@azure/msal-browser 4.29.0 → 4.29.1

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.29.0 2026-02-23 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -279,7 +279,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -296,7 +296,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -345,7 +345,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -445,7 +445,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -702,7 +702,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -741,7 +741,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -932,12 +932,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.15.0";
+const version$1 = "15.16.1";
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -957,7 +957,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1015,7 +1015,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1163,7 +1163,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1258,9 +1258,48 @@ class StringUtils {
             .replace(/\?/g, "\\?"));
         return regex.test(input);
     }
+    /**
+     * Tests if a given string matches a given pattern using stricter, anchored matching semantics.
+     *
+     * Differences from `matchPattern` (legacy):
+     * - All regex metacharacters (including `.`) in the pattern are treated as literals,
+     *   so `example.com` matches only `example.com` and not `exampleXcom`.
+     * - The generated regex is anchored with `^` and `$` so partial/substring matches
+     *   are not allowed.
+     * - `*` is the only supported wildcard. Its behaviour depends on the URL component:
+     *   - `host` component: `*` matches any sequence of characters that does NOT include
+     *     a dot (`.`), keeping wildcards within a single DNS label boundary.
+     *   - All other components: `*` matches any sequence of characters (including `/`).
+     *
+     * @param pattern - The `protectedResourceMap` key pattern to match against. `*` is a
+     *   multi-character wildcard; all other characters are treated as literals.
+     * @param input - The URL component value (e.g. host, pathname) extracted from the
+     *   outgoing request URL to test against the pattern.
+     * @param options - Optional. Provide `component` to enable component-aware wildcard
+     *   semantics. Accepted values: `"host"`, `"path"`, `"protocol"`, `"search"`,
+     *   `"hash"`. Defaults to path-style (permissive) matching when omitted.
+     * @returns `true` if the full input string matches the pattern; `false` otherwise.
+     */
+    static matchPatternStrict(pattern, input, options) {
+        const component = options?.component;
+        // Step 1: Escape all regex special characters so literals are matched literally.
+        let regexBody = pattern.replace(/[.+^${}()|[\]\\*?]/g, "\\$&");
+        // Step 2: Replace the escaped '*' with its component-aware regex equivalent.
+        if (component === "host") {
+            regexBody = regexBody.replace(/\\\*/g, "[^.]*");
+        }
+        else {
+            // PATH, PROTOCOL, SEARCH, HASH, or unspecified: '*' matches any characters.
+            regexBody = regexBody.replace(/\\\*/g, ".*");
+        }
+        // Step 3: Anchor for full-string matching.
+        // eslint-disable-next-line security/detect-non-literal-regexp
+        const regex = new RegExp(`^${regexBody}$`);
+        return regex.test(input);
+    }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1455,7 +1494,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1495,7 +1534,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1577,7 +1616,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1592,7 +1631,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1614,7 +1653,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1638,7 +1677,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1873,7 +1912,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1954,7 +1993,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2070,7 +2109,7 @@ function normalizeUrlForComparison(url) {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2234,7 +2273,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2409,7 +2448,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2417,7 +2456,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2462,7 +2501,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3573,7 +3612,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4104,9 +4143,14 @@ const IntFields = new Set([
     "currRefreshCount",
     "expiredCacheRemovedCount",
     "upgradedCacheCount",
+    "networkRtt",
+    "iframePollIntervalMs",
+    "iframeTimeoutMs",
+    "iframeTickCount",
+    "crossOriginTickCount",
 ]);
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4185,7 +4229,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4285,7 +4329,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4295,7 +4339,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4345,7 +4389,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4725,7 +4769,7 @@ function addPostBodyParameters(parameters, bodyParameters) {
     });
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4737,7 +4781,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4747,7 +4791,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4757,7 +4801,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4853,7 +4897,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4959,7 +5003,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5024,7 +5068,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5286,7 +5330,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6125,7 +6169,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6156,7 +6200,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6175,7 +6219,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6196,7 +6240,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6283,7 +6327,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6314,7 +6358,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6462,7 +6506,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6526,7 +6570,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uxNotAllowed: uxNotAllowed
