npm - @azure/msal-browser - Versions diffs - 4.26.0 → 4.26.2 - Mend

@azure/msal-browser 4.26.0 → 4.26.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (391) hide show

package/lib/custom-auth-path/msal-custom-auth.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.26.0 2025-10-29 */
+/*! @azure/msal-browser v4.26.2 2025-11-19 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -276,7 +276,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -287,7 +287,7 @@ const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 const unexpectedError = "unexpected_error";
 const postRequestFailed$1 = "post_request_failed";
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -322,7 +322,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -370,9 +370,10 @@ const noNetworkConnectivity$1 = "no_network_connectivity";
 const userCanceled = "user_canceled";
 const missingTenantIdError = "missing_tenant_id_error";
 const methodNotImplemented = "method_not_implemented";
-const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
+const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
+const platformBrokerError = "platform_broker_error";
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -429,6 +430,7 @@ const ClientAuthErrorMessages = {
     [missingTenantIdError]: "A tenant id - not common, organizations, or consumers - must be specified when using the client_credentials flow.",
     [methodNotImplemented]: "This method has not been implemented",
     [nestedAppAuthBridgeDisabled]: "The nested app auth bridge is disabled",
+    [platformBrokerError]: "An error occurred in the native broker. See the platformBrokerError property for details.",
 };
 /**
  * Error thrown when there is an error in the client code running on the browser.
@@ -446,7 +448,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -485,7 +487,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -676,12 +678,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.13.1";
+const version$1 = "15.13.2";
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -690,7 +692,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -719,7 +721,7 @@ const authorityMismatch = "authority_mismatch";
 const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -764,7 +766,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -861,7 +863,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1056,7 +1058,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1096,7 +1098,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1178,7 +1180,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1193,7 +1195,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1215,7 +1217,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1239,7 +1241,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1460,7 +1462,7 @@ class AccountEntity {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1541,7 +1543,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1657,7 +1659,7 @@ function normalizeUrlForComparison(url) {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1821,7 +1823,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1960,7 +1962,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1968,7 +1970,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2013,7 +2015,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3122,7 +3124,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3389,7 +3391,7 @@ const PerformanceEvents = {
 const PerformanceEventStatus = {
     InProgress: 1};
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3468,7 +3470,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3568,7 +3570,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3578,7 +3580,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3628,7 +3630,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4008,7 +4010,7 @@ function addPostBodyParameters(parameters, bodyParameters) {
     });
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4020,7 +4022,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4030,7 +4032,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4040,7 +4042,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4136,7 +4138,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4242,7 +4244,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4307,7 +4309,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4569,7 +4571,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5408,7 +5410,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5439,7 +5441,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5458,7 +5460,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5479,7 +5481,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5566,7 +5568,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5597,7 +5599,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5745,7 +5747,7 @@ class BaseClient {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5761,7 +5763,7 @@ const consentRequired = "consent_required";
 const loginRequired = "login_required";
 const badToken = "bad_token";
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5833,7 +5835,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5905,7 +5907,7 @@ class ProtocolUtils {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5987,7 +5989,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6014,7 +6016,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6345,7 +6347,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6363,7 +6365,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6598,7 +6600,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6807,7 +6809,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6905,7 +6907,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6920,7 +6922,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7144,7 +7146,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7407,7 +7409,7 @@ class ServerTelemetryManager {
     }
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7415,7 +7417,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7440,7 +7442,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
-/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7875,7 +7877,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.26.0";
+const version = "4.26.2";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8196,7 +8198,6 @@ class SignInResult extends AuthFlowResultBase {
     }
     /**
      * Checks if the result requires authentication method registration.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isAuthMethodRegistrationRequired() {
         return (this.state.stateType ===
@@ -8204,7 +8205,6 @@ class SignInResult extends AuthFlowResultBase {
     }
     /**
      * Checks if the result requires MFA.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isMfaRequired() {
         return this.state.stateType === MFA_AWAITING_STATE_TYPE;
@@ -9572,12 +9572,13 @@ class StandardInteractionClient extends BaseInteractionClient {
     async getClientConfiguration(params) {
         const { serverTelemetryManager, requestAuthority, requestAzureCloudOptions, requestExtraQueryParameters, account, } = params;
         this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientGetClientConfiguration, this.correlationId);
-        const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, this.correlationId)({
-            requestAuthority,
-            requestAzureCloudOptions,
-            requestExtraQueryParameters,
-            account,
-        });
+        const discoveredAuthority = params.authority ||
+            (await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, this.correlationId)({
+                requestAuthority,
+                requestAzureCloudOptions,
+                requestExtraQueryParameters,
+                account,
+            }));
         const logger = this.config.system.loggerOptions;
         return {
             authOptions: {
@@ -11860,7 +11861,6 @@ class SignInSubmitCodeResult extends AuthFlowResultBase {
     }
     /**
      * Checks if the result requires authentication method registration.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isAuthMethodRegistrationRequired() {
         return (this.state.stateType ===
@@ -11868,7 +11868,6 @@ class SignInSubmitCodeResult extends AuthFlowResultBase {
     }
     /**
      * Checks if the result requires MFA.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isMfaRequired() {
         return this.state.stateType === MFA_AWAITING_STATE_TYPE;
@@ -11950,7 +11949,6 @@ class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultBase {
     /**
      * Checks if the result indicates that verification is required.
