@azure/msal-browser 4.28.2 → 4.29.1

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -279,7 +279,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -296,7 +296,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -345,7 +345,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -445,7 +445,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -702,7 +702,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -741,7 +741,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -932,12 +932,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.14.2";
+const version$1 = "15.16.1";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -957,7 +957,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1015,7 +1015,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1163,7 +1163,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1258,9 +1258,48 @@ class StringUtils {
             .replace(/\?/g, "\\?"));
         return regex.test(input);
     }
+    /**
+     * Tests if a given string matches a given pattern using stricter, anchored matching semantics.
+     *
+     * Differences from `matchPattern` (legacy):
+     * - All regex metacharacters (including `.`) in the pattern are treated as literals,
+     *   so `example.com` matches only `example.com` and not `exampleXcom`.
+     * - The generated regex is anchored with `^` and `$` so partial/substring matches
+     *   are not allowed.
+     * - `*` is the only supported wildcard. Its behaviour depends on the URL component:
+     *   - `host` component: `*` matches any sequence of characters that does NOT include
+     *     a dot (`.`), keeping wildcards within a single DNS label boundary.
+     *   - All other components: `*` matches any sequence of characters (including `/`).
+     *
+     * @param pattern - The `protectedResourceMap` key pattern to match against. `*` is a
+     *   multi-character wildcard; all other characters are treated as literals.
+     * @param input - The URL component value (e.g. host, pathname) extracted from the
+     *   outgoing request URL to test against the pattern.
+     * @param options - Optional. Provide `component` to enable component-aware wildcard
+     *   semantics. Accepted values: `"host"`, `"path"`, `"protocol"`, `"search"`,
+     *   `"hash"`. Defaults to path-style (permissive) matching when omitted.
+     * @returns `true` if the full input string matches the pattern; `false` otherwise.
+     */
+    static matchPatternStrict(pattern, input, options) {
+        const component = options?.component;
+        // Step 1: Escape all regex special characters so literals are matched literally.
+        let regexBody = pattern.replace(/[.+^${}()|[\]\\*?]/g, "\\$&");
+        // Step 2: Replace the escaped '*' with its component-aware regex equivalent.
+        if (component === "host") {
+            regexBody = regexBody.replace(/\\\*/g, "[^.]*");
+        }
+        else {
+            // PATH, PROTOCOL, SEARCH, HASH, or unspecified: '*' matches any characters.
+            regexBody = regexBody.replace(/\\\*/g, ".*");
+        }
+        // Step 3: Anchor for full-string matching.
+        // eslint-disable-next-line security/detect-non-literal-regexp
+        const regex = new RegExp(`^${regexBody}$`);
+        return regex.test(input);
+    }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1455,7 +1494,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1495,7 +1534,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1577,7 +1616,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1592,7 +1631,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1614,7 +1653,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1638,7 +1677,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1873,7 +1912,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1954,7 +1993,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2070,7 +2109,7 @@ function normalizeUrlForComparison(url) {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2234,7 +2273,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2409,7 +2448,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2417,7 +2456,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2462,7 +2501,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3573,7 +3612,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3835,6 +3874,11 @@ const PerformanceEvents = {
     LoadIdToken: "loadIdToken",
     LoadAccessToken: "loadAccessToken",
     LoadRefreshToken: "loadRefreshToken",
+    /**
+     * SSO capability verification call (msal-browser).
+     * Fire-and-forget SSO verification call made after interactive authentication completes.
+     */
+    SsoCapable: "ssoCapable",
 };
 const PerformanceEventAbbreviations = new Map([
     [PerformanceEvents.AcquireTokenByCode, "ATByCode"],
@@ -4062,6 +4106,7 @@ const PerformanceEventAbbreviations = new Map([
     [PerformanceEvents.Decrypt, "decrypt"],
     [PerformanceEvents.GenerateEarKey, "genEarKey"],
     [PerformanceEvents.DecryptEarResponse, "decryptEarResp"],
+    [PerformanceEvents.SsoCapable, "SsoCapable"],
 ]);
 /**
  * State of the performance event.
