@azure/msal-common 16.11.3 → 16.13.0

package/dist-browser/constants/AADServerParamKeys.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"AADServerParamKeys.mjs","sources":["../../src/constants/AADServerParamKeys.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,SAAS,GAAG,YAAY;AAC9B,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,MAAM,GAAG,SAAS;AACxB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,iBAAiB,GAAG,oBAAoB;AAC9C,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,wBAAwB,GAAG,2BAA2B;AAC5D,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,MAAM,GAAG,SAAS;AACxB,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,IAAI,GAAG,OAAO;AACpB,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,qBAAqB,GAAG,wBAAwB;AACtD,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,iBAAiB,GAAG,oBAAoB;AAC9C,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,mBAAmB,GAAG,6BAA6B;AACzD,MAAM,mBAAmB,GAAG,0BAA0B;AACtD,MAAM,mBAAmB,GAAG,sBAAsB;AAClD,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,SAAS,GAAG,YAAY;AAC9B,MAAM,eAAe,GAAG,2BAA2B;AACnD,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,gBAAgB,GAAG,mBAAmB;AAC5C,MAAM,qBAAqB,GAAG,wBAAwB;AACtD,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,aAAa,GAAG,YAAY;AAClC,MAAM,mBAAmB,GAAG,sBAAsB;AAClD,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,IAAI,GAAG,OAAO;AACpB,MAAM,UAAU,GAAG,kBAAkB;AACrC,MAAM,eAAe,GAAG,kBAAkB;AAC1C,MAAM,aAAa,GAAG,eAAe;AACrC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,GAAG,GAAG,MAAM;AAClB,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,kBAAkB,GAAG,oBAAoB;AAC/C,MAAM,gBAAgB,GAAG,gBAAgB;AACzC,MAAM,mBAAmB,GAAG,mBAAmB;AAC/C,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,QAAQ,GAAG,UAAU;AAC3B,MAAM,kCAAkC,GAC3C,qCAAqC;AAClC,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,QAAQ,GAAG;;;;"}
+{"version":3,"file":"AADServerParamKeys.mjs","sources":["../../src/constants/AADServerParamKeys.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,SAAS,GAAG,YAAY;AAC9B,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,MAAM,GAAG,SAAS;AACxB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,iBAAiB,GAAG,oBAAoB;AAC9C,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,wBAAwB,GAAG,2BAA2B;AAC5D,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,MAAM,GAAG,SAAS;AACxB,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,IAAI,GAAG,OAAO;AACpB,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,qBAAqB,GAAG,wBAAwB;AACtD,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,iBAAiB,GAAG,oBAAoB;AAC9C,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,mBAAmB,GAAG,6BAA6B;AACzD,MAAM,mBAAmB,GAAG,0BAA0B;AACtD,MAAM,mBAAmB,GAAG,sBAAsB;AAClD,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,SAAS,GAAG,YAAY;AAC9B,MAAM,eAAe,GAAG,2BAA2B;AACnD,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,gBAAgB,GAAG,mBAAmB;AAC5C,MAAM,qBAAqB,GAAG,wBAAwB;AACtD,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,aAAa,GAAG,YAAY;AAClC,MAAM,mBAAmB,GAAG,sBAAsB;AAClD,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,IAAI,GAAG,OAAO;AACpB,MAAM,UAAU,GAAG,kBAAkB;AACrC,MAAM,eAAe,GAAG,kBAAkB;AAC1C,MAAM,aAAa,GAAG,eAAe;AACrC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,GAAG,GAAG,MAAM;AAClB,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,kBAAkB,GAAG,oBAAoB;AAC/C,MAAM,gBAAgB,GAAG,gBAAgB;AACzC,MAAM,mBAAmB,GAAG,mBAAmB;AAC/C,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,QAAQ,GAAG,UAAU;AAC3B,MAAM,kCAAkC,GAC3C,qCAAqC;AAClC,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,gBAAgB,GAAG;;;;"}

package/dist-browser/crypto/ICrypto.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';
@@ -7,6 +7,14 @@ import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Shared JOSE algorithm literals used by MSAL package internals.
+ * @internal
+ */
+const JsonWebTokenAlgorithms = {
+    ES256: "ES256",
+    RS256: "RS256",
+};
 /**
  * Default crypto implementation used when a platform-specific implementation has
  * not been provided.
@@ -27,22 +35,19 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     encodeKid: () => {
         throw createClientAuthError(methodNotImplemented, "");
     },
-    async getPublicKeyThumbprint() {
-        throw createClientAuthError(methodNotImplemented, "");
+    async removeTokenBindingKey(kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
     },
-    async removeTokenBindingKey() {
-        throw createClientAuthError(methodNotImplemented, "");
+    async clearKeystore(correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
     },
-    async clearKeystore() {
-        throw createClientAuthError(methodNotImplemented, "");
-    },
-    async signJwt() {
-        throw createClientAuthError(methodNotImplemented, "");
+    async signTokenBindingJwt(header, payload, kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
     },
     async hashString() {
         throw createClientAuthError(methodNotImplemented, "");
     },
 };
 
