@azure/msal-browser 4.13.0 → 4.13.2

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.13.0 2025-05-30 */
+/*! @azure/msal-browser v4.13.2 2025-06-18 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -298,7 +298,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -315,7 +315,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -364,7 +364,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -462,7 +462,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -714,7 +714,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -753,7 +753,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -944,12 +944,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.7.0";
+const version$1 = "15.7.1";
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -969,7 +969,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1030,7 +1030,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1085,7 +1085,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1412,7 +1412,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1466,7 +1466,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1604,7 +1604,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1701,7 +1701,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1892,7 +1892,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1932,7 +1932,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2011,7 +2011,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2026,7 +2026,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2048,7 +2048,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2072,7 +2072,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2315,7 +2315,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2380,7 +2380,7 @@ function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParame
     return queryParameterArray.join("&");
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2544,7 +2544,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2684,7 +2684,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2692,7 +2692,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
 const cacheUnknownErrorCode = "cache_error_unknown";
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2719,7 +2719,7 @@ class CacheError extends Error {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2730,11 +2730,12 @@ class CacheError extends Error {
  * @internal
  */
 class CacheManager {
-    constructor(clientId, cryptoImpl, logger, staticAuthorityOptions) {
+    constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
         this.commonLogger = logger.clone(name$1, version$1);
         this.staticAuthorityOptions = staticAuthorityOptions;
+        this.performanceClient = performanceClient;
     }
     /**
      * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
@@ -2943,7 +2944,6 @@ class CacheManager {
         };
         const tokenKeys = this.getTokenKeys();
         const currentScopes = ScopeSet.fromString(credential.target);
-        const removedAccessTokens = [];
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                 return;
@@ -2953,11 +2953,10 @@ class CacheManager {
                 this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
                 const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                    removedAccessTokens.push(this.removeAccessToken(key));
+                    this.removeAccessToken(key, correlationId);
                 }
             }
         });
-        await Promise.all(removedAccessTokens);
         await this.setAccessTokenCredential(credential, correlationId);
     }
     /**
@@ -3199,34 +3198,31 @@ class CacheManager {
     /**
      * Removes all accounts and related tokens from cache.
      */
-    async removeAllAccounts() {
+    removeAllAccounts(correlationId) {
         const allAccountKeys = this.getAccountKeys();
-        const removedAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
-            removedAccounts.push(this.removeAccount(cacheKey));
+            this.removeAccount(cacheKey, correlationId);
         });
-        await Promise.all(removedAccounts);
     }
     /**
      * Removes the account and related tokens for a given account key
      * @param account
      */
-    async removeAccount(accountKey) {
+    removeAccount(accountKey, correlationId) {
         const account = this.getAccount(accountKey, this.commonLogger);
         if (!account) {
             return;
         }
-        await this.removeAccountContext(account);
+        this.removeAccountContext(account, correlationId);
         this.removeItem(accountKey);
     }
     /**
      * Removes credentials associated with the provided account
      * @param account
      */
-    async removeAccountContext(account) {
+    removeAccountContext(account, correlationId) {
         const allTokenKeys = this.getTokenKeys();
         const accountId = account.generateAccountId();
-        const removedCredentials = [];
         allTokenKeys.idToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
                 this.removeIdToken(key);
@@ -3234,7 +3230,7 @@ class CacheManager {
         });
         allTokenKeys.accessToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                removedCredentials.push(this.removeAccessToken(key));
+                this.removeAccessToken(key, correlationId);
             }
         });
         allTokenKeys.refreshToken.forEach((key) => {
@@ -3242,17 +3238,17 @@ class CacheManager {
                 this.removeRefreshToken(key);
             }
         });
-        await Promise.all(removedCredentials);
     }
     /**
      * returns a boolean if the given credential is removed
      * @param credential
      */
-    async removeAccessToken(key) {
+    removeAccessToken(key, correlationId) {
         const credential = this.getAccessTokenCredential(key);
         if (!credential) {
             return;
         }
+        this.removeItem(key);
         // Remove Token Binding Key from key store for PoP Tokens Credentials
         if (credential.credentialType.toLowerCase() ===
             CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
@@ -3260,16 +3256,15 @@ class CacheManager {
                 const accessTokenWithAuthSchemeEntity = credential;
                 const kid = accessTokenWithAuthSchemeEntity.keyId;
                 if (kid) {
-                    try {
-                        await this.cryptoImpl.removeTokenBindingKey(kid);
-                    }
-                    catch (error) {
-                        throw createClientAuthError(bindingKeyNotRemoved);
-                    }
+                    void this.cryptoImpl
+                        .removeTokenBindingKey(kid)
+                        .catch(() => {
+                        this.commonLogger.error(`Failed to remove token binding key ${kid}`, correlationId);
+                        this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
+                    });
                 }
             }
         }
-        return this.removeItem(key);
     }
     /**
      * Removes all app metadata objects from cache.
@@ -3411,10 +3406,10 @@ class CacheManager {
      * @param request {BaseAuthRequest}
      * @param tokenKeys {?TokenKeys}
      * @param performanceClient {?IPerformanceClient}
-     * @param correlationId {?string}
      */
-    getAccessToken(account, request, tokenKeys, targetRealm, performanceClient, correlationId) {
-        this.commonLogger.trace("CacheManager - getAccessToken called");
+    getAccessToken(account, request, tokenKeys, targetRealm) {
+        const correlationId = request.correlationId;
