@equinor/fusion-framework-vite-plugin-spa 5.0.0 → 5.2.0

package/dist/{module-DMrP0Kg2.js → module-Xg35JJRU.js}

@@ -3712,13 +3712,13 @@ function fromIterable(iterable) {
 }
 function fromAsyncIterable(asyncIterable) {
     return new Observable(function (subscriber) {
-        process$2(asyncIterable, subscriber).catch(function (err) { return subscriber.error(err); });
+        process$1(asyncIterable, subscriber).catch(function (err) { return subscriber.error(err); });
     });
 }
 function fromReadableStreamLike(readableStream) {
     return fromAsyncIterable(readableStreamLikeToAsyncGenerator(readableStream));
 }
-function process$2(asyncIterable, subscriber) {
+function process$1(asyncIterable, subscriber) {
     var asyncIterable_1, asyncIterable_1_1;
     var e_2, _a;
     return __awaiter(this, void 0, void 0, function () {
@@ -4499,16 +4499,23 @@ function jsonStringifyReplacer(_, value) {
         return value.toString();
     return value;
 }
+// the accessor lives on a shared prototype: an own accessor makes every box a dictionary-mode object (~360 B and a slow load per read against ~100 B and an inlined getter here)
+class Cached {
+    constructor(getter) {
+        this._getter = getter;
+        this._value = undefined;
+    }
+    get value() {
+        const getter = this._getter;
+        if (getter !== undefined) {
+            this._value = getter();
+            this._getter = undefined;
+        }
+        return this._value;
+    }
+}
 function cached(getter) {
-    return {
-        get value() {
-            {
-                const value = getter();
-                Object.defineProperty(this, "value", { value });
-                return value;
-            }
-        },
-    };
+    return new Cached(getter);
 }
 function nullish(input) {
     return input === null || input === undefined;
@@ -4535,6 +4542,71 @@ function assignProp(target, prop, value) {
         configurable: true,
     });
 }
+/**
+ * Whichever object a def's `shape` currently answers from: the one the caller passed until the first read, the frozen copy after it.
+ *
+ * Its keys and descriptors read without invoking anything, which is what lets a discriminated union check its discriminator, and the cycle walk read a shape, without resolving a getter that references the schema being constructed. A def that answers `shape` from an accessor of its own has none.
+ */
+function rawShape(def) {
+    const desc = Object.getOwnPropertyDescriptor(def, "shape");
+    return desc?.get ? desc.get.raw : desc?.value;
+}
+// where a builder reads its source's keys and descriptors, resolving only a shape a def answers for itself. A shape resolves by object spread, so only its enumerable keys are ever part of it.
+function sourceShape(schema) {
+    return rawShape(schema._zod.def) ?? schema._zod.def.shape;
+}
+// a key whose value is not settled yet, self-caching so every read after the first gets the same one
+function deferProp(target, key, getter) {
+    Object.defineProperty(target, key, {
+        get() {
+            const value = getter();
+            assignProp(this, key, value);
+            return value;
+        },
+        enumerable: true,
+        configurable: true,
+    });
+}
+// Writes a settled key. A plain assignment is much cheaper than `defineProperty` and produces the same descriptor, but it runs whatever setter already answers to the key — an accessor this shape deferred, or an inherited one, which `__proto__` has on every object and prototype pollution can add for any name.
+function putProp(target, key, value) {
+    if (key in target)
+        assignProp(target, key, value);
+    else
+        target[key] = value;
+}
+/**
+ * Copies `keys` of `source`'s shape onto `target`, each value passed through `wrap`.
+ *
+ * A key the source has resolved is copied through now, so the derived shape states it outright and nothing has to resolve it to learn what it holds. A key the source still defers stays deferred, and reads back through the source's own `shape`, so it resolves once and both shapes get that one schema.
