npm - @azure/msal-browser - Versions diffs - 4.29.0 → 4.30.0 - Mend

@azure/msal-browser 4.29.0 → 4.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (329) hide show

package/lib/custom-auth-path/msal-custom-auth.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.29.0 2026-02-23 */
+/*! @azure/msal-browser v4.30.0 2026-03-18 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -276,7 +276,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -287,7 +287,7 @@ const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 const unexpectedError = "unexpected_error";
 const postRequestFailed$1 = "post_request_failed";
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -322,7 +322,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -373,7 +373,7 @@ const methodNotImplemented = "method_not_implemented";
 const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
 const platformBrokerError = "platform_broker_error";
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -448,7 +448,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -487,7 +487,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -678,12 +678,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.15.0";
+const version$1 = "15.17.0";
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -692,7 +692,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -722,7 +722,7 @@ const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
 const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -768,7 +768,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -863,9 +863,48 @@ class StringUtils {
             .replace(/\?/g, "\\?"));
         return regex.test(input);
     }
+    /**
+     * Tests if a given string matches a given pattern using stricter, anchored matching semantics.
+     *
+     * Differences from `matchPattern` (legacy):
+     * - All regex metacharacters (including `.`) in the pattern are treated as literals,
+     *   so `example.com` matches only `example.com` and not `exampleXcom`.
+     * - The generated regex is anchored with `^` and `$` so partial/substring matches
+     *   are not allowed.
+     * - `*` is the only supported wildcard. Its behaviour depends on the URL component:
+     *   - `host` component: `*` matches any sequence of characters that does NOT include
+     *     a dot (`.`), keeping wildcards within a single DNS label boundary.
+     *   - All other components: `*` matches any sequence of characters (including `/`).
+     *
+     * @param pattern - The `protectedResourceMap` key pattern to match against. `*` is a
+     *   multi-character wildcard; all other characters are treated as literals.
+     * @param input - The URL component value (e.g. host, pathname) extracted from the
+     *   outgoing request URL to test against the pattern.
+     * @param options - Optional. Provide `component` to enable component-aware wildcard
+     *   semantics. Accepted values: `"host"`, `"path"`, `"protocol"`, `"search"`,
+     *   `"hash"`. Defaults to path-style (permissive) matching when omitted.
+     * @returns `true` if the full input string matches the pattern; `false` otherwise.
+     */
+    static matchPatternStrict(pattern, input, options) {
+        const component = options?.component;
+        // Step 1: Escape all regex special characters so literals are matched literally.
+        let regexBody = pattern.replace(/[.+^${}()|[\]\\*?]/g, "\\$&");
+        // Step 2: Replace the escaped '*' with its component-aware regex equivalent.
+        if (component === "host") {
+            regexBody = regexBody.replace(/\\\*/g, "[^.]*");
+        }
+        else {
+            // PATH, PROTOCOL, SEARCH, HASH, or unspecified: '*' matches any characters.
+            regexBody = regexBody.replace(/\\\*/g, ".*");
+        }
+        // Step 3: Anchor for full-string matching.
+        // eslint-disable-next-line security/detect-non-literal-regexp
+        const regex = new RegExp(`^${regexBody}$`);
+        return regex.test(input);
+    }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1060,7 +1099,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1100,7 +1139,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1182,7 +1221,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1197,7 +1236,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1219,7 +1258,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1243,7 +1282,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1478,7 +1517,7 @@ class AccountEntity {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1559,7 +1598,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1675,7 +1714,7 @@ function normalizeUrlForComparison(url) {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1839,7 +1878,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2014,7 +2053,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2022,7 +2061,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2067,7 +2106,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3177,7 +3216,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3454,7 +3493,7 @@ const PerformanceEvents = {
 const PerformanceEventStatus = {
     InProgress: 1};
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3533,7 +3572,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3633,7 +3672,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3643,7 +3682,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3691,9 +3730,10 @@ const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
-const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const CLI_DATA = "clidata";
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3959,6 +3999,12 @@ function addGrantType(parameters, grantType) {
 function addClientInfo(parameters) {
     parameters.set(CLIENT_INFO, "1");
 }
+/**
+ * add clidata=1 to request to indicate client data support
+ */
+function addCliData(parameters) {
+    parameters.set(CLI_DATA, "1");
+}
 function addInstanceAware(parameters) {
     if (!parameters.has(INSTANCE_AWARE)) {
         parameters.set(INSTANCE_AWARE, "true");
@@ -4073,7 +4119,7 @@ function addPostBodyParameters(parameters, bodyParameters) {
     });