+        this.commonLogger.trace("CacheManager - getAccessToken called", correlationId);
         const scopes = ScopeSet.createSearchScopes(request.scopes);
         const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
         /*
@@ -3453,20 +3448,18 @@ class CacheManager {
         });
         const numAccessTokens = accessTokens.length;
         if (numAccessTokens < 1) {
-            this.commonLogger.info("CacheManager:getAccessToken - No token found");
+            this.commonLogger.info("CacheManager:getAccessToken - No token found", correlationId);
             return null;
         }
         else if (numAccessTokens > 1) {
-            this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them");
+            this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them", correlationId);
             accessTokens.forEach((accessToken) => {
-                void this.removeAccessToken(generateCredentialKey(accessToken));
+                this.removeAccessToken(generateCredentialKey(accessToken), correlationId);
             });
-            if (performanceClient && correlationId) {
-                performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
-            }
+            this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
             return null;
         }
-        this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
+        this.commonLogger.info("CacheManager:getAccessToken - Returning access token", correlationId);
         return accessTokens[0];
     }
     /**
@@ -3904,576 +3897,16 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
-
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-const DEFAULT_SYSTEM_OPTIONS = {
-    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
-    preventCorsPreflight: false,
-};
-const DEFAULT_LOGGER_IMPLEMENTATION = {
-    loggerCallback: () => {
-        // allow users to not set loggerCallback
-    },
-    piiLoggingEnabled: false,
-    logLevel: exports.LogLevel.Info,
-    correlationId: Constants.EMPTY_STRING,
-};
-const DEFAULT_CACHE_OPTIONS = {
-    claimsBasedCachingEnabled: false,
-};
-const DEFAULT_NETWORK_IMPLEMENTATION = {
-    async sendGetRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
-    },
-    async sendPostRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
-    },
-};
-const DEFAULT_LIBRARY_INFO = {
-    sku: Constants.SKU,
-    version: version$1,
-    cpu: Constants.EMPTY_STRING,
-    os: Constants.EMPTY_STRING,
-};
-const DEFAULT_CLIENT_CREDENTIALS = {
-    clientSecret: Constants.EMPTY_STRING,
-    clientAssertion: undefined,
-};
-const DEFAULT_AZURE_CLOUD_OPTIONS = {
-    azureCloudInstance: AzureCloudInstance.None,
-    tenant: `${Constants.DEFAULT_COMMON_TENANT}`,
-};
-const DEFAULT_TELEMETRY_OPTIONS = {
-    application: {
-        appName: "",
-        appVersion: "",
-    },
-};
 /**
- * Function that sets the default options when not explicitly configured from app developer
- *
- * @param Configuration
+ * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
  *
- * @returns Configuration
- */
-function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, cacheOptions: userCacheOptions, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
-    const loggerOptions = {
-        ...DEFAULT_LOGGER_IMPLEMENTATION,
-        ...userLoggerOption,
-    };
-    return {
-        authOptions: buildAuthOptions(userAuthOptions),
-        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
-        loggerOptions: loggerOptions,
-        cacheOptions: { ...DEFAULT_CACHE_OPTIONS, ...userCacheOptions },
-        storageInterface: storageImplementation ||
-            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),
-        networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
-        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
-        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
-        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
-        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
-        serverTelemetryManager: serverTelemetryManager || null,
-        persistencePlugin: persistencePlugin || null,
-        serializableCache: serializableCache || null,
-    };
-}
-/**
- * Construct authoptions from the client and platform passed values
- * @param authOptions
- */
-function buildAuthOptions(authOptions) {
-    return {
-        clientCapabilities: [],
-        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
-        skipAuthorityMetadataCache: false,
-        instanceAware: false,
-        encodeExtraQueryParams: false,
-        ...authOptions,
-    };
-}
-/**
- * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
- * @param ClientConfiguration
- */
-function isOidcProtocolMode(config) {
-    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
-}
-
-/*! @azure/msal-common v15.7.0 2025-05-30 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CcsCredentialType = {
-    HOME_ACCOUNT_ID: "home_account_id",
-    UPN: "UPN",
-};
-
-/*! @azure/msal-common v15.7.0 2025-05-30 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CLIENT_ID = "client_id";
-const REDIRECT_URI = "redirect_uri";
-const RESPONSE_TYPE = "response_type";
-const RESPONSE_MODE = "response_mode";
-const GRANT_TYPE = "grant_type";
-const CLAIMS = "claims";
-const SCOPE = "scope";
-const REFRESH_TOKEN = "refresh_token";
-const STATE = "state";
-const NONCE = "nonce";
-const PROMPT = "prompt";
-const CODE = "code";
-const CODE_CHALLENGE = "code_challenge";
-const CODE_CHALLENGE_METHOD = "code_challenge_method";
-const CODE_VERIFIER = "code_verifier";
-const CLIENT_REQUEST_ID = "client-request-id";
-const X_CLIENT_SKU = "x-client-SKU";
-const X_CLIENT_VER = "x-client-VER";
-const X_CLIENT_OS = "x-client-OS";
-const X_CLIENT_CPU = "x-client-CPU";
-const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
-const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
-const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
-const X_APP_NAME = "x-app-name";
-const X_APP_VER = "x-app-ver";
-const POST_LOGOUT_URI = "post_logout_redirect_uri";
-const ID_TOKEN_HINT = "id_token_hint";
-const CLIENT_SECRET = "client_secret";
-const CLIENT_ASSERTION = "client_assertion";
-const CLIENT_ASSERTION_TYPE = "client_assertion_type";
-const TOKEN_TYPE = "token_type";
-const REQ_CNF = "req_cnf";
-const RETURN_SPA_CODE = "return_spa_code";
-const NATIVE_BROKER = "nativebroker";
-const LOGOUT_HINT = "logout_hint";
-const SID = "sid";
-const LOGIN_HINT = "login_hint";
-const DOMAIN_HINT = "domain_hint";
-const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
-const BROKER_CLIENT_ID = "brk_client_id";
-const BROKER_REDIRECT_URI = "brk_redirect_uri";
-const INSTANCE_AWARE = "instance_aware";
-const EAR_JWK = "ear_jwk";
-const EAR_JWE_CRYPTO = "ear_jwe_crypto";
-
-/*! @azure/msal-common v15.7.0 2025-05-30 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-function instrumentBrokerParams(parameters, correlationId, performanceClient) {
-    if (!correlationId) {
-        return;
-    }
-    const clientId = parameters.get(CLIENT_ID);
-    if (clientId && parameters.has(BROKER_CLIENT_ID)) {
-        performanceClient?.addFields({
-            embeddedClientId: clientId,
-            embeddedRedirectUri: parameters.get(REDIRECT_URI),
-        }, correlationId);
-    }
-}
-/**
- * Add the given response_type
- * @param parameters
- * @param responseType
- */
-function addResponseType(parameters, responseType) {
-    parameters.set(RESPONSE_TYPE, responseType);
-}
-/**
- * add response_mode. defaults to query.
