@azure/msal-common 16.11.3 → 16.13.0

package/lib/{index-node-JVUj78ag.js → index-node-BaODPZEy.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.13.0 2026-08-18 */
 'use strict';
 'use strict';
 
@@ -266,6 +266,7 @@ const invalidAuthorityMetadata = "invalid_authority_metadata";
 const untrustedAuthority = "untrusted_authority";
 const missingSshJwk = "missing_ssh_jwk";
 const missingSshKid = "missing_ssh_kid";
+const unsupportedAuthenticationScheme = "unsupported_authentication_scheme";
 const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
 const invalidAuthenticationHeader = "invalid_authentication_header";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
@@ -304,6 +305,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     pkceParamsMissing: pkceParamsMissing,
     redirectUriEmpty: redirectUriEmpty,
     tokenRequestEmpty: tokenRequestEmpty,
+    unsupportedAuthenticationScheme: unsupportedAuthenticationScheme,
     untrustedAuthority: untrustedAuthority,
     urlEmptyError: urlEmptyError,
     urlParseError: urlParseError
@@ -694,6 +696,7 @@ const JsonWebTokenTypes = {
     Jwt: "JWT",
     Jwk: "JWK",
     Pop: "pop",
+    Dpop: "dpop+jwt",
 };
 const ONE_DAY_IN_MS = 86400000;
 // Token renewal offset default in seconds
@@ -971,10 +974,7 @@ class UrlString {
 // Build endpoint metadata dynamically to avoid string duplication
 const endpointHosts = [
     { host: "login.microsoftonline.com" },
-    {
-        host: "login.chinacloudapi.cn",
-        issuerHost: "login.partner.microsoftonline.cn", // Issuer differs
-    },
+    { host: "login.partner.microsoftonline.cn" },
     { host: "login.microsoftonline.us" },
     { host: "login.sovcloud-identity.fr" },
     { host: "login.sovcloud-identity.de" },
@@ -1627,6 +1627,7 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
     if (refreshOn) {
         atEntity.refreshOn = refreshOn.toString();
     }
+    const normalizedTokenType = atEntity.tokenType?.toLowerCase();
     /*
      * Create Access Token With Auth Scheme instead of regular access token
      * Cast to lower to handle "bearer" from ADFS
@@ -1635,7 +1636,7 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
         AuthenticationScheme.BEARER.toLowerCase()) {
         atEntity.credentialType =
             CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-        switch (atEntity.tokenType) {
+        switch (normalizedTokenType) {
             case AuthenticationScheme.POP:
                 // Make sure keyId is present and add it to credential
                 const tokenClaims = extractTokenClaims(accessToken, base64Decode, correlationId);
@@ -1644,6 +1645,12 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
                 break;
+            case "dpop":
+                if (!keyId) {
+                    throw createClientAuthError(keyIdMissing, correlationId);
+                }
+                atEntity.keyId = keyId;
+                break;
             case AuthenticationScheme.SSH:
                 atEntity.keyId = keyId;
         }
@@ -1835,6 +1842,19 @@ function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetw
  */
 function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
+}
+/**
+ * Serialize attribute tokens synchronously (sort and join).
+ * This is a sync-only operation for use at request construction time.
