@azure/msal-common 16.13.0 → 16.14.0

package/dist-browser/crypto/DpopProofGenerator.mjs

@@ -0,0 +1,153 @@
+/*! @azure/msal-common v16.14.0 2026-08-28 */
+'use strict';
+import { JsonWebTokenAlgorithms } from './ICrypto.mjs';
+import { nowSeconds } from '../utils/TimeUtils.mjs';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { JoseHeader } from './JoseHeader.mjs';
+import { dpopMissingResourceContext, invalidDpopNonce, urlParseError, invalidDpopHtu, invalidDpopHtm } from '../error/ClientConfigurationErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DPOP_HTM_REGEX = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const DPOP_TOKEN_BINDING_KEY_TYPE = "dpop";
+const DPOP_JWT_HEADER_ALGORITHM = JsonWebTokenAlgorithms.ES256;
+function buildProofHeader(publicJwk, correlationId) {
+    return JoseHeader.getDpopHeader({
+        alg: DPOP_JWT_HEADER_ALGORITHM,
+        jwk: publicJwk,
+    }, correlationId);
+}
+function normalizeHtm(htm, correlationId) {
+    if (typeof htm !== "string" || !DPOP_HTM_REGEX.test(htm)) {
+        throw createClientConfigurationError(invalidDpopHtm, correlationId);
+    }
+    return htm.toUpperCase();
+}
+/**
+ * Normalizes a URL for use as the DPoP htu claim.
+ * Per RFC 9449 §4.2, htu is the target URI without query and fragment components.
+ * WHATWG URL serialization handles RFC 3986 syntax- and scheme-based normalization
+ * such as lowercasing scheme/host and eliding default ports.
+ */
+function normalizeHtu(url, correlationId) {
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(url);
+    }
+    catch {
+        throw createClientConfigurationError(urlParseError, correlationId);
+    }
+    if (!/^https:\/\//i.test(url) ||
+        parsedUrl.protocol !== "https:" ||
+        parsedUrl.username ||
+        parsedUrl.password) {
+        throw createClientConfigurationError(invalidDpopHtu, correlationId);
+    }
+    parsedUrl.search = "";
+    parsedUrl.hash = "";
+    return parsedUrl.href;
+}
+function validateDpopNonce(nonce, correlationId) {
+    if (nonce !== undefined && nonce.trim().length === 0) {
+        throw createClientConfigurationError(invalidDpopNonce, correlationId);
+    }
+}
+/**
+ * Builds RFC 9449 DPoP proof JWT payloads for token-endpoint and
+ * resource-endpoint proof bindings.
+ *
+ * Not exported from any public package entry point.
+ * This helper is internal-only until DPoP is wired into acquisition flows
+ * in a subsequent work item.
+ *
+ * DPoP proofs do not contain SHR fields (at, ts, m, u, p, q).
+ * @internal
+ */
+class DpopProofGenerator {
+    constructor(cryptoUtils, tokenBindingKeyManager) {
+        this.cryptoUtils = cryptoUtils;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
+    }
+    /**
+     * Provisions a fresh DPoP key and returns the RFC 7638 JWK thumbprint used
+     * as `dpop_jkt`.
+     */
+    async generateJkt(correlationId = "") {
+        return this.tokenBindingKeyManager.provisionTokenBindingKey({
+            tokenBindingKeyType: DPOP_TOKEN_BINDING_KEY_TYPE,
+            tokenBindingKeyAlgorithm: DPOP_JWT_HEADER_ALGORITHM,
+            correlationId,
+        });
+    }
+    /**
+     * Builds RFC 9449 claims for a token-endpoint DPoP proof.
+     * - htm is always "POST" because token endpoint requests use HTTP POST (RFC 9449 §5).
+     * - htu is the normalized token endpoint URI (query and fragment stripped).
+     * - jti is a fresh CSPRNG-backed unique identifier for every proof.
+     */
+    buildTokenProofClaims(params, correlationId = "") {
+        validateDpopNonce(params.nonce, correlationId);
+        const claims = {
+            jti: this.cryptoUtils.createNewGuid(),
+            htm: "POST",
+            htu: normalizeHtu(params.tokenEndpoint, correlationId),
+            iat: nowSeconds(),
+        };
+        if (params.nonce !== undefined) {
+            claims.nonce = params.nonce;
+        }
+        return claims;
+    }
+    /**
+     * Builds and signs a compact DPoP proof JWT for a token-endpoint request.
+     */
+    async generateTokenProof(params, keyId, correlationId = "") {
+        return this.generateProof(this.buildTokenProofClaims(params, correlationId), keyId, correlationId);
+    }
+    /**
+     * Builds RFC 9449 claims for a resource-endpoint DPoP proof.
+     * - htm is uppercased per RFC 9449 §4.2.
+     * - htu is the normalized resource URI (query and fragment stripped).
+     * - ath is the base64url-encoded SHA-256 hash of the ASCII access token.
+     * - jti is a fresh CSPRNG-backed unique identifier for every proof.
+     */
+    buildResourceProofClaims(params, correlationId = "") {
+        validateDpopNonce(params.nonce, correlationId);
+        const claims = {
+            jti: this.cryptoUtils.createNewGuid(),
+            htm: normalizeHtm(params.htm, correlationId),
+            htu: normalizeHtu(params.htu, correlationId),
+            ath: params.ath,
+            iat: nowSeconds(),
+        };
+        if (params.nonce !== undefined) {
+            claims.nonce = params.nonce;
+        }
+        return claims;
+    }
+    /**
+     * Builds and signs a compact DPoP proof JWT for a resource request.
+     */
+    async generateResourceProof(params, keyId, correlationId = "") {
+        const { htu, htm, nonce } = params;
+        if (!htu || !htm) {
+            throw createClientConfigurationError(dpopMissingResourceContext, correlationId);
+        }
+        const ath = await this.cryptoUtils.hashString(params.accessToken);
+        return this.generateProof(this.buildResourceProofClaims({
+            htu,
+            htm,
+            ath,
+            nonce,
+        }, correlationId), keyId, correlationId);
+    }
+    async generateProof(claims, keyId, correlationId) {
+        const publicJwk = await this.tokenBindingKeyManager.getTokenBindingPublicKeyJwk(keyId, correlationId);
+        return this.cryptoUtils.signTokenBindingJwt(buildProofHeader(publicJwk, correlationId), claims, keyId, correlationId);
+    }
+}
+
+export { DpopProofGenerator };
+//# sourceMappingURL=DpopProofGenerator.mjs.map

