@equinor/fusion-framework-vite-plugin-spa 4.0.17-next.0 → 4.0.17

package/dist/html/bootstrap.js

@@ -6314,7 +6314,7 @@ async function runDisposePhase(ctx, instance, ref) {
 }
 
 // Generated by genversion.
-const version$8 = '6.1.3-next.0';
+const version$8 = '6.1.2';
 
 // biome-ignore-all lint/suspicious/noExplicitAny: internal type-erased dispatch arrays — callbacks are registered with concrete module types but stored erased; the orchestrator never inspects these shapes itself
 /* eslint-disable @typescript-eslint/no-explicit-any */
@@ -6449,34 +6449,7 @@ class ModulesConfigurator {
      * @param modules - Optional array of module descriptors to pre-register.
      */
     constructor(modules) {
-        this._modules = new Set(modules ? this._dedupeModulesByName(modules) : []);
-    }
-    /**
-     * Keeps the last registration for each module name.
-     *
-     * @param modules - Module descriptors to deduplicate.
-     * @returns The deduplicated module descriptors.
-     */
-    _dedupeModulesByName(modules) {
-        const lastByName = new Map();
-        // Iterate in registration order so later descriptors intentionally override earlier ones.
-        for (const module of modules) {
-            lastByName.set(module.name, module);
-        }
-        return Array.from(lastByName.values());
-    }
-    /**
-     * Removes lifecycle callbacks belonging to a replaced module.
-     *
-     * @param moduleName - Name of the module whose callbacks are removed.
-     */
-    _removeModuleCallbacks(moduleName) {
-        // Remove callbacks from each lifecycle phase so replaced modules cannot run stale behavior.
-        this._configs = this._configs.filter((callback) => callback.moduleName !== moduleName);
-        // Keep cleanup callbacks aligned with the module replacement.
-        this._afterConfiguration = this._afterConfiguration.filter((callback) => callback.moduleName !== moduleName);
-        // Remove initialization callbacks as well, preventing the old module from being initialized.
-        this._afterInit = this._afterInit.filter((callback) => callback.moduleName !== moduleName);
+        this._modules = new Set(modules);
     }
     /**
      * Returns all registered module descriptors as an ordered array.
@@ -6503,9 +6476,6 @@ class ModulesConfigurator {
     /**
      * Registers a single module configurator.
      *
-     * If a module with the same `name` was already registered, the previous
-     * registration is replaced so the last added module wins.
-     *
      * Adds the module to the known module set and registers the optional
      * `configure`, `afterConfig`, and `afterInit` callbacks into their
      * respective lifecycle phase arrays.
@@ -6516,26 +6486,7 @@ class ModulesConfigurator {
      */
     addConfig(config) {
         const { module, afterConfig, afterInit, configure } = config;
-        // Find an existing descriptor so re-registering a name can replace all of its lifecycle hooks.
-        const existingModule = Array.from(this._modules).find((m) => m.name === module.name);
-        // Only handle replacement/dedupe when a descriptor is already registered under this name.
-        if (existingModule) {
-            // Only a genuinely different descriptor for this name is a replacement that must
-            // discard the old callbacks. Re-registering the SAME descriptor object (as helpers
-            // like `configureHttpClient`/`useFrameworkServiceClient` do on every call, since they
-            // all share one module singleton) must stay additive so multiple calls can register
-            // multiple named clients without clobbering each other.
-            if (existingModule !== module) {
-                this._removeModuleCallbacks(module.name);
-                const modules = Array.from(this._modules)
-                    // Preserve every descriptor while substituting the newly registered module.
-                    .map((m) => (m.name === module.name ? module : m));
-                this._modules = new Set(modules);
-            }
-        }
-        else {
-            this._modules.add(module);
-        }
+        this._modules.add(module);
         this._registerEvent({
             level: ModuleEventLevel.Debug,
             name: ModuleConfiguratorEventName.ModuleConfigAdded,
@@ -6548,26 +6499,15 @@ class ModulesConfigurator {
                 afterInit: !!afterInit,
             },
         });
-        // Register each optional callback into its corresponding lifecycle phase array.
-        // When the same module name is re-registered, previous callbacks are removed
-        // so the latest configuration wins.
-        if (configure) {
-            const callback = ((cfg, ref) => configure(cfg[module.name], ref));
-            callback.moduleName = module.name;
-            this._configs.push(callback);
-        }
-        // Register the afterConfig callback, if provided.
-        if (afterConfig) {
-            const callback = ((cfg) => afterConfig(cfg[module.name]));
-            callback.moduleName = module.name;
-            this._afterConfiguration.push(callback);
-        }
-        // Register the afterInit callback, if provided.
-        if (afterInit) {
-            const callback = ((instances) => afterInit(instances[module.name]));
-            callback.moduleName = module.name;
-            this._afterInit.push(callback);
-        }
+        // Register each optional callback into its corresponding lifecycle phase array
+        if (configure)
+            this._configs.push((cfg, ref) => configure(cfg[module.name], ref));
+        // Register the afterConfig callback, if provided
+        if (afterConfig)
+            this._afterConfiguration.push((cfg) => afterConfig(cfg[module.name]));
+        // Register the afterInit callback, if provided
+        if (afterInit)
+            this._afterInit.push((instances) => afterInit(instances[module.name]));
     }
     /**
      * Registers a callback for the post-configure phase.
@@ -6989,49 +6929,6 @@ class HttpRequestHandler extends ProcessOperators {
 class HttpResponseHandler extends ProcessOperators {
 }
 
