@azure/msal-common 16.0.1 → 16.0.3

package/dist-browser/config/ClientConfiguration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientConfiguration.d.ts","sourceRoot":"","sources":["../../src/config/ClientConfiguration.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAiC,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAU,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAOxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAuB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAQpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAChC,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,sBAAsB,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACvD,iBAAiB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACxC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,gBAAgB,EAAE,YAAY,CAAC;IAC/B,gBAAgB,EAAE,cAAc,CAAC;IACjC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtC,sBAAsB,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACtD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,iBAAiB,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAClC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IACxB,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC5B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,WAAW,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,aAAa,CAG1D,CAAC;AA4CF;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,EACrC,WAAW,EAAE,eAAe,EAC5B,aAAa,EAAE,iBAAiB,EAChC,aAAa,EAAE,gBAAgB,EAC/B,gBAAgB,EAAE,qBAAqB,EACvC,gBAAgB,EAAE,qBAAqB,EACvC,eAAe,EAAE,oBAAoB,EACrC,iBAAiB,EAAE,iBAAiB,EACpC,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB,EAC9C,iBAAiB,EAAE,iBAAiB,EACpC,iBAAiB,EAAE,iBAAiB,GACvC,EAAE,mBAAmB,GAAG,yBAAyB,CA4BjD;AAeD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAIvE"}

package/dist-browser/config/ClientConfiguration.mjs

@@ -0,0 +1,107 @@
+/*! @azure/msal-common v16.0.3 2026-01-28 */
+'use strict';
+import { DEFAULT_CRYPTO_IMPLEMENTATION } from '../crypto/ICrypto.mjs';
+import { LogLevel, Logger } from '../logger/Logger.mjs';
+import { DEFAULT_TOKEN_RENEWAL_OFFSET_SEC, SKU, DEFAULT_COMMON_TENANT } from '../utils/Constants.mjs';
+import { version } from '../packageMetadata.mjs';
+import { AzureCloudInstance } from '../authority/AuthorityOptions.mjs';
+import { DefaultStorageClass } from '../cache/CacheManager.mjs';
+import { ProtocolMode } from '../authority/ProtocolMode.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { StubPerformanceClient } from '../telemetry/performance/StubPerformanceClient.mjs';
+import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_SYSTEM_OPTIONS = {
+    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+    preventCorsPreflight: false,
+};
+const DEFAULT_LOGGER_IMPLEMENTATION = {
+    loggerCallback: () => {
+        // allow users to not set loggerCallback
+    },
+    piiLoggingEnabled: false,
+    logLevel: LogLevel.Info,
+    correlationId: "",
+};
+const DEFAULT_NETWORK_IMPLEMENTATION = {
+    async sendGetRequestAsync() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async sendPostRequestAsync() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+};
+const DEFAULT_LIBRARY_INFO = {
+    sku: SKU,
+    version: version,
+    cpu: "",
+    os: "",
+};
+const DEFAULT_CLIENT_CREDENTIALS = {
+    clientSecret: "",
+    clientAssertion: undefined,
+};
+const DEFAULT_AZURE_CLOUD_OPTIONS = {
+    azureCloudInstance: AzureCloudInstance.None,
+    tenant: `${DEFAULT_COMMON_TENANT}`,
+};
+const DEFAULT_TELEMETRY_OPTIONS = {
+    application: {
+        appName: "",
+        appVersion: "",
+    },
+};
+/**
+ * Function that sets the default options when not explicitly configured from app developer
+ *
+ * @param Configuration
+ *
+ * @returns Configuration
+ */
+function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
+    const loggerOptions = {
+        ...DEFAULT_LOGGER_IMPLEMENTATION,
+        ...userLoggerOption,
+    };
+    return {
+        authOptions: buildAuthOptions(userAuthOptions),
+        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
+        loggerOptions: loggerOptions,
+        storageInterface: storageImplementation ||
+            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
+        networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
+        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
+        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
+        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
+        serverTelemetryManager: serverTelemetryManager || null,
+        persistencePlugin: persistencePlugin || null,
+        serializableCache: serializableCache || null,
+    };
+}
+/**
+ * Construct authoptions from the client and platform passed values
+ * @param authOptions
+ */
+function buildAuthOptions(authOptions) {
+    return {
+        clientCapabilities: [],
+        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
+        instanceAware: false,
+        ...authOptions,
+    };
+}
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+function isOidcProtocolMode(config) {
+    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+}
+
+export { DEFAULT_SYSTEM_OPTIONS, buildClientConfiguration, isOidcProtocolMode };
+//# sourceMappingURL=ClientConfiguration.mjs.map