      * @returns true if verification is required, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isVerificationRequired() {
         return (this.state.stateType ===
@@ -11959,7 +11957,6 @@ class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultBase {
     /**
      * Checks if the result indicates that registration is completed (fast-pass scenario).
      * @returns true if registration is completed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isCompleted() {
         return (this.state.stateType ===
@@ -11968,7 +11965,6 @@ class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultBase {
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed() {
         return (this.state.stateType === AUTH_METHOD_REGISTRATION_FAILED_STATE_TYPE);
@@ -11996,7 +11992,6 @@ class AuthMethodRegistrationSubmitChallengeResult extends AuthFlowResultBase {
     /**
      * Checks if the result indicates that registration is completed.
      * @returns true if registration is completed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isCompleted() {
         return (this.state.stateType ===
@@ -12005,7 +12000,6 @@ class AuthMethodRegistrationSubmitChallengeResult extends AuthFlowResultBase {
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed() {
         return (this.state.stateType === AUTH_METHOD_REGISTRATION_FAILED_STATE_TYPE);
@@ -12087,7 +12081,7 @@ class AuthMethodRegistrationState extends AuthFlowActionRequiredStateBase {
             }
         }
         catch (error) {
-            this.stateParameters.logger.error("Failed to challenge authentication method for auth method registration.", this.stateParameters.correlationId);
+            this.stateParameters.logger.errorPii(`Failed to challenge authentication method for auth method registration. Error: ${error}.`, this.stateParameters.correlationId);
             return AuthMethodRegistrationChallengeMethodResult.createWithError(error);
         }
     }
@@ -12106,7 +12100,6 @@ class AuthMethodRegistrationRequiredState extends AuthMethodRegistrationState {
     /**
      * Gets the available authentication methods for registration.
      * @returns Array of available authentication methods.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getAuthMethods() {
         return this.stateParameters.authMethods;
@@ -12115,7 +12108,6 @@ class AuthMethodRegistrationRequiredState extends AuthMethodRegistrationState {
      * Challenges an authentication method for registration.
      * @param authMethodDetails The authentication method details to challenge.
      * @returns Promise that resolves to AuthMethodRegistrationChallengeMethodResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async challengeAuthMethod(authMethodDetails) {
         return this.challengeAuthMethodInternal(authMethodDetails);
@@ -12135,7 +12127,6 @@ class AuthMethodVerificationRequiredState extends AuthMethodRegistrationState {
     /**
      * Gets the length of the expected verification code.
      * @returns The code length.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getCodeLength() {
         return this.stateParameters.codeLength;
@@ -12143,7 +12134,6 @@ class AuthMethodVerificationRequiredState extends AuthMethodRegistrationState {
     /**
      * Gets the channel through which the challenge was sent.
      * @returns The challenge channel (e.g., "email").
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getChannel() {
         return this.stateParameters.challengeChannel;
@@ -12151,7 +12141,6 @@ class AuthMethodVerificationRequiredState extends AuthMethodRegistrationState {
     /**
      * Gets the target label indicating where the challenge was sent.
      * @returns The challenge target label (e.g., masked email address).
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getSentTo() {
         return this.stateParameters.challengeTargetLabel;
@@ -12160,7 +12149,6 @@ class AuthMethodVerificationRequiredState extends AuthMethodRegistrationState {
      * Submits the verification challenge to complete the authentication method registration.
      * @param code The verification code entered by the user.
