@azure/msal-common 16.7.0 → 16.9.0

package/lib/{index-node-DHSwXao8.js → index-node-CcOYLhxB.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.9.0 2026-06-16 */
 'use strict';
 'use strict';
 
@@ -1811,6 +1811,7 @@ function generateAuthorityMetadataExpiresAt() {
     return (nowSeconds() +
         AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
 }
+/** @internal */
 function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
     authorityMetadata.authorization_endpoint =
         updatedValues.authorization_endpoint;
@@ -1820,6 +1821,7 @@ function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromN
     authorityMetadata.endpointsFromNetwork = fromNetwork;
     authorityMetadata.jwks_uri = updatedValues.jwks_uri;
 }
+/** @internal */
 function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
     authorityMetadata.aliases = updatedValues.aliases;
     authorityMetadata.preferred_cache = updatedValues.preferred_cache;
@@ -1828,6 +1830,7 @@ function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetw
 }
 /**
  * Returns whether or not the data needs to be refreshed
+ * @internal
  */
 function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
@@ -1881,7 +1884,7 @@ class Authority {
         this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
     }
     /**
-     * Get {@link AuthorityType}
+     * Get {@link AuthorityType:type}
      * @param authorityUri {@link IUri}
      * @private
      */
@@ -2863,28 +2866,6 @@ var AuthorityFactory = /*#__PURE__*/Object.freeze({
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-/**
- * Canonicalizes a URL by making it lowercase and ensuring it ends with /
- * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
- * @param url - URL to canonicalize
- * @returns Canonicalized URL
- */
-function canonicalizeUrl(url) {
-    if (!url) {
-        return url;
-    }
-    let lowerCaseUrl = url.toLowerCase();
-    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
-    }
-    else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
-    }
-    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
-        lowerCaseUrl += "/";
-    }
-    return lowerCaseUrl;
-}
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -2937,32 +2918,67 @@ function mapToQueryString(parameters) {
     return queryParameterArray.join("&");
 }
 /**
- * Normalizes URLs for comparison by removing hash, canonicalizing,
- * and ensuring consistent URL encoding in query parameters.
- * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * Normalizes URLs for comparison per MDN & RFC 3986 standards:
+ * - Hash/fragment is removed
+ * - Scheme and host are lowercased (case-insensitive per spec)
+ * - Path and query parameters preserve original casing (case-sensitive per spec)
+ * - Percent-encoding in pathname is normalized (e.g., %27 and ' are treated equivalently)
+ * - Ensures pathname ends with /
+ * Throws a urlParseError if the provided URL is malformed and cannot be parsed.
  * @param url - URL to normalize
+ * @param logger - Optional logger used to log parse failures
+ * @param correlationId - Optional correlationId associated with the log entry
  * @returns Normalized URL string for comparison
  */
-function normalizeUrlForComparison(url) {
+function normalizeUrlForComparison(url, logger, correlationId) {
     if (!url) {
         return url;
     }
-    // Remove hash first
     const urlWithoutHash = url.split("#")[0];
+    if (!urlWithoutHash) {
+        return urlWithoutHash;
+    }
     try {
-        // Parse the URL to handle encoding consistently
         const urlObj = new URL(urlWithoutHash);
-        /*
-         * Reconstruct the URL with properly decoded query parameters
-         * This ensures that %27 and ' are treated as equivalent
-         */
-        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
-        // Apply canonicalization logic inline to avoid circular dependency
-        return canonicalizeUrl(normalizedUrl);
+        // Treat an empty query string (a bare trailing "?") as equivalent to no query
+        if (!urlObj.search) {
+            urlObj.search = "";
+        }
+        // Decode the pathname to normalize percent-encoding and ensure trailing slash
+        let pathname;
+        try {
+            pathname = decodeURIComponent(urlObj.pathname);
+        }
+        catch (e) {
+            pathname = urlObj.pathname;
+        }
+        if (!pathname.endsWith("/")) {
+            pathname += "/";
+        }
+        urlObj.pathname = pathname;
+        return urlObj.href;
+    }
+    catch (e) {
+        logger?.error(`Failed to normalize URL for comparison: '${e}'`, correlationId || "");
+        throw createClientConfigurationError(urlParseError);
+    }
+}
+/**
+ * Validates that the provided value is a well-formed, parseable absolute URL.
