@azure/msal-common 15.2.0 → 15.3.0

package/lib/{index-node-0IMDqzO0.js → index-node-BjtDFnOl.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 'use strict';
 
@@ -1149,11 +1149,22 @@ function getDeserializedResponse(responseString) {
         throw createClientAuthError(hashNotDeserialized);
     }
     return null;
+}
+/**
+ * Utility to create a URL from the params map
+ */
+function mapToQueryString(parameters) {
+    const queryParameterArray = new Array();
+    parameters.forEach((value, key) => {
+        queryParameterArray.push(`${key}=${encodeURIComponent(value)}`);
+    });
+    return queryParameterArray.join("&");
 }
 
 var UrlUtils = /*#__PURE__*/Object.freeze({
     __proto__: null,
     getDeserializedResponse: getDeserializedResponse,
+    mapToQueryString: mapToQueryString,
     stripLeadingHashOrQuery: stripLeadingHashOrQuery
 });
 
@@ -1681,11 +1692,11 @@ const PerformanceEvents = {
     StandardInteractionClientCreateAuthCodeClient: "standardInteractionClientCreateAuthCodeClient",
     StandardInteractionClientGetClientConfiguration: "standardInteractionClientGetClientConfiguration",
     StandardInteractionClientInitializeAuthorizationRequest: "standardInteractionClientInitializeAuthorizationRequest",
-    StandardInteractionClientInitializeAuthorizationCodeRequest: "standardInteractionClientInitializeAuthorizationCodeRequest",
     /**
      * getAuthCodeUrl API (msal-browser and msal-node).
      */
     GetAuthCodeUrl: "getAuthCodeUrl",
+    GetStandardParams: "getStandardParams",
     /**
      * Functions from InteractionHandler (msal-browser)
      */
@@ -1698,7 +1709,6 @@ const PerformanceEvents = {
     AuthClientAcquireToken: "authClientAcquireToken",
     AuthClientExecuteTokenRequest: "authClientExecuteTokenRequest",
     AuthClientCreateTokenRequestBody: "authClientCreateTokenRequestBody",
-    AuthClientCreateQueryString: "authClientCreateQueryString",
     /**
      * Generate functions in PopTokenGenerator (msal-common)
      */
@@ -1869,10 +1879,6 @@ const PerformanceEventAbbreviations = new Map([
         PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
         "StdIntClientInitAuthReq",
     ],
-    [
-        PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-        "StdIntClientInitAuthCodeReq",
-    ],
     [PerformanceEvents.GetAuthCodeUrl, "GetAuthCodeUrl"],
     [
         PerformanceEvents.HandleCodeResponseFromServer,
@@ -1886,10 +1892,6 @@ const PerformanceEventAbbreviations = new Map([
         PerformanceEvents.AuthClientCreateTokenRequestBody,
         "AuthClientCreateTReqBody",
     ],
-    [
-        PerformanceEvents.AuthClientCreateQueryString,
-        "AuthClientCreateQueryStr",
-    ],
     [PerformanceEvents.PopTokenGenerateCnf, "PopTGenCnf"],
     [PerformanceEvents.PopTokenGenerateKid, "PopTGenKid"],
     [PerformanceEvents.HandleServerTokenResponse, "HandleServerTRes"],
@@ -2230,6 +2232,24 @@ function nowSeconds() {
     // Date.getTime() returns in milliseconds.
     return Math.round(new Date().getTime() / 1000.0);
 }
+/**
+ * Converts JS Date object to seconds
+ * @param date Date
+ */
+function toSecondsFromDate(date) {
+    // Convert date to seconds
+    return date.getTime() / 1000;
+}
+/**
+ * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
+ * @param seconds
+ */
+function toDateFromSeconds(seconds) {
+    if (seconds) {
+        return new Date(Number(seconds) * 1000);
+    }
+    return new Date();
+}
 /**
  * check if a token is expired based on given UTC time in seconds.
  * @param expiresOn
@@ -2265,6 +2285,8 @@ var TimeUtils = /*#__PURE__*/Object.freeze({
     delay: delay,
     isTokenExpired: isTokenExpired,
     nowSeconds: nowSeconds,
+    toDateFromSeconds: toDateFromSeconds,
+    toSecondsFromDate: toSecondsFromDate,
     wasClockTurnedBack: wasClockTurnedBack
 });
 
@@ -3543,7 +3565,8 @@ const LOGIN_HINT = "login_hint";
 const DOMAIN_HINT = "domain_hint";
 const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
 const BROKER_CLIENT_ID = "brk_client_id";
-const BROKER_REDIRECT_URI = "brk_redirect_uri";
+const BROKER_REDIRECT_URI = "brk_redirect_uri";
+const INSTANCE_AWARE = "instance_aware";
 
 var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -3571,6 +3594,7 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     GRANT_TYPE: GRANT_TYPE,
     ID_TOKEN: ID_TOKEN,
     ID_TOKEN_HINT: ID_TOKEN_HINT,
+    INSTANCE_AWARE: INSTANCE_AWARE,
     LOGIN_HINT: LOGIN_HINT,
     LOGOUT_HINT: LOGOUT_HINT,
     NATIVE_BROKER: NATIVE_BROKER,
@@ -3832,7 +3856,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "15.2.0";
+const version = "15.3.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5728,71 +5752,6 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Validates server consumable params from the "request" objects
- */
-class RequestValidator {
-    /**
-     * Utility to check if the `redirectUri` in the request is a non-null value
-     * @param redirectUri
-     */
-    static validateRedirectUri(redirectUri) {
-        if (!redirectUri) {
-            throw createClientConfigurationError(redirectUriEmpty);
-        }
-    }
-    /**
-     * Utility to validate prompt sent by the user in the request
-     * @param prompt
-     */
-    static validatePrompt(prompt) {
-        const promptValues = [];
-        for (const value in PromptValue) {
-            promptValues.push(PromptValue[value]);
-        }
-        if (promptValues.indexOf(prompt) < 0) {
-            throw createClientConfigurationError(invalidPromptValue);
-        }
-    }
-    static validateClaims(claims) {
-        try {
-            JSON.parse(claims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-    }
-    /**
-     * Utility to validate code_challenge and code_challenge_method
-     * @param codeChallenge
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-        if (!codeChallenge || !codeChallengeMethod) {
-            throw createClientConfigurationError(pkceParamsMissing);
-        }
-        else {
-            this.validateCodeChallengeMethod(codeChallengeMethod);
-        }
-    }
-    /**
-     * Utility to validate code_challenge_method
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeMethod(codeChallengeMethod) {
-        if ([
-            CodeChallengeMethodValues.PLAIN,
-            CodeChallengeMethodValues.S256,
-        ].indexOf(codeChallengeMethod) < 0) {
-            throw createClientConfigurationError(invalidCodeChallengeMethod);
-        }
-    }
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5809,396 +5768,433 @@ function instrumentBrokerParams(parameters, correlationId, performanceClient) {
         }, correlationId);
     }
 }
-/** @internal */
-class RequestParameterBuilder {
-    constructor(correlationId, performanceClient) {
-        this.parameters = new Map();
-        this.performanceClient = performanceClient;
-        this.correlationId = correlationId;
-    }
-    /**
-     * add response_type = code
-     */
-    addResponseTypeCode() {
-        this.parameters.set(RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
-    }
-    /**
-     * add response_type = token id_token
-     */
-    addResponseTypeForTokenAndIdToken() {
-        this.parameters.set(RESPONSE_TYPE, encodeURIComponent(`${Constants.TOKEN_RESPONSE_TYPE} ${Constants.ID_TOKEN_RESPONSE_TYPE}`));
-    }
-    /**
-     * add response_mode. defaults to query.