-export { DEFAULT_CRYPTO_IMPLEMENTATION };
+export { DEFAULT_CRYPTO_IMPLEMENTATION, JsonWebTokenAlgorithms };
 //# sourceMappingURL=ICrypto.mjs.map

package/dist-browser/crypto/ICrypto.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ICrypto.mjs","sources":["../../src/crypto/ICrypto.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;AAAA;;;AAGG;AAqGH;;;AAGG;AACI,MAAM,6BAA6B,GAAY;IAClD,aAAa,EAAE,MAAa;QACxB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;IACD,YAAY,EAAE,MAAa;QACvB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;IACD,YAAY,EAAE,MAAa;QACvB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;IACD,eAAe,EAAE,MAAa;QAC1B,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;IACD,SAAS,EAAE,MAAa;QACpB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;AACD,IAAA,MAAM,sBAAsB,GAAA;QACxB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;AACD,IAAA,MAAM,qBAAqB,GAAA;QACvB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;AACD,IAAA,MAAM,aAAa,GAAA;QACf,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;AACD,IAAA,MAAM,OAAO,GAAA;QACT,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;AACD,IAAA,MAAM,UAAU,GAAA;QACZ,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;;;;;"}
+{"version":3,"file":"ICrypto.mjs","sources":["../../src/crypto/ICrypto.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;AAAA;;;AAGG;AAgCH;;;AAGG;AACI,MAAM,sBAAsB,GAAG;AAClC,IAAA,KAAK,EAAE,OAAO;AACd,IAAA,KAAK,EAAE,OAAO;EACP;AA6DX;;;AAGG;AACI,MAAM,6BAA6B,GAAY;IAClD,aAAa,EAAE,MAAa;QACxB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;IACD,YAAY,EAAE,MAAa;QACvB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;IACD,YAAY,EAAE,MAAa;QACvB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;IACD,eAAe,EAAE,MAAa;QAC1B,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;IACD,SAAS,EAAE,MAAa;QACpB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;AACD,IAAA,MAAM,qBAAqB,CACvB,GAAW,EACX,aAAqB,EAAA;QAGrB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,aAAa,CAChB,CAAC;IACN,CAAC;IACD,MAAM,aAAa,CAAC,aAAqB,EAAA;QACrC,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,aAAa,CAChB,CAAC;IACN,CAAC;IACD,MAAM,mBAAmB,CACrB,MAAkB,EAClB,OAAe,EACf,GAAW,EACX,aAAqB,EAAA;QAKrB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,aAAa,CAChB,CAAC;IACN,CAAC;AACD,IAAA,MAAM,UAAU,GAAA;QACZ,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,EAAE,CACL,CAAC;IACN,CAAC;;;;;"}

package/dist-browser/crypto/ITokenBindingKeyManager.mjs

@@ -0,0 +1,28 @@
+/*! @azure/msal-common v16.13.0 2026-08-18 */
+'use strict';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Default token-binding key manager used when a platform-specific implementation
+ * has not been provided.
+ * @internal
+ */
+const DEFAULT_TOKEN_BINDING_KEY_MANAGER = {
+    async provisionTokenBindingKey(request) {
+        throw createClientAuthError(methodNotImplemented, request.correlationId);
+    },
+    async removeTokenBindingKey(_kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
+    },
+    async getTokenBindingPublicKeyJwk(_kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
+    },
+};
+
+export { DEFAULT_TOKEN_BINDING_KEY_MANAGER };
+//# sourceMappingURL=ITokenBindingKeyManager.mjs.map

package/dist-browser/crypto/ITokenBindingKeyManager.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ITokenBindingKeyManager.mjs","sources":["../../src/crypto/ITokenBindingKeyManager.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;AAAA;;;AAGG;AAgDH;;;;AAIG;AACI,MAAM,iCAAiC,GAA4B;IACtE,MAAM,wBAAwB,CAC1B,OAA8C,EAAA;QAE9C,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,OAAO,CAAC,aAAa,CACxB,CAAC;IACN,CAAC;AACD,IAAA,MAAM,qBAAqB,CACvB,IAAY,EACZ,aAAqB,EAAA;QAErB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,aAAa,CAChB,CAAC;IACN,CAAC;AACD,IAAA,MAAM,2BAA2B,CAC7B,IAAY,EACZ,aAAqB,EAAA;QAErB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,aAAa,CAChB,CAAC;IACN,CAAC;;;;;"}