package/dist-browser/crypto/DpopProofGenerator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DpopProofGenerator.mjs","sources":["../../src/crypto/DpopProofGenerator.ts"],"sourcesContent":[null],"names":["ClientConfigurationErrorCodes.invalidDpopHtm","ClientConfigurationErrorCodes.urlParseError","ClientConfigurationErrorCodes.invalidDpopHtu","ClientConfigurationErrorCodes.invalidDpopNonce","TimeUtils.nowSeconds","ClientConfigurationErrorCodes.dpopMissingResourceContext"],"mappings":";;;;;;;;AAAA;;;AAGG;AAqDH,MAAM,cAAc,GAAG,gCAAgC,CAAC;AACxD,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,yBAAyB,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAE/D,SAAS,gBAAgB,CACrB,SAA2B,EAC3B,aAAqB,EAAA;IAErB,OAAO,UAAU,CAAC,aAAa,CAC3B;AACI,QAAA,GAAG,EAAE,yBAAyB;AAC9B,QAAA,GAAG,EAAE,SAAS;KACjB,EACD,aAAa,CAChB,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,aAAqB,EAAA;AACpD,IAAA,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACtD,MAAM,8BAA8B,CAChCA,cAA4C,EAC5C,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAED,IAAA,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;AAKG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,aAAqB,EAAA;AACpD,IAAA,IAAI,SAAc,CAAC;IACnB,IAAI;AACA,QAAA,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5B,IAAA,CAAA;IAAC,MAAM;QACJ,MAAM,8BAA8B,CAChCC,aAA2C,EAC3C,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IACI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,QAAQ,KAAK,QAAQ;AAC/B,QAAA,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,QAAQ,EACpB;QACE,MAAM,8BAA8B,CAChCC,cAA4C,EAC5C,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAED,IAAA,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC;AACtB,IAAA,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC;IACpB,OAAO,SAAS,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CACtB,KAAyB,EACzB,aAAqB,EAAA;AAErB,IAAA,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE;QAClD,MAAM,8BAA8B,CAChCC,gBAA8C,EAC9C,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;;;;;;;;AAUG;MACU,kBAAkB,CAAA;IAI3B,WAAA,CACI,WAAoB,EACpB,sBAA+C,EAAA;AAE/C,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AAC/B,QAAA,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;IACzD,CAAC;AAED;;;AAGG;AACH,IAAA,MAAM,WAAW,CAAC,aAAA,GAAwB,EAAE,EAAA;AACxC,QAAA,OAAO,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;AACxD,YAAA,mBAAmB,EAAE,2BAA2B;AAChD,YAAA,wBAAwB,EAAE,yBAAyB;YACnD,aAAa;AAChB,SAAA,CAAC,CAAC;IACP,CAAC;AAED;;;;;AAKG;AACH,IAAA,qBAAqB,CACjB,MAA4B,EAC5B,aAAA,GAAwB,EAAE,EAAA;AAE1B,QAAA,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AAC/C,QAAA,MAAM,MAAM,GAAoB;AAC5B,YAAA,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;AACrC,YAAA,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC;AACtD,YAAA,GAAG,EAAEC,UAAoB,EAAE;SAC9B,CAAC;AACF,QAAA,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE;AAC5B,YAAA,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;AAC/B,QAAA,CAAA;AACD,QAAA,OAAO,MAAM,CAAC;IAClB,CAAC;AAED;;AAEG;IACH,MAAM,kBAAkB,CACpB,MAA4B,EAC5B,KAAa,EACb,gBAAwB,EAAE,EAAA;AAE1B,QAAA,OAAO,IAAI,CAAC,aAAa,CACrB,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,aAAa,CAAC,EACjD,KAAK,EACL,aAAa,CAChB,CAAC;IACN,CAAC;AAED;;;;;;AAMG;AACH,IAAA,wBAAwB,CACpB,MAA+B,EAC/B,aAAA,GAAwB,EAAE,EAAA;AAE1B,QAAA,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AAC/C,QAAA,MAAM,MAAM,GAAoB;AAC5B,YAAA,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;YACrC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC;YAC5C,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC;YAC5C,GAAG,EAAE,MAAM,CAAC,GAAG;AACf,YAAA,GAAG,EAAEA,UAAoB,EAAE;SAC9B,CAAC;AACF,QAAA,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE;AAC5B,YAAA,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;AAC/B,QAAA,CAAA;AACD,QAAA,OAAO,MAAM,CAAC;IAClB,CAAC;AAED;;AAEG;IACH,MAAM,qBAAqB,CACvB,MAAuC,EACvC,KAAa,EACb,gBAAwB,EAAE,EAAA;QAE1B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;AACnC,QAAA,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YACd,MAAM,8BAA8B,CAChCC,0BAAwD,EACxD,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClE,QAAA,OAAO,IAAI,CAAC,aAAa,CACrB,IAAI,CAAC,wBAAwB,CACzB;YACI,GAAG;YACH,GAAG;YACH,GAAG;YACH,KAAK;AACR,SAAA,EACD,aAAa,CAChB,EACD,KAAK,EACL,aAAa,CAChB,CAAC;IACN,CAAC;AAEO,IAAA,MAAM,aAAa,CACvB,MAAuB,EACvB,KAAa,EACb,aAAqB,EAAA;AAErB,QAAA,MAAM,SAAS,GACX,MAAM,IAAI,CAAC,sBAAsB,CAAC,2BAA2B,CACzD,KAAK,EACL,aAAa,CAChB,CAAC;AAEN,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACvC,gBAAgB,CAAC,SAAS,EAAE,aAAa,CAAC,EAC1C,MAAM,EACN,KAAK,EACL,aAAa,CAChB,CAAC;IACN,CAAC;AACJ;;;;"}

