@azure/msal-common 16.13.0 → 16.14.1

package/dist/error/CacheErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/ClientAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/ClientAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28,6 +28,7 @@ const invalidCacheEnvironment = "invalid_cache_environment";
 const noAccountFound = "no_account_found";
 const noCryptoObject = "no_crypto_object";
 const unexpectedCredentialType = "unexpected_credential_type";
+const dpopTokenTypeMismatch = "dpop_token_type_mismatch";
 const tokenRefreshRequired = "token_refresh_required";
 const tokenClaimsCnfRequiredForSignedJwt = "token_claims_cnf_required_for_signedjwt";
 const authorizationCodeMissingFromServerResponse = "authorization_code_missing_from_server_response";
@@ -42,5 +43,5 @@ const platformBrokerError = "platform_broker_error";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
 
-export { authorizationCodeMissingFromServerResponse, bindingKeyNotRemoved, cannotAppendScopeSet, cannotRemoveEmptyScope, clientInfoDecodingError, clientInfoEmptyError, emptyInputScopeSet, endSessionEndpointNotSupported, endpointResolutionError, hashNotDeserialized, invalidCacheEnvironment, invalidCacheRecord, invalidState, keyIdMissing, methodNotImplemented, misplacedResourceParam, multipleMatchingAppMetadata, multipleMatchingTokens, nestedAppAuthBridgeDisabled, networkError, noAccountFound, noAccountInSilentRequest, noCryptoObject, noNetworkConnectivity, nonceMismatch, nullOrEmptyToken, openIdConfigError, platformBrokerError, requestCannotBeMade, resourceParameterRequired, stateMismatch, stateNotFound, tokenClaimsCnfRequiredForSignedJwt, tokenParsingError, tokenRefreshRequired, unexpectedCredentialType, userCanceled };
+export { authorizationCodeMissingFromServerResponse, bindingKeyNotRemoved, cannotAppendScopeSet, cannotRemoveEmptyScope, clientInfoDecodingError, clientInfoEmptyError, dpopTokenTypeMismatch, emptyInputScopeSet, endSessionEndpointNotSupported, endpointResolutionError, hashNotDeserialized, invalidCacheEnvironment, invalidCacheRecord, invalidState, keyIdMissing, methodNotImplemented, misplacedResourceParam, multipleMatchingAppMetadata, multipleMatchingTokens, nestedAppAuthBridgeDisabled, networkError, noAccountFound, noAccountInSilentRequest, noCryptoObject, noNetworkConnectivity, nonceMismatch, nullOrEmptyToken, openIdConfigError, platformBrokerError, requestCannotBeMade, resourceParameterRequired, stateMismatch, stateNotFound, tokenClaimsCnfRequiredForSignedJwt, tokenParsingError, tokenRefreshRequired, unexpectedCredentialType, userCanceled };
 //# sourceMappingURL=ClientAuthErrorCodes.mjs.map

package/dist/error/ClientAuthErrorCodes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClientAuthErrorCodes.mjs","sources":["../../src/error/ClientAuthErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,gBAAgB,GAAG,sBAAsB;AAC/C,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,mBAAmB,GAAG,yBAAyB;AACrD,MAAM,sBAAsB,GAAG,4BAA4B;AAC3D,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,wBAAwB,GAAG,+BAA+B;AAChE,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,uBAAuB,GAAG,4BAA4B;AAC5D,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kCAAkC,GAC3C,0CAA0C;AACvC,MAAM,0CAA0C,GACnD,kDAAkD;AAC/C,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,8BAA8B,GACvC,qCAAqC;AAClC,MAAM,YAAY,GAAG,iBAAiB;AACtC,MAAM,qBAAqB,GAAG,0BAA0B;AACxD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,2BAA2B,GAAG,kCAAkC;AACtE,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,yBAAyB,GAAG,8BAA8B;AAChE,MAAM,sBAAsB,GAAG;;;;"}
+{"version":3,"file":"ClientAuthErrorCodes.mjs","sources":["../../src/error/ClientAuthErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,gBAAgB,GAAG,sBAAsB;AAC/C,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,mBAAmB,GAAG,yBAAyB;AACrD,MAAM,sBAAsB,GAAG,4BAA4B;AAC3D,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,wBAAwB,GAAG,+BAA+B;AAChE,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,uBAAuB,GAAG,4BAA4B;AAC5D,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kCAAkC,GAC3C,0CAA0C;AACvC,MAAM,0CAA0C,GACnD,kDAAkD;AAC/C,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,8BAA8B,GACvC,qCAAqC;AAClC,MAAM,YAAY,GAAG,iBAAiB;AACtC,MAAM,qBAAqB,GAAG,0BAA0B;AACxD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,2BAA2B,GAAG,kCAAkC;AACtE,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,yBAAyB,GAAG,8BAA8B;AAChE,MAAM,sBAAsB,GAAG;;;;"}

package/dist/error/ClientConfigurationError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/ClientConfigurationErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31,7 +31,9 @@ const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuratio
 const issuerValidationFailed = "issuer_validation_failed";
 const invalidResponseMode = "invalid_response_mode";
 const invalidDpopHtm = "invalid_dpop_htm";
-const invalidDpopHtu = "invalid_dpop_htu";
+const invalidDpopHtu = "invalid_dpop_htu";
+const invalidDpopNonce = "invalid_dpop_nonce";
+const dpopMissingResourceContext = "dpop_missing_resource_context";
 
-export { authorityMismatch, authorityUriInsecure, cannotAllowPlatformBroker, cannotSetOIDCOptions, claimsRequestParsingError, emptyInputScopesError, invalidAuthenticationHeader, invalidAuthorityMetadata, invalidClaims, invalidCloudDiscoveryMetadata, invalidCodeChallengeMethod, invalidDpopHtm, invalidDpopHtu, invalidPlatformBrokerConfiguration, invalidRequestMethodForEAR, invalidResponseMode, issuerValidationFailed, logoutRequestEmpty, missingNonceAuthenticationHeader, missingSshJwk, missingSshKid, pkceParamsMissing, redirectUriEmpty, tokenRequestEmpty, unsupportedAuthenticationScheme, untrustedAuthority, urlEmptyError, urlParseError };
+export { authorityMismatch, authorityUriInsecure, cannotAllowPlatformBroker, cannotSetOIDCOptions, claimsRequestParsingError, dpopMissingResourceContext, emptyInputScopesError, invalidAuthenticationHeader, invalidAuthorityMetadata, invalidClaims, invalidCloudDiscoveryMetadata, invalidCodeChallengeMethod, invalidDpopHtm, invalidDpopHtu, invalidDpopNonce, invalidPlatformBrokerConfiguration, invalidRequestMethodForEAR, invalidResponseMode, issuerValidationFailed, logoutRequestEmpty, missingNonceAuthenticationHeader, missingSshJwk, missingSshKid, pkceParamsMissing, redirectUriEmpty, tokenRequestEmpty, unsupportedAuthenticationScheme, untrustedAuthority, urlEmptyError, urlParseError };
 //# sourceMappingURL=ClientConfigurationErrorCodes.mjs.map

package/dist/error/ClientConfigurationErrorCodes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClientConfigurationErrorCodes.mjs","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,0BAA0B,GAAG,gCAAgC;AACnE,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,6BAA6B,GAAG,mCAAmC;AACzE,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB;AACjD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,+BAA+B,GACxC,oCAAoC;AACjC,MAAM,gCAAgC,GACzC,sCAAsC;AACnC,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,iBAAiB,GAAG,qBAAqB;AAC/C,MAAM,0BAA0B,GAAG,iCAAiC;AACpE,MAAM,kCAAkC,GAC3C,wCAAwC;AACrC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG;;;;"}
+{"version":3,"file":"ClientConfigurationErrorCodes.mjs","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,0BAA0B,GAAG,gCAAgC;AACnE,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,6BAA6B,GAAG,mCAAmC;AACzE,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB;AACjD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,+BAA+B,GACxC,oCAAoC;AACjC,MAAM,gCAAgC,GACzC,sCAAsC;AACnC,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,iBAAiB,GAAG,qBAAqB;AAC/C,MAAM,0BAA0B,GAAG,iCAAiC;AACpE,MAAM,kCAAkC,GAC3C,wCAAwC;AACrC,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,0BAA0B,GAAG;;;;"}

package/dist/error/InteractionRequiredAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 import { interactionRequired, consentRequired, loginRequired, badToken, uiNotAllowed, interruptedUser } from './InteractionRequiredAuthErrorCodes.mjs';

package/dist/error/InteractionRequiredAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/JoseHeaderError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/JoseHeaderErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/NetworkError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/PlatformBrokerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/ServerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/index-node.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };

package/dist/logger/Logger.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/network/INetworkModule.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist/network/RequestThumbprint.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { serializeAttributeTokens } from '../cache/utils/CacheHelpers.mjs';
 

package/dist/network/ThrottlingUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { THROTTLING_PREFIX, HeaderNames, DEFAULT_THROTTLE_TIME_SECONDS, DEFAULT_MAX_THROTTLE_TIME_SECONDS } from '../utils/Constants.mjs';
 import { ServerError } from '../error/ServerError.mjs';

package/dist/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.13.0";
+const version = "16.14.1";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
 import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';

