@azure/msal-common 16.0.1 → 16.0.3

package/dist-browser/request/ScopeSet.mjs

@@ -0,0 +1,204 @@
+/*! @azure/msal-common v16.0.3 2026-01-28 */
+'use strict';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { StringUtils } from '../utils/StringUtils.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { OIDC_DEFAULT_SCOPES, OFFLINE_ACCESS_SCOPE, OIDC_SCOPES } from '../utils/Constants.mjs';
+import { emptyInputScopesError } from '../error/ClientConfigurationErrorCodes.mjs';
+import { cannotAppendScopeSet, cannotRemoveEmptyScope, emptyInputScopeSet } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
+ * the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions
+ * to ensure uniqueness of strings.
+ */
+class ScopeSet {
+    constructor(inputScopes) {
+        // Filter empty string and null/undefined array items
+        const scopeArr = inputScopes
+            ? StringUtils.trimArrayEntries([...inputScopes])
+            : [];
+        const filteredInput = scopeArr
+            ? StringUtils.removeEmptyStringsFromArray(scopeArr)
+            : [];
+        // Check if scopes array has at least one member
+        if (!filteredInput || !filteredInput.length) {
+            throw createClientConfigurationError(emptyInputScopesError);
+        }
+        this.scopes = new Set(); // Iterator in constructor not supported by IE11
+        filteredInput.forEach((scope) => this.scopes.add(scope));
+    }
+    /**
+     * Factory method to create ScopeSet from space-delimited string
+     * @param inputScopeString
+     * @param appClientId
+     * @param scopesRequired
+     */
+    static fromString(inputScopeString) {
+        const scopeString = inputScopeString || "";
+        const inputScopes = scopeString.split(" ");
+        return new ScopeSet(inputScopes);
+    }
+    /**
+     * Creates the set of scopes to search for in cache lookups
+     * @param inputScopeString
+     * @returns
+     */
+    static createSearchScopes(inputScopeString) {
+        // Handle empty scopes by using default OIDC scopes for cache lookup
+        const scopesToUse = inputScopeString && inputScopeString.length > 0
+            ? inputScopeString
+            : [...OIDC_DEFAULT_SCOPES];
+        const scopeSet = new ScopeSet(scopesToUse);
+        if (!scopeSet.containsOnlyOIDCScopes()) {
+            scopeSet.removeOIDCScopes();
+        }
+        else {
+            scopeSet.removeScope(OFFLINE_ACCESS_SCOPE);
+        }
+        return scopeSet;
+    }
+    /**
+     * Check if a given scope is present in this set of scopes.
+     * @param scope
+     */
+    containsScope(scope) {
+        const lowerCaseScopes = this.printScopesLowerCase().split(" ");
+        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
+        // compare lowercase scopes
+        return scope
+            ? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
+            : false;
+    }
+    /**
+     * Check if a set of scopes is present in this set of scopes.
+     * @param scopeSet
+     */
+    containsScopeSet(scopeSet) {
+        if (!scopeSet || scopeSet.scopes.size <= 0) {
+            return false;
+        }
+        return (this.scopes.size >= scopeSet.scopes.size &&
+            scopeSet.asArray().every((scope) => this.containsScope(scope)));
+    }
+    /**
+     * Check if set of scopes contains only the defaults
+     */
+    containsOnlyOIDCScopes() {