package/dist-browser/crypto/ICrypto.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/crypto/ITokenBindingKeyManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/crypto/ITokenBindingKeyManager.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ITokenBindingKeyManager.mjs","sources":["../../src/crypto/ITokenBindingKeyManager.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;AAAA;;;AAGG;AAgDH;;;;AAIG;AACI,MAAM,iCAAiC,GAA4B;IACtE,MAAM,wBAAwB,CAC1B,OAA8C,EAAA;QAE9C,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,OAAO,CAAC,aAAa,CACxB,CAAC;IACN,CAAC;AACD,IAAA,MAAM,qBAAqB,CACvB,IAAY,EACZ,aAAqB,EAAA;QAErB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,aAAa,CAChB,CAAC;IACN,CAAC;AACD,IAAA,MAAM,2BAA2B,CAC7B,IAAY,EACZ,aAAqB,EAAA;QAErB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,aAAa,CAChB,CAAC;IACN,CAAC;;;;;"}
+{"version":3,"file":"ITokenBindingKeyManager.mjs","sources":["../../src/crypto/ITokenBindingKeyManager.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;AAAA;;;AAGG;AAiDH;;;;AAIG;AACI,MAAM,iCAAiC,GAA4B;IACtE,MAAM,wBAAwB,CAC1B,OAA8C,EAAA;QAE9C,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,OAAO,CAAC,aAAa,CACxB,CAAC;IACN,CAAC;AACD,IAAA,MAAM,qBAAqB,CACvB,IAAY,EACZ,aAAqB,EAAA;QAErB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,aAAa,CAChB,CAAC;IACN,CAAC;AACD,IAAA,MAAM,2BAA2B,CAC7B,IAAY,EACZ,aAAqB,EAAA;QAErB,MAAM,qBAAqB,CACvBA,oBAAyC,EACzC,aAAa,CAChB,CAAC;IACN,CAAC;;;;;"}

package/dist-browser/crypto/JoseHeader.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { createJoseHeaderError } from '../error/JoseHeaderError.mjs';
 import { isPlainObject } from '../utils/ObjectUtils.mjs';

package/dist-browser/crypto/JoseHeader.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"JoseHeader.mjs","sources":["../../src/crypto/JoseHeader.ts"],"sourcesContent":[null],"names":["JoseHeaderErrorCodes.missingAlgError","JoseHeaderErrorCodes.missingKidError","JoseHeaderErrorCodes.missingJwkError","JoseHeaderErrorCodes.invalidJwkError"],"mappings":";;;;;;;AAAA;;;AAGG;AAgBH;MACa,UAAU,CAAA;IAMnB,WAAA,CACI,OAA4C,EAC5C,aAAqB,EAAA;QAErB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YACjD,MAAM,qBAAqB,CACvBA,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAC3B,CAAC;AAED;;;;;;;AAOG;AACH,IAAA,OAAO,YAAY,CACf,gBAAmC,EACnC,aAAqB,EAAA;;AAGrB,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YACvB,MAAM,qBAAqB,CACvBC,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;;AAGD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YACvB,MAAM,qBAAqB,CACvBD,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QAED,OAAO,IAAI,UAAU,CACjB;;AAEI,YAAA,GAAG,EAAE,gBAAgB,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG;YAClD,GAAG,EAAE,gBAAgB,CAAC,GAAG;YACzB,GAAG,EAAE,gBAAgB,CAAC,GAAG;SAC5B,EACD,aAAa,CAChB,CAAC;IACN,CAAC;AAED;;;;;;AAMG;AACH,IAAA,OAAO,aAAa,CAChB,iBAAoC,EACpC,aAAqB,EAAA;AAErB,QAAA,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE;YACvC,MAAM,qBAAqB,CACvBE,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE;YACxB,MAAM,qBAAqB,CACvBF,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;YACjD,MAAM,qBAAqB,CACvBG,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QAED,OAAO,IAAI,UAAU,CACjB;YACI,GAAG,EAAE,iBAAiB,CAAC,IAAI;YAC3B,GAAG,EAAE,iBAAiB,CAAC,GAAG;YAC1B,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC7B,EACD,aAAa,CAChB,CAAC;IACN,CAAC;AACJ;;;;"}
+{"version":3,"file":"JoseHeader.mjs","sources":["../../src/crypto/JoseHeader.ts"],"sourcesContent":[null],"names":["JoseHeaderErrorCodes.missingAlgError","JoseHeaderErrorCodes.missingKidError","JoseHeaderErrorCodes.missingJwkError","JoseHeaderErrorCodes.invalidJwkError"],"mappings":";;;;;;;AAAA;;;AAGG;AAiBH;MACa,UAAU,CAAA;IAMnB,WAAA,CACI,OAA4C,EAC5C,aAAqB,EAAA;QAErB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YACjD,MAAM,qBAAqB,CACvBA,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAC3B,CAAC;AAED;;;;;;;AAOG;AACH,IAAA,OAAO,YAAY,CACf,gBAAmC,EACnC,aAAqB,EAAA;;AAGrB,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YACvB,MAAM,qBAAqB,CACvBC,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;;AAGD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YACvB,MAAM,qBAAqB,CACvBD,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QAED,OAAO,IAAI,UAAU,CACjB;;AAEI,YAAA,GAAG,EAAE,gBAAgB,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG;YAClD,GAAG,EAAE,gBAAgB,CAAC,GAAG;YACzB,GAAG,EAAE,gBAAgB,CAAC,GAAG;SAC5B,EACD,aAAa,CAChB,CAAC;IACN,CAAC;AAED;;;;;;AAMG;AACH,IAAA,OAAO,aAAa,CAChB,iBAAoC,EACpC,aAAqB,EAAA;AAErB,QAAA,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE;YACvC,MAAM,qBAAqB,CACvBE,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE;YACxB,MAAM,qBAAqB,CACvBF,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;YACjD,MAAM,qBAAqB,CACvBG,eAAoC,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QAED,OAAO,IAAI,UAAU,CACjB;YACI,GAAG,EAAE,iBAAiB,CAAC,IAAI;YAC3B,GAAG,EAAE,iBAAiB,CAAC,GAAG;YAC1B,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC7B,EACD,aAAa,CAChB,CAAC;IACN,CAAC;AACJ;;;;"}

package/dist-browser/crypto/PopTokenGenerator.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { JsonWebTokenAlgorithms } from './ICrypto.mjs';
 import { nowSeconds } from '../utils/TimeUtils.mjs';

package/dist-browser/error/AuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/AuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/CacheError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { cacheErrorUnknown, cacheQuotaExceeded } from './CacheErrorCodes.mjs';
 import * as CacheErrorCodes from './CacheErrorCodes.mjs';

package/dist-browser/error/CacheErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/ClientAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ClientAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28,6 +28,7 @@ const invalidCacheEnvironment = "invalid_cache_environment";
 const noAccountFound = "no_account_found";
 const noCryptoObject = "no_crypto_object";
 const unexpectedCredentialType = "unexpected_credential_type";
+const dpopTokenTypeMismatch = "dpop_token_type_mismatch";
 const tokenRefreshRequired = "token_refresh_required";
 const tokenClaimsCnfRequiredForSignedJwt = "token_claims_cnf_required_for_signedjwt";
 const authorizationCodeMissingFromServerResponse = "authorization_code_missing_from_server_response";
@@ -42,5 +43,5 @@ const platformBrokerError = "platform_broker_error";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
 
