@azure/msal-node-extensions 5.2.1 → 5.2.3

package/dist/lib/msal-common/dist/utils/TimeUtils.mjs

@@ -1,6 +1,6 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 /**
  * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
  * @param seconds

package/dist/lib/msal-common/dist/utils/TimeUtils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"TimeUtils.mjs","sources":["../../../../../../../lib/msal-common/dist/utils/TimeUtils.mjs"],"sourcesContent":["/*! @azure/msal-common v16.6.1 2026-05-11 */\n'use strict';\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n/**\r\n * Utility functions for managing date and time operations.\r\n */\r\n/**\r\n * return the current time in Unix time (seconds).\r\n */\r\nfunction nowSeconds() {\r\n    // Date.getTime() returns in milliseconds.\r\n    return Math.round(new Date().getTime() / 1000.0);\r\n}\r\n/**\r\n * Converts JS Date object to seconds\r\n * @param date Date\r\n */\r\nfunction toSecondsFromDate(date) {\r\n    // Convert date to seconds\r\n    return date.getTime() / 1000;\r\n}\r\n/**\r\n * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).\r\n * @param seconds\r\n */\r\nfunction toDateFromSeconds(seconds) {\r\n    if (seconds) {\r\n        return new Date(Number(seconds) * 1000);\r\n    }\r\n    return new Date();\r\n}\r\n/**\r\n * check if a token is expired based on given UTC time in seconds.\r\n * @param expiresOn\r\n */\r\nfunction isTokenExpired(expiresOn, offset) {\r\n    // check for access token expiry\r\n    const expirationSec = Number(expiresOn) || 0;\r\n    const offsetCurrentTimeSec = nowSeconds() + offset;\r\n    // If current time + offset is greater than token expiration time, then token is expired.\r\n    return offsetCurrentTimeSec > expirationSec;\r\n}\r\n/**\r\n * Checks if a cache entry is expired based on the last updated time and cache retention days.\r\n * @param lastUpdatedAt\r\n * @param cacheRetentionDays\r\n * @returns\r\n */\r\nfunction isCacheExpired(lastUpdatedAt, cacheRetentionDays) {\r\n    const cacheExpirationTimestamp = Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1000;\r\n    return Date.now() > cacheExpirationTimestamp;\r\n}\r\n/**\r\n * If the current time is earlier than the time that a token was cached at, we must discard the token\r\n * i.e. The system clock was turned back after acquiring the cached token\r\n * @param cachedAt\r\n * @param offset\r\n */\r\nfunction wasClockTurnedBack(cachedAt) {\r\n    const cachedAtSec = Number(cachedAt);\r\n    return cachedAtSec > nowSeconds();\r\n}\r\n/**\r\n * Waits for t number of milliseconds\r\n * @param t number\r\n * @param value T\r\n */\r\nfunction delay(t, value) {\r\n    return new Promise((resolve) => setTimeout(() => resolve(value), t));\r\n}\n\nexport { delay, isCacheExpired, isTokenExpired, nowSeconds, toDateFromSeconds, toSecondsFromDate, wasClockTurnedBack };\n//# sourceMappingURL=TimeUtils.mjs.map\n"],"names":[],"mappings":";;AAAA;AAwBA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE;AACpC,IAAI,IAAI,OAAO,EAAE;AACjB,QAAQ,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AAChD,KAAK;AACL,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;AACtB;;;;"}
