@azure/msal-browser 4.7.0 → 4.8.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.7.0 2025-03-11 */
+/*! @azure/msal-browser v4.8.0 2025-03-20 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -250,13 +250,6 @@ const Errors = {
     INVALID_GRANT_ERROR: "invalid_grant",
     CLIENT_MISMATCH_ERROR: "client_mismatch",
 };
-/**
- * Password grant parameters
- */
-const PasswordGrantConstants = {
-    username: "username",
-    password: "password",
-};
 /**
  * Response codes
  */
@@ -306,7 +299,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -323,7 +316,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -372,7 +365,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -470,7 +463,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -722,7 +715,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -761,7 +754,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -952,12 +945,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.2.1";
+const version$1 = "15.3.0";
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -977,7 +970,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1038,7 +1031,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1093,7 +1086,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1420,7 +1413,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1474,7 +1467,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1612,7 +1605,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1709,7 +1702,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1900,7 +1893,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1940,7 +1933,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2019,7 +2012,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2034,7 +2027,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2056,7 +2049,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2069,7 +2062,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2312,7 +2305,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2357,9 +2350,19 @@ function getDeserializedResponse(responseString) {
         throw createClientAuthError(hashNotDeserialized);
     }
     return null;
+}
+/**
+ * Utility to create a URL from the params map
+ */
+function mapToQueryString(parameters) {
+    const queryParameterArray = new Array();
+    parameters.forEach((value, key) => {
+        queryParameterArray.push(`${key}=${encodeURIComponent(value)}`);
+    });
+    return queryParameterArray.join("&");
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2523,7 +2526,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2663,7 +2666,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2671,7 +2674,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
 const cacheUnknownErrorCode = "cache_error_unknown";
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2698,7 +2701,7 @@ class CacheError extends Error {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3883,7 +3886,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3982,7 +3985,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3992,7 +3995,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4024,14 +4027,11 @@ const X_APP_NAME = "x-app-name";
 const X_APP_VER = "x-app-ver";
 const POST_LOGOUT_URI = "post_logout_redirect_uri";
 const ID_TOKEN_HINT = "id_token_hint";
-const DEVICE_CODE = "device_code";
 const CLIENT_SECRET = "client_secret";
 const CLIENT_ASSERTION = "client_assertion";
 const CLIENT_ASSERTION_TYPE = "client_assertion_type";
 const TOKEN_TYPE = "token_type";
 const REQ_CNF = "req_cnf";
-const OBO_ASSERTION = "assertion";
-const REQUESTED_TOKEN_USE = "requested_token_use";
 const RETURN_SPA_CODE = "return_spa_code";
 const NATIVE_BROKER = "nativebroker";
 const LOGOUT_HINT = "logout_hint";
@@ -4040,76 +4040,10 @@ const LOGIN_HINT = "login_hint";
 const DOMAIN_HINT = "domain_hint";
 const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
 const BROKER_CLIENT_ID = "brk_client_id";
-const BROKER_REDIRECT_URI = "brk_redirect_uri";
-
-/*! @azure/msal-common v15.2.1 2025-03-11 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Validates server consumable params from the "request" objects
- */
-class RequestValidator {
-    /**
-     * Utility to check if the `redirectUri` in the request is a non-null value
-     * @param redirectUri
-     */
-    static validateRedirectUri(redirectUri) {
-        if (!redirectUri) {
-            throw createClientConfigurationError(redirectUriEmpty);
-        }
-    }
-    /**
-     * Utility to validate prompt sent by the user in the request
-     * @param prompt
-     */
-    static validatePrompt(prompt) {
-        const promptValues = [];
-        for (const value in PromptValue) {
-            promptValues.push(PromptValue[value]);
-        }
-        if (promptValues.indexOf(prompt) < 0) {
-            throw createClientConfigurationError(invalidPromptValue);
-        }
-    }
-    static validateClaims(claims) {
-        try {
-            JSON.parse(claims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-    }
-    /**
-     * Utility to validate code_challenge and code_challenge_method
-     * @param codeChallenge
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-        if (!codeChallenge || !codeChallengeMethod) {
-            throw createClientConfigurationError(pkceParamsMissing);
-        }
-        else {
-            this.validateCodeChallengeMethod(codeChallengeMethod);
-        }
-    }
-    /**
-     * Utility to validate code_challenge_method
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeMethod(codeChallengeMethod) {
-        if ([
-            CodeChallengeMethodValues.PLAIN,
-            CodeChallengeMethodValues.S256,
-        ].indexOf(codeChallengeMethod) < 0) {
-            throw createClientConfigurationError(invalidCodeChallengeMethod);
-        }
-    }
-}
+const BROKER_REDIRECT_URI = "brk_redirect_uri";
+const INSTANCE_AWARE = "instance_aware";
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4127,397 +4061,344 @@ function instrumentBrokerParams(parameters, correlationId, performanceClient) {
         }, correlationId);
     }
 }
-/** @internal */
-class RequestParameterBuilder {
-    constructor(correlationId, performanceClient) {
-        this.parameters = new Map();
-        this.performanceClient = performanceClient;
-        this.correlationId = correlationId;
-    }
-    /**
-     * add response_type = code
-     */
-    addResponseTypeCode() {
-        this.parameters.set(RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
-    }
-    /**
-     * add response_type = token id_token
-     */
-    addResponseTypeForTokenAndIdToken() {
-        this.parameters.set(RESPONSE_TYPE, encodeURIComponent(`${Constants.TOKEN_RESPONSE_TYPE} ${Constants.ID_TOKEN_RESPONSE_TYPE}`));
-    }
-    /**
-     * add response_mode. defaults to query.
-     * @param responseMode
-     */
-    addResponseMode(responseMode) {
-        this.parameters.set(RESPONSE_MODE, encodeURIComponent(responseMode ? responseMode : ResponseMode.QUERY));
-    }
-    /**
-     * Add flag to indicate STS should attempt to use WAM if available
-     */
-    addNativeBroker() {
-        this.parameters.set(NATIVE_BROKER, encodeURIComponent("1"));
-    }
-    /**
-     * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
-     * @param scopeSet
-     * @param addOidcScopes
-     */
-    addScopes(scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
-        // Always add openid to the scopes when adding OIDC scopes
-        if (addOidcScopes &&
-            !defaultScopes.includes("openid") &&
-            !scopes.includes("openid")) {
-            defaultScopes.push("openid");
-        }
-        const requestScopes = addOidcScopes
-            ? [...(scopes || []), ...defaultScopes]
-            : scopes || [];
-        const scopeSet = new ScopeSet(requestScopes);
-        this.parameters.set(SCOPE, encodeURIComponent(scopeSet.printScopes()));
+/**
+ * add response_type = code
+ */
+function addResponseTypeCode(parameters) {
+    parameters.set(RESPONSE_TYPE, Constants.CODE_RESPONSE_TYPE);
+}
+/**
+ * add response_mode. defaults to query.
