@equinor/fusion-framework-vite-plugin-spa 4.0.17 → 4.1.0

package/dist/index-B_3FYBBq.js

@@ -0,0 +1,879 @@
+import { a5 as MsalConfigurator, a6 as module$1 } from './module-w44_1T9j.js';
+
+/**
+ * Encodes a value as base64url without padding, as used in JWT segments.
+ *
+ * @param value - Raw string to encode.
+ * @returns The base64url representation.
+ */
+const base64Url = (value) => {
+    // btoa operates on latin1; encodeURIComponent round-trip keeps non-ASCII names intact
+    const bytes = new TextEncoder().encode(value);
+    let binary = '';
+    // Iterate over encoded bytes so Unicode claims are preserved before base64url encoding.
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+/**
+ * Creates a structurally valid, unsigned JWT for use in tests.
+ *
+ * The token has three base64url segments and decodes to the supplied claims, so
+ * code that splits, decodes, or inspects token claims behaves exactly as it does
+ * in production. The signature segment is a fixed placeholder — the token is
+ * **not** cryptographically valid and will be rejected by any real service.
+ *
+ * @remarks
+ * Timestamps default to a fixed issue time and a one-hour lifetime so repeated
+ * runs produce byte-identical tokens. A test that needs an expired token can set
+ * `exp` in the past.
+ *
+ * @param claims - Claims to embed in the token payload.
+ * @returns An unsigned JWT string in `header.payload.signature` form.
+ *
+ * @example
+ * ```typescript
+ * const token = createMockToken({ name: 'Test User', scp: 'Files.Read' });
+ * const [, payload] = token.split('.');
+ * JSON.parse(decodeJwtSegment(payload)).name; // 'Test User'
+ * ```
+ */
+const createMockToken = (claims = {}) => {
+    const header = { alg: 'none', typ: 'JWT' };
+    // Fixed default clock keeps generated tokens byte-identical between runs
+    const issuedAt = claims.iat ?? 1_700_000_000;
+    const payload = {
+        iss: 'https://login.microsoftonline.com/fusion-test-tenant/v2.0',
+        aud: 'fusion-test-client',
+        tid: 'fusion-test-tenant',
+        oid: 'fusion-test-user',
+        iat: issuedAt,
+        nbf: issuedAt,
+        exp: issuedAt + 3600,
+        ...claims,
+    };
+    return [
+        base64Url(JSON.stringify(header)),
+        base64Url(JSON.stringify(payload)),
+        'fusion-test-signature',
+    ].join('.');
+};
+
+/**
+ * A stand-in for the MSAL client that resolves tokens in-process.
+ *
+ * @remarks
+ * Constructed from {@link MsalClientConfig} — the very same argument
+ * {@link MsalClient} takes — so it is a drop-in substitute rather than a second
+ * API to learn. `setClientConfig` therefore means the same thing whether a test
+ * runs against Entra ID or against this client.
+ *
+ * Only the boundary that would contact Entra ID is replaced. The real
+ * `MsalProvider` runs on top of it unchanged, so account handling, silent-token
+ * preference, scope resolution, proxy providers and telemetry behave as they do in
+ * production — the test exercises the framework rather than the mock.
+ *
+ * Tokens are structurally valid, unsigned JWTs and are byte-identical between runs.
+ * They are **not** cryptographically valid and are rejected by any real service.
+ */
+class MsalMockClient {
+    #user;
+    #cache = new Map();
+    #activeAccountId = null;
+    #token = null;
+    /**
+     * The account currently signed in, or `null`.
+     *
+     * @remarks
+     * Reads through the cache rather than holding an account of its own, so an
+     * account removed by a sign-out cannot linger as the active one.
+     *
+     * @returns The cached active account, or `null` when none is active.
+     */
+    get #account() {
+        return this.#activeAccountId ? (this.#cache.get(this.#activeAccountId) ?? null) : null;
+    }
+    /**
+     * Signs an account in, adding it to the cache and making it active.
+     *
+     * @param account - The account to sign in.
+     * @returns The signed-in account.