-/**
- * Normalizes a step's result to a `Promise`, so a middleware calling `next(...)` never has to
- * branch on whether the next step short-circuited with a plain `Response` or reached all the
- * way to an Observable-returning network call.
- */
-function toPromise(result) {
-    return result instanceof Response ? Promise.resolve(result) : firstValueFrom(from(result));
-}
-/**
- * Composes registered {@link HttpMiddleware} into a single execution pipeline wrapping the
- * network call, so retries, caching, telemetry, or circuit-breaking can wrap `_performFetch`
- * without touching request or response payload transforms.
- *
- * @see {@link HttpClient}
- */
-class HttpMiddlewareHandler {
-    #middleware;
-    /**
-     * Constructs a handler, optionally cloning another handler's registered middleware.
-     * @param source - An existing handler to clone the registered middleware from.
-     */
-    constructor(source) {
-        this.#middleware = source ? [...source.middleware] : [];
-    }
-    /** @inheritdoc */
-    get middleware() {
-        return this.#middleware;
-    }
-    /** @inheritdoc */
-    use(middleware) {
-        this.#middleware.push(middleware);
-        return this;
-    }
-    /** @inheritdoc */
-    process(uri, init, terminal) {
-        // wrap outward-in so the first-registered middleware is outermost, matching a conventional middleware chain
-        const chain = this.#middleware.reduceRight((next, middleware) => (nextUri, nextInit) => middleware(nextUri, nextInit, (u, i) => toPromise(next(u, i))), terminal);
-        const result = chain(uri, init);
-        // a middleware may short-circuit with a plain Response (no ObservableInput wrapping needed)
-        return result instanceof Response ? of(result) : from(result);
-    }
-}
-
 var _a$1;
 /** A special constant with type `never` */
 const NEVER = /*@__PURE__*/ Object.freeze({
@@ -7271,7 +7168,7 @@ const allowsEval = /* @__PURE__*/ cached(() => {
         return false;
     }
 });
-function isPlainObject$1(o) {
+function isPlainObject$2(o) {
     if (isObject(o) === false)
         return false;
     // modified constructor
@@ -7291,7 +7188,7 @@ function isPlainObject$1(o) {
     return true;
 }
 function shallowClone(o) {
-    if (isPlainObject$1(o))
+    if (isPlainObject$2(o))
         return { ...o };
     if (Array.isArray(o))
         return [...o];
@@ -7497,7 +7394,7 @@ function omit(schema, mask) {
     return clone(schema, def);
 }
 function extend(schema, shape) {
-    if (!isPlainObject$1(shape)) {
+    if (!isPlainObject$2(shape)) {
         throw new Error("Invalid input to extend: expected a plain object");
     }
     const checks = schema._zod.def.checks;
@@ -7522,7 +7419,7 @@ function extend(schema, shape) {
     return clone(schema, def);
 }
 function safeExtend(schema, shape) {
-    if (!isPlainObject$1(shape)) {
+    if (!isPlainObject$2(shape)) {
         throw new Error("Invalid input to safeExtend: expected a plain object");
     }
     const def = mergeDefs(schema._zod.def, {
@@ -7819,7 +7716,7 @@ var util = /*#__PURE__*/Object.freeze({
 	getSizableOrigin: getSizableOrigin,
 	hexToUint8Array: hexToUint8Array,
 	isObject: isObject,
-	isPlainObject: isPlainObject$1,
+	isPlainObject: isPlainObject$2,
 	issue: issue,
 	joinValues: joinValues,
 	jsonStringifyReplacer: jsonStringifyReplacer,
@@ -10151,7 +10048,7 @@ function mergeValues(a, b) {
     if (a instanceof Date && b instanceof Date && +a === +b) {
         return { valid: true, data: a };
     }
-    if (isPlainObject$1(a) && isPlainObject$1(b)) {
+    if (isPlainObject$2(a) && isPlainObject$2(b)) {
         const bKeys = Object.keys(b);
         const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
         const newObj = { ...a, ...b };
@@ -10357,7 +10254,7 @@ const $ZodRecord = /*@__PURE__*/ $constructor("$ZodRecord", (inst, def) => {
     $ZodType.init(inst, def);
     inst._zod.parse = (payload, ctx) => {
         const input = payload.value;
-        if (!isPlainObject$1(input)) {
+        if (!isPlainObject$2(input)) {
             payload.issues.push({
                 expected: "record",
                 code: "invalid_type",
@@ -22633,8 +22530,6 @@ class HttpClientConfigurator {
         // validate the request object
         'request-validation': requestValidationOperator(),
     });
-    /** Default middleware chain cloned into each created client instance. */
-    defaultHttpMiddlewareHandler = new HttpMiddlewareHandler();
     /**
      * Creates a configurator with the default client constructor.
      * @param client - The default client constructor used when `ctor` is not configured per client.
@@ -22647,11 +22542,6 @@ class HttpClientConfigurator {
         return Object.keys(this._clients).includes(name);
     }
     /** @inheritdoc */
-    addMiddleware(middleware) {
-        this.defaultHttpMiddlewareHandler.use(middleware);
-        return this;
-    }
-    /** @inheritdoc */
     configureClient(name, args) {
         const argFn = typeof args === 'string' ? { baseUri: args } : args;
         const options = typeof argFn === 'function' ? { onCreate: argFn } : argFn;
@@ -22666,7 +22556,7 @@ class HttpClientConfigurator {
 }
 
 // Generated by genversion.
-const version$6 = '8.1.0-next.0';
+const version$6 = '8.0.5';
 
 /** URL protocols accepted as valid ad-hoc base URIs. */
 const SUPPORTED_PROTOCOLS = ['http:', 'https:', 'ws:', 'wss:'];
@@ -22705,13 +22595,6 @@ class HttpClientProvider extends BaseModuleProvider {
     get defaultHttpRequestHandler() {
         return this.config.defaultHttpRequestHandler;
     }
-    /**
-     * Gets the default middleware chain for the HTTP client provider.
-     * @returns The default middleware chain.
-     */
-    get defaultHttpMiddlewareHandler() {
-        return this.config.defaultHttpMiddlewareHandler;
-    }
     /**
      * Creates a new `HttpClientProvider`.
      * @param config - The configurator providing client definitions and defaults.
@@ -22749,8 +22632,8 @@ class HttpClientProvider extends BaseModuleProvider {
      */
     createClient(keyOrConfig) {
         const config = this._resolveConfig(keyOrConfig);
-        const { baseUri, defaultScopes = [], onCreate, ctor = this.config.defaultHttpClientCtor, requestHandler = this.defaultHttpRequestHandler, responseHandler, middlewareHandler = this.defaultHttpMiddlewareHandler, } = config;
-        const options = { requestHandler, responseHandler, middlewareHandler };
+        const { baseUri, defaultScopes = [], onCreate, ctor = this.config.defaultHttpClientCtor, requestHandler = this.defaultHttpRequestHandler, responseHandler, } = config;
+        const options = { requestHandler, responseHandler };
         const instance = new ctor(baseUri || '', options);
         // attach the resolved default scopes onto the instance without overwriting other own properties
         Object.assign(instance, { defaultScopes });
@@ -22949,12 +22832,6 @@ class HttpClient {
      * This property is part of the `HttpClientCreateOptions` configuration object used to create an `HttpClient` instance.
      */
     responseHandler;
-    /**
-     * Middleware wrapping the network call, for cross-cutting concerns such as retries,
-     * caching, or telemetry. This property is part of the `HttpClientCreateOptions`
-     * configuration object used to create an `HttpClient` instance.
-     */
-    middlewareHandler;
     /**
      * A stream of requests that are about to be executed.