+ * @param responseMode
+ */
+function addResponseMode(parameters, responseMode) {
+    parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
+}
+/**
+ * Add flag to indicate STS should attempt to use WAM if available
+ */
+function addNativeBroker(parameters) {
+    parameters.set(NATIVE_BROKER, "1");
+}
+/**
+ * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
+ * @param scopeSet
+ * @param addOidcScopes
+ */
+function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+    // Always add openid to the scopes when adding OIDC scopes
+    if (addOidcScopes &&
+        !defaultScopes.includes("openid") &&
+        !scopes.includes("openid")) {
+        defaultScopes.push("openid");
+    }
+    const requestScopes = addOidcScopes
+        ? [...(scopes || []), ...defaultScopes]
+        : scopes || [];
+    const scopeSet = new ScopeSet(requestScopes);
+    parameters.set(SCOPE, scopeSet.printScopes());
+}
+/**
+ * add clientId
+ * @param clientId
+ */
+function addClientId(parameters, clientId) {
+    parameters.set(CLIENT_ID, clientId);
+}
+/**
+ * add redirect_uri
+ * @param redirectUri
+ */
+function addRedirectUri(parameters, redirectUri) {
+    parameters.set(REDIRECT_URI, redirectUri);
+}
+/**
+ * add post logout redirectUri
+ * @param redirectUri
+ */
+function addPostLogoutRedirectUri(parameters, redirectUri) {
+    parameters.set(POST_LOGOUT_URI, redirectUri);
+}
+/**
+ * add id_token_hint to logout request
+ * @param idTokenHint
+ */
+function addIdTokenHint(parameters, idTokenHint) {
+    parameters.set(ID_TOKEN_HINT, idTokenHint);
+}
+/**
+ * add domain_hint
+ * @param domainHint
+ */
+function addDomainHint(parameters, domainHint) {
+    parameters.set(DOMAIN_HINT, domainHint);
+}
+/**
+ * add login_hint
+ * @param loginHint
+ */
+function addLoginHint(parameters, loginHint) {
+    parameters.set(LOGIN_HINT, loginHint);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for login_hint
+ * @param loginHint
+ */
+function addCcsUpn(parameters, loginHint) {
+    parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for account object
+ * @param loginHint
+ */
+function addCcsOid(parameters, clientInfo) {
+    parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
+}
+/**
+ * add sid
+ * @param sid
+ */
+function addSid(parameters, sid) {
+    parameters.set(SID, sid);
+}
+/**
+ * add claims
+ * @param claims
+ */
+function addClaims(parameters, claims, clientCapabilities) {
+    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
+    try {
+        JSON.parse(mergedClaims);
     }
-    /**
-     * add clientId
-     * @param clientId
-     */
-    addClientId(clientId) {
-        this.parameters.set(CLIENT_ID, encodeURIComponent(clientId));
+    catch (e) {
+        throw createClientConfigurationError(invalidClaims);
     }
-    /**
-     * add redirect_uri
-     * @param redirectUri
-     */
-    addRedirectUri(redirectUri) {
-        RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(REDIRECT_URI, encodeURIComponent(redirectUri));
+    parameters.set(CLAIMS, mergedClaims);
+}
+/**
+ * add correlationId
+ * @param correlationId
+ */
+function addCorrelationId(parameters, correlationId) {
+    parameters.set(CLIENT_REQUEST_ID, correlationId);
+}
+/**
+ * add library info query params
+ * @param libraryInfo
+ */
+function addLibraryInfo(parameters, libraryInfo) {
+    // Telemetry Info
+    parameters.set(X_CLIENT_SKU, libraryInfo.sku);
+    parameters.set(X_CLIENT_VER, libraryInfo.version);
+    if (libraryInfo.os) {
+        parameters.set(X_CLIENT_OS, libraryInfo.os);
     }
-    /**
-     * add post logout redirectUri
-     * @param redirectUri
-     */
-    addPostLogoutRedirectUri(redirectUri) {
-        RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(POST_LOGOUT_URI, encodeURIComponent(redirectUri));
+    if (libraryInfo.cpu) {
+        parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
     }
-    /**
-     * add id_token_hint to logout request
-     * @param idTokenHint
-     */
-    addIdTokenHint(idTokenHint) {
-        this.parameters.set(ID_TOKEN_HINT, encodeURIComponent(idTokenHint));
+}
+/**
+ * Add client telemetry parameters
+ * @param appTelemetry
+ */
+function addApplicationTelemetry(parameters, appTelemetry) {
+    if (appTelemetry?.appName) {
+        parameters.set(X_APP_NAME, appTelemetry.appName);
     }
-    /**
-     * add domain_hint
-     * @param domainHint
-     */
-    addDomainHint(domainHint) {
-        this.parameters.set(DOMAIN_HINT, encodeURIComponent(domainHint));
+    if (appTelemetry?.appVersion) {
+        parameters.set(X_APP_VER, appTelemetry.appVersion);
     }
-    /**
-     * add login_hint
-     * @param loginHint
-     */
-    addLoginHint(loginHint) {
-        this.parameters.set(LOGIN_HINT, encodeURIComponent(loginHint));
+}
+/**
+ * add prompt
+ * @param prompt
+ */
+function addPrompt(parameters, prompt) {
+    parameters.set(PROMPT, prompt);
+}
+/**
+ * add state
+ * @param state
+ */
+function addState(parameters, state) {
+    if (state) {
+        parameters.set(STATE, state);
     }
-    /**
-     * Adds the CCS (Cache Credential Service) query parameter for login_hint
-     * @param loginHint
-     */
-    addCcsUpn(loginHint) {
-        this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent(`UPN:${loginHint}`));
+}
+/**
+ * add nonce
+ * @param nonce
+ */
+function addNonce(parameters, nonce) {
+    parameters.set(NONCE, nonce);
+}
+/**
+ * add code_challenge and code_challenge_method
+ * - throw if either of them are not passed
+ * @param codeChallenge
+ * @param codeChallengeMethod
+ */
+function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
+    if (codeChallenge && codeChallengeMethod) {
+        parameters.set(CODE_CHALLENGE, codeChallenge);
+        parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
     }
-    /**
-     * Adds the CCS (Cache Credential Service) query parameter for account object
-     * @param loginHint
-     */
-    addCcsOid(clientInfo) {
-        this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent(`Oid:${clientInfo.uid}@${clientInfo.utid}`));
+    else {
+        throw createClientConfigurationError(pkceParamsMissing);
     }
-    /**
-     * add sid
-     * @param sid
-     */
-    addSid(sid) {
-        this.parameters.set(SID, encodeURIComponent(sid));
+}
+/**
+ * add the `authorization_code` passed by the user to exchange for a token
+ * @param code
+ */
+function addAuthorizationCode(parameters, code) {
+    parameters.set(CODE, code);
+}
+/**
+ * add the `refreshToken` passed by the user
+ * @param refreshToken
+ */
+function addRefreshToken(parameters, refreshToken) {
+    parameters.set(REFRESH_TOKEN, refreshToken);
+}
+/**
+ * add the `code_verifier` passed by the user to exchange for a token
+ * @param codeVerifier
+ */
+function addCodeVerifier(parameters, codeVerifier) {
+    parameters.set(CODE_VERIFIER, codeVerifier);
+}
+/**
+ * add client_secret
+ * @param clientSecret
+ */
+function addClientSecret(parameters, clientSecret) {
+    parameters.set(CLIENT_SECRET, clientSecret);
+}
+/**
+ * add clientAssertion for confidential client flows
+ * @param clientAssertion
+ */
+function addClientAssertion(parameters, clientAssertion) {
+    if (clientAssertion) {
+        parameters.set(CLIENT_ASSERTION, clientAssertion);
     }
-    /**
-     * add claims
-     * @param claims
-     */
-    addClaims(claims, clientCapabilities) {
-        const mergedClaims = this.addClientCapabilitiesToClaims(claims, clientCapabilities);
-        RequestValidator.validateClaims(mergedClaims);
-        this.parameters.set(CLAIMS, encodeURIComponent(mergedClaims));
+}
+/**
+ * add clientAssertionType for confidential client flows
+ * @param clientAssertionType
+ */
+function addClientAssertionType(parameters, clientAssertionType) {
+    if (clientAssertionType) {
+        parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
     }
-    /**
-     * add correlationId
-     * @param correlationId
-     */
-    addCorrelationId(correlationId) {
-        this.parameters.set(CLIENT_REQUEST_ID, encodeURIComponent(correlationId));
+}
+/**
+ * add grant type
+ * @param grantType
+ */
+function addGrantType(parameters, grantType) {
+    parameters.set(GRANT_TYPE, grantType);
+}
+/**
+ * add client info
+ *
+ */
+function addClientInfo(parameters) {
+    parameters.set(CLIENT_INFO, "1");
+}
+function addInstanceAware(parameters) {
+    if (!parameters.has(INSTANCE_AWARE)) {
+        parameters.set(INSTANCE_AWARE, "true");
     }
-    /**
-     * add library info query params
-     * @param libraryInfo
-     */
-    addLibraryInfo(libraryInfo) {
-        // Telemetry Info
-        this.parameters.set(X_CLIENT_SKU, libraryInfo.sku);
-        this.parameters.set(X_CLIENT_VER, libraryInfo.version);
-        if (libraryInfo.os) {
-            this.parameters.set(X_CLIENT_OS, libraryInfo.os);
-        }
-        if (libraryInfo.cpu) {
-            this.parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
+}
+/**
+ * add extraQueryParams
+ * @param eQParams
+ */
+function addExtraQueryParameters(parameters, eQParams) {
+    Object.entries(eQParams).forEach(([key, value]) => {
+        if (!parameters.has(key) && value) {
+            parameters.set(key, value);
         }
+    });
+}
+function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+    let mergedClaims;
+    // Parse provided claims into JSON object or initialize empty object
+    if (!claims) {
+        mergedClaims = {};
     }
-    /**
-     * Add client telemetry parameters
-     * @param appTelemetry
-     */
-    addApplicationTelemetry(appTelemetry) {
-        if (appTelemetry?.appName) {
-            this.parameters.set(X_APP_NAME, appTelemetry.appName);
+    else {
+        try {
+            mergedClaims = JSON.parse(claims);
         }
-        if (appTelemetry?.appVersion) {
-            this.parameters.set(X_APP_VER, appTelemetry.appVersion);
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
         }
     }
-    /**
