npm - @azure/msal-browser - Versions diffs - 4.20.0 → 4.21.0 - Mend

@azure/msal-browser 4.20.0 → 4.21.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (272) hide show

package/lib/custom-auth-path/msal-custom-auth.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.20.0 2025-08-12 */
+/*! @azure/msal-browser v4.21.0 2025-08-19 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -276,7 +276,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -287,7 +287,7 @@ const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 const unexpectedError = "unexpected_error";
 const postRequestFailed$1 = "post_request_failed";
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -322,7 +322,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -372,7 +372,7 @@ const missingTenantIdError = "missing_tenant_id_error";
 const methodNotImplemented = "method_not_implemented";
 const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -446,7 +446,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -485,7 +485,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -676,12 +676,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.11.0";
+const version$1 = "15.12.0";
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -690,7 +690,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -719,7 +719,7 @@ const authorityMismatch = "authority_mismatch";
 const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -764,7 +764,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -861,7 +861,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -905,7 +905,11 @@ class ScopeSet {
      * @returns
      */
     static createSearchScopes(inputScopeString) {
-        const scopeSet = new ScopeSet(inputScopeString);
+        // Handle empty scopes by using default OIDC scopes for cache lookup
+        const scopesToUse = inputScopeString && inputScopeString.length > 0
+            ? inputScopeString
+            : [...OIDC_DEFAULT_SCOPES];
+        const scopeSet = new ScopeSet(scopesToUse);
         if (!scopeSet.containsOnlyOIDCScopes()) {
             scopeSet.removeOIDCScopes();
         }
@@ -1052,7 +1056,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1134,7 +1138,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1195,12 +1199,34 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Canonicalizes a URL by making it lowercase and ensuring it ends with /
+ * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
+ * @param url - URL to canonicalize
+ * @returns Canonicalized URL
+ */
+function canonicalizeUrl(url) {
+    if (!url) {
+        return url;
+    }
+    let lowerCaseUrl = url.toLowerCase();
+    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
+    }
+    else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
+    }
+    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
+        lowerCaseUrl += "/";
+    }
+    return lowerCaseUrl;
+}
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -1258,9 +1284,38 @@ function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParame
         }
     });
     return queryParameterArray.join("&");
+}
+/**
+ * Normalizes URLs for comparison by removing hash, canonicalizing,
+ * and ensuring consistent URL encoding in query parameters.
+ * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * @param url - URL to normalize
+ * @returns Normalized URL string for comparison
+ */
+function normalizeUrlForComparison(url) {
+    if (!url) {
+        return url;
+    }
+    // Remove hash first
+    const urlWithoutHash = url.split("#")[0];
+    try {
+        // Parse the URL to handle encoding consistently
+        const urlObj = new URL(urlWithoutHash);
+        /*
+         * Reconstruct the URL with properly decoded query parameters
+         * This ensures that %27 and ' are treated as equivalent
+         */
+        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
+        // Apply canonicalization logic inline to avoid circular dependency
+        return canonicalizeUrl(normalizedUrl);
+    }
+    catch (e) {
+        // Fallback to original logic if URL parsing fails
+        return canonicalizeUrl(urlWithoutHash);
+    }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1424,7 +1479,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1563,7 +1618,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1571,7 +1626,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1616,7 +1671,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2724,7 +2779,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2748,7 +2803,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3015,7 +3070,7 @@ const PerformanceEvents = {
 const PerformanceEventStatus = {
     InProgress: 1};
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3094,7 +3149,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3194,7 +3249,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3204,7 +3259,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3244,7 +3299,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3294,7 +3349,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3674,7 +3729,7 @@ function addPostBodyParameters(parameters, bodyParameters) {
     });
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3689,7 +3744,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3701,7 +3756,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3711,7 +3766,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3721,7 +3776,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3817,7 +3872,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3923,7 +3978,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3988,7 +4043,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4250,7 +4305,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5089,7 +5144,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5120,7 +5175,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5139,7 +5194,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5160,7 +5215,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5247,7 +5302,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5278,7 +5333,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5426,7 +5481,7 @@ class BaseClient {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5448,7 +5503,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5663,7 +5718,7 @@ class AccountEntity {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5679,7 +5734,7 @@ const consentRequired = "consent_required";
 const loginRequired = "login_required";
 const badToken = "bad_token";