package/dist-browser/config/ClientConfiguration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientConfiguration.mjs","sources":["../../src/config/ClientConfiguration.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;;;;;;;;;AAAA;;;AAGG;AAwJU,MAAA,sBAAsB,GAA4B;AAC3D,IAAA,yBAAyB,EAAE,gCAAgC;AAC3D,IAAA,oBAAoB,EAAE,KAAK;EAC7B;AAEF,MAAM,6BAA6B,GAA4B;IAC3D,cAAc,EAAE,MAAK;;KAEpB;AACD,IAAA,iBAAiB,EAAE,KAAK;IACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI;AACvB,IAAA,aAAa,EAAE,EAAE;CACpB,CAAC;AAEF,MAAM,8BAA8B,GAAmB;AACnD,IAAA,MAAM,mBAAmB,GAAA;AACrB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,oBAAoB,GAAA;AACtB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;CACJ,CAAC;AAEF,MAAM,oBAAoB,GAAgB;AACtC,IAAA,GAAG,EAAE,GAAG;AACR,IAAA,OAAO,EAAE,OAAO;AAChB,IAAA,GAAG,EAAE,EAAE;AACP,IAAA,EAAE,EAAE,EAAE;CACT,CAAC;AAEF,MAAM,0BAA0B,GAAsB;AAClD,IAAA,YAAY,EAAE,EAAE;AAChB,IAAA,eAAe,EAAE,SAAS;CAC7B,CAAC;AAEF,MAAM,2BAA2B,GAAsB;IACnD,kBAAkB,EAAE,kBAAkB,CAAC,IAAI;IAC3C,MAAM,EAAE,CAAG,EAAA,qBAAqB,CAAE,CAAA;CACrC,CAAC;AAEF,MAAM,yBAAyB,GAA+B;AAC1D,IAAA,WAAW,EAAE;AACT,QAAA,OAAO,EAAE,EAAE;AACX,QAAA,UAAU,EAAE,EAAE;AACjB,KAAA;CACJ,CAAC;AAEF;;;;;;AAMG;AACG,SAAU,wBAAwB,CAAC,EACrC,WAAW,EAAE,eAAe,EAC5B,aAAa,EAAE,iBAAiB,EAChC,aAAa,EAAE,gBAAgB,EAC/B,gBAAgB,EAAE,qBAAqB,EACvC,gBAAgB,EAAE,qBAAqB,EACvC,eAAe,EAAE,oBAAoB,EACrC,iBAAiB,EAAE,iBAAiB,EACpC,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB,EAC9C,iBAAiB,EAAE,iBAAiB,EACpC,iBAAiB,EAAE,iBAAiB,GAClB,EAAA;AAClB,IAAA,MAAM,aAAa,GAAG;AAClB,QAAA,GAAG,6BAA6B;AAChC,QAAA,GAAG,gBAAgB;KACtB,CAAC;IAEF,OAAO;AACH,QAAA,WAAW,EAAE,gBAAgB,CAAC,eAAe,CAAC;AAC9C,QAAA,aAAa,EAAE,EAAE,GAAG,sBAAsB,EAAE,GAAG,iBAAiB,EAAE;AAClE,QAAA,aAAa,EAAE,aAAa;AAC5B,QAAA,gBAAgB,EACZ,qBAAqB;AACrB,YAAA,IAAI,mBAAmB,CACnB,eAAe,CAAC,QAAQ,EACxB,6BAA6B,EAC7B,IAAI,MAAM,CAAC,aAAa,CAAC,EACzB,IAAI,qBAAqB,EAAE,CAC9B;QACL,gBAAgB,EACZ,qBAAqB,IAAI,8BAA8B;QAC3D,eAAe,EAAE,oBAAoB,IAAI,6BAA6B;QACtE,iBAAiB,EAAE,iBAAiB,IAAI,0BAA0B;AAClE,QAAA,WAAW,EAAE,EAAE,GAAG,oBAAoB,EAAE,GAAG,WAAW,EAAE;AACxD,QAAA,SAAS,EAAE,EAAE,GAAG,yBAAyB,EAAE,GAAG,SAAS,EAAE;QACzD,sBAAsB,EAAE,sBAAsB,IAAI,IAAI;QACtD,iBAAiB,EAAE,iBAAiB,IAAI,IAAI;QAC5C,iBAAiB,EAAE,iBAAiB,IAAI,IAAI;KAC/C,CAAC;AACN,CAAC;AAED;;;AAGG;AACH,SAAS,gBAAgB,CAAC,WAAwB,EAAA;IAC9C,OAAO;AACH,QAAA,kBAAkB,EAAE,EAAE;AACtB,QAAA,iBAAiB,EAAE,2BAA2B;AAC9C,QAAA,aAAa,EAAE,KAAK;AACpB,QAAA,GAAG,WAAW;KACjB,CAAC;AACN,CAAC;AAED;;;AAGG;AACG,SAAU,kBAAkB,CAAC,MAA2B,EAAA;AAC1D,IAAA,QACI,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,KAAK,YAAY,CAAC,IAAI,EACzE;AACN;;;;"}