+     */
+    #signIn(account) {
+        this.#cache.set(account.homeAccountId, account);
+        this.#activeAccountId = account.homeAccountId;
+        return account;
+    }
+    /**
+     * Signs the active account out, as MSAL does — the account leaves the cache.
+     */
+    #signOut() {
+        // Only clear the cache entry when a session is active; this preserves an already signed-out state.
+        if (this.#activeAccountId) {
+            this.#cache.delete(this.#activeAccountId);
+            this.#activeAccountId = null;
+        }
+    }
+    /**
+     * Mirrors MSAL's redirect completion, which is a no-op for this in-process mock.
+     * @returns Always `null`, because the mock performs no redirect.
+     */
+    async handleRedirectPromise() {
+        return null;
+    }
+    /**
+     * Mirrors silent SSO and returns a token for the cached mock account.
+     * @param request - Silent SSO options and requested scopes.
+     * @returns A mock authentication result.
+     * @throws When no account is cached.
+     */
+    async ssoSilent(request) {
+        // Silent SSO must fail without a session so providers exercise their login path.
+        if (!this.#account) {
+            throw new Error('MsalMockClient: no cached account for silent sign-in');
+        }
+        return this.#createResult(request.scopes);
+    }
+    /**
+     * Mirrors popup login by signing in the configured mock user immediately.
+     * @param request - Optional popup options and requested scopes.
+     * @returns A mock authentication result.
+     */
+    async loginPopup(request) {
+        this.#signIn(this.#createAccount());
+        return this.#createResult(request?.scopes);
+    }
+    /**
+     * Mirrors redirect login without navigating, because the mock has no browser boundary.
+     * @param _request - Redirect options, accepted for interface compatibility.
+     */
+    async loginRedirect(_request) {
+        this.#signIn(this.#createAccount());
+    }
+    /**
+     * Mirrors the framework login entry point with an immediate mock sign-in.
+     * @param options - Login options including the requested scopes.
+     * @returns A mock login result.
+     */
+    async login(options) {
+        this.#signIn(this.#createAccount());
+        return this.#createResult(options.request?.scopes);
+    }
+    /** Mirrors logout by removing the active mock account from the cache. */
+    async logout() {
+        this.#signOut();
+    }
+    /**
+     * Mirrors MSAL initialization without performing a network handshake.
+     * @param _request - Initialization options, accepted for interface compatibility.
+     */
+    async initialize(_request) {
+        // No network handshake to perform
+    }
+    /**
+     * Mirrors popup token acquisition using the mock login flow.
+     * @param request - Popup token request.
+     * @returns A mock authentication result.
+     */
+    async acquireTokenPopup(request) {
+        return this.loginPopup(request);
+    }
+    /**
+     * Mirrors redirect token acquisition without browser navigation.
+     * @param request - Redirect token request.
+     */
+    async acquireTokenRedirect(request) {
+        return this.loginRedirect(request);
+    }
+    /**
+     * Mirrors silent token acquisition for the cached mock account.
+     * @param request - Silent token request.
+     * @returns A mock authentication result.
+     * @throws When no account is cached.
+     */
+    async acquireTokenSilent(request) {
+        // Silent acquisition must fail without a session, matching the real MSAL boundary.
+        if (!this.#account) {
+            throw new Error('MsalMockClient: no cached account for silent sign-in');
+        }
+        return this.#createResult(request.scopes);
+    }
+    /**
+     * Mirrors MSAL event registration; events are intentionally not emitted by the mock.
+     * @param _callback - Event handler, accepted for interface compatibility.
+     * @param _eventTypes - Event types, accepted for interface compatibility.
+     * @returns Always `null`, because the mock registers no callback.
+     */
+    addEventCallback(_callback, _eventTypes) {
+        return null;
+    }
+    /**
+     * Mirrors event removal as a no-op because this mock registers no callbacks.
+     * @param _callbackId - Callback identifier, accepted for interface compatibility.
+     */
+    removeEventCallback(_callbackId) {
+        // No-op for mock
+    }
+    /**
+     * Mirrors performance callback registration with a stable mock identifier.
+     * @param _callback - Performance handler, accepted for interface compatibility.
+     * @returns A stable mock callback identifier.