+        let defaultScopeCount = 0;
+        OIDC_SCOPES.forEach((defaultScope) => {
+            if (this.containsScope(defaultScope)) {
+                defaultScopeCount += 1;
+            }
+        });
+        return this.scopes.size === defaultScopeCount;
+    }
+    /**
+     * Appends single scope if passed
+     * @param newScope
+     */
+    appendScope(newScope) {
+        if (newScope) {
+            this.scopes.add(newScope.trim());
+        }
+    }
+    /**
+     * Appends multiple scopes if passed
+     * @param newScopes
+     */
+    appendScopes(newScopes) {
+        try {
+            newScopes.forEach((newScope) => this.appendScope(newScope));
+        }
+        catch (e) {
+            throw createClientAuthError(cannotAppendScopeSet);
+        }
+    }
+    /**
+     * Removes element from set of scopes.
+     * @param scope
+     */
+    removeScope(scope) {
+        if (!scope) {
+            throw createClientAuthError(cannotRemoveEmptyScope);
+        }
+        this.scopes.delete(scope.trim());
+    }
+    /**
+     * Removes default scopes from set of scopes
+     * Primarily used to prevent cache misses if the default scopes are not returned from the server
+     */
+    removeOIDCScopes() {
+        OIDC_SCOPES.forEach((defaultScope) => {
+            this.scopes.delete(defaultScope);
+        });
+    }
+    /**
+     * Combines an array of scopes with the current set of scopes.
+     * @param otherScopes
+     */
+    unionScopeSets(otherScopes) {
+        if (!otherScopes) {
+            throw createClientAuthError(emptyInputScopeSet);
+        }
+        const unionScopes = new Set(); // Iterator in constructor not supported in IE11
+        otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
+        this.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
+        return unionScopes;
+    }
+    /**
+     * Check if scopes intersect between this set and another.
+     * @param otherScopes
+     */
+    intersectingScopeSets(otherScopes) {
+        if (!otherScopes) {
+            throw createClientAuthError(emptyInputScopeSet);
+        }
+        // Do not allow OIDC scopes to be the only intersecting scopes
+        if (!otherScopes.containsOnlyOIDCScopes()) {
+            otherScopes.removeOIDCScopes();
+        }
+        const unionScopes = this.unionScopeSets(otherScopes);
+        const sizeOtherScopes = otherScopes.getScopeCount();
+        const sizeThisScopes = this.getScopeCount();
+        const sizeUnionScopes = unionScopes.size;
+        return sizeUnionScopes < sizeThisScopes + sizeOtherScopes;
+    }
+    /**
+     * Returns size of set of scopes.
+     */
+    getScopeCount() {
+        return this.scopes.size;
+    }
+    /**
+     * Returns the scopes as an array of string values
+     */
+    asArray() {
+        const array = [];
+        this.scopes.forEach((val) => array.push(val));
+        return array;
+    }
+    /**
+     * Prints scopes into a space-delimited string
+     */
+    printScopes() {
+        if (this.scopes) {
+            const scopeArr = this.asArray();
+            return scopeArr.join(" ");
+        }
+        return "";
+    }
+    /**
+     * Prints scopes into a space-delimited lower-case string (used for caching)
+     */
+    printScopesLowerCase() {
+        return this.printScopes().toLowerCase();
+    }
+}
+
+export { ScopeSet };
+//# sourceMappingURL=ScopeSet.mjs.map