+ * @param attributeTokens - array of tokens
+ * @returns serialized partition string or undefined if no tokens
+ */
+function serializeAttributeTokens(attributeTokens) {
+    if (!attributeTokens || attributeTokens.length === 0) {
+        return undefined;
+    }
+    // Serialize: sort and join tokens
+    return [...attributeTokens].sort().join(" ");
 }
 
 var CacheHelpers = /*#__PURE__*/Object.freeze({
@@ -1853,6 +1873,7 @@ var CacheHelpers = /*#__PURE__*/Object.freeze({
     isRefreshTokenEntity: isRefreshTokenEntity,
     isServerTelemetryEntity: isServerTelemetryEntity,
     isThrottlingEntity: isThrottlingEntity,
+    serializeAttributeTokens: serializeAttributeTokens,
     updateAuthorityEndpointMetadata: updateAuthorityEndpointMetadata,
     updateCloudDiscoveryMetadata: updateCloudDiscoveryMetadata
 });
@@ -3058,11 +3079,13 @@ const CLI_DATA = "clidata";
 const USER_FEDERATED_IDENTITY_CREDENTIAL = "user_federated_identity_credential";
 const USERNAME = "username";
 const USER_ID = "user_id";
-const FMI_PATH = "fmi_path";
+const FMI_PATH = "fmi_path";
+const ATTRIBUTE_TOKENS = "attribute_tokens";
 
 var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     __proto__: null,
     ACCESS_TOKEN: ACCESS_TOKEN,
+    ATTRIBUTE_TOKENS: ATTRIBUTE_TOKENS,
     BROKER_CLIENT_ID: BROKER_CLIENT_ID,
     BROKER_REDIRECT_URI: BROKER_REDIRECT_URI,
     CCS_HEADER: CCS_HEADER,
@@ -3812,13 +3835,14 @@ function addSid(parameters, sid) {
  * @param claims - The claims string from the request
  * @param clientCapabilities - The client capabilities from configuration
  * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+ * @param claimsToMerge - Optional client-originated claims JSON string (e.g. `claimsFromClient`) deep-merged into `claims` with precedence on conflicts
  */
-function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims) {
+function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims, claimsToMerge) {
     // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
     const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
         ? undefined
         : clientCapabilities;
-    const mergedClaims = buildMergedClaims(claims, configClaims, correlationId);
+    const mergedClaims = buildMergedClaims(claims, configClaims, correlationId, claimsToMerge);
     parameters.set(CLAIMS, mergedClaims);
 }
 /**
@@ -4005,32 +4029,79 @@ const DEFAULT_ID_TOKEN_CLAIMS = {
     [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
 };
 /**
- * Parses claims JSON, merges default optional idToken claims (signin_state, login_hint),
- * and appends client capabilities (xms_cc) to the access_token section.
+ * Parses a claims JSON string into an object, throwing a ClientConfigurationError
+ * (error code `invalid_claims`) if the value is not a valid JSON object. The raw
+ * claims value is never included in the error - it may contain sensitive data.
+ * @param claims - Claims JSON string. Must be valid JSON representing an object.
+ * @param correlationId - The request correlation id
+ * @returns The parsed claims object
+ */
+function parseClaims(claims, correlationId = "") {
+    let parsed;
+    try {
+        parsed = JSON.parse(claims);
+    }
+    catch (e) {
+        // Malformed JSON
+        throw createClientConfigurationError(invalidClaims, correlationId);
+    }
+    if (!isPlainObject$1(parsed)) {
+        // Valid JSON, but not an object (e.g. an array, a scalar, or the literal `null`).
+        throw createClientConfigurationError(invalidClaims, correlationId);
+    }
+    return parsed;
+}
+/**
+ * Type guard for a non-null, non-array object (a JSON "object" value).
+ * @param value - The value to test
+ * @returns True when value is a plain object that can be deep-merged
+ */
+function isPlainObject$1(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Recursively deep-merges two parsed claims objects. Nested objects are merged key-by-key;
+ * for any other value type (arrays, scalars, null) the value from `claimsToMerge` replaces
+ * the base. This mirrors the deep merge used by msal-dotnet so that, for example, a server
+ * `access_token` challenge and a client-originated `access_token` claim are combined rather
+ * than one clobbering the other.
+ * @param baseClaims - The parsed base claims object
+ * @param claimsToMerge - The parsed claims object merged in with precedence
+ * @returns The deep-merged claims object
+ */
+function deepMergeClaims(baseClaims, claimsToMerge) {
+    const merged = { ...baseClaims };
+    for (const [key, mergeInValue] of Object.entries(claimsToMerge)) {
+        const baseValue = merged[key];
+        if (isPlainObject$1(baseValue) && isPlainObject$1(mergeInValue)) {
+            merged[key] = deepMergeClaims(baseValue, mergeInValue);
+        }
+        else {
+            merged[key] = mergeInValue;
+        }
+    }
+    return merged;
+}
+/**
+ * Parses claims JSON, optionally deep-merges a second client-originated claims string
+ * (`claimsToMerge`, e.g. `claimsFromClient`) with precedence on conflicting keys, merges
+ * default optional idToken claims (signin_state, login_hint), and appends client
+ * capabilities (xms_cc) to the access_token section.