package/dist/protocol/Token.mjs

@@ -1,8 +1,9 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { CcsCredentialType } from '../account/CcsCredential.mjs';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';
-import { URL_FORM_CONTENT_TYPE, HeaderNames } from '../utils/Constants.mjs';
+import { DpopProofGenerator } from '../crypto/DpopProofGenerator.mjs';
+import { AuthenticationScheme, HeaderNames, URL_FORM_CONTENT_TYPE } from '../utils/Constants.mjs';
 import { addBrokerParameters, addExtraParameters, addCorrelationId, instrumentBrokerParams } from '../request/RequestParameterBuilder.mjs';
 import { mapToQueryString } from '../utils/UrlUtils.mjs';
 import { ThrottlingUtils } from '../network/ThrottlingUtils.mjs';
@@ -11,7 +12,7 @@ import { AuthError } from '../error/AuthError.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { invokeAsync } from '../utils/FunctionWrappers.mjs';
 import { NetworkClientSendPostRequestAsync } from '../telemetry/performance/PerformanceEvents.mjs';
-import { networkError } from '../error/ClientAuthErrorCodes.mjs';
+import { keyIdMissing, networkError } from '../error/ClientAuthErrorCodes.mjs';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41,6 +42,23 @@ function createTokenRequestHeaders(logger, preventCorsPreflight, ccsCred) {
     }
     return headers;
 }
+/**
+ * Adds the DPoP proof header for token endpoint requests when DPoP is requested.
+ * @internal
+ */
+async function addDpopTokenProofHeader(headers, request, tokenEndpoint, cryptoUtils, tokenBindingKeyManager) {
+    if (request.authenticationScheme !== AuthenticationScheme.DPOP) {
+        return;
+    }
+    const dpopProofGenerator = new DpopProofGenerator(cryptoUtils, tokenBindingKeyManager);
+    const keyId = request.dpopJkt;
+    if (!keyId?.trim()) {
+        throw createClientAuthError(keyIdMissing, request.correlationId);
+    }
+    headers[HeaderNames.DPOP] = await dpopProofGenerator.generateTokenProof({
+        tokenEndpoint,
+    }, keyId, request.correlationId);
+}
 /**
  * Creates query string for the /token request
  * @param request
@@ -127,5 +145,5 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-export { createTokenQueryParameters, createTokenRequestHeaders, executePostToTokenEndpoint, sendPostRequest };
+export { addDpopTokenProofHeader, createTokenQueryParameters, createTokenRequestHeaders, executePostToTokenEndpoint, sendPostRequest };
 //# sourceMappingURL=Token.mjs.map

package/dist/protocol/Token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Token.mjs","sources":["../../src/protocol/Token.ts"],"sourcesContent":[null],"names":["RequestParameterBuilder.addBrokerParameters","RequestParameterBuilder.addExtraParameters","RequestParameterBuilder.addCorrelationId","RequestParameterBuilder.instrumentBrokerParams","UrlUtils.mapToQueryString","PerformanceEvents.NetworkClientSendPostRequestAsync","ClientAuthErrorCodes.networkError"],"mappings":";;;;;;;;;;;;;;;AAAA;;;AAGG;AA6BH;;AAEG;SACa,yBAAyB,CACrC,MAAc,EACd,oBAA6B,EAC7B,OAAuB,EAAA;IAEvB,MAAM,OAAO,GAA2B,EAAE,CAAC;AAC3C,IAAA,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,qBAAqB,CAAC;AAC1D,IAAA,IAAI,CAAC,oBAAoB,IAAI,OAAO,EAAE;QAClC,QAAQ,OAAO,CAAC,IAAI;YAChB,KAAK,iBAAiB,CAAC,eAAe;gBAClC,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,UAAU,CACrB,CAAC;AACF,oBAAA,OAAO,CACH,WAAW,CAAC,UAAU,CACzB,GAAG,CAAA,IAAA,EAAO,UAAU,CAAC,GAAG,CAAA,CAAA,EAAI,UAAU,CAAC,IAAI,EAAE,CAAC;AAClD,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,CAAA,iDAAA,EAAoD,CAAC,CAAA,CAAA,CAAG,EACxD,EAAE,CACL,CAAC;AACL,gBAAA,CAAA;gBACD,MAAM;YACV,KAAK,iBAAiB,CAAC,GAAG;gBACtB,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAA,KAAA,EAAQ,OAAO,CAAC,UAAU,CAAA,CAAE,CAAC;gBAC/D,MAAM;AACb,SAAA;AACJ,IAAA,CAAA;AACD,IAAA,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;AAGG;AACG,SAAU,0BAA0B,CACtC,OAAwB,EACxB,QAAgB,EAChB,WAAmB,EACnB,iBAAqC,EAAA;AAErC,IAAA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,IAAI,OAAO,CAAC,gBAAgB,EAAE;QAC1BA,mBAA2C,CACvC,UAAU,EACV,QAAQ,EACR,WAAW,CACd,CAAC;AACL,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,oBAAoB,EAAE;QAC9BC,kBAA0C,CACtC,UAAU,EACV,OAAO,CAAC,oBAAoB,CAC/B,CAAC;AACL,IAAA,CAAA;IAEDC,gBAAwC,CAAC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAE5EC,sBAA8C,CAC1C,UAAU,EACV,OAAO,CAAC,aAAa,EACrB,iBAAiB,CACpB,CAAC;AACF,IAAA,OAAOC,gBAAyB,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;AAOG;AACI,eAAe,0BAA0B,CAC5C,aAAqB,EACrB,WAAmB,EACnB,OAA+B,EAC/B,UAA6B,EAC7B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EACrC,sBAAqD,EAAA;AAErD,IAAA,MAAM,QAAQ,GAAG,MAAM,eAAe,CAClC,UAAU,EACV,aAAa,EACb,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,aAAa,EACb,YAAY,EACZ,aAAa,EACb,MAAM,EACN,iBAAiB,CACpB,CAAC;AAEF,IAAA,IACI,sBAAsB;QACtB,QAAQ,CAAC,MAAM,GAAG,GAAG;AACrB,QAAA,QAAQ,CAAC,MAAM,KAAK,GAAG,EACzB;;QAEE,sBAAsB,CAAC,mBAAmB,EAAE,CAAC;AAChD,IAAA,CAAA;AAED,IAAA,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;AAWG;AACI,eAAe,eAAe,CAGjC,UAA6B,EAC7B,aAAqB,EACrB,OAA8B,EAC9B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EAAA;IAErC,eAAe,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpE,IAAA,IAAI,QAAQ,CAAC;IACb,IAAI;AACA,QAAA,QAAQ,GAAG,MAAM,WAAW,EACxB,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAI,GACzDC,iCAAmD,EACnD,MAAM,EACN,iBAAiB,EACjB,aAAa,CAChB,CAAC,aAAa,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACnE,QAAA,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/C,iBAAiB,EAAE,SAAS,CACxB;YACI,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;YAC1D,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACxD,SAAS,EAAE,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;SAChE,EACD,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,YAAY,YAAY,EAAE;AAC3B,YAAA,MAAM,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;AAC1C,YAAA,IAAI,eAAe,EAAE;gBACjB,iBAAiB,EAAE,SAAS,CACxB;AACI,oBAAA,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;wBAC9C,EAAE;oBACN,SAAS,EACL,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;AACtD,oBAAA,iBAAiB,EACb,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC;wBACzC,SAAS;AACb,oBAAA,mBAAmB,EACf,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC;wBAC3C,SAAS;oBACb,UAAU,EAAE,CAAC,CAAC,UAAU;iBAC3B,EACD,aAAa,CAChB,CAAC;AACL,YAAA,CAAA;YACD,MAAM,CAAC,CAAC,KAAK,CAAC;AACjB,QAAA,CAAA;QACD,IAAI,CAAC,YAAY,SAAS,EAAE;AACxB,YAAA,MAAM,CAAC,CAAC;AACX,QAAA,CAAA;AAAM,aAAA;YACH,MAAM,qBAAqB,CACvBC,YAAiC,EACjC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACJ,IAAA,CAAA;IAED,eAAe,CAAC,WAAW,CACvB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,CAChB,CAAC;AAEF,IAAA,OAAO,QAAQ,CAAC;AACpB;;;;"}
+{"version":3,"file":"Token.mjs","sources":["../../src/protocol/Token.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.keyIdMissing","RequestParameterBuilder.addBrokerParameters","RequestParameterBuilder.addExtraParameters","RequestParameterBuilder.addCorrelationId","RequestParameterBuilder.instrumentBrokerParams","UrlUtils.mapToQueryString","PerformanceEvents.NetworkClientSendPostRequestAsync","ClientAuthErrorCodes.networkError"],"mappings":";;;;;;;;;;;;;;;;AAAA;;;AAGG;AAoCH;;AAEG;SACa,yBAAyB,CACrC,MAAc,EACd,oBAA6B,EAC7B,OAAuB,EAAA;IAEvB,MAAM,OAAO,GAA2B,EAAE,CAAC;AAC3C,IAAA,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,qBAAqB,CAAC;AAC1D,IAAA,IAAI,CAAC,oBAAoB,IAAI,OAAO,EAAE;QAClC,QAAQ,OAAO,CAAC,IAAI;YAChB,KAAK,iBAAiB,CAAC,eAAe;gBAClC,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,UAAU,CACrB,CAAC;AACF,oBAAA,OAAO,CACH,WAAW,CAAC,UAAU,CACzB,GAAG,CAAA,IAAA,EAAO,UAAU,CAAC,GAAG,CAAA,CAAA,EAAI,UAAU,CAAC,IAAI,EAAE,CAAC;AAClD,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,CAAA,iDAAA,EAAoD,CAAC,CAAA,CAAA,CAAG,EACxD,EAAE,CACL,CAAC;AACL,gBAAA,CAAA;gBACD,MAAM;YACV,KAAK,iBAAiB,CAAC,GAAG;gBACtB,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAA,KAAA,EAAQ,OAAO,CAAC,UAAU,CAAA,CAAE,CAAC;gBAC/D,MAAM;AACb,SAAA;AACJ,IAAA,CAAA;AACD,IAAA,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;AAGG;AACI,eAAe,uBAAuB,CACzC,OAA+B,EAC/B,OAAwB,EACxB,aAAqB,EACrB,WAAoB,EACpB,sBAA+C,EAAA;AAE/C,IAAA,IAAI,OAAO,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,IAAI,EAAE;QAC5D,OAAO;AACV,IAAA,CAAA;IAED,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAC7C,WAAW,EACX,sBAAsB,CACzB,CAAC;AACF,IAAA,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;AAC9B,IAAA,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAChB,MAAM,qBAAqB,CACvBA,YAAiC,EACjC,OAAO,CAAC,aAAa,CACxB,CAAC;AACL,IAAA,CAAA;IAED,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,kBAAkB,CAAC,kBAAkB,CACnE;QACI,aAAa;AAChB,KAAA,EACD,KAAK,EACL,OAAO,CAAC,aAAa,CACxB,CAAC;AACN,CAAC;AAED;;;AAGG;AACG,SAAU,0BAA0B,CACtC,OAAwB,EACxB,QAAgB,EAChB,WAAmB,EACnB,iBAAqC,EAAA;AAErC,IAAA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,IAAI,OAAO,CAAC,gBAAgB,EAAE;QAC1BC,mBAA2C,CACvC,UAAU,EACV,QAAQ,EACR,WAAW,CACd,CAAC;AACL,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,oBAAoB,EAAE;QAC9BC,kBAA0C,CACtC,UAAU,EACV,OAAO,CAAC,oBAAoB,CAC/B,CAAC;AACL,IAAA,CAAA;IAEDC,gBAAwC,CAAC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAE5EC,sBAA8C,CAC1C,UAAU,EACV,OAAO,CAAC,aAAa,EACrB,iBAAiB,CACpB,CAAC;AACF,IAAA,OAAOC,gBAAyB,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;AAOG;AACI,eAAe,0BAA0B,CAC5C,aAAqB,EACrB,WAAmB,EACnB,OAA+B,EAC/B,UAA6B,EAC7B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EACrC,sBAAqD,EAAA;AAErD,IAAA,MAAM,QAAQ,GAAG,MAAM,eAAe,CAClC,UAAU,EACV,aAAa,EACb,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,aAAa,EACb,YAAY,EACZ,aAAa,EACb,MAAM,EACN,iBAAiB,CACpB,CAAC;AAEF,IAAA,IACI,sBAAsB;QACtB,QAAQ,CAAC,MAAM,GAAG,GAAG;AACrB,QAAA,QAAQ,CAAC,MAAM,KAAK,GAAG,EACzB;;QAEE,sBAAsB,CAAC,mBAAmB,EAAE,CAAC;AAChD,IAAA,CAAA;AAED,IAAA,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;AAWG;AACI,eAAe,eAAe,CAGjC,UAA6B,EAC7B,aAAqB,EACrB,OAA8B,EAC9B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EAAA;IAErC,eAAe,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpE,IAAA,IAAI,QAAQ,CAAC;IACb,IAAI;AACA,QAAA,QAAQ,GAAG,MAAM,WAAW,EACxB,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAI,GACzDC,iCAAmD,EACnD,MAAM,EACN,iBAAiB,EACjB,aAAa,CAChB,CAAC,aAAa,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACnE,QAAA,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/C,iBAAiB,EAAE,SAAS,CACxB;YACI,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;YAC1D,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACxD,SAAS,EAAE,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;SAChE,EACD,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,YAAY,YAAY,EAAE;AAC3B,YAAA,MAAM,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;AAC1C,YAAA,IAAI,eAAe,EAAE;gBACjB,iBAAiB,EAAE,SAAS,CACxB;AACI,oBAAA,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;wBAC9C,EAAE;oBACN,SAAS,EACL,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;AACtD,oBAAA,iBAAiB,EACb,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC;wBACzC,SAAS;AACb,oBAAA,mBAAmB,EACf,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC;wBAC3C,SAAS;oBACb,UAAU,EAAE,CAAC,CAAC,UAAU;iBAC3B,EACD,aAAa,CAChB,CAAC;AACL,YAAA,CAAA;YACD,MAAM,CAAC,CAAC,KAAK,CAAC;AACjB,QAAA,CAAA;QACD,IAAI,CAAC,YAAY,SAAS,EAAE;AACxB,YAAA,MAAM,CAAC,CAAC;AACX,QAAA,CAAA;AAAM,aAAA;YACH,MAAM,qBAAqB,CACvBC,YAAiC,EACjC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACJ,IAAA,CAAA;IAED,eAAe,CAAC,WAAW,CACvB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,CAChB,CAAC;AAEF,IAAA,OAAO,QAAQ,CAAC;AACpB;;;;"}

