@cosmotech/core 3.0.1 → 3.0.2

package/dist/index.cjs.js

@@ -42502,7 +42502,7 @@ var AuthDev = {
   acquireTokensByRequest
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -42776,7 +42776,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -42787,7 +42787,7 @@ const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 const unexpectedError = "unexpected_error";
 const postRequestFailed$1 = "post_request_failed";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -42822,7 +42822,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -42873,7 +42873,7 @@ const methodNotImplemented = "method_not_implemented";
 const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
 const platformBrokerError = "platform_broker_error";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -42948,7 +42948,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -42987,7 +42987,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -43178,12 +43178,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /* eslint-disable header/header */
 const name$2 = "@azure/msal-common";
-const version$1 = "15.14.2";
+const version$1 = "15.16.1";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -43192,7 +43192,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -43222,7 +43222,7 @@ const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
 const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -43268,7 +43268,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -43363,9 +43363,48 @@ class StringUtils {
             .replace(/\?/g, "\\?"));
         return regex.test(input);
     }
+    /**
+     * Tests if a given string matches a given pattern using stricter, anchored matching semantics.
+     *
+     * Differences from `matchPattern` (legacy):
+     * - All regex metacharacters (including `.`) in the pattern are treated as literals,
+     *   so `example.com` matches only `example.com` and not `exampleXcom`.
+     * - The generated regex is anchored with `^` and `$` so partial/substring matches
+     *   are not allowed.
+     * - `*` is the only supported wildcard. Its behaviour depends on the URL component:
+     *   - `host` component: `*` matches any sequence of characters that does NOT include
+     *     a dot (`.`), keeping wildcards within a single DNS label boundary.
+     *   - All other components: `*` matches any sequence of characters (including `/`).
+     *
+     * @param pattern - The `protectedResourceMap` key pattern to match against. `*` is a
+     *   multi-character wildcard; all other characters are treated as literals.
+     * @param input - The URL component value (e.g. host, pathname) extracted from the
+     *   outgoing request URL to test against the pattern.
+     * @param options - Optional. Provide `component` to enable component-aware wildcard
+     *   semantics. Accepted values: `"host"`, `"path"`, `"protocol"`, `"search"`,
+     *   `"hash"`. Defaults to path-style (permissive) matching when omitted.
+     * @returns `true` if the full input string matches the pattern; `false` otherwise.
+     */
+    static matchPatternStrict(pattern, input, options) {
+        const component = options?.component;
+        // Step 1: Escape all regex special characters so literals are matched literally.
+        let regexBody = pattern.replace(/[.+^${}()|[\]\\*?]/g, "\\$&");
+        // Step 2: Replace the escaped '*' with its component-aware regex equivalent.
+        if (component === "host") {
+            regexBody = regexBody.replace(/\\\*/g, "[^.]*");
+        }
+        else {
+            // PATH, PROTOCOL, SEARCH, HASH, or unspecified: '*' matches any characters.
+            regexBody = regexBody.replace(/\\\*/g, ".*");
+        }
+        // Step 3: Anchor for full-string matching.
+        // eslint-disable-next-line security/detect-non-literal-regexp
+        const regex = new RegExp(`^${regexBody}$`);
+        return regex.test(input);
+    }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -43560,7 +43599,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -43600,7 +43639,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -43682,7 +43721,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -43697,7 +43736,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -43719,7 +43758,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -43743,7 +43782,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -43978,7 +44017,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -44059,7 +44098,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -44175,7 +44214,7 @@ function normalizeUrlForComparison(url) {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -44339,7 +44378,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -44514,7 +44553,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -44522,7 +44561,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -44567,7 +44606,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -45677,7 +45716,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -45939,6 +45978,11 @@ const PerformanceEvents = {
     LoadIdToken: "loadIdToken",
     LoadAccessToken: "loadAccessToken",
     LoadRefreshToken: "loadRefreshToken",
+    /**
+     * SSO capability verification call (msal-browser).