  * Does not overwrite idToken claims already specified by the caller.
  * @param claims - Existing claims JSON string from the request (may be undefined)
  * @param clientCapabilities - Client capabilities array from configuration
+ * @param correlationId - The request correlation id
+ * @param claimsToMerge - Optional second claims JSON string (e.g. client-originated `claimsFromClient`)
+ * deep-merged into `claims` with precedence on conflicts; parsed and validated when present. Nested
+ * objects are merged recursively; arrays and scalar values are replaced.
  * @returns Merged claims JSON string
  */
-function buildMergedClaims(claims, clientCapabilities, correlationId = "") {
-    let mergedClaims;
+function buildMergedClaims(claims, clientCapabilities, correlationId = "", claimsToMerge) {
     // Parse provided claims into JSON object or initialize empty object
-    if (!claims) {
-        mergedClaims = {};
-    }
-    else {
-        try {
-            const parsed = JSON.parse(claims);
-            if (typeof parsed !== "object" ||
-                parsed === null ||
-                Array.isArray(parsed)) {
-                throw new Error("Claims must be a JSON object");
-            }
-            mergedClaims = parsed;
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims, correlationId);
-        }
+    let mergedClaims = claims ? parseClaims(claims, correlationId) : {};
+    // Deep-merge client-originated claims (e.g. `claimsFromClient`) with precedence on conflicts
+    if (claimsToMerge?.trim()) {
+        mergedClaims = deepMergeClaims(mergedClaims, parseClaims(claimsToMerge, correlationId));
     }
     // Add default optional idToken claims
     if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ID_TOKEN)) {
@@ -4132,11 +4203,31 @@ function addResource(parameters, resource) {
     if (resource) {
         parameters.set(RESOURCE, resource);
     }
+}
+/**
+ * Add the `attribute_tokens` parameter to a /token request body.
+ *
+ * When `attributeTokens` is a non-empty array the values are sorted lexicographically and joined
+ * with a single space, then written to the request body. When `attributeTokens` is an empty array
+ * the parameter is deleted from the request body.
+ *
+ * @param parameters - request parameter map that will be serialized into the /token body
+ * @param attributeTokens - caller-provided attribute token strings
+ */
+function addAttributeTokens(parameters, attributeTokens) {
+    const serialized = serializeAttributeTokens(attributeTokens);
+    if (serialized) {
+        parameters.set(ATTRIBUTE_TOKENS, serialized);
+    }
+    else {
+        parameters.delete(ATTRIBUTE_TOKENS);
+    }
 }
 
 var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     __proto__: null,
     addApplicationTelemetry: addApplicationTelemetry,
+    addAttributeTokens: addAttributeTokens,
     addAuthorizationCode: addAuthorizationCode,
     addBrokerParameters: addBrokerParameters,
     addCcsOid: addCcsOid,
@@ -4189,6 +4280,14 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Shared JOSE algorithm literals used by MSAL package internals.
+ * @internal
+ */
+const JsonWebTokenAlgorithms = {
+    ES256: "ES256",
+    RS256: "RS256",
+};
 /**
  * Default crypto implementation used when a platform-specific implementation has
  * not been provided.
@@ -4209,23 +4308,41 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     encodeKid: () => {
         throw createClientAuthError(methodNotImplemented, "");
     },
-    async getPublicKeyThumbprint() {
-        throw createClientAuthError(methodNotImplemented, "");
+    async removeTokenBindingKey(kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
     },
-    async removeTokenBindingKey() {
-        throw createClientAuthError(methodNotImplemented, "");
+    async clearKeystore(correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
     },
-    async clearKeystore() {
-        throw createClientAuthError(methodNotImplemented, "");
-    },
-    async signJwt() {
-        throw createClientAuthError(methodNotImplemented, "");
+    async signTokenBindingJwt(header, payload, kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
     },
     async hashString() {
         throw createClientAuthError(methodNotImplemented, "");
     },
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Default token-binding key manager used when a platform-specific implementation
+ * has not been provided.