- * @param responseMode
- */
-function addResponseMode(parameters, responseMode) {
-    parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
-}
-/**
- * Add flag to indicate STS should attempt to use WAM if available
- */
-function addNativeBroker(parameters) {
-    parameters.set(NATIVE_BROKER, "1");
-}
-/**
- * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
- * @param scopeSet
- * @param addOidcScopes
- */
-function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
-    // Always add openid to the scopes when adding OIDC scopes
-    if (addOidcScopes &&
-        !defaultScopes.includes("openid") &&
-        !scopes.includes("openid")) {
-        defaultScopes.push("openid");
-    }
-    const requestScopes = addOidcScopes
-        ? [...(scopes || []), ...defaultScopes]
-        : scopes || [];
-    const scopeSet = new ScopeSet(requestScopes);
-    parameters.set(SCOPE, scopeSet.printScopes());
-}
-/**
- * add clientId
- * @param clientId
- */
-function addClientId(parameters, clientId) {
-    parameters.set(CLIENT_ID, clientId);
-}
-/**
- * add redirect_uri
- * @param redirectUri
- */
-function addRedirectUri(parameters, redirectUri) {
-    parameters.set(REDIRECT_URI, redirectUri);
-}
-/**
- * add post logout redirectUri
- * @param redirectUri
- */
-function addPostLogoutRedirectUri(parameters, redirectUri) {
-    parameters.set(POST_LOGOUT_URI, redirectUri);
-}
-/**
- * add id_token_hint to logout request
- * @param idTokenHint
- */
-function addIdTokenHint(parameters, idTokenHint) {
-    parameters.set(ID_TOKEN_HINT, idTokenHint);
-}
-/**
- * add domain_hint
- * @param domainHint
- */
-function addDomainHint(parameters, domainHint) {
-    parameters.set(DOMAIN_HINT, domainHint);
-}
-/**
- * add login_hint
- * @param loginHint
- */
-function addLoginHint(parameters, loginHint) {
-    parameters.set(LOGIN_HINT, loginHint);
-}
-/**
- * Adds the CCS (Cache Credential Service) query parameter for login_hint
- * @param loginHint
- */
-function addCcsUpn(parameters, loginHint) {
-    parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
-}
-/**
- * Adds the CCS (Cache Credential Service) query parameter for account object
- * @param loginHint
- */
-function addCcsOid(parameters, clientInfo) {
-    parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
-}
-/**
- * add sid
- * @param sid
- */
-function addSid(parameters, sid) {
-    parameters.set(SID, sid);
-}
-/**
- * add claims
- * @param claims
- */
-function addClaims(parameters, claims, clientCapabilities) {
-    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
-    try {
-        JSON.parse(mergedClaims);
-    }
-    catch (e) {
-        throw createClientConfigurationError(invalidClaims);
-    }
-    parameters.set(CLAIMS, mergedClaims);
-}
-/**
- * add correlationId
- * @param correlationId
- */
-function addCorrelationId(parameters, correlationId) {
-    parameters.set(CLIENT_REQUEST_ID, correlationId);
-}
-/**
- * add library info query params
- * @param libraryInfo
- */
-function addLibraryInfo(parameters, libraryInfo) {
-    // Telemetry Info
-    parameters.set(X_CLIENT_SKU, libraryInfo.sku);
-    parameters.set(X_CLIENT_VER, libraryInfo.version);
-    if (libraryInfo.os) {
-        parameters.set(X_CLIENT_OS, libraryInfo.os);
-    }
-    if (libraryInfo.cpu) {
-        parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
-    }
-}
-/**
- * Add client telemetry parameters
- * @param appTelemetry
- */
-function addApplicationTelemetry(parameters, appTelemetry) {
-    if (appTelemetry?.appName) {
-        parameters.set(X_APP_NAME, appTelemetry.appName);
-    }
-    if (appTelemetry?.appVersion) {
-        parameters.set(X_APP_VER, appTelemetry.appVersion);
-    }
-}
-/**
- * add prompt
- * @param prompt
- */
-function addPrompt(parameters, prompt) {
-    parameters.set(PROMPT, prompt);
-}
-/**
- * add state
- * @param state
- */
-function addState(parameters, state) {
-    if (state) {
-        parameters.set(STATE, state);
-    }
-}
-/**
- * add nonce
- * @param nonce
- */
-function addNonce(parameters, nonce) {
-    parameters.set(NONCE, nonce);
-}
-/**
- * add code_challenge and code_challenge_method
- * - throw if either of them are not passed
- * @param codeChallenge
- * @param codeChallengeMethod
- */
-function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
-    if (codeChallenge && codeChallengeMethod) {
-        parameters.set(CODE_CHALLENGE, codeChallenge);
-        parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
-    }
-    else {
-        throw createClientConfigurationError(pkceParamsMissing);
-    }
-}
-/**
- * add the `authorization_code` passed by the user to exchange for a token
- * @param code
- */
-function addAuthorizationCode(parameters, code) {
-    parameters.set(CODE, code);
-}
-/**
- * add the `refreshToken` passed by the user
- * @param refreshToken
- */
-function addRefreshToken(parameters, refreshToken) {
-    parameters.set(REFRESH_TOKEN, refreshToken);
-}
-/**
- * add the `code_verifier` passed by the user to exchange for a token
- * @param codeVerifier
- */
-function addCodeVerifier(parameters, codeVerifier) {
-    parameters.set(CODE_VERIFIER, codeVerifier);
-}
-/**
- * add client_secret
- * @param clientSecret
- */
-function addClientSecret(parameters, clientSecret) {
-    parameters.set(CLIENT_SECRET, clientSecret);
-}
-/**
- * add clientAssertion for confidential client flows
- * @param clientAssertion
- */
-function addClientAssertion(parameters, clientAssertion) {
-    if (clientAssertion) {
-        parameters.set(CLIENT_ASSERTION, clientAssertion);
-    }
-}
-/**
- * add clientAssertionType for confidential client flows
- * @param clientAssertionType
- */
-function addClientAssertionType(parameters, clientAssertionType) {
-    if (clientAssertionType) {
-        parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
-    }
-}
-/**
- * add grant type
- * @param grantType
- */
-function addGrantType(parameters, grantType) {
-    parameters.set(GRANT_TYPE, grantType);
-}
-/**
- * add client info
- *
- */
-function addClientInfo(parameters) {
-    parameters.set(CLIENT_INFO, "1");
-}
-function addInstanceAware(parameters) {
-    if (!parameters.has(INSTANCE_AWARE)) {
-        parameters.set(INSTANCE_AWARE, "true");
-    }
-}
-/**
- * add extraQueryParams
- * @param eQParams
- */
-function addExtraQueryParameters(parameters, eQParams) {
-    Object.entries(eQParams).forEach(([key, value]) => {
-        if (!parameters.has(key) && value) {
-            parameters.set(key, value);
-        }
-    });
-}
-function addClientCapabilitiesToClaims(claims, clientCapabilities) {
-    let mergedClaims;
-    // Parse provided claims into JSON object or initialize empty object
-    if (!claims) {
-        mergedClaims = {};
-    }
-    else {
-        try {
-            mergedClaims = JSON.parse(claims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-    }
-    if (clientCapabilities && clientCapabilities.length > 0) {
-        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
-            // Add access_token key to claims object
-            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
-        }
-        // Add xms_cc claim with provided clientCapabilities to access_token key
-        mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
-            {
-                values: clientCapabilities,
-            };
-    }
-    return JSON.stringify(mergedClaims);
-}
-/**
- * add pop_jwk to query params
- * @param cnfString
- */
-function addPopToken(parameters, cnfString) {
-    if (cnfString) {
-        parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
-        parameters.set(REQ_CNF, cnfString);
-    }
-}
-/**
- * add SSH JWK and key ID to query params
- */
-function addSshJwk(parameters, sshJwkString) {
-    if (sshJwkString) {
-        parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
-        parameters.set(REQ_CNF, sshJwkString);
-    }
-}
-/**
- * add server telemetry fields
- * @param serverTelemetryManager
- */
-function addServerTelemetry(parameters, serverTelemetryManager) {
-    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
-}
-/**
- * Adds parameter that indicates to the server that throttling is supported
- */
-function addThrottling(parameters) {
-    parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
-}
-/**
- * Adds logout_hint parameter for "silent" logout which prevent server account picker
- */
-function addLogoutHint(parameters, logoutHint) {
-    parameters.set(LOGOUT_HINT, logoutHint);
-}
-function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
-    if (!parameters.has(BROKER_CLIENT_ID)) {
-        parameters.set(BROKER_CLIENT_ID, brokerClientId);
-    }
-    if (!parameters.has(BROKER_REDIRECT_URI)) {
-        parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
-    }
-}
-/**
- * Add EAR (Encrypted Authorize Response) request parameters
- * @param parameters
- * @param jwk
- */
-function addEARParameters(parameters, jwk) {
-    parameters.set(EAR_JWK, encodeURIComponent(jwk));
-    // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
-    const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
-    parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
-}
-
-/*! @azure/msal-common v15.7.0 2025-05-30 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-function isOpenIdConfigResponse(response) {
-    return (response.hasOwnProperty("authorization_endpoint") &&
-        response.hasOwnProperty("token_endpoint") &&
-        response.hasOwnProperty("issuer") &&
-        response.hasOwnProperty("jwks_uri"));
-}
-
-/*! @azure/msal-common v15.7.0 2025-05-30 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-function isCloudInstanceDiscoveryResponse(response) {
-    return (response.hasOwnProperty("tenant_discovery_endpoint") &&
-        response.hasOwnProperty("metadata"));
-}
-
-/*! @azure/msal-common v15.7.0 2025-05-30 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-function isCloudInstanceDiscoveryErrorResponse(response) {
-    return (response.hasOwnProperty("error") &&
-        response.hasOwnProperty("error_description"));
-}
-
-/*! @azure/msal-common v15.7.0 2025-05-30 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
- *
- * @export
- * @enum {number}
+ * @export
+ * @enum {number}
  */
 const PerformanceEvents = {
     /**
@@ -4950,34 +4383,673 @@ const PerformanceEventAbbreviations = new Map([
     [PerformanceEvents.DecryptEarResponse, "decryptEarResp"],
 ]);
 /**
- * State of the performance event.
