@azure/msal-common 16.1.0 → 16.3.0

package/lib/{index-node-C4hhfREr.js → index-node-BUrdOQX5.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 'use strict';
 'use strict';
 
@@ -88,7 +88,9 @@ const noNetworkConnectivity = "no_network_connectivity";
 const userCanceled = "user_canceled";
 const methodNotImplemented = "method_not_implemented";
 const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
-const platformBrokerError = "platform_broker_error";
+const platformBrokerError = "platform_broker_error";
+const resourceParameterRequired = "resource_parameter_required";
+const misplacedResourceParam = "misplaced_resource_parameter";
 
 var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -109,6 +111,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     keyIdMissing: keyIdMissing,
     maxAgeTranspired: maxAgeTranspired,
     methodNotImplemented: methodNotImplemented,
+    misplacedResourceParam: misplacedResourceParam,
     multipleMatchingAppMetadata: multipleMatchingAppMetadata,
     multipleMatchingTokens: multipleMatchingTokens,
     nestedAppAuthBridgeDisabled: nestedAppAuthBridgeDisabled,
@@ -122,6 +125,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     openIdConfigError: openIdConfigError,
     platformBrokerError: platformBrokerError,
     requestCannotBeMade: requestCannotBeMade,
+    resourceParameterRequired: resourceParameterRequired,
     stateMismatch: stateMismatch,
     stateNotFound: stateNotFound,
     tokenClaimsCnfRequiredForSignedJwt: tokenClaimsCnfRequiredForSignedJwt,
@@ -1303,8 +1307,7 @@ const invoke = (callback, eventName, logger, telemetryClient, correlationId) =>
         const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
         if (correlationId) {
             // Track number of times this API is called in a single request
-            const eventCount = eventName + "CallCount";
-            telemetryClient.incrementFields({ [eventCount]: 1 }, correlationId);
+            telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
         }
         try {
             const result = callback(...args);
@@ -1348,8 +1351,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
         const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
         if (correlationId) {
             // Track number of times this API is called in a single request
-            const eventCount = eventName + "CallCount";
-            telemetryClient.incrementFields({ [eventCount]: 1 }, correlationId);
+            telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
         }
         return callback(...args)
             .then((response) => {
@@ -2872,7 +2874,8 @@ const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
-const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const RESOURCE = "resource";
 
 var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -2916,6 +2919,7 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     REFRESH_TOKEN_EXPIRES_IN: REFRESH_TOKEN_EXPIRES_IN,
     REQUESTED_TOKEN_USE: REQUESTED_TOKEN_USE,
     REQ_CNF: REQ_CNF,
+    RESOURCE: RESOURCE,
     RESPONSE_MODE: RESPONSE_MODE,
     RESPONSE_TYPE: RESPONSE_TYPE,
     RETURN_SPA_CODE: RETURN_SPA_CODE,
@@ -3870,6 +3874,11 @@ function addEARParameters(parameters, jwk) {
     // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
     const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+function addResource(parameters, resource) {
+    if (resource) {
+        parameters.set(RESOURCE, resource);
+    }
 }
 
 var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
@@ -3909,6 +3918,7 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     addRedirectUri: addRedirectUri,
     addRefreshToken: addRefreshToken,
     addRequestTokenUse: addRequestTokenUse,
+    addResource: addResource,
     addResponseMode: addResponseMode,
     addResponseType: addResponseType,
     addScopes: addScopes,
@@ -4234,7 +4244,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.1.0";
+const version = "16.3.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5395,6 +5405,12 @@ const PerformanceEventStatus = {
     InProgress: 1,
     Completed: 2,
 };
+/**
+ * Prefix used to mark telemetry field names as dynamic.
+ * Fields with this prefix in addFields/incrementFields calls will be routed
+ * to the PerformanceEvent.ext sub-object.
+ */
+const EXT_FIELD_PREFIX = "ext.";
 const IntFields = new Set([
     "accessTokenSize",
     "durationMs",
@@ -5419,6 +5435,9 @@ const IntFields = new Set([
     "currRefreshCount",
     "expiredCacheRemovedCount",
     "upgradedCacheCount",
+    "networkRtt",
+    "redirectBridgeTimeoutMs",
+    "redirectBridgeMessageVersion",
 ]);
 