-     * @param responseMode
-     */
-    addResponseMode(responseMode) {
-        this.parameters.set(RESPONSE_MODE, encodeURIComponent(responseMode ? responseMode : ResponseMode.QUERY));
-    }
-    /**
-     * Add flag to indicate STS should attempt to use WAM if available
-     */
-    addNativeBroker() {
-        this.parameters.set(NATIVE_BROKER, encodeURIComponent("1"));
-    }
-    /**
-     * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
-     * @param scopeSet
-     * @param addOidcScopes
-     */
-    addScopes(scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
-        // Always add openid to the scopes when adding OIDC scopes
-        if (addOidcScopes &&
-            !defaultScopes.includes("openid") &&
-            !scopes.includes("openid")) {
-            defaultScopes.push("openid");
-        }
-        const requestScopes = addOidcScopes
-            ? [...(scopes || []), ...defaultScopes]
-            : scopes || [];
-        const scopeSet = new ScopeSet(requestScopes);
-        this.parameters.set(SCOPE, encodeURIComponent(scopeSet.printScopes()));
+/**
+ * add response_type = code
+ */
+function addResponseTypeCode(parameters) {
+    parameters.set(RESPONSE_TYPE, Constants.CODE_RESPONSE_TYPE);
+}
+/**
+ * add response_type = token id_token
+ */
+function addResponseTypeForTokenAndIdToken(parameters) {
+    parameters.set(RESPONSE_TYPE, `${Constants.TOKEN_RESPONSE_TYPE} ${Constants.ID_TOKEN_RESPONSE_TYPE}`);
+}
+/**
+ * add response_mode. defaults to query.
+ * @param responseMode
+ */
+function addResponseMode(parameters, responseMode) {
+    parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
+}
+/**
+ * Add flag to indicate STS should attempt to use WAM if available
+ */
+function addNativeBroker(parameters) {
+    parameters.set(NATIVE_BROKER, "1");
+}
+/**
+ * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
+ * @param scopeSet
+ * @param addOidcScopes
+ */
+function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+    // Always add openid to the scopes when adding OIDC scopes
+    if (addOidcScopes &&
+        !defaultScopes.includes("openid") &&
+        !scopes.includes("openid")) {
+        defaultScopes.push("openid");
+    }
+    const requestScopes = addOidcScopes
+        ? [...(scopes || []), ...defaultScopes]
+        : scopes || [];
+    const scopeSet = new ScopeSet(requestScopes);
+    parameters.set(SCOPE, scopeSet.printScopes());
+}
+/**
+ * add clientId
+ * @param clientId
+ */
+function addClientId(parameters, clientId) {
+    parameters.set(CLIENT_ID, clientId);
+}
+/**
+ * add redirect_uri
+ * @param redirectUri
+ */
+function addRedirectUri(parameters, redirectUri) {
+    parameters.set(REDIRECT_URI, redirectUri);
+}
+/**
+ * add post logout redirectUri
+ * @param redirectUri
+ */
+function addPostLogoutRedirectUri(parameters, redirectUri) {
+    parameters.set(POST_LOGOUT_URI, redirectUri);
+}
+/**
+ * add id_token_hint to logout request
+ * @param idTokenHint
+ */
+function addIdTokenHint(parameters, idTokenHint) {
+    parameters.set(ID_TOKEN_HINT, idTokenHint);
+}
+/**
+ * add domain_hint
+ * @param domainHint
+ */
+function addDomainHint(parameters, domainHint) {
+    parameters.set(DOMAIN_HINT, domainHint);
+}
+/**
+ * add login_hint
+ * @param loginHint
+ */
+function addLoginHint(parameters, loginHint) {
+    parameters.set(LOGIN_HINT, loginHint);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for login_hint
+ * @param loginHint
+ */
+function addCcsUpn(parameters, loginHint) {
+    parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for account object
+ * @param loginHint
+ */
+function addCcsOid(parameters, clientInfo) {
+    parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
+}
+/**
+ * add sid
+ * @param sid
+ */
+function addSid(parameters, sid) {
+    parameters.set(SID, sid);
+}
+/**
+ * add claims
+ * @param claims
+ */
+function addClaims(parameters, claims, clientCapabilities) {
+    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
+    try {
+        JSON.parse(mergedClaims);
     }
-    /**
-     * add clientId
-     * @param clientId
-     */
-    addClientId(clientId) {
-        this.parameters.set(CLIENT_ID, encodeURIComponent(clientId));
+    catch (e) {
+        throw createClientConfigurationError(invalidClaims);
     }
-    /**
-     * add redirect_uri
-     * @param redirectUri
-     */
-    addRedirectUri(redirectUri) {
-        RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(REDIRECT_URI, encodeURIComponent(redirectUri));
+    parameters.set(CLAIMS, mergedClaims);
+}
+/**
+ * add correlationId
+ * @param correlationId
+ */
+function addCorrelationId(parameters, correlationId) {
+    parameters.set(CLIENT_REQUEST_ID, correlationId);
+}
+/**
+ * add library info query params
+ * @param libraryInfo
+ */
+function addLibraryInfo(parameters, libraryInfo) {
+    // Telemetry Info
+    parameters.set(X_CLIENT_SKU, libraryInfo.sku);
+    parameters.set(X_CLIENT_VER, libraryInfo.version);
+    if (libraryInfo.os) {
+        parameters.set(X_CLIENT_OS, libraryInfo.os);
     }
-    /**
-     * add post logout redirectUri
-     * @param redirectUri
-     */
-    addPostLogoutRedirectUri(redirectUri) {
-        RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(POST_LOGOUT_URI, encodeURIComponent(redirectUri));
+    if (libraryInfo.cpu) {
+        parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
     }
-    /**
-     * add id_token_hint to logout request
-     * @param idTokenHint
-     */
-    addIdTokenHint(idTokenHint) {
-        this.parameters.set(ID_TOKEN_HINT, encodeURIComponent(idTokenHint));
+}
+/**
+ * Add client telemetry parameters
+ * @param appTelemetry
+ */
+function addApplicationTelemetry(parameters, appTelemetry) {
+    if (appTelemetry?.appName) {
+        parameters.set(X_APP_NAME, appTelemetry.appName);
     }
-    /**
-     * add domain_hint
-     * @param domainHint
-     */
-    addDomainHint(domainHint) {
-        this.parameters.set(DOMAIN_HINT, encodeURIComponent(domainHint));
+    if (appTelemetry?.appVersion) {
+        parameters.set(X_APP_VER, appTelemetry.appVersion);
     }
-    /**
-     * add login_hint
-     * @param loginHint
-     */
-    addLoginHint(loginHint) {
-        this.parameters.set(LOGIN_HINT, encodeURIComponent(loginHint));
+}
+/**
+ * add prompt
+ * @param prompt
+ */
+function addPrompt(parameters, prompt) {
+    parameters.set(PROMPT, prompt);
+}
+/**
+ * add state
+ * @param state
+ */
+function addState(parameters, state) {
+    if (state) {
+        parameters.set(STATE, state);
     }
-    /**
-     * Adds the CCS (Cache Credential Service) query parameter for login_hint
-     * @param loginHint
-     */
-    addCcsUpn(loginHint) {
-        this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent(`UPN:${loginHint}`));
+}
+/**
+ * add nonce
+ * @param nonce
+ */
+function addNonce(parameters, nonce) {
+    parameters.set(NONCE, nonce);
+}
+/**
+ * add code_challenge and code_challenge_method
+ * - throw if either of them are not passed
+ * @param codeChallenge
+ * @param codeChallengeMethod
+ */
+function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
+    if (codeChallenge && codeChallengeMethod) {
+        parameters.set(CODE_CHALLENGE, codeChallenge);
+        parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
     }
-    /**
-     * Adds the CCS (Cache Credential Service) query parameter for account object
-     * @param loginHint
-     */
-    addCcsOid(clientInfo) {
-        this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent(`Oid:${clientInfo.uid}@${clientInfo.utid}`));
+    else {
+        throw createClientConfigurationError(pkceParamsMissing);
     }
-    /**
-     * add sid
-     * @param sid
-     */
-    addSid(sid) {
-        this.parameters.set(SID, encodeURIComponent(sid));