package/dist/request/AuthenticationHeaderParser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { HeaderNames } from '../utils/Constants.mjs';

package/dist/request/BaseAuthRequest.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';

package/dist/request/BaseAuthRequest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"BaseAuthRequest.mjs","sources":["../../src/request/BaseAuthRequest.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.misplacedResourceParam","ClientAuthErrorCodes.resourceParameterRequired"],"mappings":";;;;;AAAA;;;AAGG;AAoHH;;;;;;AAMG;AACG,SAAU,wBAAwB,CACpC,KAAc,EACd,OAAiC,EAAA;IAEjC,IAAI,CAAC,KAAK,EAAE;QACR,OAAO;AACV,IAAA,CAAA;IAED,IACI,OAAO,CAAC,QAAQ;AAChB,SAAC,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;AAC3C,YAAA,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,EAC1D;AACE,QAAA,MAAM,qBAAqB,CACvBA,sBAA2C,EAC3C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;AACnB,QAAA,MAAM,qBAAqB,CACvBC,yBAA8C,EAC9C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB,EAAA;IAC9C,IAAI,CAAC,MAAM,EAAE;AACT,QAAA,OAAO,KAAK,CAAC;AAChB,IAAA,CAAA;AAED,IAAA,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACpE;;;;"}
+{"version":3,"file":"BaseAuthRequest.mjs","sources":["../../src/request/BaseAuthRequest.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.misplacedResourceParam","ClientAuthErrorCodes.resourceParameterRequired"],"mappings":";;;;;AAAA;;;AAGG;AAyHH;;;;;;AAMG;AACG,SAAU,wBAAwB,CACpC,KAAc,EACd,OAAiC,EAAA;IAEjC,IAAI,CAAC,KAAK,EAAE;QACR,OAAO;AACV,IAAA,CAAA;IAED,IACI,OAAO,CAAC,QAAQ;AAChB,SAAC,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;AAC3C,YAAA,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,EAC1D;AACE,QAAA,MAAM,qBAAqB,CACvBA,sBAA2C,EAC3C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;AACnB,QAAA,MAAM,qBAAqB,CACvBC,yBAA8C,EAC9C,OAAO,CAAC,aAAa,IAAI,EAAE,CAC9B,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB,EAAA;IAC9C,IAAI,CAAC,MAAM,EAAE;AACT,QAAA,OAAO,KAAK,CAAC;AAChB,IAAA,CAAA;AAED,IAAA,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACpE;;;;"}

package/dist/request/RequestParameterBuilder.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { OIDC_DEFAULT_SCOPES, HeaderNames, CLIENT_INFO, PasswordGrantConstants, AuthenticationScheme, ResponseMode, X_MS_LIB_CAPABILITY_VALUE, ClaimsRequestKeys } from '../utils/Constants.mjs';
 import { X_APP_NAME, X_APP_VER, ATTRIBUTE_TOKENS, CODE, BROKER_CLIENT_ID, BROKER_REDIRECT_URI, CLAIMS, CLI_DATA, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, CLIENT_ID, CLIENT_SECRET, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE_VERIFIER, CLIENT_REQUEST_ID, DEVICE_CODE, DOMAIN_HINT, EAR_JWK, EAR_JWE_CRYPTO, GRANT_TYPE, ID_TOKEN_HINT, INSTANCE_AWARE, X_CLIENT_SKU, X_CLIENT_VER, X_CLIENT_OS, X_CLIENT_CPU, LOGIN_HINT, LOGOUT_HINT, NATIVE_BROKER, NONCE, OBO_ASSERTION, TOKEN_TYPE, REQ_CNF, POST_LOGOUT_URI, PROMPT, REDIRECT_URI, REFRESH_TOKEN, REQUESTED_TOKEN_USE, RESOURCE, RESPONSE_MODE, RESPONSE_TYPE, SCOPE, X_CLIENT_CURR_TELEM, X_CLIENT_LAST_TELEM, SID, STATE, X_MS_LIB_CAPABILITY } from '../constants/AADServerParamKeys.mjs';
@@ -320,11 +320,15 @@ function addExtraParameters(parameters, extraParams) {
 }
 /**
  * Default optional idToken claims requested on all auth requests.
- * signin_state enables KMSI detection; login_hint enables login hint propagation.
+ * signin_state enables KMSI detection; login_hint enables login hint propagation;
+ * tenant_region_sub_scope identifies the sovereign enclave a tenant belongs to.
  */
 const DEFAULT_ID_TOKEN_CLAIMS = {
     [ClaimsRequestKeys.SIGNIN_STATE]: { essential: false },
     [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
+    [ClaimsRequestKeys.TENANT_REGION_SUB_SCOPE]: {
+        essential: false,
+    },
 };
 /**
  * Parses a claims JSON string into an object, throwing a ClientConfigurationError
@@ -383,8 +387,8 @@ function deepMergeClaims(baseClaims, claimsToMerge) {
 /**
  * Parses claims JSON, optionally deep-merges a second client-originated claims string
  * (`claimsToMerge`, e.g. `claimsFromClient`) with precedence on conflicting keys, merges
- * default optional idToken claims (signin_state, login_hint), and appends client
- * capabilities (xms_cc) to the access_token section.
+ * default optional idToken claims (signin_state, login_hint, tenant_region_sub_scope), and appends client
+ * capabilities (xms_cc) to the access_token section
  * Does not overwrite idToken claims already specified by the caller.
  * @param claims - Existing claims JSON string from the request (may be undefined)
  * @param clientCapabilities - Client capabilities array from configuration