package/dist-browser/request/ScopeSet.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopeSet.mjs","sources":["../../src/request/ScopeSet.ts"],"sourcesContent":[null],"names":["ClientConfigurationErrorCodes.emptyInputScopesError","ClientAuthErrorCodes.cannotAppendScopeSet","ClientAuthErrorCodes.cannotRemoveEmptyScope","ClientAuthErrorCodes.emptyInputScopeSet"],"mappings":";;;;;;;;;AAAA;;;AAGG;AAiBH;;;;AAIG;MACU,QAAQ,CAAA;AAIjB,IAAA,WAAA,CAAY,WAA0B,EAAA;;QAElC,MAAM,QAAQ,GAAG,WAAW;cACtB,WAAW,CAAC,gBAAgB,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;cAC9C,EAAE,CAAC;QACT,MAAM,aAAa,GAAG,QAAQ;AAC1B,cAAE,WAAW,CAAC,2BAA2B,CAAC,QAAQ,CAAC;cACjD,EAAE,CAAC;;AAGT,QAAA,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;AACzC,YAAA,MAAM,8BAA8B,CAChCA,qBAAmD,CACtD,CAAC;AACL,SAAA;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;AAChC,QAAA,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;KAC5D;AAED;;;;;AAKG;IACH,OAAO,UAAU,CAAC,gBAAwB,EAAA;AACtC,QAAA,MAAM,WAAW,GAAG,gBAAgB,IAAI,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAkB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1D,QAAA,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;KACpC;AAED;;;;AAIG;IACH,OAAO,kBAAkB,CAAC,gBAA+B,EAAA;;QAErD,MAAM,WAAW,GACb,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;AAC3C,cAAE,gBAAgB;AAClB,cAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC;AAEnC,QAAA,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3C,QAAA,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE;YACpC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;AAC/B,SAAA;AAAM,aAAA;AACH,YAAA,QAAQ,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAC9C,SAAA;AAED,QAAA,OAAO,QAAQ,CAAC;KACnB;AAED;;;AAGG;AACH,IAAA,aAAa,CAAC,KAAa,EAAA;QACvB,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC/D,QAAA,MAAM,kBAAkB,GAAG,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;;AAEzD,QAAA,OAAO,KAAK;cACN,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;cAClD,KAAK,CAAC;KACf;AAED;;;AAGG;AACH,IAAA,gBAAgB,CAAC,QAAkB,EAAA;QAC/B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE;AACxC,YAAA,OAAO,KAAK,CAAC;AAChB,SAAA;QAED,QACI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI;AACxC,YAAA,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAChE;KACL;AAED;;AAEG;IACH,sBAAsB,GAAA;QAClB,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAC1B,QAAA,WAAW,CAAC,OAAO,CAAC,CAAC,YAAoB,KAAI;AACzC,YAAA,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE;gBAClC,iBAAiB,IAAI,CAAC,CAAC;AAC1B,aAAA;AACL,SAAC,CAAC,CAAC;AAEH,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,CAAC;KACjD;AAED;;;AAGG;AACH,IAAA,WAAW,CAAC,QAAgB,EAAA;AACxB,QAAA,IAAI,QAAQ,EAAE;YACV,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AACpC,SAAA;KACJ;AAED;;;AAGG;AACH,IAAA,YAAY,CAAC,SAAwB,EAAA;QACjC,IAAI;AACA,YAAA,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,SAAA;AAAC,QAAA,OAAO,CAAC,EAAE;AACR,YAAA,MAAM,qBAAqB,CACvBC,oBAAyC,CAC5C,CAAC;AACL,SAAA;KACJ;AAED;;;AAGG;AACH,IAAA,WAAW,CAAC,KAAa,EAAA;QACrB,IAAI,CAAC,KAAK,EAAE;AACR,YAAA,MAAM,qBAAqB,CACvBC,sBAA2C,CAC9C,CAAC;AACL,SAAA;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;KACpC;AAED;;;AAGG;IACH,gBAAgB,GAAA;AACZ,QAAA,WAAW,CAAC,OAAO,CAAC,CAAC,YAAoB,KAAI;AACzC,YAAA,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACrC,SAAC,CAAC,CAAC;KACN;AAED;;;AAGG;AACH,IAAA,cAAc,CAAC,WAAqB,EAAA;QAChC,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,MAAM,qBAAqB,CACvBC,kBAAuC,CAC1C,CAAC;AACL,SAAA;AACD,QAAA,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,KAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACrE,QAAA,OAAO,WAAW,CAAC;KACtB;AAED;;;AAGG;AACH,IAAA,qBAAqB,CAAC,WAAqB,EAAA;QACvC,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,MAAM,qBAAqB,CACvBA,kBAAuC,CAC1C,CAAC;AACL,SAAA;;AAGD,QAAA,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,EAAE;YACvC,WAAW,CAAC,gBAAgB,EAAE,CAAC;AAClC,SAAA;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;AACrD,QAAA,MAAM,eAAe,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;AACpD,QAAA,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;AAC5C,QAAA,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC;AACzC,QAAA,OAAO,eAAe,GAAG,cAAc,GAAG,eAAe,CAAC;KAC7D;AAED;;AAEG;IACH,aAAa,GAAA;AACT,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;KAC3B;AAED;;AAEG;IACH,OAAO,GAAA;QACH,MAAM,KAAK,GAAkB,EAAE,CAAC;AAChC,QAAA,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9C,QAAA,OAAO,KAAK,CAAC;KAChB;AAED;;AAEG;IACH,WAAW,GAAA;QACP,IAAI,IAAI,CAAC,MAAM,EAAE;AACb,YAAA,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;AAChC,YAAA,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,SAAA;AACD,QAAA,OAAO,EAAE,CAAC;KACb;AAED;;AAEG;IACH,oBAAoB,GAAA;AAChB,QAAA,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;KAC3C;AACJ;;;;"}