+}
+/**
+ * add the `authorization_code` passed by the user to exchange for a token
+ * @param code
+ */
+function addAuthorizationCode(parameters, code) {
+    parameters.set(CODE, code);
+}
+/**
+ * add the `authorization_code` passed by the user to exchange for a token
+ * @param code
+ */
+function addDeviceCode(parameters, code) {
+    parameters.set(DEVICE_CODE, code);
+}
+/**
+ * add the `refreshToken` passed by the user
+ * @param refreshToken
+ */
+function addRefreshToken(parameters, refreshToken) {
+    parameters.set(REFRESH_TOKEN, refreshToken);
+}
+/**
+ * add the `code_verifier` passed by the user to exchange for a token
+ * @param codeVerifier
+ */
+function addCodeVerifier(parameters, codeVerifier) {
+    parameters.set(CODE_VERIFIER, codeVerifier);
+}
+/**
+ * add client_secret
+ * @param clientSecret
+ */
+function addClientSecret(parameters, clientSecret) {
+    parameters.set(CLIENT_SECRET, clientSecret);
+}
+/**
+ * add clientAssertion for confidential client flows
+ * @param clientAssertion
+ */
+function addClientAssertion(parameters, clientAssertion) {
+    if (clientAssertion) {
+        parameters.set(CLIENT_ASSERTION, clientAssertion);
     }
-    /**
-     * add claims
-     * @param claims
-     */
-    addClaims(claims, clientCapabilities) {
-        const mergedClaims = this.addClientCapabilitiesToClaims(claims, clientCapabilities);
-        RequestValidator.validateClaims(mergedClaims);
-        this.parameters.set(CLAIMS, encodeURIComponent(mergedClaims));
+}
+/**
+ * add clientAssertionType for confidential client flows
+ * @param clientAssertionType
+ */
+function addClientAssertionType(parameters, clientAssertionType) {
+    if (clientAssertionType) {
+        parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
     }
-    /**
-     * add correlationId
-     * @param correlationId
-     */
-    addCorrelationId(correlationId) {
-        this.parameters.set(CLIENT_REQUEST_ID, encodeURIComponent(correlationId));
+}
+/**
+ * add OBO assertion for confidential client flows
+ * @param clientAssertion
+ */
+function addOboAssertion(parameters, oboAssertion) {
+    parameters.set(OBO_ASSERTION, oboAssertion);
+}
+/**
+ * add grant type
+ * @param grantType
+ */
+function addRequestTokenUse(parameters, tokenUse) {
+    parameters.set(REQUESTED_TOKEN_USE, tokenUse);
+}
+/**
+ * add grant type
+ * @param grantType
+ */
+function addGrantType(parameters, grantType) {
+    parameters.set(GRANT_TYPE, grantType);
+}
+/**
+ * add client info
+ *
+ */
+function addClientInfo(parameters) {
+    parameters.set(CLIENT_INFO$1, "1");
+}
+function addInstanceAware(parameters) {
+    if (!parameters.has(INSTANCE_AWARE)) {
+        parameters.set(INSTANCE_AWARE, "true");
     }
-    /**
-     * add library info query params
-     * @param libraryInfo
-     */
-    addLibraryInfo(libraryInfo) {
-        // Telemetry Info
-        this.parameters.set(X_CLIENT_SKU, libraryInfo.sku);
-        this.parameters.set(X_CLIENT_VER, libraryInfo.version);
-        if (libraryInfo.os) {
-            this.parameters.set(X_CLIENT_OS, libraryInfo.os);
-        }
-        if (libraryInfo.cpu) {
-            this.parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
+}
+/**
+ * add extraQueryParams
+ * @param eQParams
+ */
+function addExtraQueryParameters(parameters, eQParams) {
+    Object.entries(eQParams).forEach(([key, value]) => {
+        if (!parameters.has(key) && value) {
+            parameters.set(key, value);
         }
+    });
+}
+function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+    let mergedClaims;
+    // Parse provided claims into JSON object or initialize empty object
+    if (!claims) {
+        mergedClaims = {};
     }
-    /**
-     * Add client telemetry parameters
-     * @param appTelemetry
-     */
-    addApplicationTelemetry(appTelemetry) {
-        if (appTelemetry?.appName) {
-            this.parameters.set(X_APP_NAME, appTelemetry.appName);
+    else {
+        try {
+            mergedClaims = JSON.parse(claims);
         }
-        if (appTelemetry?.appVersion) {
-            this.parameters.set(X_APP_VER, appTelemetry.appVersion);
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
         }
     }
-    /**
-     * add prompt
-     * @param prompt
-     */
-    addPrompt(prompt) {
-        RequestValidator.validatePrompt(prompt);
-        this.parameters.set(`${PROMPT}`, encodeURIComponent(prompt));
-    }
-    /**
-     * add state
-     * @param state
-     */
-    addState(state) {
-        if (state) {
-            this.parameters.set(STATE, encodeURIComponent(state));
+    if (clientCapabilities && clientCapabilities.length > 0) {
+        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+            // Add access_token key to claims object
+            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
         }
-    }
-    /**
-     * add nonce
-     * @param nonce
-     */
-    addNonce(nonce) {
-        this.parameters.set(NONCE, encodeURIComponent(nonce));
-    }
-    /**
-     * add code_challenge and code_challenge_method
-     * - throw if either of them are not passed
-     * @param codeChallenge
-     * @param codeChallengeMethod
-     */
-    addCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-        RequestValidator.validateCodeChallengeParams(codeChallenge, codeChallengeMethod);
-        if (codeChallenge && codeChallengeMethod) {
-            this.parameters.set(CODE_CHALLENGE, encodeURIComponent(codeChallenge));
-            this.parameters.set(CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
-        }
-        else {
-            throw createClientConfigurationError(pkceParamsMissing);
-        }
-    }
-    /**
-     * add the `authorization_code` passed by the user to exchange for a token
-     * @param code
-     */
-    addAuthorizationCode(code) {
-        this.parameters.set(CODE, encodeURIComponent(code));
-    }
-    /**
-     * add the `authorization_code` passed by the user to exchange for a token
-     * @param code
-     */
-    addDeviceCode(code) {
-        this.parameters.set(DEVICE_CODE, encodeURIComponent(code));
-    }
-    /**
-     * add the `refreshToken` passed by the user
-     * @param refreshToken
-     */
-    addRefreshToken(refreshToken) {
-        this.parameters.set(REFRESH_TOKEN, encodeURIComponent(refreshToken));
-    }
-    /**
-     * add the `code_verifier` passed by the user to exchange for a token
-     * @param codeVerifier
-     */
-    addCodeVerifier(codeVerifier) {
-        this.parameters.set(CODE_VERIFIER, encodeURIComponent(codeVerifier));
-    }
-    /**
-     * add client_secret
-     * @param clientSecret
-     */
-    addClientSecret(clientSecret) {
-        this.parameters.set(CLIENT_SECRET, encodeURIComponent(clientSecret));
-    }
-    /**
-     * add clientAssertion for confidential client flows
-     * @param clientAssertion
-     */
-    addClientAssertion(clientAssertion) {
-        if (clientAssertion) {
-            this.parameters.set(CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
-        }
-    }
-    /**
-     * add clientAssertionType for confidential client flows
-     * @param clientAssertionType
-     */
-    addClientAssertionType(clientAssertionType) {
-        if (clientAssertionType) {
-            this.parameters.set(CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
-        }
-    }
-    /**
-     * add OBO assertion for confidential client flows
-     * @param clientAssertion
-     */
-    addOboAssertion(oboAssertion) {
-        this.parameters.set(OBO_ASSERTION, encodeURIComponent(oboAssertion));
-    }
-    /**
-     * add grant type
-     * @param grantType
-     */
-    addRequestTokenUse(tokenUse) {
-        this.parameters.set(REQUESTED_TOKEN_USE, encodeURIComponent(tokenUse));
