npm - @azure/msal-browser - Versions diffs - 4.28.2 → 4.29.1 - Mend

@azure/msal-browser 4.28.2 → 4.29.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (333) hide show

package/lib/custom-auth-path/msal-custom-auth.js CHANGED Viewed

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msalCustomAuth = {}));
 })(this, (function (exports) { 'use strict';
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -280,7 +280,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -291,7 +291,7 @@
     const unexpectedError = "unexpected_error";
     const postRequestFailed$1 = "post_request_failed";
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -326,7 +326,7 @@
             : AuthErrorMessages[code]);
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -377,7 +377,7 @@
     const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
     const platformBrokerError = "platform_broker_error";
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -452,7 +452,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -491,7 +491,7 @@
         },
     };
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -682,12 +682,12 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "15.14.2";
+    const version$1 = "15.16.1";
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -696,7 +696,7 @@
         // AzureCloudInstance is not specified.
         None: "none"};
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -726,7 +726,7 @@
     const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
     const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -772,7 +772,7 @@
         return new ClientConfigurationError(errorCode);
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -867,9 +867,48 @@
                 .replace(/\?/g, "\\?"));
             return regex.test(input);
         }
+        /**
+         * Tests if a given string matches a given pattern using stricter, anchored matching semantics.
+         *
+         * Differences from `matchPattern` (legacy):
+         * - All regex metacharacters (including `.`) in the pattern are treated as literals,
+         *   so `example.com` matches only `example.com` and not `exampleXcom`.
+         * - The generated regex is anchored with `^` and `$` so partial/substring matches
+         *   are not allowed.
+         * - `*` is the only supported wildcard. Its behaviour depends on the URL component:
+         *   - `host` component: `*` matches any sequence of characters that does NOT include
+         *     a dot (`.`), keeping wildcards within a single DNS label boundary.
+         *   - All other components: `*` matches any sequence of characters (including `/`).
+         *
+         * @param pattern - The `protectedResourceMap` key pattern to match against. `*` is a
+         *   multi-character wildcard; all other characters are treated as literals.
+         * @param input - The URL component value (e.g. host, pathname) extracted from the
+         *   outgoing request URL to test against the pattern.
+         * @param options - Optional. Provide `component` to enable component-aware wildcard
+         *   semantics. Accepted values: `"host"`, `"path"`, `"protocol"`, `"search"`,
+         *   `"hash"`. Defaults to path-style (permissive) matching when omitted.
+         * @returns `true` if the full input string matches the pattern; `false` otherwise.
+         */
+        static matchPatternStrict(pattern, input, options) {
+            const component = options?.component;
+            // Step 1: Escape all regex special characters so literals are matched literally.
+            let regexBody = pattern.replace(/[.+^${}()|[\]\\*?]/g, "\\$&");
+            // Step 2: Replace the escaped '*' with its component-aware regex equivalent.
+            if (component === "host") {
+                regexBody = regexBody.replace(/\\\*/g, "[^.]*");
+            }
+            else {
+                // PATH, PROTOCOL, SEARCH, HASH, or unspecified: '*' matches any characters.
+                regexBody = regexBody.replace(/\\\*/g, ".*");
+            }
+            // Step 3: Anchor for full-string matching.
+            // eslint-disable-next-line security/detect-non-literal-regexp
+            const regex = new RegExp(`^${regexBody}$`);
+            return regex.test(input);
+        }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1064,7 +1103,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1104,7 +1143,7 @@
         };
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1186,7 +1225,7 @@
         return updatedAccountInfo;
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1201,7 +1240,7 @@
         Ciam: 3,
     };
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1223,7 +1262,7 @@
         return null;
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1247,7 +1286,7 @@
         EAR: "EAR",
     };
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1482,7 +1521,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1563,7 +1602,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1679,7 +1718,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1843,7 +1882,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2018,7 +2057,7 @@
         return null;
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2026,7 +2065,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2071,7 +2110,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3181,7 +3220,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3443,6 +3482,11 @@
         LoadIdToken: "loadIdToken",
         LoadAccessToken: "loadAccessToken",
         LoadRefreshToken: "loadRefreshToken",
+        /**
+         * SSO capability verification call (msal-browser).
