@azure/msal-common 16.11.3 → 16.12.0

package/lib/{index-node-JVUj78ag.js → index-node-3p7V__ym.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 'use strict';
 'use strict';
 
@@ -1835,6 +1835,19 @@ function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetw
  */
 function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
+}
+/**
+ * Serialize attribute tokens synchronously (sort and join).
+ * This is a sync-only operation for use at request construction time.
+ * @param attributeTokens - array of tokens
+ * @returns serialized partition string or undefined if no tokens
+ */
+function serializeAttributeTokens(attributeTokens) {
+    if (!attributeTokens || attributeTokens.length === 0) {
+        return undefined;
+    }
+    // Serialize: sort and join tokens
+    return [...attributeTokens].sort().join(" ");
 }
 
 var CacheHelpers = /*#__PURE__*/Object.freeze({
@@ -1853,6 +1866,7 @@ var CacheHelpers = /*#__PURE__*/Object.freeze({
     isRefreshTokenEntity: isRefreshTokenEntity,
     isServerTelemetryEntity: isServerTelemetryEntity,
     isThrottlingEntity: isThrottlingEntity,
+    serializeAttributeTokens: serializeAttributeTokens,
     updateAuthorityEndpointMetadata: updateAuthorityEndpointMetadata,
     updateCloudDiscoveryMetadata: updateCloudDiscoveryMetadata
 });
@@ -3058,11 +3072,13 @@ const CLI_DATA = "clidata";
 const USER_FEDERATED_IDENTITY_CREDENTIAL = "user_federated_identity_credential";
 const USERNAME = "username";
 const USER_ID = "user_id";
-const FMI_PATH = "fmi_path";
+const FMI_PATH = "fmi_path";
+const ATTRIBUTE_TOKENS = "attribute_tokens";
 