+ * State of the performance event.
+ *
+ * @export
+ * @enum {number}
+ */
+const PerformanceEventStatus = {
+    NotStarted: 0,
+    InProgress: 1,
+    Completed: 2,
+};
+const IntFields = new Set([
+    "accessTokenSize",
+    "durationMs",
+    "idTokenSize",
+    "matsSilentStatus",
+    "matsHttpStatus",
+    "refreshTokenSize",
+    "queuedTimeMs",
+    "startTimeMs",
+    "status",
+    "multiMatchedAT",
+    "multiMatchedID",
+    "multiMatchedRT",
+    "unencryptedCacheCount",
+    "encryptedCacheExpiredCount",
+]);
+
+/*! @azure/msal-common v15.7.1 2025-06-18 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+class StubPerformanceMeasurement {
+    startMeasurement() {
+        return;
+    }
+    endMeasurement() {
+        return;
+    }
+    flushMeasurement() {
+        return null;
+    }
+}
+class StubPerformanceClient {
+    generateId() {
+        return "callback-id";
+    }
+    startMeasurement(measureName, correlationId) {
+        return {
+            end: () => null,
+            discard: () => { },
+            add: () => { },
+            increment: () => { },
+            event: {
+                eventId: this.generateId(),
+                status: PerformanceEventStatus.InProgress,
+                authority: "",
+                libraryName: "",
+                libraryVersion: "",
+                clientId: "",
+                name: measureName,
+                startTimeMs: Date.now(),
+                correlationId: correlationId || "",
+            },
+            measurement: new StubPerformanceMeasurement(),
+        };
+    }
+    startPerformanceMeasurement() {
+        return new StubPerformanceMeasurement();
+    }
+    calculateQueuedTime() {
+        return 0;
+    }
+    addQueueMeasurement() {
+        return;
+    }
+    setPreQueueTime() {
+        return;
+    }
+    endMeasurement() {
+        return null;
+    }
+    discardMeasurements() {
+        return;
+    }
+    removePerformanceCallback() {
+        return true;
+    }
+    addPerformanceCallback() {
+        return "";
+    }
+    emitEvents() {
+        return;
+    }
+    addFields() {
+        return;
+    }
+    incrementFields() {
+        return;
+    }
+    cacheEventByCorrelationId() {
+        return;
+    }
+}
+
+/*! @azure/msal-common v15.7.1 2025-06-18 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_SYSTEM_OPTIONS = {
+    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+    preventCorsPreflight: false,
+};
+const DEFAULT_LOGGER_IMPLEMENTATION = {
+    loggerCallback: () => {
+        // allow users to not set loggerCallback
+    },
+    piiLoggingEnabled: false,
+    logLevel: exports.LogLevel.Info,
+    correlationId: Constants.EMPTY_STRING,
+};
+const DEFAULT_CACHE_OPTIONS = {
+    claimsBasedCachingEnabled: false,
+};
+const DEFAULT_NETWORK_IMPLEMENTATION = {
+    async sendGetRequestAsync() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async sendPostRequestAsync() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+};
+const DEFAULT_LIBRARY_INFO = {
+    sku: Constants.SKU,
+    version: version$1,
+    cpu: Constants.EMPTY_STRING,
+    os: Constants.EMPTY_STRING,
+};
+const DEFAULT_CLIENT_CREDENTIALS = {
+    clientSecret: Constants.EMPTY_STRING,
+    clientAssertion: undefined,
+};
+const DEFAULT_AZURE_CLOUD_OPTIONS = {
+    azureCloudInstance: AzureCloudInstance.None,
+    tenant: `${Constants.DEFAULT_COMMON_TENANT}`,
+};
+const DEFAULT_TELEMETRY_OPTIONS = {
+    application: {
+        appName: "",
+        appVersion: "",
+    },
+};
+/**
+ * Function that sets the default options when not explicitly configured from app developer
+ *
+ * @param Configuration
+ *
+ * @returns Configuration
+ */
+function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, cacheOptions: userCacheOptions, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
+    const loggerOptions = {
+        ...DEFAULT_LOGGER_IMPLEMENTATION,
+        ...userLoggerOption,
+    };
+    return {
+        authOptions: buildAuthOptions(userAuthOptions),
+        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
+        loggerOptions: loggerOptions,
+        cacheOptions: { ...DEFAULT_CACHE_OPTIONS, ...userCacheOptions },
+        storageInterface: storageImplementation ||
+            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
+        networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
+        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
+        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
+        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
+        serverTelemetryManager: serverTelemetryManager || null,
+        persistencePlugin: persistencePlugin || null,
+        serializableCache: serializableCache || null,
+    };
+}
+/**
+ * Construct authoptions from the client and platform passed values
+ * @param authOptions
+ */
+function buildAuthOptions(authOptions) {
+    return {
+        clientCapabilities: [],
+        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
+        skipAuthorityMetadataCache: false,
+        instanceAware: false,
+        encodeExtraQueryParams: false,
+        ...authOptions,
+    };
+}
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+function isOidcProtocolMode(config) {
+    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+}
+
+/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CcsCredentialType = {
+    HOME_ACCOUNT_ID: "home_account_id",
+    UPN: "UPN",
+};
+
+/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CLIENT_ID = "client_id";
+const REDIRECT_URI = "redirect_uri";
+const RESPONSE_TYPE = "response_type";
+const RESPONSE_MODE = "response_mode";
+const GRANT_TYPE = "grant_type";
+const CLAIMS = "claims";
+const SCOPE = "scope";
+const REFRESH_TOKEN = "refresh_token";
+const STATE = "state";
+const NONCE = "nonce";
+const PROMPT = "prompt";
+const CODE = "code";
+const CODE_CHALLENGE = "code_challenge";
+const CODE_CHALLENGE_METHOD = "code_challenge_method";
+const CODE_VERIFIER = "code_verifier";
+const CLIENT_REQUEST_ID = "client-request-id";
+const X_CLIENT_SKU = "x-client-SKU";
+const X_CLIENT_VER = "x-client-VER";
+const X_CLIENT_OS = "x-client-OS";
+const X_CLIENT_CPU = "x-client-CPU";
+const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
+const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
+const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
+const X_APP_NAME = "x-app-name";
+const X_APP_VER = "x-app-ver";
+const POST_LOGOUT_URI = "post_logout_redirect_uri";
+const ID_TOKEN_HINT = "id_token_hint";
+const CLIENT_SECRET = "client_secret";
+const CLIENT_ASSERTION = "client_assertion";
+const CLIENT_ASSERTION_TYPE = "client_assertion_type";
+const TOKEN_TYPE = "token_type";
+const REQ_CNF = "req_cnf";
+const RETURN_SPA_CODE = "return_spa_code";
+const NATIVE_BROKER = "nativebroker";