-    }
-    /**
-     * add grant type
-     * @param grantType
-     */
-    addGrantType(grantType) {
-        this.parameters.set(GRANT_TYPE, encodeURIComponent(grantType));
-    }
-    /**
-     * add client info
-     *
-     */
-    addClientInfo() {
-        this.parameters.set(CLIENT_INFO$1, "1");
-    }
-    /**
-     * add extraQueryParams
-     * @param eQParams
-     */
-    addExtraQueryParameters(eQParams) {
-        Object.entries(eQParams).forEach(([key, value]) => {
-            if (!this.parameters.has(key) && value) {
-                this.parameters.set(key, value);
-            }
-        });
-    }
-    addClientCapabilitiesToClaims(claims, clientCapabilities) {
-        let mergedClaims;
-        // Parse provided claims into JSON object or initialize empty object
-        if (!claims) {
-            mergedClaims = {};
-        }
-        else {
-            try {
-                mergedClaims = JSON.parse(claims);
-            }
-            catch (e) {
-                throw createClientConfigurationError(invalidClaims);
-            }
-        }
-        if (clientCapabilities && clientCapabilities.length > 0) {
-            if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
-                // Add access_token key to claims object
-                mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
-            }
-            // Add xms_cc claim with provided clientCapabilities to access_token key
-            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] = {
+        // Add xms_cc claim with provided clientCapabilities to access_token key
+        mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
+            {
                 values: clientCapabilities,
             };
-        }
-        return JSON.stringify(mergedClaims);
     }
-    /**
-     * adds `username` for Password Grant flow
-     * @param username
-     */
-    addUsername(username) {
-        this.parameters.set(PasswordGrantConstants.username, encodeURIComponent(username));
-    }
-    /**
-     * adds `password` for Password Grant flow
-     * @param password
-     */
-    addPassword(password) {
-        this.parameters.set(PasswordGrantConstants.password, encodeURIComponent(password));
-    }
-    /**
-     * add pop_jwk to query params
-     * @param cnfString
-     */
-    addPopToken(cnfString) {
-        if (cnfString) {
-            this.parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
-            this.parameters.set(REQ_CNF, encodeURIComponent(cnfString));
-        }
-    }
-    /**
-     * add SSH JWK and key ID to query params
-     */
-    addSshJwk(sshJwkString) {
-        if (sshJwkString) {
-            this.parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
-            this.parameters.set(REQ_CNF, encodeURIComponent(sshJwkString));
-        }
-    }
-    /**
-     * add server telemetry fields
-     * @param serverTelemetryManager
-     */
-    addServerTelemetry(serverTelemetryManager) {
-        this.parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-        this.parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
-    }
-    /**
-     * Adds parameter that indicates to the server that throttling is supported
-     */
-    addThrottling() {
-        this.parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+    return JSON.stringify(mergedClaims);
+}
+/**
+ * adds `username` for Password Grant flow
+ * @param username
+ */
+function addUsername(parameters, username) {
+    parameters.set(PasswordGrantConstants.username, username);
+}
+/**
+ * adds `password` for Password Grant flow
+ * @param password
+ */
+function addPassword(parameters, password) {
+    parameters.set(PasswordGrantConstants.password, password);
+}
+/**
+ * add pop_jwk to query params
+ * @param cnfString
+ */
+function addPopToken(parameters, cnfString) {
+    if (cnfString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
+        parameters.set(REQ_CNF, cnfString);
     }
-    /**
-     * Adds logout_hint parameter for "silent" logout which prevent server account picker
-     */
-    addLogoutHint(logoutHint) {
-        this.parameters.set(LOGOUT_HINT, encodeURIComponent(logoutHint));
+}
+/**
+ * add SSH JWK and key ID to query params
+ */
+function addSshJwk(parameters, sshJwkString) {
+    if (sshJwkString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
+        parameters.set(REQ_CNF, sshJwkString);
     }
-    addBrokerParameters(params) {
-        const brokerParams = {};
-        brokerParams[BROKER_CLIENT_ID] =
-            params.brokerClientId;
-        brokerParams[BROKER_REDIRECT_URI] =
-            params.brokerRedirectUri;
-        this.addExtraQueryParameters(brokerParams);
+}
+/**
+ * add server telemetry fields
+ * @param serverTelemetryManager
+ */
+function addServerTelemetry(parameters, serverTelemetryManager) {
+    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+}
+/**
+ * Adds parameter that indicates to the server that throttling is supported
+ */
+function addThrottling(parameters) {
+    parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+}
+/**
+ * Adds logout_hint parameter for "silent" logout which prevent server account picker
+ */
+function addLogoutHint(parameters, logoutHint) {
+    parameters.set(LOGOUT_HINT, logoutHint);
+}
+function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
+    if (!parameters.has(BROKER_CLIENT_ID)) {
+        parameters.set(BROKER_CLIENT_ID, brokerClientId);
     }
-    /**
-     * Utility to create a URL from the params map
-     */
-    createQueryString() {
-        const queryParameterArray = new Array();
-        this.parameters.forEach((value, key) => {
-            queryParameterArray.push(`${key}=${value}`);
-        });
-        instrumentBrokerParams(this.parameters, this.correlationId, this.performanceClient);
-        return queryParameterArray.join("&");
+    if (!parameters.has(BROKER_REDIRECT_URI)) {
+        parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
     }
 }
 
+var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    addApplicationTelemetry: addApplicationTelemetry,
+    addAuthorizationCode: addAuthorizationCode,
+    addBrokerParameters: addBrokerParameters,
+    addCcsOid: addCcsOid,
+    addCcsUpn: addCcsUpn,
+    addClaims: addClaims,
+    addClientAssertion: addClientAssertion,
+    addClientAssertionType: addClientAssertionType,
+    addClientCapabilitiesToClaims: addClientCapabilitiesToClaims,
+    addClientId: addClientId,
+    addClientInfo: addClientInfo,
+    addClientSecret: addClientSecret,
+    addCodeChallengeParams: addCodeChallengeParams,
+    addCodeVerifier: addCodeVerifier,
+    addCorrelationId: addCorrelationId,
+    addDeviceCode: addDeviceCode,
+    addDomainHint: addDomainHint,
+    addExtraQueryParameters: addExtraQueryParameters,
+    addGrantType: addGrantType,
+    addIdTokenHint: addIdTokenHint,
+    addInstanceAware: addInstanceAware,
+    addLibraryInfo: addLibraryInfo,
+    addLoginHint: addLoginHint,
+    addLogoutHint: addLogoutHint,
+    addNativeBroker: addNativeBroker,
+    addNonce: addNonce,
+    addOboAssertion: addOboAssertion,
+    addPassword: addPassword,
+    addPopToken: addPopToken,
+    addPostLogoutRedirectUri: addPostLogoutRedirectUri,
+    addPrompt: addPrompt,
+    addRedirectUri: addRedirectUri,
+    addRefreshToken: addRefreshToken,
+    addRequestTokenUse: addRequestTokenUse,
+    addResponseMode: addResponseMode,
+    addResponseTypeCode: addResponseTypeCode,
+    addResponseTypeForTokenAndIdToken: addResponseTypeForTokenAndIdToken,
+    addScopes: addScopes,
+    addServerTelemetry: addServerTelemetry,
+    addSid: addSid,
+    addSshJwk: addSshJwk,
+    addState: addState,
+    addThrottling: addThrottling,
+    addUsername: addUsername,
