npm - @azure/msal-browser - Versions diffs - 5.6.3 → 5.8.0 - Mend

@azure/msal-browser 5.6.3 → 5.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (912) hide show

package/lib/msal-browser.js CHANGED Viewed

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.6.3 2026-04-01 */
+/*! @azure/msal-browser v5.8.0 2026-04-21 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -238,7 +238,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -290,7 +290,7 @@
     const RESOURCE = "resource";
     const CLI_DATA = "clidata";
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -321,7 +321,7 @@
         return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -341,7 +341,7 @@
         return new ClientConfigurationError(errorCode);
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -421,7 +421,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -444,7 +444,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -498,7 +498,7 @@
         urlParseError: urlParseError
     });
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -586,7 +586,7 @@
         userCanceled: userCanceled
     });
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -781,7 +781,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -902,18 +902,29 @@
         parameters.set(SID, sid);
     }
     /**
-     * add claims
-     * @param claims
-     */
-    function addClaims(parameters, claims, clientCapabilities) {
-        const mergedClaims = addClientCapabilitiesToClaims$1(claims, clientCapabilities);
-        try {
-            JSON.parse(mergedClaims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
+     * Adds claims to request parameters, conditionally excluding clientCapabilities
+     * when skipBrokerClaims is true and a brokered flow is in effect.
+     * @param parameters - The request parameters map
+     * @param claims - The claims string from the request
+     * @param clientCapabilities - The client capabilities from configuration
+     * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+     */
+    function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+        // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : clientCapabilities;
+        if (!StringUtils.isEmptyObj(claims) ||
+            (configClaims && configClaims.length > 0)) {
+            const mergedClaims = addClientCapabilitiesToClaims$1(claims, configClaims);
+            try {
+                JSON.parse(mergedClaims);
+            }
+            catch (e) {
+                throw createClientConfigurationError(invalidClaims);
+            }
+            parameters.set(CLAIMS, mergedClaims);
         }
-        parameters.set(CLAIMS, mergedClaims);
     }
     /**
      * add correlationId
@@ -1159,7 +1170,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1268,7 +1279,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1307,7 +1318,7 @@
         },
     };
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1582,12 +1593,12 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "16.4.1";
+    const version$1 = "16.5.1";
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1607,7 +1618,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1648,6 +1659,7 @@
                 username: preferred_username || upn || "",
                 loginHint: login_hint,
                 isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+                upn: upn,
             };
         }
         else {
@@ -1675,7 +1687,7 @@
         }
         // ID token claims override passed in account info and tenant profile
         if (idTokenClaims) {
-            // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+            // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
             // eslint-disable-next-line @typescript-eslint/no-unused-vars
             const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
             updatedAccountInfo = {
@@ -1689,7 +1701,7 @@
         return updatedAccountInfo;
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1769,7 +1781,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1926,7 +1938,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2083,7 +2095,7 @@
         return null;
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2091,7 +2103,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2129,7 +2141,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2167,7 +2179,7 @@
         };
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2182,7 +2194,7 @@
         Ciam: 3,
     };
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2204,7 +2216,7 @@
         return null;
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2228,7 +2240,7 @@
         EAR: "EAR",
     };
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -2403,7 +2415,7 @@
             entity.hasOwnProperty("authorityType"));
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2540,6 +2552,19 @@
                 !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
                 return false;
             }
+            if (!!tenantProfileFilter.username &&
+                !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
+                    !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+                return false;
+            }
+            if (!!tenantProfileFilter.loginHint &&
+                !this.matchLoginHintWithTenantProfile(tenantProfile, tenantProfileFilter.loginHint)) {
+                return false;
+            }
+            if (!!tenantProfileFilter.upn &&
+                !(tenantProfile.upn === tenantProfileFilter.upn)) {
+                return false;
+            }
             return true;
         }
         idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -2554,7 +2579,8 @@
                     return false;
                 }
                 if (!!tenantProfileFilter.username &&
-                    !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {
+                    !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username) &&
+                    !this.matchUsername(idTokenClaims.upn, tenantProfileFilter.username)) {
                     return false;
                 }
                 if (!!tenantProfileFilter.name &&
@@ -2655,10 +2681,6 @@
                     !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                     return;
                 }
-                if (!!accountFilter.username &&
-                    !this.matchUsername(entity.username, accountFilter.username)) {
-                    return;
-                }
                 if (!!accountFilter.environment &&
                     !this.matchEnvironment(entity, accountFilter.environment, correlationId)) {
                     return;
@@ -2679,6 +2701,9 @@
                 const tenantProfileFilter = {
                     localAccountId: accountFilter?.localAccountId,
                     name: accountFilter?.name,
+                    username: accountFilter?.username,
+                    loginHint: accountFilter?.loginHint,
+                    upn: accountFilter?.upn,
                 };
                 const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                     return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -2929,11 +2954,11 @@
                     const numHomeIdTokens = homeIdTokenMap.size;
                     if (numHomeIdTokens < 1) {
                         this.commonLogger.info("0ooalx", correlationId);
-                        return idTokenMap.values().next().value;
+                        return idTokenMap.values().next().value ?? null;
                     }
                     else if (numHomeIdTokens === 1) {
                         this.commonLogger.info("1eq2vc", correlationId);
-                        return homeIdTokenMap.values().next().value;