+ */
+function mirrorShape(target, source, keys, wrap) {
+    const raw = sourceShape(source);
+    for (const key of keys) {
+        const desc = Object.getOwnPropertyDescriptor(raw, key);
+        if (!desc.enumerable)
+            continue;
+        if (desc.get) {
+            deferProp(target, key, () => {
+                const value = source._zod.def.shape[key];
+                return wrap ? wrap(value, key) : value;
+            });
+        }
+        else
+            putProp(target, key, wrap ? wrap(desc.value, key) : desc.value);
+    }
+}
+// same, for a plain shape a caller passed rather than a schema's
+function mirrorProps(target, source) {
+    for (const key of Reflect.ownKeys(source)) {
+        const desc = Object.getOwnPropertyDescriptor(source, key);
+        if (!desc.enumerable)
+            continue;
+        if (desc.get)
+            deferProp(target, key, () => source[key]);
+        else
+            putProp(target, key, desc.value);
+    }
+}
 function mergeDefs(...defs) {
     const mergedDescriptors = {};
     for (const def of defs) {
@@ -4653,6 +4725,10 @@ const NUMBER_FORMAT_RANGES = /*@__PURE__*/ (() => ({
     float32: [-34028234663852886e22, 3.4028234663852886e38],
     float64: [-Number.MAX_VALUE, Number.MAX_VALUE],
 }))();
+const BIGINT_FORMAT_RANGES = {
+    int64: [/* @__PURE__*/ BigInt("-9223372036854775808"), /* @__PURE__*/ BigInt("9223372036854775807")],
+    uint64: [/* @__PURE__*/ BigInt(0), /* @__PURE__*/ BigInt("18446744073709551615")],
+};
 function pick(schema, mask) {
     const currDef = schema._zod.def;
     const checks = currDef.checks;
@@ -4660,24 +4736,23 @@ function pick(schema, mask) {
     if (hasChecks) {
         throw new Error(".pick() cannot be used on object schemas containing refinements");
     }
-    const def = mergeDefs(schema._zod.def, {
-        get shape() {
-            const newShape = {};
-            // `for...in` skips symbols, so a symbol in the mask would select nothing
-            for (const key of Reflect.ownKeys(mask)) {
-                if (!Object.prototype.hasOwnProperty.call(currDef.shape, key)) {
-                    throw new Error(`Unrecognized key: "${String(key)}"`);
-                }
-                if (!mask[key])
-                    continue;
-                assignProp(newShape, key, currDef.shape[key]);
-            }
-            assignProp(this, "shape", newShape); // self-caching
-            return newShape;
-        },
-        checks: [],
-    });
-    return clone(schema, def);
+    const newShape = {};
+    mirrorShape(newShape, schema, maskedKeys(schema, mask));
+    return clone(schema, mergeDefs(currDef, { shape: newShape, checks: [] }));
+}
+// the mask keys that select something, checked against the source's shape without resolving it
+function maskedKeys(schema, mask) {
+    const raw = sourceShape(schema);
+    const keys = [];
+    // `for...in` skips symbols, so a symbol in the mask would select nothing
+    for (const key of Reflect.ownKeys(mask)) {
+        if (!Object.getOwnPropertyDescriptor(raw, key)?.enumerable) {
+            throw new Error(`Unrecognized key: "${String(key)}"`);
+        }
+        if (mask[key])
+            keys.push(key);
+    }
+    return keys;
 }
 function omit(schema, mask) {
     const currDef = schema._zod.def;
@@ -4686,23 +4761,10 @@ function omit(schema, mask) {
     if (hasChecks) {
         throw new Error(".omit() cannot be used on object schemas containing refinements");
     }
-    const def = mergeDefs(schema._zod.def, {
-        get shape() {
-            const newShape = { ...schema._zod.def.shape };
-            for (const key of Reflect.ownKeys(mask)) {
-                if (!Object.prototype.hasOwnProperty.call(currDef.shape, key)) {
-                    throw new Error(`Unrecognized key: "${String(key)}"`);
-                }
-                if (!mask[key])
-                    continue;
-                delete newShape[key];
-            }
-            assignProp(this, "shape", newShape); // self-caching
-            return newShape;
-        },
-        checks: [],
-    });
-    return clone(schema, def);