+         * Fire-and-forget SSO verification call made after interactive authentication completes.
+         */
+        SsoCapable: "ssoCapable",
     };
     /**
      * State of the performance event.
@@ -3453,7 +3497,7 @@
     const PerformanceEventStatus = {
         InProgress: 1};
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3532,7 +3576,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3632,7 +3676,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3642,7 +3686,7 @@
         UPN: "UPN",
     };
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3692,7 +3736,7 @@
     const EAR_JWK = "ear_jwk";
     const EAR_JWE_CRYPTO = "ear_jwe_crypto";
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4072,7 +4116,7 @@
         });
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4084,7 +4128,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4094,7 +4138,7 @@
             response.hasOwnProperty("metadata"));
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4104,7 +4148,7 @@
             response.hasOwnProperty("error_description"));
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4200,7 +4244,7 @@
         };
     };
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4306,7 +4350,7 @@
         },
     };
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4371,7 +4415,7 @@
         return cachedAtSec > nowSeconds();
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4633,7 +4677,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5472,7 +5516,7 @@
         };
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5503,7 +5547,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5522,7 +5566,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5543,7 +5587,7 @@
         };
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5630,7 +5674,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5661,7 +5705,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5809,23 +5853,58 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    // Codes defined by MSAL
+    /**
+     * MSAL-defined interaction required error code indicating no tokens are found in cache.
+     * @public
+     */
     const noTokensFound = "no_tokens_found";
+    /**
+     * MSAL-defined error code indicating a native account is unavailable on the platform.
+     * @public
+     */
     const nativeAccountUnavailable = "native_account_unavailable";
+    /**
+     * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
+     * @public
+     */
     const refreshTokenExpired = "refresh_token_expired";
+    /**
+     * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
+     * @public
+     */
     const uxNotAllowed = "ux_not_allowed";
-    // Codes potentially returned by server
+    /**
+     * Server-originated error code indicating interaction is required to complete the request.
+     * @public
+     */
     const interactionRequired = "interaction_required";
+    /**
+     * Server-originated error code indicating user consent is required.
+     * @public
+     */
     const consentRequired = "consent_required";
+    /**
+     * Server-originated error code indicating user login is required.
+     * @public
+     */
     const loginRequired = "login_required";
-    const badToken = "bad_token";
+    /**
+     * Server-originated error code indicating the token is invalid or corrupted.
+     * @public
+     */
+    const badToken = "bad_token";
+    /**
+     * Server-originated error code indicating the user was interrupted and must reattempt the flow.
+     * @public
+     */
+    const interruptedUser = "interrupted_user";
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5840,6 +5919,7 @@
         loginRequired,
         badToken,
         uxNotAllowed,
+        interruptedUser,
     ];
     const InteractionRequiredAuthSubErrorMessage = [
         "message_only",
@@ -5848,6 +5928,7 @@
         "user_password_expired",
         "consent_required",
         "bad_token",
+        "interrupted_user",
     ];
     const InteractionRequiredAuthErrorMessages = {
         [noTokensFound]: "No refresh token found in the cache. Please sign-in.",
@@ -5855,6 +5936,7 @@
         [refreshTokenExpired]: "Refresh token has expired.",
         [badToken]: "Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",
         [uxNotAllowed]: "`canShowUI` flag in Edge was set to false. User interaction required on web page. Please invoke an interactive API to resolve.",
+        [interruptedUser]: "The user could not be authenticated due to an interrupted state. Please invoke an interactive API to resolve.",
     };
     /**
      * Error thrown when user interaction is required.