+const LOGOUT_HINT = "logout_hint";
+const SID = "sid";
+const LOGIN_HINT = "login_hint";
+const DOMAIN_HINT = "domain_hint";
+const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+const BROKER_CLIENT_ID = "brk_client_id";
+const BROKER_REDIRECT_URI = "brk_redirect_uri";
+const INSTANCE_AWARE = "instance_aware";
+const EAR_JWK = "ear_jwk";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+
+/*! @azure/msal-common v15.7.1 2025-06-18 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function instrumentBrokerParams(parameters, correlationId, performanceClient) {
+    if (!correlationId) {
+        return;
+    }
+    const clientId = parameters.get(CLIENT_ID);
+    if (clientId && parameters.has(BROKER_CLIENT_ID)) {
+        performanceClient?.addFields({
+            embeddedClientId: clientId,
+            embeddedRedirectUri: parameters.get(REDIRECT_URI),
+        }, correlationId);
+    }
+}
+/**
+ * Add the given response_type
+ * @param parameters
+ * @param responseType
+ */
+function addResponseType(parameters, responseType) {
+    parameters.set(RESPONSE_TYPE, responseType);
+}
+/**
+ * add response_mode. defaults to query.
+ * @param responseMode
+ */
+function addResponseMode(parameters, responseMode) {
+    parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
+}
+/**
+ * Add flag to indicate STS should attempt to use WAM if available
+ */
+function addNativeBroker(parameters) {
+    parameters.set(NATIVE_BROKER, "1");
+}
+/**
+ * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
+ * @param scopeSet
+ * @param addOidcScopes
+ */
+function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+    // Always add openid to the scopes when adding OIDC scopes
+    if (addOidcScopes &&
+        !defaultScopes.includes("openid") &&
+        !scopes.includes("openid")) {
+        defaultScopes.push("openid");
+    }
+    const requestScopes = addOidcScopes
+        ? [...(scopes || []), ...defaultScopes]
+        : scopes || [];
+    const scopeSet = new ScopeSet(requestScopes);
+    parameters.set(SCOPE, scopeSet.printScopes());
+}
+/**
+ * add clientId
+ * @param clientId
+ */
+function addClientId(parameters, clientId) {
+    parameters.set(CLIENT_ID, clientId);
+}
+/**
+ * add redirect_uri
+ * @param redirectUri
+ */
+function addRedirectUri(parameters, redirectUri) {
+    parameters.set(REDIRECT_URI, redirectUri);
+}
+/**
+ * add post logout redirectUri
+ * @param redirectUri
+ */
+function addPostLogoutRedirectUri(parameters, redirectUri) {
+    parameters.set(POST_LOGOUT_URI, redirectUri);
+}
+/**
+ * add id_token_hint to logout request
+ * @param idTokenHint
+ */
+function addIdTokenHint(parameters, idTokenHint) {
+    parameters.set(ID_TOKEN_HINT, idTokenHint);
+}
+/**
+ * add domain_hint
+ * @param domainHint
+ */
+function addDomainHint(parameters, domainHint) {
+    parameters.set(DOMAIN_HINT, domainHint);
+}
+/**
+ * add login_hint
+ * @param loginHint
+ */
+function addLoginHint(parameters, loginHint) {
+    parameters.set(LOGIN_HINT, loginHint);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for login_hint
+ * @param loginHint
+ */
+function addCcsUpn(parameters, loginHint) {
+    parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for account object
+ * @param loginHint
+ */
+function addCcsOid(parameters, clientInfo) {
+    parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
+}
+/**
+ * add sid
+ * @param sid
+ */
+function addSid(parameters, sid) {
+    parameters.set(SID, sid);
+}
+/**
+ * add claims
+ * @param claims
+ */
+function addClaims(parameters, claims, clientCapabilities) {
+    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
+    try {
+        JSON.parse(mergedClaims);
+    }
+    catch (e) {
+        throw createClientConfigurationError(invalidClaims);
+    }
+    parameters.set(CLAIMS, mergedClaims);
+}
+/**
+ * add correlationId
+ * @param correlationId
+ */
+function addCorrelationId(parameters, correlationId) {
+    parameters.set(CLIENT_REQUEST_ID, correlationId);
+}
+/**
+ * add library info query params
+ * @param libraryInfo
+ */
+function addLibraryInfo(parameters, libraryInfo) {
+    // Telemetry Info
+    parameters.set(X_CLIENT_SKU, libraryInfo.sku);
+    parameters.set(X_CLIENT_VER, libraryInfo.version);
+    if (libraryInfo.os) {
+        parameters.set(X_CLIENT_OS, libraryInfo.os);
+    }
+    if (libraryInfo.cpu) {
+        parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
+    }
+}
+/**
+ * Add client telemetry parameters
+ * @param appTelemetry
+ */
+function addApplicationTelemetry(parameters, appTelemetry) {
+    if (appTelemetry?.appName) {
+        parameters.set(X_APP_NAME, appTelemetry.appName);
+    }
+    if (appTelemetry?.appVersion) {
+        parameters.set(X_APP_VER, appTelemetry.appVersion);
+    }
+}
+/**
+ * add prompt
+ * @param prompt
+ */
+function addPrompt(parameters, prompt) {
+    parameters.set(PROMPT, prompt);
+}
+/**
+ * add state
+ * @param state
+ */
+function addState(parameters, state) {
+    if (state) {
+        parameters.set(STATE, state);
+    }
+}
+/**
+ * add nonce
+ * @param nonce
+ */
+function addNonce(parameters, nonce) {
+    parameters.set(NONCE, nonce);
+}
+/**
+ * add code_challenge and code_challenge_method
+ * - throw if either of them are not passed
+ * @param codeChallenge
+ * @param codeChallengeMethod
+ */
+function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
+    if (codeChallenge && codeChallengeMethod) {
+        parameters.set(CODE_CHALLENGE, codeChallenge);
+        parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
+    }
+    else {
+        throw createClientConfigurationError(pkceParamsMissing);
+    }
+}
+/**
+ * add the `authorization_code` passed by the user to exchange for a token
+ * @param code
+ */
+function addAuthorizationCode(parameters, code) {
+    parameters.set(CODE, code);
+}
+/**
+ * add the `refreshToken` passed by the user
+ * @param refreshToken
+ */
+function addRefreshToken(parameters, refreshToken) {
+    parameters.set(REFRESH_TOKEN, refreshToken);
+}
+/**
+ * add the `code_verifier` passed by the user to exchange for a token
+ * @param codeVerifier
+ */
+function addCodeVerifier(parameters, codeVerifier) {
+    parameters.set(CODE_VERIFIER, codeVerifier);
+}
+/**
+ * add client_secret
+ * @param clientSecret
+ */
+function addClientSecret(parameters, clientSecret) {
+    parameters.set(CLIENT_SECRET, clientSecret);
+}
+/**
+ * add clientAssertion for confidential client flows
+ * @param clientAssertion
+ */
+function addClientAssertion(parameters, clientAssertion) {
+    if (clientAssertion) {
+        parameters.set(CLIENT_ASSERTION, clientAssertion);
+    }
+}
+/**
+ * add clientAssertionType for confidential client flows
+ * @param clientAssertionType
+ */
+function addClientAssertionType(parameters, clientAssertionType) {