 });
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6623,7 +6667,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6695,7 +6739,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6777,7 +6821,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6804,7 +6848,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7143,7 +7187,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7161,7 +7205,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7310,11 +7354,6 @@ class AuthorizationCodeClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         let ccsCred = undefined;
         if (request.clientInfo) {
             try {
@@ -7364,6 +7403,15 @@ class AuthorizationCodeClient extends BaseClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims &&
+            parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : this.config.authOptions.clientCapabilities;
+        if (!StringUtils.isEmptyObj(request.claims) ||
+            (configClaims && configClaims.length > 0)) {
+            addClaims(parameters, request.claims, configClaims);
+        }
         return mapToQueryString(parameters);
     }
     /**
@@ -7397,7 +7445,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7575,11 +7623,6 @@ class RefreshTokenClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
             switch (request.ccsCredential.type) {
@@ -7605,11 +7648,20 @@ class RefreshTokenClient extends BaseClient {
             addExtraQueryParameters(parameters, request.tokenBodyParameters);
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims &&
+            parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : this.config.authOptions.clientCapabilities;
+        if (!StringUtils.isEmptyObj(request.claims) ||
+            (configClaims && configClaims.length > 0)) {
+            addClaims(parameters, request.claims, configClaims);
+        }
         return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7707,7 +7759,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7722,7 +7774,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7843,14 +7895,17 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.state) {
         addState(parameters, request.state);
     }
-    if (request.claims ||
-        (authOptions.clientCapabilities &&
-            authOptions.clientCapabilities.length > 0)) {
-        addClaims(parameters, request.claims, authOptions.clientCapabilities);
-    }
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
+    // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+    const configClaims = request.skipBrokerClaims &&
+        parameters.has(BROKER_CLIENT_ID)
+        ? undefined
+        : authOptions.clientCapabilities;
+    if (request.claims || (configClaims && configClaims.length > 0)) {
+        addClaims(parameters, request.claims, configClaims);
+    }
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -7946,7 +8001,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8004,7 +8059,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8267,7 +8322,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8275,7 +8330,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8300,7 +8355,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8340,7 +8395,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10482,7 +10537,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.29.0";
+const version = "4.29.1";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13955,6 +14010,10 @@ class StandardInteractionClient extends BaseInteractionClient {
     async initializeAuthorizationRequest(request, interactionType) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.correlationId);
         const redirectUri = this.getRedirectUri(request.redirectUri);
+        if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
+            this.logger.warning("The origin of the redirect URI does not match the origin of the current page. This is likely to cause issues with authentication.", this.correlationId);
+            this.performanceClient.addFields({ isRedirectUriCrossOrigin: true }, this.correlationId);
+        }
         const browserState = {
             interactionType: interactionType,
         };
@@ -15565,14 +15624,28 @@ class PlatformAuthDOMHandler {
         return nativeResponse;
     }
     getDOMExtraParams(extraParameters) {
-        const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
-            record[key] = String(value);
-            return record;
-        }, {});
-        const validExtraParams = {
-            ...stringifiedParams,
-        };
-        return validExtraParams;
+        try {
+            const stringifiedProperties = {};
+            for (const [key, value] of Object.entries(extraParameters)) {
+                if (!value) {
+                    continue;
+                }
+                if (typeof value === "object") {
+                    stringifiedProperties[key] = JSON.stringify(value);
+                }
+                else {
+                    stringifiedProperties[key] = String(value);
+                }
+            }
+            return stringifiedProperties;
+        }
+        catch (e) {
+            this.logger.error(this.platformAuthType + " - Error stringifying extra parameters");
+            this.logger.errorPii(this.platformAuthType +
+                " - Error stringifying extra parameters: " +
+                e);
+            return {};
+        }
     }
 }
 
@@ -16639,6 +16712,12 @@ async function initiateEarRequest(config, authority, request, logger, performanc
