@azure/msal-common 16.0.0-beta.0 → 16.0.2

package/dist-browser/account/AccountInfo.d.ts

@@ -0,0 +1,71 @@
+import { TokenClaims } from "./TokenClaims.js";
+export type DataBoundary = "EU" | "None";
+/**
+ * Account object with the following signature:
+ * - homeAccountId          - Home account identifier for this account object
+ * - environment            - Entity which issued the token represented by the domain of the issuer (e.g. login.microsoftonline.com)
+ * - tenantId               - Full tenant or organizational id that this account belongs to
+ * - username               - preferred_username claim of the id_token that represents this account
+ * - localAccountId         - Local, tenant-specific account identifer for this account object, usually used in legacy cases
+ * - name                   - Full name for the account, including given name and family name
+ * - idToken                - raw ID token
+ * - idTokenClaims          - Object contains claims from ID token
+ * - nativeAccountId        - The user's native account ID
+ * - tenantProfiles         - Map of tenant profile objects for each tenant that the account has authenticated with in the browser
+ * - dataBoundary           - Data boundary extracted from clientInfo
+ */
+export type AccountInfo = {
+    homeAccountId: string;
+    environment: string;
+    tenantId: string;
+    username: string;
+    localAccountId: string;
+    loginHint?: string;
+    name?: string;
+    idToken?: string;
+    idTokenClaims?: TokenClaims & {
+        [key: string]: string | number | string[] | object | undefined | unknown;
+    };
+    nativeAccountId?: string;
+    authorityType?: string;
+    tenantProfiles?: Map<string, TenantProfile>;
+    dataBoundary?: DataBoundary;
+};
+/**
+ * Account details that vary across tenants for the same user
+ */
+export type TenantProfile = Pick<AccountInfo, "tenantId" | "localAccountId" | "name" | "username" | "loginHint"> & {
+    /**
+     * - isHomeTenant           - True if this is the home tenant profile of the account, false if it's a guest tenant profile
+     */
+    isHomeTenant?: boolean;
+};
+export type ActiveAccountFilters = {
+    homeAccountId: string;
+    localAccountId: string;
+    tenantId?: string;
+};
+/**
+ * Returns true if tenantId matches the utid portion of homeAccountId
+ * @param tenantId
+ * @param homeAccountId
+ * @returns
+ */
+export declare function tenantIdMatchesHomeTenant(tenantId?: string, homeAccountId?: string): boolean;
+/**
+ * Build tenant profile
+ * @param homeAccountId - Home account identifier for this account object
+ * @param localAccountId - Local account identifer for this account object
+ * @param tenantId - Full tenant or organizational id that this account belongs to
+ * @param idTokenClaims - Claims from the ID token
+ * @returns
+ */
+export declare function buildTenantProfile(homeAccountId: string, localAccountId: string, tenantId: string, idTokenClaims?: TokenClaims): TenantProfile;
+/**
+ * Replaces account info that varies by tenant profile sourced from the ID token claims passed in with the tenant-specific account info
+ * @param baseAccountInfo
+ * @param idTokenClaims
+ * @returns
+ */
+export declare function updateAccountTenantProfileData(baseAccountInfo: AccountInfo, tenantProfile?: TenantProfile, idTokenClaims?: TokenClaims, idTokenSecret?: string): AccountInfo;
+//# sourceMappingURL=AccountInfo.d.ts.map

package/dist-browser/account/AccountInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountInfo.d.ts","sourceRoot":"","sources":["../../src/account/AccountInfo.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,MAAM,CAAC;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,GAAG;QAC1B,CAAC,GAAG,EAAE,MAAM,GACN,MAAM,GACN,MAAM,GACN,MAAM,EAAE,GACR,MAAM,GACN,SAAS,GACT,OAAO,CAAC;KACjB,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC5B,WAAW,EACX,UAAU,GAAG,gBAAgB,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,CACpE,GAAG;IACA;;OAEG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACrC,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACvB,OAAO,CAMT;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAC9B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,WAAW,GAC5B,aAAa,CAsCf;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC1C,eAAe,EAAE,WAAW,EAC5B,aAAa,CAAC,EAAE,aAAa,EAC7B,aAAa,CAAC,EAAE,WAAW,EAC3B,aAAa,CAAC,EAAE,MAAM,GACvB,WAAW,CAgCb"}