+    if (clientAssertionType) {
+        parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
+    }
+}
+/**
+ * add grant type
+ * @param grantType
+ */
+function addGrantType(parameters, grantType) {
+    parameters.set(GRANT_TYPE, grantType);
+}
+/**
+ * add client info
  *
- * @export
- * @enum {number}
  */
-const PerformanceEventStatus = {
-    NotStarted: 0,
-    InProgress: 1,
-    Completed: 2,
-};
-const IntFields = new Set([
-    "accessTokenSize",
-    "durationMs",
-    "idTokenSize",
-    "matsSilentStatus",
-    "matsHttpStatus",
-    "refreshTokenSize",
-    "queuedTimeMs",
-    "startTimeMs",
-    "status",
-    "multiMatchedAT",
-    "multiMatchedID",
-    "multiMatchedRT",
-    "unencryptedCacheCount",
-    "encryptedCacheExpiredCount",
-]);
+function addClientInfo(parameters) {
+    parameters.set(CLIENT_INFO, "1");
+}
+function addInstanceAware(parameters) {
+    if (!parameters.has(INSTANCE_AWARE)) {
+        parameters.set(INSTANCE_AWARE, "true");
+    }
+}
+/**
+ * add extraQueryParams
+ * @param eQParams
+ */
+function addExtraQueryParameters(parameters, eQParams) {
+    Object.entries(eQParams).forEach(([key, value]) => {
+        if (!parameters.has(key) && value) {
+            parameters.set(key, value);
+        }
+    });
+}
+function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+    let mergedClaims;
+    // Parse provided claims into JSON object or initialize empty object
+    if (!claims) {
+        mergedClaims = {};
+    }
+    else {
+        try {
+            mergedClaims = JSON.parse(claims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+    }
+    if (clientCapabilities && clientCapabilities.length > 0) {
+        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+            // Add access_token key to claims object
+            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
+        }
+        // Add xms_cc claim with provided clientCapabilities to access_token key
+        mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
+            {
+                values: clientCapabilities,
+            };
+    }
+    return JSON.stringify(mergedClaims);
+}
+/**
+ * add pop_jwk to query params
+ * @param cnfString
+ */
+function addPopToken(parameters, cnfString) {
+    if (cnfString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
+        parameters.set(REQ_CNF, cnfString);
+    }
+}
+/**
+ * add SSH JWK and key ID to query params
+ */
+function addSshJwk(parameters, sshJwkString) {
+    if (sshJwkString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
+        parameters.set(REQ_CNF, sshJwkString);
+    }
+}
+/**
+ * add server telemetry fields
+ * @param serverTelemetryManager
+ */
+function addServerTelemetry(parameters, serverTelemetryManager) {
+    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+}
+/**
+ * Adds parameter that indicates to the server that throttling is supported
+ */
+function addThrottling(parameters) {
+    parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+}
+/**
+ * Adds logout_hint parameter for "silent" logout which prevent server account picker
+ */
+function addLogoutHint(parameters, logoutHint) {
+    parameters.set(LOGOUT_HINT, logoutHint);
+}
+function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
+    if (!parameters.has(BROKER_CLIENT_ID)) {
+        parameters.set(BROKER_CLIENT_ID, brokerClientId);
+    }
+    if (!parameters.has(BROKER_REDIRECT_URI)) {
+        parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
+    }
+}
+/**
+ * Add EAR (Encrypted Authorize Response) request parameters
+ * @param parameters
+ * @param jwk
+ */
+function addEARParameters(parameters, jwk) {
+    parameters.set(EAR_JWK, encodeURIComponent(jwk));
+    // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
+    const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
+    parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+
+/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isOpenIdConfigResponse(response) {
+    return (response.hasOwnProperty("authorization_endpoint") &&
+        response.hasOwnProperty("token_endpoint") &&
+        response.hasOwnProperty("issuer") &&
+        response.hasOwnProperty("jwks_uri"));
+}
+
+/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isCloudInstanceDiscoveryResponse(response) {
+    return (response.hasOwnProperty("tenant_discovery_endpoint") &&
+        response.hasOwnProperty("metadata"));
+}
+
+/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isCloudInstanceDiscoveryErrorResponse(response) {
+    return (response.hasOwnProperty("error") &&
+        response.hasOwnProperty("error_description"));
+}
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5073,7 +5145,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5179,7 +5251,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6018,7 +6090,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6049,7 +6121,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6068,7 +6140,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6089,7 +6161,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6176,7 +6248,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6207,7 +6279,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6355,7 +6427,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6364,6 +6436,7 @@ class BaseClient {
 const noTokensFound = "no_tokens_found";
 const nativeAccountUnavailable = "native_account_unavailable";
 const refreshTokenExpired = "refresh_token_expired";
+const uxNotAllowed = "ux_not_allowed";
 // Codes potentially returned by server
 const interactionRequired = "interaction_required";
 const consentRequired = "consent_required";
@@ -6378,10 +6451,11 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     loginRequired: loginRequired,
     nativeAccountUnavailable: nativeAccountUnavailable,
     noTokensFound: noTokensFound,
-    refreshTokenExpired: refreshTokenExpired
+    refreshTokenExpired: refreshTokenExpired,
+    uxNotAllowed: uxNotAllowed
 });
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6395,6 +6469,7 @@ const InteractionRequiredServerErrorMessage = [
     consentRequired,
     loginRequired,
     badToken,
+    uxNotAllowed,
 ];
 const InteractionRequiredAuthSubErrorMessage = [
     "message_only",
@@ -6409,6 +6484,7 @@ const InteractionRequiredAuthErrorMessages = {
     [nativeAccountUnavailable]: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
     [refreshTokenExpired]: "Refresh token has expired.",
     [badToken]: "Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",
+    [uxNotAllowed]: "`canShowUI` flag in Edge was set to false. User interaction required on web page. Please invoke an interactive API to resolve.",
 };
 /**
  * Interaction required errors defined by the SDK