+     * Fire-and-forget SSO verification call made after interactive authentication completes.
+     */
+    SsoCapable: "ssoCapable",
 };
 /**
  * State of the performance event.
@@ -45949,7 +45993,7 @@ const PerformanceEvents = {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -46028,7 +46072,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -46128,7 +46172,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -46138,7 +46182,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -46188,7 +46232,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -46568,7 +46612,7 @@ function addPostBodyParameters(parameters, bodyParameters) {
     });
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -46580,7 +46624,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -46590,7 +46634,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -46600,7 +46644,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -46696,7 +46740,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -46802,7 +46846,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -46867,7 +46911,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -47129,7 +47173,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -47968,7 +48012,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -47999,7 +48043,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -48018,7 +48062,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -48039,7 +48083,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -48126,7 +48170,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -48157,7 +48201,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -48305,23 +48349,58 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-// Codes defined by MSAL
+/**
+ * MSAL-defined interaction required error code indicating no tokens are found in cache.
+ * @public
+ */
 const noTokensFound = "no_tokens_found";
+/**
+ * MSAL-defined error code indicating a native account is unavailable on the platform.
+ * @public
+ */
 const nativeAccountUnavailable = "native_account_unavailable";
+/**
+ * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
+ * @public
+ */
 const refreshTokenExpired = "refresh_token_expired";
+/**
+ * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
+ * @public
+ */
 const uxNotAllowed = "ux_not_allowed";
-// Codes potentially returned by server
+/**
+ * Server-originated error code indicating interaction is required to complete the request.
+ * @public
+ */
 const interactionRequired = "interaction_required";
+/**
+ * Server-originated error code indicating user consent is required.
+ * @public
+ */
 const consentRequired = "consent_required";
+/**
+ * Server-originated error code indicating user login is required.
+ * @public
+ */
 const loginRequired = "login_required";
-const badToken = "bad_token";
+/**
+ * Server-originated error code indicating the token is invalid or corrupted.
+ * @public
+ */
+const badToken = "bad_token";
+/**
+ * Server-originated error code indicating the user was interrupted and must reattempt the flow.
+ * @public
+ */
+const interruptedUser = "interrupted_user";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -48336,6 +48415,7 @@ const InteractionRequiredServerErrorMessage = [
     loginRequired,
     badToken,
     uxNotAllowed,
+    interruptedUser,
 ];
 const InteractionRequiredAuthSubErrorMessage = [
     "message_only",
@@ -48344,6 +48424,7 @@ const InteractionRequiredAuthSubErrorMessage = [
     "user_password_expired",
     "consent_required",
     "bad_token",
+    "interrupted_user",
 ];
 const InteractionRequiredAuthErrorMessages = {
     [noTokensFound]: "No refresh token found in the cache. Please sign-in.",
@@ -48351,6 +48432,7 @@ const InteractionRequiredAuthErrorMessages = {
     [refreshTokenExpired]: "Refresh token has expired.",
     [badToken]: "Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",
     [uxNotAllowed]: "`canShowUI` flag in Edge was set to false. User interaction required on web page. Please invoke an interactive API to resolve.",
+    [interruptedUser]: "The user could not be authenticated due to an interrupted state. Please invoke an interactive API to resolve.",
 };
 /**
  * Error thrown when user interaction is required.