+ * @internal
+ */
+const DEFAULT_TOKEN_BINDING_KEY_MANAGER = {
+    async provisionTokenBindingKey(request) {
+        throw createClientAuthError(methodNotImplemented, request.correlationId);
+    },
+    async removeTokenBindingKey(_kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
+    },
+    async getTokenBindingPublicKeyJwk(_kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
+    },
+};
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4516,7 +4633,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.11.3";
+const version = "16.13.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4792,9 +4909,17 @@ class CacheManager {
     }
     /**
      * saves access token credential
-     * @param credential
+     * @param credential - the access token entity to save
+     * @param correlationId - unique identifier for the request
+     * @param kmsi - keep me signed in flag
      */
     async saveAccessToken(credential, correlationId, kmsi) {
+        // Compute hash from components on the entity itself — no need to thread externally.
+        let additionalCacheKeyHash;
+        if (credential.additionalCacheKeyComponents &&
+            Object.keys(credential.additionalCacheKeyComponents).length > 0) {
+            additionalCacheKeyHash = await this.cryptoImpl.hashString(JSON.stringify(credential.additionalCacheKeyComponents));
+        }
         const accessTokenFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -4818,7 +4943,7 @@ class CacheManager {
                 }
             }
         });
-        await this.setAccessTokenCredential(credential, correlationId, kmsi);
+        await this.setAccessTokenCredential(credential, correlationId, kmsi, additionalCacheKeyHash);
     }
     /**
      * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
@@ -4918,16 +5043,9 @@ class CacheManager {
         // Access Token with Auth Scheme specific matching
         if (entity.credentialType ===
             CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
-            if (!!filter.tokenType &&
-                !this.matchTokenType(entity, filter.tokenType)) {
+            if (!this.matchAccessTokenWithAuthScheme(entity, filter)) {
                 return false;
             }
-            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-            if (filter.tokenType === AuthenticationScheme.SSH) {
-                if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
-                    return false;
-                }
-            }
         }
         // Additional cache key components matching (bidirectional isolation)
         const entityComponents = entity.additionalCacheKeyComponents;
@@ -5230,6 +5348,12 @@ class CacheManager {
                 AuthenticationScheme.BEARER.toLowerCase()
             ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
             : CredentialType.ACCESS_TOKEN;
+        const attributeTokenPartition = serializeAttributeTokens(request.attributeTokens);
+        const additionalCacheKeyComponents = attributeTokenPartition
+            ? {
+                attribute_tokens: attributeTokenPartition,
+            }
+            : undefined;
         const accessTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -5238,11 +5362,15 @@ class CacheManager {
             realm: targetRealm || account.tenantId,
             target: scopes,
             tokenType: authScheme,
-            keyId: request.sshKid,
+            keyId: authScheme === AuthenticationScheme.SSH
+                ? request.sshKid
+                : undefined,
+            additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
         const accessTokenKeys = (tokenKeys && tokenKeys.accessToken) ||
             this.getTokenKeys().accessToken;
         const accessTokens = [];
+        const matchedKeys = [];
         accessTokenKeys.forEach((key) => {
             // Validate key
             if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
@@ -5251,18 +5379,18 @@ class CacheManager {
                 if (accessToken &&
                     this.credentialMatchesFilter(accessToken, accessTokenFilter, correlationId)) {
                     accessTokens.push(accessToken);
+                    matchedKeys.push(key);
                 }
             }
         });
-        const numAccessTokens = accessTokens.length;
-        if (numAccessTokens < 1) {
+        if (accessTokens.length < 1) {
             this.commonLogger.info("CacheManager:getAccessToken - No token found", correlationId);
             return null;
         }
-        else if (numAccessTokens > 1) {
+        else if (accessTokens.length > 1) {
             this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them", correlationId);
-            accessTokens.forEach((accessToken) => {
-                this.removeAccessToken(this.generateCredentialKey(accessToken), correlationId);
+            matchedKeys.forEach((key) => {
+                this.removeAccessToken(key, correlationId);
             });
             this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
             return null;
@@ -5598,7 +5726,29 @@ class CacheManager {
      * @param tokenType
      */
     matchTokenType(entity, tokenType) {