package/dist/request/RequestParameterBuilder.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"RequestParameterBuilder.mjs","sources":["../../src/request/RequestParameterBuilder.ts"],"sourcesContent":[null],"names":["AADServerParamKeys.CLIENT_ID","AADServerParamKeys.BROKER_CLIENT_ID","AADServerParamKeys.REDIRECT_URI","AADServerParamKeys.RESPONSE_TYPE","AADServerParamKeys.RESPONSE_MODE","Constants.ResponseMode","AADServerParamKeys.NATIVE_BROKER","Constants.OIDC_DEFAULT_SCOPES","AADServerParamKeys.SCOPE","AADServerParamKeys.POST_LOGOUT_URI","AADServerParamKeys.ID_TOKEN_HINT","AADServerParamKeys.DOMAIN_HINT","AADServerParamKeys.LOGIN_HINT","Constants.HeaderNames","AADServerParamKeys.SID","AADServerParamKeys.CLAIMS","AADServerParamKeys.CLIENT_REQUEST_ID","AADServerParamKeys.X_CLIENT_SKU","AADServerParamKeys.X_CLIENT_VER","AADServerParamKeys.X_CLIENT_OS","AADServerParamKeys.X_CLIENT_CPU","AADServerParamKeys.X_APP_NAME","AADServerParamKeys.X_APP_VER","AADServerParamKeys.PROMPT","AADServerParamKeys.STATE","AADServerParamKeys.NONCE","AADServerParamKeys.CODE_CHALLENGE","AADServerParamKeys.CODE_CHALLENGE_METHOD","ClientConfigurationErrorCodes.pkceParamsMissing","AADServerParamKeys.CODE","AADServerParamKeys.DEVICE_CODE","AADServerParamKeys.REFRESH_TOKEN","AADServerParamKeys.CODE_VERIFIER","AADServerParamKeys.CLIENT_SECRET","AADServerParamKeys.CLIENT_ASSERTION","AADServerParamKeys.CLIENT_ASSERTION_TYPE","AADServerParamKeys.OBO_ASSERTION","AADServerParamKeys.REQUESTED_TOKEN_USE","AADServerParamKeys.GRANT_TYPE","Constants.CLIENT_INFO","AADServerParamKeys.CLI_DATA","AADServerParamKeys.INSTANCE_AWARE","Constants.ClaimsRequestKeys","ClientConfigurationErrorCodes.invalidClaims","Constants.PasswordGrantConstants","AADServerParamKeys.TOKEN_TYPE","Constants.AuthenticationScheme","AADServerParamKeys.REQ_CNF","AADServerParamKeys.X_CLIENT_CURR_TELEM","AADServerParamKeys.X_CLIENT_LAST_TELEM","AADServerParamKeys.X_MS_LIB_CAPABILITY","Constants.X_MS_LIB_CAPABILITY_VALUE","AADServerParamKeys.LOGOUT_HINT","AADServerParamKeys.BROKER_REDIRECT_URI","AADServerParamKeys.EAR_JWK","AADServerParamKeys.EAR_JWE_CRYPTO","AADServerParamKeys.RESOURCE","CacheHelpers.serializeAttributeTokens","AADServerParamKeys.ATTRIBUTE_TOKENS"],"mappings":";;;;;;;;;AAAA;;;AAGG;SAmBa,sBAAsB,CAClC,UAA+B,EAC/B,aAAsB,EACtB,iBAAsC,EAAA;IAEtC,IAAI,CAAC,aAAa,EAAE;QAChB,OAAO;AACV,IAAA,CAAA;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAACA,SAA4B,CAAC,CAAC;IAC9D,IAAI,QAAQ,IAAI,UAAU,CAAC,GAAG,CAACC,gBAAmC,CAAC,EAAE;QACjE,iBAAiB,EAAE,SAAS,CACxB;AACI,YAAA,gBAAgB,EAAE,QAAQ;YAC1B,mBAAmB,EAAE,UAAU,CAAC,GAAG,CAC/BC,YAA+B,CAClC;SACJ,EACD,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;;AAIG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAyC,EAAA;IAEzC,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAqC,EAAA;IAErC,UAAU,CAAC,GAAG,CACVC,aAAgC,EAChC,YAAY,GAAG,YAAY,GAAGC,YAAsB,CAAC,KAAK,CAC7D,CAAC;AACN,CAAC;AAED;;AAEG;AACG,SAAU,eAAe,CAAC,UAA+B,EAAA;IAC3D,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;AAIG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,MAAgB,EAChB,aAAqB,EACrB,gBAAyB,IAAI,EAC7B,aAAA,GAA+BC,mBAA6B,EAAA;;AAG5D,IAAA,IACI,aAAa;AACb,QAAA,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;AACjC,QAAA,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC5B;AACE,QAAA,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChC,IAAA,CAAA;IACD,MAAM,aAAa,GAAG,aAAa;UAC7B,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,aAAa,CAAC;AACvC,UAAE,MAAM,IAAI,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAC5D,IAAA,UAAU,CAAC,GAAG,CAACC,KAAwB,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;AAGG;AACG,SAAU,WAAW,CACvB,UAA+B,EAC/B,QAAgB,EAAA;IAEhB,UAAU,CAAC,GAAG,CAACR,SAA4B,EAAE,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED;;;AAGG;AACG,SAAU,cAAc,CAC1B,UAA+B,EAC/B,WAAmB,EAAA;IAEnB,UAAU,CAAC,GAAG,CAACE,YAA+B,EAAE,WAAW,CAAC,CAAC;AACjE,CAAC;AAED;;;AAGG;AACG,SAAU,wBAAwB,CACpC,UAA+B,EAC/B,WAAmB,EAAA;IAEnB,UAAU,CAAC,GAAG,CAACO,eAAkC,EAAE,WAAW,CAAC,CAAC;AACpE,CAAC;AAED;;;AAGG;AACG,SAAU,cAAc,CAC1B,UAA+B,EAC/B,WAAmB,EAAA;IAEnB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC;AAED;;;AAGG;AACG,SAAU,aAAa,CACzB,UAA+B,EAC/B,UAAkB,EAAA;IAElB,UAAU,CAAC,GAAG,CAACC,WAA8B,EAAE,UAAU,CAAC,CAAC;AAC/D,CAAC;AAED;;;AAGG;AACG,SAAU,YAAY,CACxB,UAA+B,EAC/B,SAAiB,EAAA;IAEjB,UAAU,CAAC,GAAG,CAACC,UAA6B,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED;;;AAGG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,SAAiB,EAAA;AAEjB,IAAA,UAAU,CAAC,GAAG,CAACC,WAAqB,CAAC,UAAU,EAAE,CAAA,IAAA,EAAO,SAAS,CAAA,CAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;AAGG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,UAAsB,EAAA;AAEtB,IAAA,UAAU,CAAC,GAAG,CACVA,WAAqB,CAAC,UAAU,EAChC,OAAO,UAAU,CAAC,GAAG,CAAA,CAAA,EAAI,UAAU,CAAC,IAAI,CAAA,CAAE,CAC7C,CAAC;AACN,CAAC;AAED;;;AAGG;AACG,SAAU,MAAM,CAAC,UAA+B,EAAE,GAAW,EAAA;IAC/D,UAAU,CAAC,GAAG,CAACC,GAAsB,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;AASG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,aAAqB,EACrB,MAAe,EACf,kBAAkC,EAClC,gBAA0B,EAC1B,aAAsB,EAAA;;IAGtB,MAAM,YAAY,GACd,gBAAgB,IAAI,UAAU,CAAC,GAAG,CAACb,gBAAmC,CAAC;AACnE,UAAE,SAAS;UACT,kBAAkB,CAAC;AAE7B,IAAA,MAAM,YAAY,GAAG,iBAAiB,CAClC,MAAM,EACN,YAAY,EACZ,aAAa,EACb,aAAa,CAChB,CAAC;IACF,UAAU,CAAC,GAAG,CAACc,MAAyB,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED;;;AAGG;AACG,SAAU,gBAAgB,CAC5B,UAA+B,EAC/B,aAAqB,EAAA;IAErB,UAAU,CAAC,GAAG,CAACC,iBAAoC,EAAE,aAAa,CAAC,CAAC;AACxE,CAAC;AAED;;;AAGG;AACG,SAAU,cAAc,CAC1B,UAA+B,EAC/B,WAAwB,EAAA;;IAGxB,UAAU,CAAC,GAAG,CAACC,YAA+B,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IACjE,UAAU,CAAC,GAAG,CAACC,YAA+B,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,WAAW,CAAC,EAAE,EAAE;QAChB,UAAU,CAAC,GAAG,CAACC,WAA8B,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;AAClE,IAAA,CAAA;IACD,IAAI,WAAW,CAAC,GAAG,EAAE;QACjB,UAAU,CAAC,GAAG,CAACC,YAA+B,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;AACpE,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,uBAAuB,CACnC,UAA+B,EAC/B,YAAkC,EAAA;IAElC,IAAI,YAAY,EAAE,OAAO,EAAE;QACvB,UAAU,CAAC,GAAG,CAACC,UAA6B,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;AACvE,IAAA,CAAA;IAED,IAAI,YAAY,EAAE,UAAU,EAAE;QAC1B,UAAU,CAAC,GAAG,CAACC,SAA4B,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;AACzE,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,MAAc,EAAA;IAEd,UAAU,CAAC,GAAG,CAACC,MAAyB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;AAGG;AACG,SAAU,QAAQ,CAAC,UAA+B,EAAE,KAAa,EAAA;AACnE,IAAA,IAAI,KAAK,EAAE;QACP,UAAU,CAAC,GAAG,CAACC,KAAwB,EAAE,KAAK,CAAC,CAAC;AACnD,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,QAAQ,CAAC,UAA+B,EAAE,KAAa,EAAA;IACnE,UAAU,CAAC,GAAG,CAACC,KAAwB,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;AAKG;SACa,sBAAsB,CAClC,UAA+B,EAC/B,aAAsB,EACtB,mBAA4B,EAAA;IAE5B,IAAI,aAAa,IAAI,mBAAmB,EAAE;QACtC,UAAU,CAAC,GAAG,CAACC,cAAiC,EAAE,aAAa,CAAC,CAAC;QACjE,UAAU,CAAC,GAAG,CACVC,qBAAwC,EACxC,mBAAmB,CACtB,CAAC;AACL,IAAA,CAAA;AAAM,SAAA;QACH,MAAM,8BAA8B,CAChCC,iBAA+C,EAC/C,EAAE,CACL,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,oBAAoB,CAChC,UAA+B,EAC/B,IAAY,EAAA;IAEZ,UAAU,CAAC,GAAG,CAACC,IAAuB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;AAGG;AACG,SAAU,aAAa,CACzB,UAA+B,EAC/B,IAAY,EAAA;IAEZ,UAAU,CAAC,GAAG,CAACC,WAA8B,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAoB,EAAA;IAEpB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAoB,EAAA;IAEpB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAoB,EAAA;IAEpB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,eAAuB,EAAA;AAEvB,IAAA,IAAI,eAAe,EAAE;QACjB,UAAU,CAAC,GAAG,CAACC,gBAAmC,EAAE,eAAe,CAAC,CAAC;AACxE,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,sBAAsB,CAClC,UAA+B,EAC/B,mBAA2B,EAAA;AAE3B,IAAA,IAAI,mBAAmB,EAAE;QACrB,UAAU,CAAC,GAAG,CACVC,qBAAwC,EACxC,mBAAmB,CACtB,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAoB,EAAA;IAEpB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,QAAgB,EAAA;IAEhB,UAAU,CAAC,GAAG,CAACC,mBAAsC,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED;;;AAGG;AACG,SAAU,YAAY,CACxB,UAA+B,EAC/B,SAAiB,EAAA;IAEjB,UAAU,CAAC,GAAG,CAACC,UAA6B,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED;;;AAGG;AACG,SAAU,aAAa,CAAC,UAA+B,EAAA;IACzD,UAAU,CAAC,GAAG,CAACC,WAAqB,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;AAEG;AACG,SAAU,UAAU,CAAC,UAA+B,EAAA;IACtD,UAAU,CAAC,GAAG,CAACC,QAA2B,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAEK,SAAU,gBAAgB,CAAC,UAA+B,EAAA;IAC5D,IAAI,CAAC,UAAU,CAAC,GAAG,CAACC,cAAiC,CAAC,EAAE;QACpD,UAAU,CAAC,GAAG,CAACA,cAAiC,EAAE,MAAM,CAAC,CAAC;AAC7D,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,WAAuB,EAAA;AAEvB,IAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,KAAI;QACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE;AAC/B,YAAA,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC9B,QAAA,CAAA;AACL,IAAA,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;AAGG;AACH,MAAM,uBAAuB,GAAyC;IAClE,CAACC,iBAA2B,CAAC,YAAY,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE;IAChE,CAACA,iBAA2B,CAAC,UAAU,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE;CACjE,CAAC;AAEF;;;;;;;AAOG;AACH,SAAS,WAAW,CAChB,MAAc,EACd,gBAAwB,EAAE,EAAA;AAE1B,IAAA,IAAI,MAAe,CAAC;IACpB,IAAI;AACA,QAAA,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/B,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;;QAER,MAAM,8BAA8B,CAChCC,aAA2C,EAC3C,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE;;QAExB,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAED,IAAA,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;AAIG;AACH,SAAS,aAAa,CAAC,KAAc,EAAA;AACjC,IAAA,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;AASG;AACH,SAAS,eAAe,CACpB,UAAmC,EACnC,aAAsC,EAAA;AAEtC,IAAA,MAAM,MAAM,GAA4B,EAAE,GAAG,UAAU,EAAE,CAAC;AAC1D,IAAA,KAAK,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;AAC7D,QAAA,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,YAAY,CAAC,EAAE;YACzD,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAC1D,QAAA,CAAA;AAAM,aAAA;AACH,YAAA,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;AAC9B,QAAA,CAAA;AACJ,IAAA,CAAA;AACD,IAAA,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;AAaG;AACG,SAAU,iBAAiB,CAC7B,MAAe,EACf,kBAAkC,EAClC,aAAA,GAAwB,EAAE,EAC1B,aAAsB,EAAA;;AAGtB,IAAA,IAAI,YAAY,GAAW,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC;;AAG5E,IAAA,IAAI,aAAa,EAAE,IAAI,EAAE,EAAE;AACvB,QAAA,YAAY,GAAG,eAAe,CAC1B,YAAuC,EACvC,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAC5C,CAAC;AACL,IAAA,CAAA;;AAGD,IAAA,IACI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CACjC,YAAY,EACZD,iBAA2B,CAAC,QAAQ,CACvC,EACH;QACE,YAAY,CAACA,iBAA2B,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC3D,IAAA,CAAA;IACD,MAAM,aAAa,GAAG,YAAY,CAACA,iBAA2B,CAAC,QAAQ,CAAC,CAAC;AACzE,IAAA,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE;AAChE,QAAA,IAAI,EAAE,GAAG,IAAI,aAAa,CAAC,EAAE;AACzB,YAAA,aAAa,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAC9B,QAAA,CAAA;AACJ,IAAA,CAAA;;AAGD,IAAA,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE;AACrD,QAAA,IACI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CACjC,YAAY,EACZA,iBAA2B,CAAC,YAAY,CAC3C,EACH;;YAEE,YAAY,CAACA,iBAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;AAC/D,QAAA,CAAA;;AAGD,QAAA,YAAY,CAACA,iBAA2B,CAAC,YAAY,CAAC,CAClDA,iBAA2B,CAAC,MAAM,CACrC,GAAG;AACA,YAAA,MAAM,EAAE,kBAAkB;SAC7B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;AACxC,CAAC;AAED;;;AAGG;AACG,SAAU,WAAW,CACvB,UAA+B,EAC/B,QAAgB,EAAA;IAEhB,UAAU,CAAC,GAAG,CAACE,sBAAgC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;AAGG;AACG,SAAU,WAAW,CACvB,UAA+B,EAC/B,QAAgB,EAAA;IAEhB,UAAU,CAAC,GAAG,CAACA,sBAAgC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;AAGG;AACG,SAAU,WAAW,CACvB,UAA+B,EAC/B,SAAiB,EAAA;AAEjB,IAAA,IAAI,SAAS,EAAE;AACX,QAAA,UAAU,CAAC,GAAG,CACVC,UAA6B,EAC7BC,oBAA8B,CAAC,GAAG,CACrC,CAAC;QACF,UAAU,CAAC,GAAG,CAACC,OAA0B,EAAE,SAAS,CAAC,CAAC;AACzD,IAAA,CAAA;AACL,CAAC;AAED;;AAEG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,YAAoB,EAAA;AAEpB,IAAA,IAAI,YAAY,EAAE;AACd,QAAA,UAAU,CAAC,GAAG,CACVF,UAA6B,EAC7BC,oBAA8B,CAAC,GAAG,CACrC,CAAC;QACF,UAAU,CAAC,GAAG,CAACC,OAA0B,EAAE,YAAY,CAAC,CAAC;AAC5D,IAAA,CAAA;AACL,CAAC;AAED;;;;AAIG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,sBAA8C,EAAA;AAE9C,IAAA,UAAU,CAAC,GAAG,CACVC,mBAAsC,EACtC,sBAAsB,CAAC,iCAAiC,EAAE,CAC7D,CAAC;AACF,IAAA,UAAU,CAAC,GAAG,CACVC,mBAAsC,EACtC,sBAAsB,CAAC,8BAA8B,EAAE,CAC1D,CAAC;AACN,CAAC;AAED;;AAEG;AACG,SAAU,aAAa,CAAC,UAA+B,EAAA;IACzD,UAAU,CAAC,GAAG,CACVC,mBAAsC,EACtCC,yBAAmC,CACtC,CAAC;AACN,CAAC;AAED;;AAEG;AACG,SAAU,aAAa,CACzB,UAA+B,EAC/B,UAAkB,EAAA;IAElB,UAAU,CAAC,GAAG,CAACC,WAA8B,EAAE,UAAU,CAAC,CAAC;AAC/D,CAAC;SAEe,mBAAmB,CAC/B,UAA+B,EAC/B,cAAsB,EACtB,iBAAyB,EAAA;IAEzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAACnD,gBAAmC,CAAC,EAAE;QACtD,UAAU,CAAC,GAAG,CAACA,gBAAmC,EAAE,cAAc,CAAC,CAAC;AACvE,IAAA,CAAA;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAACoD,mBAAsC,CAAC,EAAE;QACzD,UAAU,CAAC,GAAG,CACVA,mBAAsC,EACtC,iBAAiB,CACpB,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;;AAIG;AACG,SAAU,gBAAgB,CAC5B,UAA+B,EAC/B,GAAW,EAAA;AAEX,IAAA,UAAU,CAAC,GAAG,CAACC,OAA0B,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;;IAGpE,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;IACtE,UAAU,CAAC,GAAG,CAACC,cAAiC,EAAE,mBAAmB,CAAC,CAAC;AAC3E,CAAC;AAEK,SAAU,WAAW,CACvB,UAA+B,EAC/B,QAAiB,EAAA;AAEjB,IAAA,IAAI,QAAQ,EAAE;QACV,UAAU,CAAC,GAAG,CAACC,QAA2B,EAAE,QAAQ,CAAC,CAAC;AACzD,IAAA,CAAA;AACL,CAAC;AAED;;;;;;;;;AASG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,eAA8B,EAAA;IAE9B,MAAM,UAAU,GAAGC,wBAAqC,CAAC,eAAe,CAAC,CAAC;AAC1E,IAAA,IAAI,UAAU,EAAE;QACZ,UAAU,CAAC,GAAG,CAACC,gBAAmC,EAAE,UAAU,CAAC,CAAC;AACnE,IAAA,CAAA;AAAM,SAAA;AACH,QAAA,UAAU,CAAC,MAAM,CAACA,gBAAmC,CAAC,CAAC;AAC1D,IAAA,CAAA;AACL;;;;"}