@@ -4098,9 +4143,14 @@ const IntFields = new Set([
     "currRefreshCount",
     "expiredCacheRemovedCount",
     "upgradedCacheCount",
+    "networkRtt",
+    "iframePollIntervalMs",
+    "iframeTimeoutMs",
+    "iframeTickCount",
+    "crossOriginTickCount",
 ]);
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4179,7 +4229,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4279,7 +4329,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4289,7 +4339,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4339,7 +4389,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4719,7 +4769,7 @@ function addPostBodyParameters(parameters, bodyParameters) {
     });
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4731,7 +4781,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4741,7 +4791,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4751,7 +4801,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4847,7 +4897,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4953,7 +5003,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5018,7 +5068,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5280,7 +5330,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6119,7 +6169,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6150,7 +6200,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6169,7 +6219,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6190,7 +6240,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6277,7 +6327,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6308,7 +6358,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6456,27 +6506,63 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-// Codes defined by MSAL
+/**
+ * MSAL-defined interaction required error code indicating no tokens are found in cache.
+ * @public
+ */
 const noTokensFound = "no_tokens_found";
+/**
+ * MSAL-defined error code indicating a native account is unavailable on the platform.
+ * @public
+ */
 const nativeAccountUnavailable = "native_account_unavailable";
+/**
+ * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
+ * @public
+ */
 const refreshTokenExpired = "refresh_token_expired";
+/**
+ * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
+ * @public
+ */
 const uxNotAllowed = "ux_not_allowed";
-// Codes potentially returned by server
+/**
+ * Server-originated error code indicating interaction is required to complete the request.
+ * @public
+ */
 const interactionRequired = "interaction_required";
+/**
+ * Server-originated error code indicating user consent is required.
+ * @public
+ */
 const consentRequired = "consent_required";
+/**
+ * Server-originated error code indicating user login is required.
+ * @public
+ */
 const loginRequired = "login_required";
-const badToken = "bad_token";
+/**
+ * Server-originated error code indicating the token is invalid or corrupted.
+ * @public
+ */
+const badToken = "bad_token";
+/**
+ * Server-originated error code indicating the user was interrupted and must reattempt the flow.
+ * @public
+ */
+const interruptedUser = "interrupted_user";
 
 var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
     badToken: badToken,
     consentRequired: consentRequired,
     interactionRequired: interactionRequired,
+    interruptedUser: interruptedUser,
     loginRequired: loginRequired,
     nativeAccountUnavailable: nativeAccountUnavailable,
     noTokensFound: noTokensFound,
@@ -6484,7 +6570,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uxNotAllowed: uxNotAllowed
 });
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6499,6 +6585,7 @@ const InteractionRequiredServerErrorMessage = [
     loginRequired,
     badToken,
     uxNotAllowed,
+    interruptedUser,
 ];
 const InteractionRequiredAuthSubErrorMessage = [
     "message_only",
@@ -6507,6 +6594,7 @@ const InteractionRequiredAuthSubErrorMessage = [
     "user_password_expired",
     "consent_required",
     "bad_token",
+    "interrupted_user",
 ];
 const InteractionRequiredAuthErrorMessages = {
     [noTokensFound]: "No refresh token found in the cache. Please sign-in.",
@@ -6514,6 +6602,7 @@ const InteractionRequiredAuthErrorMessages = {
     [refreshTokenExpired]: "Refresh token has expired.",
     [badToken]: "Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",
     [uxNotAllowed]: "`canShowUI` flag in Edge was set to false. User interaction required on web page. Please invoke an interactive API to resolve.",
+    [interruptedUser]: "The user could not be authenticated due to an interrupted state. Please invoke an interactive API to resolve.",
 };
 /**
  * Interaction required errors defined by the SDK
@@ -6532,6 +6621,10 @@ const InteractionRequiredAuthErrorMessage = {
         code: badToken,
         desc: InteractionRequiredAuthErrorMessages[badToken],
     },
+    interrupted_user: {
+        code: interruptedUser,
+        desc: InteractionRequiredAuthErrorMessages[interruptedUser],
+    },
 };
 /**
  * Error thrown when user interaction is required.