+    instrumentBrokerParams: instrumentBrokerParams
+});
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6216,6 +6212,26 @@ class ServerError extends AuthError {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function getRequestThumbprint(clientId, request, homeAccountId) {
+    return {
+        clientId: clientId,
+        authority: request.authority,
+        scopes: request.scopes,
+        homeAccountIdentifier: homeAccountId,
+        claims: request.claims,
+        authenticationScheme: request.authenticationScheme,
+        resourceRequestMethod: request.resourceRequestMethod,
+        resourceRequestUri: request.resourceRequestUri,
+        shrClaims: request.shrClaims,
+        sshKid: request.sshKid,
+        embeddedClientId: request.embeddedClientId || request.tokenBodyParameters?.clientId,
+    };
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6295,18 +6311,7 @@ class ThrottlingUtils {
             ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
     }
     static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
-        const thumbprint = {
-            clientId: clientId,
-            authority: request.authority,
-            scopes: request.scopes,
-            homeAccountIdentifier: homeAccountIdentifier,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-        };
+        const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
         const key = this.generateThrottlingStorageKey(thumbprint);
         cacheManager.removeItem(key);
     }
@@ -6473,18 +6478,16 @@ class BaseClient {
      * @param request
      */
     createTokenQueryParameters(request) {
-        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+        const parameters = new Map();
         if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
         }
         if (request.tokenQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);
+            addExtraQueryParameters(parameters, request.tokenQueryParameters);
         }
-        parameterBuilder.addCorrelationId(request.correlationId);
-        return parameterBuilder.createQueryString();
+        addCorrelationId(parameters, request.correlationId);
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
     }
 }
 
@@ -6781,13 +6784,6 @@ class PopTokenGenerator {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-function parseServerErrorNo(serverResponse) {
-    const errorCodePrefix = "code=";
-    const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
-    return errorCodePrefixIndex && errorCodePrefixIndex >= 0
-        ? serverResponse.error_uri?.substring(errorCodePrefixIndex + errorCodePrefix.length)
-        : undefined;
-}
 /**
  * Class that handles response parsing.
  * @internal
@@ -6802,46 +6798,6 @@ class ResponseHandler {
         this.persistencePlugin = persistencePlugin;
         this.performanceClient = performanceClient;
     }
-    /**
-     * Function which validates server authorization code response.
-     * @param serverResponseHash
-     * @param requestState
-     * @param cryptoObj
-     */
-    validateServerAuthorizationCodeResponse(serverResponse, requestState) {
-        if (!serverResponse.state || !requestState) {
-            throw serverResponse.state
-                ? createClientAuthError(stateNotFound, "Cached State")
-                : createClientAuthError(stateNotFound, "Server State");
-        }
-        let decodedServerResponseState;
-        let decodedRequestState;
-        try {
-            decodedServerResponseState = decodeURIComponent(serverResponse.state);
-        }
-        catch (e) {
-            throw createClientAuthError(invalidState, serverResponse.state);
-        }
-        try {
-            decodedRequestState = decodeURIComponent(requestState);
-        }
-        catch (e) {
-            throw createClientAuthError(invalidState, serverResponse.state);
-        }
-        if (decodedServerResponseState !== decodedRequestState) {
-            throw createClientAuthError(stateMismatch);
-        }
-        // Check for error
-        if (serverResponse.error ||
-            serverResponse.error_description ||
-            serverResponse.suberror) {
-            const serverErrorNo = parseServerErrorNo(serverResponse);
-            if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-                throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
-            }
-            throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
-        }
-    }
     /**
      * Function which validates server authorization token response.
      * @param serverResponse
@@ -7067,10 +7023,11 @@ class ResponseHandler {
                 accessToken = cacheRecord.accessToken.secret;
             }
             responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
-            expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
-            extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+            // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
+            expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
+            extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
             if (cacheRecord.accessToken.refreshOn) {
-                refreshOn = new Date(Number(cacheRecord.accessToken.refreshOn) * 1000);
+                refreshOn = toDateFromSeconds(cacheRecord.accessToken.refreshOn);
             }
         }
         if (cacheRecord.appMetadata) {
@@ -7152,6 +7109,71 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Validates server consumable params from the "request" objects
+ */
+class RequestValidator {
+    /**
+     * Utility to check if the `redirectUri` in the request is a non-null value
+     * @param redirectUri
+     */
+    static validateRedirectUri(redirectUri) {
+        if (!redirectUri) {
+            throw createClientConfigurationError(redirectUriEmpty);
+        }
+    }
+    /**
+     * Utility to validate prompt sent by the user in the request
+     * @param prompt
+     */
+    static validatePrompt(prompt) {
+        const promptValues = [];
+        for (const value in PromptValue) {
+            promptValues.push(PromptValue[value]);
+        }
+        if (promptValues.indexOf(prompt) < 0) {
+            throw createClientConfigurationError(invalidPromptValue);
+        }
+    }
+    static validateClaims(claims) {
+        try {
+            JSON.parse(claims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+    }
+    /**
+     * Utility to validate code_challenge and code_challenge_method
+     * @param codeChallenge
+     * @param codeChallengeMethod
+     */
+    static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
+        if (!codeChallenge || !codeChallengeMethod) {
+            throw createClientConfigurationError(pkceParamsMissing);
+        }
+        else {
+            this.validateCodeChallengeMethod(codeChallengeMethod);
+        }
+    }
+    /**
+     * Utility to validate code_challenge_method
+     * @param codeChallengeMethod
+     */
+    static validateCodeChallengeMethod(codeChallengeMethod) {
+        if ([
+            CodeChallengeMethodValues.PLAIN,
+            CodeChallengeMethodValues.S256,
+        ].indexOf(codeChallengeMethod) < 0) {
+            throw createClientConfigurationError(invalidCodeChallengeMethod);
+        }
+    }
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7190,21 +7212,6 @@ class AuthorizationCodeClient extends BaseClient {
         this.oidcDefaultScopes =
             this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
     }
-    /**
-     * Creates the URL of the authorization request letting the user input credentials and consent to the
-     * application. The URL target the /authorize endpoint of the authority configured in the
-     * application object.