+{"version":3,"file":"RequestParameterBuilder.mjs","sources":["../../src/request/RequestParameterBuilder.ts"],"sourcesContent":[null],"names":["AADServerParamKeys.CLIENT_ID","AADServerParamKeys.BROKER_CLIENT_ID","AADServerParamKeys.REDIRECT_URI","AADServerParamKeys.RESPONSE_TYPE","AADServerParamKeys.RESPONSE_MODE","Constants.ResponseMode","AADServerParamKeys.NATIVE_BROKER","Constants.OIDC_DEFAULT_SCOPES","AADServerParamKeys.SCOPE","AADServerParamKeys.POST_LOGOUT_URI","AADServerParamKeys.ID_TOKEN_HINT","AADServerParamKeys.DOMAIN_HINT","AADServerParamKeys.LOGIN_HINT","Constants.HeaderNames","AADServerParamKeys.SID","AADServerParamKeys.CLAIMS","AADServerParamKeys.CLIENT_REQUEST_ID","AADServerParamKeys.X_CLIENT_SKU","AADServerParamKeys.X_CLIENT_VER","AADServerParamKeys.X_CLIENT_OS","AADServerParamKeys.X_CLIENT_CPU","AADServerParamKeys.X_APP_NAME","AADServerParamKeys.X_APP_VER","AADServerParamKeys.PROMPT","AADServerParamKeys.STATE","AADServerParamKeys.NONCE","AADServerParamKeys.CODE_CHALLENGE","AADServerParamKeys.CODE_CHALLENGE_METHOD","ClientConfigurationErrorCodes.pkceParamsMissing","AADServerParamKeys.CODE","AADServerParamKeys.DEVICE_CODE","AADServerParamKeys.REFRESH_TOKEN","AADServerParamKeys.CODE_VERIFIER","AADServerParamKeys.CLIENT_SECRET","AADServerParamKeys.CLIENT_ASSERTION","AADServerParamKeys.CLIENT_ASSERTION_TYPE","AADServerParamKeys.OBO_ASSERTION","AADServerParamKeys.REQUESTED_TOKEN_USE","AADServerParamKeys.GRANT_TYPE","Constants.CLIENT_INFO","AADServerParamKeys.CLI_DATA","AADServerParamKeys.INSTANCE_AWARE","Constants.ClaimsRequestKeys","ClientConfigurationErrorCodes.invalidClaims","Constants.PasswordGrantConstants","AADServerParamKeys.TOKEN_TYPE","Constants.AuthenticationScheme","AADServerParamKeys.REQ_CNF","AADServerParamKeys.X_CLIENT_CURR_TELEM","AADServerParamKeys.X_CLIENT_LAST_TELEM","AADServerParamKeys.X_MS_LIB_CAPABILITY","Constants.X_MS_LIB_CAPABILITY_VALUE","AADServerParamKeys.LOGOUT_HINT","AADServerParamKeys.BROKER_REDIRECT_URI","AADServerParamKeys.EAR_JWK","AADServerParamKeys.EAR_JWE_CRYPTO","AADServerParamKeys.RESOURCE","CacheHelpers.serializeAttributeTokens","AADServerParamKeys.ATTRIBUTE_TOKENS"],"mappings":";;;;;;;;;AAAA;;;AAGG;SAmBa,sBAAsB,CAClC,UAA+B,EAC/B,aAAsB,EACtB,iBAAsC,EAAA;IAEtC,IAAI,CAAC,aAAa,EAAE;QAChB,OAAO;AACV,IAAA,CAAA;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAACA,SAA4B,CAAC,CAAC;IAC9D,IAAI,QAAQ,IAAI,UAAU,CAAC,GAAG,CAACC,gBAAmC,CAAC,EAAE;QACjE,iBAAiB,EAAE,SAAS,CACxB;AACI,YAAA,gBAAgB,EAAE,QAAQ;YAC1B,mBAAmB,EAAE,UAAU,CAAC,GAAG,CAC/BC,YAA+B,CAClC;SACJ,EACD,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;;AAIG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAyC,EAAA;IAEzC,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAqC,EAAA;IAErC,UAAU,CAAC,GAAG,CACVC,aAAgC,EAChC,YAAY,GAAG,YAAY,GAAGC,YAAsB,CAAC,KAAK,CAC7D,CAAC;AACN,CAAC;AAED;;AAEG;AACG,SAAU,eAAe,CAAC,UAA+B,EAAA;IAC3D,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;AAIG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,MAAgB,EAChB,aAAqB,EACrB,gBAAyB,IAAI,EAC7B,aAAA,GAA+BC,mBAA6B,EAAA;;AAG5D,IAAA,IACI,aAAa;AACb,QAAA,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;AACjC,QAAA,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC5B;AACE,QAAA,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChC,IAAA,CAAA;IACD,MAAM,aAAa,GAAG,aAAa;UAC7B,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,aAAa,CAAC;AACvC,UAAE,MAAM,IAAI,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAC5D,IAAA,UAAU,CAAC,GAAG,CAACC,KAAwB,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;AAGG;AACG,SAAU,WAAW,CACvB,UAA+B,EAC/B,QAAgB,EAAA;IAEhB,UAAU,CAAC,GAAG,CAACR,SAA4B,EAAE,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED;;;AAGG;AACG,SAAU,cAAc,CAC1B,UAA+B,EAC/B,WAAmB,EAAA;IAEnB,UAAU,CAAC,GAAG,CAACE,YAA+B,EAAE,WAAW,CAAC,CAAC;AACjE,CAAC;AAED;;;AAGG;AACG,SAAU,wBAAwB,CACpC,UAA+B,EAC/B,WAAmB,EAAA;IAEnB,UAAU,CAAC,GAAG,CAACO,eAAkC,EAAE,WAAW,CAAC,CAAC;AACpE,CAAC;AAED;;;AAGG;AACG,SAAU,cAAc,CAC1B,UAA+B,EAC/B,WAAmB,EAAA;IAEnB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC;AAED;;;AAGG;AACG,SAAU,aAAa,CACzB,UAA+B,EAC/B,UAAkB,EAAA;IAElB,UAAU,CAAC,GAAG,CAACC,WAA8B,EAAE,UAAU,CAAC,CAAC;AAC/D,CAAC;AAED;;;AAGG;AACG,SAAU,YAAY,CACxB,UAA+B,EAC/B,SAAiB,EAAA;IAEjB,UAAU,CAAC,GAAG,CAACC,UAA6B,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED;;;AAGG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,SAAiB,EAAA;AAEjB,IAAA,UAAU,CAAC,GAAG,CAACC,WAAqB,CAAC,UAAU,EAAE,CAAA,IAAA,EAAO,SAAS,CAAA,CAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;AAGG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,UAAsB,EAAA;AAEtB,IAAA,UAAU,CAAC,GAAG,CACVA,WAAqB,CAAC,UAAU,EAChC,OAAO,UAAU,CAAC,GAAG,CAAA,CAAA,EAAI,UAAU,CAAC,IAAI,CAAA,CAAE,CAC7C,CAAC;AACN,CAAC;AAED;;;AAGG;AACG,SAAU,MAAM,CAAC,UAA+B,EAAE,GAAW,EAAA;IAC/D,UAAU,CAAC,GAAG,CAACC,GAAsB,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;AASG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,aAAqB,EACrB,MAAe,EACf,kBAAkC,EAClC,gBAA0B,EAC1B,aAAsB,EAAA;;IAGtB,MAAM,YAAY,GACd,gBAAgB,IAAI,UAAU,CAAC,GAAG,CAACb,gBAAmC,CAAC;AACnE,UAAE,SAAS;UACT,kBAAkB,CAAC;AAE7B,IAAA,MAAM,YAAY,GAAG,iBAAiB,CAClC,MAAM,EACN,YAAY,EACZ,aAAa,EACb,aAAa,CAChB,CAAC;IACF,UAAU,CAAC,GAAG,CAACc,MAAyB,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED;;;AAGG;AACG,SAAU,gBAAgB,CAC5B,UAA+B,EAC/B,aAAqB,EAAA;IAErB,UAAU,CAAC,GAAG,CAACC,iBAAoC,EAAE,aAAa,CAAC,CAAC;AACxE,CAAC;AAED;;;AAGG;AACG,SAAU,cAAc,CAC1B,UAA+B,EAC/B,WAAwB,EAAA;;IAGxB,UAAU,CAAC,GAAG,CAACC,YAA+B,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IACjE,UAAU,CAAC,GAAG,CAACC,YAA+B,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,WAAW,CAAC,EAAE,EAAE;QAChB,UAAU,CAAC,GAAG,CAACC,WAA8B,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;AAClE,IAAA,CAAA;IACD,IAAI,WAAW,CAAC,GAAG,EAAE;QACjB,UAAU,CAAC,GAAG,CAACC,YAA+B,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;AACpE,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,uBAAuB,CACnC,UAA+B,EAC/B,YAAkC,EAAA;IAElC,IAAI,YAAY,EAAE,OAAO,EAAE;QACvB,UAAU,CAAC,GAAG,CAACC,UAA6B,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;AACvE,IAAA,CAAA;IAED,IAAI,YAAY,EAAE,UAAU,EAAE;QAC1B,UAAU,CAAC,GAAG,CAACC,SAA4B,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;AACzE,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,MAAc,EAAA;IAEd,UAAU,CAAC,GAAG,CAACC,MAAyB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;AAGG;AACG,SAAU,QAAQ,CAAC,UAA+B,EAAE,KAAa,EAAA;AACnE,IAAA,IAAI,KAAK,EAAE;QACP,UAAU,CAAC,GAAG,CAACC,KAAwB,EAAE,KAAK,CAAC,CAAC;AACnD,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,QAAQ,CAAC,UAA+B,EAAE,KAAa,EAAA;IACnE,UAAU,CAAC,GAAG,CAACC,KAAwB,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;AAKG;SACa,sBAAsB,CAClC,UAA+B,EAC/B,aAAsB,EACtB,mBAA4B,EAAA;IAE5B,IAAI,aAAa,IAAI,mBAAmB,EAAE;QACtC,UAAU,CAAC,GAAG,CAACC,cAAiC,EAAE,aAAa,CAAC,CAAC;QACjE,UAAU,CAAC,GAAG,CACVC,qBAAwC,EACxC,mBAAmB,CACtB,CAAC;AACL,IAAA,CAAA;AAAM,SAAA;QACH,MAAM,8BAA8B,CAChCC,iBAA+C,EAC/C