@@ -6574,7 +6667,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6646,7 +6739,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6728,7 +6821,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6755,7 +6848,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7094,7 +7187,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7112,7 +7205,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7261,11 +7354,6 @@ class AuthorizationCodeClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         let ccsCred = undefined;
         if (request.clientInfo) {
             try {
@@ -7315,6 +7403,15 @@ class AuthorizationCodeClient extends BaseClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims &&
+            parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : this.config.authOptions.clientCapabilities;
+        if (!StringUtils.isEmptyObj(request.claims) ||
+            (configClaims && configClaims.length > 0)) {
+            addClaims(parameters, request.claims, configClaims);
+        }
         return mapToQueryString(parameters);
     }
     /**
@@ -7348,7 +7445,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7526,11 +7623,6 @@ class RefreshTokenClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
             switch (request.ccsCredential.type) {
@@ -7556,11 +7648,20 @@ class RefreshTokenClient extends BaseClient {
             addExtraQueryParameters(parameters, request.tokenBodyParameters);
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims &&
+            parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : this.config.authOptions.clientCapabilities;
+        if (!StringUtils.isEmptyObj(request.claims) ||
+            (configClaims && configClaims.length > 0)) {
+            addClaims(parameters, request.claims, configClaims);
+        }
         return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7658,7 +7759,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7673,7 +7774,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7794,14 +7895,17 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.state) {
         addState(parameters, request.state);
     }
-    if (request.claims ||
-        (authOptions.clientCapabilities &&
-            authOptions.clientCapabilities.length > 0)) {
-        addClaims(parameters, request.claims, authOptions.clientCapabilities);
-    }
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
+    // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+    const configClaims = request.skipBrokerClaims &&
+        parameters.has(BROKER_CLIENT_ID)
+        ? undefined
+        : authOptions.clientCapabilities;
+    if (request.claims || (configClaims && configClaims.length > 0)) {
+        addClaims(parameters, request.claims, configClaims);
+    }
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -7897,7 +8001,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7955,7 +8059,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8218,7 +8322,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8226,7 +8330,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8251,7 +8355,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8291,7 +8395,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10344,6 +10448,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         supportsNestedAppAuth: false,
         instanceAware: false,
         encodeExtraQueryParams: false,
+        verifySSO: false,
     };
     // Default cache options for browser
     const DEFAULT_CACHE_OPTIONS = {
@@ -10432,7 +10537,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.28.2";
+const version = "4.29.1";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13905,6 +14010,10 @@ class StandardInteractionClient extends BaseInteractionClient {
     async initializeAuthorizationRequest(request, interactionType) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.correlationId);
         const redirectUri = this.getRedirectUri(request.redirectUri);
+        if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
+            this.logger.warning("The origin of the redirect URI does not match the origin of the current page. This is likely to cause issues with authentication.", this.correlationId);
+            this.performanceClient.addFields({ isRedirectUriCrossOrigin: true }, this.correlationId);
+        }
         const browserState = {
             interactionType: interactionType,
         };
@@ -15515,14 +15624,28 @@ class PlatformAuthDOMHandler {
         return nativeResponse;
     }
     getDOMExtraParams(extraParameters) {
-        const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
-            record[key] = String(value);
-            return record;
-        }, {});
-        const validExtraParams = {
-            ...stringifiedParams,
-        };
-        return validExtraParams;
+        try {
+            const stringifiedProperties = {};
+            for (const [key, value] of Object.entries(extraParameters)) {
+                if (!value) {
+                    continue;
+                }
+                if (typeof value === "object") {
+                    stringifiedProperties[key] = JSON.stringify(value);
+                }
+                else {
+                    stringifiedProperties[key] = String(value);
+                }
+            }
+            return stringifiedProperties;