+     */
+    addPerformanceCallback(_callback) {
+        return 'mock-performance-callback';
+    }
+    /**
+     * Mirrors performance callback removal and reports successful mock removal.
+     * @param _callbackId - Callback identifier, accepted for interface compatibility.
+     * @returns Always `true` because no callback state is retained.
+     */
+    removePerformanceCallback(_callbackId) {
+        return true;
+    }
+    /**
+     * Mirrors MSAL account lookup against the mock cache.
+     * @param accountFilter - Account fields to match.
+     * @returns The first matching account, or `null`.
+     */
+    getAccount(accountFilter) {
+        const filter = (accountFilter ?? {});
+        // Filter the cache so callers observe the same account-selection semantics as MSAL.
+        const matches = this.getAllAccounts().filter((account) => (filter.homeAccountId === undefined || filter.homeAccountId === account.homeAccountId) &&
+            (filter.localAccountId === undefined || filter.localAccountId === account.localAccountId) &&
+            (filter.username === undefined || filter.username === account.username) &&
+            (filter.tenantId === undefined || filter.tenantId === account.tenantId));
+        return matches[0] ?? null;
+    }
+    /**
+     * Mirrors MSAL account enumeration using the mock cache.
+     * @param _accountFilter - Account filter, accepted for interface compatibility.
+     * @returns All accounts currently in the mock cache.
+     */
+    getAllAccounts(_accountFilter) {
+        return [...this.#cache.values()];
+    }
+    /**
+     * Mirrors redirect logout without navigating in the mock environment.
+     * @param _request - Logout options, accepted for interface compatibility.
+     */
+    async logoutRedirect(_request) {
+        this.#signOut();
+    }
+    /**
+     * Mirrors popup logout without opening a browser window.
+     * @param _request - Logout options, accepted for interface compatibility.
+     */
+    async logoutPopup(_request) {
+        this.#signOut();
+    }
+    /**
+     * Mirrors MSAL logger access; the mock does not retain a logger.
+     * @returns An interface-compatible empty logger value.
+     */
+    getLogger() {
+        // MSAL's Logger has a large internal surface with no mock consumers depend on; callers only pass it through
+        return undefined;
+    }
+    /**
+     * Mirrors logger configuration as a no-op for the mock.
+     * @param _logger - Logger, accepted for interface compatibility.
+     */
+    setLogger(_logger) {
+        // No-op for mock
+    }
+    /**
+     * Mirrors wrapper metadata initialization as a no-op for the mock.
+     * @param _sku - Wrapper identifier, accepted for interface compatibility.
+     * @param _version - Wrapper version, accepted for interface compatibility.
+     */
+    initializeWrapperLibrary(_sku, _version) {
+        // No-op for mock wrapper
+    }
+    /**
+     * Mirrors navigation-client configuration as a no-op because no navigation occurs.
+     * @param _navigationClient - Navigation client, accepted for interface compatibility.
+     */
+    setNavigationClient(_navigationClient) {
+        // No-op for mock
+    }
+    /**
+     * Mirrors configuration access and rejects it because the mock has no browser config.
+     * @returns Never; this mock does not expose browser configuration.
+     * @throws Always, because browser configuration is unsupported.
+     */
+    getConfiguration() {
+        throw new Error('MsalMockClient: getConfiguration is not supported in the mock client');
+    }
+    /**
+     * Mirrors cache hydration as a no-op because mock tokens are created in-process.
+     * @param _result - Authentication result, accepted for interface compatibility.
+     * @param _request - Original token request, accepted for interface compatibility.
+     */
+    async hydrateCache(_result, _request) {
+        // No-op for mock
+    }
+    /**
+     * Mirrors MSAL cache clearing by removing every mock account.
+     * @param _request - Cache-clear options, accepted for interface compatibility.
+     */
+    async clearCache(_request) {
+        this.#cache.clear();
+        this.#activeAccountId = null;
+    }
+    /**
+     * Mirrors the generic token acquisition entry point for the active mock account.
+     * @param options - Token acquisition options.
+     * @returns A mock result, or `null` without an active account.
+     */
+    async acquireToken(options) {
+        // Generic acquisition returns no result when no account is active, matching MSAL's nullable result.