 var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     __proto__: null,
     ACCESS_TOKEN: ACCESS_TOKEN,
+    ATTRIBUTE_TOKENS: ATTRIBUTE_TOKENS,
     BROKER_CLIENT_ID: BROKER_CLIENT_ID,
     BROKER_REDIRECT_URI: BROKER_REDIRECT_URI,
     CCS_HEADER: CCS_HEADER,
@@ -3812,13 +3828,14 @@ function addSid(parameters, sid) {
  * @param claims - The claims string from the request
  * @param clientCapabilities - The client capabilities from configuration
  * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+ * @param claimsToMerge - Optional client-originated claims JSON string (e.g. `claimsFromClient`) deep-merged into `claims` with precedence on conflicts
  */
-function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims) {
+function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims, claimsToMerge) {
     // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
     const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
         ? undefined
         : clientCapabilities;
-    const mergedClaims = buildMergedClaims(claims, configClaims, correlationId);
+    const mergedClaims = buildMergedClaims(claims, configClaims, correlationId, claimsToMerge);
     parameters.set(CLAIMS, mergedClaims);
 }
 /**
@@ -4005,32 +4022,79 @@ const DEFAULT_ID_TOKEN_CLAIMS = {
     [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
 };
 /**
- * Parses claims JSON, merges default optional idToken claims (signin_state, login_hint),
- * and appends client capabilities (xms_cc) to the access_token section.
+ * Parses a claims JSON string into an object, throwing a ClientConfigurationError
+ * (error code `invalid_claims`) if the value is not a valid JSON object. The raw
+ * claims value is never included in the error - it may contain sensitive data.
+ * @param claims - Claims JSON string. Must be valid JSON representing an object.
+ * @param correlationId - The request correlation id
+ * @returns The parsed claims object
+ */
+function parseClaims(claims, correlationId = "") {
+    let parsed;
+    try {
+        parsed = JSON.parse(claims);
+    }
+    catch (e) {
+        // Malformed JSON
+        throw createClientConfigurationError(invalidClaims, correlationId);
+    }
+    if (!isPlainObject(parsed)) {
+        // Valid JSON, but not an object (e.g. an array, a scalar, or the literal `null`).
+        throw createClientConfigurationError(invalidClaims, correlationId);
+    }
+    return parsed;
+}
+/**
+ * Type guard for a non-null, non-array object (a JSON "object" value).
+ * @param value - The value to test
+ * @returns True when value is a plain object that can be deep-merged
+ */
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Recursively deep-merges two parsed claims objects. Nested objects are merged key-by-key;
+ * for any other value type (arrays, scalars, null) the value from `claimsToMerge` replaces
+ * the base. This mirrors the deep merge used by msal-dotnet so that, for example, a server
+ * `access_token` challenge and a client-originated `access_token` claim are combined rather
+ * than one clobbering the other.
+ * @param baseClaims - The parsed base claims object
+ * @param claimsToMerge - The parsed claims object merged in with precedence
+ * @returns The deep-merged claims object
+ */
+function deepMergeClaims(baseClaims, claimsToMerge) {
+    const merged = { ...baseClaims };
+    for (const [key, mergeInValue] of Object.entries(claimsToMerge)) {
+        const baseValue = merged[key];
+        if (isPlainObject(baseValue) && isPlainObject(mergeInValue)) {
+            merged[key] = deepMergeClaims(baseValue, mergeInValue);
+        }
+        else {
+            merged[key] = mergeInValue;
+        }
+    }
+    return merged;
+}
+/**
+ * Parses claims JSON, optionally deep-merges a second client-originated claims string
+ * (`claimsToMerge`, e.g. `claimsFromClient`) with precedence on conflicting keys, merges
+ * default optional idToken claims (signin_state, login_hint), and appends client
+ * capabilities (xms_cc) to the access_token section.
  * Does not overwrite idToken claims already specified by the caller.
  * @param claims - Existing claims JSON string from the request (may be undefined)
  * @param clientCapabilities - Client capabilities array from configuration
+ * @param correlationId - The request correlation id
+ * @param claimsToMerge - Optional second claims JSON string (e.g. client-originated `claimsFromClient`)
+ * deep-merged into `claims` with precedence on conflicts; parsed and validated when present. Nested
+ * objects are merged recursively; arrays and scalar values are replaced.
  * @returns Merged claims JSON string
  */
-function buildMergedClaims(claims, clientCapabilities, correlationId = "") {
-    let mergedClaims;
+function buildMergedClaims(claims, clientCapabilities, correlationId = "", claimsToMerge) {
     // Parse provided claims into JSON object or initialize empty object
-    if (!claims) {
-        mergedClaims = {};
-    }
-    else {
-        try {
-            const parsed = JSON.parse(claims);
-            if (typeof parsed !== "object" ||
-                parsed === null ||
-                Array.isArray(parsed)) {
-                throw new Error("Claims must be a JSON object");
-            }
-            mergedClaims = parsed;
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims, correlationId);
-        }
+    let mergedClaims = claims ? parseClaims(claims, correlationId) : {};
+    // Deep-merge client-originated claims (e.g. `claimsFromClient`) with precedence on conflicts
+    if (claimsToMerge?.trim()) {
+        mergedClaims = deepMergeClaims(mergedClaims, parseClaims(claimsToMerge, correlationId));
     }
     // Add default optional idToken claims
     if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ID_TOKEN)) {
@@ -4132,11 +4196,31 @@ function addResource(parameters, resource) {
     if (resource) {
         parameters.set(RESOURCE, resource);
     }
+}
+/**
+ * Add the `attribute_tokens` parameter to a /token request body.
+ *
+ * When `attributeTokens` is a non-empty array the values are sorted lexicographically and joined
+ * with a single space, then written to the request body. When `attributeTokens` is an empty array
+ * the parameter is deleted from the request body.
+ *
+ * @param parameters - request parameter map that will be serialized into the /token body
+ * @param attributeTokens - caller-provided attribute token strings
+ */
+function addAttributeTokens(parameters, attributeTokens) {
+    const serialized = serializeAttributeTokens(attributeTokens);
+    if (serialized) {
+        parameters.set(ATTRIBUTE_TOKENS, serialized);
+    }
+    else {
+        parameters.delete(ATTRIBUTE_TOKENS);
+    }
 }
 