@@ -48393,7 +48475,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -48465,7 +48547,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -48547,7 +48629,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -48574,7 +48656,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -48913,7 +48995,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -48931,7 +49013,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -49080,11 +49162,6 @@ class AuthorizationCodeClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         let ccsCred = undefined;
         if (request.clientInfo) {
             try {
@@ -49134,6 +49211,15 @@ class AuthorizationCodeClient extends BaseClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims &&
+            parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : this.config.authOptions.clientCapabilities;
+        if (!StringUtils.isEmptyObj(request.claims) ||
+            (configClaims && configClaims.length > 0)) {
+            addClaims(parameters, request.claims, configClaims);
+        }
         return mapToQueryString(parameters);
     }
     /**
@@ -49167,7 +49253,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -49345,11 +49431,6 @@ class RefreshTokenClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
             switch (request.ccsCredential.type) {
@@ -49375,11 +49456,20 @@ class RefreshTokenClient extends BaseClient {
             addExtraQueryParameters(parameters, request.tokenBodyParameters);
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims &&
+            parameters.has(BROKER_CLIENT_ID)
+            ? undefined
+            : this.config.authOptions.clientCapabilities;
+        if (!StringUtils.isEmptyObj(request.claims) ||
+            (configClaims && configClaims.length > 0)) {
+            addClaims(parameters, request.claims, configClaims);
+        }
         return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -49477,7 +49567,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -49492,7 +49582,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -49613,14 +49703,17 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.state) {
         addState(parameters, request.state);
     }
-    if (request.claims ||
-        (authOptions.clientCapabilities &&
-            authOptions.clientCapabilities.length > 0)) {
-        addClaims(parameters, request.claims, authOptions.clientCapabilities);
-    }
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
+    // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+    const configClaims = request.skipBrokerClaims &&
+        parameters.has(BROKER_CLIENT_ID)
+        ? undefined
+        : authOptions.clientCapabilities;
+    if (request.claims || (configClaims && configClaims.length > 0)) {
+        addClaims(parameters, request.claims, configClaims);
+    }
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -49716,7 +49809,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -49979,7 +50072,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -49987,7 +50080,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -50012,7 +50105,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.14.2 2026-02-10 */
+/*! @azure/msal-common v15.16.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -50052,7 +50145,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -50109,7 +50202,7 @@ const failedToParseHeaders = "failed_to_parse_headers";
 const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
 const timedOut = "timed_out";
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -50186,7 +50279,7 @@ function createBrowserAuthError(errorCode, subError) {
     return new BrowserAuthError(errorCode, subError);
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -50375,7 +50468,7 @@ const iFrameRenewalPolicies = [
     CacheLookupPolicy.RefreshTokenAndNetwork,
 ];
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -50420,7 +50513,7 @@ function base64EncArr(aBytes) {
     return btoa(binString);
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -50459,7 +50552,7 @@ function base64DecToArr(base64String) {
     return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -50758,7 +50851,7 @@ async function hashString(plainText) {
     return urlEncodeArr(hashBytes);
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -50767,7 +50860,7 @@ const storageNotSupported = "storage_not_supported";
 const stubbedPublicClientApplicationCalled = "stubbed_public_client_application_called";
 const inMemRedirectUnavailable = "in_mem_redirect_unavailable";
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -50807,7 +50900,7 @@ function createBrowserConfigurationAuthError(errorCode) {
     return new BrowserConfigurationAuthError(errorCode, BrowserConfigurationAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -50969,7 +51062,7 @@ function createGuid() {
     return createNewGuid();
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -51012,7 +51105,7 @@ class NavigationClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -51133,7 +51226,7 @@ function getHeaderDict(headers) {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -51182,6 +51275,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         supportsNestedAppAuth: false,
         instanceAware: false,
         encodeExtraQueryParams: false,
+        verifySSO: false,
     };
     // Default cache options for browser
     const DEFAULT_CACHE_OPTIONS = {
@@ -51268,12 +51362,12 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
     return overlayedConfig;
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-browser";
-const version = "4.28.2";