package/dist-browser/crypto/JoseHeader.mjs

@@ -1,8 +1,9 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { createJoseHeaderError } from '../error/JoseHeaderError.mjs';
+import { isPlainObject } from '../utils/ObjectUtils.mjs';
 import { JsonWebTokenTypes } from '../utils/Constants.mjs';
-import { missingKidError, missingAlgError } from '../error/JoseHeaderErrorCodes.mjs';
+import { missingAlgError, missingKidError, missingJwkError, invalidJwkError } from '../error/JoseHeaderErrorCodes.mjs';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10,35 +11,61 @@ import { missingKidError, missingAlgError } from '../error/JoseHeaderErrorCodes.
  */
 /** @internal */
 class JoseHeader {
-    constructor(options) {
+    constructor(options, correlationId) {
+        if (typeof options.alg !== "string" || !options.alg) {
+            throw createJoseHeaderError(missingAlgError, correlationId);
+        }
         this.typ = options.typ;
         this.alg = options.alg;
         this.kid = options.kid;
+        this.jwk = options.jwk;
     }
     /**
      * Builds SignedHttpRequest formatted JOSE Header from the
-     * JOSE Header options provided or previously set on the object and returns
-     * the stringified header object.
+     * JOSE Header options provided or previously set on the object.
      * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
      * @param shrHeaderOptions
+     * @param correlationId
      * @returns
      */
-    static getShrHeaderString(shrHeaderOptions) {
+    static getShrHeader(shrHeaderOptions, correlationId) {
         // KeyID is required on the SHR header
         if (!shrHeaderOptions.kid) {
-            throw createJoseHeaderError(missingKidError, "");
+            throw createJoseHeaderError(missingKidError, correlationId);
         }
         // Alg is required on the SHR header
         if (!shrHeaderOptions.alg) {
-            throw createJoseHeaderError(missingAlgError, "");
+            throw createJoseHeaderError(missingAlgError, correlationId);
         }
-        const shrHeader = new JoseHeader({
+        return new JoseHeader({
             // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
             typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
             kid: shrHeaderOptions.kid,
             alg: shrHeaderOptions.alg,
-        });
-        return JSON.stringify(shrHeader);
+        }, correlationId);
+    }
+    /**
+     * Builds a DPoP formatted JOSE Header from the JOSE Header options provided.
+     * Throws if public JWK or algorithm aren't provided since they are required for DPoP.
+     * @param dpopHeaderOptions
+     * @param correlationId
+     * @returns
+     */
+    static getDpopHeader(dpopHeaderOptions, correlationId) {
+        if (!isPlainObject(dpopHeaderOptions.jwk)) {
+            throw createJoseHeaderError(missingJwkError, correlationId);
+        }
+        if (!dpopHeaderOptions.alg) {
+            throw createJoseHeaderError(missingAlgError, correlationId);
+        }
+        if (Object.keys(dpopHeaderOptions.jwk).length === 0) {
+            throw createJoseHeaderError(invalidJwkError, correlationId);
+        }
+        return new JoseHeader({
+            typ: JsonWebTokenTypes.Dpop,
+            alg: dpopHeaderOptions.alg,
+            jwk: dpopHeaderOptions.jwk,
+        }, correlationId);
     }
 }
 

package/dist-browser/crypto/JoseHeader.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"JoseHeader.mjs","sources":["../../src/crypto/JoseHeader.ts"],"sourcesContent":[null],"names":["JoseHeaderErrorCodes.missingKidError","JoseHeaderErrorCodes.missingAlgError"],"mappings":";;;;;;AAAA;;;AAGG;AAcH;MACa,UAAU,CAAA;AAKnB,IAAA,WAAA,CAAY,OAA0B,EAAA;AAClC,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAC3B,CAAC;AAED;;;;;;;AAOG;IACH,OAAO,kBAAkB,CAAC,gBAAmC,EAAA;;AAEzD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YACvB,MAAM,qBAAqB,CACvBA,eAAoC,EACpC,EAAE,CACL,CAAC;AACL,QAAA,CAAA;;AAGD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YACvB,MAAM,qBAAqB,CACvBC,eAAoC,EACpC,EAAE,CACL,CAAC;AACL,QAAA,CAAA;AAED,QAAA,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC;;AAE7B,YAAA,GAAG,EAAE,gBAAgB,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG;YAClD,GAAG,EAAE,gBAAgB,CAAC,GAAG;YACzB,GAAG,EAAE,gBAAgB,CAAC,GAAG;AAC5B,SAAA,CAAC,CAAC;AAEH,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;AACJ;;;;"}
+{"version":3,"file":"JoseHeader.mjs","sources":["../../src/crypto/JoseHeader.ts"],"sourcesContent":[null],"names":["JoseHeaderErrorCodes.missingAlgError","JoseHeaderErrorCodes.missingKidError","JoseHeaderErrorCodes.missingJwkError","JoseHeaderErrorCodes.invalidJwkError"],"mappings":";;;;;;;AAAA;;;AAGG;AAgBH;MACa,UAAU,CAAA;IAMnB,WAAA,CACI,OAA4C,EAC5C,aAAqB,EAAA;QAErB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YACjD,MAAM,qBAAqB,CACvBA,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAC3B,CAAC;AAED;;;;;;;AAOG;AACH,IAAA,OAAO,YAAY,CACf,gBAAmC,EACnC,aAAqB,EAAA;;AAGrB,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YACvB,MAAM,qBAAqB,CACvBC,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;;AAGD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YACvB,MAAM,qBAAqB,CACvBD,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QAED,OAAO,IAAI,UAAU,CACjB;;AAEI,YAAA,GAAG,EAAE,gBAAgB,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG;YAClD,GAAG,EAAE,gBAAgB,CAAC,GAAG;YACzB,GAAG,EAAE,gBAAgB,CAAC,GAAG;SAC5B,EACD,aAAa,CAChB,CAAC;IACN,CAAC;AAED;;;;;;AAMG;AACH,IAAA,OAAO,aAAa,CAChB,iBAAoC,EACpC,aAAqB,EAAA;AAErB,QAAA,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE;YACvC,MAAM,qBAAqB,CACvBE,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE;YACxB,MAAM,qBAAqB,CACvBF,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;YACjD,MAAM,qBAAqB,CACvBG,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QAED,OAAO,IAAI,UAAU,CACjB;YACI,GAAG,EAAE,iBAAiB,CAAC,IAAI;YAC3B,GAAG,EAAE,iBAAiB,CAAC,GAAG;YAC1B,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC7B,EACD,aAAa,CAChB,CAAC;IACN,CAAC;AACJ;;;;"}