package/dist-browser/constants/AADServerParamKeys.d.ts

@@ -0,0 +1,59 @@
+export declare const CLIENT_ID = "client_id";
+export declare const REDIRECT_URI = "redirect_uri";
+export declare const RESPONSE_TYPE = "response_type";
+export declare const RESPONSE_MODE = "response_mode";
+export declare const GRANT_TYPE = "grant_type";
+export declare const CLAIMS = "claims";
+export declare const SCOPE = "scope";
+export declare const ERROR = "error";
+export declare const ERROR_DESCRIPTION = "error_description";
+export declare const ACCESS_TOKEN = "access_token";
+export declare const ID_TOKEN = "id_token";
+export declare const REFRESH_TOKEN = "refresh_token";
+export declare const EXPIRES_IN = "expires_in";
+export declare const REFRESH_TOKEN_EXPIRES_IN = "refresh_token_expires_in";
+export declare const STATE = "state";
+export declare const NONCE = "nonce";
+export declare const PROMPT = "prompt";
+export declare const SESSION_STATE = "session_state";
+export declare const CLIENT_INFO = "client_info";
+export declare const CODE = "code";
+export declare const CODE_CHALLENGE = "code_challenge";
+export declare const CODE_CHALLENGE_METHOD = "code_challenge_method";
+export declare const CODE_VERIFIER = "code_verifier";
+export declare const CLIENT_REQUEST_ID = "client-request-id";
+export declare const X_CLIENT_SKU = "x-client-SKU";
+export declare const X_CLIENT_VER = "x-client-VER";
+export declare const X_CLIENT_OS = "x-client-OS";
+export declare const X_CLIENT_CPU = "x-client-CPU";
+export declare const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
+export declare const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
+export declare const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
+export declare const X_APP_NAME = "x-app-name";
+export declare const X_APP_VER = "x-app-ver";
+export declare const POST_LOGOUT_URI = "post_logout_redirect_uri";
+export declare const ID_TOKEN_HINT = "id_token_hint";
+export declare const DEVICE_CODE = "device_code";
+export declare const CLIENT_SECRET = "client_secret";
+export declare const CLIENT_ASSERTION = "client_assertion";
+export declare const CLIENT_ASSERTION_TYPE = "client_assertion_type";
+export declare const TOKEN_TYPE = "token_type";
+export declare const REQ_CNF = "req_cnf";
+export declare const OBO_ASSERTION = "assertion";
+export declare const REQUESTED_TOKEN_USE = "requested_token_use";
+export declare const ON_BEHALF_OF = "on_behalf_of";
+export declare const FOCI = "foci";
+export declare const CCS_HEADER = "X-AnchorMailbox";
+export declare const RETURN_SPA_CODE = "return_spa_code";
+export declare const NATIVE_BROKER = "nativebroker";
+export declare const LOGOUT_HINT = "logout_hint";
+export declare const SID = "sid";
+export declare const LOGIN_HINT = "login_hint";
+export declare const DOMAIN_HINT = "domain_hint";
+export declare const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+export declare const BROKER_CLIENT_ID = "brk_client_id";
+export declare const BROKER_REDIRECT_URI = "brk_redirect_uri";
+export declare const INSTANCE_AWARE = "instance_aware";
+export declare const EAR_JWK = "ear_jwk";
+export declare const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+//# sourceMappingURL=AADServerParamKeys.d.ts.map

package/dist-browser/constants/AADServerParamKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AADServerParamKeys.d.ts","sourceRoot":"","sources":["../../src/constants/AADServerParamKeys.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,eAAO,MAAM,KAAK,UAAU,CAAC;AAC7B,eAAO,MAAM,KAAK,UAAU,CAAC;AAC7B,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AACnE,eAAO,MAAM,KAAK,UAAU,CAAC;AAC7B,eAAO,MAAM,KAAK,UAAU,CAAC;AAC7B,eAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,IAAI,SAAS,CAAC;AAC3B,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAChE,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,OAAO,YAAY,CAAC;AACjC,eAAO,MAAM,aAAa,cAAc,CAAC;AACzC,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,IAAI,SAAS,CAAC;AAC3B,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAC5C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,GAAG,QAAQ,CAAC;AACzB,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AACtD,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AACtD,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,OAAO,YAAY,CAAC;AACjC,eAAO,MAAM,cAAc,mBAAmB,CAAC"}