+        if (!this.#account) {
+            return null;
+        }
+        return this.#createResult(options.request?.scopes);
+    }
+    /**
+     * Mirrors authorization-code exchange by signing in and returning a mock result.
+     * @param request - Authorization-code request.
+     * @returns A mock authentication result.
+     */
+    async acquireTokenByCode(request) {
+        this.#signIn(this.#createAccount());
+        return this.#createResult(request?.scopes);
+    }
+    /**
+     * Creates a mock client for the services the given configuration points at.
+     *
+     * @remarks
+     * Takes the same argument as {@link MsalClient}. A user named `Test User` is
+     * already in the account cache, so a provider built on this client boots the
+     * way one does for a returning user with a live session — no sign-in runs, and
+     * the provider's start-up path sees the state it would see in production. Use
+     * {@link MsalMockClient.setUser | setUser} to say who that user is.
+     *
+     * @param config - The same client configuration the real client is built from.
+     */
+    constructor(config) {
+        const tenantId = config.auth.tenantId ?? MsalMockClient.#tenantFromAuthority(config.auth);
+        this.#user = {
+            name: 'Test User',
+            username: 'test.user@equinor.com',
+            userId: 'fusion-mock-user',
+            tenantId: tenantId ?? 'fusion-mock-tenant',
+            scopes: ['fusion-mock-scope'],
+            clientId: config.auth.clientId,
+        };
+        this.#signIn(this.#createAccount());
+    }
+    /**
+     * Reads the tenant out of an authority URL.
+     *
+     * @remarks
+     * A configuration may carry only `authority`, in which case the tenant still
+     * has to end up on the tokens this client mints for the account to look like
+     * the one a real sign-in would have produced.
+     *
+     * @param auth - The auth section of the client configuration.
+     * @returns The tenant, or `undefined` when the authority carries none.
+     */
+    static #tenantFromAuthority(auth) {
+        // An explicit tenant takes precedence; only parse authority when configuration omitted it.
+        if (!auth.authority) {
+            return undefined;
+        }
+        try {
+            // Remove empty URL path segments to identify the authority's tenant consistently.
+            const segments = new URL(auth.authority).pathname.split('/').filter(Boolean);
+            return segments.at(-1);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Returns the client identifier used by tokens minted by this mock.
+     * @returns The configured client identifier.
+     */
+    get clientId() {
+        return this.#user.clientId;
+    }
+    /**
+     * Returns the tenant identifier used by tokens minted by this mock.
+     * @returns The configured tenant identifier.
+     */
+    get tenantId() {
+        return this.#user.tenantId;
+    }
+    /**
+     * Reports whether the mock currently has an active account.
+     * @returns Whether an account is active.
+     */
+    get hasValidClaims() {
+        return this.#account !== null;
+    }
+    /**
+     * Mirrors MSAL active-account access using the mock's single active account.
+     * @returns The active account, or `null`.
+     */
+    getActiveAccount() {
+        return this.#account;
+    }
+    /**
+     * Makes an account the active one, adding it to the cache if it is unknown.
+     *
+     * @remarks
+     * Real MSAL requires the account to already be cached. Accepting an unknown
+     * one is a deliberate concession to tests: it is the shortest way to swap the
+     * signed-in user between runs, without reconstructing the framework.
+     *
+     * @param next - The account to make active, or `null` to sign out.
+     */
+    setActiveAccount(next) {
+        // A null account is the MSAL sign-out signal, so clear the active mock session.
+        if (!next) {
+            this.#signOut();
+            return;
+        }
+        this.#signIn(next);
+    }
+    /**
+     * Declares who is signed in, replacing whoever was.
+     *
+     * @remarks
+     * This is the counterpart to a real sign-in: the client is configured with
+     * what it talks to, and learns the user separately. `MsalMockConfigurator`
+     * applies it as the configuration is assembled, so the account is in the cache
+     * before `MsalProvider.initialize` runs — the provider then behaves as it does
+     * for a returning user with a live session.
+     *
+     * Values left out keep whatever they were. Passing `null` signs out and
+     * forgets the identity, so the provider follows its unauthenticated path;
+     * `{ signedOut: true }` does the same but keeps the identity, so a later login
+     * resolves as that user.
