@azure/msal-common 16.11.1 → 16.11.2

package/src/crypto/DpopProofGenerator.ts

@@ -0,0 +1,247 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { ICrypto, JsonWebTokenAlgorithms } from "./ICrypto.js";
+import * as TimeUtils from "../utils/TimeUtils.js";
+import {
+    createClientConfigurationError,
+    ClientConfigurationErrorCodes,
+} from "../error/ClientConfigurationError.js";
+
+/**
+ * RFC 9449 DPoP proof JWT payload claims.
+ * Not exported from any public package entry point.
+ * @internal
+ */
+export type DpopProofClaims = {
+    jti: string;
+    htm: string;
+    htu: string;
+    iat: number;
+    nonce?: string;
+    ath?: string;
+};
+
+/**
+ * Parameters for building a token-endpoint DPoP proof.
+ * @internal
+ */
+export type DpopTokenProofParams = {
+    tokenEndpoint: string;
+    nonce?: string;
+};
+
+/**
+ * Parameters for building a resource-endpoint DPoP proof.
+ * @internal
+ */
+export type DpopResourceProofParams = {
+    resourceUrl: string;
+    htm: string;
+    ath: string;
+    nonce?: string;
+};
+
+/**
+ * Public JWK embedded in the DPoP proof header.
+ * @internal
+ */
+export type DpopPublicJwk = Record<string, unknown>;
+
+/**
+ * RFC 9449 DPoP proof JWT header.
+ * @internal
+ */
+export type DpopProofHeader = {
+    typ: typeof DPOP_JWT_HEADER_TYPE;
+    alg: string;
+    jwk: DpopPublicJwk;
+};
+
+/**
+ * Signs the ASCII DPoP JWT signing input with the declared JOSE alg
+ * and returns a base64url-encoded signature.
+ * @internal
+ */
+export type DpopProofSigner = {
+    alg: string;
+    sign: (signingInput: string, correlationId: string) => Promise<string>;
+};
+
+/**
+ * Parameters shared by token and resource DPoP proof generation.
+ * @internal
+ */
+export type DpopProofGenerationParams = {
+    publicJwk: DpopPublicJwk;
+    signer: DpopProofSigner;
+};
+
+const DPOP_HTM_REGEX = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+export const DPOP_JWT_HEADER_TYPE = "dpop+jwt";
+export const DPOP_JWT_HEADER_ALGORITHM = JsonWebTokenAlgorithms.ES256;
+
+function buildProofHeader(params: DpopProofGenerationParams): DpopProofHeader {
+    return {
+        typ: DPOP_JWT_HEADER_TYPE,
+        alg: params.signer.alg,
+        jwk: params.publicJwk,
+    };
+}
+
+function normalizeHtm(htm: string, correlationId: string): string {
+    if (typeof htm !== "string" || !DPOP_HTM_REGEX.test(htm)) {
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.invalidDpopHtm,
+            correlationId
+        );
+    }
+
+    return htm.toUpperCase();
+}
+
+/**
+ * Normalizes a URL for use as the DPoP htu claim.
+ * Per RFC 9449 §4.2, htu is the target URI without query and fragment components.
+ * WHATWG URL serialization handles RFC 3986 syntax- and scheme-based normalization
+ * such as lowercasing scheme/host and eliding default ports.
+ */
+function normalizeHtu(url: string, correlationId: string): string {
+    let parsedUrl: URL;
+    try {
+        parsedUrl = new URL(url);
+    } catch {
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.urlParseError,
+            correlationId
+        );
+    }
+
+    if (
+        !/^https:\/\//i.test(url) ||
+        parsedUrl.protocol !== "https:" ||
+        parsedUrl.username ||
+        parsedUrl.password
+    ) {
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.invalidDpopHtu,
+            correlationId
+        );
+    }
+
+    parsedUrl.search = "";
+    parsedUrl.hash = "";
+    return parsedUrl.href;
+}
+
+/**
+ * Builds RFC 9449 DPoP proof JWT payloads for token-endpoint and
+ * resource-endpoint proof bindings.
+ *
+ * Not exported from any public package entry point.