package/dist-browser/constants/AADServerParamKeys.mjs

@@ -0,0 +1,67 @@
+/*! @azure/msal-common v16.0.3 2026-01-28 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CLIENT_ID = "client_id";
+const REDIRECT_URI = "redirect_uri";
+const RESPONSE_TYPE = "response_type";
+const RESPONSE_MODE = "response_mode";
+const GRANT_TYPE = "grant_type";
+const CLAIMS = "claims";
+const SCOPE = "scope";
+const ERROR = "error";
+const ERROR_DESCRIPTION = "error_description";
+const ACCESS_TOKEN = "access_token";
+const ID_TOKEN = "id_token";
+const REFRESH_TOKEN = "refresh_token";
+const EXPIRES_IN = "expires_in";
+const REFRESH_TOKEN_EXPIRES_IN = "refresh_token_expires_in";
+const STATE = "state";
+const NONCE = "nonce";
+const PROMPT = "prompt";
+const SESSION_STATE = "session_state";
+const CLIENT_INFO = "client_info";
+const CODE = "code";
+const CODE_CHALLENGE = "code_challenge";
+const CODE_CHALLENGE_METHOD = "code_challenge_method";
+const CODE_VERIFIER = "code_verifier";
+const CLIENT_REQUEST_ID = "client-request-id";
+const X_CLIENT_SKU = "x-client-SKU";
+const X_CLIENT_VER = "x-client-VER";
+const X_CLIENT_OS = "x-client-OS";
+const X_CLIENT_CPU = "x-client-CPU";
+const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
+const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
+const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
+const X_APP_NAME = "x-app-name";
+const X_APP_VER = "x-app-ver";
+const POST_LOGOUT_URI = "post_logout_redirect_uri";
+const ID_TOKEN_HINT = "id_token_hint";
+const DEVICE_CODE = "device_code";
+const CLIENT_SECRET = "client_secret";
+const CLIENT_ASSERTION = "client_assertion";
+const CLIENT_ASSERTION_TYPE = "client_assertion_type";
+const TOKEN_TYPE = "token_type";
+const REQ_CNF = "req_cnf";
+const OBO_ASSERTION = "assertion";
+const REQUESTED_TOKEN_USE = "requested_token_use";
+const ON_BEHALF_OF = "on_behalf_of";
+const FOCI = "foci";
+const CCS_HEADER = "X-AnchorMailbox";
+const RETURN_SPA_CODE = "return_spa_code";
+const NATIVE_BROKER = "nativebroker";
+const LOGOUT_HINT = "logout_hint";
+const SID = "sid";
+const LOGIN_HINT = "login_hint";
+const DOMAIN_HINT = "domain_hint";
+const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+const BROKER_CLIENT_ID = "brk_client_id";
+const BROKER_REDIRECT_URI = "brk_redirect_uri";
+const INSTANCE_AWARE = "instance_aware";
+const EAR_JWK = "ear_jwk";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+
+export { ACCESS_TOKEN, BROKER_CLIENT_ID, BROKER_REDIRECT_URI, CCS_HEADER, CLAIMS, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, CLIENT_ID, CLIENT_INFO, CLIENT_REQUEST_ID, CLIENT_SECRET, CODE, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE_VERIFIER, DEVICE_CODE, DOMAIN_HINT, EAR_JWE_CRYPTO, EAR_JWK, ERROR, ERROR_DESCRIPTION, EXPIRES_IN, FOCI, GRANT_TYPE, ID_TOKEN, ID_TOKEN_HINT, INSTANCE_AWARE, LOGIN_HINT, LOGOUT_HINT, NATIVE_BROKER, NONCE, OBO_ASSERTION, ON_BEHALF_OF, POST_LOGOUT_URI, PROMPT, REDIRECT_URI, REFRESH_TOKEN, REFRESH_TOKEN_EXPIRES_IN, REQUESTED_TOKEN_USE, REQ_CNF, RESPONSE_MODE, RESPONSE_TYPE, RETURN_SPA_CODE, SCOPE, SESSION_STATE, SID, STATE, TOKEN_TYPE, X_APP_NAME, X_APP_VER, X_CLIENT_CPU, X_CLIENT_CURR_TELEM, X_CLIENT_EXTRA_SKU, X_CLIENT_LAST_TELEM, X_CLIENT_OS, X_CLIENT_SKU, X_CLIENT_VER, X_MS_LIB_CAPABILITY };
+//# sourceMappingURL=AADServerParamKeys.mjs.map