+        }
+        catch (e) {
+            this.logger.error(this.platformAuthType + " - Error stringifying extra parameters");
+            this.logger.errorPii(this.platformAuthType +
+                " - Error stringifying extra parameters: " +
+                e);
+            return {};
+        }
     }
 }
 
@@ -16589,6 +16712,12 @@ async function initiateEarRequest(config, authority, request, logger, performanc
  */
 async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId, responseType) {
     performanceClient.addQueueMeasurement(PerformanceEvents.SilentHandlerMonitorIframeForHash, correlationId);
+    performanceClient.addFields({
+        iframePollIntervalMs: pollIntervalMilliseconds,
+        iframeTimeoutMs: timeout,
+    }, correlationId);
+    let totalTickCount = 0;
+    let crossOriginTickCount = 0;
     return new Promise((resolve, reject) => {
         if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
             logger.warning(`system.loadFrameTimeout or system.iframeHashTimeout set to lower (${timeout}ms) than the default (${DEFAULT_IFRAME_TIMEOUT_MS}ms). This may result in timeouts.`);
@@ -16602,6 +16731,7 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             reject(createBrowserAuthError(monitorWindowTimeout));
         }, timeout);
         const intervalId = window.setInterval(() => {
+            totalTickCount++;
             let href = "";
             const contentWindow = iframe.contentWindow;
             try {
@@ -16612,7 +16742,9 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
                  */
                 href = contentWindow ? contentWindow.location.href : "";
             }
-            catch (e) { }
+            catch (e) {
+                crossOriginTickCount++;
+            }
             if (!href || href === "about:blank") {
                 return;
             }
@@ -16630,6 +16762,10 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             resolve(responseString);
         }, pollIntervalMilliseconds);
     }).finally(() => {
+        performanceClient.addFields({
+            iframeTickCount: totalTickCount,
+            crossOriginTickCount: crossOriginTickCount,
+        }, correlationId);
         invoke(removeHiddenIframe, PerformanceEvents.RemoveHiddenIframe, logger, performanceClient, correlationId)(iframe);
     });
 }
@@ -16817,6 +16953,52 @@ class SilentIframeClient extends StandardInteractionClient {
             return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
     }
+    /**
+     * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+     * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+     * @param request - The SSO silent request
+     * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+     */
+    async verifySso(request) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentIframeClientAcquireToken, request.correlationId);
+        const inputRequest = { ...request };
+        if (!inputRequest.prompt) {
+            inputRequest.prompt = PromptValue.NONE;
+        }
+        // Create silent request
+        const silentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)(inputRequest, exports.InteractionType.Silent);
+        const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
+            serverTelemetryManager: this.initializeServerTelemetryManager(this.apiId),
+            requestAuthority: silentRequest.authority,
+            requestAzureCloudOptions: silentRequest.azureCloudOptions,
+            requestExtraQueryParameters: silentRequest.extraQueryParameters,
+            account: silentRequest.account,
+        });
+        const correlationId = silentRequest.correlationId;
+        const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
+        const requestWithPkce = {
+            ...silentRequest,
+            codeChallenge: pkceCodes.challenge,
+        };
+        // Create authorize request url
+        const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, requestWithPkce, this.logger, this.performanceClient);
+        // Get the frame handle for the silent request - this triggers the SSO verification
+        const msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+        const responseType = this.config.auth.OIDCOptions.serverResponseType;
+        // Monitor the iframe for the response
+        const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
+        // Deserialize the response
+        const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger);
+        // Validate the response - this checks for errors and validates state
+        validateAuthorizationResponse(serverParams, silentRequest.state);
+        // Verify a valid authorization code is present
+        if (!serverParams.code) {
+            this.logger.warning("SSO verification response did not contain an authorization code", correlationId);
+            return false;
+        }
+        this.logger.verbose("SSO verification completed successfully with valid authorization code - skipped token exchange", correlationId);
+        return true;
+    }
     /**
      * Currently Unsupported
      */
@@ -17211,6 +17393,22 @@ class SilentAuthCodeClient extends StandardInteractionClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+ * @returns Network connection information, or an empty object if not available.