      * This property is used internally by the `HttpClient` class to manage the lifecycle of requests.
@@ -22993,7 +22870,6 @@ class HttpClient {
         this.uri = uri;
         this.requestHandler = new HttpRequestHandler(options?.requestHandler);
         this.responseHandler = new HttpResponseHandler(options?.responseHandler);
-        this.middlewareHandler = new HttpMiddlewareHandler(options?.middlewareHandler);
         this._init();
     }
     /**
@@ -23165,9 +23041,7 @@ class HttpClient {
     /**
      * Aborts any ongoing HTTP requests made by this `IHttpClient` instance.
      * This will trigger the `takeUntil` operator in the `_fetch$` method,
-     * causing any in-flight requests to be cancelled, and abort the
-     * per-request `AbortSignal` passed through to `_performFetch`, so the
-     * underlying network call is cancelled even behind registered middleware.
+     * causing any in-flight requests to be cancelled.
      */
     abort() {
         this._abort$.next();
@@ -23192,26 +23066,11 @@ class HttpClient {
      */
     _fetch$(path, args) {
         const { selector, ...options } = args || {};
-        // A registered middleware's `next(...)` resolves through a `Promise` (see
-        // `HttpMiddlewareHandler`), which `firstValueFrom` fulfils via its own independent
-        // subscription to `_performFetch` — one the `takeUntil(this._abort$)` below never reaches,
-        // since it sits outside the subscription tree that `takeUntil` tears down. Combining this
-        // controller's signal into the request `init` lets `_performFetch` (`fromFetch` by default)
-        // abort the underlying network call directly, regardless of whether middleware severed the
-        // RxJS teardown chain.
-        const abortController = new AbortController();
-        // abort only fires once per request; the subscription is torn down in `finalize` below
-        const abort = this._abort$.pipe(take(1)).subscribe(() => abortController.abort());
-        const callerSignal = options.signal;
-        const signal = callerSignal
-            ? AbortSignal.any([callerSignal, abortController.signal])
-            : abortController.signal;
         // `fromFetch` yields the raw fetch `Response`, but `responseHandler.process()` (called via
         // `_prepareResponse`) expects the pipeline's generic `TResponse` shape — cast through
         // `unknown` since the two are only compatible after that processing step.
         const response$ = of({
             ...options,
-            signal,
             path,
             uri: this._resolveUrl(path),
         }).pipe(
@@ -23219,8 +23078,8 @@ class HttpClient {
         switchMap((x) => this._prepareRequest(x)), 
         /** push request to event buss */
         tap((x) => this._request$.next(x)), 
-        /** execute request through registered middleware, terminating at _performFetch */
-        switchMap(({ uri, path: _path, ...init }) => this.middlewareHandler.process(uri, init, (u, i) => this._performFetch(u, i))), 
+        /** execute request */
+        switchMap(({ uri, path: _path, ...init }) => fromFetch(uri, init)), 
         /** prepare response, allow extensions to modify response  */
         switchMap((x) => this._prepareResponse(x)), 
         /** push response to event buss */
@@ -23241,30 +23100,11 @@ class HttpClient {
             return of(response);
         }), 
         /** cancel request on abort signal */
-        takeUntil(this._abort$), 
-        /** the abort signal subscription only ever fires once; tear it down once this request settles either way */
-        finalize$2(() => abort.unsubscribe()));
+        takeUntil(this._abort$));
         // The pipe above resolves to the per-call generic `T` (via the optional `selector`), but
         // the observable's static type tracks the class-level `TResponse` — cast to the caller's `T`.
         return response$;
     }
-    /**
-     * Performs the actual network call for a prepared request.
-     *
-     * @remarks
-     * Isolated from {@link _fetch$} so a test double can replace only this step —
-     * matching a request against registered route handlers instead of reaching
-     * the network — while everything around it (request preparation, the
-     * response pipeline, abort handling) runs unchanged. See
-     * `@equinor/fusion-framework-module-http/mock`.
-     *
-     * @param uri - The fully resolved URL for the request.
-     * @param init - The prepared `fetch` request options.
-     * @returns An observable of the raw `Response`, ahead of {@link _prepareResponse}.
-     */
-    _performFetch(uri, init) {
-        return fromFetch(uri, init);
-    }
     /**
      * Prepares the request by passing it through the `requestHandler.process()` method.
      * This method is an implementation detail of the `_fetch$()` method, and is not part of the public API.
@@ -23485,11 +23325,11 @@ var isDraft = (value) => !!value && !!value[DRAFT_STATE];
 function isDraftable(value) {
   if (!value)
     return false;
-  return isPlainObject(value) || isArray(value) || !!value[DRAFTABLE] || !!value[CONSTRUCTOR]?.[DRAFTABLE] || isMap(value) || isSet(value);
+  return isPlainObject$1(value) || isArray(value) || !!value[DRAFTABLE] || !!value[CONSTRUCTOR]?.[DRAFTABLE] || isMap(value) || isSet(value);
 }
 var objectCtorString = O[PROTOTYPE][CONSTRUCTOR].toString();
 var cachedCtorStrings = /* @__PURE__ */ new WeakMap();
-function isPlainObject(value) {
+function isPlainObject$1(value) {
   if (!value || !isObjectish(value))
     return false;
   const proto = getPrototypeOf(value);
@@ -23562,7 +23402,7 @@ function shallowCopy(base, strict) {
   }
   if (isArray(base))
     return Array[PROTOTYPE].slice.call(base);
-  const isPlain = isPlainObject(base);
+  const isPlain = isPlainObject$1(base);
   if (strict === true || strict === "class_only" && !isPlain) {
     const descriptors = O.getOwnPropertyDescriptors(base);
     delete descriptors[DRAFT_STATE];
@@ -23921,7 +23761,7 @@ var objectTraps = {
     ) && isArrayIndex(prop)) {
       return value;
     }
-    if (value === peek(state.base_, prop)) {
+    if (value === peek(state.base_, prop) || isRelocatedBaseRef(state, prop, value)) {
       prepareCopy(state);
       const childKey = state.type_ === 1 /* Array */ ? +prop : prop;
       const childDraft = createProxy(state.scope_, value, state, childKey);
@@ -23955,7 +23795,7 @@ var objectTraps = {
       markChanged(state);
     }
     if (state.copy_[prop] === value && // special case: handle new props with value 'undefined'
-    (value !== void 0 || prop in state.copy_) || // special case: NaN
+    (value !== void 0 || has(state.copy_, prop, state.type_)) || // special case: NaN
     Number.isNaN(value) && Number.isNaN(state.copy_[prop]))
       return true;
     state.copy_[prop] = value;
@@ -24024,6 +23864,12 @@ function peek(draft, prop) {
   const source = state ? latest(state) : draft;
   return source[prop];
 }
+function isRelocatedBaseRef(state, prop, value) {
+  if (state.type_ !== 1 /* Array */ || !state.allIndicesReassigned_ || state.assigned_?.get(prop) || !isDraftable(value) || value[DRAFT_STATE]) {
+    return false;
+  }
+  return state.baseRefs_.has(value);
+}
 function readPropFromProto(state, source, prop) {
   const desc = getDescriptorFromProto(source, prop);
   return desc ? VALUE in desc ? desc[VALUE] : (
@@ -25168,7 +25014,7 @@ class TelemetryConfigurator extends BaseConfigBuilder {
 }
 