+const version = "4.29.1";
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -51301,7 +51395,7 @@ function getTokenKeysCacheKey(clientId, schema = CREDENTIAL_SCHEMA_VERSION) {
     return `${PREFIX}.${schema}.${TOKEN_KEYS}.${clientId}`;
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -51398,7 +51492,7 @@ class BaseOperatingContext {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -51444,7 +51538,7 @@ StandardOperatingContext.MODULE_NAME = "";
  */
 StandardOperatingContext.ID = "StandardOperatingContext";
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -51647,7 +51741,7 @@ class DatabaseStorage {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -51693,7 +51787,7 @@ class MemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -51827,7 +51921,7 @@ class AsyncMemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -52008,7 +52102,7 @@ function getSortedObjectString(obj) {
     return JSON.stringify(obj, Object.keys(obj).sort());
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -52086,7 +52180,7 @@ function getCookieExpirationTime(cookieLifeDays) {
     return expr.toUTCString();
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -52128,7 +52222,7 @@ function getTokenKeys(clientId, storage, schemaVersion) {
     };
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -52139,7 +52233,7 @@ function isEncrypted(data) {
         data.hasOwnProperty("data"));
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -52429,7 +52523,7 @@ class LocalStorage {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -52471,7 +52565,7 @@ class SessionStorage {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -52506,7 +52600,7 @@ const EventType = {
     BROKER_CONNECTION_ESTABLISHED: "msal:brokerConnectionEstablished",
 };
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -52523,7 +52617,7 @@ function removeElementFromArray(array, element) {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -53938,7 +54032,7 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient, even
     return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger, performanceClient, eventHandler);
 };
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -54063,7 +54157,7 @@ function getActiveAccount(browserStorage, correlationId) {
     return browserStorage.getActiveAccount(correlationId);
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -54169,7 +54263,7 @@ class EventHandler {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -54285,7 +54379,7 @@ class BaseInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -54370,7 +54464,7 @@ function validateRequestMethod(interactionRequest, protocolMode) {
     return httpMethod;
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -54542,6 +54636,10 @@ class StandardInteractionClient extends BaseInteractionClient {
     async initializeAuthorizationRequest(request, interactionType) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.correlationId);
         const redirectUri = this.getRedirectUri(request.redirectUri);
+        if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
+            this.logger.warning("The origin of the redirect URI does not match the origin of the current page. This is likely to cause issues with authentication.", this.correlationId);
+            this.performanceClient.addFields({ isRedirectUriCrossOrigin: true }, this.correlationId);
+        }
         const browserState = {
             interactionType: interactionType,
         };
@@ -54574,7 +54672,7 @@ class StandardInteractionClient extends BaseInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -54598,7 +54696,7 @@ function extractBrowserRequestState(browserCrypto, state) {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -54637,7 +54735,7 @@ function validateInteractionType(response, browserCrypto, interactionType) {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -54733,7 +54831,7 @@ class InteractionHandler {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -54742,7 +54840,7 @@ const contentError = "ContentError";
 const pageException = "PageException";
 const userSwitch = "user_switch";
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -54755,7 +54853,7 @@ const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
 const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -54820,7 +54918,7 @@ function createNativeAuthError(code, description, ext) {
     return new NativeAuthError(code, NativeAuthErrorMessages[code] || description, ext);
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -54870,7 +54968,7 @@ class SilentCacheClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -55497,7 +55595,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -55726,7 +55824,7 @@ async function handleResponseEAR(request, response, apiId, config, authority, br
     return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, apiId, additionalData, undefined, undefined, undefined, undefined));
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -55783,7 +55881,7 @@ async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceCl
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -56048,7 +56146,7 @@ class PlatformAuthExtensionHandler {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -56174,18 +56272,32 @@ class PlatformAuthDOMHandler {
         return nativeResponse;
     }
     getDOMExtraParams(extraParameters) {
-        const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
-            record[key] = String(value);
-            return record;
-        }, {});
-        const validExtraParams = {
-            ...stringifiedParams,
-        };