-     * add prompt
-     * @param prompt
-     */
-    addPrompt(prompt) {
-        RequestValidator.validatePrompt(prompt);
-        this.parameters.set(`${PROMPT}`, encodeURIComponent(prompt));
-    }
-    /**
-     * add state
-     * @param state
-     */
-    addState(state) {
-        if (state) {
-            this.parameters.set(STATE, encodeURIComponent(state));
+    if (clientCapabilities && clientCapabilities.length > 0) {
+        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+            // Add access_token key to claims object
+            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
         }
+        // Add xms_cc claim with provided clientCapabilities to access_token key
+        mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
+            {
+                values: clientCapabilities,
+            };
     }
-    /**
-     * add nonce
-     * @param nonce
-     */
-    addNonce(nonce) {
-        this.parameters.set(NONCE, encodeURIComponent(nonce));
+    return JSON.stringify(mergedClaims);
+}
+/**
+ * add pop_jwk to query params
+ * @param cnfString
+ */
+function addPopToken(parameters, cnfString) {
+    if (cnfString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
+        parameters.set(REQ_CNF, cnfString);
     }
-    /**
-     * add code_challenge and code_challenge_method
-     * - throw if either of them are not passed
-     * @param codeChallenge
-     * @param codeChallengeMethod
-     */
-    addCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-        RequestValidator.validateCodeChallengeParams(codeChallenge, codeChallengeMethod);
-        if (codeChallenge && codeChallengeMethod) {
-            this.parameters.set(CODE_CHALLENGE, encodeURIComponent(codeChallenge));
-            this.parameters.set(CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
-        }
-        else {
-            throw createClientConfigurationError(pkceParamsMissing);
-        }
-    }
-    /**
-     * add the `authorization_code` passed by the user to exchange for a token
-     * @param code
-     */
-    addAuthorizationCode(code) {
-        this.parameters.set(CODE, encodeURIComponent(code));
-    }
-    /**
-     * add the `authorization_code` passed by the user to exchange for a token
-     * @param code
-     */
-    addDeviceCode(code) {
-        this.parameters.set(DEVICE_CODE, encodeURIComponent(code));
-    }
-    /**
-     * add the `refreshToken` passed by the user
-     * @param refreshToken
-     */
-    addRefreshToken(refreshToken) {
-        this.parameters.set(REFRESH_TOKEN, encodeURIComponent(refreshToken));
-    }
-    /**
-     * add the `code_verifier` passed by the user to exchange for a token
-     * @param codeVerifier
-     */
-    addCodeVerifier(codeVerifier) {
-        this.parameters.set(CODE_VERIFIER, encodeURIComponent(codeVerifier));
-    }
-    /**
-     * add client_secret
-     * @param clientSecret
-     */
-    addClientSecret(clientSecret) {
-        this.parameters.set(CLIENT_SECRET, encodeURIComponent(clientSecret));
-    }
-    /**
-     * add clientAssertion for confidential client flows
-     * @param clientAssertion
-     */
-    addClientAssertion(clientAssertion) {
-        if (clientAssertion) {
-            this.parameters.set(CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
-        }
-    }
-    /**
-     * add clientAssertionType for confidential client flows
-     * @param clientAssertionType
-     */
-    addClientAssertionType(clientAssertionType) {
-        if (clientAssertionType) {
-            this.parameters.set(CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
-        }
-    }
-    /**
-     * add OBO assertion for confidential client flows
-     * @param clientAssertion
-     */
-    addOboAssertion(oboAssertion) {
-        this.parameters.set(OBO_ASSERTION, encodeURIComponent(oboAssertion));
-    }
-    /**
-     * add grant type
-     * @param grantType
-     */
-    addRequestTokenUse(tokenUse) {
-        this.parameters.set(REQUESTED_TOKEN_USE, encodeURIComponent(tokenUse));
-    }
-    /**
-     * add grant type
-     * @param grantType
-     */
-    addGrantType(grantType) {
-        this.parameters.set(GRANT_TYPE, encodeURIComponent(grantType));
-    }
-    /**
-     * add client info
-     *
-     */
-    addClientInfo() {
-        this.parameters.set(CLIENT_INFO, "1");
-    }
-    /**
-     * add extraQueryParams
-     * @param eQParams
-     */
-    addExtraQueryParameters(eQParams) {
-        Object.entries(eQParams).forEach(([key, value]) => {
-            if (!this.parameters.has(key) && value) {
-                this.parameters.set(key, value);
-            }
-        });
-    }
-    addClientCapabilitiesToClaims(claims, clientCapabilities) {
-        let mergedClaims;
-        // Parse provided claims into JSON object or initialize empty object
-        if (!claims) {
-            mergedClaims = {};
-        }
-        else {
-            try {
-                mergedClaims = JSON.parse(claims);
-            }
-            catch (e) {
-                throw createClientConfigurationError(invalidClaims);
-            }
-        }
-        if (clientCapabilities && clientCapabilities.length > 0) {
-            if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
-                // Add access_token key to claims object
-                mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
-            }
-            // Add xms_cc claim with provided clientCapabilities to access_token key
-            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] = {
-                values: clientCapabilities,
-            };
-        }
-        return JSON.stringify(mergedClaims);
-    }
-    /**
-     * adds `username` for Password Grant flow
-     * @param username
-     */
-    addUsername(username) {
-        this.parameters.set(PasswordGrantConstants.username, encodeURIComponent(username));
-    }
-    /**
-     * adds `password` for Password Grant flow
-     * @param password
-     */
-    addPassword(password) {
-        this.parameters.set(PasswordGrantConstants.password, encodeURIComponent(password));
-    }
-    /**
-     * add pop_jwk to query params
-     * @param cnfString
-     */
-    addPopToken(cnfString) {
-        if (cnfString) {
-            this.parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
-            this.parameters.set(REQ_CNF, encodeURIComponent(cnfString));
-        }
-    }
-    /**
-     * add SSH JWK and key ID to query params
-     */
-    addSshJwk(sshJwkString) {
-        if (sshJwkString) {
-            this.parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
-            this.parameters.set(REQ_CNF, encodeURIComponent(sshJwkString));
-        }
-    }
-    /**
-     * add server telemetry fields
-     * @param serverTelemetryManager
-     */
-    addServerTelemetry(serverTelemetryManager) {
-        this.parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-        this.parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
-    }
-    /**
-     * Adds parameter that indicates to the server that throttling is supported
-     */
-    addThrottling() {
-        this.parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
-    }
-    /**
-     * Adds logout_hint parameter for "silent" logout which prevent server account picker
-     */
-    addLogoutHint(logoutHint) {
-        this.parameters.set(LOGOUT_HINT, encodeURIComponent(logoutHint));
+}
+/**
+ * add SSH JWK and key ID to query params
+ */
+function addSshJwk(parameters, sshJwkString) {
+    if (sshJwkString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
+        parameters.set(REQ_CNF, sshJwkString);
     }
-    addBrokerParameters(params) {
-        const brokerParams = {};
-        brokerParams[BROKER_CLIENT_ID] =
-            params.brokerClientId;
-        brokerParams[BROKER_REDIRECT_URI] =
-            params.brokerRedirectUri;
-        this.addExtraQueryParameters(brokerParams);
+}
+/**
+ * add server telemetry fields
+ * @param serverTelemetryManager
+ */
+function addServerTelemetry(parameters, serverTelemetryManager) {
+    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+}
+/**
+ * Adds parameter that indicates to the server that throttling is supported
+ */
+function addThrottling(parameters) {
+    parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+}
+/**
+ * Adds logout_hint parameter for "silent" logout which prevent server account picker
+ */
+function addLogoutHint(parameters, logoutHint) {
+    parameters.set(LOGOUT_HINT, logoutHint);
+}
+function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
+    if (!parameters.has(BROKER_CLIENT_ID)) {
+        parameters.set(BROKER_CLIENT_ID, brokerClientId);
     }
-    /**
-     * Utility to create a URL from the params map
-     */
-    createQueryString() {
-        const queryParameterArray = new Array();
-        this.parameters.forEach((value, key) => {
-            queryParameterArray.push(`${key}=${value}`);
-        });
-        instrumentBrokerParams(this.parameters, this.correlationId, this.performanceClient);
-        return queryParameterArray.join("&");
+    if (!parameters.has(BROKER_REDIRECT_URI)) {
+        parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4529,7 +4410,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4539,7 +4420,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4549,7 +4430,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4725,11 +4606,11 @@ const PerformanceEvents = {
     StandardInteractionClientCreateAuthCodeClient: "standardInteractionClientCreateAuthCodeClient",
     StandardInteractionClientGetClientConfiguration: "standardInteractionClientGetClientConfiguration",
     StandardInteractionClientInitializeAuthorizationRequest: "standardInteractionClientInitializeAuthorizationRequest",
-    StandardInteractionClientInitializeAuthorizationCodeRequest: "standardInteractionClientInitializeAuthorizationCodeRequest",
     /**
      * getAuthCodeUrl API (msal-browser and msal-node).