@@ -5897,7 +5979,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5969,7 +6051,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6051,7 +6133,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6078,7 +6160,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6417,7 +6499,7 @@
         return baseAccount;
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6435,7 +6517,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6584,11 +6666,6 @@
                     throw createClientConfigurationError(missingSshJwk);
                 }
             }
-            if (!StringUtils.isEmptyObj(request.claims) ||
-                (this.config.authOptions.clientCapabilities &&
-                    this.config.authOptions.clientCapabilities.length > 0)) {
-                addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-            }
             let ccsCred = undefined;
             if (request.clientInfo) {
                 try {
@@ -6638,6 +6715,15 @@
                 });
             }
             instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+            const configClaims = request.skipBrokerClaims &&
+                parameters.has(BROKER_CLIENT_ID)
+                ? undefined
+                : this.config.authOptions.clientCapabilities;
+            if (!StringUtils.isEmptyObj(request.claims) ||
+                (configClaims && configClaims.length > 0)) {
+                addClaims(parameters, request.claims, configClaims);
+            }
             return mapToQueryString(parameters);
         }
         /**
@@ -6671,7 +6757,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6849,11 +6935,6 @@
                     throw createClientConfigurationError(missingSshJwk);
                 }
             }
-            if (!StringUtils.isEmptyObj(request.claims) ||
-                (this.config.authOptions.clientCapabilities &&
-                    this.config.authOptions.clientCapabilities.length > 0)) {
-                addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-            }
             if (this.config.systemOptions.preventCorsPreflight &&
                 request.ccsCredential) {
                 switch (request.ccsCredential.type) {
@@ -6879,11 +6960,20 @@
                 addExtraQueryParameters(parameters, request.tokenBodyParameters);
             }
             instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+            const configClaims = request.skipBrokerClaims &&
+                parameters.has(BROKER_CLIENT_ID)
+                ? undefined
+                : this.config.authOptions.clientCapabilities;
+            if (!StringUtils.isEmptyObj(request.claims) ||
+                (configClaims && configClaims.length > 0)) {
+                addClaims(parameters, request.claims, configClaims);
+            }
             return mapToQueryString(parameters);
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6981,7 +7071,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6996,7 +7086,7 @@
         },
     };
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7117,14 +7207,17 @@
         if (request.state) {
             addState(parameters, request.state);
         }
-        if (request.claims ||
-            (authOptions.clientCapabilities &&
-                authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, authOptions.clientCapabilities);
-        }
         if (request.embeddedClientId) {
             addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
         }
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims &&
+            parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : authOptions.clientCapabilities;
+        if (request.claims || (configClaims && configClaims.length > 0)) {
+            addClaims(parameters, request.claims, configClaims);
+        }
         // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
         if (authOptions.instanceAware &&
             (!request.extraQueryParameters ||
@@ -7220,7 +7313,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7483,7 +7576,7 @@
         }
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7491,7 +7584,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7516,7 +7609,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
-    /*! @azure/msal-common v15.14.2 2026-02-10 */
+    /*! @azure/msal-common v15.16.1 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7951,7 +8044,7 @@
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "4.28.2";
+    const version = "4.29.1";
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9719,6 +9812,10 @@
         async initializeAuthorizationRequest(request, interactionType) {
             this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.correlationId);
             const redirectUri = this.getRedirectUri(request.redirectUri);
+            if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
+                this.logger.warning("The origin of the redirect URI does not match the origin of the current page. This is likely to cause issues with authentication.", this.correlationId);
+                this.performanceClient.addFields({ isRedirectUriCrossOrigin: true }, this.correlationId);
+            }
             const browserState = {
                 interactionType: interactionType,
             };
@@ -17806,6 +17903,7 @@
             supportsNestedAppAuth: false,
             instanceAware: false,
             encodeExtraQueryParams: false,
+            verifySSO: false,
         };
         // Default cache options for browser
         const DEFAULT_CACHE_OPTIONS = {
@@ -18279,14 +18377,28 @@
             return nativeResponse;
         }
         getDOMExtraParams(extraParameters) {
-            const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
-                record[key] = String(value);
-                return record;
-            }, {});
-            const validExtraParams = {
-                ...stringifiedParams,
-            };
-            return validExtraParams;
+            try {