-        return validExtraParams;
+        try {
+            const stringifiedProperties = {};
+            for (const [key, value] of Object.entries(extraParameters)) {
+                if (!value) {
+                    continue;
+                }
+                if (typeof value === "object") {
+                    stringifiedProperties[key] = JSON.stringify(value);
+                }
+                else {
+                    stringifiedProperties[key] = String(value);
+                }
+            }
+            return stringifiedProperties;
+        }
+        catch (e) {
+            this.logger.error(this.platformAuthType + " - Error stringifying extra parameters");
+            this.logger.errorPii(this.platformAuthType +
+                " - Error stringifying extra parameters: " +
+                e);
+            return {};
+        }
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout, enablePlatformBrokerDOMSupport) {
     logger.trace("getPlatformAuthProvider called", correlationId);
     logger.trace("Has client allowed platform auth via DOM API: " +
@@ -56250,7 +56362,7 @@ function isPlatformAuthAllowed(config, logger, platformAuthProvider, authenticat
     return true;
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -56747,7 +56859,7 @@ class PopupClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -57187,7 +57299,7 @@ class RedirectClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -57235,6 +57347,12 @@ async function initiateEarRequest(config, authority, request, logger, performanc
  */
 async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId, responseType) {
     performanceClient.addQueueMeasurement(PerformanceEvents.SilentHandlerMonitorIframeForHash, correlationId);
+    performanceClient.addFields({
+        iframePollIntervalMs: pollIntervalMilliseconds,
+        iframeTimeoutMs: timeout,
+    }, correlationId);
+    let totalTickCount = 0;
+    let crossOriginTickCount = 0;
     return new Promise((resolve, reject) => {
         if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
             logger.warning(`system.loadFrameTimeout or system.iframeHashTimeout set to lower (${timeout}ms) than the default (${DEFAULT_IFRAME_TIMEOUT_MS}ms). This may result in timeouts.`);
@@ -57248,6 +57366,7 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             reject(createBrowserAuthError(monitorWindowTimeout));
         }, timeout);
         const intervalId = window.setInterval(() => {
+            totalTickCount++;
             let href = "";
             const contentWindow = iframe.contentWindow;
             try {
@@ -57258,7 +57377,9 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
                  */
                 href = contentWindow ? contentWindow.location.href : "";
             }
-            catch (e) { }
+            catch (e) {
+                crossOriginTickCount++;
+            }
             if (!href || href === "about:blank") {
                 return;
             }
@@ -57276,6 +57397,10 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             resolve(responseString);
         }, pollIntervalMilliseconds);
     }).finally(() => {
+        performanceClient.addFields({
+            iframeTickCount: totalTickCount,
+            crossOriginTickCount: crossOriginTickCount,
+        }, correlationId);
         invoke(removeHiddenIframe, PerformanceEvents.RemoveHiddenIframe, logger, performanceClient, correlationId)(iframe);
     });
 }
@@ -57343,7 +57468,7 @@ function removeHiddenIframe(iframe) {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -57465,6 +57590,52 @@ class SilentIframeClient extends StandardInteractionClient {
             return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
     }
+    /**
+     * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+     * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+     * @param request - The SSO silent request
+     * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+     */
+    async verifySso(request) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentIframeClientAcquireToken, request.correlationId);
+        const inputRequest = { ...request };
+        if (!inputRequest.prompt) {
+            inputRequest.prompt = PromptValue.NONE;
+        }
+        // Create silent request
+        const silentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)(inputRequest, InteractionType.Silent);
+        const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
+            serverTelemetryManager: this.initializeServerTelemetryManager(this.apiId),
+            requestAuthority: silentRequest.authority,
+            requestAzureCloudOptions: silentRequest.azureCloudOptions,
+            requestExtraQueryParameters: silentRequest.extraQueryParameters,
+            account: silentRequest.account,
+        });
+        const correlationId = silentRequest.correlationId;
+        const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
+        const requestWithPkce = {
+            ...silentRequest,
+            codeChallenge: pkceCodes.challenge,
+        };
+        // Create authorize request url
+        const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, requestWithPkce, this.logger, this.performanceClient);
+        // Get the frame handle for the silent request - this triggers the SSO verification
+        const msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+        const responseType = this.config.auth.OIDCOptions.serverResponseType;
+        // Monitor the iframe for the response