-     *
-     * Once the user inputs their credentials and consents, the authority will send a response to the redirect URI
-     * sent in the request and should contain an authorization code, which can then be used to acquire tokens via
-     * acquireToken(AuthorizationCodeRequest)
-     * @param request
-     */
-    async getAuthCodeUrl(request) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.GetAuthCodeUrl, request.correlationId);
-        const queryString = await invokeAsync(this.createAuthCodeUrlQueryString.bind(this), PerformanceEvents.AuthClientCreateQueryString, this.logger, this.performanceClient, request.correlationId)(request);
-        return UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString);
-    }
     /**
      * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
      * authorization_code_grant
@@ -7224,22 +7231,6 @@ class AuthorizationCodeClient extends BaseClient {
         responseHandler.validateTokenResponse(response.body);
         return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId);
     }
-    /**
-     * Handles the hash fragment response from public client code request. Returns a code response used by
-     * the client to exchange for a token in acquireToken.
-     * @param hashFragment
-     */
-    handleFragmentResponse(serverParams, cachedState) {
-        // Handle responses.
-        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);
-        // Get code response
-        responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState);
-        // throw when there is no auth code in the response
-        if (!serverParams.code) {
-            throw createClientAuthError(authorizationCodeMissingFromServerResponse);
-        }
-        return serverParams;
-    }
     /**
      * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
      * Default behaviour is to redirect the user to `window.location.href`.
@@ -7278,18 +7269,7 @@ class AuthorizationCodeClient extends BaseClient {
             }
         }
         const headers = this.createTokenRequestHeaders(ccsCredential || request.ccsCredential);
-        const thumbprint = {
-            clientId: request.tokenBodyParameters?.clientId ||
-                this.config.authOptions.clientId,
-            authority: authority.canonicalAuthority,
-            scopes: request.scopes,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-        };
+        const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
         return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint);
     }
     /**
@@ -7298,8 +7278,8 @@ class AuthorizationCodeClient extends BaseClient {
      */
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);
-        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
-        parameterBuilder.addClientId(request.embeddedClientId ||
+        const parameters = new Map();
+        addClientId(parameters, request.embeddedClientId ||
             request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         /*
@@ -7312,33 +7292,33 @@ class AuthorizationCodeClient extends BaseClient {
         }
         else {
             // Validate and include redirect uri
-            parameterBuilder.addRedirectUri(request.redirectUri);
+            addRedirectUri(parameters, request.redirectUri);
         }
         // Add scope array, parameter builder will add default scopes and dedupe
-        parameterBuilder.addScopes(request.scopes, true, this.oidcDefaultScopes);
+        addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
         // add code: user set, not validated
-        parameterBuilder.addAuthorizationCode(request.code);
+        addAuthorizationCode(parameters, request.code);
         // Add library metadata
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        parameterBuilder.addThrottling();
+        addLibraryInfo(parameters, this.config.libraryInfo);
+        addApplicationTelemetry(parameters, this.config.telemetry.application);
+        addThrottling(parameters);
         if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
-            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
+            addServerTelemetry(parameters, this.serverTelemetryManager);
         }
         // add code_verifier if passed
         if (request.codeVerifier) {
-            parameterBuilder.addCodeVerifier(request.codeVerifier);
+            addCodeVerifier(parameters, request.codeVerifier);
         }
         if (this.config.clientCredentials.clientSecret) {
-            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
+            addClientSecret(parameters, this.config.clientCredentials.clientSecret);
         }
         if (this.config.clientCredentials.clientAssertion) {
             const clientAssertion = this.config.clientCredentials.clientAssertion;
-            parameterBuilder.addClientAssertion(await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
-            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+            addClientAssertionType(parameters, clientAssertion.assertionType);
         }
-        parameterBuilder.addGrantType(GrantType.AUTHORIZATION_CODE_GRANT);
-        parameterBuilder.addClientInfo();
+        addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
+        addClientInfo(parameters);
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
             let reqCnfData;
@@ -7350,11 +7330,11 @@ class AuthorizationCodeClient extends BaseClient {
                 reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
             }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData);
+            addPopToken(parameters, reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
-                parameterBuilder.addSshJwk(request.sshJwk);
+                addSshJwk(parameters, request.sshJwk);
             }
             else {
                 throw createClientConfigurationError(missingSshJwk);
@@ -7363,7 +7343,7 @@ class AuthorizationCodeClient extends BaseClient {
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
         }
         let ccsCred = undefined;
         if (request.clientInfo) {
@@ -7387,7 +7367,7 @@ class AuthorizationCodeClient extends BaseClient {
                 case CcsCredentialType.HOME_ACCOUNT_ID:
                     try {
                         const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
-                        parameterBuilder.addCcsOid(clientInfo);
+                        addCcsOid(parameters, clientInfo);
                     }
                     catch (e) {
                         this.logger.verbose("Could not parse home account ID for CCS Header: " +
@@ -7395,230 +7375,55 @@ class AuthorizationCodeClient extends BaseClient {
                     }
                     break;
                 case CcsCredentialType.UPN:
-                    parameterBuilder.addCcsUpn(ccsCred.credential);
+                    addCcsUpn(parameters, ccsCred.credential);
                     break;
             }
         }
         if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
         }
         if (request.tokenBodyParameters) {
-            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+            addExtraQueryParameters(parameters, request.tokenBodyParameters);
         }
         // Add hybrid spa parameters if not already provided
         if (request.enableSpaAuthorizationCode &&
             (!request.tokenBodyParameters ||
                 !request.tokenBodyParameters[RETURN_SPA_CODE])) {
-            parameterBuilder.addExtraQueryParameters({
+            addExtraQueryParameters(parameters, {
                 [RETURN_SPA_CODE]: "1",
             });
         }
-        return parameterBuilder.createQueryString();
-    }
-    /**
-     * This API validates the `AuthorizationCodeUrlRequest` and creates a URL
-     * @param request
-     */
-    async createAuthCodeUrlQueryString(request) {
-        // generate the correlationId if not set by the user and add
-        const correlationId = request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, correlationId);
-        const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
-        parameterBuilder.addClientId(request.embeddedClientId ||
-            request.extraQueryParameters?.[CLIENT_ID] ||
-            this.config.authOptions.clientId);
-        const requestScopes = [
-            ...(request.scopes || []),
-            ...(request.extraScopesToConsent || []),
-        ];
-        parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);
-        // validate the redirectUri (to be a non null value)
-        parameterBuilder.addRedirectUri(request.redirectUri);
-        parameterBuilder.addCorrelationId(correlationId);
-        // add response_mode. If not passed in it defaults to query.