+ * Throws a urlParseError if the value cannot be parsed by the URL API (e.g. the
+ * literal string "null", an empty string, or any malformed/relative URL). Use this
+ * to guard against persisting an invalid value (such as a redirect URL) to the cache.
+ * @param url - URL to validate
+ * @param logger - Optional logger used to log validation failures
+ * @param correlationId - Optional correlationId associated with the log entry
+ */
+function validateUrl(url, logger, correlationId) {
+    try {
+        new URL(url);
     }
     catch (e) {
-        // Fallback to original logic if URL parsing fails
-        return canonicalizeUrl(urlWithoutHash);
+        logger?.error(`Failed to validate URL: '${e}'`, correlationId || "");
+        throw createClientConfigurationError(urlParseError);
     }
 }
 
@@ -2971,7 +2987,8 @@ var UrlUtils = /*#__PURE__*/Object.freeze({
     getDeserializedResponse: getDeserializedResponse,
     mapToQueryString: mapToQueryString,
     normalizeUrlForComparison: normalizeUrlForComparison,
-    stripLeadingHashOrQuery: stripLeadingHashOrQuery
+    stripLeadingHashOrQuery: stripLeadingHashOrQuery,
+    validateUrl: validateUrl
 });
 
 /*
@@ -3248,6 +3265,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
  */
 /**
  * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+ * @internal
  */
 function generateAccountId(accountEntity) {
     const accountId = [
@@ -3258,6 +3276,7 @@ function generateAccountId(accountEntity) {
 }
 /**
  * Returns the AccountInfo interface for this account.
+ * @internal
  */
 function getAccountInfo(accountEntity) {
     const tenantProfiles = accountEntity.tenantProfiles || [];
@@ -3286,6 +3305,7 @@ function getAccountInfo(accountEntity) {
 }
 /**
  * Returns true if the account entity is in single tenant format (outdated), false otherwise
+ * @internal
  */
 function isSingleTenant(accountEntity) {
     return !accountEntity.tenantProfiles;
@@ -3293,6 +3313,7 @@ function isSingleTenant(accountEntity) {
 /**
  * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
  * @param accountDetails
+ * @internal
  */
 function createAccountEntity(accountDetails, authority, base64Decode) {
     let authorityType;
@@ -3371,6 +3392,7 @@ function createAccountEntity(accountDetails, authority, base64Decode) {
  * @param cloudGraphHostName
  * @param msGraphHost
  * @returns
+ * @internal
  */
 function createAccountEntityFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
     // Serialize tenant profiles map into an array
@@ -3423,6 +3445,7 @@ function generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, co
 /**
  * Validates an entity: checks for all expected params
  * @param entity
+ * @internal
  */
 function isAccountEntity(entity) {
     if (!entity) {
@@ -4020,10 +4043,17 @@ function addSshJwk(parameters, sshJwkString) {
 /**
  * add server telemetry fields
  * @param serverTelemetryManager
+ * @internal
  */
 function addServerTelemetry(parameters, serverTelemetryManager) {
-    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+    const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
+    const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
+    if (currentTelemetryHeader) {
+        parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
+    }
+    if (lastTelemetryHeader) {
+        parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
+    }
 }
 /**
  * Adds parameter that indicates to the server that throttling is supported
@@ -4197,7 +4227,7 @@ function addLogToCache(correlationId, loggedMessage) {
         // Remove LRU (first entry) if capacity exceeded
         if (correlationCache.size > CACHE_CAPACITY) {
             const firstKey = correlationCache.keys().next().value;
-            if (firstKey) {
+            if (firstKey !== undefined) {
                 correlationCache.delete(firstKey);
             }
         }
@@ -4226,22 +4256,36 @@ function getAndFlushLogsFromCache(correlationId) {
     return res;
 }
 /**
- * Checks if a string is already a hashed logging string (6 alphanumeric characters)
- */
-function isHashedString(str) {
-    if (str.length !== 6) {
-        return false;
+ * Extracts the leading minification hash from a log message, if present.
