@azure/msal-browser 5.6.2 → 5.7.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.6.2 2026-03-27 */
+/*! @azure/msal-browser v5.7.0 2026-04-16 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -238,7 +238,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -290,7 +290,7 @@
     const RESOURCE = "resource";
     const CLI_DATA = "clidata";
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -321,7 +321,7 @@
         return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -341,7 +341,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -421,7 +421,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -444,7 +444,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -498,7 +498,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -586,7 +586,7 @@
         userCanceled: userCanceled
     });
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -781,7 +781,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -902,18 +902,29 @@
         parameters.set(SID, sid);
     }
     /**
-     * add claims
-     * @param claims
-     */
-    function addClaims(parameters, claims, clientCapabilities) {
-        const mergedClaims = addClientCapabilitiesToClaims$1(claims, clientCapabilities);
-        try {
-            JSON.parse(mergedClaims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
+     * Adds claims to request parameters, conditionally excluding clientCapabilities
+     * when skipBrokerClaims is true and a brokered flow is in effect.
+     * @param parameters - The request parameters map
+     * @param claims - The claims string from the request
+     * @param clientCapabilities - The client capabilities from configuration
+     * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+     */
+    function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+        // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : clientCapabilities;
+        if (!StringUtils.isEmptyObj(claims) ||
+            (configClaims && configClaims.length > 0)) {
+            const mergedClaims = addClientCapabilitiesToClaims$1(claims, configClaims);
+            try {
+                JSON.parse(mergedClaims);
+            }
+            catch (e) {
+                throw createClientConfigurationError(invalidClaims);
+            }
+            parameters.set(CLAIMS, mergedClaims);
         }
-        parameters.set(CLAIMS, mergedClaims);
     }
     /**
      * add correlationId
@@ -1159,7 +1170,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1268,7 +1279,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1307,7 +1318,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1582,12 +1593,12 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "16.4.0";
+    const version$1 = "16.5.0";
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1607,7 +1618,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1689,7 +1700,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1769,7 +1780,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1926,7 +1937,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2083,7 +2094,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2091,7 +2102,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2129,7 +2140,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2167,7 +2178,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2182,7 +2193,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2204,7 +2215,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2228,7 +2239,7 @@
         EAR: "EAR",
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -2403,7 +2414,7 @@
             entity.hasOwnProperty("authorityType"));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3505,7 +3516,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3550,12 +3561,13 @@
         "currRefreshCount",
         "expiredCacheRemovedCount",
         "upgradedCacheCount",
+        "cacheMatchedAccounts",
         "networkRtt",
         "redirectBridgeTimeoutMs",
         "redirectBridgeMessageVersion",
     ]);
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3610,7 +3622,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3705,226 +3717,34 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Error thrown when there is an error with the server code, for example, unavailability.
-     */
-    class ServerError extends AuthError {
-        constructor(errorCode, errorMessage, subError, errorNo, status) {
-            super(errorCode, errorMessage, subError);
-            this.name = "ServerError";
-            this.errorNo = errorNo;
-            this.status = status;
-            Object.setPrototypeOf(this, ServerError.prototype);
-        }
-    }
-
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * MSAL-defined interaction required error code indicating no tokens are found in cache.
-     * @public
-     */
-    const noTokensFound = "no_tokens_found";
-    /**
-     * MSAL-defined error code indicating a native account is unavailable on the platform.
-     * @public
-     */
-    const nativeAccountUnavailable = "native_account_unavailable";
-    /**
-     * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
-     * @public
-     */
-    const refreshTokenExpired = "refresh_token_expired";
-    /**
-     * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
-     * @public
-     */
-    const uxNotAllowed = "ux_not_allowed";
-    /**
-     * Server-originated error code indicating interaction is required to complete the request.
-     * @public
-     */
-    const interactionRequired = "interaction_required";
-    /**
-     * Server-originated error code indicating user consent is required.
-     * @public
-     */
-    const consentRequired = "consent_required";
-    /**
-     * Server-originated error code indicating user login is required.
-     * @public
-     */
-    const loginRequired = "login_required";
-    /**
-     * Server-originated error code indicating the token is invalid or corrupted.
-     * @public
-     */
-    const badToken = "bad_token";
-    /**
-     * Server-originated error code indicating the user is in an interrupted state and interaction is required.
-     * @public
-     */
-    const interruptedUser = "interrupted_user";
-
-    var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
-        __proto__: null,
-        badToken: badToken,
-        consentRequired: consentRequired,
-        interactionRequired: interactionRequired,
-        interruptedUser: interruptedUser,
-        loginRequired: loginRequired,
-        nativeAccountUnavailable: nativeAccountUnavailable,
-        noTokensFound: noTokensFound,
-        refreshTokenExpired: refreshTokenExpired,
-        uxNotAllowed: uxNotAllowed
-    });
-
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
-     */
-    const InteractionRequiredServerErrorMessage = [
-        interactionRequired,
-        consentRequired,
-        loginRequired,
-        badToken,
-        uxNotAllowed,
-        interruptedUser,
-    ];
-    const InteractionRequiredAuthSubErrorMessage = [
-        "message_only",
-        "additional_action",
-        "basic_action",
-        "user_password_expired",
-        "consent_required",
-        "bad_token",
-        "ux_not_allowed",
-        "interrupted_user",
-    ];
-    /**
-     * Error thrown when user interaction is required.
-     */
-    class InteractionRequiredAuthError extends AuthError {
-        constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
-            super(errorCode, errorMessage, subError);
-            Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
-            this.timestamp = timestamp || "";
-            this.traceId = traceId || "";
-            this.correlationId = correlationId || "";
-            this.claims = claims || "";
-            this.name = "InteractionRequiredAuthError";
-            this.errorNo = errorNo;
-        }
-    }
-    /**
-     * Helper function used to determine if an error thrown by the server requires interaction to resolve
-     * @param errorCode
-     * @param errorString
-     * @param subError
-     */
-    function isInteractionRequiredError(errorCode, errorString, subError) {
-        const isInteractionRequiredErrorCode = !!errorCode &&
-            InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
-        const isInteractionRequiredSubError = !!subError &&
-            InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
-        const isInteractionRequiredErrorDesc = !!errorString &&
-            InteractionRequiredServerErrorMessage.some((irErrorCode) => {
-                return errorString.indexOf(irErrorCode) > -1;
-            });
-        return (isInteractionRequiredErrorCode ||
-            isInteractionRequiredErrorDesc ||
-            isInteractionRequiredSubError);
-    }
-    /**
-     * Creates an InteractionRequiredAuthError
-     */
-    function createInteractionRequiredAuthError(errorCode, errorMessage) {
-        return new InteractionRequiredAuthError(errorCode, errorMessage);
-    }
-
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
-
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     /**
-     * Appends user state with random guid, or returns random guid.
-     * @param cryptoObj
-     * @param userState
-     * @param meta
-     */
-    function setRequestState(cryptoObj, userState, meta) {
-        const libraryState = generateLibraryState(cryptoObj, meta);
-        return userState
-            ? `${libraryState}${RESOURCE_DELIM}${userState}`
-            : libraryState;
-    }
-    /**
-     * Generates the state value used by the common library.
-     * @param cryptoObj
-     * @param meta
-     */
-    function generateLibraryState(cryptoObj, meta) {
-        if (!cryptoObj) {
-            throw createClientAuthError(noCryptoObject);
-        }
-        // Create a state object containing a unique id and the timestamp of the request creation
-        const stateObj = {
-            id: cryptoObj.createNewGuid(),
-        };
-        if (meta) {
-            stateObj.meta = meta;
-        }
-        const stateString = JSON.stringify(stateObj);
-        return cryptoObj.base64Encode(stateString);
-    }
-    /**
-     * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
-     * @param base64Decode
-     * @param state
-     */
-    function parseRequestState(base64Decode, state) {
-        if (!base64Decode) {
-            throw createClientAuthError(noCryptoObject);
-        }
-        if (!state) {
-            throw createClientAuthError(invalidState);
+     * This class instance helps track the memory changes facilitating
+     * decisions to read from and write to the persistent cache
+     */ class TokenCacheContext {
+        constructor(tokenCache, hasChanged) {
+            this.cache = tokenCache;
+            this.hasChanged = hasChanged;
         }
-        try {
-            // Split the state between library state and user passed state and decode them separately
-            const splitState = state.split(RESOURCE_DELIM);
-            const libraryState = splitState[0];
-            const userState = splitState.length > 1
-                ? splitState.slice(1).join(RESOURCE_DELIM)
-                : "";
-            const libraryStateString = base64Decode(libraryState);
-            const libraryStateObj = JSON.parse(libraryStateString);
-            return {
-                userRequestState: userState || "",
-                libraryState: libraryStateObj,
-            };
+        /**
+         * boolean which indicates the changes in cache
+         */
+        get cacheHasChanged() {
+            return this.hasChanged;
         }
-        catch (e) {
-            throw createClientAuthError(invalidState);
+        /**
+         * function to retrieve the token cache
+         */
+        get tokenCache() {
+            return this.cache;
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3989,21 +3809,280 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     /**
-     * Time spent sending/waiting for the response of a request to the token endpoint
-     */
-    const NetworkClientSendPostRequestAsync = "networkClientSendPostRequestAsync";
-    const RefreshTokenClientExecutePostToTokenEndpoint = "refreshTokenClientExecutePostToTokenEndpoint";
-    const AuthorizationCodeClientExecutePostToTokenEndpoint = "authorizationCodeClientExecutePostToTokenEndpoint";
-    /**
-     * Time spent on the network for refresh token acquisition
+     * Create IdTokenEntity
+     * @param homeAccountId
+     * @param authenticationResult
+     * @param clientId
+     * @param authority
      */
-    const RefreshTokenClientExecuteTokenRequest = "refreshTokenClientExecuteTokenRequest";
+    function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
+        const idTokenEntity = {
+            credentialType: CredentialType.ID_TOKEN,
+            homeAccountId: homeAccountId,
+            environment: environment,
+            clientId: clientId,
+            secret: idToken,
+            realm: tenantId,
+            lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+        };
+        return idTokenEntity;
+    }
+    /**
+     * Create AccessTokenEntity
+     * @param homeAccountId
+     * @param environment
+     * @param accessToken
+     * @param clientId
+     * @param tenantId
+     * @param scopes
+     * @param expiresOn
+     * @param extExpiresOn
+     */
+    function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+        const atEntity = {
+            homeAccountId: homeAccountId,
+            credentialType: CredentialType.ACCESS_TOKEN,
+            secret: accessToken,
+            cachedAt: nowSeconds().toString(),
+            expiresOn: expiresOn.toString(),
+            extendedExpiresOn: extExpiresOn.toString(),
+            environment: environment,
+            clientId: clientId,
+            realm: tenantId,
+            target: scopes,
+            tokenType: tokenType || AuthenticationScheme$1.BEARER,
+            lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+        };
+        if (userAssertionHash) {
+            atEntity.userAssertionHash = userAssertionHash;
+        }
+        if (refreshOn) {
+            atEntity.refreshOn = refreshOn.toString();
+        }
+        /*
+         * Create Access Token With Auth Scheme instead of regular access token
+         * Cast to lower to handle "bearer" from ADFS
+         */
+        if (atEntity.tokenType?.toLowerCase() !==
+            AuthenticationScheme$1.BEARER.toLowerCase()) {
+            atEntity.credentialType =
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+            switch (atEntity.tokenType) {
+                case AuthenticationScheme$1.POP:
+                    // Make sure keyId is present and add it to credential
+                    const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                    if (!tokenClaims?.cnf?.kid) {
+                        throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                    }
+                    atEntity.keyId = tokenClaims.cnf.kid;
+                    break;
+                case AuthenticationScheme$1.SSH:
+                    atEntity.keyId = keyId;
+            }
+        }
+        return atEntity;
+    }
+    /**
+     * Create RefreshTokenEntity
+     * @param homeAccountId
+     * @param authenticationResult
+     * @param clientId
+     * @param authority
+     */
+    function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
+        const rtEntity = {
+            credentialType: CredentialType.REFRESH_TOKEN,
+            homeAccountId: homeAccountId,
+            environment: environment,
+            clientId: clientId,
+            secret: refreshToken,
+            lastUpdatedAt: Date.now().toString(),
+        };
+        if (userAssertionHash) {
+            rtEntity.userAssertionHash = userAssertionHash;
+        }
+        if (familyId) {
+            rtEntity.familyId = familyId;
+        }
+        if (expiresOn) {
+            rtEntity.expiresOn = expiresOn.toString();
+        }
+        return rtEntity;
+    }
+    function isCredentialEntity(entity) {
+        return (entity.hasOwnProperty("homeAccountId") &&
+            entity.hasOwnProperty("environment") &&
+            entity.hasOwnProperty("credentialType") &&
+            entity.hasOwnProperty("clientId") &&
+            entity.hasOwnProperty("secret"));
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    function isAccessTokenEntity(entity) {
+        if (!entity) {
+            return false;
+        }
+        return (isCredentialEntity(entity) &&
+            entity.hasOwnProperty("realm") &&
+            entity.hasOwnProperty("target") &&
+            (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
+                entity["credentialType"] ===
+                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    function isIdTokenEntity(entity) {
+        if (!entity) {
+            return false;
+        }
+        return (isCredentialEntity(entity) &&
+            entity.hasOwnProperty("realm") &&
+            entity["credentialType"] === CredentialType.ID_TOKEN);
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    function isRefreshTokenEntity(entity) {
+        if (!entity) {
+            return false;
+        }
+        return (isCredentialEntity(entity) &&
+            entity["credentialType"] === CredentialType.REFRESH_TOKEN);
+    }
+    /**
+     * validates if a given cache entry is "Telemetry", parses <key,value>
+     * @param key
+     * @param entity
+     */
+    function isServerTelemetryEntity(key, entity) {
+        const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
+        let validateEntity = true;
+        if (entity) {
+            validateEntity =
+                entity.hasOwnProperty("failedRequests") &&
+                    entity.hasOwnProperty("errors") &&
+                    entity.hasOwnProperty("cacheHits");
+        }
+        return validateKey && validateEntity;
+    }
+    /**
+     * validates if a given cache entry is "Throttling", parses <key,value>
+     * @param key
+     * @param entity
+     */
+    function isThrottlingEntity(key, entity) {
+        let validateKey = false;
+        if (key) {
+            validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
+        }
+        let validateEntity = true;
+        if (entity) {
+            validateEntity = entity.hasOwnProperty("throttleTime");
+        }
+        return validateKey && validateEntity;
+    }
+    /**
+     * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+     */
+    function generateAppMetadataKey({ environment, clientId, }) {
+        const appMetaDataKeyArray = [
+            APP_METADATA,
+            environment,
+            clientId,
+        ];
+        return appMetaDataKeyArray
+            .join(CACHE_KEY_SEPARATOR$1)
+            .toLowerCase();
+    }
+    /*
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    function isAppMetadataEntity(key, entity) {
+        if (!entity) {
+            return false;
+        }
+        return (key.indexOf(APP_METADATA) === 0 &&
+            entity.hasOwnProperty("clientId") &&
+            entity.hasOwnProperty("environment"));
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    function isAuthorityMetadataEntity(key, entity) {
+        if (!entity) {
+            return false;
+        }
+        return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
+            entity.hasOwnProperty("aliases") &&
+            entity.hasOwnProperty("preferred_cache") &&
+            entity.hasOwnProperty("preferred_network") &&
+            entity.hasOwnProperty("canonical_authority") &&
+            entity.hasOwnProperty("authorization_endpoint") &&
+            entity.hasOwnProperty("token_endpoint") &&
+            entity.hasOwnProperty("issuer") &&
+            entity.hasOwnProperty("aliasesFromNetwork") &&
+            entity.hasOwnProperty("endpointsFromNetwork") &&
+            entity.hasOwnProperty("expiresAt") &&
+            entity.hasOwnProperty("jwks_uri"));
+    }
+    /**
+     * Reset the exiresAt value
+     */
+    function generateAuthorityMetadataExpiresAt() {
+        return (nowSeconds() +
+            AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
+    }
+    function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
+        authorityMetadata.authorization_endpoint =
+            updatedValues.authorization_endpoint;
+        authorityMetadata.token_endpoint = updatedValues.token_endpoint;
+        authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
+        authorityMetadata.issuer = updatedValues.issuer;
+        authorityMetadata.endpointsFromNetwork = fromNetwork;
+        authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+    }
+    function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
+        authorityMetadata.aliases = updatedValues.aliases;
+        authorityMetadata.preferred_cache = updatedValues.preferred_cache;
+        authorityMetadata.preferred_network = updatedValues.preferred_network;
+        authorityMetadata.aliasesFromNetwork = fromNetwork;
+    }
+    /**
+     * Returns whether or not the data needs to be refreshed
+     */
+    function isAuthorityMetadataExpired(metadata) {
+        return metadata.expiresAt <= nowSeconds();
+    }
+
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Time spent sending/waiting for the response of a request to the token endpoint
+     */
+    const NetworkClientSendPostRequestAsync = "networkClientSendPostRequestAsync";
+    const RefreshTokenClientExecutePostToTokenEndpoint = "refreshTokenClientExecutePostToTokenEndpoint";
+    const AuthorizationCodeClientExecutePostToTokenEndpoint = "authorizationCodeClientExecutePostToTokenEndpoint";
+    /**
+     * Time spent on the network for refresh token acquisition
+     */
+    const RefreshTokenClientExecuteTokenRequest = "refreshTokenClientExecuteTokenRequest";
     /**
      * Time taken for acquiring refresh token , records RT size
      */
@@ -4060,7 +4139,7 @@
     const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
     const SetUserData = "setUserData";
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4153,7 +4232,7 @@
         };
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4233,293 +4312,226 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     /**
-     * This class instance helps track the memory changes facilitating
-     * decisions to read from and write to the persistent cache
-     */ class TokenCacheContext {
-        constructor(tokenCache, hasChanged) {
-            this.cache = tokenCache;
-            this.hasChanged = hasChanged;
-        }
-        /**
-         * boolean which indicates the changes in cache
-         */
-        get cacheHasChanged() {
-            return this.hasChanged;
-        }
-        /**
-         * function to retrieve the token cache
-         */
-        get tokenCache() {
-            return this.cache;
-        }
-    }
-
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
+     * MSAL-defined interaction required error code indicating no tokens are found in cache.
+     * @public
      */
+    const noTokensFound = "no_tokens_found";
     /**
-     * Create IdTokenEntity
-     * @param homeAccountId
-     * @param authenticationResult
-     * @param clientId
-     * @param authority
+     * MSAL-defined error code indicating a native account is unavailable on the platform.
+     * @public
      */
-    function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
-        const idTokenEntity = {
-            credentialType: CredentialType.ID_TOKEN,
-            homeAccountId: homeAccountId,
-            environment: environment,
-            clientId: clientId,
-            secret: idToken,
-            realm: tenantId,
-            lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-        };
-        return idTokenEntity;
-    }
+    const nativeAccountUnavailable = "native_account_unavailable";
     /**
-     * Create AccessTokenEntity
-     * @param homeAccountId
-     * @param environment
-     * @param accessToken
-     * @param clientId
-     * @param tenantId
-     * @param scopes
-     * @param expiresOn
-     * @param extExpiresOn
+     * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
+     * @public
      */
-    function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
-        const atEntity = {
-            homeAccountId: homeAccountId,
-            credentialType: CredentialType.ACCESS_TOKEN,
-            secret: accessToken,
-            cachedAt: nowSeconds().toString(),
-            expiresOn: expiresOn.toString(),
-            extendedExpiresOn: extExpiresOn.toString(),
-            environment: environment,
-            clientId: clientId,
-            realm: tenantId,
-            target: scopes,
-            tokenType: tokenType || AuthenticationScheme$1.BEARER,
-            lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-        };
-        if (userAssertionHash) {
-            atEntity.userAssertionHash = userAssertionHash;
-        }
-        if (refreshOn) {
-            atEntity.refreshOn = refreshOn.toString();
-        }
-        /*
-         * Create Access Token With Auth Scheme instead of regular access token
-         * Cast to lower to handle "bearer" from ADFS
-         */
-        if (atEntity.tokenType?.toLowerCase() !==
-            AuthenticationScheme$1.BEARER.toLowerCase()) {
-            atEntity.credentialType =
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-            switch (atEntity.tokenType) {
-                case AuthenticationScheme$1.POP:
-                    // Make sure keyId is present and add it to credential
-                    const tokenClaims = extractTokenClaims(accessToken, base64Decode);
-                    if (!tokenClaims?.cnf?.kid) {
-                        throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
-                    }
-                    atEntity.keyId = tokenClaims.cnf.kid;
-                    break;
-                case AuthenticationScheme$1.SSH:
-                    atEntity.keyId = keyId;
-            }
-        }
-        return atEntity;
-    }
+    const refreshTokenExpired = "refresh_token_expired";
     /**
-     * Create RefreshTokenEntity
-     * @param homeAccountId
-     * @param authenticationResult
-     * @param clientId
-     * @param authority
+     * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
+     * @public
      */
-    function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
-        const rtEntity = {
-            credentialType: CredentialType.REFRESH_TOKEN,
-            homeAccountId: homeAccountId,
-            environment: environment,
-            clientId: clientId,
-            secret: refreshToken,
-            lastUpdatedAt: Date.now().toString(),
-        };
-        if (userAssertionHash) {
-            rtEntity.userAssertionHash = userAssertionHash;
-        }
-        if (familyId) {
-            rtEntity.familyId = familyId;
-        }
-        if (expiresOn) {
-            rtEntity.expiresOn = expiresOn.toString();
-        }
-        return rtEntity;
-    }
-    function isCredentialEntity(entity) {
-        return (entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("credentialType") &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("secret"));
-    }
+    const uxNotAllowed = "ux_not_allowed";
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Server-originated error code indicating interaction is required to complete the request.
+     * @public
      */
-    function isAccessTokenEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (isCredentialEntity(entity) &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("target") &&
-            (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
-                entity["credentialType"] ===
-                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
-    }
+    const interactionRequired = "interaction_required";
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Server-originated error code indicating user consent is required.
+     * @public
      */
-    function isIdTokenEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (isCredentialEntity(entity) &&
-            entity.hasOwnProperty("realm") &&
-            entity["credentialType"] === CredentialType.ID_TOKEN);
-    }
+    const consentRequired = "consent_required";
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Server-originated error code indicating user login is required.
+     * @public
      */
-    function isRefreshTokenEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (isCredentialEntity(entity) &&
-            entity["credentialType"] === CredentialType.REFRESH_TOKEN);
-    }
+    const loginRequired = "login_required";
     /**
-     * validates if a given cache entry is "Telemetry", parses <key,value>
-     * @param key
-     * @param entity
+     * Server-originated error code indicating the token is invalid or corrupted.
+     * @public
      */
-    function isServerTelemetryEntity(key, entity) {
-        const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
-        let validateEntity = true;
-        if (entity) {
-            validateEntity =
-                entity.hasOwnProperty("failedRequests") &&
-                    entity.hasOwnProperty("errors") &&
-                    entity.hasOwnProperty("cacheHits");
-        }
-        return validateKey && validateEntity;
-    }
+    const badToken = "bad_token";
     /**
-     * validates if a given cache entry is "Throttling", parses <key,value>
-     * @param key
-     * @param entity
+     * Server-originated error code indicating the user is in an interrupted state and interaction is required.
+     * @public
      */
-    function isThrottlingEntity(key, entity) {
-        let validateKey = false;
-        if (key) {
-            validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
-        }
-        let validateEntity = true;
-        if (entity) {
-            validateEntity = entity.hasOwnProperty("throttleTime");
+    const interruptedUser = "interrupted_user";
+
+    var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
+        __proto__: null,
+        badToken: badToken,
+        consentRequired: consentRequired,
+        interactionRequired: interactionRequired,
+        interruptedUser: interruptedUser,
+        loginRequired: loginRequired,
+        nativeAccountUnavailable: nativeAccountUnavailable,
+        noTokensFound: noTokensFound,
+        refreshTokenExpired: refreshTokenExpired,
+        uxNotAllowed: uxNotAllowed
+    });
+
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
+     */
+    const InteractionRequiredServerErrorMessage = [
+        interactionRequired,
+        consentRequired,
+        loginRequired,
+        badToken,
+        uxNotAllowed,
+        interruptedUser,
+    ];
+    const InteractionRequiredAuthSubErrorMessage = [
+        "message_only",
+        "additional_action",
+        "basic_action",
+        "user_password_expired",
+        "consent_required",
+        "bad_token",
+        "ux_not_allowed",
+        "interrupted_user",
+    ];
+    /**
+     * Error thrown when user interaction is required.
+     */
+    class InteractionRequiredAuthError extends AuthError {
+        constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
+            super(errorCode, errorMessage, subError);
+            Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
+            this.timestamp = timestamp || "";
+            this.traceId = traceId || "";
+            this.correlationId = correlationId || "";
+            this.claims = claims || "";
+            this.name = "InteractionRequiredAuthError";
+            this.errorNo = errorNo;
         }
-        return validateKey && validateEntity;
     }
     /**
-     * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+     * Helper function used to determine if an error thrown by the server requires interaction to resolve
+     * @param errorCode
+     * @param errorString
+     * @param subError
      */
-    function generateAppMetadataKey({ environment, clientId, }) {
-        const appMetaDataKeyArray = [
-            APP_METADATA,
-            environment,
-            clientId,
-        ];
-        return appMetaDataKeyArray
-            .join(CACHE_KEY_SEPARATOR$1)
-            .toLowerCase();
+    function isInteractionRequiredError(errorCode, errorString, subError) {
+        const isInteractionRequiredErrorCode = !!errorCode &&
+            InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
+        const isInteractionRequiredSubError = !!subError &&
+            InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
+        const isInteractionRequiredErrorDesc = !!errorString &&
+            InteractionRequiredServerErrorMessage.some((irErrorCode) => {
+                return errorString.indexOf(irErrorCode) > -1;
+            });
+        return (isInteractionRequiredErrorCode ||
+            isInteractionRequiredErrorDesc ||
+            isInteractionRequiredSubError);
     }
+    /**
+     * Creates an InteractionRequiredAuthError
+     */
+    function createInteractionRequiredAuthError(errorCode, errorMessage) {
+        return new InteractionRequiredAuthError(errorCode, errorMessage);
+    }
+
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
+
     /*
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
      */
-    function isAppMetadataEntity(key, entity) {
-        if (!entity) {
-            return false;
-        }
-        return (key.indexOf(APP_METADATA) === 0 &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("environment"));
-    }
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Error thrown when there is an error with the server code, for example, unavailability.
      */
-    function isAuthorityMetadataEntity(key, entity) {
-        if (!entity) {
-            return false;
+    class ServerError extends AuthError {
+        constructor(errorCode, errorMessage, subError, errorNo, status) {
+            super(errorCode, errorMessage, subError);
+            this.name = "ServerError";
+            this.errorNo = errorNo;
+            this.status = status;
+            Object.setPrototypeOf(this, ServerError.prototype);
         }
-        return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
-            entity.hasOwnProperty("aliases") &&
-            entity.hasOwnProperty("preferred_cache") &&
-            entity.hasOwnProperty("preferred_network") &&
-            entity.hasOwnProperty("canonical_authority") &&
-            entity.hasOwnProperty("authorization_endpoint") &&
-            entity.hasOwnProperty("token_endpoint") &&
-            entity.hasOwnProperty("issuer") &&
-            entity.hasOwnProperty("aliasesFromNetwork") &&
-            entity.hasOwnProperty("endpointsFromNetwork") &&
-            entity.hasOwnProperty("expiresAt") &&
-            entity.hasOwnProperty("jwks_uri"));
-    }
+    }
+
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
     /**
-     * Reset the exiresAt value
+     * Appends user state with random guid, or returns random guid.
+     * @param cryptoObj
+     * @param userState
+     * @param meta
      */
-    function generateAuthorityMetadataExpiresAt() {
-        return (nowSeconds() +
-            AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
-    }
-    function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
-        authorityMetadata.authorization_endpoint =
-            updatedValues.authorization_endpoint;
-        authorityMetadata.token_endpoint = updatedValues.token_endpoint;
-        authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
-        authorityMetadata.issuer = updatedValues.issuer;
-        authorityMetadata.endpointsFromNetwork = fromNetwork;
-        authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+    function setRequestState(cryptoObj, userState, meta) {
+        const libraryState = generateLibraryState(cryptoObj, meta);
+        return userState
+            ? `${libraryState}${RESOURCE_DELIM}${userState}`
+            : libraryState;
     }
-    function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
-        authorityMetadata.aliases = updatedValues.aliases;
-        authorityMetadata.preferred_cache = updatedValues.preferred_cache;
-        authorityMetadata.preferred_network = updatedValues.preferred_network;
-        authorityMetadata.aliasesFromNetwork = fromNetwork;
+    /**
+     * Generates the state value used by the common library.
+     * @param cryptoObj
+     * @param meta
+     */
+    function generateLibraryState(cryptoObj, meta) {
+        if (!cryptoObj) {
+            throw createClientAuthError(noCryptoObject);
+        }
+        // Create a state object containing a unique id and the timestamp of the request creation
+        const stateObj = {
+            id: cryptoObj.createNewGuid(),
+        };
+        if (meta) {
+            stateObj.meta = meta;
+        }
+        const stateString = JSON.stringify(stateObj);
+        return cryptoObj.base64Encode(stateString);
     }
     /**
-     * Returns whether or not the data needs to be refreshed
+     * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
+     * @param base64Decode
+     * @param state
      */
-    function isAuthorityMetadataExpired(metadata) {
-        return metadata.expiresAt <= nowSeconds();
+    function parseRequestState(base64Decode, state) {
+        if (!base64Decode) {
+            throw createClientAuthError(noCryptoObject);
+        }
+        if (!state) {
+            throw createClientAuthError(invalidState);
+        }
+        try {
+            // Split the state between library state and user passed state and decode them separately
+            const splitState = state.split(RESOURCE_DELIM);
+            const libraryState = splitState[0];
+            const userState = splitState.length > 1
+                ? splitState.slice(1).join(RESOURCE_DELIM)
+                : "";
+            const libraryStateString = base64Decode(libraryState);
+            const libraryStateObj = JSON.parse(libraryStateString);
+            return {
+                userRequestState: userState || "",
+                libraryState: libraryStateObj,
+            };
+        }
+        catch (e) {
+            throw createClientAuthError(invalidState);
+        }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4675,7 +4687,7 @@
             if (serverTokenResponse.id_token && !!idTokenClaims) {
                 cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
                 cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
-                this.logger);
+                this.logger, this.performanceClient);
             }
             // AccessToken
             let cachedAccessToken = null;
@@ -4826,17 +4838,24 @@
             };
         }
     }
-    function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+    function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
         logger?.verbose("09jz0t", correlationId);
-        // Check if base account is already cached
-        const accountKeys = cacheStorage.getAccountKeys();
-        const baseAccountKey = accountKeys.find((accountKey) => {
-            return accountKey.startsWith(homeAccountId);
-        });
-        let cachedAccount = null;
-        if (baseAccountKey) {
-            cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId);
+        /*
+         * Check if base account is already cached. Filter by homeAccountId (identifies
+         * the user's home identity) and environment (identifies the cloud) — the two
+         * tenant-agnostic properties that uniquely locate a base AccountEntity.
+         */
+        const accountEnvironment = environment || authority.getPreferredCache();
+        const matchedAccounts = cacheStorage.getAccountsFilteredBy({ homeAccountId, environment: accountEnvironment }, correlationId);
+        performanceClient?.addFields({ cacheMatchedAccounts: matchedAccounts.length }, correlationId);
+        if (matchedAccounts.length > 1) {
+            /*
+             * Base accounts are expected to be unique for a given homeAccountId in normal cache usage.
+             * If multiple matches exist, ignore the cache hit rather than arbitrarily choosing one.
+             */
+            logger?.warning("0x7ad1", correlationId);
         }
+        const cachedAccount = matchedAccounts.length === 1 ? matchedAccounts[0] : null;
         const baseAccount = cachedAccount ||
             createAccountEntity({
                 homeAccountId,
@@ -4860,7 +4879,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4870,7 +4889,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4888,7 +4907,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4909,7 +4928,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4995,7 +5014,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5026,7 +5045,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5140,7 +5159,7 @@
         return response;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5152,7 +5171,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5162,7 +5181,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5172,7 +5191,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5277,7 +5296,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6097,7 +6116,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6131,7 +6150,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6296,11 +6315,6 @@
                     throw createClientConfigurationError(missingSshJwk);
                 }
             }
-            if (!StringUtils.isEmptyObj(request.claims) ||
-                (this.config.authOptions.clientCapabilities &&
-                    this.config.authOptions.clientCapabilities.length > 0)) {
-                addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-            }
             let ccsCred = undefined;
             if (request.clientInfo) {
                 try {
@@ -6349,6 +6363,7 @@
                 });
             }
             instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
             return mapToQueryString(parameters);
         }
         /**
@@ -6392,7 +6407,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6582,11 +6597,6 @@
                     throw createClientConfigurationError(missingSshJwk);
                 }
             }
-            if (!StringUtils.isEmptyObj(request.claims) ||
-                (this.config.authOptions.clientCapabilities &&
-                    this.config.authOptions.clientCapabilities.length > 0)) {
-                addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-            }
             if (this.config.systemOptions.preventCorsPreflight &&
                 request.ccsCredential) {
                 switch (request.ccsCredential.type) {
@@ -6613,11 +6623,12 @@
                 });
             }
             instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
             return mapToQueryString(parameters);
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6733,7 +6744,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6748,7 +6759,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6872,14 +6883,10 @@
         if (request.state) {
             addState(parameters, request.state);
         }
-        if (request.claims ||
-            (authOptions.clientCapabilities &&
-                authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, authOptions.clientCapabilities);
-        }
         if (request.embeddedClientId) {
             addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
         }
+        addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
         // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
         if (authOptions.instanceAware &&
             (!request.extraQueryParameters ||
@@ -6975,7 +6982,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7008,7 +7015,7 @@
         return Object.prototype.hasOwnProperty.call(params, "resource");
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7066,7 +7073,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7083,7 +7090,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7344,7 +7351,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7365,7 +7372,7 @@
         return new JoseHeaderError(code);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7373,7 +7380,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7413,7 +7420,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-27 */
+    /*! @azure/msal-common v16.5.0 2026-04-16 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7943,6 +7950,137 @@
         }
     }
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * acquireTokenFromCache (msal-browser).
+     * Internal API for acquiring token from cache
+     */
+    const AcquireTokenFromCache = "acquireTokenFromCache";
+    /**
+     * acquireTokenByRefreshToken API (msal-browser and msal-node).
+     * Used to renew an access token using a refresh token against the token endpoint.
+     */
+    const AcquireTokenByRefreshToken = "acquireTokenByRefreshToken";
+    /**
+     * acquireTokenSilentAsync (msal-browser).
+     * Internal API for acquireTokenSilent.
+     */
+    const AcquireTokenSilentAsync = "acquireTokenSilentAsync";
+    /**
+     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
+     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
+     */
+    const CryptoOptsGetPublicKeyThumbprint = "cryptoOptsGetPublicKeyThumbprint";
+    /**
+     * signJwt API in CryptoOpts class (msal-browser).
+     * Used to signed a pop token.
+     */
+    const CryptoOptsSignJwt = "cryptoOptsSignJwt";
+    /**
+     * acquireToken API in the SilentCacheClient class (msal-browser).
+     * Used to read access tokens from the cache.
+     */
+    const SilentCacheClientAcquireToken = "silentCacheClientAcquireToken";
+    /**
+     * acquireToken API in the SilentIframeClient class (msal-browser).
+     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
+     */
+    const SilentIframeClientAcquireToken = "silentIframeClientAcquireToken";
+    const AwaitConcurrentIframe = "awaitConcurrentIframe"; // Time spent waiting for a concurrent iframe to complete
+    /**
+     * acquireToken API in SilentRereshClient (msal-browser).
+     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
+     */
+    const SilentRefreshClientAcquireToken = "silentRefreshClientAcquireToken";
+    /**
+     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
+     * Used to load authority metadata for a request.
+     */
+    const StandardInteractionClientGetDiscoveredAuthority = "standardInteractionClientGetDiscoveredAuthority";
+    /**
+     * acquireToken API in NativeInteractionClient class (msal-browser).
+     * Used to acquire a token from Native component when native brokering is enabled.
+     */
+    const NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
+    const NativeInteractionClientAcquireTokenRedirect = "nativeInteractionClientAcquireToken";
+    /**
+     * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
+     */
+    const RefreshTokenClientAcquireTokenByRefreshToken = "refreshTokenClientAcquireTokenByRefreshToken";
+    /**
+     * acquireTokenBySilentIframe (msal-browser).
+     * Internal API for acquiring token by silent Iframe
+     */
+    const AcquireTokenBySilentIframe = "acquireTokenBySilentIframe";
+    /**
+     * Internal API for initializing base request in BaseInteractionClient (msal-browser)
+     */
+    const InitializeBaseRequest = "initializeBaseRequest";
+    /**
+     * Internal API for initializing silent request in SilentCacheClient (msal-browser)
+     */
+    const InitializeSilentRequest = "initializeSilentRequest";
+    const InitializeCache = "initializeCache";
+    /**
+     * Helper function in SilentIframeClient class (msal-browser).
+     */
+    const SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
+    /**
+     * SilentHandler
+     */
+    const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
+    const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
+    const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
+    /**
+     * Helper functions in StandardInteractionClient class (msal-browser)
+     */
+    const StandardInteractionClientCreateAuthCodeClient = "standardInteractionClientCreateAuthCodeClient";
+    const StandardInteractionClientGetClientConfiguration = "standardInteractionClientGetClientConfiguration";
+    const StandardInteractionClientInitializeAuthorizationRequest = "standardInteractionClientInitializeAuthorizationRequest";
+    const SilentFlowClientAcquireCachedToken = "silentFlowClientAcquireCachedToken";
+    const GetStandardParams = "getStandardParams";
+    const HandleCodeResponse = "handleCodeResponse";
+    const HandleResponseEar = "handleResponseEar";
+    const HandleResponsePlatformBroker = "handleResponsePlatformBroker";
+    const HandleResponseCode = "handleResponseCode";
+    const AuthClientAcquireToken = "authClientAcquireToken";
+    const DeserializeResponse = "deserializeResponse";
+    const AuthorityFactoryCreateDiscoveredInstance = "authorityFactoryCreateDiscoveredInstance";
+    const AcquireTokenByCodeAsync = "acquireTokenByCodeAsync";
+    const HandleRedirectPromiseMeasurement = "handleRedirectPromise";
+    const HandleNativeRedirectPromiseMeasurement = "handleNativeRedirectPromise";
+    const NativeMessageHandlerHandshake = "nativeMessageHandlerHandshake";
+    const RemoveHiddenIframe = "removeHiddenIframe";
+    const ImportExistingCache = "importExistingCache";
+    /**
+     * Crypto Operations
+     */
+    const GeneratePkceCodes = "generatePkceCodes";
+    const GenerateCodeVerifier = "generateCodeVerifier";
+    const GenerateCodeChallengeFromVerifier = "generateCodeChallengeFromVerifier";
+    const Sha256Digest = "sha256Digest";
+    const GetRandomValues = "getRandomValues";
+    const GenerateHKDF = "generateHKDF";
+    const GenerateBaseKey = "generateBaseKey";
+    const Base64Decode = "base64Decode";
+    const UrlEncodeArr = "urlEncodeArr";
+    const Encrypt = "encrypt";
+    const Decrypt = "decrypt";
+    const GenerateEarKey = "generateEarKey";
+    const DecryptEarResponse = "decryptEarResponse";
+    const LoadAccount = "loadAccount";
+    const LoadIdToken = "loadIdToken";
+    const LoadAccessToken = "loadAccessToken";
+    const LoadRefreshToken = "loadRefreshToken";
+    /**
+     * Background telemetry measurement that tracks whether a late bridge response
+     * arrives after the iframe timeout has already fired.
+     */
+    const WaitForBridgeLateResponse$1 = "waitForBridgeLateResponse";
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8849,20 +8987,35 @@
             activeBridgeMonitor = null;
         }
     }
-    async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient) {
+    async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient, experimentalConfig) {
         return new Promise((resolve, reject) => {
             logger.verbose("1rf6em", request.correlationId);
             const correlationId = request.correlationId;
             performanceClient.addFields({
                 redirectBridgeTimeoutMs: timeoutMs,
+                lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false,
             }, correlationId);
             const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
             const channel = new BroadcastChannel(libraryState.id);
             let responseString = undefined;
+            let timedOut$1 = false;
+            let lateTimeoutId;
+            let lateMeasurement;
             const timeoutId = window.setTimeout(() => {
                 // Clear the active monitor
                 activeBridgeMonitor = null;
-                channel.close();
+                if (experimentalConfig?.iframeTimeoutTelemetry) {
+                    lateMeasurement = performanceClient.startMeasurement(WaitForBridgeLateResponse$1, correlationId);
+                    timedOut$1 = true;
+                    lateTimeoutId = window.setTimeout(() => {
+                        lateMeasurement?.end({ success: false });
+                        clearTimeout(lateTimeoutId);
+                        channel.close();
+                    }, 60000); // 60s late response timeout to allow for telemetry of late responses
+                }
+                else {
+                    channel.close();
+                }
                 reject(createBrowserAuthError(timedOut, "redirect_bridge_timeout"));
             }, timeoutMs);
             // Track this monitor so it can be cancelled if needed
@@ -8876,6 +9029,14 @@
                 const messageVersion = event?.data && typeof event.data.v === "number"
                     ? event.data.v
                     : undefined;
+                if (timedOut$1) {
+                    lateMeasurement?.end({
+                        success: responseString ? true : false,
+                    });
+                    clearTimeout(lateTimeoutId);
+                    channel.close();
+                    return;
+                }
                 performanceClient.addFields({
                     redirectBridgeMessageVersion: messageVersion,
                 }, correlationId);
@@ -9038,131 +9199,6 @@
         waitForBridgeResponse: waitForBridgeResponse
     });
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * acquireTokenFromCache (msal-browser).
-     * Internal API for acquiring token from cache
-     */
-    const AcquireTokenFromCache = "acquireTokenFromCache";
-    /**
-     * acquireTokenByRefreshToken API (msal-browser and msal-node).
-     * Used to renew an access token using a refresh token against the token endpoint.
-     */
-    const AcquireTokenByRefreshToken = "acquireTokenByRefreshToken";
-    /**
-     * acquireTokenSilentAsync (msal-browser).
-     * Internal API for acquireTokenSilent.
-     */
-    const AcquireTokenSilentAsync = "acquireTokenSilentAsync";
-    /**
-     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
-     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
-     */
-    const CryptoOptsGetPublicKeyThumbprint = "cryptoOptsGetPublicKeyThumbprint";
-    /**
-     * signJwt API in CryptoOpts class (msal-browser).
-     * Used to signed a pop token.
-     */
-    const CryptoOptsSignJwt = "cryptoOptsSignJwt";
-    /**
-     * acquireToken API in the SilentCacheClient class (msal-browser).
-     * Used to read access tokens from the cache.
-     */
-    const SilentCacheClientAcquireToken = "silentCacheClientAcquireToken";
-    /**
-     * acquireToken API in the SilentIframeClient class (msal-browser).
-     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
-     */
-    const SilentIframeClientAcquireToken = "silentIframeClientAcquireToken";
-    const AwaitConcurrentIframe = "awaitConcurrentIframe"; // Time spent waiting for a concurrent iframe to complete
-    /**
-     * acquireToken API in SilentRereshClient (msal-browser).
-     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
-     */
-    const SilentRefreshClientAcquireToken = "silentRefreshClientAcquireToken";
-    /**
-     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
-     * Used to load authority metadata for a request.
-     */
-    const StandardInteractionClientGetDiscoveredAuthority = "standardInteractionClientGetDiscoveredAuthority";
-    /**
-     * acquireToken API in NativeInteractionClient class (msal-browser).
-     * Used to acquire a token from Native component when native brokering is enabled.
-     */
-    const NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
-    /**
-     * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
-     */
-    const RefreshTokenClientAcquireTokenByRefreshToken = "refreshTokenClientAcquireTokenByRefreshToken";
-    /**
-     * acquireTokenBySilentIframe (msal-browser).
-     * Internal API for acquiring token by silent Iframe
-     */
-    const AcquireTokenBySilentIframe = "acquireTokenBySilentIframe";
-    /**
-     * Internal API for initializing base request in BaseInteractionClient (msal-browser)
-     */
-    const InitializeBaseRequest = "initializeBaseRequest";
-    /**
-     * Internal API for initializing silent request in SilentCacheClient (msal-browser)
-     */
-    const InitializeSilentRequest = "initializeSilentRequest";
-    const InitializeCache = "initializeCache";
-    /**
-     * Helper function in SilentIframeClient class (msal-browser).
-     */
-    const SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
-    /**
-     * SilentHandler
-     */
-    const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
-    const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
-    const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
-    /**
-     * Helper functions in StandardInteractionClient class (msal-browser)
-     */
-    const StandardInteractionClientCreateAuthCodeClient = "standardInteractionClientCreateAuthCodeClient";
-    const StandardInteractionClientGetClientConfiguration = "standardInteractionClientGetClientConfiguration";
-    const StandardInteractionClientInitializeAuthorizationRequest = "standardInteractionClientInitializeAuthorizationRequest";
-    const SilentFlowClientAcquireCachedToken = "silentFlowClientAcquireCachedToken";
-    const GetStandardParams = "getStandardParams";
-    const HandleCodeResponse = "handleCodeResponse";
-    const HandleResponseEar = "handleResponseEar";
-    const HandleResponsePlatformBroker = "handleResponsePlatformBroker";
-    const HandleResponseCode = "handleResponseCode";
-    const AuthClientAcquireToken = "authClientAcquireToken";
-    const DeserializeResponse = "deserializeResponse";
-    const AuthorityFactoryCreateDiscoveredInstance = "authorityFactoryCreateDiscoveredInstance";
-    const AcquireTokenByCodeAsync = "acquireTokenByCodeAsync";
-    const HandleRedirectPromiseMeasurement = "handleRedirectPromise";
-    const HandleNativeRedirectPromiseMeasurement = "handleNativeRedirectPromise";
-    const NativeMessageHandlerHandshake = "nativeMessageHandlerHandshake";
-    const RemoveHiddenIframe = "removeHiddenIframe";
-    const ImportExistingCache = "importExistingCache";
-    /**
-     * Crypto Operations
-     */
-    const GeneratePkceCodes = "generatePkceCodes";
-    const GenerateCodeVerifier = "generateCodeVerifier";
-    const GenerateCodeChallengeFromVerifier = "generateCodeChallengeFromVerifier";
-    const Sha256Digest = "sha256Digest";
-    const GetRandomValues = "getRandomValues";
-    const GenerateHKDF = "generateHKDF";
-    const GenerateBaseKey = "generateBaseKey";
-    const Base64Decode = "base64Decode";
-    const UrlEncodeArr = "urlEncodeArr";
-    const Encrypt = "encrypt";
-    const Decrypt = "decrypt";
-    const GenerateEarKey = "generateEarKey";
-    const DecryptEarResponse = "decryptEarResponse";
-    const LoadAccount = "loadAccount";
-    const LoadIdToken = "loadIdToken";
-    const LoadAccessToken = "loadAccessToken";
-    const LoadRefreshToken = "loadRefreshToken";
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -9770,7 +9806,14 @@
     // Update cache storage
     const LocalStorageUpdated = "localStorageUpdated";
     // Load external tokens
-    const LoadExternalTokens = "loadExternalTokens";
+    const LoadExternalTokens = "loadExternalTokens";
+    /**
+     * SSO capability verification call (msal-browser).
+     * Fire-and-forget SSO verification call made after interactive authentication completes.
+     */
+    const SsoCapable = "ssoCapable";
+    // Wait for late response from bridge after timeout has already occurred
+    const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
 
     var BrowserRootPerformanceEvents = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -9782,7 +9825,9 @@
         InitializeClientApplication: InitializeClientApplication,
         LoadExternalTokens: LoadExternalTokens,
         LocalStorageUpdated: LocalStorageUpdated,
-        SsoSilent: SsoSilent
+        SsoCapable: SsoCapable,
+        SsoSilent: SsoSilent,
+        WaitForBridgeLateResponse: WaitForBridgeLateResponse
     });
 
     /*
@@ -9801,6 +9846,7 @@
     const VERSION_CACHE_KEY = `${PREFIX}.version`;
     const ACCOUNT_KEYS = "account.keys";
     const TOKEN_KEYS = "token.keys";
+    const SSO_CAPABLE = `${PREFIX}.${BROWSER_PREFIX}.sso.capable`;
     function getAccountKeysCacheKey(schema = ACCOUNT_SCHEMA_VERSION) {
         if (schema < 1) {
             return `${PREFIX}.${ACCOUNT_KEYS}`;
@@ -10299,7 +10345,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "5.6.2";
+    const version = "5.7.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12402,7 +12448,6 @@
     const USER_INTERACTION_REQUIRED = "USER_INTERACTION_REQUIRED";
     const USER_CANCEL = "USER_CANCEL";
     const NO_NETWORK = "NO_NETWORK";
-    const PERSISTENT_ERROR = "PERSISTENT_ERROR";
     const DISABLED = "DISABLED";
     const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
     const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
@@ -12426,8 +12471,7 @@
     function isFatalNativeAuthError(error) {
         if (error.ext &&
             error.ext.status &&
-            (error.ext.status === PERSISTENT_ERROR ||
-                error.ext.status === DISABLED)) {
+            error.ext.status === DISABLED) {
             return true;
         }
         if (error.ext &&
@@ -12553,12 +12597,12 @@
         async acquireToken(request, cacheLookupPolicy) {
             this.logger.trace("03qeos", this.correlationId);
             // start the perf measurement
-            const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, request.correlationId);
+            const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
             const reqTimestamp = nowSeconds();
             const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
             try {
                 // initialize native request
-                const nativeRequest = await this.initializeNativeRequest(request);
+                const nativeRequest = await this.initializePlatformRequest(request);
                 // check if the tokens can be retrieved from internal cache
                 try {
                     const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
@@ -12572,6 +12616,10 @@
                 catch (e) {
                     if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
                         this.logger.info("0eitbc", this.correlationId);
+                        nativeATMeasurement.end({
+                            success: false,
+                            brokerErrorCode: "cache_request_failed",
+                        });
                         throw e;
                     }
                     // continue with a native call for any and all errors
@@ -12593,7 +12641,6 @@
                         success: false,
                         errorCode: error.errorCode,
                         subErrorCode: error.subError,
-                        isNativeBroker: true,
                     });
                     throw error;
                 });
@@ -12602,6 +12649,9 @@
                 if (e instanceof NativeAuthError) {
                     serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                 }
+                nativeATMeasurement.end({
+                    success: false,
+                });
                 throw e;
             }
         }
@@ -12634,7 +12684,7 @@
             // fetch the account from browser cache
             const account = this.browserStorage.getBaseAccountInfo({
                 nativeAccountId,
-            }, request.correlationId);
+            }, this.correlationId);
             if (!account) {
                 throw createClientAuthError(noAccountFound);
             }
@@ -12664,7 +12714,7 @@
          */
         async acquireTokenRedirect(request, rootMeasurement, options) {
             this.logger.trace("0luikq", this.correlationId);
-            const nativeRequest = await this.initializeNativeRequest(request);
+            const nativeRequest = await this.initializePlatformRequest(request);
             const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
             try {
                 await this.platformAuthProvider.sendMessage(nativeRequest);
@@ -12696,7 +12746,7 @@
          * @param performanceClient {IPerformanceClient?}
          * @param correlationId {string?} correlation identifier
          */
-        async handleRedirectPromise(performanceClient, correlationId) {
+        async handleRedirectPromise() {
             this.logger.trace("1c5lhw", this.correlationId);
             if (!this.browserStorage.isInteractionInProgress(true)) {
                 this.logger.info("0le6uv", this.correlationId);
@@ -12706,9 +12756,7 @@
             const cachedRequest = this.browserStorage.getCachedNativeRequest();
             if (!cachedRequest) {
                 this.logger.verbose("0a6zjb", this.correlationId);
-                if (performanceClient && correlationId) {
-                    performanceClient?.addFields({ errorCode: "no_cached_request" }, correlationId);
-                }
+                this.performanceClient?.addFields({ errorCode: "no_cached_request" }, this.correlationId);
                 return null;
             }
             const { prompt, ...request } = cachedRequest;
@@ -12723,6 +12771,7 @@
                 const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
                 const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
                 serverTelemetryManager.clearNativeBrokerErrorCode();
+                this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
                 return authResult;
             }
             catch (e) {
@@ -12763,9 +12812,9 @@
             }
             // Get the preferred_cache domain for the given authority
             const authority = await getDiscoveredAuthority(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, request.authority);
-            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, undefined, // environment
+            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, authority.getPreferredCache(), // environment
             idTokenClaims.tid, undefined, // auth code payload
-            response.account.id);
+            response.account.id, this.logger, this.performanceClient);
             // Ensure expires_in is in number format
             response.expires_in = Number(response.expires_in);
             // generate authenticationResult
@@ -12991,15 +13040,23 @@
          * Translates developer provided request object into NativeRequest object
          * @param request
          */
-        async initializeNativeRequest(request) {
-            this.logger.trace("04j6wj", this.correlationId);
+        async initializePlatformRequest(request) {
+            this.logger.trace("1xdm2a", this.correlationId);
             const canonicalAuthority = await this.getCanonicalAuthority(request);
+            // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+            const configClaims = request.skipBrokerClaims && !!request.embeddedClientId
+                ? undefined
+                : this.config.auth.clientCapabilities;
             // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
-            const { scopes, ...remainingProperties } = request;
+            const { scopes, claims, ...remainingProperties } = request;
             const scopeSet = new ScopeSet(scopes || []);
             scopeSet.appendScopes(OIDC_DEFAULT_SCOPES$1);
+            const mergedClaims = configClaims && configClaims.length
+                ? addClientCapabilitiesToClaims$1(claims, configClaims)
+                : claims;
             const validatedRequest = {
                 ...remainingProperties,
+                claims: mergedClaims,
                 accountId: this.accountId,
                 clientId: this.config.auth.clientId,
                 authority: canonicalAuthority.urlString,
@@ -13069,12 +13126,12 @@
             switch (this.apiId) {
                 case ApiId.ssoSilent:
                 case ApiId.acquireTokenSilent_silentFlow:
-                    this.logger.trace("1hiwaz", this.correlationId);
+                    this.logger.trace("12n1y2", this.correlationId);
                     return PromptValue$1.NONE;
             }
             // Prompt not provided, request may proceed and native broker decides if it needs to prompt
             if (!prompt) {
-                this.logger.trace("1qlu04", this.correlationId);
+                this.logger.trace("0uid1p", this.correlationId);
                 return undefined;
             }
             // If request is interactive, check if prompt provided is allowed to go directly to native broker
@@ -13082,10 +13139,10 @@
                 case PromptValue$1.NONE:
                 case PromptValue$1.CONSENT:
                 case PromptValue$1.LOGIN:
-                    this.logger.trace("1ynje4", this.correlationId);
+                    this.logger.trace("0i0hco", this.correlationId);
                     return prompt;
                 default:
-                    this.logger.trace("0nkr6q", this.correlationId);
+                    this.logger.trace("0w3tpw", this.correlationId);
                     throw createBrowserAuthError(nativePromptNotSupported);
             }
         }
@@ -13121,7 +13178,7 @@
             this.performanceClient?.addFields({
                 embeddedClientId: child_client_id,
                 embeddedRedirectUri: child_redirect_uri,
-            }, request.correlationId);
+            }, this.correlationId);
         }
     }
 
@@ -13208,6 +13265,10 @@
         if (request.platformBroker) {
             // signal ests that this is a WAM call
             addNativeBroker(parameters);
+            // instrument JS-platform bridge specific fields
+            performanceClient.addFields({
+                isPlatformAuthorizeRequest: true,
+            }, request.correlationId);
             // pass the req_cnf for POP
             if (request.authenticationScheme === AuthenticationScheme$1.POP) {
                 const cryptoOps = new CryptoOps(logger, performanceClient);
@@ -13650,7 +13711,7 @@
      *
      * @returns Configuration object
      */
-    function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system: userInputSystem, telemetry: userInputTelemetry, }, isBrowserEnvironment) {
+    function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system: userInputSystem, experimental: userInputExperimental, telemetry: userInputTelemetry, }, isBrowserEnvironment) {
         // Default auth options for browser
         const DEFAULT_AUTH_OPTIONS = {
             clientId: "",
@@ -13677,6 +13738,7 @@
             },
             instanceAware: false,
             isMcp: false,
+            verifySSO: false,
         };
         // Default cache options for browser
         const DEFAULT_CACHE_OPTIONS = {
@@ -13722,6 +13784,9 @@
             },
             client: new StubPerformanceClient(),
         };
+        const DEFAULT_EXPERIMENTAL_OPTIONS = {
+            iframeTimeoutTelemetry: false,
+        };
         // Throw an error if user has set OIDCOptions without being in OIDC protocol mode
         if (userInputSystem?.protocolMode !== ProtocolMode.OIDC &&
             userInputAuth?.OIDCOptions) {
@@ -13745,6 +13810,10 @@
             },
             cache: { ...DEFAULT_CACHE_OPTIONS, ...userInputCache },
             system: providedSystemOptions,
+            experimental: {
+                ...DEFAULT_EXPERIMENTAL_OPTIONS,
+                ...userInputExperimental,
+            },
             telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...userInputTelemetry },
         };
         return overlayedConfig;
@@ -14222,7 +14291,7 @@
         }
     }
     /**
-     * Returns boolean indicating whether or not the request should attempt to use native broker
+     * Returns boolean indicating whether or not the request should attempt to use platform broker
      * @param logger
      * @param config
      * @param correlationId
@@ -14504,6 +14573,10 @@
                         return;
                     }
                 }
+                // Redirect bridge requires "state" param to work properly
+                validRequest.state = setRequestState(this.browserCrypto, validRequest.state || "", {
+                    interactionType: exports.InteractionType.Popup,
+                });
                 // Create logout string and navigate user window to logout.
                 const logoutUri = authClient.getLogoutUri(validRequest);
                 this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, validRequest.correlationId, exports.InteractionType.Popup, validRequest);
@@ -15044,6 +15117,10 @@
                         }
                     }
                 }
+                // Redirect bridge requires "state" param to work properly
+                validLogoutRequest.state = setRequestState(this.browserCrypto, validLogoutRequest.state || "", {
+                    interactionType: exports.InteractionType.Redirect,
+                });
                 // Create logout string and navigate user window to logout.
                 const logoutUri = authClient.getLogoutUri(validLogoutRequest);
                 if (validLogoutRequest.account?.homeAccountId) {
@@ -15270,7 +15347,7 @@
             const responseType = this.config.auth.OIDCOptions.responseMode;
             let responseString;
             try {
-                responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+                responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
             }
             finally {
                 invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -15292,6 +15369,38 @@
                 return invokeAsync(handleResponseEAR, HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
             }
         }
+        /**
+         * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+         * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+         * @param request - The SSO silent request
+         * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+         */
+        async verifySso(request) {
+            const inputRequest = { ...request };
+            if (!inputRequest.prompt) {
+                inputRequest.prompt = PromptValue$1.NONE;
+            }
+            // Create silent request
+            const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, exports.InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
+            const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
+                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger),
+                requestAuthority: silentRequest.authority,
+                requestAzureCloudOptions: silentRequest.azureCloudOptions,
+                requestExtraQueryParameters: silentRequest.extraQueryParameters,
+                account: silentRequest.account,
+            });
+            const { serverParams } = await this.silentAuthorizeHelper(authClient, silentRequest);
+            const correlationId = silentRequest.correlationId;
+            // Validate the response - this checks for errors and validates state
+            validateAuthorizationResponse(serverParams, silentRequest.state);
+            // Verify a valid authorization code is present
+            if (!serverParams.code) {
+                this.logger.warning("0y34ti", correlationId);
+                return false;
+            }
+            this.logger.verbose("0kkkcj", correlationId);
+            return true;
+        }
         /**
          * Currently Unsupported
          */
@@ -15306,6 +15415,16 @@
          * @param userRequestScopes
          */
         async silentTokenHelper(authClient, request) {
+            const { serverParams, pkceCodes } = await this.silentAuthorizeHelper(authClient, request);
+            return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, request.correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        }
+        /**
+         * Shared helper that generates PKCE codes, builds the /authorize URL,
+         * loads it in a hidden iframe, waits for the redirect-bridge response,
+         * and returns the deserialized server parameters along with the PKCE codes
+         * and the request that was sent.
+         */
+        async silentAuthorizeHelper(authClient, request) {
             const correlationId = request.correlationId;
             const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
             const silentRequest = {
@@ -15326,13 +15445,13 @@
             // Wait for response from the redirect bridge.
             let responseString;
             try {
-                responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+                responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
             }
             finally {
                 invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
             }
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
-            return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+            return { serverParams, pkceCodes, silentRequest };
         }
     }
 
@@ -15586,22 +15705,32 @@
             this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient, this.eventHandler);
             this.activeSilentTokenRequests = new Map();
             // Register listener functions
-            this.trackPageVisibility = this.trackPageVisibility.bind(this);
+            this.trackStateChange = this.trackStateChange.bind(this);
             // Register listener functions
-            this.trackPageVisibilityWithMeasurement =
-                this.trackPageVisibilityWithMeasurement.bind(this);
+            this.trackStateChangeWithMeasurement =
+                this.trackStateChangeWithMeasurement.bind(this);
         }
         static async createController(operatingContext, request) {
             const controller = new StandardController(operatingContext);
             await controller.initialize(request);
             return controller;
         }
-        trackPageVisibility(correlationId) {
+        trackStateChange(correlationId, event) {
             if (!correlationId) {
                 return;
             }
-            this.logger.info("16v6hv", correlationId);
-            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+            if (event.type === "visibilitychange") {
+                this.logger.info("16v6hv", correlationId);
+                this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+            }
+            else if (event.type === "online") {
+                this.logger.info("0zirfd", correlationId);
+                this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+            }
+            else if (event.type === "offline") {
+                this.logger.info("1xk9ef", correlationId);
+                this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+            }
         }
         /**
          * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -15701,22 +15830,25 @@
             }
             const loggedInAccounts = this.getAllAccounts();
             const platformBrokerRequest = this.browserStorage.getCachedNativeRequest();
-            const useNative = platformBrokerRequest &&
-                this.platformAuthProvider &&
-                !options?.hash;
+            const useNative = platformBrokerRequest && !options?.hash;
             let rootMeasurement;
             let redirectResponse;
+            let cachedRedirectRequest;
             try {
                 if (useNative && this.platformAuthProvider) {
                     const correlationId = platformBrokerRequest?.correlationId || "";
                     this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, exports.InteractionType.Redirect);
                     rootMeasurement = this.performanceClient.startMeasurement(AcquireTokenRedirect, correlationId);
                     this.logger.trace("12v7is", correlationId);
+                    rootMeasurement.add({
+                        isPlatformBrokerRequest: true,
+                    });
                     const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.platformAuthProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
-                    redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
+                    redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)();
                 }
                 else {
                     const [standardRequest, codeVerifier] = this.browserStorage.getCachedRequest("");
+                    cachedRedirectRequest = standardRequest;
                     const correlationId = standardRequest.correlationId;
                     this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, exports.InteractionType.Redirect);
                     // Reset rootMeasurement now that we have correlationId
@@ -15745,6 +15877,8 @@
                     rootMeasurement.end({
                         success: true,
                     }, undefined, result.account);
+                    // Fire-and-forget SSO capability verification in background
+                    this.verifySsoCapability(cachedRedirectRequest, exports.InteractionType.Redirect);
                 }
                 else {
                     /*
@@ -15810,12 +15944,14 @@
                 if (this.platformAuthProvider &&
                     this.canUsePlatformBroker(request)) {
                     const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.platformAuthProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-                    result = nativeClient
-                        .acquireTokenRedirect(request, atrMeasurement)
-                        .catch((e) => {
+                    result = invokeAsync(nativeClient.acquireTokenRedirect.bind(nativeClient), NativeInteractionClientAcquireTokenRedirect, this.logger, this.performanceClient, correlationId)(request, atrMeasurement).catch((e) => {
+                        atrMeasurement.add({
+                            brokerErrorName: e.name,
+                            brokerErrorCode: e.errorCode,
+                        });
                         if (e instanceof NativeAuthError &&
                             isFatalNativeAuthError(e)) {
-                            this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                            this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                             const redirectClient = this.createRedirectClient(correlationId);
                             return redirectClient.acquireToken(request);
                         }
@@ -15881,6 +16017,9 @@
             let result;
             const pkce = this.getPreGeneratedPkceCodes(correlationId);
             if (this.canUsePlatformBroker(request)) {
+                atPopupMeasurement.add({
+                    isPlatformBrokerRequest: true,
+                });
                 result = this.acquireTokenNative({
                     ...request,
                     correlationId,
@@ -15893,9 +16032,13 @@
                     return response;
                 })
                     .catch((e) => {
+                    atPopupMeasurement.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    });
                     if (e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)) {
-                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                         const popupClient = this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request, pkce);
                     }
@@ -15926,6 +16069,8 @@
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
                 }, undefined, result.account);
+                // SSO capability verification in background
+                this.verifySsoCapability(request, exports.InteractionType.Popup);
                 return result;
             })
                 .catch((e) => {
@@ -15943,15 +16088,137 @@
                 }
             });
         }
-        trackPageVisibilityWithMeasurement() {
+        trackStateChangeWithMeasurement(event) {
             const measurement = this.ssoSilentMeasurement ||
                 this.acquireTokenByCodeAsyncMeasurement;
             if (!measurement) {
                 return;
             }
-            measurement.increment({
-                visibilityChangeCount: 1,
+            if (event.type === "visibilitychange") {
+                this.logger.info("0yzimq", measurement.event.correlationId);
+                measurement.increment({
+                    visibilityChangeCount: 1,
+                });
+            }
+            else if (event.type === "online") {
+                this.logger.info("1caf53", measurement.event.correlationId);
+                measurement.increment({
+                    onlineStatusChangeCount: 1,
+                });
+            }
+            else if (event.type === "offline") {
+                this.logger.info("0fdyk7", measurement.event.correlationId);
+                measurement.increment({
+                    onlineStatusChangeCount: 1,
+                });
+            }
+        }
+        addStateChangeListeners(listener) {
+            document.addEventListener("visibilitychange", listener);
+            window.addEventListener("online", listener);
+            window.addEventListener("offline", listener);
+        }
+        removeStateChangeListeners(listener) {
+            document.removeEventListener("visibilitychange", listener);
+            window.removeEventListener("online", listener);
+            window.removeEventListener("offline", listener);
+        }
+        /**
+         * Reads the cached ssoCapable value from localStorage.
+         * @returns The cached ssoCapable boolean value, or undefined if not cached or expired.
+         */
+        getCachedSsoCapable() {
+            try {
+                const cachedValue = window.localStorage.getItem(SSO_CAPABLE);
+                if (cachedValue) {
+                    const parsed = JSON.parse(cachedValue);
+                    if (parsed &&
+                        typeof parsed.ssoCapable === "boolean" &&
+                        parsed.expiresOn &&
+                        Date.now() < parsed.expiresOn) {
+                        return parsed.ssoCapable;
+                    }
+                }
+            }
+            catch {
+                // If parsing fails, return undefined
+            }
+            return undefined;
+        }
+        /**
+         * SSO capability verification in the background.
+         * This method makes an iframe request to /authorize to verify SSO capability without calling /token.
+         * This method does not block the caller and tracks telemetry for success/failure.
+         * This method only executes if verifySSO is set to true in the auth configuration.
+         * The result is cached in localStorage with a 24-hour TTL; the SSO verification call
+         * is only attempted when the cached value is absent or expired.
+         * @param request - The original request used for the authentication flow
+         * @param interactionType - The interactionType of the AT operation for logging purposes
+         */
+        verifySsoCapability(request, interactionType) {
+            // Check if SSO capability verification is enabled
+            if (!this.config.auth.verifySSO) {
+                return;
+            }
+            // Check TTL: derive ssoCapable state from localStorage and skip if not expired
+            const ssoCacheKey = SSO_CAPABLE;
+            const SSO_CAPABLE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+            const cachedSsoCapable = this.getCachedSsoCapable();
+            if (cachedSsoCapable !== undefined) {
+                this.logger.verbose("13poou", "");
+                return;
+            }
+            const correlationId = createNewGuid();
+            const ssoCapableMeasurement = this.performanceClient.startMeasurement(SsoCapable, correlationId);
+            ssoCapableMeasurement.add({
+                "ext.interactionType": interactionType,
             });
+            this.logger.verbose("0pbr0i", correlationId);
+            /*
+             * Use setTimeout to ensure this runs in a separate macrotask after the current call stack completes
+             * This ensures the result is returned to the caller before the SSO verification starts and doesn't affect performance
+             */
+            setTimeout(() => {
+                const ssoVerificationRequest = {
+                    ...request,
+                    correlationId: correlationId,
+                };
+                const silentIframeClient = this.createSilentIframeClient(correlationId);
+                silentIframeClient
+                    .verifySso(ssoVerificationRequest)
+                    .then((result) => {
+                    this.logger.verbose("1gd1iv", correlationId);
+                    // TBD to add profileTelemetry later in localStorage with 24h TTL
+                    try {
+                        const cacheEntry = JSON.stringify({
+                            ssoCapable: result,
+                            expiresOn: Date.now() + SSO_CAPABLE_TTL_MS,
+                        });
+                        window.localStorage.setItem(ssoCacheKey, cacheEntry);
+                    }
+                    catch {
+                        this.logger.warning("18lmoj", correlationId);
+                    }
+                    ssoCapableMeasurement.end({
+                        fromCache: false,
+                        success: result,
+                    }, undefined);
+                })
+                    .catch((error) => {
+                    this.logger.warning("05g83w", correlationId);
+                    // reset the cache
+                    try {
+                        window.localStorage.removeItem(ssoCacheKey);
+                    }
+                    catch {
+                        this.logger.warning("0nlf9q", correlationId);
+                    }
+                    ssoCapableMeasurement.end({
+                        fromCache: false,
+                        success: false,
+                    }, error);
+                });
+            }, 0);
         }
         // #endregion
         // #region Silent Flow
@@ -15974,28 +16241,35 @@
             const correlationId = this.getRequestCorrelationId(request);
             const validRequest = {
                 ...request,
-                // will be PromptValue.NONE or PromptValue.NO_SESSION
-                prompt: request.prompt,
                 correlationId: correlationId,
             };
             this.ssoSilentMeasurement = this.performanceClient.startMeasurement(SsoSilent, correlationId);
             this.ssoSilentMeasurement?.add({
                 scenarioId: request.scenarioId,
+                ssoCapable: this.getCachedSsoCapable(),
             });
             preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
             this.ssoSilentMeasurement?.increment({
                 visibilityChangeCount: 0,
+                onlineStatusChangeCount: 0,
             });
-            document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
             const loggedInAccounts = this.getAllAccounts();
             this.logger.verbose("0w1b45", correlationId);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Silent, validRequest);
             let result;
             if (this.canUsePlatformBroker(validRequest)) {
+                this.ssoSilentMeasurement?.add({
+                    isPlatformBrokerRequest: true,
+                });
                 result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
+                    this.ssoSilentMeasurement?.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    });
                     // If native token acquisition fails for availability reasons fallback to standard flow
                     if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
-                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                         const silentIframeClient = this.createSilentIframeClient(validRequest.correlationId);
                         return silentIframeClient.acquireToken(validRequest);
                     }
@@ -16029,7 +16303,7 @@
                 throw e;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+                this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
             });
         }
         /**
@@ -16068,7 +16342,6 @@
                             this.hybridAuthCodeResponses.delete(hybridAuthCode);
                             atbcMeasurement.end({
                                 success: true,
-                                isNativeBroker: result.fromPlatformBroker,
                                 accessTokenSize: result.accessToken.length,
                                 idTokenSize: result.idToken.length,
                             }, undefined, result.account);
@@ -16092,10 +16365,17 @@
                 }
                 else if (request.nativeAccountId) {
                     if (this.canUsePlatformBroker(request, request.nativeAccountId)) {
+                        atbcMeasurement.add({
+                            isPlatformBrokerRequest: true,
+                        });
                         const result = await this.acquireTokenNative({
                             ...request,
                             correlationId,
                         }, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
+                            atbcMeasurement.add({
+                                brokerErrorName: e.name,
+                                brokerErrorCode: e.errorCode,
+                            });
                             // If native token acquisition fails for availability reasons fallback to standard flow
                             if (e instanceof NativeAuthError &&
                                 isFatalNativeAuthError(e)) {
@@ -16136,8 +16416,9 @@
                 this.performanceClient.startMeasurement(AcquireTokenByCodeAsync, correlationId);
             this.acquireTokenByCodeAsyncMeasurement?.increment({
                 visibilityChangeCount: 0,
+                onlineStatusChangeCount: 0,
             });
-            document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
             const silentAuthCodeClient = this.createSilentAuthCodeClient(correlationId);
             const silentTokenResult = await silentAuthCodeClient
                 .acquireToken(request)
@@ -16145,7 +16426,6 @@
                 this.acquireTokenByCodeAsyncMeasurement?.end({
                     success: true,
                     fromCache: response.fromCache,
-                    isNativeBroker: response.fromPlatformBroker,
                 });
                 return response;
             })
@@ -16156,7 +16436,7 @@
                 throw tokenRenewalError;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+                this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
             });
             return silentTokenResult;
         }
@@ -16314,7 +16594,7 @@
                 throw createBrowserAuthError(nativeConnectionNotEstablished);
             }
             const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.platformAuthProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-            return nativeClient.acquireToken(request, cacheLookupPolicy);
+            return invokeAsync(nativeClient.acquireToken.bind(nativeClient), NativeInteractionClientAcquireToken, this.logger, this.performanceClient, correlationId)(request, cacheLookupPolicy);
         }
         /**
          * Returns boolean indicating if this request can use the platform broker
@@ -16328,7 +16608,7 @@
                 return false;
             }
             if (!isPlatformAuthAllowed(this.config, this.logger, correlationId, this.platformAuthProvider, request.authenticationScheme)) {
-                this.logger.trace("1m4bzf", correlationId);
+                this.logger.trace("0yoy1g", correlationId);
                 return false;
             }
             if (request.prompt) {
@@ -16547,6 +16827,7 @@
             atsMeasurement.add({
                 cacheLookupPolicy: request.cacheLookupPolicy,
                 scenarioId: request.scenarioId,
+                ssoCapable: this.getCachedSsoCapable(),
             });
             preflightCheck(this.initialized, atsMeasurement, this.config, request);
             this.logger.verbose("0x1c4s", correlationId);
@@ -16559,7 +16840,6 @@
                 atsMeasurement.end({
                     success: true,
                     fromCache: result.fromCache,
-                    isNativeBroker: result.fromPlatformBroker,
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
                 }, undefined, result.account);
@@ -16618,12 +16898,12 @@
          * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
          */
         async acquireTokenSilentAsync(request, account) {
-            const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+            const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, request.correlationId, exports.InteractionType.Silent, request);
             if (request.correlationId) {
-                this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+                this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
             }
-            document.addEventListener("visibilitychange", trackPageVisibility);
+            this.addStateChangeListeners(trackStateChange);
             const silentRequest = await invokeAsync(initializeSilentRequest, InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
             const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
             const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
@@ -16705,7 +16985,7 @@
                 throw tokenRenewalError;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", trackPageVisibility);
+                this.removeStateChangeListeners(trackStateChange);
             });
         }
         /**
@@ -16719,7 +16999,12 @@
             if (isPlatformAuthAllowed(this.config, this.logger, silentRequest.correlationId, this.platformAuthProvider, silentRequest.authenticationScheme) &&
                 silentRequest.account.nativeAccountId) {
                 this.logger.verbose("0sczo4", silentRequest.correlationId);
+                this.performanceClient.addFields({ isPlatformBrokerRequest: true }, silentRequest.correlationId);
                 return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
+                    this.performanceClient.addFields({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    }, silentRequest.correlationId);
                     // If native token acquisition fails for availability reasons fallback to web flow
                     if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                         this.logger.verbose("07rkmb", silentRequest.correlationId);
@@ -18305,7 +18590,7 @@
             const storage = new BrowserCacheManager(browserConfig.auth.clientId, browserConfig.cache, cryptoOps, logger, browserConfig.telemetry.client, new EventHandler(logger), buildStaticAuthorityOptions(browserConfig.auth));
             const authorityString = request.authority || browserConfig.auth.authority;
             const authority = await createDiscoveredInstance(Authority.generateAuthority(authorityString, request.azureCloudOptions), browserConfig.system.networkClient, storage, authorityOptions, logger, correlationId, performanceClient);
-            const cacheRecordAccount = await invokeAsync(loadAccount, LoadAccount, logger, performanceClient, correlationId)(request, options.clientInfo || response.client_info || "", correlationId, storage, logger, cryptoOps, authority, idTokenClaims);
+            const cacheRecordAccount = await invokeAsync(loadAccount, LoadAccount, logger, performanceClient, correlationId)(request, options.clientInfo || response.client_info || "", correlationId, storage, logger, cryptoOps, authority, idTokenClaims, performanceClient);
             const idToken = await invokeAsync(loadIdToken, LoadIdToken, logger, performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, kmsi, correlationId, storage, logger, config.auth.clientId);
             const accessToken = await invokeAsync(loadAccessToken, LoadAccessToken, logger, performanceClient, correlationId)(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, kmsi, options, correlationId, storage, logger, config.auth.clientId);
             const refreshToken = await invokeAsync(loadRefreshToken, LoadRefreshToken, logger, performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, kmsi, correlationId, storage, logger, config.auth.clientId, performanceClient);
@@ -18331,7 +18616,7 @@
      * @param requestHomeAccountId
      * @returns `AccountEntity`
      */
-    async function loadAccount(request, clientInfo, correlationId, storage, logger, cryptoObj, authority, idTokenClaims) {
+    async function loadAccount(request, clientInfo, correlationId, storage, logger, cryptoObj, authority, idTokenClaims, performanceClient) {
         logger.verbose("0ke46k", correlationId);
         if (request.account) {
             const accountEntity = createAccountEntityFromAccountInfo(request.account);
@@ -18346,7 +18631,7 @@
         const claimsTenantId = idTokenClaims?.tid;
         const cachedAccount = buildAccountToCache(storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.getPreferredCache(), claimsTenantId, undefined, // authCodePayload
         undefined, // nativeAccountId
-        logger);
+        logger, performanceClient);
         await storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}), ApiId.loadExternalTokens);
         return cachedAccount;
     }
@@ -18618,6 +18903,9 @@
         getPageVisibility() {
             return document.visibilityState?.toString() || null;
         }
+        getOnlineStatus() {
+            return typeof navigator !== "undefined" ? navigator.onLine : null;
+        }
         deleteIncompleteSubMeasurements(inProgressEvent) {
             void getPerfMeasurementModule()?.then((module) => {
                 const rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
@@ -18644,6 +18932,7 @@
         startMeasurement(measureName, correlationId) {
             // Capture page visibilityState and then invoke start/end measurement
             const startPageVisibility = this.getPageVisibility();
+            const startOnlineStatus = this.getOnlineStatus();
             const inProgressEvent = super.startMeasurement(measureName, correlationId);
             const startTime = supportsBrowserPerformanceNow()
                 ? window.performance.now()
@@ -18659,6 +18948,7 @@
                     const res = inProgressEvent.end({
                         ...event,
                         startPageVisibility,
+                        startOnlineStatus,
                         endPageVisibility: this.getPageVisibility(),
                         durationMs: getPerfDurationMs(startTime),
                         networkEffectiveType: networkInfo.effectiveType,