package/dist-browser/account/AccountInfo.mjs

@@ -0,0 +1,85 @@
+/*! @azure/msal-common v16.0.2 2026-01-17 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns true if tenantId matches the utid portion of homeAccountId
+ * @param tenantId
+ * @param homeAccountId
+ * @returns
+ */
+function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
+    return (!!tenantId &&
+        !!homeAccountId &&
+        tenantId === homeAccountId.split(".")[1]);
+}
+/**
+ * Build tenant profile
+ * @param homeAccountId - Home account identifier for this account object
+ * @param localAccountId - Local account identifer for this account object
+ * @param tenantId - Full tenant or organizational id that this account belongs to
+ * @param idTokenClaims - Claims from the ID token
+ * @returns
+ */
+function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
+    if (idTokenClaims) {
+        const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint, } = idTokenClaims;
+        /**
+         * Since there is no way to determine if the authority is AAD or B2C, we exhaust all the possible claims that can serve as tenant ID with the following precedence:
+         * tid - TenantID claim that identifies the tenant that issued the token in AAD. Expected in all AAD ID tokens, not present in B2C ID Tokens.
+         * tfp - Trust Framework Policy claim that identifies the policy that was used to authenticate the user. Functions as tenant for B2C scenarios.
+         * acr - Authentication Context Class Reference claim used only with older B2C policies. Fallback in case tfp is not present, but likely won't be present anyway.
+         */
+        const tenantId = tid || tfp || acr || "";
+        return {
+            tenantId: tenantId,
+            localAccountId: oid || sub || "",
+            name: name,
+            username: preferred_username || upn || "",
+            loginHint: login_hint,
+            isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+        };
+    }
+    else {
+        return {
+            tenantId,
+            localAccountId,
+            username: "",
+            isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+        };
+    }
+}
+/**
+ * Replaces account info that varies by tenant profile sourced from the ID token claims passed in with the tenant-specific account info
+ * @param baseAccountInfo
+ * @param idTokenClaims
+ * @returns
+ */
+function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims, idTokenSecret) {
+    let updatedAccountInfo = baseAccountInfo;
+    // Tenant Profile overrides passed in account info
+    if (tenantProfile) {
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { isHomeTenant, ...tenantProfileOverride } = tenantProfile;
+        updatedAccountInfo = { ...baseAccountInfo, ...tenantProfileOverride };
+    }
+    // ID token claims override passed in account info and tenant profile
+    if (idTokenClaims) {
+        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
+        updatedAccountInfo = {
+            ...updatedAccountInfo,
+            ...claimsSourcedTenantProfile,
+            idTokenClaims: idTokenClaims,
+            idToken: idTokenSecret,
+        };
+        return updatedAccountInfo;
+    }
+    return updatedAccountInfo;
+}
+
+export { buildTenantProfile, tenantIdMatchesHomeTenant, updateAccountTenantProfileData };
+//# sourceMappingURL=AccountInfo.mjs.map

package/dist-browser/account/AccountInfo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountInfo.mjs","sources":["../../src/account/AccountInfo.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AA+DH;;;;;AAKG;AACa,SAAA,yBAAyB,CACrC,QAAiB,EACjB,aAAsB,EAAA;IAEtB,QACI,CAAC,CAAC,QAAQ;AACV,QAAA,CAAC,CAAC,aAAa;QACf,QAAQ,KAAK,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAC1C;AACN,CAAC;AAED;;;;;;;AAOG;AACG,SAAU,kBAAkB,CAC9B,aAAqB,EACrB,cAAsB,EACtB,QAAgB,EAChB,aAA2B,EAAA;AAE3B,IAAA,IAAI,aAAa,EAAE;QACf,MAAM,EACF,GAAG,EACH,GAAG,EACH,GAAG,EACH,IAAI,EACJ,GAAG,EACH,GAAG,EACH,kBAAkB,EAClB,GAAG,EACH,UAAU,GACb,GAAG,aAAa,CAAC;AAElB;;;;;AAKG;QACH,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAEzC,OAAO;AACH,YAAA,QAAQ,EAAE,QAAQ;AAClB,YAAA,cAAc,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE;AAChC,YAAA,IAAI,EAAE,IAAI;AACV,YAAA,QAAQ,EAAE,kBAAkB,IAAI,GAAG,IAAI,EAAE;AACzC,YAAA,SAAS,EAAE,UAAU;AACrB,YAAA,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,aAAa,CAAC;SACnE,CAAC;AACL,KAAA;AAAM,SAAA;QACH,OAAO;YACH,QAAQ;YACR,cAAc;AACd,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,aAAa,CAAC;SACnE,CAAC;AACL,KAAA;AACL,CAAC;AAED;;;;;AAKG;AACG,SAAU,8BAA8B,CAC1C,eAA4B,EAC5B,aAA6B,EAC7B,aAA2B,EAC3B,aAAsB,EAAA;IAEtB,IAAI,kBAAkB,GAAG,eAAe,CAAC;;AAEzC,IAAA,IAAI,aAAa,EAAE;;QAEf,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,EAAE,GAAG,aAAa,CAAC;QACjE,kBAAkB,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,qBAAqB,EAAE,CAAC;AACzE,KAAA;;AAGD,IAAA,IAAI,aAAa,EAAE;;;QAGf,MAAM,EAAE,YAAY,EAAE,GAAG,0BAA0B,EAAE,GACjD,kBAAkB,CACd,eAAe,CAAC,aAAa,EAC7B,eAAe,CAAC,cAAc,EAC9B,eAAe,CAAC,QAAQ,EACxB,aAAa,CAChB,CAAC;AAEN,QAAA,kBAAkB,GAAG;AACjB,YAAA,GAAG,kBAAkB;AACrB,YAAA,GAAG,0BAA0B;AAC7B,YAAA,aAAa,EAAE,aAAa;AAC5B,YAAA,OAAO,EAAE,aAAa;SACzB,CAAC;AAEF,QAAA,OAAO,kBAAkB,CAAC;AAC7B,KAAA;AAED,IAAA,OAAO,kBAAkB,CAAC;AAC9B;;;;"}