package/dist-browser/crypto/PopTokenGenerator.mjs

@@ -1,9 +1,11 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
+import { JsonWebTokenAlgorithms } from './ICrypto.mjs';
 import { nowSeconds } from '../utils/TimeUtils.mjs';
 import { UrlString } from '../url/UrlString.mjs';
 import { PopTokenGenerateCnf } from '../telemetry/performance/PerformanceEvents.mjs';
 import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+import { JoseHeader } from './JoseHeader.mjs';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11,10 +13,13 @@ import { invokeAsync } from '../utils/FunctionWrappers.mjs';
  */
 const KeyLocation = {
     SW: "sw"};
+const SHR_TOKEN_BINDING_KEY_TYPE = "shr";
+const SHR_TOKEN_BINDING_KEY_ALGORITHM = JsonWebTokenAlgorithms.RS256;
 /** @internal */
 class PopTokenGenerator {
-    constructor(cryptoUtils, performanceClient) {
+    constructor(cryptoUtils, tokenBindingKeyManager, performanceClient) {
         this.cryptoUtils = cryptoUtils;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
         this.performanceClient = performanceClient;
     }
     /**
@@ -37,7 +42,11 @@ class PopTokenGenerator {
      * @returns
      */
     async generateKid(request) {
-        const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(request);
+        const kidThumbprint = await this.tokenBindingKeyManager.provisionTokenBindingKey({
+            correlationId: request.correlationId,
+            tokenBindingKeyType: SHR_TOKEN_BINDING_KEY_TYPE,
+            tokenBindingKeyAlgorithm: SHR_TOKEN_BINDING_KEY_ALGORITHM,
+        });
         return {
             kid: kidThumbprint,
             xms_ksl: KeyLocation.SW,
@@ -67,7 +76,17 @@ class PopTokenGenerator {
             ? new UrlString(resourceRequestUri, request.correlationId)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
-        return this.cryptoUtils.signJwt({
+        const publicKeyJwk = await this.tokenBindingKeyManager.getTokenBindingPublicKeyJwk(keyId, request.correlationId);
+        const encodedKeyIdThumbprint = this.cryptoUtils.base64UrlEncode(JSON.stringify({ kid: keyId }));
+        const shrAlgorithm = shrOptions?.header?.alg ||
+            publicKeyJwk.alg ||
+            SHR_TOKEN_BINDING_KEY_ALGORITHM;
+        const shrHeader = JoseHeader.getShrHeader({
+            ...shrOptions?.header,
+            alg: shrAlgorithm,
+            kid: encodedKeyIdThumbprint,
+        }, request.correlationId);
+        const shrPayload = {
             at: payload,
             ts: nowSeconds(),
             m: resourceRequestMethod?.toUpperCase(),
@@ -79,7 +98,11 @@ class PopTokenGenerator {
                 : undefined,
             client_claims: shrClaims || undefined,
             ...claims,
-        }, keyId, shrOptions, request.correlationId);
+            cnf: {
+                jwk: publicKeyJwk,
+            },
+        };
+        return this.cryptoUtils.signTokenBindingJwt(shrHeader, shrPayload, keyId, request.correlationId);
     }
 }
 