 // Generated by genversion.
-const version$5 = '8.0.0-next.0';
+const version$5 = '7.0.3';
 
 /**
  * Enum representing the severity levels of telemetry items.
@@ -26160,7 +26006,7 @@ configurator, options) => {
     });
 };
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26210,9 +26056,10 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
-const CLI_DATA = "clidata";
+const CLI_DATA = "clidata";
+const ATTRIBUTE_TOKENS = "attribute_tokens";
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26443,7 +26290,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26472,7 +26319,7 @@ function createAuthError(code, correlationId, additionalMessage) {
     return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage$1(code));
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26495,7 +26342,7 @@ function createClientAuthError(errorCode, correlationId, additionalMessage) {
     return new ClientAuthError(errorCode, correlationId, additionalMessage);
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26532,7 +26379,7 @@ const methodNotImplemented = "method_not_implemented";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26570,7 +26417,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26636,7 +26483,7 @@ function getJWSPayload(authToken, correlationId) {
     return matches[2];
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26724,7 +26571,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26739,7 +26586,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26761,7 +26608,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26785,7 +26632,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /**
  * Returns the AccountInfo interface for this account.
  * @internal
@@ -26974,7 +26821,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26984,7 +26831,7 @@ function isAccountEntity(entity) {
  */
 const unexpectedError = "unexpected_error";
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27004,7 +26851,7 @@ function createClientConfigurationError(errorCode, correlationId) {
     return new ClientConfigurationError(errorCode, correlationId);
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27030,7 +26877,7 @@ const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
 const issuerValidationFailed = "issuer_validation_failed";
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27042,7 +26889,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27122,7 +26969,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27280,7 +27127,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27446,7 +27293,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27455,7 +27302,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27465,7 +27312,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27475,7 +27322,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27546,7 +27393,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27639,7 +27486,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27750,7 +27597,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27815,7 +27662,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28080,9 +27927,22 @@ function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetw
  */
 function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
+}
+/**
+ * Serialize attribute tokens synchronously (sort and join).
+ * This is a sync-only operation for use at request construction time.
+ * @param attributeTokens - array of tokens
+ * @returns serialized partition string or undefined if no tokens
+ */
+function serializeAttributeTokens(attributeTokens) {
+    if (!attributeTokens || attributeTokens.length === 0) {
+        return undefined;
+    }
+    // Serialize: sort and join tokens
+    return [...attributeTokens].sort().join(" ");
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29052,7 +28912,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29086,7 +28946,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29282,7 +29142,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29410,13 +29270,14 @@ function addSid(parameters, sid) {
  * @param claims - The claims string from the request
  * @param clientCapabilities - The client capabilities from configuration
  * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+ * @param claimsToMerge - Optional client-originated claims JSON string (e.g. `claimsFromClient`) deep-merged into `claims` with precedence on conflicts
  */
-function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims) {
+function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims, claimsToMerge) {
     // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
     const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
         ? undefined
         : clientCapabilities;
-    const mergedClaims = buildMergedClaims(claims, configClaims, correlationId);
+    const mergedClaims = buildMergedClaims(claims, configClaims, correlationId, claimsToMerge);
     parameters.set(CLAIMS, mergedClaims);
 }
 /**
@@ -29582,32 +29443,79 @@ const DEFAULT_ID_TOKEN_CLAIMS = {
     [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
 };
 /**
- * Parses claims JSON, merges default optional idToken claims (signin_state, login_hint),
- * and appends client capabilities (xms_cc) to the access_token section.
+ * Parses a claims JSON string into an object, throwing a ClientConfigurationError
+ * (error code `invalid_claims`) if the value is not a valid JSON object. The raw
+ * claims value is never included in the error - it may contain sensitive data.
+ * @param claims - Claims JSON string. Must be valid JSON representing an object.
+ * @param correlationId - The request correlation id
+ * @returns The parsed claims object
+ */
+function parseClaims(claims, correlationId = "") {
+    let parsed;
+    try {
+        parsed = JSON.parse(claims);
+    }
+    catch (e) {
+        // Malformed JSON
+        throw createClientConfigurationError(invalidClaims, correlationId);
+    }
+    if (!isPlainObject(parsed)) {
+        // Valid JSON, but not an object (e.g. an array, a scalar, or the literal `null`).
+        throw createClientConfigurationError(invalidClaims, correlationId);
+    }
+    return parsed;
+}
+/**
+ * Type guard for a non-null, non-array object (a JSON "object" value).
+ * @param value - The value to test
+ * @returns True when value is a plain object that can be deep-merged
+ */
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Recursively deep-merges two parsed claims objects. Nested objects are merged key-by-key;
+ * for any other value type (arrays, scalars, null) the value from `claimsToMerge` replaces
+ * the base. This mirrors the deep merge used by msal-dotnet so that, for example, a server
+ * `access_token` challenge and a client-originated `access_token` claim are combined rather
+ * than one clobbering the other.
+ * @param baseClaims - The parsed base claims object
+ * @param claimsToMerge - The parsed claims object merged in with precedence
+ * @returns The deep-merged claims object
+ */
+function deepMergeClaims(baseClaims, claimsToMerge) {
+    const merged = { ...baseClaims };
+    for (const [key, mergeInValue] of Object.entries(claimsToMerge)) {
+        const baseValue = merged[key];
+        if (isPlainObject(baseValue) && isPlainObject(mergeInValue)) {
+            merged[key] = deepMergeClaims(baseValue, mergeInValue);
+        }
+        else {
+            merged[key] = mergeInValue;
+        }
+    }
+    return merged;
+}
+/**
+ * Parses claims JSON, optionally deep-merges a second client-originated claims string
+ * (`claimsToMerge`, e.g. `claimsFromClient`) with precedence on conflicting keys, merges
+ * default optional idToken claims (signin_state, login_hint), and appends client
+ * capabilities (xms_cc) to the access_token section.
  * Does not overwrite idToken claims already specified by the caller.
  * @param claims - Existing claims JSON string from the request (may be undefined)
  * @param clientCapabilities - Client capabilities array from configuration
+ * @param correlationId - The request correlation id
+ * @param claimsToMerge - Optional second claims JSON string (e.g. client-originated `claimsFromClient`)
+ * deep-merged into `claims` with precedence on conflicts; parsed and validated when present. Nested
+ * objects are merged recursively; arrays and scalar values are replaced.
  * @returns Merged claims JSON string
  */
-function buildMergedClaims(claims, clientCapabilities, correlationId = "") {
-    let mergedClaims;
+function buildMergedClaims(claims, clientCapabilities, correlationId = "", claimsToMerge) {
     // Parse provided claims into JSON object or initialize empty object
-    if (!claims) {
-        mergedClaims = {};
-    }
-    else {
-        try {
-            const parsed = JSON.parse(claims);
-            if (typeof parsed !== "object" ||
-                parsed === null ||
-                Array.isArray(parsed)) {
-                throw new Error("Claims must be a JSON object");
-            }
-            mergedClaims = parsed;
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims, correlationId);
-        }
+    let mergedClaims = claims ? parseClaims(claims, correlationId) : {};
+    // Deep-merge client-originated claims (e.g. `claimsFromClient`) with precedence on conflicts
+    if (claimsToMerge?.trim()) {
+        mergedClaims = deepMergeClaims(mergedClaims, parseClaims(claimsToMerge, correlationId));
     }
     // Add default optional idToken claims
     if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ID_TOKEN)) {
@@ -29695,9 +29603,28 @@ function addResource(parameters, resource) {
     if (resource) {
         parameters.set(RESOURCE, resource);
     }
+}
+/**
+ * Add the `attribute_tokens` parameter to a /token request body.
+ *
+ * When `attributeTokens` is a non-empty array the values are sorted lexicographically and joined
+ * with a single space, then written to the request body. When `attributeTokens` is an empty array
+ * the parameter is deleted from the request body.
+ *
+ * @param parameters - request parameter map that will be serialized into the /token body
+ * @param attributeTokens - caller-provided attribute token strings
+ */
+function addAttributeTokens(parameters, attributeTokens) {
+    const serialized = serializeAttributeTokens(attributeTokens);
+    if (serialized) {
+        parameters.set(ATTRIBUTE_TOKENS, serialized);
+    }
+    else {
+        parameters.delete(ATTRIBUTE_TOKENS);
+    }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29819,7 +29746,7 @@ function validateUrl(url, logger, correlationId) {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29862,7 +29789,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -30137,12 +30064,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$4 = "16.11.3";
+const version$4 = "16.12.0";
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -30150,7 +30077,7 @@ const version$4 = "16.11.3";
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -30188,7 +30115,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -30415,9 +30342,17 @@ class CacheManager {
     }
     /**
      * saves access token credential
-     * @param credential
+     * @param credential - the access token entity to save
+     * @param correlationId - unique identifier for the request
+     * @param kmsi - keep me signed in flag
      */
     async saveAccessToken(credential, correlationId, kmsi) {
+        // Compute hash from components on the entity itself — no need to thread externally.
+        let additionalCacheKeyHash;
+        if (credential.additionalCacheKeyComponents &&
+            Object.keys(credential.additionalCacheKeyComponents).length > 0) {
+            additionalCacheKeyHash = await this.cryptoImpl.hashString(JSON.stringify(credential.additionalCacheKeyComponents));
+        }
         const accessTokenFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -30441,7 +30376,7 @@ class CacheManager {
                 }
             }
         });
-        await this.setAccessTokenCredential(credential, correlationId, kmsi);
+        await this.setAccessTokenCredential(credential, correlationId, kmsi, additionalCacheKeyHash);
     }
     /**
      * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
@@ -30852,6 +30787,12 @@ class CacheManager {
                 AuthenticationScheme.BEARER.toLowerCase()
             ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
             : CredentialType.ACCESS_TOKEN;
+        const attributeTokenPartition = serializeAttributeTokens(request.attributeTokens);
+        const additionalCacheKeyComponents = attributeTokenPartition
+            ? {
+                attribute_tokens: attributeTokenPartition,
+            }
+            : undefined;
         const accessTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -30861,10 +30802,12 @@ class CacheManager {
             target: scopes,
             tokenType: authScheme,
             keyId: request.sshKid,
+            additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
         const accessTokenKeys = (tokenKeys && tokenKeys.accessToken) ||
             this.getTokenKeys().accessToken;
         const accessTokens = [];
+        const matchedKeys = [];
         accessTokenKeys.forEach((key) => {
             // Validate key
             if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
@@ -30873,18 +30816,18 @@ class CacheManager {
                 if (accessToken &&
                     this.credentialMatchesFilter(accessToken, accessTokenFilter, correlationId)) {
                     accessTokens.push(accessToken);
+                    matchedKeys.push(key);
                 }
             }
         });
-        const numAccessTokens = accessTokens.length;
-        if (numAccessTokens < 1) {
+        if (accessTokens.length < 1) {
             this.commonLogger.info("1nckna", correlationId);
             return null;
         }
-        else if (numAccessTokens > 1) {
+        else if (accessTokens.length > 1) {
             this.commonLogger.info("1wkfwp", correlationId);
-            accessTokens.forEach((accessToken) => {
-                this.removeAccessToken(this.generateCredentialKey(accessToken), correlationId);
+            matchedKeys.forEach((key) => {
+                this.removeAccessToken(key, correlationId);
             });
             this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
             return null;
@@ -31327,7 +31270,9 @@ class DefaultStorageClass extends CacheManager {
     getTokenKeys() {
         throw createClientAuthError(methodNotImplemented, "");
     }
-    generateCredentialKey() {
+    /* eslint-disable @typescript-eslint/no-unused-vars */
+    generateCredentialKey(_credential, _hash) {
+        /* eslint-enable @typescript-eslint/no-unused-vars */
         throw createClientAuthError(methodNotImplemented, "");
     }
     generateAccountKey() {
@@ -31335,7 +31280,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -31349,7 +31294,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31407,7 +31352,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31503,7 +31448,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -31530,7 +31475,7 @@ function isOidcProtocolMode(config) {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31610,7 +31555,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -31661,7 +31606,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31728,7 +31673,7 @@ function createInteractionRequiredAuthError(errorCode, correlationId, errorMessa
     return new InteractionRequiredAuthError(errorCode, correlationId, errorMessage);
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31747,7 +31692,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31818,7 +31763,7 @@ function parseRequestState(base64Decode, state, correlationId) {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31907,7 +31852,15 @@ class ResponseHandler {
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
             serverTokenResponse.key_id || request.sshKid || undefined;
-        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents);
+        // Compute components once for entity storage (fallback if hash not provided by client)
+        const attributeTokenPartition = serializeAttributeTokens(request.attributeTokens);
+        const cacheKeyComponents = additionalCacheKeyComponents ??
+            (attributeTokenPartition
+                ? {
+                    attribute_tokens: attributeTokenPartition,
+                }
+                : undefined);
+        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, cacheKeyComponents);
         let cacheContext;
         try {
             if (this.persistencePlugin && this.serializableCache) {
@@ -32169,7 +32122,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -32179,7 +32132,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -32198,7 +32151,8 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint, fmiP
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -32217,10 +32171,11 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
         sshKid: request.sshKid,
         embeddedClientId: request.embeddedClientId || request.extraParameters?.clientId,
         resource: request.resource,
+        attributeTokens: serializeAttributeTokens(request.attributeTokens),
     };
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32306,7 +32261,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32337,7 +32292,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32453,7 +32408,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32574,6 +32529,12 @@ class AuthorizationCodeClient {
         // Add scope array, parameter builder will add default scopes and dedupe
         addScopes(parameters, request.scopes, request.correlationId, true, this.oidcDefaultScopes);
         addResource(parameters, request.resource);
+        if (request.attributeTokens) {
+            addAttributeTokens(parameters, request.attributeTokens);
+        }
+        this.performanceClient?.addFields({
+            hasAttributeTokens: !!request.attributeTokens?.length,
+        }, request.correlationId);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
         // Add library metadata
@@ -32710,7 +32671,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32937,7 +32898,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32958,7 +32919,7 @@ function createJoseHeaderError(code, correlationId) {
     return new JoseHeaderError(code, correlationId);
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -32966,7 +32927,7 @@ function createJoseHeaderError(code, correlationId) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33006,7 +32967,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33167,6 +33128,12 @@ class RefreshTokenClient {
             addServerTelemetry(parameters, this.serverTelemetryManager);
         }
         addRefreshToken(parameters, request.refreshToken);
+        if (request.attributeTokens) {
+            addAttributeTokens(parameters, request.attributeTokens);
+        }
+        this.performanceClient?.addFields({
+            hasAttributeTokens: !!request.attributeTokens?.length,
+        }, request.correlationId);
         if (this.config.clientCredentials.clientSecret) {
             addClientSecret(parameters, this.config.clientCredentials.clientSecret);
         }
@@ -33227,7 +33194,7 @@ class RefreshTokenClient {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33520,7 +33487,7 @@ class StubServerTelemetryManager extends ServerTelemetryManager {
     clearNativeBrokerErrorCode() { }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33628,7 +33595,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33644,7 +33611,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v16.11.3 2026-07-29 */
+/*! @azure/msal-common v16.12.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33677,7 +33644,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -33804,7 +33771,7 @@ const DecryptEarResponse = "decryptEarResponse";
  */
 const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33827,7 +33794,7 @@ function createBrowserAuthError(errorCode, correlationId, subError) {
     return new BrowserAuthError(errorCode, correlationId, subError);
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -33882,7 +33849,7 @@ const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
 const timedOut = "timed_out";
 const emptyResponse = "empty_response";
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33921,7 +33888,7 @@ function base64DecToArr(base64String) {
     return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -34107,7 +34074,7 @@ const iFrameRenewalPolicies = [
     CacheLookupPolicy.RefreshTokenAndNetwork,
 ];
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -34152,7 +34119,7 @@ function base64EncArr(aBytes) {
     return btoa(binString);
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -34499,7 +34466,7 @@ async function computeJwkThumbprint(publicJwk) {
     return hashString(thumbprintJson);
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -34519,7 +34486,7 @@ function createBrowserConfigurationAuthError(errorCode, correlationId) {
     return new BrowserConfigurationAuthError(errorCode, correlationId, getDefaultErrorMessage(errorCode));
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -34527,7 +34494,7 @@ function createBrowserConfigurationAuthError(errorCode, correlationId) {
 const storageNotSupported = "storage_not_supported";
 const inMemRedirectUnavailable = "in_mem_redirect_unavailable";
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -34868,7 +34835,7 @@ function createGuid() {
     return createNewGuid();
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35071,7 +35038,7 @@ class DatabaseStorage {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -35117,7 +35084,7 @@ class MemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35258,7 +35225,7 @@ class AsyncMemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35435,7 +35402,7 @@ function getSortedObjectString(obj) {
     return JSON.stringify(obj, Object.keys(obj).sort());
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -35482,7 +35449,7 @@ const LocalStorageUpdated = "localStorageUpdated";
  */
 const SsoCapable = "ssoCapable";
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -35511,7 +35478,7 @@ function getTokenKeysCacheKey(clientId, schema = CREDENTIAL_SCHEMA_VERSION) {
     return `${PREFIX}.${schema}.${TOKEN_KEYS}.${clientId}`;
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35602,7 +35569,7 @@ function getCookieExpirationTime(cookieLifeDays) {
     return expr.toUTCString();
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35644,7 +35611,7 @@ function getTokenKeys(clientId, storage, schemaVersion) {
     };
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -35655,7 +35622,7 @@ function isEncrypted(data) {
         data.hasOwnProperty("data"));
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35947,7 +35914,7 @@ class LocalStorage {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35989,7 +35956,7 @@ class SessionStorage {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -36017,12 +35984,12 @@ const EventType = {
     BROKER_CONNECTION_ESTABLISHED: "msal:brokerConnectionEstablished",
 };
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version$3 = "5.17.3";
+const version$3 = "5.18.0";
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -36039,7 +36006,7 @@ function removeElementFromArray(array, element) {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36916,12 +36883,12 @@ class BrowserCacheManager extends CacheManager {
         return parsedAccessToken;
     }
     /**
-     * set accessToken credential to the platform cache
-     * @param accessToken
+     * Set accessToken credential to the platform cache
+     * @param accessToken - the access token entity to cache
      */
-    async setAccessTokenCredential(accessToken, correlationId, kmsi) {
+    async setAccessTokenCredential(accessToken, correlationId, kmsi, additionalCacheKeyHash) {
         this.logger.trace("1pondb", correlationId);
-        const accessTokenKey = this.generateCredentialKey(accessToken);
+        const accessTokenKey = this.generateCredentialKey(accessToken, additionalCacheKeyHash);
         const timestamp = Date.now().toString();
         accessToken.lastUpdatedAt = timestamp;
         await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp, kmsi);
@@ -37231,11 +37198,13 @@ class BrowserCacheManager extends CacheManager {
     }
     /**
      * Generate Credential Key. All changes to the key REQUIRE a schema version update.