      */
     GetAuthCodeUrl: "getAuthCodeUrl",
+    GetStandardParams: "getStandardParams",
     /**
      * Functions from InteractionHandler (msal-browser)
      */
@@ -4742,7 +4623,6 @@ const PerformanceEvents = {
     AuthClientAcquireToken: "authClientAcquireToken",
     AuthClientExecuteTokenRequest: "authClientExecuteTokenRequest",
     AuthClientCreateTokenRequestBody: "authClientCreateTokenRequestBody",
-    AuthClientCreateQueryString: "authClientCreateQueryString",
     /**
      * Generate functions in PopTokenGenerator (msal-common)
      */
@@ -4913,10 +4793,6 @@ const PerformanceEventAbbreviations = new Map([
         PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
         "StdIntClientInitAuthReq",
     ],
-    [
-        PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-        "StdIntClientInitAuthCodeReq",
-    ],
     [PerformanceEvents.GetAuthCodeUrl, "GetAuthCodeUrl"],
     [
         PerformanceEvents.HandleCodeResponseFromServer,
@@ -4930,10 +4806,6 @@ const PerformanceEventAbbreviations = new Map([
         PerformanceEvents.AuthClientCreateTokenRequestBody,
         "AuthClientCreateTReqBody",
     ],
-    [
-        PerformanceEvents.AuthClientCreateQueryString,
-        "AuthClientCreateQueryStr",
-    ],
     [PerformanceEvents.PopTokenGenerateCnf, "PopTGenCnf"],
     [PerformanceEvents.PopTokenGenerateKid, "PopTGenKid"],
     [PerformanceEvents.HandleServerTokenResponse, "HandleServerTRes"],
@@ -5058,7 +4930,7 @@ const IntFields = new Set([
     "encryptedCacheExpiredCount",
 ]);
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5154,7 +5026,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5263,7 +5135,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6102,7 +5974,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6133,7 +6005,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6152,7 +6024,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6173,7 +6045,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6260,7 +6132,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6290,7 +6162,7 @@ function createNetworkError(error, httpStatus, responseHeaders) {
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6425,22 +6297,20 @@ class BaseClient {
      * @param request
      */
     createTokenQueryParameters(request) {
-        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+        const parameters = new Map();
         if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
         }
         if (request.tokenQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);
+            addExtraQueryParameters(parameters, request.tokenQueryParameters);
         }
-        parameterBuilder.addCorrelationId(request.correlationId);
-        return parameterBuilder.createQueryString();
+        addCorrelationId(parameters, request.correlationId);
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6466,7 +6336,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6554,7 +6424,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6626,7 +6496,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6710,7 +6580,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6737,19 +6607,12 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-function parseServerErrorNo(serverResponse) {
-    const errorCodePrefix = "code=";
-    const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
-    return errorCodePrefixIndex && errorCodePrefixIndex >= 0
-        ? serverResponse.error_uri?.substring(errorCodePrefixIndex + errorCodePrefix.length)
-        : undefined;
-}
 /**
  * Class that handles response parsing.
  * @internal
@@ -6764,46 +6627,6 @@ class ResponseHandler {
         this.persistencePlugin = persistencePlugin;
         this.performanceClient = performanceClient;
     }
-    /**
-     * Function which validates server authorization code response.
-     * @param serverResponseHash
-     * @param requestState
-     * @param cryptoObj
-     */
-    validateServerAuthorizationCodeResponse(serverResponse, requestState) {
-        if (!serverResponse.state || !requestState) {
-            throw serverResponse.state
-                ? createClientAuthError(stateNotFound, "Cached State")
-                : createClientAuthError(stateNotFound, "Server State");
-        }
-        let decodedServerResponseState;
-        let decodedRequestState;
-        try {
-            decodedServerResponseState = decodeURIComponent(serverResponse.state);
-        }
-        catch (e) {
-            throw createClientAuthError(invalidState, serverResponse.state);
-        }
-        try {
-            decodedRequestState = decodeURIComponent(requestState);
-        }
-        catch (e) {
-            throw createClientAuthError(invalidState, serverResponse.state);
-        }
-        if (decodedServerResponseState !== decodedRequestState) {
-            throw createClientAuthError(stateMismatch);
-        }
-        // Check for error
-        if (serverResponse.error ||
-            serverResponse.error_description ||
-            serverResponse.suberror) {
-            const serverErrorNo = parseServerErrorNo(serverResponse);
-            if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-                throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
-            }
-            throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
-        }
-    }
     /**
      * Function which validates server authorization token response.
      * @param serverResponse
@@ -7115,7 +6938,74 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Validates server consumable params from the "request" objects
+ */
+class RequestValidator {
+    /**
+     * Utility to check if the `redirectUri` in the request is a non-null value
+     * @param redirectUri
+     */
+    static validateRedirectUri(redirectUri) {
+        if (!redirectUri) {
+            throw createClientConfigurationError(redirectUriEmpty);
+        }
+    }
+    /**
+     * Utility to validate prompt sent by the user in the request
+     * @param prompt
+     */
+    static validatePrompt(prompt) {
+        const promptValues = [];
+        for (const value in PromptValue) {
+            promptValues.push(PromptValue[value]);
+        }
+        if (promptValues.indexOf(prompt) < 0) {
+            throw createClientConfigurationError(invalidPromptValue);
+        }
+    }
+    static validateClaims(claims) {
+        try {
+            JSON.parse(claims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+    }
+    /**
+     * Utility to validate code_challenge and code_challenge_method
+     * @param codeChallenge
+     * @param codeChallengeMethod
+     */
+    static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
+        if (!codeChallenge || !codeChallengeMethod) {
+            throw createClientConfigurationError(pkceParamsMissing);
+        }
+        else {
+            this.validateCodeChallengeMethod(codeChallengeMethod);
+        }
+    }
+    /**
+     * Utility to validate code_challenge_method
+     * @param codeChallengeMethod
+     */
+    static validateCodeChallengeMethod(codeChallengeMethod) {
+        if ([
+            CodeChallengeMethodValues.PLAIN,
+            CodeChallengeMethodValues.S256,
+        ].indexOf(codeChallengeMethod) < 0) {
+            throw createClientConfigurationError(invalidCodeChallengeMethod);
+        }
+    }
+}
+
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7133,7 +7023,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7151,21 +7041,6 @@ class AuthorizationCodeClient extends BaseClient {
         this.oidcDefaultScopes =
             this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
     }
-    /**
-     * Creates the URL of the authorization request letting the user input credentials and consent to the
-     * application. The URL target the /authorize endpoint of the authority configured in the
-     * application object.
-     *
-     * Once the user inputs their credentials and consents, the authority will send a response to the redirect URI
-     * sent in the request and should contain an authorization code, which can then be used to acquire tokens via
-     * acquireToken(AuthorizationCodeRequest)
-     * @param request
-     */
-    async getAuthCodeUrl(request) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.GetAuthCodeUrl, request.correlationId);
-        const queryString = await invokeAsync(this.createAuthCodeUrlQueryString.bind(this), PerformanceEvents.AuthClientCreateQueryString, this.logger, this.performanceClient, request.correlationId)(request);
-        return UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString);
-    }
     /**
      * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
      * authorization_code_grant
@@ -7185,22 +7060,6 @@ class AuthorizationCodeClient extends BaseClient {
         responseHandler.validateTokenResponse(response.body);
         return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId);
     }
-    /**
-     * Handles the hash fragment response from public client code request. Returns a code response used by
-     * the client to exchange for a token in acquireToken.
-     * @param hashFragment
-     */
-    handleFragmentResponse(serverParams, cachedState) {
-        // Handle responses.
-        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);
-        // Get code response
-        responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState);
-        // throw when there is no auth code in the response
-        if (!serverParams.code) {
-            throw createClientAuthError(authorizationCodeMissingFromServerResponse);
-        }
-        return serverParams;
-    }
     /**
      * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
      * Default behaviour is to redirect the user to `window.location.href`.