+                const stringifiedProperties = {};
+                for (const [key, value] of Object.entries(extraParameters)) {
+                    if (!value) {
+                        continue;
+                    }
+                    if (typeof value === "object") {
+                        stringifiedProperties[key] = JSON.stringify(value);
+                    }
+                    else {
+                        stringifiedProperties[key] = String(value);
+                    }
+                }
+                return stringifiedProperties;
+            }
+            catch (e) {
+                this.logger.error(this.platformAuthType + " - Error stringifying extra parameters");
+                this.logger.errorPii(this.platformAuthType +
+                    " - Error stringifying extra parameters: " +
+                    e);
+                return {};
+            }
         }
     }
@@ -19337,6 +19449,12 @@
      */
     async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId, responseType) {
         performanceClient.addQueueMeasurement(PerformanceEvents.SilentHandlerMonitorIframeForHash, correlationId);
+        performanceClient.addFields({
+            iframePollIntervalMs: pollIntervalMilliseconds,
+            iframeTimeoutMs: timeout,
+        }, correlationId);
+        let totalTickCount = 0;
+        let crossOriginTickCount = 0;
         return new Promise((resolve, reject) => {
             if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
                 logger.warning(`system.loadFrameTimeout or system.iframeHashTimeout set to lower (${timeout}ms) than the default (${DEFAULT_IFRAME_TIMEOUT_MS}ms). This may result in timeouts.`);
@@ -19350,6 +19468,7 @@
                 reject(createBrowserAuthError(monitorWindowTimeout));
             }, timeout);
             const intervalId = window.setInterval(() => {
+                totalTickCount++;
                 let href = "";
                 const contentWindow = iframe.contentWindow;
                 try {
@@ -19360,7 +19479,9 @@
                      */
                     href = contentWindow ? contentWindow.location.href : "";
                 }
-                catch (e) { }
+                catch (e) {
+                    crossOriginTickCount++;
+                }
                 if (!href || href === "about:blank") {
                     return;
                 }
@@ -19378,6 +19499,10 @@
                 resolve(responseString);
             }, pollIntervalMilliseconds);
         }).finally(() => {
+            performanceClient.addFields({
+                iframeTickCount: totalTickCount,
+                crossOriginTickCount: crossOriginTickCount,
+            }, correlationId);
             invoke(removeHiddenIframe, PerformanceEvents.RemoveHiddenIframe, logger, performanceClient, correlationId)(iframe);
         });
     }
@@ -19565,6 +19690,52 @@
                 return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
             }
         }
+        /**
+         * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+         * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+         * @param request - The SSO silent request
+         * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+         */
+        async verifySso(request) {
+            this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentIframeClientAcquireToken, request.correlationId);
+            const inputRequest = { ...request };
+            if (!inputRequest.prompt) {
+                inputRequest.prompt = PromptValue.NONE;
+            }
+            // Create silent request
+            const silentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)(inputRequest, InteractionType.Silent);
+            const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
+                serverTelemetryManager: this.initializeServerTelemetryManager(this.apiId),
+                requestAuthority: silentRequest.authority,
+                requestAzureCloudOptions: silentRequest.azureCloudOptions,
+                requestExtraQueryParameters: silentRequest.extraQueryParameters,
+                account: silentRequest.account,
+            });
+            const correlationId = silentRequest.correlationId;
+            const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
+            const requestWithPkce = {
+                ...silentRequest,
+                codeChallenge: pkceCodes.challenge,
+            };
+            // Create authorize request url
+            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, requestWithPkce, this.logger, this.performanceClient);
+            // Get the frame handle for the silent request - this triggers the SSO verification
+            const msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+            const responseType = this.config.auth.OIDCOptions.serverResponseType;
+            // Monitor the iframe for the response
+            const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
+            // Deserialize the response
+            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger);
+            // Validate the response - this checks for errors and validates state
+            validateAuthorizationResponse(serverParams, silentRequest.state);
+            // Verify a valid authorization code is present
+            if (!serverParams.code) {
+                this.logger.warning("SSO verification response did not contain an authorization code", correlationId);
+                return false;
+            }
+            this.logger.verbose("SSO verification completed successfully with valid authorization code - skipped token exchange", correlationId);
+            return true;
+        }
         /**
          * Currently Unsupported
          */
@@ -19959,6 +20130,10 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
+    /**
+     * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+     * @returns Network connection information, or an empty object if not available.