      * @returns Promise that resolves to AuthMethodRegistrationSubmitChallengeResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async submitChallenge(code) {
         try {
@@ -12181,7 +12169,7 @@ class AuthMethodVerificationRequiredState extends AuthMethodRegistrationState {
             return new AuthMethodRegistrationSubmitChallengeResult(new AuthMethodRegistrationCompletedState(), accountInfo);
         }
         catch (error) {
-            this.stateParameters.logger.error("Failed to submit auth method challenge.", this.stateParameters.correlationId);
+            this.stateParameters.logger.errorPii(`Failed to submit auth method challenge. Error: ${error}.`, this.stateParameters.correlationId);
             return AuthMethodRegistrationSubmitChallengeResult.createWithError(error);
         }
     }
@@ -12189,7 +12177,6 @@ class AuthMethodVerificationRequiredState extends AuthMethodRegistrationState {
      * Challenges a different authentication method for registration.
      * @param authMethodDetails The authentication method details to challenge.
      * @returns Promise that resolves to AuthMethodRegistrationChallengeMethodResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async challengeAuthMethod(authMethodDetails) {
         return this.challengeAuthMethodInternal(authMethodDetails);
@@ -12270,7 +12257,6 @@ class MfaSubmitChallengeResult extends AuthFlowResultBase {
     /**
      * Checks if the MFA flow is completed successfully.
      * @returns true if completed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isCompleted() {
         return this.state.stateType === MFA_COMPLETED_STATE_TYPE;
@@ -12278,7 +12264,6 @@ class MfaSubmitChallengeResult extends AuthFlowResultBase {
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed() {
         return this.state.stateType === MFA_FAILED_STATE_TYPE;
@@ -12307,7 +12292,6 @@ class MfaRequestChallengeResult extends AuthFlowResultBase {
     /**
      * Checks if the result indicates that verification is required.
      * @returns true if verification is required, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isVerificationRequired() {
         return this.state.stateType === MFA_VERIFICATION_REQUIRED_STATE_TYPE;
@@ -12315,7 +12299,6 @@ class MfaRequestChallengeResult extends AuthFlowResultBase {
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed() {
         return this.state.stateType === MFA_FAILED_STATE_TYPE;
@@ -12348,7 +12331,6 @@ class MfaState extends AuthFlowActionRequiredStateBase {
      * Requests an MFA challenge for a specific authentication method.
      * @param authMethodId The authentication method ID to use for the challenge.
      * @returns Promise that resolves to MfaRequestChallengeResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async requestChallenge(authMethodId) {
         try {
@@ -12397,7 +12379,6 @@ class MfaAwaitingState extends MfaState {
     /**
      * Gets the available authentication methods for MFA.
      * @returns Array of available authentication methods.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getAuthMethods() {
         return this.stateParameters.authMethods;
@@ -12418,7 +12399,6 @@ class MfaVerificationRequiredState extends MfaState {
     /**
      * Gets the length of the code that the user needs to provide.
      * @returns The expected code length.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getCodeLength() {
         return this.stateParameters.codeLength;
@@ -12426,7 +12406,6 @@ class MfaVerificationRequiredState extends MfaState {
     /**
      * Gets the channel through which the challenge was sent.
      * @returns The challenge channel (e.g., "email").
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getChannel() {
         return this.stateParameters.challengeChannel;
@@ -12434,7 +12413,6 @@ class MfaVerificationRequiredState extends MfaState {
     /**
      * Gets the target label indicating where the challenge was sent.
      * @returns The challenge target label (e.g., masked email address).
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getSentTo() {
         return this.stateParameters.challengeTargetLabel;
@@ -12443,7 +12421,6 @@ class MfaVerificationRequiredState extends MfaState {
      * Submits the MFA challenge (e.g., OTP code) to complete the authentication.
      * @param challenge The challenge code (e.g., OTP code) entered by the user.