package/dist-browser/crypto/PopTokenGenerator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"PopTokenGenerator.mjs","sources":["../../src/crypto/PopTokenGenerator.ts"],"sourcesContent":[null],"names":["PerformanceEvents.PopTokenGenerateCnf","TimeUtils.nowSeconds"],"mappings":";;;;;;;AAAA;;;AAGG;AA2BH,MAAM,WAAW,GAAG;AAChB,IAAA,EAAE,EAAE,KAEE,CAAC;AAGX;MACa,iBAAiB,CAAA;IAI1B,WAAA,CAAY,WAAoB,EAAE,iBAAqC,EAAA;AACnE,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AAC/B,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC/C,CAAC;AAED;;;;;AAKG;AACH,IAAA,MAAM,WAAW,CACb,OAAoC,EACpC,MAAc,EAAA;AAEd,QAAA,MAAM,MAAM,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3BA,mBAAqC,EACrC,MAAM,EACN,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,CAAC,CAAC;AACX,QAAA,MAAM,YAAY,GAAW,IAAI,CAAC,WAAW,CAAC,eAAe,CACzD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CACzB,CAAC;QAEF,OAAO;YACH,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,YAAY;SACf,CAAC;IACN,CAAC;AAED;;;;AAIG;IACH,MAAM,WAAW,CAAC,OAAoC,EAAA;QAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAC/D,OAAO,CACV,CAAC;QAEF,OAAO;AACH,YAAA,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,WAAW,CAAC,EAAE;SAC1B,CAAC;IACN,CAAC;AAED;;;;;AAKG;AACH,IAAA,MAAM,YAAY,CACd,WAAmB,EACnB,KAAa,EACb,OAAoC,EAAA;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;AAED;;;;;;;AAOG;IACH,MAAM,WAAW,CACb,OAAe,EACf,KAAa,EACb,OAAoC,EACpC,MAAe,EAAA;;AAGf,QAAA,MAAM,EACF,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,UAAU,GACb,GAAG,OAAO,CAAC;QAEZ,MAAM,iBAAiB,GAAG,kBAAkB;cACtC,IAAI,SAAS,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC;cACxD,SAAS,CAAC;AAChB,QAAA,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AACpE,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAC3B;AACI,YAAA,EAAE,EAAE,OAAO;AACX,YAAA,EAAE,EAAEC,UAAoB,EAAE;AAC1B,YAAA,CAAC,EAAE,qBAAqB,EAAE,WAAW,EAAE;YACvC,CAAC,EAAE,qBAAqB,EAAE,eAAe;YACzC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;YACnD,CAAC,EAAE,qBAAqB,EAAE,YAAY;YACtC,CAAC,EAAE,qBAAqB,EAAE,WAAW;AACjC,kBAAE,CAAC,EAAE,EAAE,qBAAqB,CAAC,WAAW,CAAC;AACzC,kBAAE,SAAS;YACf,aAAa,EAAE,SAAS,IAAI,SAAS;AACrC,YAAA,GAAG,MAAM;SACZ,EACD,KAAK,EACL,UAAU,EACV,OAAO,CAAC,aAAa,CACxB,CAAC;IACN,CAAC;AACJ;;;;"}
+{"version":3,"file":"PopTokenGenerator.mjs","sources":["../../src/crypto/PopTokenGenerator.ts"],"sourcesContent":[null],"names":["PerformanceEvents.PopTokenGenerateCnf","TimeUtils.nowSeconds"],"mappings":";;;;;;;;;AAAA;;;AAGG;AAkCH,MAAM,WAAW,GAAG;AAChB,IAAA,EAAE,EAAE,KAEE,CAAC;AAGX,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,+BAA+B,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAErE;MACa,iBAAiB,CAAA;AAK1B,IAAA,WAAA,CACI,WAAoB,EACpB,sBAA+C,EAC/C,iBAAqC,EAAA;AAErC,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AAC/B,QAAA,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;AACrD,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC/C,CAAC;AAED;;;;;AAKG;AACH,IAAA,MAAM,WAAW,CACb,OAAoC,EACpC,MAAc,EAAA;AAEd,QAAA,MAAM,MAAM,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3BA,mBAAqC,EACrC,MAAM,EACN,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,CAAC,CAAC;AACX,QAAA,MAAM,YAAY,GAAW,IAAI,CAAC,WAAW,CAAC,eAAe,CACzD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CACzB,CAAC;QAEF,OAAO;YACH,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,YAAY;SACf,CAAC;IACN,CAAC;AAED;;;;AAIG;IACH,MAAM,WAAW,CAAC,OAAoC,EAAA;QAClD,MAAM,aAAa,GACf,MAAM,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;YACvD,aAAa,EAAE,OAAO,CAAC,aAAa;AACpC,YAAA,mBAAmB,EAAE,0BAA0B;AAC/C,YAAA,wBAAwB,EAAE,+BAA+B;AAC5D,SAAA,CAAC,CAAC;QAEP,OAAO;AACH,YAAA,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,WAAW,CAAC,EAAE;SAC1B,CAAC;IACN,CAAC;AAED;;;;;AAKG;AACH,IAAA,MAAM,YAAY,CACd,WAAmB,EACnB,KAAa,EACb,OAAoC,EAAA;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;AAED;;;;;;;AAOG;IACH,MAAM,WAAW,CACb,OAAe,EACf,KAAa,EACb,OAAoC,EACpC,MAAe,EAAA;;AAGf,QAAA,MAAM,EACF,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,UAAU,GACb,GAAG,OAAO,CAAC;QAEZ,MAAM,iBAAiB,GAAG,kBAAkB;cACtC,IAAI,SAAS,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC;cACxD,SAAS,CAAC;AAChB,QAAA,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AACpE,QAAA,MAAM,YAAY,GACd,MAAM,IAAI,CAAC,sBAAsB,CAAC,2BAA2B,CACzD,KAAK,EACL,OAAO,CAAC,aAAa,CACxB,CAAC;AACN,QAAA,MAAM,sBAAsB,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAC3D,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CACjC,CAAC;AACF,QAAA,MAAM,YAAY,GACd,UAAU,EAAE,MAAM,EAAE,GAAG;AACvB,YAAA,YAAY,CAAC,GAAG;AAChB,YAAA,+BAA+B,CAAC;AACpC,QAAA,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CACrC;YACI,GAAG,UAAU,EAAE,MAAM;AACrB,YAAA,GAAG,EAAE,YAAY;AACjB,YAAA,GAAG,EAAE,sBAAsB;AAC9B,SAAA,EACD,OAAO,CAAC,aAAa,CACxB,CAAC;AACF,QAAA,MAAM,UAAU,GAAsB;AAClC,YAAA,EAAE,EAAE,OAAO;AACX,YAAA,EAAE,EAAEC,UAAoB,EAAE;AAC1B,YAAA,CAAC,EAAE,qBAAqB,EAAE,WAAW,EAAE;YACvC,CAAC,EAAE,qBAAqB,EAAE,eAAe;YACzC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;YACnD,CAAC,EAAE,qBAAqB,EAAE,YAAY;YACtC,CAAC,EAAE,qBAAqB,EAAE,WAAW;AACjC,kBAAE,CAAC,EAAE,EAAE,qBAAqB,CAAC,WAAW,CAAC;AACzC,kBAAE,SAAS;YACf,aAAa,EAAE,SAAS,IAAI,SAAS;AACrC,YAAA,GAAG,MAAM;AACT,YAAA,GAAG,EAAE;AACD,gBAAA,GAAG,EAAE,YAAY;AACpB,aAAA;SACJ,CAAC;AAEF,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACvC,SAAS,EACT,UAAU,EACV,KAAK,EACL,OAAO,CAAC,aAAa,CACxB,CAAC;IACN,CAAC;AACJ;;;;"}