+     *
+     * @param user - The user to sign in, or `null` when nobody is.
+     */
+    setUser(user) {
+        // Declaring a user replaces the session rather than adding to it, so a test
+        // that names a second user does not silently end up with two cached accounts
+        this.#cache.clear();
+        this.#activeAccountId = null;
+        // A null user explicitly clears the session and identity supplied to the mock.
+        if (!user) {
+            return;
+        }
+        const { account, signedOut, ...rest } = user;
+        // Merge overrides while retaining defaults for fields omitted by the test.
+        this.#user = {
+            ...this.#user,
+            ...rest,
+            name: rest.name ?? account?.name ?? this.#user.name,
+            username: rest.username ?? account?.username ?? this.#user.username,
+            userId: rest.userId ?? account?.localAccountId ?? this.#user.userId,
+            tenantId: rest.tenantId ?? account?.tenantId ?? this.#user.tenantId,
+            scopes: rest.scopes ?? this.#user.scopes,
+        };
+        // Keep identity data without caching an account when the test starts signed out.
+        if (signedOut) {
+            return;
+        }
+        this.#signIn(account ?? this.#createAccount());
+    }
+    /**
+     * Overrides the token returned by future results, independent of who is signed in.
+     *
+     * @remarks
+     * Use this when a backend mock validates its own tokens (specific claims, an
+     * audience, or a signature) — supplying the exact token here means that
+     * backend sees the token it issued, rather than a mock-shaped substitute this
+     * client would otherwise fabricate from the signed-in user's fields.
+     *
+     * @param token - The token to return verbatim, or `null` to resume generating one.
+     */
+    setToken(token) {
+        this.#token = token;
+    }
+    /**
+     * Creates the one account represented by this mock's configured identity.
+     * @returns An MSAL-shaped account for the configured user.
+     */
+    #createAccount() {
+        return {
+            homeAccountId: `${this.#user.userId}.${this.#user.tenantId}`,
+            localAccountId: this.#user.userId,
+            environment: 'login.microsoftonline.com',
+            tenantId: this.#user.tenantId,
+            username: this.#user.username,
+            name: this.#user.name,
+        };
+    }
+    /**
+     * Creates an MSAL-shaped token result for the requested or default scopes.
+     * @param scopes - Requested scopes, or the user's configured defaults.
+     * @returns An MSAL-shaped mock authentication result.
+     */
+    #createResult(scopes) {
+        const granted = scopes?.length ? scopes : this.#user.scopes;
+        // a caller-supplied token is sent verbatim so a backend mock validating it sees what it expects
+        const token = this.#token ??
+            createMockToken({
+                name: this.#user.name,
+                preferred_username: this.#user.username,
+                oid: this.#user.userId,
+                tid: this.#user.tenantId,
+                aud: this.#user.clientId,
+                scp: granted.join(' '),
+            });
+        // Object shape matches AuthenticationResult's fields consumers rely on; the real
+        // type also carries browser-only fields (e.g. `familyId`) this mock intentionally omits
+        return {
+            account: this.#account ?? this.#createAccount(),
+            accessToken: token,
+            idToken: token,
+            scopes: granted,
+            tokenType: 'Bearer',
+            expiresOn: new Date('2033-11-14T22:13:20.000Z'),
+            authority: `https://login.microsoftonline.com/${this.#user.tenantId}`,
+            uniqueId: this.#user.userId,
+            tenantId: this.#user.tenantId,
+            fromCache: false,
+            correlationId: 'fusion-mock-correlation',
+        };
+    }
+}
+
+/**
+ * Decodes a base64url segment of a {@link createMockToken} JWT back to its JSON string.
+ *
+ * @remarks
+ * Plain `atob` alone mangles non-ASCII claims: it treats its output as latin1,
+ * while segments are UTF-8 encoded. This reverses that encoding and also
+ * restores the standard base64 alphabet/padding `atob` expects.
+ *
+ * @param segment - A base64url segment, e.g. from splitting a JWT on `.`.
+ * @returns The decoded UTF-8 string.