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4085,7 +4131,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4095,7 +4141,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4105,7 +4151,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4201,7 +4247,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4307,7 +4353,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4372,7 +4418,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4634,7 +4680,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5473,7 +5519,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5504,7 +5550,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5523,7 +5569,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5544,7 +5590,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5631,7 +5677,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5662,7 +5708,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5810,7 +5856,7 @@ class BaseClient {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5861,7 +5907,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5936,7 +5982,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6008,7 +6054,7 @@ class ProtocolUtils {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6090,7 +6136,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6117,7 +6163,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6456,7 +6502,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6474,7 +6520,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6623,11 +6669,6 @@ class AuthorizationCodeClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         let ccsCred = undefined;
         if (request.clientInfo) {
             try {
@@ -6677,6 +6718,15 @@ class AuthorizationCodeClient extends BaseClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims &&
+            parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : this.config.authOptions.clientCapabilities;
+        if (!StringUtils.isEmptyObj(request.claims) ||
+            (configClaims && configClaims.length > 0)) {
+            addClaims(parameters, request.claims, configClaims);
+        }
         return mapToQueryString(parameters);
     }
     /**
@@ -6710,7 +6760,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6888,11 +6938,6 @@ class RefreshTokenClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
             switch (request.ccsCredential.type) {
@@ -6918,11 +6963,20 @@ class RefreshTokenClient extends BaseClient {
             addExtraQueryParameters(parameters, request.tokenBodyParameters);
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims &&
+            parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : this.config.authOptions.clientCapabilities;
+        if (!StringUtils.isEmptyObj(request.claims) ||
+            (configClaims && configClaims.length > 0)) {
+            addClaims(parameters, request.claims, configClaims);
+        }
         return mapToQueryString(parameters);
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7020,7 +7074,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7035,7 +7089,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7067,6 +7121,8 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     addResponseMode(parameters, request.responseMode);
     // add client_info=1
     addClientInfo(parameters);
+    // add clidata=1
+    addCliData(parameters);
     if (request.prompt) {
         addPrompt(parameters, request.prompt);
         performanceClient?.addFields({ prompt: request.prompt }, correlationId);
@@ -7156,14 +7212,17 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.state) {
         addState(parameters, request.state);
     }
-    if (request.claims ||
-        (authOptions.clientCapabilities &&
-            authOptions.clientCapabilities.length > 0)) {
-        addClaims(parameters, request.claims, authOptions.clientCapabilities);
-    }
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
+    // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+    const configClaims = request.skipBrokerClaims &&
+        parameters.has(BROKER_CLIENT_ID)
+        ? undefined
+        : authOptions.clientCapabilities;
+    if (request.claims || (configClaims && configClaims.length > 0)) {
+        addClaims(parameters, request.claims, configClaims);
+    }
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -7259,7 +7318,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7522,7 +7581,7 @@ class ServerTelemetryManager {
     }
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7530,7 +7589,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7555,7 +7614,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
-/*! @azure/msal-common v15.15.0 2026-02-23 */
+/*! @azure/msal-common v15.17.0 2026-03-18 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7990,7 +8049,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.29.0";
+const version = "4.30.0";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9758,6 +9817,10 @@ class StandardInteractionClient extends BaseInteractionClient {
     async initializeAuthorizationRequest(request, interactionType) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.correlationId);
         const redirectUri = this.getRedirectUri(request.redirectUri);
+        if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
+            this.logger.warning("The origin of the redirect URI does not match the origin of the current page. This is likely to cause issues with authentication.", this.correlationId);
+            this.performanceClient.addFields({ isRedirectUriCrossOrigin: true }, this.correlationId);
+        }
         const browserState = {
             interactionType: interactionType,
         };
@@ -17223,11 +17286,19 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         this.logger.trace("NativeInteractionClient - initializeNativeRequest called");
         const canonicalAuthority = await this.getCanonicalAuthority(request);
         // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
-        const { scopes, ...remainingProperties } = request;
+        const { scopes, claims, ...remainingProperties } = request;
         const scopeSet = new ScopeSet(scopes || []);
         scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims && !!request.embeddedClientId
+            ? undefined
+            : this.config.auth.clientCapabilities;
+        const mergedClaims = configClaims && configClaims.length
+            ? addClientCapabilitiesToClaims(claims, configClaims)
+            : claims;
         const validatedRequest = {
             ...remainingProperties,
+            claims: mergedClaims,
             accountId: this.accountId,
             clientId: this.config.auth.clientId,
             authority: canonicalAuthority.urlString,
@@ -17360,6 +17431,53 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+const clientDataAccountTypeMapping = new Map([
+    ["e", "AAD"],
+    ["m", "MSA"],
+]);
+/**
+ * Parses the clientdata response parameter from the /authorize endpoint.