-     * Cache Key: msal.<schema_version>|<home_account_id>|<environment>|<credential_type>|<client_id or familyId>|<realm>|<scopes>|<scheme>
+     * Cache Key: msal.<schema_version>|<home_account_id>|<environment>|<credential_type>|<client_id or familyId>|<realm>|<scopes>|<scheme>|<additional_cache_key_components_hash>
+     *
      * @param credentialEntity
+     * @param hash - optional precomputed hash of additionalCacheKeyComponents
      * @returns
      */
-    generateCredentialKey(credential) {
+    generateCredentialKey(credential, additionalCacheKeyHash) {
         const familyId = (credential.credentialType ===
             CredentialType.REFRESH_TOKEN &&
             credential.familyId) ||
@@ -37255,6 +37224,12 @@ class BrowserCacheManager extends CacheManager {
             credential.target || "",
             scheme,
         ];
+        // Append precomputed component-hash segment.
+        if (credential.additionalCacheKeyComponents &&
+            Object.keys(credential.additionalCacheKeyComponents).length > 0 &&
+            additionalCacheKeyHash) {
+            credentialKey.push(additionalCacheKeyHash);
+        }
         return credentialKey.join(CACHE_KEY_SEPARATOR).toLowerCase();
     }
     /**
@@ -37477,7 +37452,7 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient, even
     return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger, performanceClient, eventHandler);
 };
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -37524,7 +37499,7 @@ function getActiveAccount(browserStorage, correlationId) {
     return browserStorage.getActiveAccount(correlationId);
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -37628,7 +37603,7 @@ class EventHandler {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -37768,7 +37743,7 @@ async function clearCacheOnLogout(browserStorage, browserCrypto, logger, correla
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -37846,7 +37821,7 @@ function validateRequestMethod(interactionRequest, protocolMode) {
     return httpMethod;
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38052,7 +38027,7 @@ async function initializeAuthorizationRequest(request, interactionType, config,
     return validatedRequest;
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -38070,7 +38045,7 @@ async function initializeAuthorizationRequest(request, interactionType, config,
  */
 const POPUP_RELAY_RESPONSE_TYPE = "msal:popup-relay-response:v1";
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38176,7 +38151,7 @@ async function waitForPopupRelayResponse(timeoutMs, logger, request, popupWindow
     });
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38200,7 +38175,7 @@ function extractBrowserRequestState(browserCrypto, state, correlationId) {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38239,7 +38214,7 @@ function validateInteractionType(response, browserCrypto, interactionType, corre
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38328,7 +38303,7 @@ class InteractionHandler {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -38337,7 +38312,7 @@ const contentError = "ContentError";
 const pageException = "PageException";
 const userSwitch = "user_switch";
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -38350,7 +38325,7 @@ const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
 const UI_NOT_ALLOWED = "UI_NOT_ALLOWED";
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38422,7 +38397,7 @@ function createNativeAuthError(code, correlationId, description, ext) {
     return error;
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38471,7 +38446,7 @@ class SilentCacheClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38608,13 +38583,18 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @returns CommonSilentFlowRequest
      */
     createSilentCacheRequest(request, cachedAccount) {
-        return {
+        const silentRequest = {
             authority: request.authority,
             correlationId: this.correlationId,
             scopes: ScopeSet.fromString(request.scope, this.correlationId).asArray(),
             account: cachedAccount,
             forceRefresh: false,
         };
+        // Preserve FMI partition semantics for silent cache filtering.
+        if (request.attributeTokens) {
+            silentRequest.attributeTokens = request.attributeTokens.split(" ");
+        }
+        return silentRequest;
     }
     /**
      * Fetches the tokens from the cache if un-expired
@@ -38940,7 +38920,12 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
                 : response.expires_in) || 0;
         const tokenExpirationSeconds = reqTimestamp + expiresIn;
         const responseScopes = this.generateScopes(response.scope, request.scope);
-        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, request.correlationId, undefined, request.tokenType, undefined, request.keyId);
+        const additionalCacheKeyComponents = request.attributeTokens
+            ? {
+                attribute_tokens: request.attributeTokens,
+            }
+            : undefined;
+        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, request.correlationId, undefined, request.tokenType, undefined, request.keyId, additionalCacheKeyComponents);
         // save idtoken credential in configured browser storage
         if (!!cachedIdToken && storeInCache?.idToken !== false) {
             await this.browserStorage.setIdTokenCredential(cachedIdToken, this.correlationId, isKmsi(idTokenClaims));
@@ -39021,11 +39006,18 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const configClaims = request.skipBrokerClaims && !!request.embeddedClientId
             ? undefined
             : this.config.auth.clientCapabilities;
-        // scopes are expected to be received by the native broker as "scope" and will be added to the request below. 'resource' is added in extraParameters for MCP scenarios.
+        /*
+         * scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
+         * attributeTokens is destructured out because PlatformAuthRequest represents it as a pre-serialized string, not the caller-provided Array<string>.
+         */
         const { scopes, claims } = request;
         const scopeSet = new ScopeSet(scopes || [], this.correlationId);
         scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
         const mergedClaims = buildMergedClaims(claims, configClaims?.length ? configClaims : undefined);
+        const hasAttributeTokens = !!request.attributeTokens?.length;
+        this.performanceClient?.addFields({
+            hasAttributeTokens,
+        }, this.correlationId);
         const validatedRequest = {
             claims: mergedClaims,
             accountId: this.accountId,
@@ -39052,6 +39044,10 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             shrClaims: request.shrClaims,
             shrNonce: request.shrNonce,
         };
+        if (hasAttributeTokens) {
+            validatedRequest.attributeTokens =
+                serializeAttributeTokens(request.attributeTokens);
+        }
         // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
         if (validatedRequest.signPopToken && !!request.popKid) {
             throw createBrowserAuthError(invalidPopTokenRequest, this.correlationId);
@@ -39170,7 +39166,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39488,7 +39484,7 @@ async function handleResponseEAR(request, response, apiId, config, authority, br
     return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, apiId, additionalData, undefined, undefined, undefined, undefined));
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39543,7 +39539,7 @@ async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceCl
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39586,7 +39582,7 @@ class NavigationClient {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39733,7 +39729,7 @@ function getHeaderDict(headers) {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39864,7 +39860,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
     return overlayedConfig;
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -40125,7 +40121,7 @@ class PlatformAuthExtensionHandler {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -40273,7 +40269,7 @@ class PlatformAuthDOMHandler {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout, enablePlatformBrokerDOMSupport) {
     logger.trace("134j0v", correlationId);
     logger.trace(`04c81g ${enablePlatformBrokerDOMSupport}`, correlationId);
@@ -40338,7 +40334,7 @@ function isPlatformAuthAllowed(config, logger, correlationId, platformAuthProvid
     return true;
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -40843,7 +40839,7 @@ class PopupClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41286,7 +41282,7 @@ class RedirectClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41352,7 +41348,7 @@ function removeHiddenIframe(iframe) {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41588,7 +41584,7 @@ class SilentIframeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41653,7 +41649,7 @@ class SilentRefreshClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41666,7 +41662,7 @@ class HybridSpaAuthorizationCodeClient extends AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41737,7 +41733,7 @@ class SilentAuthCodeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
     const frameInstances = 
     // @ts-ignore
@@ -41753,7 +41749,7 @@ function collectInstanceStats(currentClientId, performanceEvent, logger, correla
     });
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -42692,21 +42688,32 @@ class StandardController {
             // Create idToken entity and store in browser storage
             const idTokenEntity = createIdTokenEntity(result.account.homeAccountId, result.account.environment, result.idToken, this.config.auth.clientId, result.tenantId);
             // Create accessToken entity and store in native internal storage
+            const attributeTokenPartition = serializeAttributeTokens(request.attributeTokens);
+            const additionalCacheKeyComponents = attributeTokenPartition
+                ? {
+                    attribute_tokens: attributeTokenPartition,
+                }
+                : undefined;
             const accessTokenEntity = createAccessTokenEntity(result.account.homeAccountId, result.account.environment, result.accessToken, this.config.auth.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn
                 ? toSecondsFromDate(result.expiresOn)
                 : 0, result.extExpiresOn
                 ? toSecondsFromDate(result.extExpiresOn)
                 : 0, base64Decode, request.correlationId || "", undefined, // refreshOn
             result.tokenType, undefined, // userAssertionHash
-            request.sshKid);
+            request.sshKid, additionalCacheKeyComponents);
             if (request.resource) {
                 accessTokenEntity.resource = request.resource;
             }
+            // Get attribute token partition hash for cache key isolation
+            const components = additionalCacheKeyComponents;
+            const additionalCacheKeyHash = components
+                ? await this.browserCrypto.hashString(JSON.stringify(components))
+                : undefined;
             const kmsi = isKmsi(result.idTokenClaims);
             // Store idToken in browser storage
             await this.browserStorage.setIdTokenCredential(idTokenEntity, result.correlationId, kmsi);
             // Store accessToken in native internal storage
-            await this.nativeInternalStorage.setAccessTokenCredential(accessTokenEntity, result.correlationId, kmsi);
+            await this.nativeInternalStorage.setAccessTokenCredential(accessTokenEntity, result.correlationId, kmsi, additionalCacheKeyHash);
         }
         else {
             return this.browserStorage.hydrateCache(result, request);
@@ -43237,7 +43244,7 @@ function checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheL
     return isSilentlyResolvable && tryIframeRenewal;
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -43342,7 +43349,7 @@ class BaseOperatingContext {
     }
 }
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -43389,7 +43396,7 @@ StandardOperatingContext.MODULE_NAME = "";
  */
 StandardOperatingContext.ID = "StandardOperatingContext";
 