  */
 async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId, responseType) {
     performanceClient.addQueueMeasurement(PerformanceEvents.SilentHandlerMonitorIframeForHash, correlationId);
+    performanceClient.addFields({
+        iframePollIntervalMs: pollIntervalMilliseconds,
+        iframeTimeoutMs: timeout,
+    }, correlationId);
+    let totalTickCount = 0;
+    let crossOriginTickCount = 0;
     return new Promise((resolve, reject) => {
         if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
             logger.warning(`system.loadFrameTimeout or system.iframeHashTimeout set to lower (${timeout}ms) than the default (${DEFAULT_IFRAME_TIMEOUT_MS}ms). This may result in timeouts.`);
@@ -16652,6 +16731,7 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             reject(createBrowserAuthError(monitorWindowTimeout));
         }, timeout);
         const intervalId = window.setInterval(() => {
+            totalTickCount++;
             let href = "";
             const contentWindow = iframe.contentWindow;
             try {
@@ -16662,7 +16742,9 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
                  */
                 href = contentWindow ? contentWindow.location.href : "";
             }
-            catch (e) { }
+            catch (e) {
+                crossOriginTickCount++;
+            }
             if (!href || href === "about:blank") {
                 return;
             }
@@ -16680,6 +16762,10 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             resolve(responseString);
         }, pollIntervalMilliseconds);
     }).finally(() => {
+        performanceClient.addFields({
+            iframeTickCount: totalTickCount,
+            crossOriginTickCount: crossOriginTickCount,
+        }, correlationId);
         invoke(removeHiddenIframe, PerformanceEvents.RemoveHiddenIframe, logger, performanceClient, correlationId)(iframe);
     });
 }
@@ -17307,6 +17393,22 @@ class SilentAuthCodeClient extends StandardInteractionClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+ * @returns Network connection information, or an empty object if not available.
+ */
+function getNetworkInfo() {
+    if (typeof window === "undefined" || !window.navigator) {
+        return {};
+    }
+    const connection = "connection" in window.navigator
+        ? window.navigator.connection
+        : undefined;
+    return {
+        effectiveType: connection?.effectiveType,
+        rtt: connection?.rtt,
+    };
+}
 function collectInstanceStats(currentClientId, performanceEvent, logger) {
     const frameInstances = 
     // @ts-ignore
@@ -17400,22 +17502,30 @@ class StandardController {
         this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto, this.performanceClient);
         this.activeSilentTokenRequests = new Map();
         // Register listener functions
-        this.trackPageVisibility = this.trackPageVisibility.bind(this);
-        // Register listener functions
-        this.trackPageVisibilityWithMeasurement =
-            this.trackPageVisibilityWithMeasurement.bind(this);
+        this.trackStateChangeWithMeasurement =
+            this.trackStateChangeWithMeasurement.bind(this);
     }
     static async createController(operatingContext, request) {
         const controller = new StandardController(operatingContext);
         await controller.initialize(request);
         return controller;
     }
-    trackPageVisibility(correlationId) {
+    trackStateChange(correlationId, event) {
         if (!correlationId) {
             return;
         }
-        this.logger.info("Perf: Visibility change detected");
-        this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        if (event.type === "visibilitychange") {
+            this.logger.info("Perf: Visibility change detected");
+            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "online") {
+            this.logger.info("Perf: Online status change detected");
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "offline") {
+            this.logger.info("Perf: Offline status change detected");
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -17821,16 +17931,40 @@ class StandardController {
             }
         });
     }
-    trackPageVisibilityWithMeasurement() {
+    trackStateChangeWithMeasurement(event) {
         const measurement = this.ssoSilentMeasurement ||
             this.acquireTokenByCodeAsyncMeasurement;
         if (!measurement) {
             return;
         }
-        this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
-        measurement.increment({
-            visibilityChangeCount: 1,
-        });
+        if (event.type === "visibilitychange") {
+            this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
+            measurement.increment({
+                visibilityChangeCount: 1,
+            });
+        }
+        else if (event.type === "online") {
+            this.logger.info("Perf: Online status change detected in ", measurement.event.name);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+        else if (event.type === "offline") {
+            this.logger.info("Perf: Offline status change detected in ", measurement.event.name);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+    }
+    addStateChangeListeners(listener) {
+        document.addEventListener("visibilitychange", listener);
+        window.addEventListener("online", listener);
+        window.addEventListener("offline", listener);
+    }
+    removeStateChangeListeners(listener) {
+        document.removeEventListener("visibilitychange", listener);
+        window.removeEventListener("online", listener);
+        window.removeEventListener("offline", listener);
     }
     /**
      * SSO capability verification in the background.