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5751,7 +5806,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5823,7 +5878,7 @@ class ProtocolUtils {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5905,7 +5960,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5932,7 +5987,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6263,7 +6318,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6281,7 +6336,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6516,7 +6571,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6725,7 +6780,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6823,7 +6878,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6838,7 +6893,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7062,7 +7117,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7325,7 +7380,7 @@ class ServerTelemetryManager {
     }
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7333,7 +7388,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7358,7 +7413,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7756,7 +7811,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.20.0";
+const version = "4.21.0";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14911,7 +14966,6 @@ const userSwitch = "user_switch";
 const USER_INTERACTION_REQUIRED = "USER_INTERACTION_REQUIRED";
 const USER_CANCEL = "USER_CANCEL";
 const NO_NETWORK = "NO_NETWORK";
-const PERSISTENT_ERROR = "PERSISTENT_ERROR";
 const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
 const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
@@ -14938,8 +14992,7 @@ class NativeAuthError extends AuthError {
 function isFatalNativeAuthError(error) {
     if (error.ext &&
         error.ext.status &&
-        (error.ext.status === PERSISTENT_ERROR ||
-            error.ext.status === DISABLED)) {
+        error.ext.status === DISABLED) {
         return true;
     }
     if (error.ext &&
@@ -15063,10 +15116,10 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param request
      */
     async acquireToken(request, cacheLookupPolicy) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, this.correlationId);
         this.logger.trace("NativeInteractionClient - acquireToken called.");
         // start the perf measurement
-        const nativeATMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+        const nativeATMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, this.correlationId);
         const reqTimestamp = nowSeconds();
         const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
         try {
@@ -15085,6 +15138,10 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             catch (e) {
                 if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
                     this.logger.info("MSAL internal Cache does not contain tokens, return error as per cache policy");
+                    nativeATMeasurement.end({
+                        success: false,
+                        brokerErrorCode: "cache_request_failed",
+                    });
                     throw e;
                 }
                 // continue with a native call for any and all errors
@@ -15106,7 +15163,6 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
                     success: false,
                     errorCode: error.errorCode,
                     subErrorCode: error.subError,
-                    isNativeBroker: true,
                 });
                 throw error;
             });
@@ -15115,6 +15171,9 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             if (e instanceof NativeAuthError) {
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
             }
+            nativeATMeasurement.end({
+                success: false,
+            });
             throw e;
         }
     }
@@ -15236,6 +15295,9 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
             const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
             serverTelemetryManager.clearNativeBrokerErrorCode();
+            if (performanceClient && this.correlationId) {
+                this.performanceClient.addFields({ isNativeBroker: true }, this.correlationId);
+            }
             return authResult;
         }
         catch (e) {
@@ -15552,7 +15614,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             // generate reqCnf if not provided in the request
             let reqCnfData;
             if (!validatedRequest.keyId) {
-                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, this.correlationId)(shrParameters, this.logger);
                 reqCnfData = generatedReqCnfData.reqCnfString;
                 validatedRequest.keyId = generatedReqCnfData.kid;
                 validatedRequest.signPopToken = true;
@@ -15638,7 +15700,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         this.performanceClient?.addFields({
             embeddedClientId: child_client_id,
             embeddedRedirectUri: child_redirect_uri,
-        }, request.correlationId);
+        }, this.correlationId);
     }
 }
@@ -15669,6 +15731,10 @@ async function getStandardParameters(config, authority, request, logger, perform
     if (request.platformBroker) {
         // signal ests that this is a WAM call
         addNativeBroker(parameters);
+        // instrument JS-platform bridge specific fields
+        performanceClient.addFields({
+            isPlatformAuthorizeRequest: true,
+        }, request.correlationId);
         // pass the req_cnf for POP
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const cryptoOps = new CryptoOps(logger, performanceClient);
@@ -17337,8 +17403,8 @@ class RedirectClient extends StandardInteractionClient {
             }
             // If navigateToLoginRequestUrl is true, get the url where the redirect request was initiated
             const loginRequestUrl = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, true) || Constants.EMPTY_STRING;
-            const loginRequestUrlNormalized = UrlString.removeHashFromUrl(loginRequestUrl);
-            const currentUrlNormalized = UrlString.removeHashFromUrl(window.location.href);
+            const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl);
+            const currentUrlNormalized = normalizeUrlForComparison(window.location.href);
             if (loginRequestUrlNormalized === currentUrlNormalized &&
                 this.config.auth.navigateToLoginRequestUrl) {
                 // We are on the page we need to navigate to - handle hash
@@ -18467,6 +18533,9 @@ class StandardController {
             if (useNative && this.platformAuthProvider) {
                 rootMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenRedirect, platformBrokerRequest?.correlationId || "");