-/*! @azure/msal-browser v5.17.3 2026-07-29 */
+/*! @azure/msal-browser v5.18.0 2026-08-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -44021,7 +44028,7 @@ const createClientLogCallback = (provider, metadata, scope) => {
 };
 
 // Generated by genversion.
-const version$2 = '11.0.0-next.0';
+const version$2 = '10.0.2';
 
 /**
  * Zod schema for telemetry configuration validation.
@@ -44036,15 +44043,10 @@ const TelemetryConfigSchema = z.object({
     }),
     scope: z.array(z.string()).optional().default(['framework', 'authentication']),
 });
-
 /**
  * Zod schema for MSAL module configuration validation.
  *
- * @remarks
- * Kept in its own module so the configuration can be extended at its source.
- * The schema itself describes what reaches `MsalProvider` and strips anything
- * else; keys a variant of this module needs only while the configuration is
- * being built are declared on {@link MsalConfigExtension} instead.
+ * @internal
  */
 const MsalConfigSchema = z.object({
     client: z.custom().optional(),
@@ -44057,19 +44059,9 @@ const MsalConfigSchema = z.object({
         .custom((val) => typeof val === 'number' &&
         Object.values(CacheLookupPolicy).includes(val))
         .optional(),
-    version: z.string().transform((value, ctx) => {
-        const coerced = semver.coerce(value);
-        // `semver.coerce` returns `null` for an unparseable version; without this guard it
-        // would silently become the literal string "null" instead of failing validation.
-        if (!coerced) {
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Invalid MSAL module version' });
-            return z.NEVER;
-        }
-        return coerced.version;
-    }),
+    version: z.string().transform((x) => String(semver.coerce(x))),
     telemetry: TelemetryConfigSchema,
 });
-
 /**
  * Configuration builder for MSAL v4 authentication module.
  *
@@ -44085,7 +44077,6 @@ const MsalConfigSchema = z.object({
  */
 class MsalConfigurator extends BaseConfigBuilder {
     #msalConfig;
-    #client;
     /**
      * The MSAL module version being configured.
      *
@@ -44112,9 +44103,6 @@ class MsalConfigurator extends BaseConfigBuilder {
                 return telemetry;
             }
         });
-        // Always resolve the configured client instance through the builder.
-        // This keeps the client getter live and avoids re-registering the same config key.
-        this._set('client', async () => this.#client);
         // Default cache lookup policy to AccessTokenAndRefreshToken to avoid iframe fallback delays
         this._set('cacheLookupPolicy', async () => CacheLookupPolicy.AccessTokenAndRefreshToken);
     }
@@ -44142,22 +44130,6 @@ class MsalConfigurator extends BaseConfigBuilder {
         this.#msalConfig = config;
         return this;
     }
-    /**
-     * Returns the client configuration declared through
-     * {@link MsalConfigurator.setClientConfig | setClientConfig}, if any.
-     *
-     * @remarks
-     * This is the configuration as declared, not the resolved one a client is
-     * built from — see
-     * {@link MsalConfigurator._createClientConfig | _createClientConfig} for that.
-     * Reading it is how a subclass can tell "nothing was declared" apart from
-     * "declared, and here it is", without re-deriving that from a resolved value.
-     *
-     * @returns The declared client configuration, or `undefined` when none was declared.
-     */
-    getClientConfig() {
-        return this.#msalConfig;
-    }
     /**
      * Sets the cache lookup policy used for every silent token acquisition.
      *
@@ -44291,21 +44263,9 @@ class MsalConfigurator extends BaseConfigBuilder {
      * ```
      */
     setClient(client) {
-        this.#client = client;
+        this._set('client', async () => client);
         return this;
     }
-    /**
-     * Returns the currently configured MSAL client, if one has been set.
-     *
-     * @remarks
-     * This is useful in tests when a mock client has been provided and the test
-     * wants to adjust its state after it has been assigned to the configurator.
-     *
-     * @returns The configured client, or `undefined` when none has been set.
-     */
-    getClient() {
-        return this.#client;
-    }
     /**
      * Sets telemetry provider for MSAL authentication events.
      *
@@ -44353,151 +44313,64 @@ class MsalConfigurator extends BaseConfigBuilder {
     /**
      * Processes and validates the configuration.
      *
-     * @param rawConfig - Raw configuration object
-     * @param init - The builder arguments, carrying the host reference when hoisted
+     * @param config - Raw configuration object
      * @returns Processed and validated configuration
      */
-    async _processConfig(rawConfig, init) {
+    async _processConfig(rawConfig) {
         // Validate and coerce configuration using Zod schema
         const config = await MsalConfigSchema.parseAsync(rawConfig);
-        // Auto-create client if no client instance was supplied
+        // Auto-create client if config provided but no client instance
         // This allows users to provide configuration without manually instantiating the client
-        // A hoisted module authenticates through the host's provider, so any client built here
-        // would be discarded — gate it here rather than in `_createClient`, so a substituted
-        // client (see `MsalMockConfigurator`) cannot shadow the host's signed-in user
-        if (!config.client && !this._isHoisted(init)) {
-            config.client = await this._createClient(config, init);
-        }
-        return config;
-    }
-    /**
-     * Creates the client to authenticate through, when none was supplied.
-     *
-     * @remarks
-     * Called by {@link MsalConfigurator._processConfig | _processConfig} only when
-     * no client was set, so a client supplied through
-     * {@link MsalConfigurator.setClient | setClient} always wins. It is likewise
-     * not called when the module is hoisted onto a host application's provider —
-     * see {@link MsalConfigurator._isHoisted | _isHoisted}.
-     *
-     * This is the seam for authenticating through something other than Entra ID.
-     * Overriding it replaces only the client, leaving the builder, the schema
-     * validation and `MsalProvider` untouched — which is how
-     * `MsalMockConfigurator` substitutes an in-process client for tests.
-     *
-     * An override normally builds from
-     * {@link MsalConfigurator._createClientConfig | _createClientConfig}, so it
-     * receives the same fully-resolved {@link MsalClientConfig} the real client is
-     * built from rather than re-deriving it.
-     *
-     * Returning `undefined` is legitimate and means "there is nothing to build a
-     * client from", which leaves the module without one.
-     *
-     * @param config - The validated configuration the client is built from.
-     * @param init - The builder arguments, carrying the host reference when hoisted.
-     * @returns The client, or `undefined` when there is nothing to build one from.
-     */
-    async _createClient(config, _init) {
-        const clientConfig = this._createClientConfig(config);
-        // A client can be omitted for a hoisted module or an intentionally incomplete setup.
-        if (!clientConfig) {
-            return undefined;
-        }
-        // Instantiate MSAL client with fully configured options
-        return new MsalClient(clientConfig);
-    }
-    /**
-     * Whether this module is hoisted onto a host application's authentication.
-     *
-     * @remarks
-     * When an application runs inside a host — a portal loading an app, or an app
-     * loading a widget — the module initializer returns a proxy of the host's
-     * provider instead of building its own (see the host-provider branch of the
-     * module initializer). A client built during configuration would therefore be
-     * constructed and immediately discarded.
-     *
-     * Detecting this during configuration lets the configurator skip building a
-     * client entirely, which matters most for substituted clients: a mock client
-     * built here would otherwise silently shadow the host's real signed-in user.
-     *
-     * @param init - The builder arguments, carrying the host reference when hoisted.
-     * @returns `true` when a host provider will be used instead of a locally built client.
-     */
-    _isHoisted(init) {
-        return !!init?.ref?.auth;
-    }
-    /**
-     * Resolves the full MSAL client configuration to build a client from.
-     *
-     * @remarks
-     * Applies the defaults a client is expected to be built with — authority
-     * derived from the tenant, cache location, telemetry-backed logging and the
-     * configured cache lookup policy.
-     *
-     * Kept separate from {@link MsalConfigurator._createClient | _createClient} so
-     * that substituting the client does not also mean re-implementing this
-     * resolution. `MsalMockConfigurator` relies on it to hand its mock client the
-     * very same configuration the real client would have received.
-     *
-     * @param config - The validated configuration.
-     * @returns The client configuration, or `undefined` when none was declared.
-     */
-    _createClientConfig(config) {
-        const declared = this.#msalConfig;
-        // Do not construct a client when configuration has not supplied client settings.
-        if (!declared) {
-            return undefined;
-        }
-        config.telemetry.provider?.trackEvent({
-            name: 'module-msal.configurator._processConfig.creating-client',
-            level: TelemetryLevel.Debug,
-            scope: config.telemetry.scope,
-            metadata: { ...config.telemetry.metadata, clientConfig: declared },
-        });
-        // Copied rather than enriched in place, so the object a caller passed to
-        // `setClientConfig` is never rewritten behind its back — a caller may well
-        // be reusing or asserting on it
-        const clientConfig = {
-            ...declared,
-            auth: { ...declared.auth },
-            // Default to localStorage: MSAL supports sessionStorage too, but
-            // localStorage is the standard for persistent auth in browsers
-            cache: declared.cache ?? { cacheLocation: 'localStorage' },
-        };
-        // Auto-generate authority URL from tenant ID if not explicitly provided
-        // This simplifies configuration for most common cases
-        if (!clientConfig.auth.authority && clientConfig.auth.tenantId) {
-            clientConfig.auth.authority = `https://login.microsoftonline.com/${clientConfig.auth.tenantId}`;
-        }
-        // Integrate framework telemetry with MSAL logging system
-        // This allows MSAL events to flow through the framework's telemetry pipeline
-        if (!clientConfig.system?.loggerOptions && config.telemetry?.provider) {
-            const { provider, metadata, scope } = config.telemetry;
-            provider.trackEvent({
-                name: 'module-msal.configurator._processConfig.client-telemetry-connected',
+        if (!config.client && this.#msalConfig) {
+            const clientConfig = this.#msalConfig;
+            config.telemetry.provider?.trackEvent({
+                name: 'module-msal.configurator._processConfig.creating-client',
                 level: TelemetryLevel.Debug,
-                scope,
-                metadata,
+                scope: config.telemetry.scope,
+                metadata: { ...config.telemetry.metadata, clientConfig },
             });
-            clientConfig.system = {
-                ...clientConfig.system,
-                loggerOptions: {
-                    // Only log PII in development to protect user privacy in production
-                    piiLoggingEnabled: process.env.NODE_ENV === 'development',
-                    // Bridge MSAL log events to framework telemetry system
-                    loggerCallback: createClientLogCallback(provider, metadata, [...scope, '3rd-party']),
-                    // Use Warning level by default - captures errors and warnings without being verbose
-                    logLevel: LogLevel.Warning,
-                    // Preserve any user-provided logger options (allows customization)
-                    ...clientConfig.system?.loggerOptions,
-                },
-            };
-        }
-        // Apply silent cache lookup policy if configured
-        if (config.cacheLookupPolicy !== undefined) {
-            clientConfig.cacheLookupPolicy = config.cacheLookupPolicy;
+            // Auto-generate authority URL from tenant ID if not explicitly provided
+            // This simplifies configuration for most common cases
+            if (!clientConfig.auth.authority && clientConfig.auth.tenantId) {
+                clientConfig.auth.authority = `https://login.microsoftonline.com/${clientConfig.auth.tenantId}`;
+            }
+            // Set default cache location to localStorage for browser environments
+            // MSAL supports sessionStorage as well, but localStorage is the standard for persistent auth
+            if (!clientConfig.cache) {
+                clientConfig.cache = { cacheLocation: 'localStorage' };
+            }
+            // Integrate framework telemetry with MSAL logging system
+            // This allows MSAL events to flow through the framework's telemetry pipeline
+            if (!clientConfig.system?.loggerOptions && config.telemetry?.provider) {
+                const { provider, metadata, scope } = config.telemetry;
+                provider.trackEvent({
+                    name: 'module-msal.configurator._processConfig.client-telemetry-connected',
+                    level: TelemetryLevel.Debug,
+                    scope,
+                    metadata,
+                });
+                clientConfig.system = {
+                    ...clientConfig.system,
+                    loggerOptions: {
+                        // Only log PII in development to protect user privacy in production
+                        piiLoggingEnabled: process.env.NODE_ENV === 'development',
+                        // Bridge MSAL log events to framework telemetry system
+                        loggerCallback: createClientLogCallback(provider, metadata, [...scope, '3rd-party']),
+                        // Use Warning level by default - captures errors and warnings without being verbose
+                        logLevel: LogLevel.Warning,
+                        // Preserve any user-provided logger options (allows customization)
+                        ...clientConfig.system?.loggerOptions,
+                    },
+                };
+            }
+            // Apply silent cache lookup policy if configured
+            if (config.cacheLookupPolicy !== undefined) {
+                clientConfig.cacheLookupPolicy = config.cacheLookupPolicy;
+            }
+            // Instantiate MSAL client with fully configured options
+            config.client = new MsalClient(clientConfig);
         }
-        return clientConfig;
+        return config;
     }
 }
 