package/dist-browser/error/AuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/AuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/CacheError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { cacheErrorUnknown, cacheQuotaExceeded } from './CacheErrorCodes.mjs';
 import * as CacheErrorCodes from './CacheErrorCodes.mjs';

package/dist-browser/error/CacheErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/ClientAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ClientAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/ClientConfigurationError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ClientConfigurationErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20,6 +20,7 @@ const invalidAuthorityMetadata = "invalid_authority_metadata";
 const untrustedAuthority = "untrusted_authority";
 const missingSshJwk = "missing_ssh_jwk";
 const missingSshKid = "missing_ssh_kid";
+const unsupportedAuthenticationScheme = "unsupported_authentication_scheme";
 const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
 const invalidAuthenticationHeader = "invalid_authentication_header";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
@@ -32,5 +33,5 @@ const invalidResponseMode = "invalid_response_mode";
 const invalidDpopHtm = "invalid_dpop_htm";
 const invalidDpopHtu = "invalid_dpop_htu";
 
-export { authorityMismatch, authorityUriInsecure, cannotAllowPlatformBroker, cannotSetOIDCOptions, claimsRequestParsingError, emptyInputScopesError, invalidAuthenticationHeader, invalidAuthorityMetadata, invalidClaims, invalidCloudDiscoveryMetadata, invalidCodeChallengeMethod, invalidDpopHtm, invalidDpopHtu, invalidPlatformBrokerConfiguration, invalidRequestMethodForEAR, invalidResponseMode, issuerValidationFailed, logoutRequestEmpty, missingNonceAuthenticationHeader, missingSshJwk, missingSshKid, pkceParamsMissing, redirectUriEmpty, tokenRequestEmpty, untrustedAuthority, urlEmptyError, urlParseError };
+export { authorityMismatch, authorityUriInsecure, cannotAllowPlatformBroker, cannotSetOIDCOptions, claimsRequestParsingError, emptyInputScopesError, invalidAuthenticationHeader, invalidAuthorityMetadata, invalidClaims, invalidCloudDiscoveryMetadata, invalidCodeChallengeMethod, invalidDpopHtm, invalidDpopHtu, invalidPlatformBrokerConfiguration, invalidRequestMethodForEAR, invalidResponseMode, issuerValidationFailed, logoutRequestEmpty, missingNonceAuthenticationHeader, missingSshJwk, missingSshKid, pkceParamsMissing, redirectUriEmpty, tokenRequestEmpty, unsupportedAuthenticationScheme, untrustedAuthority, urlEmptyError, urlParseError };
 //# sourceMappingURL=ClientConfigurationErrorCodes.mjs.map