+                        return homeIdTokenMap.values().next().value ?? null;
                     }
                     else {
                         // Multiple ID tokens for home tenant profile, remove all and return null
@@ -2949,7 +2974,7 @@
                 return null;
             }
             this.commonLogger.info("1sm769", correlationId);
-            return idTokenMap.values().next().value;
+            return idTokenMap.values().next().value ?? null;
         }
         /**
          * Gets all idTokens matching the given filter
@@ -3262,6 +3287,17 @@
                 typeof cachedUsername === "string" &&
                 filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
         }
+        /**
+         * helper to match loginhints
+         * @param entity
+         * @param loginHint
+         * @returns
+         */
+        matchLoginHintWithTenantProfile(tenantProfile, loginHintFilter) {
+            return (tenantProfile.loginHint === loginHintFilter ||
+                tenantProfile.username === loginHintFilter ||
+                tenantProfile.upn === loginHintFilter);
+        }
         /**
          * helper to match assertion
          * @param value
@@ -3354,6 +3390,10 @@
             if (tokenClaims.upn === loginHint) {
                 return true;
             }
+            // check login hint against list of emails in token claims
+            if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
+                return true;
+            }
             return false;
         }
         /**
@@ -3505,7 +3545,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3556,7 +3596,7 @@
         "redirectBridgeMessageVersion",
     ]);
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3611,7 +3651,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3706,7 +3746,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3733,7 +3773,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3798,7 +3838,7 @@
         return cachedAtSec > nowSeconds();
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4057,7 +4097,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4128,7 +4168,7 @@
     const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
     const SetUserData = "setUserData";
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4221,7 +4261,7 @@
         };
     };
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4301,7 +4341,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4365,7 +4405,7 @@
         uxNotAllowed: uxNotAllowed
     });
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4433,7 +4473,7 @@
         return new InteractionRequiredAuthError(errorCode, errorMessage);
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4452,7 +4492,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4520,7 +4560,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4868,7 +4908,7 @@
         return baseAccount;
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4878,7 +4918,7 @@
         UPN: "UPN",
     };
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4896,7 +4936,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4917,7 +4957,7 @@
         };
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5003,7 +5043,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5034,7 +5074,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5148,7 +5188,7 @@
         return response;
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5160,7 +5200,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5170,7 +5210,7 @@
             response.hasOwnProperty("metadata"));
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5180,7 +5220,7 @@
             response.hasOwnProperty("error_description"));
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5285,7 +5325,7 @@
         },
     };
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6105,7 +6145,7 @@
         };
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6139,7 +6179,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6304,11 +6344,6 @@
                     throw createClientConfigurationError(missingSshJwk);
                 }
             }
-            if (!StringUtils.isEmptyObj(request.claims) ||
-                (this.config.authOptions.clientCapabilities &&
-                    this.config.authOptions.clientCapabilities.length > 0)) {
-                addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-            }
             let ccsCred = undefined;
             if (request.clientInfo) {
                 try {
@@ -6357,6 +6392,7 @@
                 });
             }
             instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
             return mapToQueryString(parameters);
         }
         /**
@@ -6400,7 +6436,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6590,11 +6626,6 @@
                     throw createClientConfigurationError(missingSshJwk);
                 }
             }
-            if (!StringUtils.isEmptyObj(request.claims) ||
-                (this.config.authOptions.clientCapabilities &&
-                    this.config.authOptions.clientCapabilities.length > 0)) {
-                addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-            }
             if (this.config.systemOptions.preventCorsPreflight &&
                 request.ccsCredential) {
                 switch (request.ccsCredential.type) {
@@ -6621,11 +6652,12 @@
                 });
             }
             instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
             return mapToQueryString(parameters);
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6741,7 +6773,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6756,7 +6788,7 @@
         },
     };
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6880,14 +6912,10 @@
         if (request.state) {
             addState(parameters, request.state);
         }
-        if (request.claims ||
-            (authOptions.clientCapabilities &&
-                authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, authOptions.clientCapabilities);
-        }
         if (request.embeddedClientId) {
             addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
         }
+        addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
         // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
         if (authOptions.instanceAware &&
             (!request.extraQueryParameters ||
@@ -6983,7 +7011,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7016,7 +7044,7 @@
         return Object.prototype.hasOwnProperty.call(params, "resource");
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7074,7 +7102,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7091,7 +7119,7 @@
         unexpectedError: unexpectedError
     });
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7352,7 +7380,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7373,7 +7401,7 @@
         return new JoseHeaderError(code);
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7381,7 +7409,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7421,7 +7449,7 @@
         }
     }
-    /*! @azure/msal-common v16.4.1 2026-04-01 */
+    /*! @azure/msal-common v16.5.1 2026-04-21 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8006,6 +8034,7 @@
      * Used to acquire a token from Native component when native brokering is enabled.
      */
     const NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
+    const NativeInteractionClientAcquireTokenRedirect = "nativeInteractionClientAcquireToken";
     /**
      * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
      */
@@ -8079,7 +8108,7 @@
      * Background telemetry measurement that tracks whether a late bridge response
      * arrives after the iframe timeout has already fired.