+{"version":3,"file":"TimeUtils.mjs","sources":["../../../../../../../lib/msal-common/dist/utils/TimeUtils.mjs"],"sourcesContent":["/*! @azure/msal-common v16.7.0 2026-06-05 */\n'use strict';\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n/**\r\n * Utility functions for managing date and time operations.\r\n */\r\n/**\r\n * return the current time in Unix time (seconds).\r\n */\r\nfunction nowSeconds() {\r\n    // Date.getTime() returns in milliseconds.\r\n    return Math.round(new Date().getTime() / 1000.0);\r\n}\r\n/**\r\n * Converts JS Date object to seconds\r\n * @param date Date\r\n */\r\nfunction toSecondsFromDate(date) {\r\n    // Convert date to seconds\r\n    return date.getTime() / 1000;\r\n}\r\n/**\r\n * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).\r\n * @param seconds\r\n */\r\nfunction toDateFromSeconds(seconds) {\r\n    if (seconds) {\r\n        return new Date(Number(seconds) * 1000);\r\n    }\r\n    return new Date();\r\n}\r\n/**\r\n * check if a token is expired based on given UTC time in seconds.\r\n * @param expiresOn\r\n */\r\nfunction isTokenExpired(expiresOn, offset) {\r\n    // check for access token expiry\r\n    const expirationSec = Number(expiresOn) || 0;\r\n    const offsetCurrentTimeSec = nowSeconds() + offset;\r\n    // If current time + offset is greater than token expiration time, then token is expired.\r\n    return offsetCurrentTimeSec > expirationSec;\r\n}\r\n/**\r\n * Checks if a cache entry is expired based on the last updated time and cache retention days.\r\n * @param lastUpdatedAt\r\n * @param cacheRetentionDays\r\n * @returns\r\n */\r\nfunction isCacheExpired(lastUpdatedAt, cacheRetentionDays) {\r\n    const cacheExpirationTimestamp = Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1000;\r\n    return Date.now() > cacheExpirationTimestamp;\r\n}\r\n/**\r\n * If the current time is earlier than the time that a token was cached at, we must discard the token\r\n * i.e. The system clock was turned back after acquiring the cached token\r\n * @param cachedAt\r\n * @param offset\r\n */\r\nfunction wasClockTurnedBack(cachedAt) {\r\n    const cachedAtSec = Number(cachedAt);\r\n    return cachedAtSec > nowSeconds();\r\n}\r\n/**\r\n * Waits for t number of milliseconds\r\n * @param t number\r\n * @param value T\r\n */\r\nfunction delay(t, value) {\r\n    return new Promise((resolve) => setTimeout(() => resolve(value), t));\r\n}\n\nexport { delay, isCacheExpired, isTokenExpired, nowSeconds, toDateFromSeconds, toSecondsFromDate, wasClockTurnedBack };\n//# sourceMappingURL=TimeUtils.mjs.map\n"],"names":[],"mappings":";;AAAA;AAwBA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE;AACpC,IAAI,IAAI,OAAO,EAAE;AACjB,QAAQ,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AAChD,KAAK;AACL,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;AACtB;;;;"}