package/dist-browser/constants/AADServerParamKeys.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AADServerParamKeys.mjs","sources":["../../src/constants/AADServerParamKeys.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,SAAS,GAAG,YAAY;AAC9B,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,MAAM,GAAG,SAAS;AACxB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,iBAAiB,GAAG,oBAAoB;AAC9C,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,wBAAwB,GAAG,2BAA2B;AAC5D,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,MAAM,GAAG,SAAS;AACxB,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,IAAI,GAAG,OAAO;AACpB,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,qBAAqB,GAAG,wBAAwB;AACtD,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,iBAAiB,GAAG,oBAAoB;AAC9C,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,mBAAmB,GAAG,6BAA6B;AACzD,MAAM,mBAAmB,GAAG,0BAA0B;AACtD,MAAM,mBAAmB,GAAG,sBAAsB;AAClD,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,SAAS,GAAG,YAAY;AAC9B,MAAM,eAAe,GAAG,2BAA2B;AACnD,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,gBAAgB,GAAG,mBAAmB;AAC5C,MAAM,qBAAqB,GAAG,wBAAwB;AACtD,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,aAAa,GAAG,YAAY;AAClC,MAAM,mBAAmB,GAAG,sBAAsB;AAClD,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,IAAI,GAAG,OAAO;AACpB,MAAM,UAAU,GAAG,kBAAkB;AACrC,MAAM,eAAe,GAAG,kBAAkB;AAC1C,MAAM,aAAa,GAAG,eAAe;AACrC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,GAAG,GAAG,MAAM;AAClB,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,kBAAkB,GAAG,oBAAoB;AAC/C,MAAM,gBAAgB,GAAG,gBAAgB;AACzC,MAAM,mBAAmB,GAAG,mBAAmB;AAC/C,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,cAAc,GAAG;;;;"}

package/dist-browser/crypto/ICrypto.d.ts

@@ -0,0 +1,71 @@
+import type { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import type { ShrOptions, SignedHttpRequest } from "./SignedHttpRequest.js";
+/**
+ * The PkceCodes type describes the structure
+ * of objects that contain PKCE code
+ * challenge and verifier pairs
+ */
+export type PkceCodes = {
+    verifier: string;
+    challenge: string;
+};
+export type SignedHttpRequestParameters = Pick<BaseAuthRequest, "resourceRequestMethod" | "resourceRequestUri" | "shrClaims" | "shrNonce" | "shrOptions"> & {
+    correlationId: string;
+};
+/**
+ * Interface for crypto functions used by library
+ */
+export interface ICrypto {
+    /**
+     * Creates a guid randomly.
+     */
+    createNewGuid(): string;
+    /**
+     * base64 Encode string
+     * @param input
+     */
+    base64Encode(input: string): string;
+    /**
+     * base64 decode string
+     * @param input
+     */
+    base64Decode(input: string): string;
+    /**
+     * base64 URL safe encoded string
+     */
+    base64UrlEncode(input: string): string;
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid: string): string;
+    /**
+     * Generates an JWK RSA S256 Thumbprint
+     * @param request
+     */
+    getPublicKeyThumbprint(request: SignedHttpRequestParameters): Promise<string>;
+    /**
+     * Removes cryptographic keypair from key store matching the keyId passed in
+     * @param kid
+     * @param correlationId
+     */
+    removeTokenBindingKey(kid: string, correlationId: string): Promise<void>;
+    /**
+     * Removes all cryptographic keys from IndexedDB storage
+     * @param correlationId
+     */
+    clearKeystore(correlationId: string): Promise<boolean>;
+    /**
+     * Returns a signed proof-of-possession token with a given acces token that contains a cnf claim with the required kid.
+     * @param accessToken
+     */
+    signJwt(payload: SignedHttpRequest, kid: string, shrOptions?: ShrOptions, correlationId?: string): Promise<string>;
+    /**
+     * Returns the SHA-256 hash of an input string
+     * @param plainText
+     */
+    hashString(plainText: string): Promise<string>;
+}
+export declare const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto;
+//# sourceMappingURL=ICrypto.d.ts.map

package/dist-browser/crypto/ICrypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ICrypto.d.ts","sourceRoot":"","sources":["../../src/crypto/ICrypto.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE5E;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC1C,eAAe,EACb,uBAAuB,GACvB,oBAAoB,GACpB,WAAW,GACX,UAAU,GACV,YAAY,CACjB,GAAG;IACA,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,OAAO;IACpB;;OAEG;IACH,aAAa,IAAI,MAAM,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;OAGG;IACH,sBAAsB,CAClB,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;OAIG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;;OAGG;IACH,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD;;;OAGG;IACH,OAAO,CACH,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,UAAU,EACvB,aAAa,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD;AAED,eAAO,MAAM,6BAA6B,EAAE,OA+B3C,CAAC"}

package/dist-browser/crypto/ICrypto.mjs

@@ -0,0 +1,44 @@
+/*! @azure/msal-common v16.0.3 2026-01-28 */
+'use strict';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_CRYPTO_IMPLEMENTATION = {
+    createNewGuid: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    base64Decode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    base64Encode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    base64UrlEncode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    encodeKid: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async getPublicKeyThumbprint() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async removeTokenBindingKey() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async clearKeystore() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async signJwt() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async hashString() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+};
+
+export { DEFAULT_CRYPTO_IMPLEMENTATION };
+//# sourceMappingURL=ICrypto.mjs.map