      * @returns Promise that resolves to MfaSubmitChallengeResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async submitChallenge(challenge) {
         try {
@@ -12690,7 +12667,6 @@ class SignInSubmitPasswordResult extends AuthFlowResultBase {
     }
     /**
      * Checks if the result requires authentication method registration.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isAuthMethodRegistrationRequired() {
         return (this.state.stateType ===
@@ -12698,7 +12674,6 @@ class SignInSubmitPasswordResult extends AuthFlowResultBase {
     }
     /**
      * Checks if the result requires MFA.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isMfaRequired() {
         return this.state.stateType === MFA_AWAITING_STATE_TYPE;
@@ -17320,6 +17295,8 @@ async function getEARForm(frame, config, authority, request, logger, performance
     const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
     addResponseType(parameters, OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN);
     addEARParameters(parameters, request.earJwk);
+    // Also add codeChallenge as backup in case EAR is not supported
+    addCodeChallengeParams(parameters, request.codeChallenge, Constants.S256_CODE_CHALLENGE_METHOD);
     const queryParams = new Map();
     addExtraQueryParameters(queryParams, request.extraQueryParameters || {});
     const url = getAuthorizeUrl(authority, queryParams, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
@@ -18390,7 +18367,7 @@ class PopupClient extends StandardInteractionClient {
         const isPlatformBroker = isPlatformAuthAllowed(this.config, this.logger, this.platformAuthProvider, request.authenticationScheme);
         validRequest.platformBroker = isPlatformBroker;
         if (this.config.auth.protocolMode === ProtocolMode.EAR) {
-            return this.executeEarFlow(validRequest, popupParams);
+            return this.executeEarFlow(validRequest, popupParams, pkceCodes);
         }
         else {
             return this.executeCodeFlow(validRequest, popupParams, pkceCodes);
@@ -18450,7 +18427,7 @@ class PopupClient extends StandardInteractionClient {
      * Executes EAR flow
      * @param request
      */
-    async executeEarFlow(request, popupParams) {
+    async executeEarFlow(request, popupParams, pkceCodes) {
         const correlationId = request.correlationId;
         // Get the frame handle for the silent request
         const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
@@ -18460,9 +18437,12 @@ class PopupClient extends StandardInteractionClient {
             account: request.account,
         });
         const earJwk = await invokeAsync(generateEarKey, PerformanceEvents.GenerateEarKey, this.logger, this.performanceClient, correlationId)();
+        const pkce = pkceCodes ||
+            (await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId));
         const popupRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkce.challenge,
         };
         const popupWindow = popupParams.popup || this.openPopup("about:blank", popupParams);
         const form = await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient);
@@ -18470,7 +18450,20 @@ class PopupClient extends StandardInteractionClient {
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(this.monitorPopupForHash.bind(this), PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupWindow, popupParams.popupWindowParent);
         const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
-        return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, ApiId.acquireTokenPopup, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        if (!serverParams.ear_jwe && serverParams.code) {
+            const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
+                serverTelemetryManager: this.initializeServerTelemetryManager(ApiId.acquireTokenPopup),
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+                authority: discoveredAuthority,
+            });
+            return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        }
+        else {
+            return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, ApiId.acquireTokenPopup, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        }
     }
     async executeCodeFlowWithPost(request, popupParams, authClient, pkceVerifier) {
         const correlationId = request.correlationId;
@@ -18879,11 +18872,13 @@ class RedirectClient extends StandardInteractionClient {
             account: request.account,
         });
         const earJwk = await invokeAsync(generateEarKey, PerformanceEvents.GenerateEarKey, this.logger, this.performanceClient, correlationId)();
+        const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
         const redirectRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkceCodes.challenge,
         };
-        this.browserStorage.cacheAuthorizeRequest(redirectRequest);
+        this.browserStorage.cacheAuthorizeRequest(redirectRequest, pkceCodes.verifier);
         const form = await getEARForm(document, this.config, discoveredAuthority, redirectRequest, this.logger, this.performanceClient);
         form.submit();
         return new Promise((resolve, reject) => {
@@ -19341,6 +19336,7 @@ function createHiddenIframe() {
     authFrame.style.width = authFrame.style.height = "0";
     authFrame.style.border = "0";
     authFrame.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
+    authFrame.setAttribute("allow", "local-network-access *");
     document.body.appendChild(authFrame);
     return authFrame;
 }
@@ -19448,16 +19444,32 @@ class SilentIframeClient extends StandardInteractionClient {
             account: request.account,
         });
         const earJwk = await invokeAsync(generateEarKey, PerformanceEvents.GenerateEarKey, this.logger, this.performanceClient, correlationId)();
+        const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
         const silentRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkceCodes.challenge,
         };
         const msalFrame = await invokeAsync(initiateEarRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
         const responseType = this.config.auth.OIDCOptions.serverResponseType;
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
         const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger);
-        return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        if (!serverParams.ear_jwe && serverParams.code) {
+            // If server doesn't support EAR, they may fallback to auth code flow instead
+            const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
+                serverTelemetryManager: this.initializeServerTelemetryManager(this.apiId),
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+                authority: discoveredAuthority,
+            });
+            return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        }
+        else {
+            return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        }
     }
     /**
      * Currently Unsupported