+     */
     function collectInstanceStats(currentClientId, performanceEvent, logger) {
         const frameInstances =
         // @ts-ignore
@@ -20052,22 +20227,30 @@
             this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto, this.performanceClient);
             this.activeSilentTokenRequests = new Map();
             // Register listener functions
-            this.trackPageVisibility = this.trackPageVisibility.bind(this);
-            // Register listener functions
-            this.trackPageVisibilityWithMeasurement =
-                this.trackPageVisibilityWithMeasurement.bind(this);
+            this.trackStateChangeWithMeasurement =
+                this.trackStateChangeWithMeasurement.bind(this);
         }
         static async createController(operatingContext, request) {
             const controller = new StandardController(operatingContext);
             await controller.initialize(request);
             return controller;
         }
-        trackPageVisibility(correlationId) {
+        trackStateChange(correlationId, event) {
             if (!correlationId) {
                 return;
             }
-            this.logger.info("Perf: Visibility change detected");
-            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+            if (event.type === "visibilitychange") {
+                this.logger.info("Perf: Visibility change detected");
+                this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+            }
+            else if (event.type === "online") {
+                this.logger.info("Perf: Online status change detected");
+                this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+            }
+            else if (event.type === "offline") {
+                this.logger.info("Perf: Offline status change detected");
+                this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+            }
         }
         /**
          * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -20215,6 +20398,8 @@
                     rootMeasurement.end({
                         success: true,
                     }, undefined, result.account);
+                    // Fire-and-forget SSO capability verification in background
+                    this.verifySsoCapability(result.account, InteractionType.Redirect);
                 }
                 else {
                     /*
@@ -20447,6 +20632,8 @@
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
                 }, undefined, result.account);
+                // SSO capability verification in background
+                this.verifySsoCapability(result.account, InteractionType.Popup);
                 return result;
             })
                 .catch((e) => {
@@ -20469,16 +20656,87 @@
                 }
             });
         }
-        trackPageVisibilityWithMeasurement() {
+        trackStateChangeWithMeasurement(event) {
             const measurement = this.ssoSilentMeasurement ||
                 this.acquireTokenByCodeAsyncMeasurement;
             if (!measurement) {
                 return;
             }
-            this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
-            measurement.increment({
-                visibilityChangeCount: 1,
+            if (event.type === "visibilitychange") {
+                this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
+                measurement.increment({
+                    visibilityChangeCount: 1,
+                });
+            }
+            else if (event.type === "online") {
+                this.logger.info("Perf: Online status change detected in ", measurement.event.name);
+                measurement.increment({
+                    onlineStatusChangeCount: 1,
+                });
+            }
+            else if (event.type === "offline") {
+                this.logger.info("Perf: Offline status change detected in ", measurement.event.name);
+                measurement.increment({
+                    onlineStatusChangeCount: 1,
+                });
+            }
+        }
+        addStateChangeListeners(listener) {
+            document.addEventListener("visibilitychange", listener);
+            window.addEventListener("online", listener);
+            window.addEventListener("offline", listener);
+        }
+        removeStateChangeListeners(listener) {
+            document.removeEventListener("visibilitychange", listener);
+            window.removeEventListener("online", listener);
+            window.removeEventListener("offline", listener);
+        }
+        /**
+         * SSO capability verification in the background.
+         * This method makes an iframe request to /authorize to verify SSO capability without calling /token.
+         * This method does not block the caller and tracks telemetry for success/failure.
+         * This method only executes if verifySSO is set to true in the auth configuration.