+ *
+ * The clientdata value is URL-encoded and pipe-delimited:
+ *   urlencoded(account_type | error | sub_error | cloud_instance | caller_data_boundary)
+ *
+ * @param clientdata - The raw clientdata string from the authorize response
+ * @returns Parsed ClientData object, or null if the input is empty/invalid
+ */
+function parseClientData(clientdata) {
+    if (!clientdata) {
+        return null;
+    }
+    try {
+        const decoded = decodeURIComponent(clientdata);
+        const parts = decoded.split("|");
+        if (parts.length < 5) {
+            return null;
+        }
+        return {
+            accountType: clientDataAccountTypeMapping.get(parts[0]?.trim() || "") || "",
+            error: parts[1]?.trim() || "",
+            subError: parts[2]?.trim() || "",
+            cloudInstance: parts[3]?.trim() || "",
+            callerDataBoundary: parts[4]?.trim() || "",
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Instruments account type, error, and suberror from clientdata
+ */
+function instrumentClientData(response, correlationId, performanceClient) {
+    const parsed = parseClientData(response.clientdata);
+    parsed?.accountType &&
+        performanceClient.addFields({ accountType: parsed.accountType }, correlationId);
+    parsed?.error &&
+        performanceClient.addFields({ serverErrorNo: parsed.error }, correlationId);
+    parsed?.subError &&
+        performanceClient.addFields({ serverSubErrorNo: parsed.subError }, correlationId);
+}
 /**
  * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
  * @param config
@@ -17522,6 +17640,8 @@ async function handleResponsePlatformBroker(request, accountId, apiId, config, b
 async function handleResponseCode(request, response, codeVerifier, apiId, config, authClient, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider) {
     // Remove throttle if it exists
     ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
+    // Instrument clientdata telemetry fields from the authorize response
+    instrumentClientData(response, request.correlationId, performanceClient);
     if (response.accountId) {
         return invokeAsync(handleResponsePlatformBroker, PerformanceEvents.HandleResponsePlatformBroker, logger, performanceClient, request.correlationId)(request, response.accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider);
     }
@@ -17554,6 +17674,8 @@ async function handleResponseCode(request, response, codeVerifier, apiId, config
 async function handleResponseEAR(request, response, apiId, config, authority, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider) {
     // Remove throttle if it exists
     ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
+    // Instrument clientdata telemetry fields from the authorize response
+    instrumentClientData(response, request.correlationId, performanceClient);
     // Validate state & check response for errors
     validateAuthorizationResponse(response, request.state);
     if (!response.ear_jwe) {
@@ -18319,14 +18441,28 @@ class PlatformAuthDOMHandler {
         return nativeResponse;
     }
     getDOMExtraParams(extraParameters) {
-        const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
-            record[key] = String(value);
-            return record;
-        }, {});
-        const validExtraParams = {
-            ...stringifiedParams,
-        };
-        return validExtraParams;
+        try {
+            const stringifiedProperties = {};
+            for (const [key, value] of Object.entries(extraParameters)) {
+                if (!value) {
+                    continue;
+                }
+                if (typeof value === "object") {
+                    stringifiedProperties[key] = JSON.stringify(value);
+                }
+                else {
+                    stringifiedProperties[key] = String(value);
+                }
+            }
+            return stringifiedProperties;
+        }
+        catch (e) {
+            this.logger.error(this.platformAuthType + " - Error stringifying extra parameters");
+            this.logger.errorPii(this.platformAuthType +
+                " - Error stringifying extra parameters: " +
+                e);
+            return {};
+        }
     }
 }
@@ -19377,6 +19513,12 @@ async function initiateEarRequest(config, authority, request, logger, performanc
  */
 async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId, responseType) {
     performanceClient.addQueueMeasurement(PerformanceEvents.SilentHandlerMonitorIframeForHash, correlationId);
+    performanceClient.addFields({
+        iframePollIntervalMs: pollIntervalMilliseconds,
+        iframeTimeoutMs: timeout,
+    }, correlationId);
+    let totalTickCount = 0;
+    let crossOriginTickCount = 0;
     return new Promise((resolve, reject) => {
         if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
             logger.warning(`system.loadFrameTimeout or system.iframeHashTimeout set to lower (${timeout}ms) than the default (${DEFAULT_IFRAME_TIMEOUT_MS}ms). This may result in timeouts.`);
@@ -19390,6 +19532,7 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             reject(createBrowserAuthError(monitorWindowTimeout));
         }, timeout);
         const intervalId = window.setInterval(() => {
+            totalTickCount++;
             let href = "";
             const contentWindow = iframe.contentWindow;
             try {
@@ -19400,7 +19543,9 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
                  */
                 href = contentWindow ? contentWindow.location.href : "";
             }
-            catch (e) { }
+            catch (e) {
+                crossOriginTickCount++;
+            }
             if (!href || href === "about:blank") {
                 return;
             }
@@ -19418,6 +19563,10 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             resolve(responseString);
         }, pollIntervalMilliseconds);
     }).finally(() => {
+        performanceClient.addFields({
+            iframeTickCount: totalTickCount,
+            crossOriginTickCount: crossOriginTickCount,
+        }, correlationId);
         invoke(removeHiddenIframe, PerformanceEvents.RemoveHiddenIframe, logger, performanceClient, correlationId)(iframe);
     });
 }
@@ -20045,6 +20194,10 @@ class SilentAuthCodeClient extends StandardInteractionClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+ * @returns Network connection information, or an empty object if not available.