+ * This helper is internal-only until DPoP is wired into acquisition flows
+ * in a subsequent work item.
+ *
+ * DPoP proofs do not contain SHR fields (at, ts, m, u, p, q).
+ * @internal
+ */
+export class DpopProofGenerator {
+    private cryptoUtils: ICrypto;
+
+    constructor(cryptoUtils: ICrypto) {
+        this.cryptoUtils = cryptoUtils;
+    }
+
+    /**
+     * Builds RFC 9449 claims for a token-endpoint DPoP proof.
+     * - htm is always "POST" because token endpoint requests use HTTP POST (RFC 9449 §5).
+     * - htu is the normalized token endpoint URI (query and fragment stripped).
+     * - jti is a fresh CSPRNG-backed unique identifier for every proof.
+     */
+    buildTokenProofClaims(
+        params: DpopTokenProofParams,
+        correlationId: string = ""
+    ): DpopProofClaims {
+        const claims: DpopProofClaims = {
+            jti: this.cryptoUtils.createNewGuid(),
+            htm: "POST",
+            htu: normalizeHtu(params.tokenEndpoint, correlationId),
+            iat: TimeUtils.nowSeconds(),
+        };
+        if (params.nonce !== undefined) {
+            claims.nonce = params.nonce;
+        }
+        return claims;
+    }
+
+    /**
+     * Builds and signs a compact DPoP proof JWT for a token-endpoint request.
+     */
+    async generateTokenProof(
+        params: DpopTokenProofParams & DpopProofGenerationParams,
+        correlationId: string = ""
+    ): Promise<string> {
+        return this.generateProof(
+            this.buildTokenProofClaims(params, correlationId),
+            params,
+            correlationId
+        );
+    }
+
+    /**
+     * Builds RFC 9449 claims for a resource-endpoint DPoP proof.
+     * - htm is uppercased per RFC 9449 §4.2.
+     * - htu is the normalized resource URI (query and fragment stripped).
+     * - ath is the base64url-encoded SHA-256 hash of the ASCII access token.
+     * - jti is a fresh CSPRNG-backed unique identifier for every proof.
+     */
+    buildResourceProofClaims(
+        params: DpopResourceProofParams,
+        correlationId: string = ""
+    ): DpopProofClaims {
+        const claims: DpopProofClaims = {
+            jti: this.cryptoUtils.createNewGuid(),
+            htm: normalizeHtm(params.htm, correlationId),
+            htu: normalizeHtu(params.resourceUrl, correlationId),
+            ath: params.ath,
+            iat: TimeUtils.nowSeconds(),
+        };
+        if (params.nonce !== undefined) {
+            claims.nonce = params.nonce;
+        }
+        return claims;
+    }
+
+    /**
+     * Builds and signs a compact DPoP proof JWT for a resource request.
+     */
+    async generateResourceProof(
+        params: DpopResourceProofParams & DpopProofGenerationParams,
+        correlationId: string = ""
+    ): Promise<string> {
+        return this.generateProof(
+            this.buildResourceProofClaims(params, correlationId),
+            params,
+            correlationId
+        );
+    }
+
+    private async generateProof(
+        claims: DpopProofClaims,
+        params: DpopProofGenerationParams,
+        correlationId: string
+    ): Promise<string> {
+        const encodedHeader = this.cryptoUtils.base64UrlEncode(
+            JSON.stringify(buildProofHeader(params))
+        );
+        const encodedClaims = this.cryptoUtils.base64UrlEncode(
+            JSON.stringify(claims)
+        );
+        const signingInput = `${encodedHeader}.${encodedClaims}`;
+        const signature = await params.signer.sign(signingInput, correlationId);
+
+        return `${signingInput}.${signature}`;
+    }
+}