@@ -7248,8 +7107,8 @@ class AuthorizationCodeClient extends BaseClient {
      */
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);
-        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
-        parameterBuilder.addClientId(request.embeddedClientId ||
+        const parameters = new Map();
+        addClientId(parameters, request.embeddedClientId ||
             request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         /*
@@ -7262,33 +7121,33 @@ class AuthorizationCodeClient extends BaseClient {
         }
         else {
             // Validate and include redirect uri
-            parameterBuilder.addRedirectUri(request.redirectUri);
+            addRedirectUri(parameters, request.redirectUri);
         }
         // Add scope array, parameter builder will add default scopes and dedupe
-        parameterBuilder.addScopes(request.scopes, true, this.oidcDefaultScopes);
+        addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
         // add code: user set, not validated
-        parameterBuilder.addAuthorizationCode(request.code);
+        addAuthorizationCode(parameters, request.code);
         // Add library metadata
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        parameterBuilder.addThrottling();
+        addLibraryInfo(parameters, this.config.libraryInfo);
+        addApplicationTelemetry(parameters, this.config.telemetry.application);
+        addThrottling(parameters);
         if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
-            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
+            addServerTelemetry(parameters, this.serverTelemetryManager);
         }
         // add code_verifier if passed
         if (request.codeVerifier) {
-            parameterBuilder.addCodeVerifier(request.codeVerifier);
+            addCodeVerifier(parameters, request.codeVerifier);
         }
         if (this.config.clientCredentials.clientSecret) {
-            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
+            addClientSecret(parameters, this.config.clientCredentials.clientSecret);
         }
         if (this.config.clientCredentials.clientAssertion) {
             const clientAssertion = this.config.clientCredentials.clientAssertion;
-            parameterBuilder.addClientAssertion(await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
-            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+            addClientAssertionType(parameters, clientAssertion.assertionType);
         }
-        parameterBuilder.addGrantType(GrantType.AUTHORIZATION_CODE_GRANT);
-        parameterBuilder.addClientInfo();
+        addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
+        addClientInfo(parameters);
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
             let reqCnfData;
@@ -7300,11 +7159,11 @@ class AuthorizationCodeClient extends BaseClient {
                 reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
             }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData);
+            addPopToken(parameters, reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
-                parameterBuilder.addSshJwk(request.sshJwk);
+                addSshJwk(parameters, request.sshJwk);
             }
             else {
                 throw createClientConfigurationError(missingSshJwk);
@@ -7313,7 +7172,7 @@ class AuthorizationCodeClient extends BaseClient {
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
         }
         let ccsCred = undefined;
         if (request.clientInfo) {
@@ -7337,7 +7196,7 @@ class AuthorizationCodeClient extends BaseClient {
                 case CcsCredentialType.HOME_ACCOUNT_ID:
                     try {
                         const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
-                        parameterBuilder.addCcsOid(clientInfo);
+                        addCcsOid(parameters, clientInfo);
                     }
                     catch (e) {
                         this.logger.verbose("Could not parse home account ID for CCS Header: " +
@@ -7345,234 +7204,59 @@ class AuthorizationCodeClient extends BaseClient {
                     }
                     break;
                 case CcsCredentialType.UPN:
-                    parameterBuilder.addCcsUpn(ccsCred.credential);
+                    addCcsUpn(parameters, ccsCred.credential);
                     break;
             }
         }
         if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
         }
         if (request.tokenBodyParameters) {
-            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+            addExtraQueryParameters(parameters, request.tokenBodyParameters);
         }
         // Add hybrid spa parameters if not already provided
         if (request.enableSpaAuthorizationCode &&
             (!request.tokenBodyParameters ||
                 !request.tokenBodyParameters[RETURN_SPA_CODE])) {
-            parameterBuilder.addExtraQueryParameters({
+            addExtraQueryParameters(parameters, {
                 [RETURN_SPA_CODE]: "1",
             });
         }
-        return parameterBuilder.createQueryString();
-    }
-    /**
-     * This API validates the `AuthorizationCodeUrlRequest` and creates a URL
-     * @param request
-     */
-    async createAuthCodeUrlQueryString(request) {
-        // generate the correlationId if not set by the user and add
-        const correlationId = request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, correlationId);
-        const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
-        parameterBuilder.addClientId(request.embeddedClientId ||
-            request.extraQueryParameters?.[CLIENT_ID] ||
-            this.config.authOptions.clientId);
-        const requestScopes = [
-            ...(request.scopes || []),
-            ...(request.extraScopesToConsent || []),
-        ];
-        parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);
-        // validate the redirectUri (to be a non null value)
-        parameterBuilder.addRedirectUri(request.redirectUri);
-        parameterBuilder.addCorrelationId(correlationId);
-        // add response_mode. If not passed in it defaults to query.
-        parameterBuilder.addResponseMode(request.responseMode);
-        // add response_type = code
-        parameterBuilder.addResponseTypeCode();
-        // add library info parameters
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        if (!isOidcProtocolMode(this.config)) {
-            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        }
-        // add client_info=1
-        parameterBuilder.addClientInfo();
-        if (request.codeChallenge && request.codeChallengeMethod) {
-            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
-        }
-        if (request.prompt) {
-            parameterBuilder.addPrompt(request.prompt);
-        }
-        if (request.domainHint) {
-            parameterBuilder.addDomainHint(request.domainHint);
-            this.performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
-        }
-        this.performanceClient?.addFields({ prompt: request.prompt }, correlationId);
-        // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
-        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
-            // AAD will throw if prompt=select_account is passed with an account hint
-            if (request.sid && request.prompt === PromptValue.NONE) {
-                // SessionID is only used in silent calls
-                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
-                parameterBuilder.addSid(request.sid);
-                this.performanceClient?.addFields({ sidFromRequest: true }, correlationId);
-            }
-            else if (request.account) {
-                const accountSid = this.extractAccountSid(request.account);
-                let accountLoginHintClaim = this.extractLoginHint(request.account);
-                if (accountLoginHintClaim && request.domainHint) {
-                    this.logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`);
-                    accountLoginHintClaim = null;
-                }
-                // If login_hint claim is present, use it over sid/username
-                if (accountLoginHintClaim) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
-                    parameterBuilder.addLoginHint(accountLoginHintClaim);
-                    this.performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                    }
-                }
-                else if (accountSid && request.prompt === PromptValue.NONE) {
-                    /*
-                     * If account and loginHint are provided, we will check account first for sid before adding loginHint
-                     * SessionId is only used in silent calls
-                     */
-                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
-                    parameterBuilder.addSid(accountSid);
-                    this.performanceClient?.addFields({ sidFromClaim: true }, correlationId);
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                    }
-                }
-                else if (request.loginHint) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
-                    parameterBuilder.addLoginHint(request.loginHint);
-                    parameterBuilder.addCcsUpn(request.loginHint);
-                    this.performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
-                }
-                else if (request.account.username) {
-                    // Fallback to account username if provided
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
-                    parameterBuilder.addLoginHint(request.account.username);
-                    this.performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                    }
-                }
-            }
-            else if (request.loginHint) {
-                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
-                parameterBuilder.addLoginHint(request.loginHint);
-                parameterBuilder.addCcsUpn(request.loginHint);
-                this.performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
-            }
-        }
-        else {
-            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
-        }
-        if (request.nonce) {
-            parameterBuilder.addNonce(request.nonce);
-        }
-        if (request.state) {
-            parameterBuilder.addState(request.state);
-        }
-        if (request.claims ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
-        }
-        if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
-        }
-        this.addExtraQueryParams(request, parameterBuilder);
-        if (request.platformBroker) {
-            // signal ests that this is a WAM call
-            parameterBuilder.addNativeBroker();
-            // pass the req_cnf for POP
-            if (request.authenticationScheme === AuthenticationScheme.POP) {
-                const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                // req_cnf is always sent as a string for SPAs
-                let reqCnfData;
-                if (!request.popKid) {
-                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                    reqCnfData = generatedReqCnfData.reqCnfString;
-                }
-                else {
-                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
-                }
-                parameterBuilder.addPopToken(reqCnfData);
-            }
-        }
-        return parameterBuilder.createQueryString();
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
     }
     /**
      * This API validates the `EndSessionRequest` and creates a URL
      * @param request
      */
     createLogoutUrlQueryString(request) {
-        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+        const parameters = new Map();
         if (request.postLogoutRedirectUri) {
-            parameterBuilder.addPostLogoutRedirectUri(request.postLogoutRedirectUri);
+            addPostLogoutRedirectUri(parameters, request.postLogoutRedirectUri);
         }
         if (request.correlationId) {
-            parameterBuilder.addCorrelationId(request.correlationId);
+            addCorrelationId(parameters, request.correlationId);
         }
         if (request.idTokenHint) {
-            parameterBuilder.addIdTokenHint(request.idTokenHint);
+            addIdTokenHint(parameters, request.idTokenHint);
         }
         if (request.state) {
-            parameterBuilder.addState(request.state);
+            addState(parameters, request.state);
         }
         if (request.logoutHint) {
-            parameterBuilder.addLogoutHint(request.logoutHint);
-        }
-        this.addExtraQueryParams(request, parameterBuilder);
-        return parameterBuilder.createQueryString();
-    }
-    addExtraQueryParams(request, parameterBuilder) {
-        const hasRequestInstanceAware = request.extraQueryParameters &&
-            request.extraQueryParameters.hasOwnProperty("instance_aware");
-        // Set instance_aware flag if config auth param is set