+ *
+ * Minified messages are produced by the logger-minify rollup plugin and are
+ * either a bare 6-character alphanumeric hash, or that hash followed by a space
+ * and runtime variables appended for local (console) logging, e.g.
+ * "abc123 user-1 popup". Only the leading hash is returned so that telemetry
+ * never captures the appended variables. Returns null when the message is not
+ * a minified message.
+ */
+function getMessageHash(str) {
+    if (str.length < 6) {
+        return null;
+    }
+    /*
+     * If the message is longer than the hash, the hash must be delimited by a
+     * space (the separator the plugin inserts before appended variables).
+     */
+    if (str.length > 6 && str[6] !== " ") {
+        return null;
     }
-    for (let i = 0; i < str.length; i++) {
+    for (let i = 0; i < 6; i++) {
         const char = str[i];
         const isAlphaNumeric = (char >= "a" && char <= "z") ||
             (char >= "A" && char <= "Z") ||
             (char >= "0" && char <= "9");
         if (!isAlphaNumeric) {
-            return false;
+            return null;
         }
     }
-    return true;
+    return str.substring(0, 6);
 }
 /**
  * Class which facilitates logging of messages to a specific place.
@@ -4288,10 +4332,10 @@ class Logger {
      */
     logMessage(logMessage, options) {
         const correlationId = options.correlationId;
-        const isHashedInput = isHashedString(logMessage);
-        if (isHashedInput) {
+        const messageHash = getMessageHash(logMessage);
+        if (messageHash) {
             const loggedMessage = {
-                hash: logMessage,
+                hash: messageHash,
                 level: options.logLevel,
                 containsPii: options.containsPii || false,
                 milliseconds: 0, // Will be calculated in addLogToCache
@@ -4426,7 +4470,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.7.0";
+const version = "16.9.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5650,7 +5694,20 @@ const IntFields = new Set([
     "currAccessCount",
     "currIdCount",
     "currRefreshCount",
-    "expiredCacheRemovedCount",
+    "ttlExpiredAcntCount",
+    "ttlExpiredITCount",
+    "ttlExpiredATCount",
+    "ttlExpiredRTCount",
+    "decryptFailedAcntCount",
+    "decryptFailedITCount",
+    "decryptFailedATCount",
+    "decryptFailedRTCount",
+    "invalidAcntCount",
+    "invalidITCount",
+    "invalidATCount",
+    "invalidRTCount",
+    "expiredATCount",
+    "expiredRTCount",
     "upgradedCacheCount",
     "cacheMatchedAccounts",
     "networkRtt",
@@ -5761,6 +5818,7 @@ const DEFAULT_TELEMETRY_OPTIONS = {
  * @param Configuration
  *
  * @returns Configuration
+ * @internal
  */
 function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
     const loggerOptions = {
@@ -5772,7 +5830,7 @@ function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions:
         systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
         loggerOptions: loggerOptions,
         storageInterface: storageImplementation ||
-            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
+            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions, name, version), new StubPerformanceClient()),
         networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
@@ -6432,6 +6490,7 @@ class ResponseHandler {
         };
     }
 }
+/** @internal */
 function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
     logger?.verbose("setCachedAccount called", correlationId);
     /*
@@ -6687,6 +6746,7 @@ function createTokenQueryParameters(request, clientId, redirectUri, performanceC
  * @param queryString
  * @param headers
  * @param thumbprint
+ * @internal
  */
 async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, cacheManager, networkClient, logger, performanceClient, serverTelemetryManager) {
     const response = await sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId, cacheManager, networkClient, logger, performanceClient);
@@ -6708,6 +6768,7 @@ async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, t
  * @param networkClient - Network module instance
  * @param logger - Logger instance
  * @param performanceClient - Performance client instance
+ * @internal
  */
 async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId, cacheManager, networkClient, logger, performanceClient) {
     ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
@@ -7369,6 +7430,7 @@ const StubbedNetworkModule = {
  * @param logger
  * @param performanceClient