package/dist/lock/CrossPlatformLock.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 import { promises } from 'fs';
 import { pid } from 'process';

package/dist/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-node-extensions";
-const version = "5.2.1";
+const version = "5.2.3";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist/persistence/BasePersistence.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 import { PersistenceError } from '../error/PersistenceError.mjs';
 import { Constants } from '../utils/Constants.mjs';

package/dist/persistence/DataProtectionScope.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/persistence/FilePersistence.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 import { promises } from 'fs';
 import { dirname } from 'path';
-import { ErrorCodes, Constants } from '../utils/Constants.mjs';
+import { Constants, ErrorCodes } from '../utils/Constants.mjs';
 import { PersistenceError } from '../error/PersistenceError.mjs';
 import { BasePersistence } from './BasePersistence.mjs';
 import { isNodeError } from '../utils/TypeGuards.mjs';
@@ -19,6 +19,10 @@ import { Logger, LogLevel } from '../lib/msal-common/dist/logger/Logger.mjs';
  * If file or directory has not been created, it FilePersistence.create() will create
  * file and any directories in the path recursively.
  */
+/** Owner read/write only (0o600) */
+const FILE_MODE = 0o600;
+/** Owner read/write/execute only (0o700) */
+const DIR_MODE = 0o700;
 class FilePersistence extends BasePersistence {
     constructor(fileLocation, loggerOptions) {
         super();
@@ -32,7 +36,17 @@ class FilePersistence extends BasePersistence {
     }
     async save(contents) {
         try {
-            await promises.writeFile(this.getFilePath(), contents, "utf-8");
+            // Tighten permissions before writing to close TOCTOU window on existing files
+            await promises.chmod(this.getFilePath(), FILE_MODE).catch((err) => {
+                if (!isNodeError(err) || err.code !== Constants.ENOENT_ERROR) {
+                    throw err;
+                }
+            });
+            await promises.writeFile(this.getFilePath(), contents, {
+                encoding: "utf-8",
+                mode: FILE_MODE,
+            });
+            await promises.chmod(this.getFilePath(), FILE_MODE);
         }
         catch (err) {
             if (isNodeError(err)) {
@@ -45,7 +59,16 @@ class FilePersistence extends BasePersistence {
     }
     async saveBuffer(contents) {
         try {
-            await promises.writeFile(this.getFilePath(), contents);
+            // Tighten permissions before writing to close TOCTOU window on existing files
+            await promises.chmod(this.getFilePath(), FILE_MODE).catch((err) => {
+                if (!isNodeError(err) || err.code !== Constants.ENOENT_ERROR) {
+                    throw err;
+                }
+            });
+            await promises.writeFile(this.getFilePath(), contents, {
+                mode: FILE_MODE,
+            });
+            await promises.chmod(this.getFilePath(), FILE_MODE);
         }
         catch (err) {
             if (isNodeError(err)) {
@@ -145,13 +168,17 @@ class FilePersistence extends BasePersistence {
     async createCacheFile() {
         await this.createFileDirectory();
         // File is created only if it does not exist
-        const fileHandle = await promises.open(this.filePath, "a");
+        const fileHandle = await promises.open(this.filePath, "a", FILE_MODE);
         await fileHandle.close();
+        await promises.chmod(this.filePath, FILE_MODE);
         this.logger.info(`File created at ${this.filePath}`, "");
     }
     async createFileDirectory() {
         try {
-            await promises.mkdir(dirname(this.filePath), { recursive: true });
+            await promises.mkdir(dirname(this.filePath), {
+                recursive: true,
+                mode: DIR_MODE,
+            });
         }
         catch (err) {
             if (isNodeError(err)) {