package/dist-browser/account/AuthToken.d.ts

@@ -0,0 +1,24 @@
+import { TokenClaims } from "./TokenClaims.js";
+/**
+ * Extract token by decoding the rawToken
+ *
+ * @param encodedToken
+ */
+export declare function extractTokenClaims(encodedToken: string, base64Decode: (input: string) => string): TokenClaims;
+/**
+ * Check if the signin_state claim contains "kmsi"
+ * @param idTokenClaims
+ * @returns
+ */
+export declare function isKmsi(idTokenClaims: TokenClaims): boolean;
+/**
+ * decode a JWT
+ *
+ * @param authToken
+ */
+export declare function getJWSPayload(authToken: string): string;
+/**
+ * Determine if the token's max_age has transpired
+ */
+export declare function checkMaxAge(authTime: number, maxAge: number): void;
+//# sourceMappingURL=AuthToken.d.ts.map

package/dist-browser/account/AuthToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthToken.d.ts","sourceRoot":"","sources":["../../src/account/AuthToken.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAM/C;;;;GAIG;AACH,wBAAgB,kBAAkB,CAC9B,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GACxC,WAAW,CAWb;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,aAAa,EAAE,WAAW,GAAG,OAAO,CAe1D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAkBvD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAUlE"}

package/dist-browser/account/AuthToken.mjs

@@ -0,0 +1,85 @@
+/*! @azure/msal-common v16.0.2 2026-01-17 */
+'use strict';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { tokenParsingError, nullOrEmptyToken, maxAgeTranspired } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Extract token by decoding the rawToken
+ *
+ * @param encodedToken
+ */
+function extractTokenClaims(encodedToken, base64Decode) {
+    const jswPayload = getJWSPayload(encodedToken);
+    // token will be decoded to get the username
+    try {
+        // base64Decode() should throw an error if there is an issue
+        const base64Decoded = base64Decode(jswPayload);
+        return JSON.parse(base64Decoded);
+    }
+    catch (err) {
+        throw createClientAuthError(tokenParsingError);
+    }
+}
+/**
+ * Check if the signin_state claim contains "kmsi"
+ * @param idTokenClaims
+ * @returns
+ */
+function isKmsi(idTokenClaims) {
+    if (!idTokenClaims.signin_state) {
+        return false;
+    }
+    /**
+     * Signin_state claim known values:
+     * dvc_mngd - device is managed
+     * dvc_dmjd - device is domain joined
+     * kmsi - user opted to "keep me signed in"
+     * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
+     */
+    const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
+    return idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
+}
+/**
+ * decode a JWT
+ *
+ * @param authToken
+ */
+function getJWSPayload(authToken) {
+    if (!authToken) {
+        throw createClientAuthError(nullOrEmptyToken);
+    }
+    const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
+    const matches = tokenPartsRegex.exec(authToken);
+    if (!matches || matches.length < 4) {
+        throw createClientAuthError(tokenParsingError);
+    }
+    /**
+     * const crackedToken = {
+     *  header: matches[1],
+     *  JWSPayload: matches[2],
+     *  JWSSig: matches[3],
+     * };
+     */
+    return matches[2];
+}
+/**
+ * Determine if the token's max_age has transpired
+ */
+function checkMaxAge(authTime, maxAge) {
+    /*
+     * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+     * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
+     * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
+     */
+    const fiveMinuteSkew = 300000; // five minutes in milliseconds
+    if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
+        throw createClientAuthError(maxAgeTranspired);
+    }
+}
+
+export { checkMaxAge, extractTokenClaims, getJWSPayload, isKmsi };
+//# sourceMappingURL=AuthToken.mjs.map