 /*
@@ -5555,6 +5574,7 @@ function buildAuthOptions(authOptions) {
         clientCapabilities: [],
         azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
         instanceAware: false,
+        isMcp: false,
         ...authOptions,
     };
 }
@@ -6072,6 +6092,11 @@ class ResponseHandler {
                 : undefined;
             // non AAD scenarios can have empty realm
             cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+            // Set resource (to be used for MCP scenarios)
+            const resource = request.resource || null;
+            if (resource) {
+                cachedAccessToken.resource = resource;
+            }
         }
         // refreshToken
         let cachedRefreshToken = null;
@@ -6625,6 +6650,7 @@ class AuthorizationCodeClient {
         }
         // Add scope array, parameter builder will add default scopes and dedupe
         addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+        addResource(parameters, request.resource);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
         // Add library metadata
@@ -7042,6 +7068,13 @@ class SilentFlowClient {
             this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
             throw createClientAuthError(tokenRefreshRequired);
         }
+        else if (request.resource) {
+            // cached access token must have a resource that matches the request resource for MCP scenarios
+            if (cachedAccessToken.resource !== request.resource) {
+                this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+                throw createClientAuthError(tokenRefreshRequired);
+            }
+        }
         else if (cachedAccessToken.refreshOn &&
             isTokenExpired(cachedAccessToken.refreshOn, 0)) {
             // must refresh (in the background) due to the refresh_in value
@@ -7132,6 +7165,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
         ...(request.extraScopesToConsent || []),
     ];
     addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addResource(parameters, request.resource);
     addRedirectUri(parameters, request.redirectUri);
     addCorrelationId(parameters, correlationId);
     // add response_mode. If not passed in it defaults to query.
@@ -7338,6 +7372,37 @@ var Authorize = /*#__PURE__*/Object.freeze({
     validateAuthorizationResponse: validateAuthorizationResponse
 });
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
+ * If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
+ * This is used for MCP flows.
+ * @param isMcp - Flag indicating if application is an MCP app, from configuration
+ * @param request - Auth request
+ */
+function enforceResourceParameter(isMcp, request) {
+    if (!isMcp) {
+        return;
+    }
+    if (request.resource &&
+        (containsResourceParam(request.extraParameters) ||
+            containsResourceParam(request.extraQueryParameters))) {
+        throw createClientAuthError(misplacedResourceParam);
+    }
+    if (!request.resource) {
+        throw createClientAuthError(resourceParameterRequired);
+    }
+}
+function containsResourceParam(params) {
+    if (!params) {
+        return false;
+    }
+    return Object.prototype.hasOwnProperty.call(params, "resource");
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7722,6 +7787,7 @@ exports.Constants = Constants;
 exports.DEFAULT_CRYPTO_IMPLEMENTATION = DEFAULT_CRYPTO_IMPLEMENTATION;
 exports.DEFAULT_SYSTEM_OPTIONS = DEFAULT_SYSTEM_OPTIONS;
 exports.DefaultStorageClass = DefaultStorageClass;
+exports.EXT_FIELD_PREFIX = EXT_FIELD_PREFIX;
 exports.IntFields = IntFields;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
 exports.InteractionRequiredAuthErrorCodes = InteractionRequiredAuthErrorCodes;
@@ -7762,6 +7828,7 @@ exports.createClientAuthError = createClientAuthError;
 exports.createClientConfigurationError = createClientConfigurationError;
 exports.createInteractionRequiredAuthError = createInteractionRequiredAuthError;
 exports.createNetworkError = createNetworkError;
+exports.enforceResourceParameter = enforceResourceParameter;
 exports.formatAuthorityUri = formatAuthorityUri;
 exports.getAndFlushLogsFromCache = getAndFlushLogsFromCache;
 exports.getClientAssertion = getClientAssertion;
@@ -7772,4 +7839,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-C4hhfREr.js.map
+//# sourceMappingURL=index-node-BUrdOQX5.js.map