,EAAE,CACL,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,oBAAoB,CAChC,UAA+B,EAC/B,IAAY,EAAA;IAEZ,UAAU,CAAC,GAAG,CAACC,IAAuB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;AAGG;AACG,SAAU,aAAa,CACzB,UAA+B,EAC/B,IAAY,EAAA;IAEZ,UAAU,CAAC,GAAG,CAACC,WAA8B,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAoB,EAAA;IAEpB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAoB,EAAA;IAEpB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAoB,EAAA;IAEpB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,eAAuB,EAAA;AAEvB,IAAA,IAAI,eAAe,EAAE;QACjB,UAAU,CAAC,GAAG,CAACC,gBAAmC,EAAE,eAAe,CAAC,CAAC;AACxE,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,sBAAsB,CAClC,UAA+B,EAC/B,mBAA2B,EAAA;AAE3B,IAAA,IAAI,mBAAmB,EAAE;QACrB,UAAU,CAAC,GAAG,CACVC,qBAAwC,EACxC,mBAAmB,CACtB,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,eAAe,CAC3B,UAA+B,EAC/B,YAAoB,EAAA;IAEpB,UAAU,CAAC,GAAG,CAACC,aAAgC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;AAGG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,QAAgB,EAAA;IAEhB,UAAU,CAAC,GAAG,CAACC,mBAAsC,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED;;;AAGG;AACG,SAAU,YAAY,CACxB,UAA+B,EAC/B,SAAiB,EAAA;IAEjB,UAAU,CAAC,GAAG,CAACC,UAA6B,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED;;;AAGG;AACG,SAAU,aAAa,CAAC,UAA+B,EAAA;IACzD,UAAU,CAAC,GAAG,CAACC,WAAqB,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;AAEG;AACG,SAAU,UAAU,CAAC,UAA+B,EAAA;IACtD,UAAU,CAAC,GAAG,CAACC,QAA2B,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAEK,SAAU,gBAAgB,CAAC,UAA+B,EAAA;IAC5D,IAAI,CAAC,UAAU,CAAC,GAAG,CAACC,cAAiC,CAAC,EAAE;QACpD,UAAU,CAAC,GAAG,CAACA,cAAiC,EAAE,MAAM,CAAC,CAAC;AAC7D,IAAA,CAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,WAAuB,EAAA;AAEvB,IAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,KAAI;QACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE;AAC/B,YAAA,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC9B,QAAA,CAAA;AACL,IAAA,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;AAIG;AACH,MAAM,uBAAuB,GAAyC;IAClE,CAACC,iBAA2B,CAAC,YAAY,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE;IAChE,CAACA,iBAA2B,CAAC,UAAU,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE;AAC9D,IAAA,CAACA,iBAA2B,CAAC,uBAAuB,GAAG;AACnD,QAAA,SAAS,EAAE,KAAK;AACnB,KAAA;CACJ,CAAC;AAEF;;;;;;;AAOG;AACH,SAAS,WAAW,CAChB,MAAc,EACd,gBAAwB,EAAE,EAAA;AAE1B,IAAA,IAAI,MAAe,CAAC;IACpB,IAAI;AACA,QAAA,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/B,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;;QAER,MAAM,8BAA8B,CAChCC,aAA2C,EAC3C,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE;;QAExB,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAED,IAAA,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;AAIG;AACH,SAAS,aAAa,CAAC,KAAc,EAAA;AACjC,IAAA,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;AASG;AACH,SAAS,eAAe,CACpB,UAAmC,EACnC,aAAsC,EAAA;AAEtC,IAAA,MAAM,MAAM,GAA4B,EAAE,GAAG,UAAU,EAAE,CAAC;AAC1D,IAAA,KAAK,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;AAC7D,QAAA,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,YAAY,CAAC,EAAE;YACzD,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAC1D,QAAA,CAAA;AAAM,aAAA;AACH,YAAA,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;AAC9B,QAAA,CAAA;AACJ,IAAA,CAAA;AACD,IAAA,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;AAaG;AACG,SAAU,iBAAiB,CAC7B,MAAe,EACf,kBAAkC,EAClC,aAAA,GAAwB,EAAE,EAC1B,aAAsB,EAAA;;AAGtB,IAAA,IAAI,YAAY,GAAW,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC;;AAG5E,IAAA,IAAI,aAAa,EAAE,IAAI,EAAE,EAAE;AACvB,QAAA,YAAY,GAAG,eAAe,CAC1B,YAAuC,EACvC,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAC5C,CAAC;AACL,IAAA,CAAA;;AAGD,IAAA,IACI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CACjC,YAAY,EACZD,iBAA2B,CAAC,QAAQ,CACvC,EACH;QACE,YAAY,CAACA,iBAA2B,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC3D,IAAA,CAAA;IACD,MAAM,aAAa,GAAG,YAAY,CAACA,iBAA2B,CAAC,QAAQ,CAAC,CAAC;AACzE,IAAA,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE;AAChE,QAAA,IAAI,EAAE,GAAG,IAAI,aAAa,CAAC,EAAE;AACzB,YAAA,aAAa,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAC9B,QAAA,CAAA;AACJ,IAAA,CAAA;;AAGD,IAAA,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE;AACrD,QAAA,IACI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CACjC,YAAY,EACZA,iBAA2B,CAAC,YAAY,CAC3C,EACH;;YAEE,YAAY,CAACA,iBAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;AAC/D,QAAA,CAAA;;AAGD,QAAA,YAAY,CAACA,iBAA2B,CAAC,YAAY,CAAC,CAClDA,iBAA2B,CAAC,MAAM,CACrC,GAAG;AACA,YAAA,MAAM,EAAE,kBAAkB;SAC7B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;AACxC,CAAC;AAED;;;AAGG;AACG,SAAU,WAAW,CACvB,UAA+B,EAC/B,QAAgB,EAAA;IAEhB,UAAU,CAAC,GAAG,CAACE,sBAAgC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;AAGG;AACG,SAAU,WAAW,CACvB,UAA+B,EAC/B,QAAgB,EAAA;IAEhB,UAAU,CAAC,GAAG,CAACA,sBAAgC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;AAGG;AACG,SAAU,WAAW,CACvB,UAA+B,EAC/B,SAAiB,EAAA;AAEjB,IAAA,IAAI,SAAS,EAAE;AACX,QAAA,UAAU,CAAC,GAAG,CACVC,UAA6B,EAC7BC,oBAA8B,CAAC,GAAG,CACrC,CAAC;QACF,UAAU,CAAC,GAAG,CAACC,OAA0B,EAAE,SAAS,CAAC,CAAC;AACzD,IAAA,CAAA;AACL,CAAC;AAED;;AAEG;AACG,SAAU,SAAS,CACrB,UAA+B,EAC/B,YAAoB,EAAA;AAEpB,IAAA,IAAI,YAAY,EAAE;AACd,QAAA,UAAU,CAAC,GAAG,CACVF,UAA6B,EAC7BC,oBAA8B,CAAC,GAAG,CACrC,CAAC;QACF,UAAU,CAAC,GAAG,CAACC,OAA0B,EAAE,YAAY,CAAC,CAAC;AAC5D,IAAA,CAAA;AACL,CAAC;AAED;;;;AAIG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,sBAA8C,EAAA;AAE9C,IAAA,UAAU,CAAC,GAAG,CACVC,mBAAsC,EACtC,sBAAsB,CAAC,iCAAiC,EAAE,CAC7D,CAAC;AACF,IAAA,UAAU,CAAC,GAAG,CACVC,mBAAsC,EACtC,sBAAsB,CAAC,8BAA8B,EAAE,CAC1D,CAAC;AACN,CAAC;AAED;;AAEG;AACG,SAAU,aAAa,CAAC,UAA+B,EAAA;IACzD,UAAU,CAAC,GAAG,CACVC,mBAAsC,EACtCC,yBAAmC,CACtC,CAAC;AACN,CAAC;AAED;;AAEG;AACG,SAAU,aAAa,CACzB,UAA+B,EAC/B,UAAkB,EAAA;IAElB,UAAU,CAAC,GAAG,CAACC,WAA8B,EAAE,UAAU,CAAC,CAAC;AAC/D,CAAC;SAEe,mBAAmB,CAC/B,UAA+B,EAC/B,cAAsB,EACtB,iBAAyB,EAAA;IAEzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAACnD,gBAAmC,CAAC,EAAE;QACtD,UAAU,CAAC,GAAG,CAACA,gBAAmC,EAAE,cAAc,CAAC,CAAC;AACvE,IAAA,CAAA;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAACoD,mBAAsC,CAAC,EAAE;QACzD,UAAU,CAAC,GAAG,CACVA,mBAAsC,EACtC,iBAAiB,CACpB,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;;AAIG;AACG,SAAU,gBAAgB,CAC5B,UAA+B,EAC/B,GAAW,EAAA;AAEX,IAAA,UAAU,CAAC,GAAG,CAACC,OAA0B,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;;IAGpE,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;IACtE,UAAU,CAAC,GAAG,CAACC,cAAiC,EAAE,mBAAmB,CAAC,CAAC;AAC3E,CAAC;AAEK,SAAU,WAAW,CACvB,UAA+B,EAC/B,QAAiB,EAAA;AAEjB,IAAA,IAAI,QAAQ,EAAE;QACV,UAAU,CAAC,GAAG,CAACC,QAA2B,EAAE,QAAQ,CAAC,CAAC;AACzD,IAAA,CAAA;AACL,CAAC;AAED;;;;;;;;;AASG;AACG,SAAU,kBAAkB,CAC9B,UAA+B,EAC/B,eAA8B,EAAA;IAE9B,MAAM,UAAU,GAAGC,wBAAqC,CAAC,eAAe,CAAC,CAAC;AAC1E,IAAA,IAAI,UAAU,EAAE;QACZ,UAAU,CAAC,GAAG,CAACC,gBAAmC,EAAE,UAAU,CAAC,CAAC;AACnE,IAAA,CAAA;AAAM,SAAA;AACH,QAAA,UAAU,CAAC,MAAM,CAACA,gBAAmC,CAAC,CAAC;AAC1D,IAAA,CAAA;AACL;;;;"}