package/dist-browser/account/AuthToken.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthToken.mjs","sources":["../../src/account/AuthToken.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.tokenParsingError","ClientAuthErrorCodes.nullOrEmptyToken","ClientAuthErrorCodes.maxAgeTranspired"],"mappings":";;;;;AAAA;;;AAGG;AAQH;;;;AAIG;AACa,SAAA,kBAAkB,CAC9B,YAAoB,EACpB,YAAuC,EAAA;AAEvC,IAAA,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;;IAG/C,IAAI;;AAEA,QAAA,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AAC/C,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;AACnD,KAAA;AAAC,IAAA,OAAO,GAAG,EAAE;AACV,QAAA,MAAM,qBAAqB,CAACA,iBAAsC,CAAC,CAAC;AACvE,KAAA;AACL,CAAC;AAED;;;;AAIG;AACG,SAAU,MAAM,CAAC,aAA0B,EAAA;AAC7C,IAAA,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE;AAC7B,QAAA,OAAO,KAAK,CAAC;AAChB,KAAA;AACD;;;;;;AAMG;IACH,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,KACzC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAClD,CAAC;AACN,CAAC;AAED;;;;AAIG;AACG,SAAU,aAAa,CAAC,SAAiB,EAAA;IAC3C,IAAI,CAAC,SAAS,EAAE;AACZ,QAAA,MAAM,qBAAqB,CAACC,gBAAqC,CAAC,CAAC;AACtE,KAAA;IACD,MAAM,eAAe,GAAG,sCAAsC,CAAC;IAC/D,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;AAChC,QAAA,MAAM,qBAAqB,CAACD,iBAAsC,CAAC,CAAC;AACvE,KAAA;AACD;;;;;;AAMG;AAEH,IAAA,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED;;AAEG;AACa,SAAA,WAAW,CAAC,QAAgB,EAAE,MAAc,EAAA;AACxD;;;;AAIG;AACH,IAAA,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,IAAA,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,QAAQ,GAAG,MAAM,EAAE;AACjE,QAAA,MAAM,qBAAqB,CAACE,gBAAqC,CAAC,CAAC;AACtE,KAAA;AACL;;;;"}

package/dist-browser/account/CcsCredential.d.ts

@@ -0,0 +1,10 @@
+export type CcsCredential = {
+    credential: string;
+    type: CcsCredentialType;
+};
+export declare const CcsCredentialType: {
+    readonly HOME_ACCOUNT_ID: "home_account_id";
+    readonly UPN: "UPN";
+};
+export type CcsCredentialType = (typeof CcsCredentialType)[keyof typeof CcsCredentialType];
+//# sourceMappingURL=CcsCredential.d.ts.map

package/dist-browser/account/CcsCredential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CcsCredential.d.ts","sourceRoot":"","sources":["../../src/account/CcsCredential.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,aAAa,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;CAGpB,CAAC;AACX,MAAM,MAAM,iBAAiB,GACzB,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC"}

package/dist-browser/account/CcsCredential.mjs

@@ -0,0 +1,13 @@
+/*! @azure/msal-common v16.0.2 2026-01-17 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CcsCredentialType = {
+    HOME_ACCOUNT_ID: "home_account_id",
+    UPN: "UPN",
+};
+
+export { CcsCredentialType };
+//# sourceMappingURL=CcsCredential.mjs.map

package/dist-browser/account/CcsCredential.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CcsCredential.mjs","sources":["../../src/account/CcsCredential.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAOU,MAAA,iBAAiB,GAAG;AAC7B,IAAA,eAAe,EAAE,iBAAiB;AAClC,IAAA,GAAG,EAAE,KAAK;;;;;"}