+    const omitted = new Set(maskedKeys(schema, mask));
+    const newShape = {};
+    mirrorShape(newShape, schema, Reflect.ownKeys(sourceShape(schema)).filter((key) => !omitted.has(key)));
+    return clone(schema, mergeDefs(currDef, { shape: newShape, checks: [] }));
 }
 function extend(schema, shape) {
     if (!isPlainObject$2(shape)) {
@@ -4712,34 +4774,27 @@ function extend(schema, shape) {
     const hasChecks = checks && checks.length > 0;
     if (hasChecks) {
         // Only throw if new shape overlaps with existing shape. Use getOwnPropertyDescriptor to check key existence without accessing values
-        const existingShape = schema._zod.def.shape;
+        const existingShape = sourceShape(schema);
         for (const key of Reflect.ownKeys(shape)) {
             if (Object.getOwnPropertyDescriptor(existingShape, key) !== undefined) {
                 throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.");
             }
         }
     }
-    const def = mergeDefs(schema._zod.def, {
-        get shape() {
-            const _shape = { ...schema._zod.def.shape, ...shape };
-            assignProp(this, "shape", _shape); // self-caching
-            return _shape;
-        },
-    });
-    return clone(schema, def);
+    return clone(schema, mergeDefs(schema._zod.def, { shape: extended(schema, shape) }));
+}
+// the source's keys, then the caller's overlaid on top
+function extended(schema, shape) {
+    const newShape = {};
+    mirrorShape(newShape, schema, Reflect.ownKeys(sourceShape(schema)));
+    mirrorProps(newShape, shape);
+    return newShape;
 }
 function safeExtend(schema, shape) {
     if (!isPlainObject$2(shape)) {
         throw new Error("Invalid input to safeExtend: expected a plain object");
     }
-    const def = mergeDefs(schema._zod.def, {
-        get shape() {
-            const _shape = { ...schema._zod.def.shape, ...shape };
-            assignProp(this, "shape", _shape); // self-caching
-            return _shape;
-        },
-    });
-    return clone(schema, def);
+    return clone(schema, mergeDefs(schema._zod.def, { shape: extended(schema, shape) }));
 }
 function merge(a, b) {
     if (!b?._zod?.def) {
@@ -4748,12 +4803,11 @@ function merge(a, b) {
     if (a._zod.def.checks?.length) {
         throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");
     }
+    const newShape = {};
+    mirrorShape(newShape, a, Reflect.ownKeys(sourceShape(a)));
+    mirrorShape(newShape, b, Reflect.ownKeys(sourceShape(b)));
     const def = mergeDefs(a._zod.def, {
-        get shape() {
-            const _shape = { ...a._zod.def.shape, ...b._zod.def.shape };
-            assignProp(this, "shape", _shape); // self-caching
-            return _shape;
-        },
+        shape: newShape,
         get catchall() {
             return b._zod.def.catchall;
         },
@@ -4768,78 +4822,19 @@ function partial(Class, schema, mask, name = "partial") {
     if (hasChecks) {
         throw new Error(`.${name}() cannot be used on object schemas containing refinements`);
     }
-    const def = mergeDefs(schema._zod.def, {
-        get shape() {
-            const oldShape = schema._zod.def.shape;
-            const shape = { ...oldShape };
-            if (mask) {
-                for (const key of Reflect.ownKeys(mask)) {
-                    if (!Object.prototype.hasOwnProperty.call(oldShape, key)) {
-                        throw new Error(`Unrecognized key: "${String(key)}"`);
-                    }
-                    if (!mask[key])
-                        continue;
-                    // if (oldShape[key]!._zod.optin === "optional") continue;
-                    shape[key] = Class
-                        ? new Class({
-                            type: "optional",
-                            innerType: oldShape[key],
-                        })
-                        : oldShape[key];
-                }
-            }
-            else {
-                // the spread copies symbol keys; `for...in` would not reach them
-                for (const key of Reflect.ownKeys(oldShape)) {
-                    // if (oldShape[key]!._zod.optin === "optional") continue;