-export { authorizationCodeMissingFromServerResponse, bindingKeyNotRemoved, cannotAppendScopeSet, cannotRemoveEmptyScope, clientInfoDecodingError, clientInfoEmptyError, emptyInputScopeSet, endSessionEndpointNotSupported, endpointResolutionError, hashNotDeserialized, invalidCacheEnvironment, invalidCacheRecord, invalidState, keyIdMissing, methodNotImplemented, misplacedResourceParam, multipleMatchingAppMetadata, multipleMatchingTokens, nestedAppAuthBridgeDisabled, networkError, noAccountFound, noAccountInSilentRequest, noCryptoObject, noNetworkConnectivity, nonceMismatch, nullOrEmptyToken, openIdConfigError, platformBrokerError, requestCannotBeMade, resourceParameterRequired, stateMismatch, stateNotFound, tokenClaimsCnfRequiredForSignedJwt, tokenParsingError, tokenRefreshRequired, unexpectedCredentialType, userCanceled };
+export { authorizationCodeMissingFromServerResponse, bindingKeyNotRemoved, cannotAppendScopeSet, cannotRemoveEmptyScope, clientInfoDecodingError, clientInfoEmptyError, dpopTokenTypeMismatch, emptyInputScopeSet, endSessionEndpointNotSupported, endpointResolutionError, hashNotDeserialized, invalidCacheEnvironment, invalidCacheRecord, invalidState, keyIdMissing, methodNotImplemented, misplacedResourceParam, multipleMatchingAppMetadata, multipleMatchingTokens, nestedAppAuthBridgeDisabled, networkError, noAccountFound, noAccountInSilentRequest, noCryptoObject, noNetworkConnectivity, nonceMismatch, nullOrEmptyToken, openIdConfigError, platformBrokerError, requestCannotBeMade, resourceParameterRequired, stateMismatch, stateNotFound, tokenClaimsCnfRequiredForSignedJwt, tokenParsingError, tokenRefreshRequired, unexpectedCredentialType, userCanceled };
 //# sourceMappingURL=ClientAuthErrorCodes.mjs.map

package/dist-browser/error/ClientAuthErrorCodes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClientAuthErrorCodes.mjs","sources":["../../src/error/ClientAuthErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,gBAAgB,GAAG,sBAAsB;AAC/C,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,mBAAmB,GAAG,yBAAyB;AACrD,MAAM,sBAAsB,GAAG,4BAA4B;AAC3D,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,wBAAwB,GAAG,+BAA+B;AAChE,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,uBAAuB,GAAG,4BAA4B;AAC5D,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kCAAkC,GAC3C,0CAA0C;AACvC,MAAM,0CAA0C,GACnD,kDAAkD;AAC/C,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,8BAA8B,GACvC,qCAAqC;AAClC,MAAM,YAAY,GAAG,iBAAiB;AACtC,MAAM,qBAAqB,GAAG,0BAA0B;AACxD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,2BAA2B,GAAG,kCAAkC;AACtE,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,yBAAyB,GAAG,8BAA8B;AAChE,MAAM,sBAAsB,GAAG;;;;"}
+{"version":3,"file":"ClientAuthErrorCodes.mjs","sources":["../../src/error/ClientAuthErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,gBAAgB,GAAG,sBAAsB;AAC/C,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,mBAAmB,GAAG,yBAAyB;AACrD,MAAM,sBAAsB,GAAG,4BAA4B;AAC3D,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,wBAAwB,GAAG,+BAA+B;AAChE,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,uBAAuB,GAAG,4BAA4B;AAC5D,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kCAAkC,GAC3C,0CAA0C;AACvC,MAAM,0CAA0C,GACnD,kDAAkD;AAC/C,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,8BAA8B,GACvC,qCAAqC;AAClC,MAAM,YAAY,GAAG,iBAAiB;AACtC,MAAM,qBAAqB,GAAG,0BAA0B;AACxD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,2BAA2B,GAAG,kCAAkC;AACtE,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,yBAAyB,GAAG,8BAA8B;AAChE,MAAM,sBAAsB,GAAG;;;;"}

package/dist-browser/error/ClientConfigurationError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ClientConfigurationErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31,7 +31,9 @@ const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuratio
 const issuerValidationFailed = "issuer_validation_failed";
 const invalidResponseMode = "invalid_response_mode";
 const invalidDpopHtm = "invalid_dpop_htm";
-const invalidDpopHtu = "invalid_dpop_htu";
+const invalidDpopHtu = "invalid_dpop_htu";
+const invalidDpopNonce = "invalid_dpop_nonce";
+const dpopMissingResourceContext = "dpop_missing_resource_context";
 