package/dist-browser/crypto/ICrypto.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ICrypto.mjs","sources":["../../src/crypto/ICrypto.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;AAAA;;;AAGG;AA6FU,MAAA,6BAA6B,GAAY;IAClD,aAAa,EAAE,MAAa;AACxB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;IACD,YAAY,EAAE,MAAa;AACvB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;IACD,YAAY,EAAE,MAAa;AACvB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;IACD,eAAe,EAAE,MAAa;AAC1B,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;IACD,SAAS,EAAE,MAAa;AACpB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,sBAAsB,GAAA;AACxB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,qBAAqB,GAAA;AACvB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,aAAa,GAAA;AACf,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,OAAO,GAAA;AACT,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,UAAU,GAAA;AACZ,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;;;;;"}

package/dist-browser/crypto/IGuidGenerator.d.ts

@@ -0,0 +1,5 @@
+export interface IGuidGenerator {
+    generateGuid(): string;
+    isGuid(guid: string): boolean;
+}
+//# sourceMappingURL=IGuidGenerator.d.ts.map

package/dist-browser/crypto/IGuidGenerator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IGuidGenerator.d.ts","sourceRoot":"","sources":["../../src/crypto/IGuidGenerator.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC3B,YAAY,IAAI,MAAM,CAAC;IACvB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC"}

package/dist-browser/crypto/JoseHeader.d.ts

@@ -0,0 +1,23 @@
+import { JsonWebTokenTypes } from "../utils/Constants.js";
+export type JoseHeaderOptions = {
+    typ?: JsonWebTokenTypes;
+    alg?: string;
+    kid?: string;
+};
+/** @internal */
+export declare class JoseHeader {
+    typ?: JsonWebTokenTypes;
+    alg?: string;
+    kid?: string;
+    constructor(options: JoseHeaderOptions);
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object and returns
+     * the stringified header object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @returns
+     */
+    static getShrHeaderString(shrHeaderOptions: JoseHeaderOptions): string;
+}
+//# sourceMappingURL=JoseHeader.d.ts.map

package/dist-browser/crypto/JoseHeader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JoseHeader.d.ts","sourceRoot":"","sources":["../../src/crypto/JoseHeader.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG;IAC5B,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,gBAAgB;AAChB,qBAAa,UAAU;IACZ,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;gBAER,OAAO,EAAE,iBAAiB;IAMtC;;;;;;;OAOG;IACH,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,MAAM;CAoBzE"}

package/dist-browser/crypto/JoseHeader.mjs

@@ -0,0 +1,46 @@
+/*! @azure/msal-common v16.0.3 2026-01-28 */
+'use strict';
+import { createJoseHeaderError } from '../error/JoseHeaderError.mjs';
+import { JsonWebTokenTypes } from '../utils/Constants.mjs';
+import { missingKidError, missingAlgError } from '../error/JoseHeaderErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class JoseHeader {
+    constructor(options) {
+        this.typ = options.typ;
+        this.alg = options.alg;
+        this.kid = options.kid;
+    }
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object and returns
+     * the stringified header object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @returns
+     */
+    static getShrHeaderString(shrHeaderOptions) {
+        // KeyID is required on the SHR header
+        if (!shrHeaderOptions.kid) {
+            throw createJoseHeaderError(missingKidError);
+        }
+        // Alg is required on the SHR header
+        if (!shrHeaderOptions.alg) {
+            throw createJoseHeaderError(missingAlgError);
+        }
+        const shrHeader = new JoseHeader({
+            // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
+            typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
+            kid: shrHeaderOptions.kid,
+            alg: shrHeaderOptions.alg,
+        });
+        return JSON.stringify(shrHeader);
+    }
+}
+
+export { JoseHeader };
+//# sourceMappingURL=JoseHeader.mjs.map

package/dist-browser/crypto/JoseHeader.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"JoseHeader.mjs","sources":["../../src/crypto/JoseHeader.ts"],"sourcesContent":[null],"names":["JoseHeaderErrorCodes.missingKidError","JoseHeaderErrorCodes.missingAlgError"],"mappings":";;;;;;AAAA;;;AAGG;AAcH;MACa,UAAU,CAAA;AAKnB,IAAA,WAAA,CAAY,OAA0B,EAAA;AAClC,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;KAC1B;AAED;;;;;;;AAOG;IACH,OAAO,kBAAkB,CAAC,gBAAmC,EAAA;;AAEzD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;AACvB,YAAA,MAAM,qBAAqB,CAACA,eAAoC,CAAC,CAAC;AACrE,SAAA;;AAGD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;AACvB,YAAA,MAAM,qBAAqB,CAACC,eAAoC,CAAC,CAAC;AACrE,SAAA;AAED,QAAA,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC;;AAE7B,YAAA,GAAG,EAAE,gBAAgB,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG;YAClD,GAAG,EAAE,gBAAgB,CAAC,GAAG;YACzB,GAAG,EAAE,gBAAgB,CAAC,GAAG;AAC5B,SAAA,CAAC,CAAC;AAEH,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;KACpC;AACJ;;;;"}