+ */
+function getNetworkInfo() {
+    if (typeof window === "undefined" || !window.navigator) {
+        return {};
+    }
+    const connection = "connection" in window.navigator
+        ? window.navigator.connection
+        : undefined;
+    return {
+        effectiveType: connection?.effectiveType,
+        rtt: connection?.rtt,
+    };
+}
 function collectInstanceStats(currentClientId, performanceEvent, logger) {
     const frameInstances = 
     // @ts-ignore
@@ -17304,22 +17502,30 @@ class StandardController {
         this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto, this.performanceClient);
         this.activeSilentTokenRequests = new Map();
         // Register listener functions
-        this.trackPageVisibility = this.trackPageVisibility.bind(this);
-        // Register listener functions
-        this.trackPageVisibilityWithMeasurement =
-            this.trackPageVisibilityWithMeasurement.bind(this);
+        this.trackStateChangeWithMeasurement =
+            this.trackStateChangeWithMeasurement.bind(this);
     }
     static async createController(operatingContext, request) {
         const controller = new StandardController(operatingContext);
         await controller.initialize(request);
         return controller;
     }
-    trackPageVisibility(correlationId) {
+    trackStateChange(correlationId, event) {
         if (!correlationId) {
             return;
         }
-        this.logger.info("Perf: Visibility change detected");
-        this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        if (event.type === "visibilitychange") {
+            this.logger.info("Perf: Visibility change detected");
+            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "online") {
+            this.logger.info("Perf: Online status change detected");
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "offline") {
+            this.logger.info("Perf: Offline status change detected");
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -17467,6 +17673,8 @@ class StandardController {
                 rootMeasurement.end({
                     success: true,
                 }, undefined, result.account);
+                // Fire-and-forget SSO capability verification in background
+                this.verifySsoCapability(result.account, exports.InteractionType.Redirect);
             }
             else {
                 /*
@@ -17699,6 +17907,8 @@ class StandardController {
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             }, undefined, result.account);
+            // SSO capability verification in background
+            this.verifySsoCapability(result.account, exports.InteractionType.Popup);
             return result;
         })
             .catch((e) => {
@@ -17721,16 +17931,87 @@ class StandardController {
             }
         });
     }
-    trackPageVisibilityWithMeasurement() {
+    trackStateChangeWithMeasurement(event) {
         const measurement = this.ssoSilentMeasurement ||
             this.acquireTokenByCodeAsyncMeasurement;
         if (!measurement) {
             return;
         }
-        this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
-        measurement.increment({
-            visibilityChangeCount: 1,
+        if (event.type === "visibilitychange") {
+            this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
+            measurement.increment({
+                visibilityChangeCount: 1,
+            });
+        }
+        else if (event.type === "online") {
+            this.logger.info("Perf: Online status change detected in ", measurement.event.name);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+        else if (event.type === "offline") {
+            this.logger.info("Perf: Offline status change detected in ", measurement.event.name);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+    }
+    addStateChangeListeners(listener) {
+        document.addEventListener("visibilitychange", listener);
+        window.addEventListener("online", listener);
+        window.addEventListener("offline", listener);
+    }
+    removeStateChangeListeners(listener) {
+        document.removeEventListener("visibilitychange", listener);
+        window.removeEventListener("online", listener);
+        window.removeEventListener("offline", listener);
+    }
+    /**
+     * SSO capability verification in the background.
+     * This method makes an iframe request to /authorize to verify SSO capability without calling /token.
+     * This method does not block the caller and tracks telemetry for success/failure.
+     * This method only executes if verifySSO is set to true in the auth configuration.