      */
-    const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
+    const WaitForBridgeLateResponse$1 = "waitForBridgeLateResponse";
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9005,7 +9034,7 @@
                 // Clear the active monitor
                 activeBridgeMonitor = null;
                 if (experimentalConfig?.iframeTimeoutTelemetry) {
-                    lateMeasurement = performanceClient.startMeasurement(WaitForBridgeLateResponse, correlationId);
+                    lateMeasurement = performanceClient.startMeasurement(WaitForBridgeLateResponse$1, correlationId);
                     timedOut$1 = true;
                     lateTimeoutId = window.setTimeout(() => {
                         lateMeasurement?.end({ success: false });
@@ -9806,7 +9835,14 @@
     // Update cache storage
     const LocalStorageUpdated = "localStorageUpdated";
     // Load external tokens
-    const LoadExternalTokens = "loadExternalTokens";
+    const LoadExternalTokens = "loadExternalTokens";
+    /**
+     * SSO capability verification call (msal-browser).
+     * Fire-and-forget SSO verification call made after interactive authentication completes.
+     */
+    const SsoCapable = "ssoCapable";
+    // Wait for late response from bridge after timeout has already occurred
+    const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
     var BrowserRootPerformanceEvents = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -9818,7 +9854,9 @@
         InitializeClientApplication: InitializeClientApplication,
         LoadExternalTokens: LoadExternalTokens,
         LocalStorageUpdated: LocalStorageUpdated,
-        SsoSilent: SsoSilent
+        SsoCapable: SsoCapable,
+        SsoSilent: SsoSilent,
+        WaitForBridgeLateResponse: WaitForBridgeLateResponse
     });
     /*
@@ -9828,8 +9866,8 @@
     const PREFIX = "msal";
     const BROWSER_PREFIX = "browser";
     const CACHE_KEY_SEPARATOR = "|";
-    const CREDENTIAL_SCHEMA_VERSION = 2;
-    const ACCOUNT_SCHEMA_VERSION = 2;
+    const CREDENTIAL_SCHEMA_VERSION = 3;
+    const ACCOUNT_SCHEMA_VERSION = 3;
     const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
     const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
     const BROWSER_PERF_ENABLED_KEY = `${PREFIX}.${BROWSER_PREFIX}.performance.enabled`;
@@ -9837,6 +9875,7 @@
     const VERSION_CACHE_KEY = `${PREFIX}.version`;
     const ACCOUNT_KEYS = "account.keys";
     const TOKEN_KEYS = "token.keys";
+    const SSO_CAPABLE = `${PREFIX}.${BROWSER_PREFIX}.sso.capable`;
     function getAccountKeysCacheKey(schema = ACCOUNT_SCHEMA_VERSION) {
         if (schema < 1) {
             return `${PREFIX}.${ACCOUNT_KEYS}`;
@@ -10335,7 +10374,7 @@
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "5.6.3";
+    const version = "5.8.0";
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10618,7 +10657,9 @@
                     }
                     await this.setUserData(newIdTokenKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
                     this.performanceClient.incrementFields({ migratedITCount: 1 }, correlationId);
-                    currentCredentialKeys.idToken.push(newIdTokenKey);
+                    if (!currentCredentialKeys.idToken.includes(newIdTokenKey)) {
+                        currentCredentialKeys.idToken.push(newIdTokenKey);
+                    }
                 }
             }
             this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
@@ -11467,10 +11508,8 @@
             return `${PREFIX}.${this.clientId}.${key}`;
         }
         /**
-         * Cache Key: msal.<schema_version>-<home_account_id>-<environment>-<credential_type>-<client_id or familyId>-<realm>-<scopes>-<claims hash>-<scheme>
-         * IdToken Example: uid.utid-login.microsoftonline.com-idtoken-app_client_id-contoso.com
-         * AccessToken Example: uid.utid-login.microsoftonline.com-accesstoken-app_client_id-contoso.com-scope1 scope2--pop
-         * RefreshToken Example: uid.utid-login.microsoftonline.com-refreshtoken-1-contoso.com
+         * Generate Credential Key. All changes to the key REQUIRE a schema version update.