+ */
+function decodeJwtSegment(segment) {
+    const base64 = segment
+        .replace(/-/g, '+')
+        .replace(/_/g, '/')
+        .padEnd(segment.length + ((4 - (segment.length % 4)) % 4), '=');
+    const binary = atob(base64);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+}
+
+/**
+ * Derives a {@link MsalMockUser} from a JWT's payload claims, so a token minted
+ * outside this module (e.g. by a backend's own mock) can drive who the mock
+ * signs in as.
+ *
+ * @remarks
+ * Maps the standard Entra ID claims Fusion applications read — `name`,
+ * `preferred_username`, `oid`, `tid`, `scp` — onto the matching
+ * {@link MsalMockUser} fields. Identity only: it does not affect which token
+ * the client returns — use {@link MsalMockConfigurator.setToken} for that.
+ *
+ * @param token - A JWT (e.g. from {@link createMockToken}, or issued by an
+ * external mock) with a base64url-encoded payload segment.
+ * @returns A mock user built from the token's claims.
+ * @throws When the token has no payload segment (`header.payload.signature`).
+ *
+ * @example
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setAccount(createMockUserFromToken(token));
+ * });
+ * ```
+ */
+const createMockUserFromToken = (token) => {
+    const [, payload] = token.split('.');
+    // fail loudly rather than signing in an empty/garbage user from a malformed token
+    if (!payload) {
+        throw new Error('createMockUserFromToken: expected a JWT with a payload segment (header.payload.signature)');
+    }
+    const claims = JSON.parse(decodeJwtSegment(payload));
+    return {
+        name: claims.name,
+        username: claims.preferred_username,
+        userId: claims.oid,
+        tenantId: claims.tid,
+        scopes: claims.scp?.split(' '),
+    };
+};
+
+/**
+ * The client configuration used when a test declares none.
+ *
+ * @remarks
+ * `MsalClientConfig.auth.clientId` is required, so a mock still needs a client
+ * configuration to exist. Supplying a default is what lets an application boot
+ * under test without declaring credentials it does not have.
+ */
+const defaultMockClientConfig = {
+    auth: {
+        clientId: 'fusion-mock-client',
+        tenantId: 'fusion-mock-tenant',
+    },
+};
+/**
+ * The real MSAL configurator, backed by an in-process client.
+ *
+ * @remarks
+ * Nothing else changes: the same builder API, the same validation and the same
+ * `MsalProvider` are used. Only the boundary that would contact Entra ID is
+ * substituted, through the same
+ * {@link MsalConfigurator._createClient | _createClient} seam the real
+ * configurator builds its own client from — and from the same
+ * {@link MsalConfigurator._createClientConfig | _createClientConfig}, so
+ * `setClientConfig` means exactly what it means in production.
+ *
+ * A user named `Test User` is signed in by default, so an application boots
+ * without declaring anything.
+ *
+ * @example Name the signed-in user
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setAccount({ name: 'Ada Lovelace', username: 'ada@equinor.com' });
+ * });
+ * ```
+ *
+ * @example Configure the client exactly as in production
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setClientConfig({ auth: { clientId: 'my-app', tenantId: 'my-tenant' } });
+ * });
+ * ```
+ *
+ * @example Take full control of authentication
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setClient(new MyOwnMsalClient());
+ * });
+ * ```
+ */
+class MsalMockConfigurator extends MsalConfigurator {
+    /**
+     * Declares the user to sign in.
+     *
+     * @remarks
+     * Who is signed in is session state, not client configuration — which is what
+     * lets {@link MsalMockClient} take the same argument the real client takes: a
+     * client is configured with *what it talks to*, never with *who is signed in*.
+     *
+     * The user is therefore recorded on the configuration as `mock.account`, not
+     * on this builder, and is signed in on whichever client the module ends up
+     * authenticating through — wherever that client was built:
+     *
+     * - The client this builder builds, normally. The user is in place before
+     *   `MsalProvider.initialize` runs, which is what makes the provider's own
+     *   start-up path observable: with `signedOut` and `setRequiresAuth(true)`, a
+     *   test sees the real automatic login run.
+     * - The **host's** client when the module is hoisted onto a host
+     *   application's provider, because none is built here. An application inside
+     *   a portal shares the portal's session, so this changes who the host sees
+     *   signed in too, as it would in production.