package/dist-browser/account/ClientCredentials.d.ts

@@ -0,0 +1,20 @@
+export type ClientAssertionConfig = {
+    clientId: string;
+    tokenEndpoint?: string;
+};
+export type ClientAssertionCallback = (config: ClientAssertionConfig) => Promise<string>;
+/**
+ * Client Assertion credential for Confidential Clients
+ */
+export type ClientAssertion = {
+    assertion: string | ClientAssertionCallback;
+    assertionType: string;
+};
+/**
+ * Client Credentials set for Confidential Clients
+ */
+export type ClientCredentials = {
+    clientSecret?: string;
+    clientAssertion?: ClientAssertion;
+};
+//# sourceMappingURL=ClientCredentials.d.ts.map

package/dist-browser/account/ClientCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientCredentials.d.ts","sourceRoot":"","sources":["../../src/account/ClientCredentials.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,qBAAqB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,CAClC,MAAM,EAAE,qBAAqB,KAC5B,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,MAAM,GAAG,uBAAuB,CAAC;IAC5C,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,CAAC;CACrC,CAAC"}

package/dist-browser/account/ClientInfo.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Client info object which consists of:
+ * uid: user id
+ * utid: tenant id
+ * xms_tdbr: optional, only for non-US tenants
+ */
+export type ClientInfo = {
+    uid: string;
+    utid: string;
+    xms_tdbr?: string;
+};
+/**
+ * Function to build a client info object from server clientInfo string
+ * @param rawClientInfo
+ * @param crypto
+ */
+export declare function buildClientInfo(rawClientInfo: string, base64Decode: (input: string) => string): ClientInfo;
+/**
+ * Function to build a client info object from cached homeAccountId string
+ * @param homeAccountId
+ */
+export declare function buildClientInfoFromHomeAccountId(homeAccountId: string): ClientInfo;
+//# sourceMappingURL=ClientInfo.d.ts.map

package/dist-browser/account/ClientInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientInfo.d.ts","sourceRoot":"","sources":["../../src/account/ClientInfo.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAC3B,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GACxC,UAAU,CAaZ;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC5C,aAAa,EAAE,MAAM,GACtB,UAAU,CAcZ"}

package/dist-browser/account/ClientInfo.mjs

@@ -0,0 +1,44 @@
+/*! @azure/msal-common v16.0.2 2026-01-17 */
+'use strict';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { CLIENT_INFO_SEPARATOR } from '../utils/Constants.mjs';
+import { clientInfoEmptyError, clientInfoDecodingError } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Function to build a client info object from server clientInfo string
+ * @param rawClientInfo
+ * @param crypto
+ */
+function buildClientInfo(rawClientInfo, base64Decode) {
+    if (!rawClientInfo) {
+        throw createClientAuthError(clientInfoEmptyError);
+    }
+    try {
+        const decodedClientInfo = base64Decode(rawClientInfo);
+        return JSON.parse(decodedClientInfo);
+    }
+    catch (e) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+}
+/**
+ * Function to build a client info object from cached homeAccountId string
+ * @param homeAccountId
+ */
+function buildClientInfoFromHomeAccountId(homeAccountId) {
+    if (!homeAccountId) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+    const clientInfoParts = homeAccountId.split(CLIENT_INFO_SEPARATOR, 2);
+    return {
+        uid: clientInfoParts[0],
+        utid: clientInfoParts.length < 2 ? "" : clientInfoParts[1],
+    };
+}
+
+export { buildClientInfo, buildClientInfoFromHomeAccountId };
+//# sourceMappingURL=ClientInfo.mjs.map

package/dist-browser/account/ClientInfo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientInfo.mjs","sources":["../../src/account/ClientInfo.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.clientInfoEmptyError","ClientAuthErrorCodes.clientInfoDecodingError","Constants.CLIENT_INFO_SEPARATOR"],"mappings":";;;;;;AAAA;;;AAGG;AAoBH;;;;AAIG;AACa,SAAA,eAAe,CAC3B,aAAqB,EACrB,YAAuC,EAAA;IAEvC,IAAI,CAAC,aAAa,EAAE;AAChB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;AAC1E,KAAA;IAED,IAAI;AACA,QAAA,MAAM,iBAAiB,GAAW,YAAY,CAAC,aAAa,CAAC,CAAC;AAC9D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAe,CAAC;AACtD,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;AACR,QAAA,MAAM,qBAAqB,CACvBC,uBAA4C,CAC/C,CAAC;AACL,KAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,gCAAgC,CAC5C,aAAqB,EAAA;IAErB,IAAI,CAAC,aAAa,EAAE;AAChB,QAAA,MAAM,qBAAqB,CACvBA,uBAA4C,CAC/C,CAAC;AACL,KAAA;AACD,IAAA,MAAM,eAAe,GAAa,aAAa,CAAC,KAAK,CACjDC,qBAA+B,EAC/B,CAAC,CACJ,CAAC;IACF,OAAO;AACH,QAAA,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;AACvB,QAAA,IAAI,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;KAC7D,CAAC;AACN;;;;"}