package/dist/request/ScopeSet.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist/response/ResponseHandler.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.13.0 2026-08-18 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { updateAccountTenantProfileData, buildTenantProfile } from '../account/AccountInfo.mjs';
 import { extractTokenClaims, isKmsi } from '../account/AuthToken.mjs';
@@ -7,6 +7,7 @@ import { TokenCacheContext } from '../cache/persistence/TokenCacheContext.mjs';
 import { generateHomeAccountId, getAccountInfo, createAccountEntity } from '../cache/utils/AccountEntityUtils.mjs';
 import { createIdTokenEntity, createAccessTokenEntity, createRefreshTokenEntity, serializeAttributeTokens } from '../cache/utils/CacheHelpers.mjs';
 import { PopTokenGenerator } from '../crypto/PopTokenGenerator.mjs';
+import { DpopProofGenerator } from '../crypto/DpopProofGenerator.mjs';
 import { DEFAULT_TOKEN_BINDING_KEY_MANAGER } from '../crypto/ITokenBindingKeyManager.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { isInteractionRequiredError, InteractionRequiredAuthError } from '../error/InteractionRequiredAuthError.mjs';
@@ -15,7 +16,7 @@ import { ScopeSet } from '../request/ScopeSet.mjs';
 import { NOT_AVAILABLE, HTTP_SERVER_ERROR_RANGE_START, HTTP_SERVER_ERROR_RANGE_END, HTTP_CLIENT_ERROR_RANGE_START, HTTP_CLIENT_ERROR_RANGE_END, AuthenticationScheme, THE_FAMILY_ID } from '../utils/Constants.mjs';
 import { parseRequestState } from '../utils/ProtocolUtils.mjs';
 import { toDateFromSeconds } from '../utils/TimeUtils.mjs';
-import { nonceMismatch, invalidCacheEnvironment, keyIdMissing } from '../error/ClientAuthErrorCodes.mjs';
+import { nonceMismatch, dpopTokenTypeMismatch, invalidCacheEnvironment, keyIdMissing } from '../error/ClientAuthErrorCodes.mjs';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -88,11 +89,26 @@ class ResponseHandler {
         let idTokenClaims;
         if (serverTokenResponse.id_token) {
             idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode, request.correlationId);
-            // token nonce check (TODO: Add a warning if no nonce is given?)
-            if (authCodePayload && authCodePayload.nonce) {
-                if (idTokenClaims.nonce !== authCodePayload.nonce) {
-                    throw createClientAuthError(nonceMismatch, request.correlationId);
-                }
+        }
+        /*
+         * Callers opt in to strict nonce-presence validation by including
+         * the nonce property, even when its value is undefined.
+         */
+        if (authCodePayload &&
+            Object.prototype.hasOwnProperty.call(authCodePayload, "nonce")) {
+            const expectedNonce = authCodePayload.nonce;
+            const tokenNonce = idTokenClaims?.nonce;
+            // Warn when the ID Token nonce cannot be bound to the request.
+            if (tokenNonce !== undefined && expectedNonce === undefined) {
+                this.logger.warning("Authorization code response contains an ID Token nonce, but no expected nonce was supplied. Rejecting the response.", request.correlationId);
+                throw createClientAuthError(nonceMismatch, request.correlationId);
+            }
+            // If the request supplies a nonce, the ID Token value must be a matching string.
+            if (expectedNonce !== undefined &&
+                (typeof expectedNonce !== "string" ||
+                    typeof tokenNonce !== "string" ||
+                    expectedNonce !== tokenNonce)) {
+                throw createClientAuthError(nonceMismatch, request.correlationId);
             }
         }
         // generate homeAccountId
@@ -104,7 +120,21 @@ class ResponseHandler {
         }
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
-            serverTokenResponse.key_id || request.sshKid || undefined;
+            serverTokenResponse.key_id ||
+                request.dpopJkt ||
+                request.sshKid ||
+                undefined;
+        if (request.authenticationScheme === AuthenticationScheme.DPOP) {
+            if (serverTokenResponse.token_type?.toLowerCase() !==
+                AuthenticationScheme.DPOP.toLowerCase()) {
+                this.performanceClient?.addFields({
+                    dpopTokenTypeMismatch: serverTokenResponse.token_type,
+                }, request.correlationId);
+                throw createClientAuthError(dpopTokenTypeMismatch, request.correlationId);
+            }
+            serverTokenResponse.token_type =
+                AuthenticationScheme.DPOP;
+        }
         // Compute components once for entity storage (fallback if hash not provided by client)
         const attributeTokenPartition = serializeAttributeTokens(request.attributeTokens);
         const cacheKeyComponents = additionalCacheKeyComponents ??
@@ -267,7 +297,9 @@ class ResponseHandler {
         let extExpiresOn;
         let refreshOn;
         let familyId = "";
+        let dpopProof;
         if (cacheRecord.accessToken) {
+            const accessTokenType = cacheRecord.accessToken.tokenType?.toLowerCase();
             /*
              * if the request object has `popKid` property, `signPopToken` will be set to false and
              * the token will be returned unsigned
@@ -285,6 +317,18 @@ class ResponseHandler {
             else {
                 accessToken = cacheRecord.accessToken.secret;
             }
+            if (accessTokenType ===
+                AuthenticationScheme.DPOP.toLowerCase()) {
+                if (!cacheRecord.accessToken.keyId) {
+                    throw createClientAuthError(keyIdMissing, request.correlationId);
+                }
+                const dpopProofGenerator = new DpopProofGenerator(cryptoObj, tokenBindingKeyManager);
+                dpopProof = await dpopProofGenerator.generateResourceProof({
+                    htu: request.resourceRequestUri,
+                    htm: request.resourceRequestMethod,
+                    accessToken: cacheRecord.accessToken.secret,
+                }, cacheRecord.accessToken.keyId, request.correlationId);
+            }
             responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target, request.correlationId).asArray();
             // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
             expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
@@ -301,6 +345,15 @@ class ResponseHandler {
         }
         const uid = idTokenClaims?.oid || idTokenClaims?.sub || "";
         const tid = idTokenClaims?.tid || "";
+        /*
+         * Surface the sovereign enclave for telemetry. This runs for both freshly acquired
+         * and cache-served tokens because SilentFlowClient shares this method, so the field
+         * is present on silent requests that never hit the network.
+         */
+        const regionSubScope = idTokenClaims?.tenant_region_sub_scope;
+        if (typeof regionSubScope === "string") {
+            performanceClient?.addFields({ regionSubScope }, request.correlationId);
+        }
         // for hybrid + native bridge enablement, send back the native account Id
         if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
             // Set on deprecated top-level for downgrade compat
@@ -329,6 +382,7 @@ class ResponseHandler {
             idToken: cacheRecord?.idToken?.secret || "",
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken,
+            dpopProof,
             fromCache: fromTokenCache,
             expiresOn: expiresOn,
             extExpiresOn: extExpiresOn,
@@ -336,7 +390,10 @@ class ResponseHandler {
             correlationId: request.correlationId,
             requestId: requestId || "",
             familyId: familyId,
-            tokenType: cacheRecord.accessToken?.tokenType || "",
+            tokenType: cacheRecord.accessToken?.tokenType?.toLowerCase() ===
+                AuthenticationScheme.DPOP.toLowerCase()
+                ? AuthenticationScheme.DPOP
+                : cacheRecord.accessToken?.tokenType || "",
             state: requestState ? requestState.userRequestState : "",
             cloudGraphHostName: cacheRecord.account?.cloudGraphHostName || "",
             msGraphHost: cacheRecord.account?.msGraphHost || "",