-        return !!(entity.tokenType && entity.tokenType === tokenType);
+        return !!(entity.tokenType &&
+            entity.tokenType.toLowerCase() === tokenType.toLowerCase());
+    }
+    matchAccessTokenWithAuthScheme(entity, filter) {
+        const normalizedFilterTokenType = filter.tokenType?.toLowerCase();
+        if (!!filter.tokenType &&
+            !this.matchTokenType(entity, filter.tokenType)) {
+            return false;
+        }
+        switch (normalizedFilterTokenType) {
+            case "dpop":
+                return this.matchKeyBoundAccessToken(entity, filter, true);
+            case AuthenticationScheme.SSH:
+                return this.matchKeyBoundAccessToken(entity, filter, false);
+            default:
+                return true;
+        }
+    }
+    matchKeyBoundAccessToken(entity, filter, requireKeyId) {
+        if (!filter.keyId) {
+            return !requireKeyId;
+        }
+        return this.matchKeyId(entity, filter.keyId);
     }
     /**
      * Returns true if the credential's keyId matches the one in the request, false otherwise
@@ -5705,7 +5855,9 @@ class DefaultStorageClass extends CacheManager {
     getTokenKeys() {
         throw createClientAuthError(methodNotImplemented, "");
     }
-    generateCredentialKey() {
+    /* eslint-disable @typescript-eslint/no-unused-vars */
+    generateCredentialKey(_credential, _hash) {
+        /* eslint-enable @typescript-eslint/no-unused-vars */
         throw createClientAuthError(methodNotImplemented, "");
     }
     generateAccountKey() {
@@ -5886,7 +6038,7 @@ const DEFAULT_TELEMETRY_OPTIONS = {
  * @returns Configuration
  * @internal
  */
-function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
+function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, tokenBindingKeyManager: tokenBindingKeyManager, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
     const loggerOptions = {
         ...DEFAULT_LOGGER_IMPLEMENTATION,
         ...userLoggerOption,
@@ -5899,6 +6051,7 @@ function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions:
             new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions, name, version), new StubPerformanceClient()),
         networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        tokenBindingKeyManager: tokenBindingKeyManager || DEFAULT_TOKEN_BINDING_KEY_MANAGER,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
         libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
         telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
@@ -5954,16 +6107,135 @@ function isOidcProtocolMode(config) {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const missingKidError = "missing_kid_error";
+const missingAlgError = "missing_alg_error";
+const missingJwkError = "missing_jwk_error";
+const invalidJwkError = "invalid_jwk_error";
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+class JoseHeaderError extends AuthError {
+    constructor(errorCode, correlationId, errorMessage) {
+        super(errorCode, correlationId, errorMessage);
+        this.name = "JoseHeaderError";
+        Object.setPrototypeOf(this, JoseHeaderError.prototype);
+    }
+}
+/** Returns JoseHeaderError object */
+function createJoseHeaderError(code, correlationId) {
+    return new JoseHeaderError(code, correlationId);
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Checks whether a value is a plain JSON-like object.
+ * Allows objects with null prototypes, but rejects arrays and object subclasses.
+ */
+function isPlainObject(value) {
+    if (typeof value !== "object" ||
+        value === null ||
+        Object.prototype.toString.call(value) !== "[object Object]") {
+        return false;
+    }
+    if (Object.getPrototypeOf(value) === null) {
+        return true;
+    }
+    let proto = value;
+    while (Object.getPrototypeOf(proto) !== null) {
+        proto = Object.getPrototypeOf(proto);
+    }
+    return Object.getPrototypeOf(value) === proto;
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class JoseHeader {
+    constructor(options, correlationId) {
+        if (typeof options.alg !== "string" || !options.alg) {
+            throw createJoseHeaderError(missingAlgError, correlationId);
+        }
+        this.typ = options.typ;
+        this.alg = options.alg;
+        this.kid = options.kid;
+        this.jwk = options.jwk;
+    }
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @param correlationId
+     * @returns
+     */
+    static getShrHeader(shrHeaderOptions, correlationId) {
+        // KeyID is required on the SHR header
+        if (!shrHeaderOptions.kid) {
+            throw createJoseHeaderError(missingKidError, correlationId);
+        }
+        // Alg is required on the SHR header
+        if (!shrHeaderOptions.alg) {
+            throw createJoseHeaderError(missingAlgError, correlationId);
+        }
+        return new JoseHeader({
+            // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
+            typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
+            kid: shrHeaderOptions.kid,
+            alg: shrHeaderOptions.alg,
+        }, correlationId);
+    }
+    /**
+     * Builds a DPoP formatted JOSE Header from the JOSE Header options provided.