package/dist/persistence/FilePersistence.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"FilePersistence.mjs","sources":["../../src/persistence/FilePersistence.ts"],"sourcesContent":[null],"names":["fs"],"mappings":";;;;;;;;;;AAAA;;;AAGG;AAWH;;;;;;AAMG;AACG,MAAO,eAAgB,SAAQ,eAAe,CAAA;IAIhD,WAAoB,CAAA,YAAoB,EAAE,aAA6B,EAAA;AACnE,QAAA,KAAK,EAAE,CAAC;AACR,QAAA,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CACpB,aAAa,IAAI,eAAe,CAAC,0BAA0B,EAAE,CAChE,CAAC;AACF,QAAA,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;KAChC;AAEM,IAAA,aAAa,MAAM,CACtB,YAAoB,EACpB,aAA6B,EAAA;QAE7B,MAAM,eAAe,GAAG,IAAI,eAAe,CACvC,YAAY,EACZ,aAAa,CAChB,CAAC;AACF,QAAA,MAAM,eAAe,CAAC,eAAe,EAAE,CAAC;AACxC,QAAA,OAAO,eAAe,CAAC;KAC1B;IAEM,MAAM,IAAI,CAAC,QAAgB,EAAA;QAC9B,IAAI;AACA,YAAA,MAAMA,QAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC7D,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;IAEM,MAAM,UAAU,CAAC,QAAoB,EAAA;QACxC,IAAI;YACA,MAAMA,QAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;AACpD,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AAEM,IAAA,MAAM,IAAI,GAAA;QACb,IAAI;AACA,YAAA,OAAO,MAAMA,QAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;AACzD,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AAEM,IAAA,MAAM,UAAU,GAAA;QACnB,IAAI;YACA,OAAO,MAAMA,QAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAChD,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AAEM,IAAA,MAAM,MAAM,GAAA;QACf,IAAI;YACA,MAAMA,QAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACpC,YAAA,OAAO,IAAI,CAAC;AACf,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,EAAE;;oBAErC,IAAI,CAAC,MAAM,CAAC,OAAO,CACf,uDAAuD,EACvD,EAAE,CACL,CAAC;AACF,oBAAA,OAAO,KAAK,CAAC;AAChB,iBAAA;AACD,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;IAEM,WAAW,GAAA;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC;KACxB;IAEM,MAAM,eAAe,CAAC,QAAgB,EAAA;QACzC,OAAO,QAAQ,IAAI,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;KACrD;IAEM,SAAS,GAAA;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC;KACtB;IAEM,8BAA8B,GAAA;QACjC,MAAM,qBAAqB,GAAG,CAAA,EAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA,WAAA,CAAa,CAAC;AACrE,QAAA,OAAO,eAAe,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;KACxD;AAEO,IAAA,OAAO,0BAA0B,GAAA;QACrC,OAAO;YACH,cAAc,EAAE,MAAK;;aAEpB;AACD,YAAA,iBAAiB,EAAE,KAAK;YACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI;SAC1B,CAAC;KACL;AAEO,IAAA,MAAM,gBAAgB,GAAA;QAC1B,IAAI;YACA,MAAM,KAAK,GAAG,MAAMA,QAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3C,YAAA,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AAChC,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,EAAE;;oBAErC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;AACrD,oBAAA,OAAO,CAAC,CAAC;AACZ,iBAAA;AACD,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AAEO,IAAA,MAAM,eAAe,GAAA;AACzB,QAAA,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;;AAEjC,QAAA,MAAM,UAAU,GAAG,MAAMA,QAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACrD,QAAA,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;AACzB,QAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA,gBAAA,EAAmB,IAAI,CAAC,QAAQ,CAAA,CAAE,EAAE,EAAE,CAAC,CAAC;KAC5D;AAEO,IAAA,MAAM,mBAAmB,GAAA;QAC7B,IAAI;AACA,YAAA,MAAMA,QAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,EAAE;AACrC,oBAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,aAAa,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA,gBAAA,CAAkB,EACrD,EAAE,CACL,CAAC;AACL,iBAAA;AAAM,qBAAA;AACH,oBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,iBAAA;AACJ,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AACJ;;;;"}