  * @returns
+ * @internal
  */
 function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
     // generate the correlationId if not set by the user and add
@@ -7497,6 +7559,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
  * @param authority
  * @param requestParameters
  * @returns
+ * @internal
  */
 function getAuthorizeUrl(authority, requestParameters) {
     const queryString = mapToQueryString(requestParameters);
@@ -7826,35 +7889,40 @@ class ServerTelemetryManager {
      * @param error
      */
     cacheFailedRequest(error) {
-        const lastRequests = this.getLastRequests();
-        if (lastRequests.errors.length >=
-            SERVER_TELEM_MAX_CACHED_ERRORS) {
-            // Remove a cached error to make room, first in first out
-            lastRequests.failedRequests.shift(); // apiId
-            lastRequests.failedRequests.shift(); // correlationId
-            lastRequests.errors.shift();
-        }
-        lastRequests.failedRequests.push(this.apiId, this.correlationId);
-        if (error instanceof Error && !!error && error.toString()) {
-            if (error instanceof AuthError) {
-                if (error.subError) {
-                    lastRequests.errors.push(error.subError);
-                }
-                else if (error.errorCode) {
-                    lastRequests.errors.push(error.errorCode);
+        try {
+            const lastRequests = this.getLastRequests();
+            if (lastRequests.errors.length >=
+                SERVER_TELEM_MAX_CACHED_ERRORS) {
+                // Remove a cached error to make room, first in first out
+                lastRequests.failedRequests.shift(); // apiId
+                lastRequests.failedRequests.shift(); // correlationId
+                lastRequests.errors.shift();
+            }
+            lastRequests.failedRequests.push(this.apiId, this.correlationId);
+            if (error instanceof Error && !!error && error.toString()) {
+                if (error instanceof AuthError) {
+                    if (error.subError) {
+                        lastRequests.errors.push(error.subError);
+                    }
+                    else if (error.errorCode) {
+                        lastRequests.errors.push(error.errorCode);
+                    }
+                    else {
+                        lastRequests.errors.push(error.toString());
+                    }
                 }
                 else {
                     lastRequests.errors.push(error.toString());
                 }
             }
             else {
-                lastRequests.errors.push(error.toString());
+                lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
             }
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         }
-        else {
-            lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
+        catch {
+            // Ignore telemetry cache failures to avoid masking the original auth error path.
         }
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return;
     }
     /**
@@ -7974,6 +8042,33 @@ class ServerTelemetryManager {
     static makeExtraSkuString(params) {
         return makeExtraSkuString(params);
     }
+}
+/** @internal */
+class StubServerTelemetryManager extends ServerTelemetryManager {
+    constructor() {
+        super({ clientId: "", apiId: 0, correlationId: "", forceRefresh: false }, {});
+    }
+    generateCurrentRequestHeaderValue() {
+        return "";
+    }
+    generateLastRequestHeaderValue() {
+        return "";
+    }
+    cacheFailedRequest() { }
+    incrementCacheHits() {
+        return 0;
+    }
+    clearTelemetryCache() { }
+    getRegionDiscoveryFields() {
+        return "";
+    }
+    updateRegionDiscoveryMetadata() { }
+    setCacheOutcome() { }
+    setNativeBrokerErrorCode() { }
+    getNativeBrokerErrorCode() {
+        return undefined;
+    }
+    clearNativeBrokerErrorCode() { }
 }
 
 exports.AADServerParamKeys = AADServerParamKeys;
@@ -8024,6 +8119,7 @@ exports.ServerTelemetryManager = ServerTelemetryManager;
 exports.SilentFlowClient = SilentFlowClient;
 exports.StringUtils = StringUtils;
 exports.StubPerformanceClient = StubPerformanceClient;
+exports.StubServerTelemetryManager = StubServerTelemetryManager;
 exports.StubbedNetworkModule = StubbedNetworkModule;
 exports.ThrottlingUtils = ThrottlingUtils;
 exports.TimeUtils = TimeUtils;
@@ -8054,4 +8150,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-DHSwXao8.js.map
+//# sourceMappingURL=index-node-CcOYLhxB.js.map