+     * Throws if public JWK or algorithm aren't provided since they are required for DPoP.
+     * @param dpopHeaderOptions
+     * @param correlationId
+     * @returns
+     */
+    static getDpopHeader(dpopHeaderOptions, correlationId) {
+        if (!isPlainObject(dpopHeaderOptions.jwk)) {
+            throw createJoseHeaderError(missingJwkError, correlationId);
+        }
+        if (!dpopHeaderOptions.alg) {
+            throw createJoseHeaderError(missingAlgError, correlationId);
+        }
+        if (Object.keys(dpopHeaderOptions.jwk).length === 0) {
+            throw createJoseHeaderError(invalidJwkError, correlationId);
+        }
+        return new JoseHeader({
+            typ: JsonWebTokenTypes.Dpop,
+            alg: dpopHeaderOptions.alg,
+            jwk: dpopHeaderOptions.jwk,
+        }, correlationId);
+    }
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 const KeyLocation = {
     SW: "sw"};
+const SHR_TOKEN_BINDING_KEY_TYPE = "shr";
+const SHR_TOKEN_BINDING_KEY_ALGORITHM = JsonWebTokenAlgorithms.RS256;
 /** @internal */
 class PopTokenGenerator {
-    constructor(cryptoUtils, performanceClient) {
+    constructor(cryptoUtils, tokenBindingKeyManager, performanceClient) {
         this.cryptoUtils = cryptoUtils;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
         this.performanceClient = performanceClient;
     }
     /**
@@ -5986,7 +6258,11 @@ class PopTokenGenerator {
      * @returns
      */
     async generateKid(request) {
-        const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(request);
+        const kidThumbprint = await this.tokenBindingKeyManager.provisionTokenBindingKey({
+            correlationId: request.correlationId,
+            tokenBindingKeyType: SHR_TOKEN_BINDING_KEY_TYPE,
+            tokenBindingKeyAlgorithm: SHR_TOKEN_BINDING_KEY_ALGORITHM,
+        });
         return {
             kid: kidThumbprint,
             xms_ksl: KeyLocation.SW,
@@ -6016,7 +6292,17 @@ class PopTokenGenerator {
             ? new UrlString(resourceRequestUri, request.correlationId)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
-        return this.cryptoUtils.signJwt({
+        const publicKeyJwk = await this.tokenBindingKeyManager.getTokenBindingPublicKeyJwk(keyId, request.correlationId);
+        const encodedKeyIdThumbprint = this.cryptoUtils.base64UrlEncode(JSON.stringify({ kid: keyId }));
+        const shrAlgorithm = shrOptions?.header?.alg ||
+            publicKeyJwk.alg ||
+            SHR_TOKEN_BINDING_KEY_ALGORITHM;
+        const shrHeader = JoseHeader.getShrHeader({
+            ...shrOptions?.header,
+            alg: shrAlgorithm,
+            kid: encodedKeyIdThumbprint,
+        }, request.correlationId);
+        const shrPayload = {
             at: payload,
             ts: nowSeconds(),
             m: resourceRequestMethod?.toUpperCase(),
@@ -6028,7 +6314,11 @@ class PopTokenGenerator {
                 : undefined,
             client_claims: shrClaims || undefined,
             ...claims,
-        }, keyId, shrOptions, request.correlationId);
+            cnf: {
+                jwk: publicKeyJwk,
+            },
+        };
+        return this.cryptoUtils.signTokenBindingJwt(shrHeader, shrPayload, keyId, request.correlationId);
     }
 }
 
@@ -6262,10 +6552,11 @@ var ProtocolUtils = /*#__PURE__*/Object.freeze({
  * @internal
  */
 class ResponseHandler {
-    constructor(clientId, cacheStorage, cryptoObj, logger, performanceClient, serializableCache, persistencePlugin) {
+    constructor(clientId, cacheStorage, cryptoObj, logger, performanceClient, serializableCache, persistencePlugin, tokenBindingKeyManager = DEFAULT_TOKEN_BINDING_KEY_MANAGER) {
         this.clientId = clientId;
         this.cacheStorage = cacheStorage;
         this.cryptoObj = cryptoObj;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
         this.logger = logger;
         this.performanceClient = performanceClient;
         this.serializableCache = serializableCache;
@@ -6340,7 +6631,15 @@ class ResponseHandler {
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
             serverTokenResponse.key_id || request.sshKid || undefined;