@@ -6469,7 +6545,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6541,7 +6617,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6625,7 +6701,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6652,7 +6728,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6983,7 +7059,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7050,7 +7126,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7068,7 +7144,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7301,7 +7377,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7510,7 +7586,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7542,7 +7618,7 @@ class SilentFlowClient extends BaseClient {
         const requestTenantId = request.account.tenantId ||
             getTenantFromAuthorityString(request.authority);
         const tokenKeys = this.cacheManager.getTokenKeys();
-        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);
+        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
         if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
@@ -7608,7 +7684,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7623,7 +7699,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7847,7 +7923,7 @@ function extractLoginHint(account) {
     return account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7905,7 +7981,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8168,7 +8244,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8176,7 +8252,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8201,7 +8277,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8241,86 +8317,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-05-30 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class StubPerformanceMeasurement {
-    startMeasurement() {
-        return;
-    }
-    endMeasurement() {
-        return;
-    }
-    flushMeasurement() {
-        return null;
-    }
-}
-class StubPerformanceClient {
-    generateId() {
-        return "callback-id";
-    }
-    startMeasurement(measureName, correlationId) {
-        return {
-            end: () => null,
-            discard: () => { },
-            add: () => { },
-            increment: () => { },
-            event: {
-                eventId: this.generateId(),
-                status: PerformanceEventStatus.InProgress,
-                authority: "",
-                libraryName: "",
-                libraryVersion: "",
-                clientId: "",
-                name: measureName,
-                startTimeMs: Date.now(),
-                correlationId: correlationId || "",
-            },
-            measurement: new StubPerformanceMeasurement(),
-        };
-    }
-    startPerformanceMeasurement() {
-        return new StubPerformanceMeasurement();
-    }
-    calculateQueuedTime() {
-        return 0;
-    }
-    addQueueMeasurement() {
-        return;
-    }
-    setPreQueueTime() {
-        return;
-    }
-    endMeasurement() {
-        return null;
-    }
-    discardMeasurements() {
-        return;
-    }
-    removePerformanceCallback() {
-        return true;
-    }
-    addPerformanceCallback() {
-        return "";
-    }
-    emitEvents() {
-        return;
-    }
-    addFields() {
-        return;
-    }
-    incrementFields() {
-        return;
-    }
-    cacheEventByCorrelationId() {
-        return;
-    }
-}
-
-/*! @azure/msal-common v15.7.0 2025-05-30 */
+/*! @azure/msal-common v15.7.1 2025-06-18 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10160,10 +10157,10 @@ class NavigationClient {
      */
     static defaultNavigateWindow(url, options) {
         if (options.noHistory) {
-            window.location.replace(url);
+            window.location.replace(url); // CodeQL [SM03712] Application owner controls the URL. User can't change it.
         }
         else {
-            window.location.assign(url);
+            window.location.assign(url); // CodeQL [SM03712] Application owner controls the URL. User can't change it.
         }
         return new Promise((resolve) => {
             setTimeout(() => {
@@ -10425,7 +10422,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.13.0";
+const version = "4.13.2";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11269,7 +11266,9 @@ class CryptoOps {
     async removeTokenBindingKey(kid) {
         await this.cache.removeItem(kid);
         const keyFound = await this.cache.containsKey(kid);
-        return !keyFound;
+        if (keyFound) {
+            throw createClientAuthError(bindingKeyNotRemoved);
+        }
     }
     /**
      * Removes all cryptographic keys from IndexedDB storage
@@ -11791,14 +11790,13 @@ const EventType = {
  */
 class BrowserCacheManager extends CacheManager {
     constructor(clientId, cacheConfig, cryptoImpl, logger, performanceClient, eventHandler, staticAuthorityOptions) {
-        super(clientId, cryptoImpl, logger, staticAuthorityOptions);
+        super(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions);
         this.cacheConfig = cacheConfig;
         this.logger = logger;
         this.internalStorage = new MemoryStorage();
         this.browserStorage = getStorageImplementation(clientId, cacheConfig.cacheLocation, logger, performanceClient);
         this.temporaryCacheStorage = getStorageImplementation(clientId, cacheConfig.temporaryCacheLocation, logger, performanceClient);
         this.cookieStorage = new CookieStorage();
-        this.performanceClient = performanceClient;
         this.eventHandler = eventHandler;
     }
     async initialize(correlationId) {
@@ -11926,16 +11924,16 @@ class BrowserCacheManager extends CacheManager {
      * Extends inherited removeAccount function to include removal of the account key from the map
      * @param key
      */
-    async removeAccount(key) {
-        void super.removeAccount(key);
+    removeAccount(key, correlationId) {
+        super.removeAccount(key, correlationId);
         this.removeAccountKeyFromMap(key);
     }
     /**
      * Removes credentials associated with the provided account
      * @param account
      */
-    async removeAccountContext(account) {
-        await super.removeAccountContext(account);
+    removeAccountContext(account, correlationId) {
+        super.removeAccountContext(account, correlationId);
         /**
          * @deprecated - Remove this in next major version in favor of more consistent LOGOUT event
          */
@@ -11955,8 +11953,8 @@ class BrowserCacheManager extends CacheManager {
      * Removes given accessToken from the cache and from the key map
      * @param key
      */
-    async removeAccessToken(key) {
-        void super.removeAccessToken(key);
+    removeAccessToken(key, correlationId) {
+        super.removeAccessToken(key, correlationId);
         this.removeTokenKey(key, CredentialType.ACCESS_TOKEN);
     }
     /**
@@ -12401,9 +12399,9 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Clears all cache entries created by MSAL.