+{"version":3,"file":"FilePersistence.mjs","sources":["../../src/persistence/FilePersistence.ts"],"sourcesContent":[null],"names":["fs"],"mappings":";;;;;;;;;;AAAA;;;AAGG;AAWH;;;;;;AAMG;AACH;AACA,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB;AACA,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEjB,MAAO,eAAgB,SAAQ,eAAe,CAAA;IAIhD,WAAoB,CAAA,YAAoB,EAAE,aAA6B,EAAA;AACnE,QAAA,KAAK,EAAE,CAAC;AACR,QAAA,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CACpB,aAAa,IAAI,eAAe,CAAC,0BAA0B,EAAE,CAChE,CAAC;AACF,QAAA,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;KAChC;AAEM,IAAA,aAAa,MAAM,CACtB,YAAoB,EACpB,aAA6B,EAAA;QAE7B,MAAM,eAAe,GAAG,IAAI,eAAe,CACvC,YAAY,EACZ,aAAa,CAChB,CAAC;AACF,QAAA,MAAM,eAAe,CAAC,eAAe,EAAE,CAAC;AACxC,QAAA,OAAO,eAAe,CAAC;KAC1B;IAEM,MAAM,IAAI,CAAC,QAAgB,EAAA;QAC9B,IAAI;;AAEA,YAAA,MAAMA,QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAI;AACxD,gBAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,EAAE;AAC1D,oBAAA,MAAM,GAAG,CAAC;AACb,iBAAA;AACL,aAAC,CAAC,CAAC;YACH,MAAMA,QAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE;AAC7C,gBAAA,QAAQ,EAAE,OAAO;AACjB,gBAAA,IAAI,EAAE,SAAS;AAClB,aAAA,CAAC,CAAC;YACH,MAAMA,QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;AACjD,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;IAEM,MAAM,UAAU,CAAC,QAAoB,EAAA;QACxC,IAAI;;AAEA,YAAA,MAAMA,QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAI;AACxD,gBAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,EAAE;AAC1D,oBAAA,MAAM,GAAG,CAAC;AACb,iBAAA;AACL,aAAC,CAAC,CAAC;YACH,MAAMA,QAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE;AAC7C,gBAAA,IAAI,EAAE,SAAS;AAClB,aAAA,CAAC,CAAC;YACH,MAAMA,QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;AACjD,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AAEM,IAAA,MAAM,IAAI,GAAA;QACb,IAAI;AACA,YAAA,OAAO,MAAMA,QAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;AACzD,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AAEM,IAAA,MAAM,UAAU,GAAA;QACnB,IAAI;YACA,OAAO,MAAMA,QAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAChD,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AAEM,IAAA,MAAM,MAAM,GAAA;QACf,IAAI;YACA,MAAMA,QAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACpC,YAAA,OAAO,IAAI,CAAC;AACf,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,EAAE;;oBAErC,IAAI,CAAC,MAAM,CAAC,OAAO,CACf,uDAAuD,EACvD,EAAE,CACL,CAAC;AACF,oBAAA,OAAO,KAAK,CAAC;AAChB,iBAAA;AACD,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;IAEM,WAAW,GAAA;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC;KACxB;IAEM,MAAM,eAAe,CAAC,QAAgB,EAAA;QACzC,OAAO,QAAQ,IAAI,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;KACrD;IAEM,SAAS,GAAA;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC;KACtB;IAEM,8BAA8B,GAAA;QACjC,MAAM,qBAAqB,GAAG,CAAA,EAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA,WAAA,CAAa,CAAC;AACrE,QAAA,OAAO,eAAe,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;KACxD;AAEO,IAAA,OAAO,0BAA0B,GAAA;QACrC,OAAO;YACH,cAAc,EAAE,MAAK;;aAEpB;AACD,YAAA,iBAAiB,EAAE,KAAK;YACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI;SAC1B,CAAC;KACL;AAEO,IAAA,MAAM,gBAAgB,GAAA;QAC1B,IAAI;YACA,MAAM,KAAK,GAAG,MAAMA,QAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3C,YAAA,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AAChC,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,EAAE;;oBAErC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;AACrD,oBAAA,OAAO,CAAC,CAAC;AACZ,iBAAA;AACD,gBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AAEO,IAAA,MAAM,eAAe,GAAA;AACzB,QAAA,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;;AAEjC,QAAA,MAAM,UAAU,GAAG,MAAMA,QAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;AAChE,QAAA,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QACzB,MAAMA,QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACzC,QAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA,gBAAA,EAAmB,IAAI,CAAC,QAAQ,CAAA,CAAE,EAAE,EAAE,CAAC,CAAC;KAC5D;AAEO,IAAA,MAAM,mBAAmB,GAAA;QAC7B,IAAI;YACA,MAAMA,QAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;AACnC,gBAAA,SAAS,EAAE,IAAI;AACf,gBAAA,IAAI,EAAE,QAAQ;AACjB,aAAA,CAAC,CAAC;AACN,SAAA;AAAC,QAAA,OAAO,GAAG,EAAE;AACV,YAAA,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AAClB,gBAAA,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,EAAE;AACrC,oBAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,aAAa,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA,gBAAA,CAAkB,EACrD,EAAE,CACL,CAAC;AACL,iBAAA;AAAM,qBAAA;AACH,oBAAA,MAAM,gBAAgB,CAAC,qBAAqB,CACxC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAC9B,GAAG,CAAC,OAAO,CACd,CAAC;AACL,iBAAA;AACJ,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,GAAG,CAAC;AACb,aAAA;AACJ,SAAA;KACJ;AACJ;;;;"}