+     * @param account - The account to use for the SSO verification
+     * @param parentApi - The API ID of the parent operation for logging purposes
+     */
+    verifySsoCapability(account, parentApi) {
+        // Check if SSO capability verification is enabled
+        if (!this.config.auth.verifySSO) {
+            return;
+        }
+        const correlationId = this.browserCrypto.createNewGuid();
+        const ssoCapableMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.SsoCapable, correlationId);
+        ssoCapableMeasurement.add({
+            parentApi: parentApi,
         });
+        this.logger.verbose(`SSO capability verification initiated after ${parentApi}`, correlationId);
+        /*
+         * Use setTimeout to ensure this runs in a separate macrotask after the current call stack completes
+         * This ensures the result is returned to the caller before the SSO verification starts and doesn't affect performance
+         */
+        setTimeout(() => {
+            const ssoVerificationRequest = {
+                account: account,
+                correlationId: correlationId,
+            };
+            const silentIframeClient = this.createSilentIframeClient(correlationId);
+            silentIframeClient
+                .verifySso(ssoVerificationRequest)
+                .then((success) => {
+                this.logger.verbose(`SSO capability verification completed after ${parentApi}, success: ${success}`, correlationId);
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: success,
+                }, undefined, account);
+            })
+                .catch((error) => {
+                this.logger.warning(`SSO capability verification failed after ${parentApi}: ${error.message}`, correlationId);
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: false,
+                }, error, account);
+            });
+        }, 0);
     }
     // #endregion
     // #region Silent Flow
@@ -17764,8 +18045,9 @@ class StandardController {
         preflightCheck(this.initialized, this.ssoSilentMeasurement, request.account);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         this.logger.verbose("ssoSilent called", correlationId);
         this.eventHandler.emitEvent(EventType.SSO_SILENT_START, exports.InteractionType.Silent, validRequest);
         let result;
@@ -17809,7 +18091,7 @@ class StandardController {
             throw e;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
     }
     /**
@@ -17921,8 +18203,9 @@ class StandardController {
             this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCodeAsync, request.correlationId);
         this.acquireTokenByCodeAsyncMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const silentAuthCodeClient = this.createSilentAuthCodeClient(request.correlationId);
         const silentTokenResult = await silentAuthCodeClient
             .acquireToken(request)
@@ -17940,7 +18223,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
         return silentTokenResult;
     }
@@ -18485,18 +18768,22 @@ class StandardController {
      * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
      */
     async acquireTokenSilentAsync(request, account) {
-        const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+        const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
         this.performanceClient.addQueueMeasurement(PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
         if (request.correlationId) {
-            this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
         }
-        document.addEventListener("visibilitychange", trackPageVisibility);
+        this.addStateChangeListeners(trackStateChange);
         const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
         const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
         const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
             const shouldTryToResolveSilently = checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheLookupPolicy);
             if (shouldTryToResolveSilently) {
+                const silentRefreshReason = `${refreshTokenError.errorCode}${refreshTokenError.subError
+                    ? `|${refreshTokenError.subError}`
+                    : ""}`;
+                this.performanceClient.addFields({ silentRefreshReason }, silentRequest.correlationId);
                 if (!this.activeIframeRequest) {
                     let _resolve;
                     // Always set the active request tracker immediately after checking it to prevent races
@@ -18566,7 +18853,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", trackPageVisibility);
+            this.removeStateChangeListeners(trackStateChange);
         });
     }
     /**
@@ -20745,6 +21032,9 @@ class BrowserPerformanceClient extends PerformanceClient {
     getPageVisibility() {
         return document.visibilityState?.toString() || null;
     }
+    getOnlineStatus() {
+        return typeof navigator !== "undefined" ? navigator.onLine : null;
+    }
     deleteIncompleteSubMeasurements(inProgressEvent) {
         void getPerfMeasurementModule()?.then((module) => {
             const rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
@@ -20771,6 +21061,7 @@ class BrowserPerformanceClient extends PerformanceClient {
     startMeasurement(measureName, correlationId) {
         // Capture page visibilityState and then invoke start/end measurement
         const startPageVisibility = this.getPageVisibility();
+        const startOnlineStatus = this.getOnlineStatus();
         const inProgressEvent = super.startMeasurement(measureName, correlationId);
         const startTime = supportsBrowserPerformanceNow()
             ? window.performance.now()
@@ -20782,11 +21073,15 @@ class BrowserPerformanceClient extends PerformanceClient {
         return {
             ...inProgressEvent,
             end: (event, error, account) => {
+                const networkInfo = getNetworkInfo();
                 const res = inProgressEvent.end({
                     ...event,
                     startPageVisibility,
+                    startOnlineStatus,
                     endPageVisibility: this.getPageVisibility(),
                     durationMs: getPerfDurationMs(startTime),
+                    networkEffectiveType: networkInfo.effectiveType,
+                    networkRtt: networkInfo.rtt,
                 }, error, account);
                 void browserMeasurement?.then((measurement) => measurement.endMeasurement());
                 this.deleteIncompleteSubMeasurements(inProgressEvent);