-                    shape[key] = Class
-                        ? new Class({
-                            type: "optional",
-                            innerType: oldShape[key],
-                        })
-                        : oldShape[key];
-                }
-            }
-            assignProp(this, "shape", shape); // self-caching
-            return shape;
-        },
-        checks: [],
-    });
-    return clone(schema, def);
+    const selected = mask ? new Set(maskedKeys(schema, mask)) : undefined;
+    const newShape = {};
+    mirrorShape(newShape, schema, Reflect.ownKeys(sourceShape(schema)), Class &&
+        ((value, key) => (selected && !selected.has(key) ? value : new Class({ type: "optional", innerType: value }))));
+    return clone(schema, mergeDefs(schema._zod.def, { shape: newShape, checks: [] }));
 }
 function required(Class, schema, mask) {
-    const def = mergeDefs(schema._zod.def, {
-        get shape() {
-            const oldShape = schema._zod.def.shape;
-            const shape = { ...oldShape };
-            if (mask) {
-                for (const key of Reflect.ownKeys(mask)) {
-                    if (!Object.prototype.hasOwnProperty.call(shape, key)) {
-                        throw new Error(`Unrecognized key: "${String(key)}"`);
-                    }
-                    if (!mask[key])
-                        continue;
-                    // overwrite with non-optional
-                    shape[key] = new Class({
-                        type: "nonoptional",
-                        innerType: oldShape[key],
-                    });
-                }
-            }
-            else {
-                for (const key of Reflect.ownKeys(oldShape)) {
-                    // overwrite with non-optional
-                    shape[key] = new Class({
-                        type: "nonoptional",
-                        innerType: oldShape[key],
-                    });
-                }
-            }
-            assignProp(this, "shape", shape); // self-caching
-            return shape;
-        },
-    });
-    return clone(schema, def);
+    const selected = mask ? new Set(maskedKeys(schema, mask)) : undefined;
+    const newShape = {};
+    mirrorShape(newShape, schema, Reflect.ownKeys(sourceShape(schema)), (value, key) => 
+    // overwrite with non-optional
+    selected && !selected.has(key) ? value : new Class({ type: "nonoptional", innerType: value }));
+    return clone(schema, mergeDefs(schema._zod.def, { shape: newShape }));
 }
 // invalid_type | too_big | too_small | invalid_format | not_multiple_of | unrecognized_keys | invalid_union | invalid_key | invalid_element | invalid_value | custom
 function aborted(x, startIndex = 0) {
@@ -4901,13 +4896,19 @@ function finalizeIssue(iss, ctx, config) {
             unwrapMessage(config.customError?.(iss)) ??
             unwrapMessage(config.localeError?.(iss)) ??
             "Invalid input");
-    const { inst: _inst, schema: _schema, continue: _continue, input: _input, ...rest } = iss;
-    rest.path ?? (rest.path = []);
-    rest.message = message;
+    // an explicit own-key copy beats object rest with excluded keys, which v8 routes through a generic runtime call; Object.keys rather than for-in so an issue pushed with a prototype does not leak inherited keys, and an own __proto__ key is dropped rather than assigned through the setter
+    const full = {};
+    for (const k of Object.keys(iss)) {
+        if (k === "inst" || k === "schema" || k === "continue" || k === "input" || k === "__proto__")
+            continue;
+        full[k] = iss[k];
+    }
+    full.path ?? (full.path = []);
+    full.message = message;
     if (ctx?.reportInput) {
-        rest.input = _input;
+        full.input = iss.input;
     }
-    return rest;
+    return full;
 }
 const highSurrogate = /[\uD800-\uDBFF]/;
 // Code points in `str`: a surrogate pair counts once, a lone surrogate as itself. Hand-rolled because the string iterator allocates and runs ~250x slower on this path; the regex probe exits ~50x quicker for a string with no astral characters.