package/dist-browser/error/ClientConfigurationErrorCodes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClientConfigurationErrorCodes.mjs","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,0BAA0B,GAAG,gCAAgC;AACnE,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,6BAA6B,GAAG,mCAAmC;AACzE,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB;AACjD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,gCAAgC,GACzC,sCAAsC;AACnC,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,iBAAiB,GAAG,qBAAqB;AAC/C,MAAM,0BAA0B,GAAG,iCAAiC;AACpE,MAAM,kCAAkC,GAC3C,wCAAwC;AACrC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG;;;;"}
+{"version":3,"file":"ClientConfigurationErrorCodes.mjs","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,0BAA0B,GAAG,gCAAgC;AACnE,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,6BAA6B,GAAG,mCAAmC;AACzE,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB;AACjD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,+BAA+B,GACxC,oCAAoC;AACjC,MAAM,gCAAgC,GACzC,sCAAsC;AACnC,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,iBAAiB,GAAG,qBAAqB;AAC/C,MAAM,0BAA0B,GAAG,iCAAiC;AACpE,MAAM,kCAAkC,GAC3C,wCAAwC;AACrC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG;;;;"}

package/dist-browser/error/InteractionRequiredAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 import { interactionRequired, consentRequired, loginRequired, badToken, uiNotAllowed, interruptedUser } from './InteractionRequiredAuthErrorCodes.mjs';

package/dist-browser/error/InteractionRequiredAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/JoseHeaderError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/JoseHeaderErrorCodes.mjs

@@ -1,11 +1,13 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 const missingKidError = "missing_kid_error";
-const missingAlgError = "missing_alg_error";
+const missingAlgError = "missing_alg_error";
+const missingJwkError = "missing_jwk_error";
+const invalidJwkError = "invalid_jwk_error";
 
-export { missingAlgError, missingKidError };
+export { invalidJwkError, missingAlgError, missingJwkError, missingKidError };
 //# sourceMappingURL=JoseHeaderErrorCodes.mjs.map

package/dist-browser/error/JoseHeaderErrorCodes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"JoseHeaderErrorCodes.mjs","sources":["../../src/error/JoseHeaderErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,eAAe,GAAG,oBAAoB;AAC5C,MAAM,eAAe,GAAG;;;;"}
+{"version":3,"file":"JoseHeaderErrorCodes.mjs","sources":["../../src/error/JoseHeaderErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,eAAe,GAAG,oBAAoB;AAC5C,MAAM,eAAe,GAAG,oBAAoB;AAC5C,MAAM,eAAe,GAAG,oBAAoB;AAC5C,MAAM,eAAe,GAAG;;;;"}

package/dist-browser/error/NetworkError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/PlatformBrokerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ServerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/index-browser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };
@@ -33,8 +33,9 @@ import * as ClientConfigurationErrorCodes from './error/ClientConfigurationError
 export { ClientConfigurationErrorCodes };
 import * as Constants from './utils/Constants.mjs';
 export { Constants };
-export { DEFAULT_CRYPTO_IMPLEMENTATION } from './crypto/ICrypto.mjs';
+export { DEFAULT_CRYPTO_IMPLEMENTATION, JsonWebTokenAlgorithms } from './crypto/ICrypto.mjs';
 export { DEFAULT_SYSTEM_OPTIONS } from './config/ClientConfiguration.mjs';
+export { DEFAULT_TOKEN_BINDING_KEY_MANAGER } from './crypto/ITokenBindingKeyManager.mjs';
 export { IntFields, PerformanceEventStatus } from './telemetry/performance/PerformanceEvent.mjs';
 export { InteractionRequiredAuthError, createInteractionRequiredAuthError } from './error/InteractionRequiredAuthError.mjs';
 import * as InteractionRequiredAuthErrorCodes from './error/InteractionRequiredAuthErrorCodes.mjs';

package/dist-browser/index-browser.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index-browser.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index-browser.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist-browser/index.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };
@@ -36,8 +36,9 @@ import * as ClientConfigurationErrorCodes from './error/ClientConfigurationError
 export { ClientConfigurationErrorCodes };
 import * as Constants from './utils/Constants.mjs';
 export { Constants };
-export { DEFAULT_CRYPTO_IMPLEMENTATION } from './crypto/ICrypto.mjs';
+export { DEFAULT_CRYPTO_IMPLEMENTATION, JsonWebTokenAlgorithms } from './crypto/ICrypto.mjs';
 export { DEFAULT_SYSTEM_OPTIONS, buildClientConfiguration } from './config/ClientConfiguration.mjs';
+export { DEFAULT_TOKEN_BINDING_KEY_MANAGER } from './crypto/ITokenBindingKeyManager.mjs';
 export { IntFields, PerformanceEventStatus } from './telemetry/performance/PerformanceEvent.mjs';
 export { InteractionRequiredAuthError, createInteractionRequiredAuthError } from './error/InteractionRequiredAuthError.mjs';
 import * as InteractionRequiredAuthErrorCodes from './error/InteractionRequiredAuthErrorCodes.mjs';

package/dist-browser/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist-browser/log-strings-mapping.json