-        parameterBuilder.addResponseMode(request.responseMode);
-        // add response_type = code
-        parameterBuilder.addResponseTypeCode();
-        // add library info parameters
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        if (!isOidcProtocolMode(this.config)) {
-            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        }
-        // add client_info=1
-        parameterBuilder.addClientInfo();
-        if (request.codeChallenge && request.codeChallengeMethod) {
-            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
-        }
-        if (request.prompt) {
-            parameterBuilder.addPrompt(request.prompt);
-        }
-        if (request.domainHint) {
-            parameterBuilder.addDomainHint(request.domainHint);
-            this.performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
-        }
-        this.performanceClient?.addFields({ prompt: request.prompt }, correlationId);
-        // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
-        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
-            // AAD will throw if prompt=select_account is passed with an account hint
-            if (request.sid && request.prompt === PromptValue.NONE) {
-                // SessionID is only used in silent calls
-                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
-                parameterBuilder.addSid(request.sid);
-                this.performanceClient?.addFields({ sidFromRequest: true }, correlationId);
-            }
-            else if (request.account) {
-                const accountSid = this.extractAccountSid(request.account);
-                let accountLoginHintClaim = this.extractLoginHint(request.account);
-                if (accountLoginHintClaim && request.domainHint) {
-                    this.logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`);
-                    accountLoginHintClaim = null;
-                }
-                // If login_hint claim is present, use it over sid/username
-                if (accountLoginHintClaim) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
-                    parameterBuilder.addLoginHint(accountLoginHintClaim);
-                    this.performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                    }
-                }
-                else if (accountSid && request.prompt === PromptValue.NONE) {
-                    /*
-                     * If account and loginHint are provided, we will check account first for sid before adding loginHint
-                     * SessionId is only used in silent calls
-                     */
-                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
-                    parameterBuilder.addSid(accountSid);
-                    this.performanceClient?.addFields({ sidFromClaim: true }, correlationId);
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                    }
-                }
-                else if (request.loginHint) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
-                    parameterBuilder.addLoginHint(request.loginHint);
-                    parameterBuilder.addCcsUpn(request.loginHint);
-                    this.performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
-                }
-                else if (request.account.username) {
-                    // Fallback to account username if provided
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
-                    parameterBuilder.addLoginHint(request.account.username);
-                    this.performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                    }
-                }
-            }
-            else if (request.loginHint) {
-                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
-                parameterBuilder.addLoginHint(request.loginHint);
-                parameterBuilder.addCcsUpn(request.loginHint);
-                this.performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
-            }
-        }
-        else {
-            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
-        }
-        if (request.nonce) {
-            parameterBuilder.addNonce(request.nonce);
-        }
-        if (request.state) {
-            parameterBuilder.addState(request.state);
-        }
-        if (request.claims ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
-        }
-        if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
-        }
-        this.addExtraQueryParams(request, parameterBuilder);
-        if (request.platformBroker) {
-            // signal ests that this is a WAM call
-            parameterBuilder.addNativeBroker();
-            // pass the req_cnf for POP
-            if (request.authenticationScheme === AuthenticationScheme.POP) {
-                const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                // req_cnf is always sent as a string for SPAs
-                let reqCnfData;
-                if (!request.popKid) {
-                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                    reqCnfData = generatedReqCnfData.reqCnfString;
-                }
-                else {
-                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
-                }
-                parameterBuilder.addPopToken(reqCnfData);
-            }
-        }
-        return parameterBuilder.createQueryString();
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
     }
     /**
      * This API validates the `EndSessionRequest` and creates a URL
      * @param request
      */
     createLogoutUrlQueryString(request) {
-        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+        const parameters = new Map();
         if (request.postLogoutRedirectUri) {
-            parameterBuilder.addPostLogoutRedirectUri(request.postLogoutRedirectUri);
+            addPostLogoutRedirectUri(parameters, request.postLogoutRedirectUri);
         }
         if (request.correlationId) {
-            parameterBuilder.addCorrelationId(request.correlationId);
+            addCorrelationId(parameters, request.correlationId);
         }
         if (request.idTokenHint) {
-            parameterBuilder.addIdTokenHint(request.idTokenHint);
+            addIdTokenHint(parameters, request.idTokenHint);
         }
         if (request.state) {
-            parameterBuilder.addState(request.state);
+            addState(parameters, request.state);
         }
         if (request.logoutHint) {
-            parameterBuilder.addLogoutHint(request.logoutHint);
-        }
-        this.addExtraQueryParams(request, parameterBuilder);
-        return parameterBuilder.createQueryString();
-    }
-    addExtraQueryParams(request, parameterBuilder) {
-        const hasRequestInstanceAware = request.extraQueryParameters &&
-            request.extraQueryParameters.hasOwnProperty("instance_aware");
-        // Set instance_aware flag if config auth param is set
-        if (!hasRequestInstanceAware && this.config.authOptions.instanceAware) {
-            request.extraQueryParameters = request.extraQueryParameters || {};
-            request.extraQueryParameters["instance_aware"] = "true";
+            addLogoutHint(parameters, request.logoutHint);
         }
         if (request.extraQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+            addExtraQueryParameters(parameters, request.extraQueryParameters);
         }
-    }
-    /**
-     * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
-     * @param account
-     */
-    extractAccountSid(account) {
-        return account.idTokenClaims?.sid || null;
-    }
-    extractLoginHint(account) {
-        return account.idTokenClaims?.login_hint || null;
+        if (this.config.authOptions.instanceAware) {
+            addInstanceAware(parameters);
+        }
+        return mapToQueryString(parameters);
     }
 }
 
@@ -7740,18 +7545,7 @@ class RefreshTokenClient extends BaseClient {
         const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
         const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
         const headers = this.createTokenRequestHeaders(request.ccsCredential);
-        const thumbprint = {
-            clientId: request.tokenBodyParameters?.clientId ||
-                this.config.authOptions.clientId,
-            authority: authority.canonicalAuthority,
-            scopes: request.scopes,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-        };
+        const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
         return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint);
     }
     /**
@@ -7760,31 +7554,30 @@ class RefreshTokenClient extends BaseClient {
      */
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);
-        const correlationId = request.correlationId;
-        const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
-        parameterBuilder.addClientId(request.embeddedClientId ||
+        const parameters = new Map();
+        addClientId(parameters, request.embeddedClientId ||
             request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         if (request.redirectUri) {
-            parameterBuilder.addRedirectUri(request.redirectUri);
-        }
-        parameterBuilder.addScopes(request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
-        parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
-        parameterBuilder.addClientInfo();
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        parameterBuilder.addThrottling();
+            addRedirectUri(parameters, request.redirectUri);
+        }
+        addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
+        addClientInfo(parameters);
+        addLibraryInfo(parameters, this.config.libraryInfo);
+        addApplicationTelemetry(parameters, this.config.telemetry.application);
+        addThrottling(parameters);
         if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
-            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
+            addServerTelemetry(parameters, this.serverTelemetryManager);
         }
-        parameterBuilder.addRefreshToken(request.refreshToken);
+        addRefreshToken(parameters, request.refreshToken);
         if (this.config.clientCredentials.clientSecret) {
-            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
+            addClientSecret(parameters, this.config.clientCredentials.clientSecret);
         }
         if (this.config.clientCredentials.clientAssertion) {
             const clientAssertion = this.config.clientCredentials.clientAssertion;
-            parameterBuilder.addClientAssertion(await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
-            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+            addClientAssertionType(parameters, clientAssertion.assertionType);
         }
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
@@ -7797,11 +7590,11 @@ class RefreshTokenClient extends BaseClient {
                 reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
             }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData);
+            addPopToken(parameters, reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
-                parameterBuilder.addSshJwk(request.sshJwk);
+                addSshJwk(parameters, request.sshJwk);
             }
             else {
                 throw createClientConfigurationError(missingSshJwk);
@@ -7810,7 +7603,7 @@ class RefreshTokenClient extends BaseClient {
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
         }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
@@ -7818,7 +7611,7 @@ class RefreshTokenClient extends BaseClient {
                 case CcsCredentialType.HOME_ACCOUNT_ID:
                     try {
                         const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);
-                        parameterBuilder.addCcsOid(clientInfo);
+                        addCcsOid(parameters, clientInfo);
                     }
                     catch (e) {
                         this.logger.verbose("Could not parse home account ID for CCS Header: " +
@@ -7826,20 +7619,18 @@ class RefreshTokenClient extends BaseClient {
                     }
                     break;
                 case CcsCredentialType.UPN:
-                    parameterBuilder.addCcsUpn(request.ccsCredential.credential);
+                    addCcsUpn(parameters, request.ccsCredential.credential);
                     break;
             }
         }
         if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
         }
         if (request.tokenBodyParameters) {
-            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+            addExtraQueryParameters(parameters, request.tokenBodyParameters);
         }
-        return parameterBuilder.createQueryString();
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
     }
 }
 
@@ -7952,6 +7743,236 @@ const StubbedNetworkModule = {
     },
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+ * @param config
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
+    // generate the correlationId if not set by the user and add
+    const correlationId = request.correlationId;
+    const parameters = new Map();
+    addClientId(parameters, request.embeddedClientId ||
+        request.extraQueryParameters?.[CLIENT_ID] ||
+        authOptions.clientId);
+    const requestScopes = [
+        ...(request.scopes || []),
+        ...(request.extraScopesToConsent || []),
+    ];
+    addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addRedirectUri(parameters, request.redirectUri);
+    addCorrelationId(parameters, correlationId);
+    // add response_mode. If not passed in it defaults to query.