package/dist-browser/account/TokenClaims.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Type which describes Id Token claims known by MSAL.
+ */
+export type TokenClaims = {
+    /**
+     * Audience
+     */
+    aud?: string;
+    /**
+     * Issuer
+     */
+    iss?: string;
+    /**
+     * Issued at
+     */
+    iat?: number;
+    /**
+     * Not valid before
+     */
+    nbf?: number;
+    /**
+     * Immutable object identifier, this ID uniquely identifies the user across applications
+     */
+    oid?: string;
+    /**
+     * Immutable subject identifier, this is a pairwise identifier - it is unique to a particular application ID
+     */
+    sub?: string;
+    /**
+     * Users' tenant or '9188040d-6c67-4c5b-b112-36a304b66dad' for personal accounts.
+     */
+    tid?: string;
+    /**
+     * Trusted Framework Policy (B2C) The name of the policy that was used to acquire the ID token.
+     */
+    tfp?: string;
+    /**
+     * Authentication Context Class Reference (B2C) Used only with older policies.
+     */
+    acr?: string;
+    ver?: string;
+    upn?: string;
+    preferred_username?: string;
+    login_hint?: string;
+    /**
+     * Contains KMSI (Keep Me Signed In) status among other things
+     */
+    signin_state?: Array<string>;
+    emails?: string[];
+    name?: string;
+    nonce?: string;
+    /**
+     * Expiration
+     */
+    exp?: number;
+    home_oid?: string;
+    sid?: string;
+    cloud_instance_host_name?: string;
+    cnf?: {
+        kid: string;
+    };
+    x5c_ca?: string[];
+    ts?: number;
+    at?: string;
+    u?: string;
+    p?: string;
+    m?: string;
+    roles?: string[];
+    amr?: string[];
+    idp?: string;
+    auth_time?: number;
+    /**
+     * 	Region of the resource tenant
+     */
+    tenant_region_scope?: string;
+    tenant_region_sub_scope?: string;
+};
+/**
+ * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+ * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+ * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+ * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+ * Downcased to match the realm case-insensitive comparison requirements
+ * @param idTokenClaims
+ * @returns
+ */
+export declare function getTenantIdFromIdTokenClaims(idTokenClaims?: TokenClaims): string | null;
+//# sourceMappingURL=TokenClaims.d.ts.map

package/dist-browser/account/TokenClaims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenClaims.d.ts","sourceRoot":"","sources":["../../src/account/TokenClaims.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG;IACtB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,GAAG,CAAC,EAAE;QACF,GAAG,EAAE,MAAM,CAAC;KACf,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;CACpC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CACxC,aAAa,CAAC,EAAE,WAAW,GAC5B,MAAM,GAAG,IAAI,CAOf"}

package/dist-browser/account/TokenClaims.mjs

@@ -0,0 +1,25 @@
+/*! @azure/msal-common v16.0.2 2026-01-17 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+ * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+ * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+ * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+ * Downcased to match the realm case-insensitive comparison requirements
+ * @param idTokenClaims
+ * @returns
+ */
+function getTenantIdFromIdTokenClaims(idTokenClaims) {
+    if (idTokenClaims) {
+        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
+        return tenantId || null;
+    }
+    return null;
+}
+
+export { getTenantIdFromIdTokenClaims };
+//# sourceMappingURL=TokenClaims.mjs.map

package/dist-browser/account/TokenClaims.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenClaims.mjs","sources":["../../src/account/TokenClaims.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAgFH;;;;;;;;AAQG;AACG,SAAU,4BAA4B,CACxC,aAA2B,EAAA;AAE3B,IAAA,IAAI,aAAa,EAAE;AACf,QAAA,MAAM,QAAQ,GACV,aAAa,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC;QAChE,OAAO,QAAQ,IAAI,IAAI,CAAC;AAC3B,KAAA;AACD,IAAA,OAAO,IAAI,CAAC;AAChB;;;;"}