-        if (!hasRequestInstanceAware && this.config.authOptions.instanceAware) {
-            request.extraQueryParameters = request.extraQueryParameters || {};
-            request.extraQueryParameters["instance_aware"] = "true";
+            addLogoutHint(parameters, request.logoutHint);
         }
         if (request.extraQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+            addExtraQueryParameters(parameters, request.extraQueryParameters);
         }
-    }
-    /**
-     * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
-     * @param account
-     */
-    extractAccountSid(account) {
-        return account.idTokenClaims?.sid || null;
-    }
-    extractLoginHint(account) {
-        return account.idTokenClaims?.login_hint || null;
+        if (this.config.authOptions.instanceAware) {
+            addInstanceAware(parameters);
+        }
+        return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7701,31 +7385,30 @@ class RefreshTokenClient extends BaseClient {
      */
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);
-        const correlationId = request.correlationId;
-        const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
-        parameterBuilder.addClientId(request.embeddedClientId ||
+        const parameters = new Map();
+        addClientId(parameters, request.embeddedClientId ||
             request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         if (request.redirectUri) {
-            parameterBuilder.addRedirectUri(request.redirectUri);
-        }
-        parameterBuilder.addScopes(request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
-        parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
-        parameterBuilder.addClientInfo();
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        parameterBuilder.addThrottling();
+            addRedirectUri(parameters, request.redirectUri);
+        }
+        addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
+        addClientInfo(parameters);
+        addLibraryInfo(parameters, this.config.libraryInfo);
+        addApplicationTelemetry(parameters, this.config.telemetry.application);
+        addThrottling(parameters);
         if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
-            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
+            addServerTelemetry(parameters, this.serverTelemetryManager);
         }
-        parameterBuilder.addRefreshToken(request.refreshToken);
+        addRefreshToken(parameters, request.refreshToken);
         if (this.config.clientCredentials.clientSecret) {
-            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
+            addClientSecret(parameters, this.config.clientCredentials.clientSecret);
         }
         if (this.config.clientCredentials.clientAssertion) {
             const clientAssertion = this.config.clientCredentials.clientAssertion;
-            parameterBuilder.addClientAssertion(await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
-            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+            addClientAssertionType(parameters, clientAssertion.assertionType);
         }
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
@@ -7738,11 +7421,11 @@ class RefreshTokenClient extends BaseClient {
                 reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
             }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData);
+            addPopToken(parameters, reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
-                parameterBuilder.addSshJwk(request.sshJwk);
+                addSshJwk(parameters, request.sshJwk);
             }
             else {
                 throw createClientConfigurationError(missingSshJwk);
@@ -7751,7 +7434,7 @@ class RefreshTokenClient extends BaseClient {
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
         }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
@@ -7759,7 +7442,7 @@ class RefreshTokenClient extends BaseClient {
                 case CcsCredentialType.HOME_ACCOUNT_ID:
                     try {
                         const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);
-                        parameterBuilder.addCcsOid(clientInfo);
+                        addCcsOid(parameters, clientInfo);
                     }
                     catch (e) {
                         this.logger.verbose("Could not parse home account ID for CCS Header: " +
@@ -7767,24 +7450,22 @@ class RefreshTokenClient extends BaseClient {
                     }
                     break;
                 case CcsCredentialType.UPN:
-                    parameterBuilder.addCcsUpn(request.ccsCredential.credential);
+                    addCcsUpn(parameters, request.ccsCredential.credential);
                     break;
             }
         }
         if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
         }
         if (request.tokenBodyParameters) {
-            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+            addExtraQueryParameters(parameters, request.tokenBodyParameters);
         }
-        return parameterBuilder.createQueryString();
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7859,45 +7540,269 @@ class SilentFlowClient extends BaseClient {
         if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
             this.logger.info(`Token refresh is required due to cache outcome: ${cacheOutcome}`);
         }
-    }
-    /**
-     * Helper function to build response object from the CacheRecord
-     * @param cacheRecord
-     */
-    async generateResultFromCacheRecord(cacheRecord, request) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, request.correlationId);
-        let idTokenClaims;
-        if (cacheRecord.idToken) {
-            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
+    }
+    /**
+     * Helper function to build response object from the CacheRecord
+     * @param cacheRecord
+     */
+    async generateResultFromCacheRecord(cacheRecord, request) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, request.correlationId);
+        let idTokenClaims;
+        if (cacheRecord.idToken) {
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
+        }
+        // token max_age check
+        if (request.maxAge || request.maxAge === 0) {
+            const authTime = idTokenClaims?.auth_time;
+            if (!authTime) {
+                throw createClientAuthError(authTimeNotFound);
+            }
+            checkMaxAge(authTime, request.maxAge);
+        }
+        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
+    }
+}
+
+/*! @azure/msal-common v15.3.0 2025-03-20 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const StubbedNetworkModule = {
+    sendGetRequestAsync: () => {
+        return Promise.reject(createClientAuthError(methodNotImplemented));
+    },
+    sendPostRequestAsync: () => {
+        return Promise.reject(createClientAuthError(methodNotImplemented));
+    },
+};
+
+/*! @azure/msal-common v15.3.0 2025-03-20 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+ * @param config
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
+    // generate the correlationId if not set by the user and add
+    const correlationId = request.correlationId;
+    const parameters = new Map();
+    addClientId(parameters, request.embeddedClientId ||
+        request.extraQueryParameters?.[CLIENT_ID] ||
+        authOptions.clientId);
+    const requestScopes = [
+        ...(request.scopes || []),
+        ...(request.extraScopesToConsent || []),
+    ];
+    addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addRedirectUri(parameters, request.redirectUri);
+    addCorrelationId(parameters, correlationId);
+    // add response_mode. If not passed in it defaults to query.
+    addResponseMode(parameters, request.responseMode);
+    // add client_info=1
+    addClientInfo(parameters);
+    if (request.prompt) {
+        addPrompt(parameters, request.prompt);
+        performanceClient?.addFields({ prompt: request.prompt }, correlationId);
+    }
+    if (request.domainHint) {
+        addDomainHint(parameters, request.domainHint);
+        performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
+    }
+    // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
+    if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+        // AAD will throw if prompt=select_account is passed with an account hint
+        if (request.sid && request.prompt === PromptValue.NONE) {
+            // SessionID is only used in silent calls
+            logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
+            addSid(parameters, request.sid);
+            performanceClient?.addFields({ sidFromRequest: true }, correlationId);
+        }
+        else if (request.account) {
+            const accountSid = extractAccountSid(request.account);
+            let accountLoginHintClaim = extractLoginHint(request.account);
+            if (accountLoginHintClaim && request.domainHint) {
+                logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`);
+                accountLoginHintClaim = null;
+            }
+            // If login_hint claim is present, use it over sid/username
+            if (accountLoginHintClaim) {
+                logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
+                addLoginHint(parameters, accountLoginHintClaim);
+                performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                }
+            }
+            else if (accountSid && request.prompt === PromptValue.NONE) {
+                /*
+                 * If account and loginHint are provided, we will check account first for sid before adding loginHint
+                 * SessionId is only used in silent calls
+                 */
+                logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
+                addSid(parameters, accountSid);
+                performanceClient?.addFields({ sidFromClaim: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                }
+            }
+            else if (request.loginHint) {
+                logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
+                addLoginHint(parameters, request.loginHint);
+                addCcsUpn(parameters, request.loginHint);
+                performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
+            }
+            else if (request.account.username) {
+                // Fallback to account username if provided
+                logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
+                addLoginHint(parameters, request.account.username);
+                performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                }
+            }
+        }
+        else if (request.loginHint) {
+            logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
+            addLoginHint(parameters, request.loginHint);
+            addCcsUpn(parameters, request.loginHint);
+            performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
         }
-        // token max_age check
-        if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenClaims?.auth_time;
-            if (!authTime) {
-                throw createClientAuthError(authTimeNotFound);
-            }
-            checkMaxAge(authTime, request.maxAge);
+    }
+    else {
+        logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
+    }
+    if (request.nonce) {
+        addNonce(parameters, request.nonce);
+    }
+    if (request.state) {
+        addState(parameters, request.state);
+    }
+    if (request.claims ||
+        (authOptions.clientCapabilities &&
+            authOptions.clientCapabilities.length > 0)) {
+        addClaims(parameters, request.claims, authOptions.clientCapabilities);
+    }
+    if (request.embeddedClientId) {
+        addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
+    }
+    if (request.extraQueryParameters) {
+        addExtraQueryParameters(parameters, request.extraQueryParameters);
+    }
+    if (authOptions.instanceAware) {
+        addInstanceAware(parameters);
+    }
+    return parameters;
+}
+/**
+ * Returns authorize endpoint with given request parameters in the query string
+ * @param authority
+ * @param requestParameters
+ * @returns
+ */
+function getAuthorizeUrl(authority, requestParameters) {
+    const queryString = mapToQueryString(requestParameters);
+    return UrlString.appendQueryString(authority.authorizationEndpoint, queryString);
+}
+/**
+ * Handles the hash fragment response from public client code request. Returns a code response used by
+ * the client to exchange for a token in acquireToken.
+ * @param serverParams
+ * @param cachedState
+ */
+function getAuthorizationCodePayload(serverParams, cachedState) {
+    // Get code response
+    validateAuthorizationResponse(serverParams, cachedState);
+    // throw when there is no auth code in the response
+    if (!serverParams.code) {
+        throw createClientAuthError(authorizationCodeMissingFromServerResponse);
+    }
+    return serverParams;
+}
+/**
+ * Function which validates server authorization code response.