 var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     __proto__: null,
     addApplicationTelemetry: addApplicationTelemetry,
+    addAttributeTokens: addAttributeTokens,
     addAuthorizationCode: addAuthorizationCode,
     addBrokerParameters: addBrokerParameters,
     addCcsOid: addCcsOid,
@@ -4516,7 +4600,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.11.3";
+const version = "16.12.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4792,9 +4876,17 @@ class CacheManager {
     }
     /**
      * saves access token credential
-     * @param credential
+     * @param credential - the access token entity to save
+     * @param correlationId - unique identifier for the request
+     * @param kmsi - keep me signed in flag
      */
     async saveAccessToken(credential, correlationId, kmsi) {
+        // Compute hash from components on the entity itself — no need to thread externally.
+        let additionalCacheKeyHash;
+        if (credential.additionalCacheKeyComponents &&
+            Object.keys(credential.additionalCacheKeyComponents).length > 0) {
+            additionalCacheKeyHash = await this.cryptoImpl.hashString(JSON.stringify(credential.additionalCacheKeyComponents));
+        }
         const accessTokenFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -4818,7 +4910,7 @@ class CacheManager {
                 }
             }
         });
-        await this.setAccessTokenCredential(credential, correlationId, kmsi);
+        await this.setAccessTokenCredential(credential, correlationId, kmsi, additionalCacheKeyHash);
     }
     /**
      * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
@@ -5230,6 +5322,12 @@ class CacheManager {
                 AuthenticationScheme.BEARER.toLowerCase()
             ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
             : CredentialType.ACCESS_TOKEN;
+        const attributeTokenPartition = serializeAttributeTokens(request.attributeTokens);
+        const additionalCacheKeyComponents = attributeTokenPartition
+            ? {
+                attribute_tokens: attributeTokenPartition,
+            }
+            : undefined;
         const accessTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -5239,10 +5337,12 @@ class CacheManager {
             target: scopes,
             tokenType: authScheme,
             keyId: request.sshKid,
+            additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
         const accessTokenKeys = (tokenKeys && tokenKeys.accessToken) ||
             this.getTokenKeys().accessToken;
         const accessTokens = [];
+        const matchedKeys = [];
         accessTokenKeys.forEach((key) => {
             // Validate key
             if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
@@ -5251,18 +5351,18 @@ class CacheManager {
                 if (accessToken &&
                     this.credentialMatchesFilter(accessToken, accessTokenFilter, correlationId)) {
                     accessTokens.push(accessToken);
+                    matchedKeys.push(key);
                 }
             }
         });
-        const numAccessTokens = accessTokens.length;
-        if (numAccessTokens < 1) {
+        if (accessTokens.length < 1) {
             this.commonLogger.info("CacheManager:getAccessToken - No token found", correlationId);
             return null;
         }
-        else if (numAccessTokens > 1) {
+        else if (accessTokens.length > 1) {
             this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them", correlationId);
-            accessTokens.forEach((accessToken) => {
-                this.removeAccessToken(this.generateCredentialKey(accessToken), correlationId);
+            matchedKeys.forEach((key) => {
+                this.removeAccessToken(key, correlationId);
             });
             this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
             return null;
@@ -5705,7 +5805,9 @@ class DefaultStorageClass extends CacheManager {
     getTokenKeys() {
         throw createClientAuthError(methodNotImplemented, "");
     }
-    generateCredentialKey() {
+    /* eslint-disable @typescript-eslint/no-unused-vars */
+    generateCredentialKey(_credential, _hash) {
+        /* eslint-enable @typescript-eslint/no-unused-vars */
         throw createClientAuthError(methodNotImplemented, "");
     }
     generateAccountKey() {
@@ -6340,7 +6442,15 @@ class ResponseHandler {
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
             serverTokenResponse.key_id || request.sshKid || undefined;
-        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents);
+        // Compute components once for entity storage (fallback if hash not provided by client)
+        const attributeTokenPartition = serializeAttributeTokens(request.attributeTokens);
+        const cacheKeyComponents = additionalCacheKeyComponents ??
+            (attributeTokenPartition
+                ? {
+                    attribute_tokens: attributeTokenPartition,
+                }
+                : undefined);
+        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, cacheKeyComponents);
         let cacheContext;
         try {
             if (this.persistencePlugin && this.serializableCache) {
@@ -6652,6 +6762,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
         sshKid: request.sshKid,
         embeddedClientId: request.embeddedClientId || request.extraParameters?.clientId,
         resource: request.resource,
+        attributeTokens: serializeAttributeTokens(request.attributeTokens),
     };
 }
 
@@ -7009,6 +7120,12 @@ class AuthorizationCodeClient {
         // Add scope array, parameter builder will add default scopes and dedupe
         addScopes(parameters, request.scopes, request.correlationId, true, this.oidcDefaultScopes);
         addResource(parameters, request.resource);
+        if (request.attributeTokens) {
+            addAttributeTokens(parameters, request.attributeTokens);
+        }
+        this.performanceClient?.addFields({
+            hasAttributeTokens: !!request.attributeTokens?.length,
+        }, request.correlationId);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
         // Add library metadata
@@ -7304,6 +7421,12 @@ class RefreshTokenClient {
             addServerTelemetry(parameters, this.serverTelemetryManager);
         }
         addRefreshToken(parameters, request.refreshToken);
+        if (request.attributeTokens) {
+            addAttributeTokens(parameters, request.attributeTokens);
+        }
+        this.performanceClient?.addFields({
+            hasAttributeTokens: !!request.attributeTokens?.length,
+        }, request.correlationId);
         if (this.config.clientCredentials.clientSecret) {
             addClientSecret(parameters, this.config.clientCredentials.clientSecret);
         }
@@ -8217,4 +8340,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-JVUj78ag.js.map
+//# sourceMappingURL=index-node-3p7V__ym.js.map