@@ -4992,6 +4993,24 @@ function own(inst, key, value, enumerable = true) {
 function hide(inst, key, value) {
     return own(inst, key, value, false);
 }
+/** Adds members a table derives from the instance: each builds on first read and shadows as own data, and assignment shadows the same way, as when these were own properties. */
+function derived(computes, table) {
+    for (const key in computes) {
+        const compute = computes[key];
+        // an object literal's accessor is configurable and enumerable, and `members` copies the descriptor as written
+        Object.defineProperty(table, key, {
+            configurable: true,
+            enumerable: true,
+            get() {
+                return own(this, key, compute(this));
+            },
+            set(value) {
+                own(this, key, value);
+            },
+        });
+    }
+    return table;
+}
 function defineBound(proto, key, fn) {
     Object.defineProperty(proto, key, {
         configurable: true,
@@ -5104,7 +5123,7 @@ const NEVER = /*@__PURE__*/ Object.freeze({
 });
 /* Shared descriptor for installing `_zod`; defineProperty reads it
  * synchronously, so reusing one object avoids a per-instance allocation. */
-const _zodDesc$1 = { value: undefined, enumerable: false };
+const _zodDesc = { value: undefined, enumerable: false };
 // null where suppressing the capture would be unrecoverable: `parse()` puts the frames back with `captureStackTrace`, so without it the throw would lose its stack. also latched to null once `stackTraceLimit` proves unassignable, which a realm can do at any point by hardening Error
 let _E = "captureStackTrace" in Error ? Error : null;
 // v8 captures a stack trace inside the Error constructor, which dominates a failed parse; costs only the frames, and parse() restores those. the constructor must RUN: Object.create is cheaper and passes instanceof, but Error.isError and util.types.isNativeError check an internal slot
@@ -5147,16 +5166,16 @@ proto, params) {
     const initialized = protoMembers && new WeakSet();
     function init(inst, def) {
         if (!inst._zod) {
-            _zodDesc$1.value = new Internals(def);
+            _zodDesc.value = new Internals(def);
             try {
-                Object.defineProperty(inst, "_zod", _zodDesc$1);
+                Object.defineProperty(inst, "_zod", _zodDesc);
             }
             finally {
                 // Cleared even on throw, so the shared descriptor never leaks one instance's internals into the next.
-                _zodDesc$1.value = undefined;
+                _zodDesc.value = undefined;
             }
         }
-        if (inst._zod.traits.has(name)) {
+        else if (inst._zod.traits.has(name)) {
             return;
         }
         inst._zod.traits.add(name);
@@ -5256,7 +5275,6 @@ const _messageDesc = {
     enumerable: true,
     configurable: true,
 };
-const _zodDesc = { value: undefined, enumerable: false };
 const _issuesDesc = { value: undefined, enumerable: false };
 /* Prototypes that already carry the lazy `toString`. Seeded with the
  * intrinsics so that `init` on a foreign object — it accepts any object —
@@ -5264,12 +5282,10 @@ const _issuesDesc = { value: undefined, enumerable: false };
 const _installedToString = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 const initializer$1 = (inst, def) => {
     inst.name = "$ZodError";
-    _zodDesc.value = inst._zod;
-    Object.defineProperty(inst, "_zod", _zodDesc);
+    // `_zod` is already non-enumerable: $constructor's init defined it with this same descriptor
     _issuesDesc.value = def;
     Object.defineProperty(inst, "issues", _issuesDesc);
-    // Clear the shared slots; a retained `value` pins the last error's issues.
-    _zodDesc.value = undefined;
+    // Clear the shared slot; a retained `value` pins the last error's issues.
     _issuesDesc.value = undefined;
     Object.defineProperty(inst, "message", _messageDesc);
     /* `toString` lives as a non-enumerable lazy getter on the shared
@@ -5293,9 +5309,6 @@ const initializer$1 = (inst, def) => {
     }
 };
 const $ZodError = $constructor("$ZodError", initializer$1);
-const $ZodRealError = $constructor("$ZodError", initializer$1, undefined, {
-    Parent: Error,
-});
 /** Get-or-create `obj[key]` as an own data property. A path segment naming an inherited member
  * ("toString", "constructor") would otherwise read through to the prototype, and assigning
  * "__proto__" would hit the setter instead of creating a key. */
@@ -5424,27 +5437,81 @@ const _safeParse = (_Err) => (schema, value, _ctx) => {
     if (result instanceof Promise) {
         throw new $ZodAsyncError();
     }
-    return result.issues.length
-        ? {
-            success: false,
-            error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))),
-        }
-        : { success: true, data: result.value };
+    return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
 };
-const safeParse$1 = /* @__PURE__*/ _safeParse($ZodRealError);
+// the error is built on the first read of `error`: finalizing the issues and constructing the instance is most of a failing parse, and a caller that only branches on `success` never pays it. a getter in the literal keeps this small; the alternative, one shared accessor descriptor plus a hidden state slot, reads ~15% faster but costs ~75 B gzipped in every bundle
+function failure(Err, issues, ctx) {
+    let error;
+    return {
+        success: false,
+        get error() {
+            if (!error) {
+                error = new Err(issues.map((iss) => finalizeIssue(iss, ctx, config())));
+                // finalizeIssue drops `input`, so the built error holds nothing; keeping the raw issues past this point pins the parsed value for the life of the result
+                issues = undefined;
+                ctx = undefined;
+            }
+            return error;
+        },
+        set error(e) {
+            error = e;
+            // a replacement makes the getter's branch unreachable, so the captures have to go here too
+            issues = undefined;
+            ctx = undefined;
+        },
+    };
+}
 const _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
     const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
     let result = schema._zod.run({ value, issues: [] }, ctx);
     if (result instanceof Promise)
         result = await result;
-    return result.issues.length
-        ? {
-            success: false,
-            error: new _Err(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))),
-        }
-        : { success: true, data: result.value };
+    return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
+};
+// registry mirrors of the compiler's sentinels, so this module never imports the compiler
+const COMPILE_INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
+const COMPILE_FALLBACK = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
+// Deliberately tiny, because v8 will not inline a body carrying the fallback's object literals and throw. Everything that is not the compiled happy path lives in validateFallback, and that split is worth ~35% on a compiled schema.