+     * - A client supplied through {@link MsalConfigurator.setClient | setClient},
+     *   when that client is a {@link MsalMockClient}.
+     *
+     * Throws when that client cannot represent a declared user, rather than
+     * failing quietly — a silent no-op is the whole failure mode this exists to
+     * prevent.
+     *
+     * Pass `null` when nobody is signed in, or `{ signedOut: true }` to keep an
+     * identity without a session — a later login then resolves as that user.
+     *
+     * @param account - The user, or an ordinary config-builder callback resolving it.
+     * @returns The builder, for chaining.
+     *
+     * @example Derive the user from the modules in scope
+     * ```typescript
+     * builder.setAccount(async ({ hasModule }) => ({
+     *   name: hasModule('app') ? 'App User' : 'Portal User',
+     * }));
+     * ```
+     */
+    setAccount(account) {
+        this._set('mock.account', account);
+        return this;
+    }
+    /**
+     * Declares the token to return, independent of who is signed in.
+     *
+     * @remarks
+     * Use this when a backend mock validates its own tokens (specific claims, an
+     * audience, or a signature) — the client then returns this token verbatim
+     * instead of fabricating one from the signed-in user's fields.
+     *
+     * @param token - A JWT (e.g. from `createMockToken`, or issued by an external mock).
+     * @param skipResolve - When `true`, override only the token and leave an account
+     * declared through {@link setAccount} untouched. Defaults to `false`, which also signs
+     * in the user described by the token's claims, via {@link createMockUserFromToken}.
+     * @returns The builder, for chaining.
+     *
+     * @example Sign in as whoever the token names
+     * ```typescript
+     * builder.setToken(token);
+     * ```
+     *
+     * @example Keep a separately declared account, but return this exact token
+     * ```typescript
+     * builder.setAccount({ name: 'Ada Lovelace' }).setToken(token, true);
+     * ```
+     */
+    setToken(token, skipResolve = false) {
+        this._set('mock.token', token);
+        // skipResolve defaults to false - most callers want the token's claims to name who is signed in
+        if (!skipResolve) {
+            this.setAccount(createMockUserFromToken(token));
+        }
+        return this;
+    }
+    /**
+     * Resolves the client the module authenticates through, wherever it was built.
+     *
+     * @remarks
+     * Shared by {@link setAccount} and {@link setToken} application: neither can
+     * assume the scope declaring mock state is the scope that built the client,
+     * which is exactly what is not true when an application is tested inside a
+     * portal. The host built that client, in a scope this builder never sees, so
+     * the client has to be located rather than assumed.
+     *
+     * @param config - The validated configuration, carrying the client when one was built.
+     * @param init - The builder arguments, carrying the host reference when hoisted.
+     * @param action - Describes what could not be applied, for the thrown error.
+     * @returns The resolved mock client.
+     * @throws When the resolved client is not a {@link MsalMockClient}.
+     */
+    #getClient(config, init, action) {
+        const host = init?.ref?.auth;
+        const client = config.client ?? host?.client;
+        // Reject a real client because mock state cannot be applied to it.
+        if (!(client instanceof MsalMockClient)) {
+            throw new Error(`MsalMockConfigurator: cannot ${action}, because this module does not authenticate through a mock client. Declare it where that client is configured instead.`);
+        }
+        return client;
+    }
+    /**
+     * Signs the declared user in on the client the module authenticates through.
+     *
+     * @param account - The user to sign in, or `null` when nobody is.
+     * @param config - The validated configuration, carrying the client when one was built.
+     * @param init - The builder arguments, carrying the host reference when hoisted.
+     * @throws When the resolved client is not a {@link MsalMockClient}.
+     */
+    #signIn(account, config, init) {
+        this.#getClient(config, init, 'sign a user in').setUser(account);
+    }
+    /**
+     * Assembles the configuration, then signs the declared user in.
+     *
+     * @remarks
+     * Stands a client configuration in first when this builder is the one that
+     * will build a client: `MsalClientConfig.auth.clientId` is required to build
+     * any client at all and a test has no real credentials to declare. It then
+     * flows through the very same
+     * {@link MsalConfigurator._createClientConfig | _createClientConfig}
+     * enrichment the real client is built from, and anything declared through
+     * {@link MsalConfigurator.setClientConfig | setClientConfig} wins — exactly as
+     * in production.