+         * Cache Key: msal.<schema_version>|<home_account_id>|<environment>|<credential_type>|<client_id or familyId>|<realm>|<scopes>|<scheme>
          * @param credentialEntity
          * @returns
          */
@@ -12438,7 +12477,6 @@
     const USER_INTERACTION_REQUIRED = "USER_INTERACTION_REQUIRED";
     const USER_CANCEL = "USER_CANCEL";
     const NO_NETWORK = "NO_NETWORK";
-    const PERSISTENT_ERROR = "PERSISTENT_ERROR";
     const DISABLED = "DISABLED";
     const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
     const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
@@ -12462,8 +12500,7 @@
     function isFatalNativeAuthError(error) {
         if (error.ext &&
             error.ext.status &&
-            (error.ext.status === PERSISTENT_ERROR ||
-                error.ext.status === DISABLED)) {
+            error.ext.status === DISABLED) {
             return true;
         }
         if (error.ext &&
@@ -12589,12 +12626,12 @@
         async acquireToken(request, cacheLookupPolicy) {
             this.logger.trace("03qeos", this.correlationId);
             // start the perf measurement
-            const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, request.correlationId);
+            const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
             const reqTimestamp = nowSeconds();
             const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
             try {
                 // initialize native request
-                const nativeRequest = await this.initializeNativeRequest(request);
+                const nativeRequest = await this.initializePlatformRequest(request);
                 // check if the tokens can be retrieved from internal cache
                 try {
                     const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
@@ -12608,6 +12645,10 @@
                 catch (e) {
                     if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
                         this.logger.info("0eitbc", this.correlationId);
+                        nativeATMeasurement.end({
+                            success: false,
+                            brokerErrorCode: "cache_request_failed",
+                        });
                         throw e;
                     }
                     // continue with a native call for any and all errors
@@ -12629,7 +12670,6 @@
                         success: false,
                         errorCode: error.errorCode,
                         subErrorCode: error.subError,
-                        isNativeBroker: true,
                     });
                     throw error;
                 });
@@ -12638,6 +12678,9 @@
                 if (e instanceof NativeAuthError) {
                     serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                 }
+                nativeATMeasurement.end({
+                    success: false,
+                });
                 throw e;
             }
         }
@@ -12670,7 +12713,7 @@
             // fetch the account from browser cache
             const account = this.browserStorage.getBaseAccountInfo({
                 nativeAccountId,
-            }, request.correlationId);
+            }, this.correlationId);
             if (!account) {
                 throw createClientAuthError(noAccountFound);
             }
@@ -12678,13 +12721,14 @@
             try {
                 const silentRequest = this.createSilentCacheRequest(request, account);
                 const result = await this.silentCacheClient.acquireToken(silentRequest);
-                const fullAccount = {
-                    ...account,
-                    idTokenClaims: result?.idTokenClaims,
-                    idToken: result?.idToken,
-                };
+                const idToken = this.browserStorage.getIdToken(account, this.correlationId, this.browserStorage.getTokenKeys(), account.tenantId);
+                const idTokenClaims = extractTokenClaims(idToken?.secret || "", base64Decode);
+                const fullAccount = updateAccountTenantProfileData(account, undefined, // tenantProfile optional
+                idTokenClaims, idToken?.secret);
                 return {
                     ...result,
+                    idToken: idToken?.secret || "",
+                    idTokenClaims: idTokenClaims,
                     account: fullAccount,
                 };
             }
@@ -12700,7 +12744,7 @@
          */
         async acquireTokenRedirect(request, rootMeasurement, options) {
             this.logger.trace("0luikq", this.correlationId);
-            const nativeRequest = await this.initializeNativeRequest(request);
+            const nativeRequest = await this.initializePlatformRequest(request);
             const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
             try {
                 await this.platformAuthProvider.sendMessage(nativeRequest);
@@ -12732,7 +12776,7 @@
          * @param performanceClient {IPerformanceClient?}
          * @param correlationId {string?} correlation identifier
          */
-        async handleRedirectPromise(performanceClient, correlationId) {
+        async handleRedirectPromise() {
             this.logger.trace("1c5lhw", this.correlationId);
             if (!this.browserStorage.isInteractionInProgress(true)) {
                 this.logger.info("0le6uv", this.correlationId);
@@ -12742,9 +12786,7 @@
             const cachedRequest = this.browserStorage.getCachedNativeRequest();
             if (!cachedRequest) {
                 this.logger.verbose("0a6zjb", this.correlationId);
-                if (performanceClient && correlationId) {
-                    performanceClient?.addFields({ errorCode: "no_cached_request" }, correlationId);
-                }
+                this.performanceClient?.addFields({ errorCode: "no_cached_request" }, this.correlationId);
                 return null;
             }
             const { prompt, ...request } = cachedRequest;
@@ -12759,6 +12801,7 @@
                 const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
                 const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
                 serverTelemetryManager.clearNativeBrokerErrorCode();
+                this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
                 return authResult;
             }
             catch (e) {
@@ -12808,7 +12851,8 @@
             const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
             // cache accounts and tokens in the appropriate storage
             await this.cacheAccount(baseAccount, isKmsi(idTokenClaims));
-            await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
+            await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.tenantId, reqTimestamp, authority.getPreferredCache() // environment
+            );
             return result;
         }
         /**
@@ -12947,8 +12991,8 @@
          * @param tenantId
          * @param reqTimestamp
          */
-        cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, responseAccessToken, tenantId, reqTimestamp) {
-            const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || "", request.clientId, idTokenClaims.tid || "");
+        async cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, tenantId, reqTimestamp, environment) {
+            const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, environment, response.id_token || "", request.clientId, idTokenClaims.tid || "");
             // cache accessToken in inmemory storage
             const expiresIn = request.tokenType === AuthenticationScheme$1.POP
                 ? SHR_NONCE_VALIDITY
@@ -12957,9 +13001,13 @@
                     : response.expires_in) || 0;
             const tokenExpirationSeconds = reqTimestamp + expiresIn;
             const responseScopes = this.generateScopes(response.scope, request.scope);
-            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+            // save idtoken credential in configured browser storage
+            if (!!cachedIdToken && request.storeInCache?.idToken !== false) {
+                await this.browserStorage.setIdTokenCredential(cachedIdToken, this.correlationId, isKmsi(idTokenClaims));
+            }
+            // save access token credential in memory storage
             const nativeCacheRecord = {
-                idToken: cachedIdToken,
                 accessToken: cachedAccessToken,
             };
             return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), this.apiId, request.storeInCache);
@@ -13027,15 +13075,23 @@
          * Translates developer provided request object into NativeRequest object
          * @param request
          */
-        async initializeNativeRequest(request) {
-            this.logger.trace("04j6wj", this.correlationId);
+        async initializePlatformRequest(request) {
+            this.logger.trace("1xdm2a", this.correlationId);
             const canonicalAuthority = await this.getCanonicalAuthority(request);
+            // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+            const configClaims = request.skipBrokerClaims && !!request.embeddedClientId
+                ? undefined
+                : this.config.auth.clientCapabilities;
             // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
-            const { scopes, ...remainingProperties } = request;
+            const { scopes, claims, ...remainingProperties } = request;
             const scopeSet = new ScopeSet(scopes || []);
             scopeSet.appendScopes(OIDC_DEFAULT_SCOPES$1);
+            const mergedClaims = configClaims && configClaims.length
+                ? addClientCapabilitiesToClaims$1(claims, configClaims)
+                : claims;
             const validatedRequest = {
                 ...remainingProperties,
+                claims: mergedClaims,
                 accountId: this.accountId,
                 clientId: this.config.auth.clientId,
                 authority: canonicalAuthority.urlString,
@@ -13105,12 +13161,12 @@
             switch (this.apiId) {
                 case ApiId.ssoSilent:
                 case ApiId.acquireTokenSilent_silentFlow:
-                    this.logger.trace("1hiwaz", this.correlationId);
+                    this.logger.trace("12n1y2", this.correlationId);
                     return PromptValue$1.NONE;
             }
             // Prompt not provided, request may proceed and native broker decides if it needs to prompt
             if (!prompt) {
-                this.logger.trace("1qlu04", this.correlationId);
+                this.logger.trace("0uid1p", this.correlationId);
                 return undefined;
             }
             // If request is interactive, check if prompt provided is allowed to go directly to native broker
@@ -13118,10 +13174,10 @@
                 case PromptValue$1.NONE:
                 case PromptValue$1.CONSENT:
                 case PromptValue$1.LOGIN:
-                    this.logger.trace("1ynje4", this.correlationId);
+                    this.logger.trace("0i0hco", this.correlationId);
                     return prompt;
                 default:
-                    this.logger.trace("0nkr6q", this.correlationId);
+                    this.logger.trace("0w3tpw", this.correlationId);
                     throw createBrowserAuthError(nativePromptNotSupported);
             }
         }
@@ -13157,7 +13213,7 @@
             this.performanceClient?.addFields({
                 embeddedClientId: child_client_id,
                 embeddedRedirectUri: child_redirect_uri,
-            }, request.correlationId);
+            }, this.correlationId);
         }
     }
@@ -13244,6 +13300,10 @@
         if (request.platformBroker) {
             // signal ests that this is a WAM call
             addNativeBroker(parameters);
+            // instrument JS-platform bridge specific fields
+            performanceClient.addFields({
+                isPlatformAuthorizeRequest: true,
+            }, request.correlationId);
             // pass the req_cnf for POP
             if (request.authenticationScheme === AuthenticationScheme$1.POP) {
                 const cryptoOps = new CryptoOps(logger, performanceClient);
@@ -13713,6 +13773,7 @@
             },
             instanceAware: false,
             isMcp: false,
+            verifySSO: false,
         };
         // Default cache options for browser
         const DEFAULT_CACHE_OPTIONS = {
@@ -13807,7 +13868,7 @@
             this.messageChannel = new MessageChannel();
             this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
             this.performanceClient = performanceClient;
-            this.handshakeEvent = performanceClient.startMeasurement(NativeMessageHandlerHandshake);
+            this.handshakeEvent = this.performanceClient.startMeasurement(NativeMessageHandlerHandshake);
             this.platformAuthType =
                 PlatformAuthConstants.PLATFORM_EXTENSION_PROVIDER;
         }
@@ -14265,7 +14326,7 @@
         }
     }
     /**
-     * Returns boolean indicating whether or not the request should attempt to use native broker
+     * Returns boolean indicating whether or not the request should attempt to use platform broker
      * @param logger
      * @param config
      * @param correlationId
@@ -14547,6 +14608,10 @@
                         return;
                     }
                 }
+                // Redirect bridge requires "state" param to work properly
+                validRequest.state = setRequestState(this.browserCrypto, validRequest.state || "", {
+                    interactionType: exports.InteractionType.Popup,
+                });
                 // Create logout string and navigate user window to logout.
                 const logoutUri = authClient.getLogoutUri(validRequest);
                 this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, validRequest.correlationId, exports.InteractionType.Popup, validRequest);
@@ -15087,6 +15152,10 @@
                         }
                     }
                 }
+                // Redirect bridge requires "state" param to work properly
+                validLogoutRequest.state = setRequestState(this.browserCrypto, validLogoutRequest.state || "", {
+                    interactionType: exports.InteractionType.Redirect,
+                });
                 // Create logout string and navigate user window to logout.