-export { authorityMismatch, authorityUriInsecure, cannotAllowPlatformBroker, cannotSetOIDCOptions, claimsRequestParsingError, emptyInputScopesError, invalidAuthenticationHeader, invalidAuthorityMetadata, invalidClaims, invalidCloudDiscoveryMetadata, invalidCodeChallengeMethod, invalidDpopHtm, invalidDpopHtu, invalidPlatformBrokerConfiguration, invalidRequestMethodForEAR, invalidResponseMode, issuerValidationFailed, logoutRequestEmpty, missingNonceAuthenticationHeader, missingSshJwk, missingSshKid, pkceParamsMissing, redirectUriEmpty, tokenRequestEmpty, unsupportedAuthenticationScheme, untrustedAuthority, urlEmptyError, urlParseError };
+export { authorityMismatch, authorityUriInsecure, cannotAllowPlatformBroker, cannotSetOIDCOptions, claimsRequestParsingError, dpopMissingResourceContext, emptyInputScopesError, invalidAuthenticationHeader, invalidAuthorityMetadata, invalidClaims, invalidCloudDiscoveryMetadata, invalidCodeChallengeMethod, invalidDpopHtm, invalidDpopHtu, invalidDpopNonce, invalidPlatformBrokerConfiguration, invalidRequestMethodForEAR, invalidResponseMode, issuerValidationFailed, logoutRequestEmpty, missingNonceAuthenticationHeader, missingSshJwk, missingSshKid, pkceParamsMissing, redirectUriEmpty, tokenRequestEmpty, unsupportedAuthenticationScheme, untrustedAuthority, urlEmptyError, urlParseError };
 //# sourceMappingURL=ClientConfigurationErrorCodes.mjs.map

package/dist-browser/error/ClientConfigurationErrorCodes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClientConfigurationErrorCodes.mjs","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,0BAA0B,GAAG,gCAAgC;AACnE,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,6BAA6B,GAAG,mCAAmC;AACzE,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB;AACjD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,+BAA+B,GACxC,oCAAoC;AACjC,MAAM,gCAAgC,GACzC,sCAAsC;AACnC,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,iBAAiB,GAAG,qBAAqB;AAC/C,MAAM,0BAA0B,GAAG,iCAAiC;AACpE,MAAM,kCAAkC,GAC3C,wCAAwC;AACrC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG;;;;"}
+{"version":3,"file":"ClientConfigurationErrorCodes.mjs","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,0BAA0B,GAAG,gCAAgC;AACnE,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,6BAA6B,GAAG,mCAAmC;AACzE,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB;AACjD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,+BAA+B,GACxC,oCAAoC;AACjC,MAAM,gCAAgC,GACzC,sCAAsC;AACnC,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,iBAAiB,GAAG,qBAAqB;AAC/C,MAAM,0BAA0B,GAAG,iCAAiC;AACpE,MAAM,kCAAkC,GAC3C,wCAAwC;AACrC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,0BAA0B,GAAG;;;;"}

package/dist-browser/error/InteractionRequiredAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 import { interactionRequired, consentRequired, loginRequired, badToken, uiNotAllowed, interruptedUser } from './InteractionRequiredAuthErrorCodes.mjs';

package/dist-browser/error/InteractionRequiredAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/JoseHeaderError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/JoseHeaderErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/NetworkError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/PlatformBrokerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ServerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/index-browser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };

package/dist-browser/index.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };

package/dist-browser/log-strings-mapping.json

@@ -1,7 +1,7 @@
 {
-  "timestamp": "2026-08-18T20:11:58.925Z",
-  "packageVersion": "16.13.0",
-  "totalStrings": 98,
+  "timestamp": "2026-08-28T21:31:23.790Z",
+  "packageVersion": "16.14.0",
+  "totalStrings": 100,
   "mappings": {
     "1lrjz7": {
       "message": "Failed to validate URL: '${e}'",
@@ -31,6 +31,14 @@
       "message": "Token refresh is required due to cache outcome: '${cacheOutcome}'",
       "level": "info"
     },
+    "14djth": {
+      "message": "SilentFlowClient:acquireCachedToken - Local DPoP key was not found for cached access token; refresh required",
+      "level": "info"
+    },
+    "1enswf": {
+      "message": "SilentFlowClient:acquireCachedToken - Cached DPoP access token is missing keyId; refresh required",
+      "level": "info"
+    },
     "130sd8": {
       "message": "Creating custom Authority for custom domain scenario.",
       "level": "verbose"
@@ -239,8 +247,8 @@
       "message": "CacheManager - getIdToken called",
       "level": "trace"
     },
-    "0cx291": {
-      "message": "Failed to remove token binding key '${kid}'",
+    "0id34f": {
+      "message": "Failed to remove token binding key",
       "level": "error"
     },
     "0j476p": {

package/dist-browser/logger/Logger.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/network/INetworkModule.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/network/RequestThumbprint.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { serializeAttributeTokens } from '../cache/utils/CacheHelpers.mjs';
 

package/dist-browser/network/ThrottlingUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { THROTTLING_PREFIX, HeaderNames, DEFAULT_THROTTLE_TIME_SECONDS, DEFAULT_MAX_THROTTLE_TIME_SECONDS } from '../utils/Constants.mjs';
 import { ServerError } from '../error/ServerError.mjs';

package/dist-browser/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.13.0";
+const version = "16.14.0";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist-browser/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
 import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';

package/dist-browser/protocol/Token.mjs

@@ -1,8 +1,9 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { CcsCredentialType } from '../account/CcsCredential.mjs';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';
-import { URL_FORM_CONTENT_TYPE, HeaderNames } from '../utils/Constants.mjs';
+import { DpopProofGenerator } from '../crypto/DpopProofGenerator.mjs';
+import { AuthenticationScheme, HeaderNames, URL_FORM_CONTENT_TYPE } from '../utils/Constants.mjs';
 import { addBrokerParameters, addExtraParameters, addCorrelationId, instrumentBrokerParams } from '../request/RequestParameterBuilder.mjs';
 import { mapToQueryString } from '../utils/UrlUtils.mjs';
 import { ThrottlingUtils } from '../network/ThrottlingUtils.mjs';
@@ -11,7 +12,7 @@ import { AuthError } from '../error/AuthError.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { invokeAsync } from '../utils/FunctionWrappers.mjs';
 import { NetworkClientSendPostRequestAsync } from '../telemetry/performance/PerformanceEvents.mjs';
-import { networkError } from '../error/ClientAuthErrorCodes.mjs';
+import { keyIdMissing, networkError } from '../error/ClientAuthErrorCodes.mjs';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41,6 +42,23 @@ function createTokenRequestHeaders(logger, preventCorsPreflight, ccsCred) {
     }
     return headers;
 }
+/**
+ * Adds the DPoP proof header for token endpoint requests when DPoP is requested.
+ * @internal
+ */
+async function addDpopTokenProofHeader(headers, request, tokenEndpoint, cryptoUtils, tokenBindingKeyManager) {
+    if (request.authenticationScheme !== AuthenticationScheme.DPOP) {
+        return;
+    }
+    const dpopProofGenerator = new DpopProofGenerator(cryptoUtils, tokenBindingKeyManager);
+    const keyId = request.dpopJkt;
+    if (!keyId?.trim()) {
+        throw createClientAuthError(keyIdMissing, request.correlationId);
+    }
+    headers[HeaderNames.DPOP] = await dpopProofGenerator.generateTokenProof({
+        tokenEndpoint,
+    }, keyId, request.correlationId);
+}
 /**
  * Creates query string for the /token request
  * @param request
@@ -127,5 +145,5 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-export { createTokenQueryParameters, createTokenRequestHeaders, executePostToTokenEndpoint, sendPostRequest };
+export { addDpopTokenProofHeader, createTokenQueryParameters, createTokenRequestHeaders, executePostToTokenEndpoint, sendPostRequest };
 //# sourceMappingURL=Token.mjs.map