+ * @param serverResponseHash
+ * @param requestState
+ */
+function validateAuthorizationResponse(serverResponse, requestState) {
+    if (!serverResponse.state || !requestState) {
+        throw serverResponse.state
+            ? createClientAuthError(stateNotFound, "Cached State")
+            : createClientAuthError(stateNotFound, "Server State");
+    }
+    let decodedServerResponseState;
+    let decodedRequestState;
+    try {
+        decodedServerResponseState = decodeURIComponent(serverResponse.state);
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState, serverResponse.state);
+    }
+    try {
+        decodedRequestState = decodeURIComponent(requestState);
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState, serverResponse.state);
+    }
+    if (decodedServerResponseState !== decodedRequestState) {
+        throw createClientAuthError(stateMismatch);
+    }
+    // Check for error
+    if (serverResponse.error ||
+        serverResponse.error_description ||
+        serverResponse.suberror) {
+        const serverErrorNo = parseServerErrorNo(serverResponse);
+        if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
+            throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
         }
-        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
+        throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
     }
-}
-
-/*! @azure/msal-common v15.2.1 2025-03-11 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
+}
+/**
+ * Get server error No from the error_uri
+ * @param serverResponse
+ * @returns
  */
-const StubbedNetworkModule = {
-    sendGetRequestAsync: () => {
-        return Promise.reject(createClientAuthError(methodNotImplemented));
-    },
-    sendPostRequestAsync: () => {
-        return Promise.reject(createClientAuthError(methodNotImplemented));
-    },
-};
+function parseServerErrorNo(serverResponse) {
+    const errorCodePrefix = "code=";
+    const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
+    return errorCodePrefixIndex && errorCodePrefixIndex >= 0
+        ? serverResponse.error_uri?.substring(errorCodePrefixIndex + errorCodePrefix.length)
+        : undefined;
+}
+/**
+ * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
+ * @param account
+ */
+function extractAccountSid(account) {
+    return account.idTokenClaims?.sid || null;
+}
+function extractLoginHint(account) {
+    return account.idTokenClaims?.login_hint || null;
+}
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7955,7 +7860,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8218,7 +8123,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8226,7 +8131,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8251,7 +8156,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8291,7 +8196,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8370,7 +8275,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10407,7 +10312,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.7.0";
+const version = "4.8.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13111,61 +13016,6 @@ class BaseInteractionClient {
     }
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-// Constant byte array length
-const RANDOM_BYTE_ARR_LENGTH = 32;
-/**
- * This file defines APIs to generate PKCE codes and code verifiers.
- */
-/**
- * Generates PKCE Codes. See the RFC for more information: https://tools.ietf.org/html/rfc7636
- */
-async function generatePkceCodes(performanceClient, logger, correlationId) {
-    performanceClient.addQueueMeasurement(PerformanceEvents.GeneratePkceCodes, correlationId);
-    const codeVerifier = invoke(generateCodeVerifier, PerformanceEvents.GenerateCodeVerifier, logger, performanceClient, correlationId)(performanceClient, logger, correlationId);
-    const codeChallenge = await invokeAsync(generateCodeChallengeFromVerifier, PerformanceEvents.GenerateCodeChallengeFromVerifier, logger, performanceClient, correlationId)(codeVerifier, performanceClient, logger, correlationId);
-    return {
-        verifier: codeVerifier,
-        challenge: codeChallenge,
-    };
-}
-/**
- * Generates a random 32 byte buffer and returns the base64
- * encoded string to be used as a PKCE Code Verifier
- */
-function generateCodeVerifier(performanceClient, logger, correlationId) {
-    try {
-        // Generate random values as utf-8
-        const buffer = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
-        invoke(getRandomValues, PerformanceEvents.GetRandomValues, logger, performanceClient, correlationId)(buffer);
-        // encode verifier as base64
-        const pkceCodeVerifierB64 = urlEncodeArr(buffer);
-        return pkceCodeVerifierB64;
-    }
-    catch (e) {
-        throw createBrowserAuthError(pkceNotCreated);
-    }
-}
-/**
- * Creates a base64 encoded PKCE Code Challenge string from the
- * hash created from the PKCE Code Verifier supplied
- */
-async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceClient, logger, correlationId) {
-    performanceClient.addQueueMeasurement(PerformanceEvents.GenerateCodeChallengeFromVerifier, correlationId);
-    try {
-        // hashed verifier
-        const pkceHashedCodeVerifier = await invokeAsync(sha256Digest, PerformanceEvents.Sha256Digest, logger, performanceClient, correlationId)(pkceCodeVerifier, performanceClient, correlationId);
-        // encode hash as base64
-        return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
-    }
-    catch (e) {
-        throw createBrowserAuthError(pkceNotCreated);
-    }
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -13228,25 +13078,6 @@ async function initializeSilentRequest(request, account, config, performanceClie
  * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
  */
 class StandardInteractionClient extends BaseInteractionClient {
-    /**
-     * Generates an auth code request tied to the url request.
-     * @param request
-     * @param pkceCodes
-     */
-    async initializeAuthorizationCodeRequest(request, pkceCodes) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.correlationId);
-        const generatedPkceParams = pkceCodes ||
-            (await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId));
-        const authCodeRequest = {
-            ...request,
-            redirectUri: request.redirectUri,
-            code: Constants.EMPTY_STRING,
-            codeVerifier: generatedPkceParams.verifier,
-        };
-        request.codeChallenge = generatedPkceParams.challenge;
-        request.codeChallengeMethod = Constants.S256_CODE_CHALLENGE_METHOD;
-        return authCodeRequest;
-    }
     /**
      * Initializer for the logout request.
      * @param logoutRequest
@@ -13825,7 +13656,12 @@ class NativeInteractionClient extends BaseInteractionClient {
         const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
             nativeAccountId: request.accountId,
         })?.homeAccountId;
-        if (homeAccountIdentifier !== cachedhomeAccountId &&
+        // add exception for double brokering, please note this is temporary and will be fortified in future
+        if (request.extraParameters?.child_client_id &&
+            response.account.id !== request.accountId) {
+            this.logger.info("handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch");
+        }
+        else if (homeAccountIdentifier !== cachedhomeAccountId &&
             response.account.id !== request.accountId) {
             // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
             throw createNativeAuthError(userSwitch);
@@ -13837,6 +13673,8 @@ class NativeInteractionClient extends BaseInteractionClient {
         const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
         idTokenClaims.tid, undefined, // auth code payload
         response.account.id, this.logger);
+        // Ensure expires_in is in number format
+        response.expires_in = Number(response.expires_in);
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
@@ -14484,7 +14322,7 @@ class InteractionHandler {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(response, request.state);
+            authCodeResponse = getAuthorizationCodePayload(response, request.state);
         }
         catch (e) {
             if (e instanceof ServerError &&
@@ -14592,6 +14430,126 @@ function validateInteractionType(response, browserCrypto, interactionType) {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+ * @param config
+ * @param authority
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+async function getStandardParameters(config, authority, request, logger, performanceClient) {
+    const parameters = getStandardAuthorizeRequestParameters({ ...config.auth, authority: authority }, request, logger, performanceClient);
+    addLibraryInfo(parameters, {
+        sku: BrowserConstants.MSAL_SKU,
+        version: version,
+        os: "",
+        cpu: "",
+    });
+    if (config.auth.protocolMode !== ProtocolMode.OIDC) {
+        addApplicationTelemetry(parameters, config.telemetry.application);
+    }
+    if (request.platformBroker) {
+        // signal ests that this is a WAM call
+        addNativeBroker(parameters);
+        // pass the req_cnf for POP
+        if (request.authenticationScheme === AuthenticationScheme.POP) {
+            const cryptoOps = new CryptoOps(logger, performanceClient);
+            const popTokenGenerator = new PopTokenGenerator(cryptoOps);
+            // req_cnf is always sent as a string for SPAs
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, logger, performanceClient, request.correlationId)(request, logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = cryptoOps.encodeKid(request.popKid);
+            }
+            addPopToken(parameters, reqCnfData);
+        }
+    }
+    instrumentBrokerParams(parameters, request.correlationId, performanceClient);
+    return parameters;
+}
+/**
+ * Gets the full /authorize URL with request parameters when using Auth Code + PKCE
+ * @param config
+ * @param authority
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+async function getAuthCodeRequestUrl(config, authority, request, logger, performanceClient) {
+    if (!request.codeChallenge) {
+        throw createClientConfigurationError(pkceParamsMissing);
+    }
+    const parameters = await invokeAsync(getStandardParameters, PerformanceEvents.GetStandardParams, logger, performanceClient, request.correlationId)(config, authority, request, logger, performanceClient);
+    addResponseTypeCode(parameters);
+    addCodeChallengeParams(parameters, request.codeChallenge, Constants.S256_CODE_CHALLENGE_METHOD);
+    return getAuthorizeUrl(authority, parameters);
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+// Constant byte array length
+const RANDOM_BYTE_ARR_LENGTH = 32;
+/**
+ * This file defines APIs to generate PKCE codes and code verifiers.