package/dist-browser/crypto/PopTokenGenerator.d.ts

@@ -0,0 +1,60 @@
+import { ICrypto, SignedHttpRequestParameters } from "./ICrypto.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+import { Logger } from "../logger/Logger.js";
+/**
+ * See eSTS docs for more info.
+ * - A kid element, with the value containing an RFC 7638-compliant JWK thumbprint that is base64 encoded.
+ * -  xms_ksl element, representing the storage location of the key's secret component on the client device. One of two values:
+ *      - sw: software storage
+ *      - uhw: hardware storage
+ */
+type ReqCnf = {
+    kid: string;
+    xms_ksl: KeyLocation;
+};
+export type ReqCnfData = {
+    kid: string;
+    reqCnfString: string;
+};
+declare const KeyLocation: {
+    readonly SW: "sw";
+    readonly UHW: "uhw";
+};
+export type KeyLocation = (typeof KeyLocation)[keyof typeof KeyLocation];
+/** @internal */
+export declare class PopTokenGenerator {
+    private cryptoUtils;
+    private performanceClient;
+    constructor(cryptoUtils: ICrypto, performanceClient: IPerformanceClient);
+    /**
+     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
+     * @param request
+     * @returns
+     */
+    generateCnf(request: SignedHttpRequestParameters, logger: Logger): Promise<ReqCnfData>;
+    /**
+     * Generates key_id for a SHR token request
+     * @param request
+     * @returns
+     */
+    generateKid(request: SignedHttpRequestParameters): Promise<ReqCnf>;
+    /**
+     * Signs the POP access_token with the local generated key-pair
+     * @param accessToken
+     * @param request
+     * @returns
+     */
+    signPopToken(accessToken: string, keyId: string, request: SignedHttpRequestParameters): Promise<string>;
+    /**
+     * Utility function to generate the signed JWT for an access_token
+     * @param payload
+     * @param kid
+     * @param request
+     * @param claims
+     * @returns
+     */
+    signPayload(payload: string, keyId: string, request: SignedHttpRequestParameters, claims?: object): Promise<string>;
+}
+export {};
+//# sourceMappingURL=PopTokenGenerator.d.ts.map

package/dist-browser/crypto/PopTokenGenerator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PopTokenGenerator.d.ts","sourceRoot":"","sources":["../../src/crypto/PopTokenGenerator.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAGpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAGpF,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;;;;;GAMG;AACH,KAAK,MAAM,GAAG;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,WAAW,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,QAAA,MAAM,WAAW;;;CAGP,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAEzE,gBAAgB;AAChB,qBAAa,iBAAiB;IAC1B,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,iBAAiB,CAAqB;gBAElC,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB;IAKvE;;;;;OAKG;IACG,WAAW,CACb,OAAO,EAAE,2BAA2B,EACpC,MAAM,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAkBtB;;;;OAIG;IACG,WAAW,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC;IAWxE;;;;;OAKG;IACG,YAAY,CACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,MAAM,CAAC;IAIlB;;;;;;;OAOG;IACG,WAAW,CACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,2BAA2B,EACpC,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;CAiCrB"}