@@ -1,6 +1,6 @@
 {
-  "timestamp": "2026-07-29T00:28:07.217Z",
-  "packageVersion": "16.11.3",
+  "timestamp": "2026-08-18T20:11:58.925Z",
+  "packageVersion": "16.13.0",
   "totalStrings": 98,
   "mappings": {
     "1lrjz7": {

package/dist-browser/logger/Logger.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/network/INetworkModule.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/network/RequestThumbprint.mjs

@@ -1,5 +1,7 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
+import { serializeAttributeTokens } from '../cache/utils/CacheHelpers.mjs';
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -18,6 +20,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
         sshKid: request.sshKid,
         embeddedClientId: request.embeddedClientId || request.extraParameters?.clientId,
         resource: request.resource,
+        attributeTokens: serializeAttributeTokens(request.attributeTokens),
     };
 }
 

package/dist-browser/network/RequestThumbprint.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"RequestThumbprint.mjs","sources":["../../src/network/RequestThumbprint.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;SAyBa,oBAAoB,CAChC,QAAgB,EAChB,OAAwB,EACxB,aAAsB,EAAA;IAEtB,OAAO;AACH,QAAA,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;AACtB,QAAA,qBAAqB,EAAE,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EACZ,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,QAAQ;QACjE,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC7B,CAAC;AACN;;;;"}
+{"version":3,"file":"RequestThumbprint.mjs","sources":["../../src/network/RequestThumbprint.ts"],"sourcesContent":[null],"names":["CacheHelpers.serializeAttributeTokens"],"mappings":";;;;AAAA;;;AAGG;SA2Ba,oBAAoB,CAChC,QAAgB,EAChB,OAAwB,EACxB,aAAsB,EAAA;IAEtB,OAAO;AACH,QAAA,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;AACtB,QAAA,qBAAqB,EAAE,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EACZ,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,QAAQ;QACjE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAEA,wBAAqC,CAClD,OAAO,CAAC,eAAe,CAC1B;KACJ,CAAC;AACN;;;;"}

package/dist-browser/network/ThrottlingUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { THROTTLING_PREFIX, HeaderNames, DEFAULT_THROTTLE_TIME_SECONDS, DEFAULT_MAX_THROTTLE_TIME_SECONDS } from '../utils/Constants.mjs';
 import { ServerError } from '../error/ServerError.mjs';

package/dist-browser/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.11.3";
+const version = "16.13.0";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist-browser/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
 import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';

package/dist-browser/protocol/Token.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { CcsCredentialType } from '../account/CcsCredential.mjs';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';

package/dist-browser/request/AuthenticationHeaderParser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { HeaderNames } from '../utils/Constants.mjs';

package/dist-browser/request/BaseAuthRequest.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/request/BaseAuthRequest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"BaseAuthRequest.mjs","sources":["../../src/request/BaseAuthRequest.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.misplacedResourceParam","ClientAuthErrorCodes.resourceParameterRequired"],"mappings":";;;;;AAAA;;;AAGG;AAgHH;;;;;;AAMG;AACG,SAAU,wBAAwB,CACpC,KAAc,EACd,OAAiC,EAAA;IAEjC,IAAI,CAAC,KAAK,EAAE;QACR,OAAO;AACV,IAAA,CAAA;IAED,IACI,OAAO,CAAC,QAAQ;AAChB,SAAC,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;AAC3C,YAAA,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,EAC1D;AACE,QAAA,MAAM,qBAAqB,CACvBA,sBAA2C,EAC3C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;AACnB,QAAA,MAAM,qBAAqB,CACvBC,yBAA8C,EAC9C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB,EAAA;IAC9C,IAAI,CAAC,MAAM,EAAE;AACT,QAAA,OAAO,KAAK,CAAC;AAChB,IAAA,CAAA;AAED,IAAA,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACpE;;;;"}
+{"version":3,"file":"BaseAuthRequest.mjs","sources":["../../src/request/BaseAuthRequest.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.misplacedResourceParam","ClientAuthErrorCodes.resourceParameterRequired"],"mappings":";;;;;AAAA;;;AAGG;AAoHH;;;;;;AAMG;AACG,SAAU,wBAAwB,CACpC,KAAc,EACd,OAAiC,EAAA;IAEjC,IAAI,CAAC,KAAK,EAAE;QACR,OAAO;AACV,IAAA,CAAA;IAED,IACI,OAAO,CAAC,QAAQ;AAChB,SAAC,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;AAC3C,YAAA,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,EAC1D;AACE,QAAA,MAAM,qBAAqB,CACvBA,sBAA2C,EAC3C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;AACnB,QAAA,MAAM,qBAAqB,CACvBC,yBAA8C,EAC9C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB,EAAA;IAC9C,IAAI,CAAC,MAAM,EAAE;AACT,QAAA,OAAO,KAAK,CAAC;AAChB,IAAA,CAAA;AAED,IAAA,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACpE;;;;"}