package/dist-browser/request/StoreInCache.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Controls whether tokens should be stored in the cache or not. If set to false, tokens may still be acquired and returned but will not be cached for later retrieval.
+ */
+export type StoreInCache = {
+    accessToken?: boolean;
+    idToken?: boolean;
+    refreshToken?: boolean;
+};
+//# sourceMappingURL=StoreInCache.d.ts.map

package/dist-browser/request/StoreInCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StoreInCache.d.ts","sourceRoot":"","sources":["../../src/request/StoreInCache.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IAEvB,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC"}

package/dist-browser/response/AuthenticationResult.d.ts

@@ -0,0 +1,42 @@
+import { AccountInfo } from "../account/AccountInfo.js";
+/**
+ * Result returned from the authority's token endpoint.
+ * - uniqueId               - `oid` or `sub` claim from ID token
+ * - tenantId               - `tid` claim from ID token
+ * - scopes                 - Scopes that are validated for the respective token
+ * - account                - An account object representation of the currently signed-in user
+ * - idToken                - Id token received as part of the response
+ * - idTokenClaims          - MSAL-relevant ID token claims
+ * - accessToken            - Access token or SSH certificate received as part of the response
+ * - fromCache              - Boolean denoting whether token came from cache
+ * - expiresOn              - Javascript Date object representing relative expiration of access token
+ * - extExpiresOn           - Javascript Date object representing extended relative expiration of access token in case of server outage
+ * - refreshOn              - Javascript Date object representing relative time until an access token must be refreshed
+ * - state                  - Value passed in by user in request
+ * - familyId               - Family ID identifier, usually only used for refresh tokens
+ * - requestId              - Request ID returned as part of the response
+ */
+export type AuthenticationResult = {
+    authority: string;
+    uniqueId: string;
+    tenantId: string;
+    scopes: Array<string>;
+    account: AccountInfo | null;
+    idToken: string;
+    idTokenClaims: object;
+    accessToken: string;
+    fromCache: boolean;
+    expiresOn: Date | null;
+    extExpiresOn?: Date;
+    refreshOn?: Date;
+    tokenType: string;
+    correlationId: string;
+    requestId?: string;
+    state?: string;
+    familyId?: string;
+    cloudGraphHostName?: string;
+    msGraphHost?: string;
+    code?: string;
+    fromPlatformBroker?: boolean;
+};
+//# sourceMappingURL=AuthenticationResult.d.ts.map

package/dist-browser/response/AuthenticationResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationResult.d.ts","sourceRoot":"","sources":["../../src/response/AuthenticationResult.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC"}

package/dist-browser/response/AuthorizationCodePayload.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Response returned after processing the code response query string or fragment.
+ */
+export type AuthorizationCodePayload = {
+    code: string;
+    cloud_instance_name?: string;
+    cloud_instance_host_name?: string;
+    cloud_graph_host_name?: string;
+    msgraph_host?: string;
+    state?: string;
+    nonce?: string;
+    client_info?: string;
+};
+//# sourceMappingURL=AuthorizationCodePayload.d.ts.map

package/dist-browser/response/AuthorizationCodePayload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationCodePayload.d.ts","sourceRoot":"","sources":["../../src/response/AuthorizationCodePayload.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}

package/dist-browser/response/AuthorizeResponse.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Response properties that may be returned by the /authorize endpoint
+ */
+export type AuthorizeResponse = {
+    /**
+     * Authorization Code to be exchanged for tokens
+     */
+    code?: string;
+    /**
+     * Encrypted Authorize Response (EAR) JWE
+     */
+    ear_jwe?: string;
+    /**
+     * Client info object containing UserId and TenantId
+     */
+    client_info?: string;
+    /**
+     * State string, should match what was sent on request
+     */
+    state?: string;
+    /**
+     * Cloud instance returned when application is instance aware
+     */
+    cloud_instance_name?: string;
+    /**
+     * Cloud instance hostname returned when application is instance aware
+     */
+    cloud_instance_host_name?: string;
+    /**
+     * AAD Graph hostname returned when application is instance aware
+     * https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api
+     */
+    cloud_graph_host_name?: string;
+    /**
+     * Microsoft Graph hostname returned when application is instance aware
+     * https://docs.microsoft.com/en-us/graph/overview
+     */
+    msgraph_host?: string;
+    /**
+     * Server error code
+     */
+    error?: string;
+    /**
+     * Server error URI
+     */
+    error_uri?: string;
+    /**
+     * Server error description
+     */
+    error_description?: string;
+    /**
+     * Server Sub-Error
+     */
+    suberror?: string;
+    /**
+     * Timestamp of request
+     */
+    timestamp?: string;
+    /**
+     * Trace Id used to look up request in logs
+     */
+    trace_id?: string;
+    /**
+     * Correlation ID use to look up request in logs
+     */
+    correlation_id?: string;
+    /**
+     * Claims
+     */
+    claims?: string;
+    /**
+     * AccountId for the user, returned when platform broker is available to use
+     */
+    accountId?: string;
+};
+//# sourceMappingURL=AuthorizeResponse.d.ts.map

package/dist-browser/response/AuthorizeResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizeResponse.d.ts","sourceRoot":"","sources":["../../src/response/AuthorizeResponse.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC5B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC"}