+        const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
+        // Deserialize the response
+        const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger);
+        // Validate the response - this checks for errors and validates state
+        validateAuthorizationResponse(serverParams, silentRequest.state);
+        // Verify a valid authorization code is present
+        if (!serverParams.code) {
+            this.logger.warning("SSO verification response did not contain an authorization code", correlationId);
+            return false;
+        }
+        this.logger.verbose("SSO verification completed successfully with valid authorization code - skipped token exchange", correlationId);
+        return true;
+    }
     /**
      * Currently Unsupported
      */
@@ -57504,7 +57675,7 @@ class SilentIframeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -57570,7 +57741,7 @@ class SilentRefreshClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -57784,7 +57955,7 @@ class TokenCache {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -57797,7 +57968,7 @@ class HybridSpaAuthorizationCodeClient extends AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -57863,11 +58034,7 @@ class SilentAuthCodeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 function collectInstanceStats(currentClientId, performanceEvent, logger) {
     const frameInstances = 
     // @ts-ignore
@@ -57883,7 +58050,7 @@ function collectInstanceStats(currentClientId, performanceEvent, logger) {
     });
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -57963,22 +58130,30 @@ class StandardController {
         this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto, this.performanceClient);
         this.activeSilentTokenRequests = new Map();
         // Register listener functions
-        this.trackPageVisibility = this.trackPageVisibility.bind(this);
-        // Register listener functions
-        this.trackPageVisibilityWithMeasurement =
-            this.trackPageVisibilityWithMeasurement.bind(this);
+        this.trackStateChangeWithMeasurement =
+            this.trackStateChangeWithMeasurement.bind(this);
     }
     static async createController(operatingContext, request) {
         const controller = new StandardController(operatingContext);
         await controller.initialize(request);
         return controller;
     }
-    trackPageVisibility(correlationId) {
+    trackStateChange(correlationId, event) {
         if (!correlationId) {
             return;
         }
-        this.logger.info("Perf: Visibility change detected");
-        this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        if (event.type === "visibilitychange") {
+            this.logger.info("Perf: Visibility change detected");
+            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "online") {
+            this.logger.info("Perf: Online status change detected");
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "offline") {
+            this.logger.info("Perf: Offline status change detected");
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -58126,6 +58301,8 @@ class StandardController {
                 rootMeasurement.end({
                     success: true,
                 }, undefined, result.account);
+                // Fire-and-forget SSO capability verification in background
+                this.verifySsoCapability(result.account, InteractionType.Redirect);
             }
             else {
                 /*
@@ -58358,6 +58535,8 @@ class StandardController {
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             }, undefined, result.account);
+            // SSO capability verification in background
+            this.verifySsoCapability(result.account, InteractionType.Popup);
             return result;
         })
             .catch((e) => {
@@ -58380,16 +58559,87 @@ class StandardController {
             }
         });
     }
-    trackPageVisibilityWithMeasurement() {
+    trackStateChangeWithMeasurement(event) {
         const measurement = this.ssoSilentMeasurement ||
             this.acquireTokenByCodeAsyncMeasurement;
         if (!measurement) {
             return;
         }
-        this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
-        measurement.increment({
-            visibilityChangeCount: 1,
+        if (event.type === "visibilitychange") {
+            this.logger.info("Perf: Visibility change detected in ", measurement.event.name);
+            measurement.increment({
+                visibilityChangeCount: 1,
+            });
+        }
+        else if (event.type === "online") {
+            this.logger.info("Perf: Online status change detected in ", measurement.event.name);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+        else if (event.type === "offline") {
+            this.logger.info("Perf: Offline status change detected in ", measurement.event.name);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+    }
+    addStateChangeListeners(listener) {
+        document.addEventListener("visibilitychange", listener);
+        window.addEventListener("online", listener);
+        window.addEventListener("offline", listener);
+    }
+    removeStateChangeListeners(listener) {
+        document.removeEventListener("visibilitychange", listener);
+        window.removeEventListener("online", listener);
+        window.removeEventListener("offline", listener);
+    }
+    /**
+     * SSO capability verification in the background.
+     * This method makes an iframe request to /authorize to verify SSO capability without calling /token.