+ */
+/**
+ * Generates PKCE Codes. See the RFC for more information: https://tools.ietf.org/html/rfc7636
+ */
+async function generatePkceCodes(performanceClient, logger, correlationId) {
+    performanceClient.addQueueMeasurement(PerformanceEvents.GeneratePkceCodes, correlationId);
+    const codeVerifier = invoke(generateCodeVerifier, PerformanceEvents.GenerateCodeVerifier, logger, performanceClient, correlationId)(performanceClient, logger, correlationId);
+    const codeChallenge = await invokeAsync(generateCodeChallengeFromVerifier, PerformanceEvents.GenerateCodeChallengeFromVerifier, logger, performanceClient, correlationId)(codeVerifier, performanceClient, logger, correlationId);
+    return {
+        verifier: codeVerifier,
+        challenge: codeChallenge,
+    };
+}
+/**
+ * Generates a random 32 byte buffer and returns the base64
+ * encoded string to be used as a PKCE Code Verifier
+ */
+function generateCodeVerifier(performanceClient, logger, correlationId) {
+    try {
+        // Generate random values as utf-8
+        const buffer = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
+        invoke(getRandomValues, PerformanceEvents.GetRandomValues, logger, performanceClient, correlationId)(buffer);
+        // encode verifier as base64
+        const pkceCodeVerifierB64 = urlEncodeArr(buffer);
+        return pkceCodeVerifierB64;
+    }
+    catch (e) {
+        throw createBrowserAuthError(pkceNotCreated);
+    }
+}
+/**
+ * Creates a base64 encoded PKCE Code Challenge string from the
+ * hash created from the PKCE Code Verifier supplied
+ */
+async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceClient, logger, correlationId) {
+    performanceClient.addQueueMeasurement(PerformanceEvents.GenerateCodeChallengeFromVerifier, correlationId);
+    try {
+        // hashed verifier
+        const pkceHashedCodeVerifier = await invokeAsync(sha256Digest, PerformanceEvents.Sha256Digest, logger, performanceClient, correlationId)(pkceCodeVerifier, performanceClient, correlationId);
+        // encode hash as base64
+        return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
+    }
+    catch (e) {
+        throw createBrowserAuthError(pkceNotCreated);
+    }
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -14679,6 +14637,9 @@ class PopupClient extends StandardInteractionClient {
         this.logger.verbose("acquireTokenPopupAsync called");
         const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenPopup);
         const validRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, exports.InteractionType.Popup);
+        const pkce = pkceCodes ||
+            (await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId));
+        validRequest.codeChallenge = pkce.challenge;
         /*
          * Skip pre-connect for async popups to reduce time between user interaction and popup window creation to avoid
          * popup from being blocked by browsers with shorter popup timers
@@ -14687,8 +14648,6 @@ class PopupClient extends StandardInteractionClient {
             preconnect(validRequest.authority);
         }
         try {
-            // Create auth code request and generate PKCE params
-            const authCodeRequest = await invokeAsync(this.initializeAuthorizationCodeRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.logger, this.performanceClient, this.correlationId)(validRequest, pkceCodes);
             // Initialize the client
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
                 serverTelemetryManager,
@@ -14705,12 +14664,10 @@ class PopupClient extends StandardInteractionClient {
                     this.performanceClient.startMeasurement(PerformanceEvents.FetchAccountIdWithNativeBroker, request.correlationId);
             }
             // Create acquire token url.
-            const navigateUrl = await authClient.getAuthCodeUrl({
+            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, validRequest.correlationId)(this.config, authClient.authority, {
                 ...validRequest,
                 platformBroker: isPlatformBroker,
-            });
-            // Create popup interaction handler.
-            const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
+            }, this.logger, this.performanceClient);
             // Show the UI once the url has been created. Get the window handle for the popup.
             const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
             this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
@@ -14718,7 +14675,7 @@ class PopupClient extends StandardInteractionClient {
             const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
             const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
             // Remove throttle if it exists
-            ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
+            ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, validRequest);
             if (serverParams.accountId) {
                 this.logger.verbose("Account id found in hash, calling WAM for token");
                 // end measurement for server call with native brokering enabled
@@ -14739,6 +14696,13 @@ class PopupClient extends StandardInteractionClient {
                     prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
                 });
             }
+            const authCodeRequest = {
+                ...validRequest,
+                code: serverParams.code || "",
+                codeVerifier: pkce.verifier,
+            };
+            // Create popup interaction handler.
+            const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
             // Handle response from hash string.
             const result = await interactionHandler.handleCodeResponse(serverParams, validRequest);
             return result;
@@ -15114,7 +15078,7 @@ class RedirectHandler {
         }
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(response, requestState);
+            authCodeResponse = getAuthorizationCodePayload(response, requestState);
         }
         catch (e) {
             if (e instanceof ServerError &&
@@ -15198,6 +15162,8 @@ class RedirectClient extends StandardInteractionClient {
      */
     async acquireToken(request) {
         const validRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, exports.InteractionType.Redirect);
+        const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId);
+        validRequest.codeChallenge = pkceCodes.challenge;
         this.browserStorage.updateCacheEntries(validRequest.state, validRequest.nonce, validRequest.authority, validRequest.loginHint || "", validRequest.account || null);
         const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenRedirect);
         const handleBackButton = (event) => {
@@ -15209,8 +15175,6 @@ class RedirectClient extends StandardInteractionClient {
             }
         };
         try {
-            // Create auth code request and generate PKCE params
-            const authCodeRequest = await invokeAsync(this.initializeAuthorizationCodeRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.logger, this.performanceClient, this.correlationId)(validRequest);
             // Initialize the client
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
                 serverTelemetryManager,
@@ -15219,13 +15183,18 @@ class RedirectClient extends StandardInteractionClient {
                 requestExtraQueryParameters: validRequest.extraQueryParameters,
                 account: validRequest.account,
             });
+            const authCodeRequest = {
+                ...validRequest,
+                code: "",
+                codeVerifier: pkceCodes.verifier,
+            };
             // Create redirect interaction handler.
             const interactionHandler = new RedirectHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
             // Create acquire token url.
-            const navigateUrl = await authClient.getAuthCodeUrl({
+            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, validRequest.correlationId)(this.config, authClient.authority, {
                 ...validRequest,
                 platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme),
-            });
+            }, this.logger, this.performanceClient);
             const redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
             this.logger.verbosePii(`Redirect start page: ${redirectStartPage}`);
             // Clear temporary cache if the back button is clicked during the redirect flow.
@@ -15730,18 +15699,19 @@ class SilentIframeClient extends StandardInteractionClient {
      * @param navigateUrl
      * @param userRequestScopes
      */
-    async silentTokenHelper(authClient, silentRequest) {
-        const correlationId = silentRequest.correlationId;
+    async silentTokenHelper(authClient, request) {
+        const correlationId = request.correlationId;
         this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentIframeClientTokenHelper, correlationId);
-        // Create auth code request and generate PKCE params
-        const authCodeRequest = await invokeAsync(this.initializeAuthorizationCodeRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.logger, this.performanceClient, correlationId)(silentRequest);
+        const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId);
+        const silentRequest = {
+            ...request,
+            codeChallenge: pkceCodes.challenge,
+        };
         // Create authorize request url
-        const navigateUrl = await invokeAsync(authClient.getAuthCodeUrl.bind(authClient), PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)({
+        const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, {
             ...silentRequest,
             platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme),
-        });
-        // Create silent handler
-        const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
+        }, this.logger, this.performanceClient);
         // Get the frame handle for the silent request
         const msalFrame = await invokeAsync(initiateAuthRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
         const responseType = this.config.auth.OIDCOptions.serverResponseType;
@@ -15761,6 +15731,13 @@ class SilentIframeClient extends StandardInteractionClient {
                 prompt: silentRequest.prompt || PromptValue.NONE,
             });
         }
+        const authCodeRequest = {
+            ...silentRequest,
+            code: serverParams.code || "",
+            codeVerifier: pkceCodes.verifier,
+        };
+        // Create silent handler
+        const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
         // Handle response from hash string
         return invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, this.logger, this.performanceClient, correlationId)(serverParams, silentRequest);
     }
@@ -17514,8 +17491,7 @@ class NestedAppAuthAdapter {
             extraParams = new Map(Object.entries(request.extraQueryParameters));
         }
         const correlationId = request.correlationId || this.crypto.createNewGuid();
-        const requestBuilder = new RequestParameterBuilder(correlationId);
-        const claims = requestBuilder.addClientCapabilitiesToClaims(request.claims, this.clientCapabilities);
+        const claims = addClientCapabilitiesToClaims(request.claims, this.clientCapabilities);
         const scopes = request.scopes || OIDC_DEFAULT_SCOPES;
         const tokenRequest = {
             platformBrokerId: request.account?.homeAccountId,