package/src/crypto/ICrypto.ts

@@ -11,15 +11,17 @@ import type { BaseAuthRequest } from "../request/BaseAuthRequest.js";
 import type { ShrOptions, SignedHttpRequest } from "./SignedHttpRequest.js";
 
 /**
- * The PkceCodes type describes the structure
- * of objects that contain PKCE code
- * challenge and verifier pairs
+ * PKCE code verifier and challenge pair used by authorization code flows.
  */
 export type PkceCodes = {
     verifier: string;
     challenge: string;
 };
 
+/**
+ * Parameters used by crypto implementations to build signed HTTP request
+ * proof-of-possession tokens.
+ */
 export type SignedHttpRequestParameters = Pick<
     BaseAuthRequest,
     | "resourceRequestMethod"
@@ -31,6 +33,12 @@ export type SignedHttpRequestParameters = Pick<
     correlationId: string;
 };
 
+/**
+ * Shared JOSE algorithm literals used by MSAL package internals.
+ */
+export const JsonWebTokenAlgorithms = {
+    ES256: "ES256",
+} as const;
 /**
  * Interface for crypto functions used by library
  */
@@ -94,6 +102,10 @@ export interface ICrypto {
     hashString(plainText: string): Promise<string>;
 }
 
+/**
+ * Default crypto implementation used when a platform-specific implementation has
+ * not been provided.
+ */
 export const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {
     createNewGuid: (): string => {
         throw createClientAuthError(

package/src/error/ClientConfigurationErrorCodes.ts

@@ -30,3 +30,5 @@ export const invalidPlatformBrokerConfiguration =
     "invalid_platform_broker_configuration";
 export const issuerValidationFailed = "issuer_validation_failed";
 export const invalidResponseMode = "invalid_response_mode";
+export const invalidDpopHtm = "invalid_dpop_htm";
+export const invalidDpopHtu = "invalid_dpop_htu";

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.11.1";
+export const version = "16.11.2";

package/types/crypto/DpopProofGenerator.d.ts

@@ -0,0 +1,105 @@
+import { ICrypto } from "./ICrypto.js";
+/**
+ * RFC 9449 DPoP proof JWT payload claims.
+ * Not exported from any public package entry point.
+ * @internal
+ */
+export type DpopProofClaims = {
+    jti: string;
+    htm: string;
+    htu: string;
+    iat: number;
+    nonce?: string;
+    ath?: string;
+};
+/**
+ * Parameters for building a token-endpoint DPoP proof.
+ * @internal
+ */
+export type DpopTokenProofParams = {
+    tokenEndpoint: string;
+    nonce?: string;
+};
+/**
+ * Parameters for building a resource-endpoint DPoP proof.
+ * @internal
+ */
+export type DpopResourceProofParams = {
+    resourceUrl: string;
+    htm: string;
+    ath: string;
+    nonce?: string;
+};
+/**
+ * Public JWK embedded in the DPoP proof header.
+ * @internal
+ */
+export type DpopPublicJwk = Record<string, unknown>;
+/**
+ * RFC 9449 DPoP proof JWT header.
+ * @internal
+ */
+export type DpopProofHeader = {
+    typ: typeof DPOP_JWT_HEADER_TYPE;
+    alg: string;
+    jwk: DpopPublicJwk;
+};
+/**
+ * Signs the ASCII DPoP JWT signing input with the declared JOSE alg
+ * and returns a base64url-encoded signature.
+ * @internal
+ */
+export type DpopProofSigner = {
+    alg: string;
+    sign: (signingInput: string, correlationId: string) => Promise<string>;
+};
+/**
+ * Parameters shared by token and resource DPoP proof generation.
+ * @internal
+ */
+export type DpopProofGenerationParams = {
+    publicJwk: DpopPublicJwk;
+    signer: DpopProofSigner;
+};
+export declare const DPOP_JWT_HEADER_TYPE = "dpop+jwt";
+export declare const DPOP_JWT_HEADER_ALGORITHM: "ES256";
+/**
+ * Builds RFC 9449 DPoP proof JWT payloads for token-endpoint and
+ * resource-endpoint proof bindings.
+ *
+ * Not exported from any public package entry point.
+ * This helper is internal-only until DPoP is wired into acquisition flows
+ * in a subsequent work item.
+ *
+ * DPoP proofs do not contain SHR fields (at, ts, m, u, p, q).
+ * @internal
+ */
+export declare class DpopProofGenerator {
+    private cryptoUtils;
+    constructor(cryptoUtils: ICrypto);
+    /**
+     * Builds RFC 9449 claims for a token-endpoint DPoP proof.
+     * - htm is always "POST" because token endpoint requests use HTTP POST (RFC 9449 §5).
+     * - htu is the normalized token endpoint URI (query and fragment stripped).
+     * - jti is a fresh CSPRNG-backed unique identifier for every proof.
+     */
+    buildTokenProofClaims(params: DpopTokenProofParams, correlationId?: string): DpopProofClaims;
+    /**
+     * Builds and signs a compact DPoP proof JWT for a token-endpoint request.
+     */
+    generateTokenProof(params: DpopTokenProofParams & DpopProofGenerationParams, correlationId?: string): Promise<string>;
+    /**
+     * Builds RFC 9449 claims for a resource-endpoint DPoP proof.
+     * - htm is uppercased per RFC 9449 §4.2.
+     * - htu is the normalized resource URI (query and fragment stripped).
+     * - ath is the base64url-encoded SHA-256 hash of the ASCII access token.
+     * - jti is a fresh CSPRNG-backed unique identifier for every proof.
+     */
+    buildResourceProofClaims(params: DpopResourceProofParams, correlationId?: string): DpopProofClaims;
+    /**
+     * Builds and signs a compact DPoP proof JWT for a resource request.
+     */
+    generateResourceProof(params: DpopResourceProofParams & DpopProofGenerationParams, correlationId?: string): Promise<string>;
+    private generateProof;
+}
+//# sourceMappingURL=DpopProofGenerator.d.ts.map