+     *
+     * Doing that here rather than in the constructor is deliberate: a hoisted
+     * module authenticates through the host and builds no client, so it must not
+     * look configured either.
+     *
+     * The user is read from `rawConfig`, because the schema strips `mock` when it
+     * validates — the key exists to carry a test's declaration through the
+     * builder, never to reach the provider.
+     *
+     * @param rawConfig - The raw configuration to process.
+     * @param init - The builder arguments, carrying the host reference when hoisted.
+     * @returns The processed and validated configuration.
+     */
+    async _processConfig(rawConfig, init) {
+        // Supply mock credentials only when this builder owns client construction.
+        if (!this._isHoisted(init) && !this.getClientConfig()) {
+            this.setClientConfig(defaultMockClientConfig);
+        }
+        const config = await super._processConfig(rawConfig, init);
+        // `null` is a declaration in its own right — nobody is signed in — so only
+        // an absent one means the test said nothing about the user
+        const account = rawConfig.mock?.account;
+        // Apply even null because null explicitly requests a signed-out mock state.
+        if (account !== undefined) {
+            this.#signIn(account, config, init);
+        }
+        // Applied after the account so a token declared alongside `skipResolve: true`
+        // overrides whatever `setUser` above just fabricated.
+        const token = rawConfig.mock?.token;
+        // absent means the test declared no token override; leave the client generating its own
+        if (token !== undefined) {
+            this.#getClient(config, init, 'set a token').setToken(token);
+        }
+        return config;
+    }
+    /**
+     * Builds an in-process client.
+     *
+     * @remarks
+     * Called only when no client was set, so
+     * {@link MsalConfigurator.setClient | setClient} still replaces authentication
+     * outright.
+     *
+     * Deliberately does not delegate to `super`, which would build a real
+     * `MsalClient` and contact Entra ID. It is never reached when the module is
+     * hoisted onto a host application's provider, because the base configurator
+     * gates client creation on {@link MsalConfigurator._isHoisted | _isHoisted} —
+     * a mock client built there would shadow the host's client, the exact scenario
+     * an application-inside-a-portal test exists to cover.
+     *
+     * Knows nothing about who is signed in: a client is built from what it talks
+     * to, and the declared user is applied to it afterwards.
+     *
+     * @param config - The validated configuration the client is built from.
+     * @returns A client resolving tokens in-process.
+     */
+    async _createClient(config) {
+        return new MsalMockClient(this._createClientConfig(config) ?? defaultMockClientConfig);
+    }
+}
+
+/**
+ * The MSAL module with a mock client instead of a live connection to Entra ID.
+ *
+ * @remarks
+ * Only `configure` differs from the real module. `initialize` is the production
+ * one, untouched, so proxy providers, host-provider hoisting and provider
+ * initialization all behave exactly as they do in production — and a test
+ * observes the real start-up path rather than a rehearsal of it.
+ */
+const msalMockModule = {
+    ...module$1,
+    configure: () => new MsalMockConfigurator(),
+};
+/**
+ * Enables MSAL against a mock client, so a test needs no credentials and no network.
+ *
+ * @remarks
+ * Registered last, this replaces whichever auth module the configurator already
+ * carries, so it works on a `FrameworkConfigurator` that pre-registers the real one.
+ *
+ * @param configurator - The modules configurator to register on.
+ * @param configure - Optional callback to override the default mock client.
+ *
+ * @example
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setAccount({ name: 'Ada Lovelace' });
+ * });
+ * ```
+ */
+const enableMsalMock = (
+// biome-ignore lint/suspicious/noExplicitAny: must be any to support all module types
+configurator, configure) => {
+    configurator.addConfig({ module: msalMockModule, configure });
+};
+
+export { MsalMockClient, MsalMockConfigurator, createMockToken, createMockUserFromToken, decodeJwtSegment, enableMsalMock, msalMockModule };
+//# sourceMappingURL=index-B_3FYBBq.js.map