                 this.logger.trace("handleRedirectPromise - acquiring token from native platform");
+                rootMeasurement.add({
+                    isPlatformBrokerRequest: true,
+                });
                 const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.platformAuthProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
                 redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), PerformanceEvents.HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
             }
@@ -18602,9 +18671,13 @@ class StandardController {
                 result = nativeClient
                     .acquireTokenRedirect(request, atrMeasurement)
                     .catch((e) => {
+                    atrMeasurement.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    });
                     if (e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)) {
-                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                         const redirectClient = this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
@@ -18681,6 +18754,9 @@ class StandardController {
         let result;
         const pkce = this.getPreGeneratedPkceCodes(correlationId);
         if (this.canUsePlatformBroker(request)) {
+            atPopupMeasurement.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative({
                 ...request,
                 correlationId,
@@ -18688,15 +18764,18 @@ class StandardController {
                 .then((response) => {
                 atPopupMeasurement.end({
                     success: true,
-                    isNativeBroker: true,
                     accountType: getAccountType(response.account),
                 });
                 return response;
             })
                 .catch((e) => {
+                atPopupMeasurement.add({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                });
                 if (e instanceof NativeAuthError &&
                     isFatalNativeAuthError(e)) {
-                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to continuing to attempt platform broker calls
                     const popupClient = this.createPopupClient(correlationId);
                     return popupClient.acquireToken(request, pkce);
                 }
@@ -18802,7 +18881,14 @@ class StandardController {
         this.eventHandler.emitEvent(EventType.SSO_SILENT_START, InteractionType.Silent, validRequest);
         let result;
         if (this.canUsePlatformBroker(validRequest)) {
+            this.ssoSilentMeasurement?.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
+                this.ssoSilentMeasurement?.add({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                });
                 // If native token acquisition fails for availability reasons fallback to standard flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
@@ -18821,7 +18907,6 @@ class StandardController {
             this.eventHandler.emitEvent(EventType.SSO_SILENT_SUCCESS, InteractionType.Silent, response);
             this.ssoSilentMeasurement?.end({
                 success: true,
-                isNativeBroker: response.fromNativeBroker,
                 accessTokenSize: response.accessToken.length,
                 idTokenSize: response.idToken.length,
                 accountType: getAccountType(response.account),
@@ -18875,7 +18960,6 @@ class StandardController {
                         this.hybridAuthCodeResponses.delete(hybridAuthCode);
                         atbcMeasurement.end({
                             success: true,
-                            isNativeBroker: result.fromNativeBroker,
                             accessTokenSize: result.accessToken.length,
                             idTokenSize: result.idToken.length,
                             accountType: getAccountType(result.account),
@@ -18900,6 +18984,9 @@ class StandardController {
             }
             else if (request.nativeAccountId) {
                 if (this.canUsePlatformBroker(request, request.nativeAccountId)) {
+                    atbcMeasurement.add({
+                        isPlatformBrokerRequest: true,
+                    });
                     const result = await this.acquireTokenNative({
                         ...request,
                         correlationId,
@@ -18909,6 +18996,10 @@ class StandardController {
                             isFatalNativeAuthError(e)) {
                             this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                         }
+                        atbcMeasurement.add({
+                            brokerErrorName: e.name,
+                            brokerErrorCode: e.errorCode,
+                        });
                         throw e;
                     });
                     atbcMeasurement.end({
@@ -18953,7 +19044,6 @@ class StandardController {
             this.acquireTokenByCodeAsyncMeasurement?.end({
                 success: true,
                 fromCache: response.fromCache,
-                isNativeBroker: response.fromNativeBroker,
             });
             return response;
         })
@@ -19451,7 +19541,6 @@ class StandardController {
             atsMeasurement.end({
                 success: true,
                 fromCache: result.fromCache,
-                isNativeBroker: result.fromNativeBroker,
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             });
@@ -19584,7 +19673,6 @@ class StandardController {
             if (request.correlationId) {
                 this.performanceClient.addFields({
                     fromCache: response.fromCache,
-                    isNativeBroker: response.fromNativeBroker,
                 }, request.correlationId);
             }
             return response;
@@ -19608,7 +19696,12 @@ class StandardController {
         if (isPlatformAuthAllowed(this.config, this.logger, this.platformAuthProvider, silentRequest.authenticationScheme) &&
             silentRequest.account.nativeAccountId) {
             this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
+            this.performanceClient.addFields({ isPlatformBrokerRequest: true }, silentRequest.correlationId);
             return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
+                this.performanceClient.addFields({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                }, silentRequest.correlationId);
                 // If native token acquisition fails for availability reasons fallback to web flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow");