npm - @azure/msal-browser - Versions diffs - 5.6.3 → 5.8.0 - Mend

@azure/msal-browser 5.6.3 → 5.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (912) hide show

package/lib/custom-auth-path/msal-custom-auth.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.6.3 2026-04-01 */
+/*! @azure/msal-browser v5.8.0 2026-04-21 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -229,7 +229,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -281,7 +281,7 @@ const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -312,7 +312,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -332,7 +332,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -412,7 +412,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -435,7 +435,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -459,7 +459,7 @@ const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
 const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -498,7 +498,7 @@ const methodNotImplemented = "method_not_implemented";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -693,7 +693,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -814,18 +814,29 @@ function addSid(parameters, sid) {
     parameters.set(SID, sid);
 }
 /**
- * add claims
- * @param claims
- */
-function addClaims(parameters, claims, clientCapabilities) {
-    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
-    try {
-        JSON.parse(mergedClaims);
-    }
-    catch (e) {
-        throw createClientConfigurationError(invalidClaims);
+ * Adds claims to request parameters, conditionally excluding clientCapabilities
+ * when skipBrokerClaims is true and a brokered flow is in effect.
+ * @param parameters - The request parameters map
+ * @param claims - The claims string from the request
+ * @param clientCapabilities - The client capabilities from configuration
+ * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+ */
+function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+    // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
+    const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
+        ? undefined
+        : clientCapabilities;
+    if (!StringUtils.isEmptyObj(claims) ||
+        (configClaims && configClaims.length > 0)) {
+        const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
+        try {
+            JSON.parse(mergedClaims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+        parameters.set(CLAIMS, mergedClaims);
     }
-    parameters.set(CLAIMS, mergedClaims);
 }
 /**
  * add correlationId
@@ -1071,7 +1082,7 @@ function addResource(parameters, resource) {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1180,7 +1191,7 @@ function normalizeUrlForComparison(url) {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1219,7 +1230,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1480,12 +1491,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.4.1";
+const version$1 = "16.5.1";
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1494,7 +1505,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1535,6 +1546,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             username: preferred_username || upn || "",
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            upn: upn,
         };
     }
     else {
@@ -1562,7 +1574,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     }
     // ID token claims override passed in account info and tenant profile
     if (idTokenClaims) {
-        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
         updatedAccountInfo = {
@@ -1576,7 +1588,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1656,7 +1668,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1813,7 +1825,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1970,7 +1982,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1978,7 +1990,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2016,7 +2028,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2054,7 +2066,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2069,7 +2081,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2091,7 +2103,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2115,7 +2127,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2290,7 +2302,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2427,6 +2439,19 @@ class CacheManager {
             !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
             return false;
         }
+        if (!!tenantProfileFilter.username &&
+            !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
+                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+            return false;
+        }
+        if (!!tenantProfileFilter.loginHint &&
+            !this.matchLoginHintWithTenantProfile(tenantProfile, tenantProfileFilter.loginHint)) {
+            return false;
+        }
+        if (!!tenantProfileFilter.upn &&
+            !(tenantProfile.upn === tenantProfileFilter.upn)) {
+            return false;
+        }
         return true;
     }
     idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -2441,7 +2466,8 @@ class CacheManager {
                 return false;
             }
             if (!!tenantProfileFilter.username &&
-                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {
+                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username) &&
+                !this.matchUsername(idTokenClaims.upn, tenantProfileFilter.username)) {
                 return false;
             }
             if (!!tenantProfileFilter.name &&
@@ -2542,10 +2568,6 @@ class CacheManager {
                 !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                 return;
             }
-            if (!!accountFilter.username &&
-                !this.matchUsername(entity.username, accountFilter.username)) {
-                return;
-            }
             if (!!accountFilter.environment &&
                 !this.matchEnvironment(entity, accountFilter.environment, correlationId)) {
                 return;
@@ -2566,6 +2588,9 @@ class CacheManager {
             const tenantProfileFilter = {
                 localAccountId: accountFilter?.localAccountId,
                 name: accountFilter?.name,
+                username: accountFilter?.username,
+                loginHint: accountFilter?.loginHint,
+                upn: accountFilter?.upn,
             };
             const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                 return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -2816,11 +2841,11 @@ class CacheManager {
                 const numHomeIdTokens = homeIdTokenMap.size;
                 if (numHomeIdTokens < 1) {
                     this.commonLogger.info("0ooalx", correlationId);
-                    return idTokenMap.values().next().value;
+                    return idTokenMap.values().next().value ?? null;
                 }
                 else if (numHomeIdTokens === 1) {
                     this.commonLogger.info("1eq2vc", correlationId);
-                    return homeIdTokenMap.values().next().value;
+                    return homeIdTokenMap.values().next().value ?? null;
                 }
                 else {
                     // Multiple ID tokens for home tenant profile, remove all and return null
@@ -2836,7 +2861,7 @@ class CacheManager {
             return null;
         }
         this.commonLogger.info("1sm769", correlationId);
-        return idTokenMap.values().next().value;
+        return idTokenMap.values().next().value ?? null;
     }
     /**
      * Gets all idTokens matching the given filter
@@ -3148,6 +3173,17 @@ class CacheManager {
             typeof cachedUsername === "string" &&
             filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
     }
+    /**
+     * helper to match loginhints
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    matchLoginHintWithTenantProfile(tenantProfile, loginHintFilter) {
+        return (tenantProfile.loginHint === loginHintFilter ||
+            tenantProfile.username === loginHintFilter ||
+            tenantProfile.upn === loginHintFilter);
+    }
     /**
      * helper to match assertion
      * @param value
@@ -3240,6 +3276,10 @@ class CacheManager {
         if (tokenClaims.upn === loginHint) {
             return true;
         }
+        // check login hint against list of emails in token claims
+        if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
+            return true;
+        }
         return false;
     }
     /**
@@ -3391,7 +3431,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3405,7 +3445,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3460,7 +3500,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3555,7 +3595,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3582,7 +3622,7 @@ function isOidcProtocolMode(config) {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3647,7 +3687,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3906,7 +3946,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3977,7 +4017,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4070,7 +4110,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4150,7 +4190,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4201,7 +4241,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4269,7 +4309,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4288,7 +4328,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4356,7 +4396,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4704,7 +4744,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4714,7 +4754,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4732,7 +4772,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4753,7 +4793,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4839,7 +4879,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4870,7 +4910,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4984,7 +5024,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4996,7 +5036,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5006,7 +5046,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5016,7 +5056,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5121,7 +5161,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5941,7 +5981,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5975,7 +6015,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6140,11 +6180,6 @@ class AuthorizationCodeClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         let ccsCred = undefined;
         if (request.clientInfo) {
             try {
@@ -6193,6 +6228,7 @@ class AuthorizationCodeClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
     /**
@@ -6236,7 +6272,7 @@ class AuthorizationCodeClient {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6426,11 +6462,6 @@ class RefreshTokenClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
             switch (request.ccsCredential.type) {
@@ -6457,11 +6488,12 @@ class RefreshTokenClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6577,7 +6609,7 @@ class SilentFlowClient {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6592,7 +6624,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6716,14 +6748,10 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.state) {
         addState(parameters, request.state);
     }
-    if (request.claims ||
-        (authOptions.clientCapabilities &&
-            authOptions.clientCapabilities.length > 0)) {
-        addClaims(parameters, request.claims, authOptions.clientCapabilities);
-    }
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
+    addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -6819,7 +6847,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6852,7 +6880,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6862,7 +6890,7 @@ function containsResourceParam(params) {
  */
 const unexpectedError = "unexpected_error";
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7123,7 +7151,7 @@ class ServerTelemetryManager {
     }
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7144,7 +7172,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7152,7 +7180,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7587,7 +7615,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.6.3";
+const version = "5.8.0";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8143,6 +8171,7 @@ const StandardInteractionClientGetDiscoveredAuthority = "standardInteractionClie
  * Used to acquire a token from Native component when native brokering is enabled.
  */
 const NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
+const NativeInteractionClientAcquireTokenRedirect = "nativeInteractionClientAcquireToken";
 /**
  * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
  */
@@ -14189,7 +14218,12 @@ const SsoSilent = "ssoSilent";
 // Initialize client application
 const InitializeClientApplication = "initializeClientApplication";
 // Update cache storage
-const LocalStorageUpdated = "localStorageUpdated";
+const LocalStorageUpdated = "localStorageUpdated";
+/**
+ * SSO capability verification call (msal-browser).
+ * Fire-and-forget SSO verification call made after interactive authentication completes.
+ */
+const SsoCapable = "ssoCapable";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14198,14 +14232,15 @@ const LocalStorageUpdated = "localStorageUpdated";
 const PREFIX = "msal";
 const BROWSER_PREFIX = "browser";
 const CACHE_KEY_SEPARATOR = "|";
-const CREDENTIAL_SCHEMA_VERSION = 2;
-const ACCOUNT_SCHEMA_VERSION = 2;
+const CREDENTIAL_SCHEMA_VERSION = 3;
+const ACCOUNT_SCHEMA_VERSION = 3;
 const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
 const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
 const PLATFORM_AUTH_DOM_SUPPORT = `${PREFIX}.${BROWSER_PREFIX}.platform.auth.dom`;
 const VERSION_CACHE_KEY = `${PREFIX}.version`;
 const ACCOUNT_KEYS = "account.keys";
 const TOKEN_KEYS = "token.keys";
+const SSO_CAPABLE = `${PREFIX}.${BROWSER_PREFIX}.sso.capable`;
 function getAccountKeysCacheKey(schema = ACCOUNT_SCHEMA_VERSION) {
     if (schema < 1) {
         return `${PREFIX}.${ACCOUNT_KEYS}`;
@@ -14983,7 +15018,9 @@ class BrowserCacheManager extends CacheManager {
                 }
                 await this.setUserData(newIdTokenKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
                 this.performanceClient.incrementFields({ migratedITCount: 1 }, correlationId);
-                currentCredentialKeys.idToken.push(newIdTokenKey);
+                if (!currentCredentialKeys.idToken.includes(newIdTokenKey)) {
+                    currentCredentialKeys.idToken.push(newIdTokenKey);
+                }
             }
         }
         this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
@@ -15832,10 +15869,8 @@ class BrowserCacheManager extends CacheManager {
         return `${PREFIX}.${this.clientId}.${key}`;
     }
     /**
-     * Cache Key: msal.<schema_version>-<home_account_id>-<environment>-<credential_type>-<client_id or familyId>-<realm>-<scopes>-<claims hash>-<scheme>
-     * IdToken Example: uid.utid-login.microsoftonline.com-idtoken-app_client_id-contoso.com
-     * AccessToken Example: uid.utid-login.microsoftonline.com-accesstoken-app_client_id-contoso.com-scope1 scope2--pop
-     * RefreshToken Example: uid.utid-login.microsoftonline.com-refreshtoken-1-contoso.com
+     * Generate Credential Key. All changes to the key REQUIRE a schema version update.
+     * Cache Key: msal.<schema_version>|<home_account_id>|<environment>|<credential_type>|<client_id or familyId>|<realm>|<scopes>|<scheme>
      * @param credentialEntity
      * @returns
      */
@@ -16391,7 +16426,6 @@ const userSwitch = "user_switch";
 const USER_INTERACTION_REQUIRED = "USER_INTERACTION_REQUIRED";
 const USER_CANCEL = "USER_CANCEL";
 const NO_NETWORK = "NO_NETWORK";
-const PERSISTENT_ERROR = "PERSISTENT_ERROR";
 const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
 const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
@@ -16415,8 +16449,7 @@ class NativeAuthError extends AuthError {
 function isFatalNativeAuthError(error) {
     if (error.ext &&
         error.ext.status &&
-        (error.ext.status === PERSISTENT_ERROR ||
-            error.ext.status === DISABLED)) {
+        error.ext.status === DISABLED) {
         return true;
     }
     if (error.ext &&
@@ -16542,12 +16575,12 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
     async acquireToken(request, cacheLookupPolicy) {
         this.logger.trace("03qeos", this.correlationId);
         // start the perf measurement
-        const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, request.correlationId);
+        const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
         const reqTimestamp = nowSeconds();
         const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
         try {
             // initialize native request
-            const nativeRequest = await this.initializeNativeRequest(request);
+            const nativeRequest = await this.initializePlatformRequest(request);
             // check if the tokens can be retrieved from internal cache
             try {
                 const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
@@ -16561,6 +16594,10 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             catch (e) {
                 if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
                     this.logger.info("0eitbc", this.correlationId);
+                    nativeATMeasurement.end({
+                        success: false,
+                        brokerErrorCode: "cache_request_failed",
+                    });
                     throw e;
                 }
                 // continue with a native call for any and all errors
@@ -16582,7 +16619,6 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
                     success: false,
                     errorCode: error.errorCode,
                     subErrorCode: error.subError,
-                    isNativeBroker: true,
                 });
                 throw error;
             });
@@ -16591,6 +16627,9 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             if (e instanceof NativeAuthError) {
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
             }
+            nativeATMeasurement.end({
+                success: false,
+            });
             throw e;
         }
     }
@@ -16623,7 +16662,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // fetch the account from browser cache
         const account = this.browserStorage.getBaseAccountInfo({
             nativeAccountId,
-        }, request.correlationId);
+        }, this.correlationId);
         if (!account) {
             throw createClientAuthError(noAccountFound);
         }
@@ -16631,13 +16670,14 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         try {
             const silentRequest = this.createSilentCacheRequest(request, account);
             const result = await this.silentCacheClient.acquireToken(silentRequest);
-            const fullAccount = {
-                ...account,
-                idTokenClaims: result?.idTokenClaims,
-                idToken: result?.idToken,
-            };
+            const idToken = this.browserStorage.getIdToken(account, this.correlationId, this.browserStorage.getTokenKeys(), account.tenantId);
+            const idTokenClaims = extractTokenClaims(idToken?.secret || "", base64Decode);
+            const fullAccount = updateAccountTenantProfileData(account, undefined, // tenantProfile optional
+            idTokenClaims, idToken?.secret);
             return {
                 ...result,
+                idToken: idToken?.secret || "",
+                idTokenClaims: idTokenClaims,
                 account: fullAccount,
             };
         }
@@ -16653,7 +16693,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      */
     async acquireTokenRedirect(request, rootMeasurement, options) {
         this.logger.trace("0luikq", this.correlationId);
-        const nativeRequest = await this.initializeNativeRequest(request);
+        const nativeRequest = await this.initializePlatformRequest(request);
         const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
         try {
             await this.platformAuthProvider.sendMessage(nativeRequest);
@@ -16685,7 +16725,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param performanceClient {IPerformanceClient?}
      * @param correlationId {string?} correlation identifier
      */
-    async handleRedirectPromise(performanceClient, correlationId) {
+    async handleRedirectPromise() {
         this.logger.trace("1c5lhw", this.correlationId);
         if (!this.browserStorage.isInteractionInProgress(true)) {
             this.logger.info("0le6uv", this.correlationId);
@@ -16695,9 +16735,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const cachedRequest = this.browserStorage.getCachedNativeRequest();
         if (!cachedRequest) {
             this.logger.verbose("0a6zjb", this.correlationId);
-            if (performanceClient && correlationId) {
-                performanceClient?.addFields({ errorCode: "no_cached_request" }, correlationId);
-            }
+            this.performanceClient?.addFields({ errorCode: "no_cached_request" }, this.correlationId);
             return null;
         }
         const { prompt, ...request } = cachedRequest;
@@ -16712,6 +16750,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
             const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
             serverTelemetryManager.clearNativeBrokerErrorCode();
+            this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
             return authResult;
         }
         catch (e) {
@@ -16761,7 +16800,8 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
         await this.cacheAccount(baseAccount, isKmsi(idTokenClaims));
-        await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
+        await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.tenantId, reqTimestamp, authority.getPreferredCache() // environment
+        );
         return result;
     }
     /**
@@ -16900,8 +16940,8 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param tenantId
      * @param reqTimestamp
      */
-    cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, responseAccessToken, tenantId, reqTimestamp) {
-        const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || "", request.clientId, idTokenClaims.tid || "");
+    async cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, tenantId, reqTimestamp, environment) {
+        const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, environment, response.id_token || "", request.clientId, idTokenClaims.tid || "");
         // cache accessToken in inmemory storage
         const expiresIn = request.tokenType === AuthenticationScheme.POP
             ? SHR_NONCE_VALIDITY
@@ -16910,9 +16950,13 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
                 : response.expires_in) || 0;
         const tokenExpirationSeconds = reqTimestamp + expiresIn;
         const responseScopes = this.generateScopes(response.scope, request.scope);
-        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+        // save idtoken credential in configured browser storage
+        if (!!cachedIdToken && request.storeInCache?.idToken !== false) {
+            await this.browserStorage.setIdTokenCredential(cachedIdToken, this.correlationId, isKmsi(idTokenClaims));
+        }
+        // save access token credential in memory storage
         const nativeCacheRecord = {
-            idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
         return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), this.apiId, request.storeInCache);
@@ -16980,15 +17024,23 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * Translates developer provided request object into NativeRequest object
      * @param request
      */
-    async initializeNativeRequest(request) {
-        this.logger.trace("04j6wj", this.correlationId);
+    async initializePlatformRequest(request) {
+        this.logger.trace("1xdm2a", this.correlationId);
         const canonicalAuthority = await this.getCanonicalAuthority(request);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims && !!request.embeddedClientId
+            ? undefined
+            : this.config.auth.clientCapabilities;
         // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
-        const { scopes, ...remainingProperties } = request;
+        const { scopes, claims, ...remainingProperties } = request;
         const scopeSet = new ScopeSet(scopes || []);
         scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
+        const mergedClaims = configClaims && configClaims.length
+            ? addClientCapabilitiesToClaims(claims, configClaims)
+            : claims;
         const validatedRequest = {
             ...remainingProperties,
+            claims: mergedClaims,
             accountId: this.accountId,
             clientId: this.config.auth.clientId,
             authority: canonicalAuthority.urlString,
@@ -17058,12 +17110,12 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         switch (this.apiId) {
             case ApiId.ssoSilent:
             case ApiId.acquireTokenSilent_silentFlow:
-                this.logger.trace("1hiwaz", this.correlationId);
+                this.logger.trace("12n1y2", this.correlationId);
                 return PromptValue.NONE;
         }
         // Prompt not provided, request may proceed and native broker decides if it needs to prompt
         if (!prompt) {
-            this.logger.trace("1qlu04", this.correlationId);
+            this.logger.trace("0uid1p", this.correlationId);
             return undefined;
         }
         // If request is interactive, check if prompt provided is allowed to go directly to native broker
@@ -17071,10 +17123,10 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             case PromptValue.NONE:
             case PromptValue.CONSENT:
             case PromptValue.LOGIN:
-                this.logger.trace("1ynje4", this.correlationId);
+                this.logger.trace("0i0hco", this.correlationId);
                 return prompt;
             default:
-                this.logger.trace("0nkr6q", this.correlationId);
+                this.logger.trace("0w3tpw", this.correlationId);
                 throw createBrowserAuthError(nativePromptNotSupported);
         }
     }
@@ -17110,7 +17162,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         this.performanceClient?.addFields({
             embeddedClientId: child_client_id,
             embeddedRedirectUri: child_redirect_uri,
-        }, request.correlationId);
+        }, this.correlationId);
     }
 }
@@ -17197,6 +17249,10 @@ async function getStandardParameters(config, authority, request, logger, perform
     if (request.platformBroker) {
         // signal ests that this is a WAM call
         addNativeBroker(parameters);
+        // instrument JS-platform bridge specific fields
+        performanceClient.addFields({
+            isPlatformAuthorizeRequest: true,
+        }, request.correlationId);
         // pass the req_cnf for POP
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const cryptoOps = new CryptoOps(logger, performanceClient);
@@ -17666,6 +17722,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         },
         instanceAware: false,
         isMcp: false,
+        verifySSO: false,
     };
     // Default cache options for browser
     const DEFAULT_CACHE_OPTIONS = {
@@ -17760,7 +17817,7 @@ class PlatformAuthExtensionHandler {
         this.messageChannel = new MessageChannel();
         this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
         this.performanceClient = performanceClient;
-        this.handshakeEvent = performanceClient.startMeasurement(NativeMessageHandlerHandshake);
+        this.handshakeEvent = this.performanceClient.startMeasurement(NativeMessageHandlerHandshake);
         this.platformAuthType =
             PlatformAuthConstants.PLATFORM_EXTENSION_PROVIDER;
     }
@@ -18200,7 +18257,7 @@ function isDomEnabledForPlatformAuth() {
     }
 }
 /**
- * Returns boolean indicating whether or not the request should attempt to use native broker
+ * Returns boolean indicating whether or not the request should attempt to use platform broker
  * @param logger
  * @param config
  * @param correlationId
@@ -18482,6 +18539,10 @@ class PopupClient extends StandardInteractionClient {
                     return;
                 }
             }
+            // Redirect bridge requires "state" param to work properly
+            validRequest.state = setRequestState(this.browserCrypto, validRequest.state || "", {
+                interactionType: InteractionType.Popup,
+            });
             // Create logout string and navigate user window to logout.
             const logoutUri = authClient.getLogoutUri(validRequest);
             this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, validRequest.correlationId, InteractionType.Popup, validRequest);
@@ -19022,6 +19083,10 @@ class RedirectClient extends StandardInteractionClient {
                     }
                 }
             }
+            // Redirect bridge requires "state" param to work properly
+            validLogoutRequest.state = setRequestState(this.browserCrypto, validLogoutRequest.state || "", {
+                interactionType: InteractionType.Redirect,
+            });
             // Create logout string and navigate user window to logout.
             const logoutUri = authClient.getLogoutUri(validLogoutRequest);
             if (validLogoutRequest.account?.homeAccountId) {
@@ -19270,6 +19335,38 @@ class SilentIframeClient extends StandardInteractionClient {
             return invokeAsync(handleResponseEAR, HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
     }
+    /**
+     * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+     * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+     * @param request - The SSO silent request
+     * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+     */
+    async verifySso(request) {
+        const inputRequest = { ...request };
+        if (!inputRequest.prompt) {
+            inputRequest.prompt = PromptValue.NONE;
+        }
+        // Create silent request
+        const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
+        const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
+            serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger),
+            requestAuthority: silentRequest.authority,
+            requestAzureCloudOptions: silentRequest.azureCloudOptions,
+            requestExtraQueryParameters: silentRequest.extraQueryParameters,
+            account: silentRequest.account,
+        });
+        const { serverParams } = await this.silentAuthorizeHelper(authClient, silentRequest);
+        const correlationId = silentRequest.correlationId;
+        // Validate the response - this checks for errors and validates state
+        validateAuthorizationResponse(serverParams, silentRequest.state);
+        // Verify a valid authorization code is present
+        if (!serverParams.code) {
+            this.logger.warning("0y34ti", correlationId);
+            return false;
+        }
+        this.logger.verbose("0kkkcj", correlationId);
+        return true;
+    }
     /**
      * Currently Unsupported
      */
@@ -19284,6 +19381,16 @@ class SilentIframeClient extends StandardInteractionClient {
      * @param userRequestScopes
      */
     async silentTokenHelper(authClient, request) {
+        const { serverParams, pkceCodes } = await this.silentAuthorizeHelper(authClient, request);
+        return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, request.correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+    }
+    /**
+     * Shared helper that generates PKCE codes, builds the /authorize URL,
+     * loads it in a hidden iframe, waits for the redirect-bridge response,
+     * and returns the deserialized server parameters along with the PKCE codes
+     * and the request that was sent.
+     */
+    async silentAuthorizeHelper(authClient, request) {
         const correlationId = request.correlationId;
         const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
         const silentRequest = {
@@ -19310,7 +19417,7 @@ class SilentIframeClient extends StandardInteractionClient {
             invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
         }
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
-        return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        return { serverParams, pkceCodes, silentRequest };
     }
 }
@@ -19677,22 +19784,25 @@ class StandardController {
         }
         const loggedInAccounts = this.getAllAccounts();
         const platformBrokerRequest = this.browserStorage.getCachedNativeRequest();
-        const useNative = platformBrokerRequest &&
-            this.platformAuthProvider &&
-            !options?.hash;
+        const useNative = platformBrokerRequest && !options?.hash;
         let rootMeasurement;
         let redirectResponse;
+        let cachedRedirectRequest;
         try {
             if (useNative && this.platformAuthProvider) {
                 const correlationId = platformBrokerRequest?.correlationId || "";
                 this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, InteractionType.Redirect);
                 rootMeasurement = this.performanceClient.startMeasurement(AcquireTokenRedirect, correlationId);
                 this.logger.trace("12v7is", correlationId);
+                rootMeasurement.add({
+                    isPlatformBrokerRequest: true,
+                });
                 const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.platformAuthProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
-                redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
+                redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)();
             }
             else {
                 const [standardRequest, codeVerifier] = this.browserStorage.getCachedRequest("");
+                cachedRedirectRequest = standardRequest;
                 const correlationId = standardRequest.correlationId;
                 this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, InteractionType.Redirect);
                 // Reset rootMeasurement now that we have correlationId
@@ -19721,6 +19831,8 @@ class StandardController {
                 rootMeasurement.end({
                     success: true,
                 }, undefined, result.account);
+                // Fire-and-forget SSO capability verification in background
+                this.verifySsoCapability(cachedRedirectRequest, InteractionType.Redirect);
             }
             else {
                 /*
@@ -19786,12 +19898,14 @@ class StandardController {
             if (this.platformAuthProvider &&
                 this.canUsePlatformBroker(request)) {
                 const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.platformAuthProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-                result = nativeClient
-                    .acquireTokenRedirect(request, atrMeasurement)
-                    .catch((e) => {
+                result = invokeAsync(nativeClient.acquireTokenRedirect.bind(nativeClient), NativeInteractionClientAcquireTokenRedirect, this.logger, this.performanceClient, correlationId)(request, atrMeasurement).catch((e) => {
+                    atrMeasurement.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    });
                     if (e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)) {
-                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                         const redirectClient = this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
@@ -19857,6 +19971,9 @@ class StandardController {
         let result;
         const pkce = this.getPreGeneratedPkceCodes(correlationId);
         if (this.canUsePlatformBroker(request)) {
+            atPopupMeasurement.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative({
                 ...request,
                 correlationId,
@@ -19869,9 +19986,13 @@ class StandardController {
                 return response;
             })
                 .catch((e) => {
+                atPopupMeasurement.add({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                });
                 if (e instanceof NativeAuthError &&
                     isFatalNativeAuthError(e)) {
-                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                     const popupClient = this.createPopupClient(correlationId);
                     return popupClient.acquireToken(request, pkce);
                 }
@@ -19902,6 +20023,8 @@ class StandardController {
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             }, undefined, result.account);
+            // SSO capability verification in background
+            this.verifySsoCapability(request, InteractionType.Popup);
             return result;
         })
             .catch((e) => {
@@ -19954,6 +20077,103 @@ class StandardController {
         window.removeEventListener("online", listener);
         window.removeEventListener("offline", listener);
     }
+    /**
+     * Reads the cached ssoCapable value from localStorage.
+     * @returns The cached ssoCapable boolean value, or undefined if not cached or expired.
+     */
+    getCachedSsoCapable() {
+        try {
+            const cachedValue = window.localStorage.getItem(SSO_CAPABLE);
+            if (cachedValue) {
+                const parsed = JSON.parse(cachedValue);
+                if (parsed &&
+                    typeof parsed.ssoCapable === "boolean" &&
+                    parsed.expiresOn &&
+                    Date.now() < parsed.expiresOn) {
+                    return parsed.ssoCapable;
+                }
+            }
+        }
+        catch {
+            // If parsing fails, return undefined
+        }
+        return undefined;
+    }
+    /**
+     * SSO capability verification in the background.
+     * This method makes an iframe request to /authorize to verify SSO capability without calling /token.
+     * This method does not block the caller and tracks telemetry for success/failure.
+     * This method only executes if verifySSO is set to true in the auth configuration.
+     * The result is cached in localStorage with a 24-hour TTL; the SSO verification call
+     * is only attempted when the cached value is absent or expired.
+     * @param request - The original request used for the authentication flow
+     * @param interactionType - The interactionType of the AT operation for logging purposes
+     */
+    verifySsoCapability(request, interactionType) {
+        // Check if SSO capability verification is enabled
+        if (!this.config.auth.verifySSO) {
+            return;
+        }
+        // Check TTL: derive ssoCapable state from localStorage and skip if not expired
+        const ssoCacheKey = SSO_CAPABLE;
+        const SSO_CAPABLE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+        const cachedSsoCapable = this.getCachedSsoCapable();
+        if (cachedSsoCapable !== undefined) {
+            this.logger.verbose("13poou", "");
+            return;
+        }
+        const correlationId = createNewGuid();
+        const ssoCapableMeasurement = this.performanceClient.startMeasurement(SsoCapable, correlationId);
+        ssoCapableMeasurement.add({
+            "ext.interactionType": interactionType,
+        });
+        this.logger.verbose("0pbr0i", correlationId);
+        /*
+         * Use setTimeout to ensure this runs in a separate macrotask after the current call stack completes
+         * This ensures the result is returned to the caller before the SSO verification starts and doesn't affect performance
+         */
+        setTimeout(() => {
+            const ssoVerificationRequest = {
+                ...request,
+                correlationId: correlationId,
+            };
+            const silentIframeClient = this.createSilentIframeClient(correlationId);
+            silentIframeClient
+                .verifySso(ssoVerificationRequest)
+                .then((result) => {
+                this.logger.verbose("1gd1iv", correlationId);
+                // TBD to add profileTelemetry later in localStorage with 24h TTL
+                try {
+                    const cacheEntry = JSON.stringify({
+                        ssoCapable: result,
+                        expiresOn: Date.now() + SSO_CAPABLE_TTL_MS,
+                    });
+                    window.localStorage.setItem(ssoCacheKey, cacheEntry);
+                }
+                catch {
+                    this.logger.warning("18lmoj", correlationId);
+                }
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: result,
+                }, undefined);
+            })
+                .catch((error) => {
+                this.logger.warning("05g83w", correlationId);
+                // reset the cache
+                try {
+                    window.localStorage.removeItem(ssoCacheKey);
+                }
+                catch {
+                    this.logger.warning("0nlf9q", correlationId);
+                }
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: false,
+                }, error);
+            });
+        }, 0);
+    }
     // #endregion
     // #region Silent Flow
     /**
@@ -19975,13 +20195,12 @@ class StandardController {
         const correlationId = this.getRequestCorrelationId(request);
         const validRequest = {
             ...request,
-            // will be PromptValue.NONE or PromptValue.NO_SESSION
-            prompt: request.prompt,
             correlationId: correlationId,
         };
         this.ssoSilentMeasurement = this.performanceClient.startMeasurement(SsoSilent, correlationId);
         this.ssoSilentMeasurement?.add({
             scenarioId: request.scenarioId,
+            ssoCapable: this.getCachedSsoCapable(),
         });
         preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
         this.ssoSilentMeasurement?.increment({
@@ -19994,10 +20213,17 @@ class StandardController {
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Silent, validRequest);
         let result;
         if (this.canUsePlatformBroker(validRequest)) {
+            this.ssoSilentMeasurement?.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
+                this.ssoSilentMeasurement?.add({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                });
                 // If native token acquisition fails for availability reasons fallback to standard flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
-                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                     const silentIframeClient = this.createSilentIframeClient(validRequest.correlationId);
                     return silentIframeClient.acquireToken(validRequest);
                 }
@@ -20070,7 +20296,6 @@ class StandardController {
                         this.hybridAuthCodeResponses.delete(hybridAuthCode);
                         atbcMeasurement.end({
                             success: true,
-                            isNativeBroker: result.fromPlatformBroker,
                             accessTokenSize: result.accessToken.length,
                             idTokenSize: result.idToken.length,
                         }, undefined, result.account);
@@ -20094,10 +20319,17 @@ class StandardController {
             }
             else if (request.nativeAccountId) {
                 if (this.canUsePlatformBroker(request, request.nativeAccountId)) {
+                    atbcMeasurement.add({
+                        isPlatformBrokerRequest: true,
+                    });
                     const result = await this.acquireTokenNative({
                         ...request,
                         correlationId,
                     }, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
+                        atbcMeasurement.add({
+                            brokerErrorName: e.name,
+                            brokerErrorCode: e.errorCode,
+                        });
                         // If native token acquisition fails for availability reasons fallback to standard flow
                         if (e instanceof NativeAuthError &&
                             isFatalNativeAuthError(e)) {
@@ -20148,7 +20380,6 @@ class StandardController {
             this.acquireTokenByCodeAsyncMeasurement?.end({
                 success: true,
                 fromCache: response.fromCache,
-                isNativeBroker: response.fromPlatformBroker,
             });
             return response;
         })
@@ -20297,9 +20528,25 @@ class StandardController {
         const accountEntity = createAccountEntityFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
         await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims), ApiId.hydrateCache);
         if (result.fromPlatformBroker) {
-            this.logger.verbose("1fxyu8", result.correlationId);
-            // Tokens from native broker are stored in-memory
-            return this.nativeInternalStorage.hydrateCache(result, request);
+            this.logger.verbose("1i5atf", result.correlationId);
+            // Create idToken entity and store in browser storage
+            const idTokenEntity = createIdTokenEntity(result.account.homeAccountId, result.account.environment, result.idToken, this.config.auth.clientId, result.tenantId);
+            // Create accessToken entity and store in native internal storage
+            const accessTokenEntity = createAccessTokenEntity(result.account.homeAccountId, result.account.environment, result.accessToken, this.config.auth.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn
+                ? toSecondsFromDate(result.expiresOn)
+                : 0, result.extExpiresOn
+                ? toSecondsFromDate(result.extExpiresOn)
+                : 0, base64Decode, undefined, // refreshOn
+            result.tokenType, undefined, // userAssertionHash
+            request.sshKid);
+            if (request.resource) {
+                accessTokenEntity.resource = request.resource;
+            }
+            const kmsi = isKmsi(result.idTokenClaims);
+            // Store idToken in browser storage
+            await this.browserStorage.setIdTokenCredential(idTokenEntity, result.correlationId, kmsi);
+            // Store accessToken in native internal storage
+            await this.nativeInternalStorage.setAccessTokenCredential(accessTokenEntity, result.correlationId, kmsi);
         }
         else {
             return this.browserStorage.hydrateCache(result, request);
@@ -20317,7 +20564,7 @@ class StandardController {
             throw createBrowserAuthError(nativeConnectionNotEstablished);
         }
         const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.platformAuthProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-        return nativeClient.acquireToken(request, cacheLookupPolicy);
+        return invokeAsync(nativeClient.acquireToken.bind(nativeClient), NativeInteractionClientAcquireToken, this.logger, this.performanceClient, correlationId)(request, cacheLookupPolicy);
     }
     /**
      * Returns boolean indicating if this request can use the platform broker
@@ -20331,7 +20578,7 @@ class StandardController {
             return false;
         }
         if (!isPlatformAuthAllowed(this.config, this.logger, correlationId, this.platformAuthProvider, request.authenticationScheme)) {
-            this.logger.trace("1m4bzf", correlationId);
+            this.logger.trace("0yoy1g", correlationId);
             return false;
         }
         if (request.prompt) {
@@ -20363,7 +20610,9 @@ class StandardController {
                 loginHint: request.loginHint,
                 sid: request.sid,
             }) ||
-            this.getActiveAccount();
+            (!request.loginHint && !request.sid
+                ? this.getActiveAccount()
+                : null);
         return (account && account.nativeAccountId) || "";
     }
     /**
@@ -20550,6 +20799,7 @@ class StandardController {
         atsMeasurement.add({
             cacheLookupPolicy: request.cacheLookupPolicy,
             scenarioId: request.scenarioId,
+            ssoCapable: this.getCachedSsoCapable(),
         });
         preflightCheck(this.initialized, atsMeasurement, this.config, request);
         this.logger.verbose("0x1c4s", correlationId);
@@ -20562,7 +20812,6 @@ class StandardController {
             atsMeasurement.end({
                 success: true,
                 fromCache: result.fromCache,
-                isNativeBroker: result.fromPlatformBroker,
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             }, undefined, result.account);
@@ -20722,7 +20971,12 @@ class StandardController {
         if (isPlatformAuthAllowed(this.config, this.logger, silentRequest.correlationId, this.platformAuthProvider, silentRequest.authenticationScheme) &&
             silentRequest.account.nativeAccountId) {
             this.logger.verbose("0sczo4", silentRequest.correlationId);
+            this.performanceClient.addFields({ isPlatformBrokerRequest: true }, silentRequest.correlationId);
             return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
+                this.performanceClient.addFields({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                }, silentRequest.correlationId);
                 // If native token acquisition fails for availability reasons fallback to web flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.logger.verbose("07rkmb", silentRequest.correlationId);