                 const logoutUri = authClient.getLogoutUri(validLogoutRequest);
                 if (validLogoutRequest.account?.homeAccountId) {
@@ -15335,6 +15404,38 @@
                 return invokeAsync(handleResponseEAR, HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
             }
         }
+        /**
+         * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+         * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+         * @param request - The SSO silent request
+         * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+         */
+        async verifySso(request) {
+            const inputRequest = { ...request };
+            if (!inputRequest.prompt) {
+                inputRequest.prompt = PromptValue$1.NONE;
+            }
+            // Create silent request
+            const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, exports.InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
+            const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
+                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger),
+                requestAuthority: silentRequest.authority,
+                requestAzureCloudOptions: silentRequest.azureCloudOptions,
+                requestExtraQueryParameters: silentRequest.extraQueryParameters,
+                account: silentRequest.account,
+            });
+            const { serverParams } = await this.silentAuthorizeHelper(authClient, silentRequest);
+            const correlationId = silentRequest.correlationId;
+            // Validate the response - this checks for errors and validates state
+            validateAuthorizationResponse(serverParams, silentRequest.state);
+            // Verify a valid authorization code is present
+            if (!serverParams.code) {
+                this.logger.warning("0y34ti", correlationId);
+                return false;
+            }
+            this.logger.verbose("0kkkcj", correlationId);
+            return true;
+        }
         /**
          * Currently Unsupported
          */
@@ -15349,6 +15450,16 @@
          * @param userRequestScopes
          */
         async silentTokenHelper(authClient, request) {
+            const { serverParams, pkceCodes } = await this.silentAuthorizeHelper(authClient, request);
+            return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, request.correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        }
+        /**
+         * Shared helper that generates PKCE codes, builds the /authorize URL,
+         * loads it in a hidden iframe, waits for the redirect-bridge response,
+         * and returns the deserialized server parameters along with the PKCE codes
+         * and the request that was sent.
+         */
+        async silentAuthorizeHelper(authClient, request) {
             const correlationId = request.correlationId;
             const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
             const silentRequest = {
@@ -15375,7 +15486,7 @@
                 invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
             }
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
-            return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+            return { serverParams, pkceCodes, silentRequest };
         }
     }
@@ -15754,22 +15865,25 @@
             }
             const loggedInAccounts = this.getAllAccounts();
             const platformBrokerRequest = this.browserStorage.getCachedNativeRequest();
-            const useNative = platformBrokerRequest &&
-                this.platformAuthProvider &&
-                !options?.hash;
+            const useNative = platformBrokerRequest && !options?.hash;
             let rootMeasurement;
             let redirectResponse;
+            let cachedRedirectRequest;
             try {
                 if (useNative && this.platformAuthProvider) {
                     const correlationId = platformBrokerRequest?.correlationId || "";
                     this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, exports.InteractionType.Redirect);
                     rootMeasurement = this.performanceClient.startMeasurement(AcquireTokenRedirect, correlationId);
                     this.logger.trace("12v7is", correlationId);
+                    rootMeasurement.add({
+                        isPlatformBrokerRequest: true,
+                    });
                     const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.platformAuthProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
-                    redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
+                    redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)();
                 }
                 else {
                     const [standardRequest, codeVerifier] = this.browserStorage.getCachedRequest("");
+                    cachedRedirectRequest = standardRequest;
                     const correlationId = standardRequest.correlationId;
                     this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, exports.InteractionType.Redirect);
                     // Reset rootMeasurement now that we have correlationId
@@ -15798,6 +15912,8 @@
                     rootMeasurement.end({
                         success: true,
                     }, undefined, result.account);
+                    // Fire-and-forget SSO capability verification in background
+                    this.verifySsoCapability(cachedRedirectRequest, exports.InteractionType.Redirect);
                 }
                 else {
                     /*
@@ -15863,12 +15979,14 @@
                 if (this.platformAuthProvider &&
                     this.canUsePlatformBroker(request)) {
                     const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.platformAuthProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-                    result = nativeClient
-                        .acquireTokenRedirect(request, atrMeasurement)
-                        .catch((e) => {
+                    result = invokeAsync(nativeClient.acquireTokenRedirect.bind(nativeClient), NativeInteractionClientAcquireTokenRedirect, this.logger, this.performanceClient, correlationId)(request, atrMeasurement).catch((e) => {
+                        atrMeasurement.add({
+                            brokerErrorName: e.name,
+                            brokerErrorCode: e.errorCode,
+                        });
                         if (e instanceof NativeAuthError &&
                             isFatalNativeAuthError(e)) {
-                            this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                            this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                             const redirectClient = this.createRedirectClient(correlationId);
                             return redirectClient.acquireToken(request);
                         }
@@ -15934,6 +16052,9 @@
             let result;
             const pkce = this.getPreGeneratedPkceCodes(correlationId);
             if (this.canUsePlatformBroker(request)) {
+                atPopupMeasurement.add({
+                    isPlatformBrokerRequest: true,
+                });
                 result = this.acquireTokenNative({
                     ...request,
                     correlationId,
@@ -15946,9 +16067,13 @@
                     return response;
                 })
                     .catch((e) => {
+                    atPopupMeasurement.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    });
                     if (e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)) {
-                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                         const popupClient = this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request, pkce);
                     }
@@ -15979,6 +16104,8 @@
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
                 }, undefined, result.account);
+                // SSO capability verification in background
+                this.verifySsoCapability(request, exports.InteractionType.Popup);
                 return result;
             })
                 .catch((e) => {
@@ -16031,6 +16158,103 @@
             window.removeEventListener("online", listener);
             window.removeEventListener("offline", listener);
         }
+        /**
+         * Reads the cached ssoCapable value from localStorage.