package/dist/persistence/FilePersistenceWithDataProtection.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 import { FilePersistence } from './FilePersistence.mjs';
 import { PersistenceError } from '../error/PersistenceError.mjs';

package/dist/persistence/KeychainPersistence.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 import keytar from 'keytar';
 import { FilePersistence } from './FilePersistence.mjs';

package/dist/persistence/LibSecretPersistence.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 import keytar from 'keytar';
 import { FilePersistence } from './FilePersistence.mjs';

package/dist/persistence/PersistenceCachePlugin.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 import { CrossPlatformLock } from '../lock/CrossPlatformLock.mjs';
 import { pid } from 'process';

package/dist/persistence/PersistenceCreator.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 import { FilePersistenceWithDataProtection } from './FilePersistenceWithDataProtection.mjs';
 import { LibSecretPersistence } from './LibSecretPersistence.mjs';

package/dist/utils/Constants.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/Environment.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 import path from 'path';
 import { Constants, Platform } from './Constants.mjs';

package/dist/utils/TypeGuards.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/lib/msal-node-extensions.cjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node-extensions v5.2.1 2026-05-11 */
+/*! @azure/msal-node-extensions v5.2.3 2026-06-05 */
 'use strict';
 'use strict';
 
@@ -343,7 +343,7 @@ class PersistenceCachePlugin {
     }
 }
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 /**
  * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
  * prompt values kept changing over past couple of years. There are some undocumented prompt values for some
@@ -380,11 +380,11 @@ const CacheOutcome = {
     // When a token is found in the cache or the cache is not supposed to be hit when making the request
     NOT_APPLICABLE: "0"};
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
 const RESOURCE = "resource";
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -412,7 +412,7 @@ class AuthError extends Error {
     }
 }
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -432,7 +432,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -455,16 +455,16 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 const untrustedAuthority = "untrusted_authority";
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 const noAccountFound = "no_account_found";
 const noNetworkConnectivity = "no_network_connectivity";
 const userCanceled = "user_canceled";
 const platformBrokerError = "platform_broker_error";
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -725,7 +725,7 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 /**
  * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
  * @param seconds
@@ -737,7 +737,7 @@ function toDateFromSeconds(seconds) {
     return new Date();
 }
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 /**
  * Error thrown when user interaction is required.
  */
@@ -754,7 +754,7 @@ class InteractionRequiredAuthError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -773,7 +773,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -818,7 +818,7 @@ class PlatformBrokerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1119,6 +1119,10 @@ class BasePersistence {
  * If file or directory has not been created, it FilePersistence.create() will create
  * file and any directories in the path recursively.
  */
+/** Owner read/write only (0o600) */
+const FILE_MODE = 0o600;
+/** Owner read/write/execute only (0o700) */
+const DIR_MODE = 0o700;
 class FilePersistence extends BasePersistence {
     constructor(fileLocation, loggerOptions) {
         super();
@@ -1132,7 +1136,17 @@ class FilePersistence extends BasePersistence {
     }
     async save(contents) {
         try {
-            await fs.promises.writeFile(this.getFilePath(), contents, "utf-8");
+            // Tighten permissions before writing to close TOCTOU window on existing files
+            await fs.promises.chmod(this.getFilePath(), FILE_MODE).catch((err) => {
+                if (!isNodeError(err) || err.code !== Constants.ENOENT_ERROR) {
+                    throw err;
+                }
+            });
+            await fs.promises.writeFile(this.getFilePath(), contents, {
+                encoding: "utf-8",
+                mode: FILE_MODE,
+            });
+            await fs.promises.chmod(this.getFilePath(), FILE_MODE);
         }
         catch (err) {
             if (isNodeError(err)) {
@@ -1145,7 +1159,16 @@ class FilePersistence extends BasePersistence {
     }
     async saveBuffer(contents) {
         try {
-            await fs.promises.writeFile(this.getFilePath(), contents);
+            // Tighten permissions before writing to close TOCTOU window on existing files
+            await fs.promises.chmod(this.getFilePath(), FILE_MODE).catch((err) => {
+                if (!isNodeError(err) || err.code !== Constants.ENOENT_ERROR) {
+                    throw err;
+                }
+            });
+            await fs.promises.writeFile(this.getFilePath(), contents, {
+                mode: FILE_MODE,
+            });
+            await fs.promises.chmod(this.getFilePath(), FILE_MODE);
         }
         catch (err) {
             if (isNodeError(err)) {
@@ -1245,13 +1268,17 @@ class FilePersistence extends BasePersistence {
     async createCacheFile() {
         await this.createFileDirectory();
         // File is created only if it does not exist
-        const fileHandle = await fs.promises.open(this.filePath, "a");
+        const fileHandle = await fs.promises.open(this.filePath, "a", FILE_MODE);
         await fileHandle.close();
+        await fs.promises.chmod(this.filePath, FILE_MODE);
         this.logger.info(`File created at ${this.filePath}`, "");
     }
     async createFileDirectory() {
         try {
-            await fs.promises.mkdir(path.dirname(this.filePath), { recursive: true });
+            await fs.promises.mkdir(path.dirname(this.filePath), {
+                recursive: true,
+                mode: DIR_MODE,
+            });
         }
         catch (err) {
             if (isNodeError(err)) {
@@ -1702,7 +1729,7 @@ class PersistenceCreator {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-node-extensions";
-const version = "5.2.1";
+const version = "5.2.3";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.