package/dist-browser/protocol/Token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Token.mjs","sources":["../../src/protocol/Token.ts"],"sourcesContent":[null],"names":["RequestParameterBuilder.addBrokerParameters","RequestParameterBuilder.addExtraParameters","RequestParameterBuilder.addCorrelationId","RequestParameterBuilder.instrumentBrokerParams","UrlUtils.mapToQueryString","PerformanceEvents.NetworkClientSendPostRequestAsync","ClientAuthErrorCodes.networkError"],"mappings":";;;;;;;;;;;;;;;AAAA;;;AAGG;AA6BH;;AAEG;SACa,yBAAyB,CACrC,MAAc,EACd,oBAA6B,EAC7B,OAAuB,EAAA;IAEvB,MAAM,OAAO,GAA2B,EAAE,CAAC;AAC3C,IAAA,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,qBAAqB,CAAC;AAC1D,IAAA,IAAI,CAAC,oBAAoB,IAAI,OAAO,EAAE;QAClC,QAAQ,OAAO,CAAC,IAAI;YAChB,KAAK,iBAAiB,CAAC,eAAe;gBAClC,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,UAAU,CACrB,CAAC;AACF,oBAAA,OAAO,CACH,WAAW,CAAC,UAAU,CACzB,GAAG,CAAA,IAAA,EAAO,UAAU,CAAC,GAAG,CAAA,CAAA,EAAI,UAAU,CAAC,IAAI,EAAE,CAAC;AAClD,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,CAAA,OAAA,EAAA,CAAA,CAAA,CAAA,EAAA,EAAA,CAAA,CAAA;AAGP,gBAAA,CAAA;gBACD,MAAM;YACV,KAAK,iBAAiB,CAAC,GAAG;gBACtB,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAA,KAAA,EAAQ,OAAO,CAAC,UAAU,CAAA,CAAE,CAAC;gBAC/D,MAAM;AACb,SAAA;AACJ,IAAA,CAAA;AACD,IAAA,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;AAGG;AACG,SAAU,0BAA0B,CACtC,OAAwB,EACxB,QAAgB,EAChB,WAAmB,EACnB,iBAAqC,EAAA;AAErC,IAAA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,IAAI,OAAO,CAAC,gBAAgB,EAAE;QAC1BA,mBAA2C,CACvC,UAAU,EACV,QAAQ,EACR,WAAW,CACd,CAAC;AACL,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,oBAAoB,EAAE;QAC9BC,kBAA0C,CACtC,UAAU,EACV,OAAO,CAAC,oBAAoB,CAC/B,CAAC;AACL,IAAA,CAAA;IAEDC,gBAAwC,CAAC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAE5EC,sBAA8C,CAC1C,UAAU,EACV,OAAO,CAAC,aAAa,EACrB,iBAAiB,CACpB,CAAC;AACF,IAAA,OAAOC,gBAAyB,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;AAOG;AACI,eAAe,0BAA0B,CAC5C,aAAqB,EACrB,WAAmB,EACnB,OAA+B,EAC/B,UAA6B,EAC7B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EACrC,sBAAqD,EAAA;AAErD,IAAA,MAAM,QAAQ,GAAG,MAAM,eAAe,CAClC,UAAU,EACV,aAAa,EACb,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,aAAa,EACb,YAAY,EACZ,aAAa,EACb,MAAM,EACN,iBAAiB,CACpB,CAAC;AAEF,IAAA,IACI,sBAAsB;QACtB,QAAQ,CAAC,MAAM,GAAG,GAAG;AACrB,QAAA,QAAQ,CAAC,MAAM,KAAK,GAAG,EACzB;;QAEE,sBAAsB,CAAC,mBAAmB,EAAE,CAAC;AAChD,IAAA,CAAA;AAED,IAAA,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;AAWG;AACI,eAAe,eAAe,CAGjC,UAA6B,EAC7B,aAAqB,EACrB,OAA8B,EAC9B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EAAA;IAErC,eAAe,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpE,IAAA,IAAI,QAAQ,CAAC;IACb,IAAI;AACA,QAAA,QAAQ,GAAG,MAAM,WAAW,EACxB,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAI,GACzDC,iCAAmD,EACnD,MAAM,EACN,iBAAiB,EACjB,aAAa,CAChB,CAAC,aAAa,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACnE,QAAA,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/C,iBAAiB,EAAE,SAAS,CACxB;YACI,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;YAC1D,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACxD,SAAS,EAAE,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;SAChE,EACD,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,YAAY,YAAY,EAAE;AAC3B,YAAA,MAAM,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;AAC1C,YAAA,IAAI,eAAe,EAAE;gBACjB,iBAAiB,EAAE,SAAS,CACxB;AACI,oBAAA,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;wBAC9C,EAAE;oBACN,SAAS,EACL,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;AACtD,oBAAA,iBAAiB,EACb,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC;wBACzC,SAAS;AACb,oBAAA,mBAAmB,EACf,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC;wBAC3C,SAAS;oBACb,UAAU,EAAE,CAAC,CAAC,UAAU;iBAC3B,EACD,aAAa,CAChB,CAAC;AACL,YAAA,CAAA;YACD,MAAM,CAAC,CAAC,KAAK,CAAC;AACjB,QAAA,CAAA;QACD,IAAI,CAAC,YAAY,SAAS,EAAE;AACxB,YAAA,MAAM,CAAC,CAAC;AACX,QAAA,CAAA;AAAM,aAAA;YACH,MAAM,qBAAqB,CACvBC,YAAiC,EACjC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACJ,IAAA,CAAA;IAED,eAAe,CAAC,WAAW,CACvB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,CAChB,CAAC;AAEF,IAAA,OAAO,QAAQ,CAAC;AACpB;;;;"}