package/dist-browser/response/DeviceCodeResponse.d.ts

@@ -0,0 +1,26 @@
+/**
+ * DeviceCode returned by the security token service device code endpoint containing information necessary for device code flow.
+ * - userCode: code which user needs to provide when authenticating at the verification URI
+ * - deviceCode: code which should be included in the request for the access token
+ * - verificationUri: URI where user can authenticate
+ * - expiresIn: expiration time of the device code in seconds
+ * - interval: interval at which the STS should be polled at
+ * - message: message which should be displayed to the user
+ */
+export type DeviceCodeResponse = {
+    userCode: string;
+    deviceCode: string;
+    verificationUri: string;
+    expiresIn: number;
+    interval: number;
+    message: string;
+};
+export type ServerDeviceCodeResponse = {
+    user_code: string;
+    device_code: string;
+    verification_uri: string;
+    expires_in: number;
+    interval: number;
+    message: string;
+};
+//# sourceMappingURL=DeviceCodeResponse.d.ts.map

package/dist-browser/response/DeviceCodeResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceCodeResponse.d.ts","sourceRoot":"","sources":["../../src/response/DeviceCodeResponse.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist-browser/response/ExternalTokenResponse.d.ts

@@ -0,0 +1,16 @@
+import { ServerAuthorizationTokenResponse } from "./ServerAuthorizationTokenResponse.js";
+/**
+ * Response object used for loading external tokens to cache.
+ * - token_type: Indicates the token type value. The only type that Azure AD supports is Bearer.
+ * - scope: The scopes that the access_token is valid for.
+ * - expires_in: How long the access token is valid (in seconds).
+ * - id_token: A JSON Web Token (JWT). The app can decode the segments of this token to request information about the user who signed in.
+ * - refresh_token: An OAuth 2.0 refresh token. The app can use this token acquire additional access tokens after the current access token expires.
+ * - access_token: The requested access token. The app can use this token to authenticate to the secured resource, such as a web API.
+ * - client_info: Client info object
+ */
+export type ExternalTokenResponse = Pick<ServerAuthorizationTokenResponse, "token_type" | "scope" | "expires_in" | "ext_expires_in" | "id_token" | "refresh_token" | "refresh_token_expires_in" | "foci"> & {
+    access_token?: string;
+    client_info?: string;
+};
+//# sourceMappingURL=ExternalTokenResponse.d.ts.map

package/dist-browser/response/ExternalTokenResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalTokenResponse.d.ts","sourceRoot":"","sources":["../../src/response/ExternalTokenResponse.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAEzF;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACpC,gCAAgC,EAC9B,YAAY,GACZ,OAAO,GACP,YAAY,GACZ,gBAAgB,GAChB,UAAU,GACV,eAAe,GACf,0BAA0B,GAC1B,MAAM,CACX,GAAG;IACA,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}

package/dist-browser/response/IMDSBadResponse.d.ts

@@ -0,0 +1,5 @@
+export type IMDSBadResponse = {
+    error: string;
+    "newest-versions": Array<string>;
+};
+//# sourceMappingURL=IMDSBadResponse.d.ts.map

package/dist-browser/response/IMDSBadResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IMDSBadResponse.d.ts","sourceRoot":"","sources":["../../src/response/IMDSBadResponse.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,eAAe,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACpC,CAAC"}