+     * This method does not block the caller and tracks telemetry for success/failure.
+     * This method only executes if verifySSO is set to true in the auth configuration.
+     * @param account - The account to use for the SSO verification
+     * @param parentApi - The API ID of the parent operation for logging purposes
+     */
+    verifySsoCapability(account, parentApi) {
+        // Check if SSO capability verification is enabled
+        if (!this.config.auth.verifySSO) {
+            return;
+        }
+        const correlationId = this.browserCrypto.createNewGuid();
+        const ssoCapableMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.SsoCapable, correlationId);
+        ssoCapableMeasurement.add({
+            parentApi: parentApi,
         });
+        this.logger.verbose(`SSO capability verification initiated after ${parentApi}`, correlationId);
+        /*
+         * Use setTimeout to ensure this runs in a separate macrotask after the current call stack completes
+         * This ensures the result is returned to the caller before the SSO verification starts and doesn't affect performance
+         */
+        setTimeout(() => {
+            const ssoVerificationRequest = {
+                account: account,
+                correlationId: correlationId,
+            };
+            const silentIframeClient = this.createSilentIframeClient(correlationId);
+            silentIframeClient
+                .verifySso(ssoVerificationRequest)
+                .then((success) => {
+                this.logger.verbose(`SSO capability verification completed after ${parentApi}, success: ${success}`, correlationId);
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: success,
+                }, undefined, account);
+            })
+                .catch((error) => {
+                this.logger.warning(`SSO capability verification failed after ${parentApi}: ${error.message}`, correlationId);
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: false,
+                }, error, account);
+            });
+        }, 0);
     }
     // #endregion
     // #region Silent Flow
@@ -58423,8 +58673,9 @@ class StandardController {
         preflightCheck(this.initialized, this.ssoSilentMeasurement, request.account);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         this.logger.verbose("ssoSilent called", correlationId);
         this.eventHandler.emitEvent(EventType.SSO_SILENT_START, InteractionType.Silent, validRequest);
         let result;
@@ -58468,7 +58719,7 @@ class StandardController {
             throw e;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
     }
     /**
@@ -58580,8 +58831,9 @@ class StandardController {
             this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCodeAsync, request.correlationId);
         this.acquireTokenByCodeAsyncMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const silentAuthCodeClient = this.createSilentAuthCodeClient(request.correlationId);
         const silentTokenResult = await silentAuthCodeClient
             .acquireToken(request)
@@ -58599,7 +58851,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
         return silentTokenResult;
     }
@@ -59144,18 +59396,22 @@ class StandardController {
      * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
      */
     async acquireTokenSilentAsync(request, account) {
-        const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+        const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
         this.performanceClient.addQueueMeasurement(PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, InteractionType.Silent, request);
         if (request.correlationId) {
-            this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
         }
-        document.addEventListener("visibilitychange", trackPageVisibility);
+        this.addStateChangeListeners(trackStateChange);
         const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
         const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
         const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
             const shouldTryToResolveSilently = checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheLookupPolicy);
             if (shouldTryToResolveSilently) {
+                const silentRefreshReason = `${refreshTokenError.errorCode}${refreshTokenError.subError
+                    ? `|${refreshTokenError.subError}`
+                    : ""}`;
+                this.performanceClient.addFields({ silentRefreshReason }, silentRequest.correlationId);
                 if (!this.activeIframeRequest) {
                     let _resolve;
                     // Always set the active request tracker immediately after checking it to prevent races
@@ -59225,7 +59481,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", trackPageVisibility);
+            this.removeStateChangeListeners(trackStateChange);
         });
     }
     /**
@@ -59336,7 +59592,7 @@ function checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheL
     return isSilentlyResolvable && tryIframeRenewal;
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -59348,7 +59604,7 @@ async function createV3Controller(config, request) {
     return StandardController.createController(standard, request);
 }
 
-/*! @azure/msal-browser v4.28.2 2026-02-10 */
+/*! @azure/msal-browser v4.29.1 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.