      */
-    async clear() {
+    clear(correlationId) {
         // Removes all accounts and their credentials
-        await this.removeAllAccounts();
+        this.removeAllAccounts(correlationId);
         this.removeAppMetadata();
         // Remove temp storage first to make sure any cookies are cleared
         this.temporaryCacheStorage.getKeys().forEach((cacheKey) => {
@@ -12427,22 +12425,22 @@ class BrowserCacheManager extends CacheManager {
      * @param correlationId {string} correlation id
      * @returns
      */
-    async clearTokensAndKeysWithClaims(performanceClient, correlationId) {
-        performanceClient.addQueueMeasurement(PerformanceEvents.ClearTokensAndKeysWithClaims, correlationId);
+    clearTokensAndKeysWithClaims(correlationId) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.ClearTokensAndKeysWithClaims, correlationId);
         const tokenKeys = this.getTokenKeys();
-        const removedAccessTokens = [];
+        let removedAccessTokens = 0;
         tokenKeys.accessToken.forEach((key) => {
             // if the access token has claims in its key, remove the token key and the token
             const credential = this.getAccessTokenCredential(key);
             if (credential?.requestedClaimsHash &&
                 key.includes(credential.requestedClaimsHash.toLowerCase())) {
-                removedAccessTokens.push(this.removeAccessToken(key));
+                this.removeAccessToken(key, correlationId);
+                removedAccessTokens++;
             }
         });
-        await Promise.all(removedAccessTokens);
         // warn if any access tokens are removed
-        if (removedAccessTokens.length > 0) {
-            this.logger.warning(`${removedAccessTokens.length} access tokens with claims in the cache keys have been removed from the cache.`);
+        if (removedAccessTokens > 0) {
+            this.logger.warning(`${removedAccessTokens} access tokens with claims in the cache keys have been removed from the cache.`);
         }
     }
     /**
@@ -12916,7 +12914,7 @@ class BaseInteractionClient {
             }
             // Clear given account.
             try {
-                await this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account));
+                this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account), this.correlationId);
                 this.logger.verbose("Cleared cache items belonging to the account provided in the logout request.");
             }
             catch (error) {
@@ -12927,7 +12925,7 @@ class BaseInteractionClient {
             try {
                 this.logger.verbose("No account provided in logout request, clearing all cache items.", this.correlationId);
                 // Clear all accounts and tokens
-                await this.browserStorage.clear();
+                this.browserStorage.clear(this.correlationId);
                 // Clear any stray keys from IndexedDB
                 await this.browserCrypto.clearKeystore();
             }
@@ -13429,7 +13427,8 @@ const USER_CANCEL = "USER_CANCEL";
 const NO_NETWORK = "NO_NETWORK";
 const PERSISTENT_ERROR = "PERSISTENT_ERROR";
 const DISABLED = "DISABLED";
-const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
+const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
+const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13487,6 +13486,8 @@ function createNativeAuthError(code, description, ext) {
                 return createBrowserAuthError(userCancelled);
             case NO_NETWORK:
                 return createBrowserAuthError(noNetworkConnectivity);
+            case UX_NOT_ALLOWED:
+                return createInteractionRequiredAuthError(uxNotAllowed);
         }
     }
     return new NativeAuthError(code, NativeAuthErrorMessages[code] || description, ext);
@@ -13927,9 +13928,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // Store the account info and hence `nativeAccountId` in browser cache
         await this.browserStorage.setAccount(accountEntity, this.correlationId);
         // Remove any existing cached tokens for this account in browser storage
-        this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
-            this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
-        });
+        this.browserStorage.removeAccountContext(accountEntity, this.correlationId);
     }
     /**
      * Stores the access_token and id_token in inmemory storage
@@ -14885,14 +14884,14 @@ function isDomEnabledForPlatformAuth() {
  * @param authenticationScheme
  */
 function isPlatformAuthAllowed(config, logger, platformAuthProvider, authenticationScheme) {
-    logger.trace("isBrokerAvailable called");
+    logger.trace("isPlatformAuthAllowed called");
     if (!config.system.allowPlatformBroker) {
-        logger.trace("isBrokerAvailable: allowPlatformBroker is not enabled, returning false");
+        logger.trace("isPlatformAuthAllowed: allowPlatformBroker is not enabled, returning false");
         // Developer disabled WAM
         return false;
     }
     if (!platformAuthProvider) {
-        logger.trace("isBrokerAvailable: Platform auth provider is not initialized, returning false");
+        logger.trace("isPlatformAuthAllowed: Platform auth provider is not initialized, returning false");
         // Platform broker auth providers are not available
         return false;
     }
@@ -14900,10 +14899,10 @@ function isPlatformAuthAllowed(config, logger, platformAuthProvider, authenticat
         switch (authenticationScheme) {
             case AuthenticationScheme.BEARER:
             case AuthenticationScheme.POP:
-                logger.trace("isBrokerAvailable: authenticationScheme is supported, returning true");
+                logger.trace("isPlatformAuthAllowed: authenticationScheme is supported, returning true");
                 return true;
             default:
-                logger.trace("isBrokerAvailable: authenticationScheme is not supported, returning false");
+                logger.trace("isPlatformAuthAllowed: authenticationScheme is not supported, returning false");
                 return false;
         }
     }
@@ -15113,7 +15112,7 @@ class PopupClient extends StandardInteractionClient {
                 if (validRequest.account?.homeAccountId &&
                     validRequest.postLogoutRedirectUri &&
                     authClient.authority.protocolMode === ProtocolMode.OIDC) {
-                    void this.browserStorage.removeAccount(validRequest.account?.homeAccountId);
+                    this.browserStorage.removeAccount(validRequest.account?.homeAccountId, this.correlationId);
                     this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
                     if (mainWindowRedirectUri) {
                         const navigationOptions = {
@@ -15709,7 +15708,7 @@ class RedirectClient extends StandardInteractionClient {
                 }
                 catch {
                     if (validLogoutRequest.account?.homeAccountId) {
-                        void this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId);
+                        this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId, this.correlationId);
                         this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Redirect, validLogoutRequest);
                         return;
                     }
@@ -16549,7 +16548,7 @@ class StandardController {
         }
         if (!this.config.cache.claimsBasedCachingEnabled) {
             this.logger.verbose("Claims-based caching is disabled. Clearing the previous cache with claims");
-            await invokeAsync(this.browserStorage.clearTokensAndKeysWithClaims.bind(this.browserStorage), PerformanceEvents.ClearTokensAndKeysWithClaims, this.logger, this.performanceClient, initCorrelationId)(this.performanceClient, initCorrelationId);
+            invoke(this.browserStorage.clearTokensAndKeysWithClaims.bind(this.browserStorage), PerformanceEvents.ClearTokensAndKeysWithClaims, this.logger, this.performanceClient, initCorrelationId)(initCorrelationId);
         }
         this.config.system.asyncPopups &&
             (await this.preGeneratePkceCodes(initCorrelationId));
@@ -18299,7 +18298,7 @@ class NestedAppAuthController {
         };
         // fetch access token and check for expiry
         const tokenKeys = this.browserStorage.getTokenKeys();
-        const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+        const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId);
         // If there is no access token, log it and return null
         if (!cachedAccessToken) {
             this.logger.verbose("No cached access token found");
@@ -19812,7 +19811,20 @@ class SignedHttpRequest {
      * @returns If keys are properly deleted
      */
     async removeKeys(publicKeyThumbprint) {
-        return this.cryptoOps.removeTokenBindingKey(publicKeyThumbprint);
+        return this.cryptoOps
+            .removeTokenBindingKey(publicKeyThumbprint)
+            .then(() => true)
+            .catch((error) => {
+            /*
+             * @deprecated - To maintain public API signature, we return false if the error is due to the key still being present in indexedDB.
+             */
+            if (error instanceof ClientAuthError &&
+                error.errorCode ===
+                    bindingKeyNotRemoved) {
+                return false;
+            }
+            throw error;
+        });
     }
 }