package/dist-browser/crypto/PopTokenGenerator.mjs

@@ -0,0 +1,87 @@
+/*! @azure/msal-common v16.0.3 2026-01-28 */
+'use strict';
+import { nowSeconds } from '../utils/TimeUtils.mjs';
+import { UrlString } from '../url/UrlString.mjs';
+import { PopTokenGenerateCnf } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const KeyLocation = {
+    SW: "sw"};
+/** @internal */
+class PopTokenGenerator {
+    constructor(cryptoUtils, performanceClient) {
+        this.cryptoUtils = cryptoUtils;
+        this.performanceClient = performanceClient;
+    }
+    /**
+     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
+     * @param request
+     * @returns
+     */
+    async generateCnf(request, logger) {
+        const reqCnf = await invokeAsync(this.generateKid.bind(this), PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
+        const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
+        return {
+            kid: reqCnf.kid,
+            reqCnfString,
+        };
+    }
+    /**
+     * Generates key_id for a SHR token request
+     * @param request
+     * @returns
+     */
+    async generateKid(request) {
+        const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(request);
+        return {
+            kid: kidThumbprint,
+            xms_ksl: KeyLocation.SW,
+        };
+    }
+    /**
+     * Signs the POP access_token with the local generated key-pair
+     * @param accessToken
+     * @param request
+     * @returns
+     */
+    async signPopToken(accessToken, keyId, request) {
+        return this.signPayload(accessToken, keyId, request);
+    }
+    /**
+     * Utility function to generate the signed JWT for an access_token
+     * @param payload
+     * @param kid
+     * @param request
+     * @param claims
+     * @returns
+     */
+    async signPayload(payload, keyId, request, claims) {
+        // Deconstruct request to extract SHR parameters
+        const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
+        const resourceUrlString = resourceRequestUri
+            ? new UrlString(resourceRequestUri)
+            : undefined;
+        const resourceUrlComponents = resourceUrlString?.getUrlComponents();
+        return this.cryptoUtils.signJwt({
+            at: payload,
+            ts: nowSeconds(),
+            m: resourceRequestMethod?.toUpperCase(),
+            u: resourceUrlComponents?.HostNameAndPort,
+            nonce: shrNonce || this.cryptoUtils.createNewGuid(),
+            p: resourceUrlComponents?.AbsolutePath,
+            q: resourceUrlComponents?.QueryString
+                ? [[], resourceUrlComponents.QueryString]
+                : undefined,
+            client_claims: shrClaims || undefined,
+            ...claims,
+        }, keyId, shrOptions, request.correlationId);
+    }
+}
+
+export { PopTokenGenerator };
+//# sourceMappingURL=PopTokenGenerator.mjs.map

package/dist-browser/crypto/PopTokenGenerator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PopTokenGenerator.mjs","sources":["../../src/crypto/PopTokenGenerator.ts"],"sourcesContent":[null],"names":["PerformanceEvents.PopTokenGenerateCnf","TimeUtils.nowSeconds"],"mappings":";;;;;;;AAAA;;;AAGG;AA2BH,MAAM,WAAW,GAAG;AAChB,IAAA,EAAE,EAAE,KAEE,CAAC;AAGX;MACa,iBAAiB,CAAA;IAI1B,WAAY,CAAA,WAAoB,EAAE,iBAAqC,EAAA;AACnE,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AAC/B,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;KAC9C;AAED;;;;;AAKG;AACH,IAAA,MAAM,WAAW,CACb,OAAoC,EACpC,MAAc,EAAA;AAEd,QAAA,MAAM,MAAM,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3BA,mBAAqC,EACrC,MAAM,EACN,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,CAAC,CAAC;AACX,QAAA,MAAM,YAAY,GAAW,IAAI,CAAC,WAAW,CAAC,eAAe,CACzD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CACzB,CAAC;QAEF,OAAO;YACH,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,YAAY;SACf,CAAC;KACL;AAED;;;;AAIG;IACH,MAAM,WAAW,CAAC,OAAoC,EAAA;QAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAC/D,OAAO,CACV,CAAC;QAEF,OAAO;AACH,YAAA,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,WAAW,CAAC,EAAE;SAC1B,CAAC;KACL;AAED;;;;;AAKG;AACH,IAAA,MAAM,YAAY,CACd,WAAmB,EACnB,KAAa,EACb,OAAoC,EAAA;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;KACxD;AAED;;;;;;;AAOG;IACH,MAAM,WAAW,CACb,OAAe,EACf,KAAa,EACb,OAAoC,EACpC,MAAe,EAAA;;AAGf,QAAA,MAAM,EACF,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,UAAU,GACb,GAAG,OAAO,CAAC;QAEZ,MAAM,iBAAiB,GAAG,kBAAkB;AACxC,cAAE,IAAI,SAAS,CAAC,kBAAkB,CAAC;cACjC,SAAS,CAAC;AAChB,QAAA,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AACpE,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAC3B;AACI,YAAA,EAAE,EAAE,OAAO;AACX,YAAA,EAAE,EAAEC,UAAoB,EAAE;AAC1B,YAAA,CAAC,EAAE,qBAAqB,EAAE,WAAW,EAAE;YACvC,CAAC,EAAE,qBAAqB,EAAE,eAAe;YACzC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;YACnD,CAAC,EAAE,qBAAqB,EAAE,YAAY;YACtC,CAAC,EAAE,qBAAqB,EAAE,WAAW;AACjC,kBAAE,CAAC,EAAE,EAAE,qBAAqB,CAAC,WAAW,CAAC;AACzC,kBAAE,SAAS;YACf,aAAa,EAAE,SAAS,IAAI,SAAS;AACrC,YAAA,GAAG,MAAM;SACZ,EACD,KAAK,EACL,UAAU,EACV,OAAO,CAAC,aAAa,CACxB,CAAC;KACL;AACJ;;;;"}