@@ -17911,8 +18045,9 @@ class StandardController {
         preflightCheck(this.initialized, this.ssoSilentMeasurement, request.account);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         this.logger.verbose("ssoSilent called", correlationId);
         this.eventHandler.emitEvent(EventType.SSO_SILENT_START, exports.InteractionType.Silent, validRequest);
         let result;
@@ -17956,7 +18091,7 @@ class StandardController {
             throw e;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
     }
     /**
@@ -18068,8 +18203,9 @@ class StandardController {
             this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCodeAsync, request.correlationId);
         this.acquireTokenByCodeAsyncMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const silentAuthCodeClient = this.createSilentAuthCodeClient(request.correlationId);
         const silentTokenResult = await silentAuthCodeClient
             .acquireToken(request)
@@ -18087,7 +18223,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
         return silentTokenResult;
     }
@@ -18632,13 +18768,13 @@ class StandardController {
      * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
      */
     async acquireTokenSilentAsync(request, account) {
-        const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+        const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
         this.performanceClient.addQueueMeasurement(PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
         if (request.correlationId) {
-            this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
         }
-        document.addEventListener("visibilitychange", trackPageVisibility);
+        this.addStateChangeListeners(trackStateChange);
         const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
         const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
         const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
@@ -18717,7 +18853,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", trackPageVisibility);
+            this.removeStateChangeListeners(trackStateChange);
         });
     }
     /**
@@ -20896,6 +21032,9 @@ class BrowserPerformanceClient extends PerformanceClient {
     getPageVisibility() {
         return document.visibilityState?.toString() || null;
     }
+    getOnlineStatus() {
+        return typeof navigator !== "undefined" ? navigator.onLine : null;
+    }
     deleteIncompleteSubMeasurements(inProgressEvent) {
         void getPerfMeasurementModule()?.then((module) => {
             const rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
@@ -20922,6 +21061,7 @@ class BrowserPerformanceClient extends PerformanceClient {
     startMeasurement(measureName, correlationId) {
         // Capture page visibilityState and then invoke start/end measurement
         const startPageVisibility = this.getPageVisibility();
+        const startOnlineStatus = this.getOnlineStatus();
         const inProgressEvent = super.startMeasurement(measureName, correlationId);
         const startTime = supportsBrowserPerformanceNow()
             ? window.performance.now()
@@ -20933,11 +21073,15 @@ class BrowserPerformanceClient extends PerformanceClient {
         return {
             ...inProgressEvent,
             end: (event, error, account) => {
+                const networkInfo = getNetworkInfo();
                 const res = inProgressEvent.end({
                     ...event,
                     startPageVisibility,
+                    startOnlineStatus,
                     endPageVisibility: this.getPageVisibility(),
                     durationMs: getPerfDurationMs(startTime),
+                    networkEffectiveType: networkInfo.effectiveType,
+                    networkRtt: networkInfo.rtt,
                 }, error, account);
                 void browserMeasurement?.then((measurement) => measurement.endMeasurement());
                 this.deleteIncompleteSubMeasurements(inProgressEvent);