+{"version":3,"file":"Token.mjs","sources":["../../src/protocol/Token.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.keyIdMissing","RequestParameterBuilder.addBrokerParameters","RequestParameterBuilder.addExtraParameters","RequestParameterBuilder.addCorrelationId","RequestParameterBuilder.instrumentBrokerParams","UrlUtils.mapToQueryString","PerformanceEvents.NetworkClientSendPostRequestAsync","ClientAuthErrorCodes.networkError"],"mappings":";;;;;;;;;;;;;;;;AAAA;;;AAGG;AAoCH;;AAEG;SACa,yBAAyB,CACrC,MAAc,EACd,oBAA6B,EAC7B,OAAuB,EAAA;IAEvB,MAAM,OAAO,GAA2B,EAAE,CAAC;AAC3C,IAAA,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,qBAAqB,CAAC;AAC1D,IAAA,IAAI,CAAC,oBAAoB,IAAI,OAAO,EAAE;QAClC,QAAQ,OAAO,CAAC,IAAI;YAChB,KAAK,iBAAiB,CAAC,eAAe;gBAClC,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,UAAU,CACrB,CAAC;AACF,oBAAA,OAAO,CACH,WAAW,CAAC,UAAU,CACzB,GAAG,CAAA,IAAA,EAAO,UAAU,CAAC,GAAG,CAAA,CAAA,EAAI,UAAU,CAAC,IAAI,EAAE,CAAC;AAClD,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,CAAA,OAAA,EAAA,CAAA,CAAA,CAAA,EAAA,EAAA,CAAA,CAAA;AAGP,gBAAA,CAAA;gBACD,MAAM;YACV,KAAK,iBAAiB,CAAC,GAAG;gBACtB,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAA,KAAA,EAAQ,OAAO,CAAC,UAAU,CAAA,CAAE,CAAC;gBAC/D,MAAM;AACb,SAAA;AACJ,IAAA,CAAA;AACD,IAAA,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;AAGG;AACI,eAAe,uBAAuB,CACzC,OAA+B,EAC/B,OAAwB,EACxB,aAAqB,EACrB,WAAoB,EACpB,sBAA+C,EAAA;AAE/C,IAAA,IAAI,OAAO,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,IAAI,EAAE;QAC5D,OAAO;AACV,IAAA,CAAA;IAED,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAC7C,WAAW,EACX,sBAAsB,CACzB,CAAC;AACF,IAAA,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;AAC9B,IAAA,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAChB,MAAM,qBAAqB,CACvBA,YAAiC,EACjC,OAAO,CAAC,aAAa,CACxB,CAAC;AACL,IAAA,CAAA;IAED,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,kBAAkB,CAAC,kBAAkB,CACnE;QACI,aAAa;AAChB,KAAA,EACD,KAAK,EACL,OAAO,CAAC,aAAa,CACxB,CAAC;AACN,CAAC;AAED;;;AAGG;AACG,SAAU,0BAA0B,CACtC,OAAwB,EACxB,QAAgB,EAChB,WAAmB,EACnB,iBAAqC,EAAA;AAErC,IAAA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,IAAI,OAAO,CAAC,gBAAgB,EAAE;QAC1BC,mBAA2C,CACvC,UAAU,EACV,QAAQ,EACR,WAAW,CACd,CAAC;AACL,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,oBAAoB,EAAE;QAC9BC,kBAA0C,CACtC,UAAU,EACV,OAAO,CAAC,oBAAoB,CAC/B,CAAC;AACL,IAAA,CAAA;IAEDC,gBAAwC,CAAC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAE5EC,sBAA8C,CAC1C,UAAU,EACV,OAAO,CAAC,aAAa,EACrB,iBAAiB,CACpB,CAAC;AACF,IAAA,OAAOC,gBAAyB,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;AAOG;AACI,eAAe,0BAA0B,CAC5C,aAAqB,EACrB,WAAmB,EACnB,OAA+B,EAC/B,UAA6B,EAC7B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EACrC,sBAAqD,EAAA;AAErD,IAAA,MAAM,QAAQ,GAAG,MAAM,eAAe,CAClC,UAAU,EACV,aAAa,EACb,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,aAAa,EACb,YAAY,EACZ,aAAa,EACb,MAAM,EACN,iBAAiB,CACpB,CAAC;AAEF,IAAA,IACI,sBAAsB;QACtB,QAAQ,CAAC,MAAM,GAAG,GAAG;AACrB,QAAA,QAAQ,CAAC,MAAM,KAAK,GAAG,EACzB;;QAEE,sBAAsB,CAAC,mBAAmB,EAAE,CAAC;AAChD,IAAA,CAAA;AAED,IAAA,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;AAWG;AACI,eAAe,eAAe,CAGjC,UAA6B,EAC7B,aAAqB,EACrB,OAA8B,EAC9B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EAAA;IAErC,eAAe,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpE,IAAA,IAAI,QAAQ,CAAC;IACb,IAAI;AACA,QAAA,QAAQ,GAAG,MAAM,WAAW,EACxB,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAI,GACzDC,iCAAmD,EACnD,MAAM,EACN,iBAAiB,EACjB,aAAa,CAChB,CAAC,aAAa,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACnE,QAAA,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/C,iBAAiB,EAAE,SAAS,CACxB;YACI,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;YAC1D,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACxD,SAAS,EAAE,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;SAChE,EACD,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,YAAY,YAAY,EAAE;AAC3B,YAAA,MAAM,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;AAC1C,YAAA,IAAI,eAAe,EAAE;gBACjB,iBAAiB,EAAE,SAAS,CACxB;AACI,oBAAA,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;wBAC9C,EAAE;oBACN,SAAS,EACL,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;AACtD,oBAAA,iBAAiB,EACb,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC;wBACzC,SAAS;AACb,oBAAA,mBAAmB,EACf,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC;wBAC3C,SAAS;oBACb,UAAU,EAAE,CAAC,CAAC,UAAU;iBAC3B,EACD,aAAa,CAChB,CAAC;AACL,YAAA,CAAA;YACD,MAAM,CAAC,CAAC,KAAK,CAAC;AACjB,QAAA,CAAA;QACD,IAAI,CAAC,YAAY,SAAS,EAAE;AACxB,YAAA,MAAM,CAAC,CAAC;AACX,QAAA,CAAA;AAAM,aAAA;YACH,MAAM,qBAAqB,CACvBC,YAAiC,EACjC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACJ,IAAA,CAAA;IAED,eAAe,CAAC,WAAW,CACvB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,CAChB,CAAC;AAEF,IAAA,OAAO,QAAQ,CAAC;AACpB;;;;"}