@@ -44615,6 +44488,7 @@ class VersionError extends Error {
  * ```
  */
 function mapVersionToEnumVersion(version) {
+    console.log('Resolving version:', version);
     const coercedVersion = semver.coerce(version);
     // An uncoercible version string cannot be mapped to a module version
     if (!coercedVersion) {
@@ -48501,7 +48375,7 @@ class ServiceDiscoveryConfigurator extends BaseConfigBuilder {
 }
 
 // Generated by genversion.
-const version$1 = '10.1.0-next.0';
+const version$1 = '10.0.2';
 
 /**
  * Default implementation of {@link IServiceDiscoveryProvider}.
@@ -48525,10 +48399,6 @@ class ServiceDiscoveryProvider extends BaseModuleProvider {
         this.config = config;
         this._http = _http;
     }
-    /** {@inheritDoc IServiceDiscoveryProvider.client} */
-    get client() {
-        return this.config.discoveryClient;
-    }
     /** {@inheritDoc IServiceDiscoveryProvider.resolveServices} */
     resolveServices() {
         return this.config.discoveryClient.resolveServices();
@@ -48643,9 +48513,8 @@ const configureServiceDiscovery = (callback) => ({
  *
  * @param configurator - The modules configurator to register the module on.
  *   Must already include {@link HttpModule}.
- * @param callback - Optional callback receiving a
- *   {@link ServiceDiscoveryConfigurator} for advanced setup. May be synchronous
- *   or asynchronous.
+ * @param callback - Optional async callback receiving a
+ *   {@link ServiceDiscoveryConfigurator} for advanced setup.
  *
  * @example
  * ```typescript
@@ -49140,7 +49009,7 @@ async function registerServiceWorker(framework) {
 }
 
 // Generated by genversion.
-const version = '4.0.17-next.0';
+const version = '4.0.17';
 
 // Allow dynamic import without vite
 const importWithoutVite = (path) => import(/* @vite-ignore */ path);