-        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents);
+        // Compute components once for entity storage (fallback if hash not provided by client)
+        const attributeTokenPartition = serializeAttributeTokens(request.attributeTokens);
+        const cacheKeyComponents = additionalCacheKeyComponents ??
+            (attributeTokenPartition
+                ? {
+                    attribute_tokens: attributeTokenPartition,
+                }
+                : undefined);
+        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, cacheKeyComponents);
         let cacheContext;
         try {
             if (this.persistencePlugin && this.serializableCache) {
@@ -6366,7 +6665,12 @@ class ResponseHandler {
                     this.performanceClient?.addFields({
                         acntLoggedOut: true,
                     }, request.correlationId);
-                    return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, undefined, serverRequestId);
+                    return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, {
+                        idTokenClaims,
+                        requestState: requestStateObj,
+                        requestId: serverRequestId,
+                        tokenBindingKeyManager: this.tokenBindingKeyManager,
+                    });
                 }
             }
             await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), apiId, request.storeInCache);
@@ -6379,7 +6683,13 @@ class ResponseHandler {
                 await this.persistencePlugin.afterCacheAccess(cacheContext);
             }
         }
-        return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, serverTokenResponse, serverRequestId);
+        return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, {
+            idTokenClaims,
+            requestState: requestStateObj,
+            serverTokenResponse,
+            requestId: serverRequestId,
+            tokenBindingKeyManager: this.tokenBindingKeyManager,
+        });
     }
     /**
      * Generates CacheRecord
@@ -6475,7 +6785,8 @@ class ResponseHandler {
      * @param fromTokenCache
      * @param stateString
      */
-    static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, performanceClient, idTokenClaims, requestState, serverTokenResponse, requestId) {
+    static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, performanceClient, options = {}) {
+        const { idTokenClaims, requestState, serverTokenResponse, requestId, tokenBindingKeyManager = DEFAULT_TOKEN_BINDING_KEY_MANAGER, } = options;
         let accessToken = "";
         let responseScopes = [];
         let expiresOn = null;
@@ -6490,7 +6801,7 @@ class ResponseHandler {
             if (cacheRecord.accessToken.tokenType ===
                 AuthenticationScheme.POP &&
                 !request.popKid) {
-                const popTokenGenerator = new PopTokenGenerator(cryptoObj, performanceClient);
+                const popTokenGenerator = new PopTokenGenerator(cryptoObj, tokenBindingKeyManager, performanceClient);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
                     throw createClientAuthError(keyIdMissing, request.correlationId);
@@ -6652,6 +6963,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
         sshKid: request.sshKid,
         embeddedClientId: request.embeddedClientId || request.extraParameters?.clientId,
         resource: request.resource,
+        attributeTokens: serializeAttributeTokens(request.attributeTokens),
     };
 }
 
@@ -6938,7 +7250,7 @@ class AuthorizationCodeClient {
         const response = await invokeAsync(this.executeTokenRequest.bind(this), AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request, this.serverTelemetryManager);
         // Retrieve requestId from response headers
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
-        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
+        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin, this.config.tokenBindingKeyManager);
         // Validate response. This function throws a server error if an error is returned by the server.