package/dist-browser/response/ResponseHandler.d.ts

@@ -0,0 +1,63 @@
+import { ServerAuthorizationTokenResponse } from "./ServerAuthorizationTokenResponse.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { Logger } from "../logger/Logger.js";
+import { AuthenticationResult } from "./AuthenticationResult.js";
+import { AccountEntity } from "../cache/entities/AccountEntity.js";
+import { Authority } from "../authority/Authority.js";
+import { CacheRecord } from "../cache/entities/CacheRecord.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { ICachePlugin } from "../cache/interface/ICachePlugin.js";
+import { ISerializableTokenCache } from "../cache/interface/ISerializableTokenCache.js";
+import { AuthorizationCodePayload } from "./AuthorizationCodePayload.js";
+import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import { TokenClaims } from "../account/TokenClaims.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+import { RequestStateObject } from "../utils/StateTypes.js";
+/**
+ * Class that handles response parsing.
+ * @internal
+ */
+export declare class ResponseHandler {
+    private clientId;
+    private cacheStorage;
+    private cryptoObj;
+    private logger;
+    private homeAccountIdentifier;
+    private performanceClient;
+    private serializableCache;
+    private persistencePlugin;
+    constructor(clientId: string, cacheStorage: CacheManager, cryptoObj: ICrypto, logger: Logger, performanceClient: IPerformanceClient, serializableCache: ISerializableTokenCache | null, persistencePlugin: ICachePlugin | null);
+    /**
+     * Function which validates server authorization token response.
+     * @param serverResponse
+     * @param correlationId
+     * @param refreshAccessToken
+     */
+    validateTokenResponse(serverResponse: ServerAuthorizationTokenResponse, correlationId: string, refreshAccessToken?: boolean): void;
+    /**
+     * Returns a constructed token response based on given string. Also manages the cache updates and cleanups.
+     * @param serverTokenResponse
+     * @param authority
+     */
+    handleServerTokenResponse(serverTokenResponse: ServerAuthorizationTokenResponse, authority: Authority, reqTimestamp: number, request: BaseAuthRequest, apiId: number, authCodePayload?: AuthorizationCodePayload, userAssertionHash?: string, handlingRefreshTokenResponse?: boolean, forceCacheRefreshTokenResponse?: boolean, serverRequestId?: string): Promise<AuthenticationResult>;
+    /**
+     * Generates CacheRecord
+     * @param serverTokenResponse
+     * @param idTokenObj
+     * @param authority
+     */
+    private generateCacheRecord;
+    /**
+     * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
+     *
+     * Optionally takes a state string that is set as-is in the response.
+     *
+     * @param cacheRecord
+     * @param idTokenObj
+     * @param fromTokenCache
+     * @param stateString
+     */
+    static generateAuthenticationResult(cryptoObj: ICrypto, authority: Authority, cacheRecord: CacheRecord, fromTokenCache: boolean, request: BaseAuthRequest, performanceClient: IPerformanceClient, idTokenClaims?: TokenClaims, requestState?: RequestStateObject, serverTokenResponse?: ServerAuthorizationTokenResponse, requestId?: string): Promise<AuthenticationResult>;
+}
+export declare function buildAccountToCache(cacheStorage: CacheManager, authority: Authority, homeAccountId: string, base64Decode: (input: string) => string, correlationId: string, idTokenClaims?: TokenClaims, clientInfo?: string, environment?: string, claimsTenantId?: string | null, authCodePayload?: AuthorizationCodePayload, nativeAccountId?: string, logger?: Logger): AccountEntity;
+//# sourceMappingURL=ResponseHandler.d.ts.map

package/dist-browser/response/ResponseHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResponseHandler.d.ts","sourceRoot":"","sources":["../../src/response/ResponseHandler.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAK/C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAQtD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMhE,OAAO,EACH,WAAW,EAEd,MAAM,2BAA2B,CAAC;AASnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D;;;GAGG;AACH,qBAAa,eAAe;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,iBAAiB,CAAiC;IAC1D,OAAO,CAAC,iBAAiB,CAAsB;gBAG3C,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,kBAAkB,EACrC,iBAAiB,EAAE,uBAAuB,GAAG,IAAI,EACjD,iBAAiB,EAAE,YAAY,GAAG,IAAI;IAW1C;;;;;OAKG;IACH,qBAAqB,CACjB,cAAc,EAAE,gCAAgC,EAChD,aAAa,EAAE,MAAM,EACrB,kBAAkB,CAAC,EAAE,OAAO,GAC7B,IAAI;IAoFP;;;;OAIG;IACG,yBAAyB,CAC3B,mBAAmB,EAAE,gCAAgC,EACrD,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,EACb,eAAe,CAAC,EAAE,wBAAwB,EAC1C,iBAAiB,CAAC,EAAE,MAAM,EAC1B,4BAA4B,CAAC,EAAE,OAAO,EACtC,8BAA8B,CAAC,EAAE,OAAO,EACxC,eAAe,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,oBAAoB,CAAC;IA2JhC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAkJ3B;;;;;;;;;OASG;WACU,4BAA4B,CACrC,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,EACvB,OAAO,EAAE,eAAe,EACxB,iBAAiB,EAAE,kBAAkB,EACrC,aAAa,CAAC,EAAE,WAAW,EAC3B,YAAY,CAAC,EAAE,kBAAkB,EACjC,mBAAmB,CAAC,EAAE,gCAAgC,EACtD,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,CAAC;CAqGnC;AAED,wBAAgB,mBAAmB,CAC/B,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,EACvC,aAAa,EAAE,MAAM,EACrB,aAAa,CAAC,EAAE,WAAW,EAC3B,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,eAAe,CAAC,EAAE,wBAAwB,EAC1C,eAAe,CAAC,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,MAAM,GAChB,aAAa,CAiDf"}