+ */
 function collectInstanceStats(currentClientId, performanceEvent, logger) {
     const frameInstances =
     // @ts-ignore
@@ -20138,22 +20291,30 @@ class StandardController {
         this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto, this.performanceClient);
         this.activeSilentTokenRequests = new Map();
         // Register listener functions
-        this.trackPageVisibility = this.trackPageVisibility.bind(this);
-        // Register listener functions
-        this.trackPageVisibilityWithMeasurement =
-            this.trackPageVisibilityWithMeasurement.bind(this);
+        this.trackStateChangeWithMeasurement =
+            this.trackStateChangeWithMeasurement.bind(this);
     }
     static async createController(operatingContext, request) {
         const controller = new StandardController(operatingContext);
         await controller.initialize(request);
         return controller;
     }
-    trackPageVisibility(correlationId) {
+    trackStateChange(correlationId, event) {
         if (!correlationId) {
             return;
         }
-        this.logger.info("Perf: Visibility change detected");
-        this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        if (event.type === "visibilitychange") {
+            this.logger.info("Perf: Visibility change detected");
+            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "online") {
+            this.logger.info("Perf: Online status change detected");
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "offline") {
+            this.logger.info("Perf: Offline status change detected");
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -20559,16 +20720,40 @@ class StandardController {
             }
         });
     }
-    trackPageVisibilityWithMeasurement() {
+    trackStateChangeWithMeasurement(event) {
         const measurement = this.ssoSilentMeasurement ||
             this.acquireTokenByCodeAsyncMeasurement;
         if (!measurement) {
             return;
         }
-        this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
-        measurement.increment({
-            visibilityChangeCount: 1,
-        });
+        if (event.type === "visibilitychange") {
+            this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
+            measurement.increment({
+                visibilityChangeCount: 1,
+            });
+        }
+        else if (event.type === "online") {
+            this.logger.info("Perf: Online status change detected in ", measurement.event.name);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+        else if (event.type === "offline") {
+            this.logger.info("Perf: Offline status change detected in ", measurement.event.name);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+    }
+    addStateChangeListeners(listener) {
+        document.addEventListener("visibilitychange", listener);
+        window.addEventListener("online", listener);
+        window.addEventListener("offline", listener);
+    }
+    removeStateChangeListeners(listener) {
+        document.removeEventListener("visibilitychange", listener);
+        window.removeEventListener("online", listener);
+        window.removeEventListener("offline", listener);
     }
     /**
      * SSO capability verification in the background.
@@ -20649,8 +20834,9 @@ class StandardController {
         preflightCheck(this.initialized, this.ssoSilentMeasurement, request.account);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         this.logger.verbose("ssoSilent called", correlationId);
         this.eventHandler.emitEvent(EventType.SSO_SILENT_START, InteractionType.Silent, validRequest);
         let result;
@@ -20694,7 +20880,7 @@ class StandardController {
             throw e;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
     }
     /**
@@ -20806,8 +20992,9 @@ class StandardController {
             this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCodeAsync, request.correlationId);
         this.acquireTokenByCodeAsyncMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const silentAuthCodeClient = this.createSilentAuthCodeClient(request.correlationId);
         const silentTokenResult = await silentAuthCodeClient
             .acquireToken(request)
@@ -20825,7 +21012,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
         return silentTokenResult;
     }
@@ -21370,13 +21557,13 @@ class StandardController {
      * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
      */
     async acquireTokenSilentAsync(request, account) {
-        const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+        const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
         this.performanceClient.addQueueMeasurement(PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, InteractionType.Silent, request);
         if (request.correlationId) {
-            this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
         }
-        document.addEventListener("visibilitychange", trackPageVisibility);
+        this.addStateChangeListeners(trackStateChange);
         const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
         const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
         const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
@@ -21455,7 +21642,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", trackPageVisibility);
+            this.removeStateChangeListeners(trackStateChange);
         });
     }
     /**