+         * @param account - The account to use for the SSO verification
+         * @param parentApi - The API ID of the parent operation for logging purposes
+         */
+        verifySsoCapability(account, parentApi) {
+            // Check if SSO capability verification is enabled
+            if (!this.config.auth.verifySSO) {
+                return;
+            }
+            const correlationId = this.browserCrypto.createNewGuid();
+            const ssoCapableMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.SsoCapable, correlationId);
+            ssoCapableMeasurement.add({
+                parentApi: parentApi,
             });
+            this.logger.verbose(`SSO capability verification initiated after ${parentApi}`, correlationId);
+            /*
+             * Use setTimeout to ensure this runs in a separate macrotask after the current call stack completes
+             * This ensures the result is returned to the caller before the SSO verification starts and doesn't affect performance
+             */
+            setTimeout(() => {
+                const ssoVerificationRequest = {
+                    account: account,
+                    correlationId: correlationId,
+                };
+                const silentIframeClient = this.createSilentIframeClient(correlationId);
+                silentIframeClient
+                    .verifySso(ssoVerificationRequest)
+                    .then((success) => {
+                    this.logger.verbose(`SSO capability verification completed after ${parentApi}, success: ${success}`, correlationId);
+                    ssoCapableMeasurement.end({
+                        fromCache: false,
+                        success: success,
+                    }, undefined, account);
+                })
+                    .catch((error) => {
+                    this.logger.warning(`SSO capability verification failed after ${parentApi}: ${error.message}`, correlationId);
+                    ssoCapableMeasurement.end({
+                        fromCache: false,
+                        success: false,
+                    }, error, account);
+                });
+            }, 0);
         }
         // #endregion
         // #region Silent Flow
@@ -20512,8 +20770,9 @@
             preflightCheck(this.initialized, this.ssoSilentMeasurement, request.account);
             this.ssoSilentMeasurement?.increment({
                 visibilityChangeCount: 0,
+                onlineStatusChangeCount: 0,
             });
-            document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
             this.logger.verbose("ssoSilent called", correlationId);
             this.eventHandler.emitEvent(EventType.SSO_SILENT_START, InteractionType.Silent, validRequest);
             let result;
@@ -20557,7 +20816,7 @@
                 throw e;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+                this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
             });
         }
         /**
@@ -20669,8 +20928,9 @@
                 this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCodeAsync, request.correlationId);
             this.acquireTokenByCodeAsyncMeasurement?.increment({
                 visibilityChangeCount: 0,
+                onlineStatusChangeCount: 0,
             });
-            document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
             const silentAuthCodeClient = this.createSilentAuthCodeClient(request.correlationId);
             const silentTokenResult = await silentAuthCodeClient
                 .acquireToken(request)
@@ -20688,7 +20948,7 @@
                 throw tokenRenewalError;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+                this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
             });
             return silentTokenResult;
         }
@@ -21233,18 +21493,22 @@
          * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
          */
         async acquireTokenSilentAsync(request, account) {
-            const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+            const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
             this.performanceClient.addQueueMeasurement(PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, InteractionType.Silent, request);
             if (request.correlationId) {
-                this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+                this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
             }
-            document.addEventListener("visibilitychange", trackPageVisibility);
+            this.addStateChangeListeners(trackStateChange);
             const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
             const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
             const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
                 const shouldTryToResolveSilently = checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheLookupPolicy);
                 if (shouldTryToResolveSilently) {
+                    const silentRefreshReason = `${refreshTokenError.errorCode}${refreshTokenError.subError
+                    ? `|${refreshTokenError.subError}`
+                    : ""}`;
+                    this.performanceClient.addFields({ silentRefreshReason }, silentRequest.correlationId);
                     if (!this.activeIframeRequest) {
                         let _resolve;
                         // Always set the active request tracker immediately after checking it to prevent races
@@ -21314,7 +21578,7 @@
                 throw tokenRenewalError;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", trackPageVisibility);
+                this.removeStateChangeListeners(trackStateChange);
             });
         }
         /**