package/types/crypto/DpopProofGenerator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DpopProofGenerator.d.ts","sourceRoot":"","sources":["../../src/crypto/DpopProofGenerator.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,cAAc,CAAC;AAO/D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC1B,GAAG,EAAE,OAAO,oBAAoB,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,aAAa,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1E,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,eAAe,CAAC;CAC3B,CAAC;AAGF,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAC/C,eAAO,MAAM,yBAAyB,SAA+B,CAAC;AAuDtE;;;;;;;;;;GAUG;AACH,qBAAa,kBAAkB;IAC3B,OAAO,CAAC,WAAW,CAAU;gBAEjB,WAAW,EAAE,OAAO;IAIhC;;;;;OAKG;IACH,qBAAqB,CACjB,MAAM,EAAE,oBAAoB,EAC5B,aAAa,GAAE,MAAW,GAC3B,eAAe;IAalB;;OAEG;IACG,kBAAkB,CACpB,MAAM,EAAE,oBAAoB,GAAG,yBAAyB,EACxD,aAAa,GAAE,MAAW,GAC3B,OAAO,CAAC,MAAM,CAAC;IAQlB;;;;;;OAMG;IACH,wBAAwB,CACpB,MAAM,EAAE,uBAAuB,EAC/B,aAAa,GAAE,MAAW,GAC3B,eAAe;IAclB;;OAEG;IACG,qBAAqB,CACvB,MAAM,EAAE,uBAAuB,GAAG,yBAAyB,EAC3D,aAAa,GAAE,MAAW,GAC3B,OAAO,CAAC,MAAM,CAAC;YAQJ,aAAa;CAgB9B"}

package/types/crypto/ICrypto.d.ts

@@ -1,17 +1,25 @@
 import type { BaseAuthRequest } from "../request/BaseAuthRequest.js";
 import type { ShrOptions, SignedHttpRequest } from "./SignedHttpRequest.js";
 /**
- * The PkceCodes type describes the structure
- * of objects that contain PKCE code
- * challenge and verifier pairs
+ * PKCE code verifier and challenge pair used by authorization code flows.
  */
 export type PkceCodes = {
     verifier: string;
     challenge: string;
 };
+/**
+ * Parameters used by crypto implementations to build signed HTTP request
+ * proof-of-possession tokens.
+ */
 export type SignedHttpRequestParameters = Pick<BaseAuthRequest, "resourceRequestMethod" | "resourceRequestUri" | "shrClaims" | "shrNonce" | "shrOptions"> & {
     correlationId: string;
 };
+/**
+ * Shared JOSE algorithm literals used by MSAL package internals.
+ */
+export declare const JsonWebTokenAlgorithms: {
+    readonly ES256: "ES256";
+};
 /**
  * Interface for crypto functions used by library
  */
@@ -67,5 +75,9 @@ export interface ICrypto {
      */
     hashString(plainText: string): Promise<string>;
 }
+/**
+ * Default crypto implementation used when a platform-specific implementation has
+ * not been provided.
+ */
 export declare const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto;
 //# sourceMappingURL=ICrypto.d.ts.map