+         * @returns The cached ssoCapable boolean value, or undefined if not cached or expired.
+         */
+        getCachedSsoCapable() {
+            try {
+                const cachedValue = window.localStorage.getItem(SSO_CAPABLE);
+                if (cachedValue) {
+                    const parsed = JSON.parse(cachedValue);
+                    if (parsed &&
+                        typeof parsed.ssoCapable === "boolean" &&
+                        parsed.expiresOn &&
+                        Date.now() < parsed.expiresOn) {
+                        return parsed.ssoCapable;
+                    }
+                }
+            }
+            catch {
+                // If parsing fails, return undefined
+            }
+            return undefined;
+        }
+        /**
+         * SSO capability verification in the background.
+         * This method makes an iframe request to /authorize to verify SSO capability without calling /token.
+         * This method does not block the caller and tracks telemetry for success/failure.
+         * This method only executes if verifySSO is set to true in the auth configuration.
+         * The result is cached in localStorage with a 24-hour TTL; the SSO verification call
+         * is only attempted when the cached value is absent or expired.
+         * @param request - The original request used for the authentication flow
+         * @param interactionType - The interactionType of the AT operation for logging purposes
+         */
+        verifySsoCapability(request, interactionType) {
+            // Check if SSO capability verification is enabled
+            if (!this.config.auth.verifySSO) {
+                return;
+            }
+            // Check TTL: derive ssoCapable state from localStorage and skip if not expired
+            const ssoCacheKey = SSO_CAPABLE;
+            const SSO_CAPABLE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+            const cachedSsoCapable = this.getCachedSsoCapable();
+            if (cachedSsoCapable !== undefined) {
+                this.logger.verbose("13poou", "");
+                return;
+            }
+            const correlationId = createNewGuid();
+            const ssoCapableMeasurement = this.performanceClient.startMeasurement(SsoCapable, correlationId);
+            ssoCapableMeasurement.add({
+                "ext.interactionType": interactionType,
+            });
+            this.logger.verbose("0pbr0i", correlationId);
+            /*
+             * Use setTimeout to ensure this runs in a separate macrotask after the current call stack completes
+             * This ensures the result is returned to the caller before the SSO verification starts and doesn't affect performance
+             */
+            setTimeout(() => {
+                const ssoVerificationRequest = {
+                    ...request,
+                    correlationId: correlationId,
+                };
+                const silentIframeClient = this.createSilentIframeClient(correlationId);
+                silentIframeClient
+                    .verifySso(ssoVerificationRequest)
+                    .then((result) => {
+                    this.logger.verbose("1gd1iv", correlationId);
+                    // TBD to add profileTelemetry later in localStorage with 24h TTL
+                    try {
+                        const cacheEntry = JSON.stringify({
+                            ssoCapable: result,
+                            expiresOn: Date.now() + SSO_CAPABLE_TTL_MS,
+                        });
+                        window.localStorage.setItem(ssoCacheKey, cacheEntry);
+                    }
+                    catch {
+                        this.logger.warning("18lmoj", correlationId);
+                    }
+                    ssoCapableMeasurement.end({
+                        fromCache: false,
+                        success: result,
+                    }, undefined);
+                })
+                    .catch((error) => {
+                    this.logger.warning("05g83w", correlationId);
+                    // reset the cache
+                    try {
+                        window.localStorage.removeItem(ssoCacheKey);
+                    }
+                    catch {
+                        this.logger.warning("0nlf9q", correlationId);
+                    }
+                    ssoCapableMeasurement.end({
+                        fromCache: false,
+                        success: false,
+                    }, error);
+                });
+            }, 0);
+        }
         // #endregion
         // #region Silent Flow
         /**
@@ -16052,13 +16276,12 @@
             const correlationId = this.getRequestCorrelationId(request);
             const validRequest = {
                 ...request,
-                // will be PromptValue.NONE or PromptValue.NO_SESSION
-                prompt: request.prompt,
                 correlationId: correlationId,
             };
             this.ssoSilentMeasurement = this.performanceClient.startMeasurement(SsoSilent, correlationId);
             this.ssoSilentMeasurement?.add({
                 scenarioId: request.scenarioId,
+                ssoCapable: this.getCachedSsoCapable(),
             });
             preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
             this.ssoSilentMeasurement?.increment({
@@ -16071,10 +16294,17 @@
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Silent, validRequest);
             let result;
             if (this.canUsePlatformBroker(validRequest)) {
+                this.ssoSilentMeasurement?.add({
+                    isPlatformBrokerRequest: true,
+                });
                 result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
+                    this.ssoSilentMeasurement?.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    });
                     // If native token acquisition fails for availability reasons fallback to standard flow
                     if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
-                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                         const silentIframeClient = this.createSilentIframeClient(validRequest.correlationId);
                         return silentIframeClient.acquireToken(validRequest);
                     }
@@ -16147,7 +16377,6 @@
                             this.hybridAuthCodeResponses.delete(hybridAuthCode);
                             atbcMeasurement.end({
                                 success: true,
-                                isNativeBroker: result.fromPlatformBroker,