         responseHandler.validateTokenResponse(response.body, request.correlationId);
         return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, authCodePayload, undefined, undefined, undefined, requestId);
@@ -7009,6 +7321,12 @@ class AuthorizationCodeClient {
         // Add scope array, parameter builder will add default scopes and dedupe
         addScopes(parameters, request.scopes, request.correlationId, true, this.oidcDefaultScopes);
         addResource(parameters, request.resource);
+        if (request.attributeTokens) {
+            addAttributeTokens(parameters, request.attributeTokens);
+        }
+        this.performanceClient?.addFields({
+            hasAttributeTokens: !!request.attributeTokens?.length,
+        }, request.correlationId);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
         // Add library metadata
@@ -7033,7 +7351,7 @@ class AuthorizationCodeClient {
         addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
         addClientInfo(parameters);
         if (request.authenticationScheme === AuthenticationScheme.POP) {
-            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
+            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.config.tokenBindingKeyManager, this.performanceClient);
             let reqCnfData;
             if (!request.popKid) {
                 const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
@@ -7178,7 +7496,7 @@ class RefreshTokenClient {
         const response = await invokeAsync(this.executeTokenRequest.bind(this), RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
         // Retrieve requestId from response headers
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
-        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
+        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin, this.config.tokenBindingKeyManager);
         responseHandler.validateTokenResponse(response.body, request.correlationId);
         return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, undefined, undefined, true, request.forceCache, requestId);
     }
@@ -7304,6 +7622,12 @@ class RefreshTokenClient {
             addServerTelemetry(parameters, this.serverTelemetryManager);
         }
         addRefreshToken(parameters, request.refreshToken);
+        if (request.attributeTokens) {
+            addAttributeTokens(parameters, request.attributeTokens);
+        }
+        this.performanceClient?.addFields({
+            hasAttributeTokens: !!request.attributeTokens?.length,
+        }, request.correlationId);
         if (this.config.clientCredentials.clientSecret) {
             addClientSecret(parameters, this.config.clientCredentials.clientSecret);
         }
@@ -7313,7 +7637,7 @@ class RefreshTokenClient {
             addClientAssertionType(parameters, clientAssertion.assertionType);
         }
         if (request.authenticationScheme === AuthenticationScheme.POP) {
-            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
+            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.config.tokenBindingKeyManager, this.performanceClient);
             let reqCnfData;
             if (!request.popKid) {
                 const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
@@ -7466,7 +7790,10 @@ class SilentFlowClient {
         if (cacheRecord.idToken) {
             idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode, request.correlationId);
         }
-        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
+        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, {
+            idTokenClaims,
+            tokenBindingKeyManager: this.config.tokenBindingKeyManager,
+        });
     }
 }
 
@@ -8163,12 +8490,14 @@ exports.ClientConfigurationErrorCodes = ClientConfigurationErrorCodes;
 exports.Constants = Constants;
 exports.DEFAULT_CRYPTO_IMPLEMENTATION = DEFAULT_CRYPTO_IMPLEMENTATION;
 exports.DEFAULT_SYSTEM_OPTIONS = DEFAULT_SYSTEM_OPTIONS;
+exports.DEFAULT_TOKEN_BINDING_KEY_MANAGER = DEFAULT_TOKEN_BINDING_KEY_MANAGER;
 exports.DefaultStorageClass = DefaultStorageClass;
 exports.EXT_FIELD_PREFIX = EXT_FIELD_PREFIX;
 exports.IntFields = IntFields;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
 exports.InteractionRequiredAuthErrorCodes = InteractionRequiredAuthErrorCodes;
-exports.JsonWebTokenTypes = JsonWebTokenTypes;
+exports.JoseHeader = JoseHeader;
+exports.JsonWebTokenAlgorithms = JsonWebTokenAlgorithms;
 exports.Logger = Logger;
 exports.NetworkError = NetworkError;
 exports.PerformanceEventStatus = PerformanceEventStatus;
@@ -8217,4 +8546,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-JVUj78ag.js.map
+//# sourceMappingURL=index-node-BaODPZEy.js.map