package/types/crypto/ICrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ICrypto.d.ts","sourceRoot":"","sources":["../../src/crypto/ICrypto.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE5E;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC1C,eAAe,EACb,uBAAuB,GACvB,oBAAoB,GACpB,WAAW,GACX,UAAU,GACV,YAAY,CACjB,GAAG;IACA,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,OAAO;IACpB;;OAEG;IACH,aAAa,IAAI,MAAM,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;OAGG;IACH,sBAAsB,CAClB,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;OAIG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;;OAGG;IACH,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD;;;OAGG;IACH,OAAO,CACH,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,UAAU,EACvB,aAAa,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD;AAED,eAAO,MAAM,6BAA6B,EAAE,OA6D3C,CAAC"}
+{"version":3,"file":"ICrypto.d.ts","sourceRoot":"","sources":["../../src/crypto/ICrypto.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE5E;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC1C,eAAe,EACb,uBAAuB,GACvB,oBAAoB,GACpB,WAAW,GACX,UAAU,GACV,YAAY,CACjB,GAAG;IACA,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;CAEzB,CAAC;AACX;;GAEG;AACH,MAAM,WAAW,OAAO;IACpB;;OAEG;IACH,aAAa,IAAI,MAAM,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;OAGG;IACH,sBAAsB,CAClB,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;OAIG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;;OAGG;IACH,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD;;;OAGG;IACH,OAAO,CACH,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,UAAU,EACvB,aAAa,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,OA6D3C,CAAC"}

package/types/error/ClientConfigurationErrorCodes.d.ts

@@ -23,4 +23,6 @@ export declare const invalidRequestMethodForEAR = "invalid_request_method_for_EA
 export declare const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
 export declare const issuerValidationFailed = "issuer_validation_failed";
 export declare const invalidResponseMode = "invalid_response_mode";
+export declare const invalidDpopHtm = "invalid_dpop_htm";
+export declare const invalidDpopHtu = "invalid_dpop_htu";
 //# sourceMappingURL=ClientConfigurationErrorCodes.d.ts.map

package/types/error/ClientConfigurationErrorCodes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ClientConfigurationErrorCodes.d.ts","sourceRoot":"","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AACrD,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AACxE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAChE,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAC9C,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAC1E,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AACrE,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,gCAAgC,wCACJ,CAAC;AAC1C,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAC3E,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AACxE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AACtD,eAAO,MAAM,0BAA0B,mCAAmC,CAAC;AAC3E,eAAO,MAAM,kCAAkC,0CACJ,CAAC;AAC5C,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AACjE,eAAO,MAAM,mBAAmB,0BAA0B,CAAC"}
+{"version":3,"file":"ClientConfigurationErrorCodes.d.ts","sourceRoot":"","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AACrD,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AACxE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAChE,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAC9C,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAC1E,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AACrE,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,gCAAgC,wCACJ,CAAC;AAC1C,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAC3E,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AACxE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AACtD,eAAO,MAAM,0BAA0B,mCAAmC,CAAC;AAC3E,eAAO,MAAM,kCAAkC,0CACJ,CAAC;AAC5C,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AACjE,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D,eAAO,MAAM,cAAc,qBAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,qBAAqB,CAAC"}

package/types/packageMetadata.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "@azure/msal-common";
-export declare const version = "16.11.1";
+export declare const version = "16.11.2";
 //# sourceMappingURL=packageMetadata.d.ts.map