                                 accessTokenSize: result.accessToken.length,
                                 idTokenSize: result.idToken.length,
                             }, undefined, result.account);
@@ -16171,10 +16400,17 @@
                 }
                 else if (request.nativeAccountId) {
                     if (this.canUsePlatformBroker(request, request.nativeAccountId)) {
+                        atbcMeasurement.add({
+                            isPlatformBrokerRequest: true,
+                        });
                         const result = await this.acquireTokenNative({
                             ...request,
                             correlationId,
                         }, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
+                            atbcMeasurement.add({
+                                brokerErrorName: e.name,
+                                brokerErrorCode: e.errorCode,
+                            });
                             // If native token acquisition fails for availability reasons fallback to standard flow
                             if (e instanceof NativeAuthError &&
                                 isFatalNativeAuthError(e)) {
@@ -16225,7 +16461,6 @@
                 this.acquireTokenByCodeAsyncMeasurement?.end({
                     success: true,
                     fromCache: response.fromCache,
-                    isNativeBroker: response.fromPlatformBroker,
                 });
                 return response;
             })
@@ -16374,9 +16609,25 @@
             const accountEntity = createAccountEntityFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
             await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims), ApiId.hydrateCache);
             if (result.fromPlatformBroker) {
-                this.logger.verbose("1fxyu8", result.correlationId);
-                // Tokens from native broker are stored in-memory
-                return this.nativeInternalStorage.hydrateCache(result, request);
+                this.logger.verbose("1i5atf", result.correlationId);
+                // Create idToken entity and store in browser storage
+                const idTokenEntity = createIdTokenEntity(result.account.homeAccountId, result.account.environment, result.idToken, this.config.auth.clientId, result.tenantId);
+                // Create accessToken entity and store in native internal storage
+                const accessTokenEntity = createAccessTokenEntity(result.account.homeAccountId, result.account.environment, result.accessToken, this.config.auth.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn
+                    ? toSecondsFromDate(result.expiresOn)
+                    : 0, result.extExpiresOn
+                    ? toSecondsFromDate(result.extExpiresOn)
+                    : 0, base64Decode, undefined, // refreshOn
+                result.tokenType, undefined, // userAssertionHash
+                request.sshKid);
+                if (request.resource) {
+                    accessTokenEntity.resource = request.resource;
+                }
+                const kmsi = isKmsi(result.idTokenClaims);
+                // Store idToken in browser storage
+                await this.browserStorage.setIdTokenCredential(idTokenEntity, result.correlationId, kmsi);
+                // Store accessToken in native internal storage
+                await this.nativeInternalStorage.setAccessTokenCredential(accessTokenEntity, result.correlationId, kmsi);
             }
             else {
                 return this.browserStorage.hydrateCache(result, request);
@@ -16394,7 +16645,7 @@
                 throw createBrowserAuthError(nativeConnectionNotEstablished);
             }
             const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.platformAuthProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-            return nativeClient.acquireToken(request, cacheLookupPolicy);
+            return invokeAsync(nativeClient.acquireToken.bind(nativeClient), NativeInteractionClientAcquireToken, this.logger, this.performanceClient, correlationId)(request, cacheLookupPolicy);
         }
         /**
          * Returns boolean indicating if this request can use the platform broker
@@ -16408,7 +16659,7 @@
                 return false;
             }
             if (!isPlatformAuthAllowed(this.config, this.logger, correlationId, this.platformAuthProvider, request.authenticationScheme)) {
-                this.logger.trace("1m4bzf", correlationId);
+                this.logger.trace("0yoy1g", correlationId);
                 return false;
             }
             if (request.prompt) {
@@ -16440,7 +16691,9 @@
                     loginHint: request.loginHint,
                     sid: request.sid,
                 }) ||
-                this.getActiveAccount();
+                (!request.loginHint && !request.sid
+                    ? this.getActiveAccount()
+                    : null);
             return (account && account.nativeAccountId) || "";
         }
         /**
@@ -16627,6 +16880,7 @@
             atsMeasurement.add({
                 cacheLookupPolicy: request.cacheLookupPolicy,
                 scenarioId: request.scenarioId,
+                ssoCapable: this.getCachedSsoCapable(),
             });
             preflightCheck(this.initialized, atsMeasurement, this.config, request);
             this.logger.verbose("0x1c4s", correlationId);
@@ -16639,7 +16893,6 @@
                 atsMeasurement.end({
                     success: true,
                     fromCache: result.fromCache,
-                    isNativeBroker: result.fromPlatformBroker,
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
                 }, undefined, result.account);
@@ -16799,7 +17052,12 @@
             if (isPlatformAuthAllowed(this.config, this.logger, silentRequest.correlationId, this.platformAuthProvider, silentRequest.authenticationScheme) &&
                 silentRequest.account.nativeAccountId) {
                 this.logger.verbose("0sczo4", silentRequest.correlationId);
+                this.performanceClient.addFields({ isPlatformBrokerRequest: true }, silentRequest.correlationId);
                 return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
+                    this.performanceClient.addFields({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    }, silentRequest.correlationId);
                     // If native token acquisition fails for availability reasons fallback to web flow
                     if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                         this.logger.verbose("07rkmb", silentRequest.correlationId);