package/dist-browser/request/AuthenticationHeaderParser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { HeaderNames } from '../utils/Constants.mjs';

package/dist-browser/request/BaseAuthRequest.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/request/BaseAuthRequest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"BaseAuthRequest.mjs","sources":["../../src/request/BaseAuthRequest.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.misplacedResourceParam","ClientAuthErrorCodes.resourceParameterRequired"],"mappings":";;;;;AAAA;;;AAGG;AAoHH;;;;;;AAMG;AACG,SAAU,wBAAwB,CACpC,KAAc,EACd,OAAiC,EAAA;IAEjC,IAAI,CAAC,KAAK,EAAE;QACR,OAAO;AACV,IAAA,CAAA;IAED,IACI,OAAO,CAAC,QAAQ;AAChB,SAAC,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;AAC3C,YAAA,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,EAC1D;AACE,QAAA,MAAM,qBAAqB,CACvBA,sBAA2C,EAC3C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;AACnB,QAAA,MAAM,qBAAqB,CACvBC,yBAA8C,EAC9C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB,EAAA;IAC9C,IAAI,CAAC,MAAM,EAAE;AACT,QAAA,OAAO,KAAK,CAAC;AAChB,IAAA,CAAA;AAED,IAAA,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACpE;;;;"}
+{"version":3,"file":"BaseAuthRequest.mjs","sources":["../../src/request/BaseAuthRequest.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.misplacedResourceParam","ClientAuthErrorCodes.resourceParameterRequired"],"mappings":";;;;;AAAA;;;AAGG;AAyHH;;;;;;AAMG;AACG,SAAU,wBAAwB,CACpC,KAAc,EACd,OAAiC,EAAA;IAEjC,IAAI,CAAC,KAAK,EAAE;QACR,OAAO;AACV,IAAA,CAAA;IAED,IACI,OAAO,CAAC,QAAQ;AAChB,SAAC,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;AAC3C,YAAA,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,EAC1D;AACE,QAAA,MAAM,qBAAqB,CACvBA,sBAA2C,EAC3C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;AACnB,QAAA,MAAM,qBAAqB,CACvBC,yBAA8C,EAC9C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB,EAAA;IAC9C,IAAI,CAAC,MAAM,EAAE;AACT,QAAA,OAAO,KAAK,CAAC;AAChB,IAAA,CAAA;AAED,IAAA,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACpE;;;;"}

package/dist-browser/request/RequestParameterBuilder.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 import { OIDC_DEFAULT_SCOPES, HeaderNames, CLIENT_INFO, PasswordGrantConstants, AuthenticationScheme, ResponseMode, X_MS_LIB_CAPABILITY_VALUE, ClaimsRequestKeys } from '../utils/Constants.mjs';
 import { X_APP_NAME, X_APP_VER, ATTRIBUTE_TOKENS, CODE, BROKER_CLIENT_ID, BROKER_REDIRECT_URI, CLAIMS, CLI_DATA, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, CLIENT_ID, CLIENT_SECRET, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE_VERIFIER, CLIENT_REQUEST_ID, DEVICE_CODE, DOMAIN_HINT, EAR_JWK, EAR_JWE_CRYPTO, GRANT_TYPE, ID_TOKEN_HINT, INSTANCE_AWARE, X_CLIENT_SKU, X_CLIENT_VER, X_CLIENT_OS, X_CLIENT_CPU, LOGIN_HINT, LOGOUT_HINT, NATIVE_BROKER, NONCE, OBO_ASSERTION, TOKEN_TYPE, REQ_CNF, POST_LOGOUT_URI, PROMPT, REDIRECT_URI, REFRESH_TOKEN, REQUESTED_TOKEN_USE, RESOURCE, RESPONSE_MODE, RESPONSE_TYPE, SCOPE, X_CLIENT_CURR_TELEM, X_CLIENT_LAST_TELEM, SID, STATE, X_MS_LIB_CAPABILITY } from '../constants/AADServerParamKeys.mjs';
@@ -320,11 +320,15 @@ function addExtraParameters(parameters, extraParams) {
 }
 /**
  * Default optional idToken claims requested on all auth requests.
- * signin_state enables KMSI detection; login_hint enables login hint propagation.
+ * signin_state enables KMSI detection; login_hint enables login hint propagation;
+ * tenant_region_sub_scope identifies the sovereign enclave a tenant belongs to.
  */
 const DEFAULT_ID_TOKEN_CLAIMS = {
     [ClaimsRequestKeys.SIGNIN_STATE]: { essential: false },
     [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
+    [ClaimsRequestKeys.TENANT_REGION_SUB_SCOPE]: {
+        essential: false,
+    },
 };
 /**
  * Parses a claims JSON string into an object, throwing a ClientConfigurationError
@@ -383,8 +387,8 @@ function deepMergeClaims(baseClaims, claimsToMerge) {
 /**
  * Parses claims JSON, optionally deep-merges a second client-originated claims string
  * (`claimsToMerge`, e.g. `claimsFromClient`) with precedence on conflicting keys, merges
- * default optional idToken claims (signin_state, login_hint), and appends client
- * capabilities (xms_cc) to the access_token section.
+ * default optional idToken claims (signin_state, login_hint, tenant_region_sub_scope), and appends client
+ * capabilities (xms_cc) to the access_token section
  * Does not overwrite idToken claims already specified by the caller.
  * @param claims - Existing claims JSON string from the request (may be undefined)
  * @param clientCapabilities - Client capabilities array from configuration