+    addResponseMode(parameters, request.responseMode);
+    // add client_info=1
+    addClientInfo(parameters);
+    if (request.prompt) {
+        addPrompt(parameters, request.prompt);
+        performanceClient?.addFields({ prompt: request.prompt }, correlationId);
+    }
+    if (request.domainHint) {
+        addDomainHint(parameters, request.domainHint);
+        performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
+    }
+    // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
+    if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+        // AAD will throw if prompt=select_account is passed with an account hint
+        if (request.sid && request.prompt === PromptValue.NONE) {
+            // SessionID is only used in silent calls
+            logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
+            addSid(parameters, request.sid);
+            performanceClient?.addFields({ sidFromRequest: true }, correlationId);
+        }
+        else if (request.account) {
+            const accountSid = extractAccountSid(request.account);
+            let accountLoginHintClaim = extractLoginHint(request.account);
+            if (accountLoginHintClaim && request.domainHint) {
+                logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`);
+                accountLoginHintClaim = null;
+            }
+            // If login_hint claim is present, use it over sid/username
+            if (accountLoginHintClaim) {
+                logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
+                addLoginHint(parameters, accountLoginHintClaim);
+                performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                }
+            }
+            else if (accountSid && request.prompt === PromptValue.NONE) {
+                /*
+                 * If account and loginHint are provided, we will check account first for sid before adding loginHint
+                 * SessionId is only used in silent calls
+                 */
+                logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
+                addSid(parameters, accountSid);
+                performanceClient?.addFields({ sidFromClaim: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                }
+            }
+            else if (request.loginHint) {
+                logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
+                addLoginHint(parameters, request.loginHint);
+                addCcsUpn(parameters, request.loginHint);
+                performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
+            }
+            else if (request.account.username) {
+                // Fallback to account username if provided
+                logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
+                addLoginHint(parameters, request.account.username);
+                performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                }
+            }
+        }
+        else if (request.loginHint) {
+            logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
+            addLoginHint(parameters, request.loginHint);
+            addCcsUpn(parameters, request.loginHint);
+            performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
+        }
+    }
+    else {
+        logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
+    }
+    if (request.nonce) {
+        addNonce(parameters, request.nonce);
+    }
+    if (request.state) {
+        addState(parameters, request.state);
+    }
+    if (request.claims ||
+        (authOptions.clientCapabilities &&
+            authOptions.clientCapabilities.length > 0)) {
+        addClaims(parameters, request.claims, authOptions.clientCapabilities);
+    }
+    if (request.embeddedClientId) {
+        addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
+    }
+    if (request.extraQueryParameters) {
+        addExtraQueryParameters(parameters, request.extraQueryParameters);
+    }
+    if (authOptions.instanceAware) {
+        addInstanceAware(parameters);
+    }
+    return parameters;
+}
+/**
+ * Returns authorize endpoint with given request parameters in the query string
+ * @param authority
+ * @param requestParameters
+ * @returns
+ */
+function getAuthorizeUrl(authority, requestParameters) {
+    const queryString = mapToQueryString(requestParameters);
+    return UrlString.appendQueryString(authority.authorizationEndpoint, queryString);
+}
+/**
+ * Handles the hash fragment response from public client code request. Returns a code response used by
+ * the client to exchange for a token in acquireToken.
+ * @param serverParams
+ * @param cachedState
+ */
+function getAuthorizationCodePayload(serverParams, cachedState) {
+    // Get code response
+    validateAuthorizationResponse(serverParams, cachedState);
+    // throw when there is no auth code in the response
+    if (!serverParams.code) {
+        throw createClientAuthError(authorizationCodeMissingFromServerResponse);
+    }
+    return serverParams;
+}
+/**
+ * Function which validates server authorization code response.
+ * @param serverResponseHash
+ * @param requestState
+ */
+function validateAuthorizationResponse(serverResponse, requestState) {
+    if (!serverResponse.state || !requestState) {
+        throw serverResponse.state
+            ? createClientAuthError(stateNotFound, "Cached State")
+            : createClientAuthError(stateNotFound, "Server State");
+    }
+    let decodedServerResponseState;
+    let decodedRequestState;
+    try {
+        decodedServerResponseState = decodeURIComponent(serverResponse.state);
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState, serverResponse.state);
+    }
+    try {
+        decodedRequestState = decodeURIComponent(requestState);
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState, serverResponse.state);
+    }
+    if (decodedServerResponseState !== decodedRequestState) {
+        throw createClientAuthError(stateMismatch);
+    }
+    // Check for error
+    if (serverResponse.error ||
+        serverResponse.error_description ||
+        serverResponse.suberror) {
+        const serverErrorNo = parseServerErrorNo(serverResponse);
+        if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
+            throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+        }
+        throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
+    }
+}
+/**
+ * Get server error No from the error_uri
+ * @param serverResponse
+ * @returns
+ */
+function parseServerErrorNo(serverResponse) {
+    const errorCodePrefix = "code=";
+    const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
+    return errorCodePrefixIndex && errorCodePrefixIndex >= 0
+        ? serverResponse.error_uri?.substring(errorCodePrefixIndex + errorCodePrefix.length)
+        : undefined;
+}
+/**
+ * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
+ * @param account
+ */
+function extractAccountSid(account) {
+    return account.idTokenClaims?.sid || null;
+}
+function extractLoginHint(account) {
+    return account.idTokenClaims?.login_hint || null;
+}
+
+var Authorize = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    getAuthorizationCodePayload: getAuthorizationCodePayload,
+    getAuthorizeUrl: getAuthorizeUrl,
+    getStandardAuthorizeRequestParameters: getStandardAuthorizeRequestParameters,
+    validateAuthorizationResponse: validateAuthorizationResponse
+});
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8282,6 +8303,7 @@ exports.Authority = Authority;
 exports.AuthorityFactory = AuthorityFactory;
 exports.AuthorityType = AuthorityType;
 exports.AuthorizationCodeClient = AuthorizationCodeClient;
+exports.Authorize = Authorize;
 exports.AzureCloudInstance = AzureCloudInstance;
 exports.BaseClient = BaseClient;
 exports.CacheAccountType = CacheAccountType;
@@ -8359,10 +8381,11 @@ exports.createInteractionRequiredAuthError = createInteractionRequiredAuthError;
 exports.createNetworkError = createNetworkError;
 exports.formatAuthorityUri = formatAuthorityUri;
 exports.getClientAssertion = getClientAssertion;
+exports.getRequestThumbprint = getRequestThumbprint;
 exports.getTenantIdFromIdTokenClaims = getTenantIdFromIdTokenClaims;
 exports.invoke = invoke;
 exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-0IMDqzO0.js.map
+//# sourceMappingURL=index-node-BjtDFnOl.js.map