+const validate = ((schema, value, _ctx) => {
+    const validator = schema._zod.bag.validator;
+    if (validator !== undefined) {
+        if (validator(value) !== COMPILE_INVALID)
+            return true;
+        // a definite sentinel means the runtime would reject, so skip the re-parse; a ctx can still change the answer
+        if (validator.definite === true && _ctx === undefined)
+            return false;
+    }
+    return validateFallback(schema, value, _ctx);
+});
+function validateFallback(schema, value, _ctx) {
+    const ctx = _ctx
+        ? { ..._ctx, async: false, abortEarly: true }
+        : { async: false, abortEarly: true };
+    const fallbackRun = schema._zod.bag.fallbackRun;
+    let result;
+    if (fallbackRun) {
+        // skip nested fast paths on the fallback, so user callbacks keep the at-most-twice bound
+        ctx[COMPILE_FALLBACK] = true;
+        result = fallbackRun({ value, issues: [] }, ctx);
+    }
+    else {
+        result = schema._zod.run({ value, issues: [] }, ctx);
+    }
+    if (result instanceof Promise) {
+        throw new $ZodAsyncError();
+    }
+    return result.issues.length === 0;
+}
+// no fast path: the compiler keeps async parses on the runtime, because a promise-returning callback that is not declared async compiles to a throw
+const validateAsync$1 = async (schema, value, _ctx) => {
+    const ctx = _ctx
+        ? { ..._ctx, async: true, abortEarly: true }
+        : { async: true, abortEarly: true };
+    let result = schema._zod.run({ value, issues: [] }, ctx);
+    if (result instanceof Promise)
+        result = await result;
+    return result.issues.length === 0;
 };
-const safeParseAsync$1 = /* @__PURE__*/ _safeParseAsync($ZodRealError);
 const _encode = (_Err) => {
     const parse = _parse(_Err);
     const fn = (schema, value, _ctx, _params) => {
@@ -5517,10 +5584,10 @@ const uuid = (version) => {
     return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 };
 /** Practical email validation */
-const email = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
+const email = /^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
 // from https://thekevinscott.com/emojis-in-javascript/#writing-a-regular-expression
-// Single character class, not an alternation: the two properties overlap (U+1F9B0-U+1F9B3), so `(A|B)+` backtracks exponentially on a failed match.
-const _emoji$1 = `^[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`;
+// Single character class, not an alternation: the two properties overlap (U+1F9B0-U+1F9B3), so `(A|B)+` backtracks exponentially on a failed match. The leading lookahead then demands one anchor — a pictograph, a regional indicator, or the enclosing keycap — because `\p{Emoji_Component}` on its own covers ASCII digits, `#`, `*`, ZWJ, variation selectors and skin tone modifiers, none of which is an emoji without a base.
+const _emoji$1 = `^(?=[\\s\\S]*[\\p{Extended_Pictographic}\\p{Regional_Indicator}\\u20E3])[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`;
 function emoji() {
     return new RegExp(_emoji$1, "u");
 }
@@ -5530,7 +5597,7 @@ const cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-
 const cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 // https://stackoverflow.com/questions/7860392/determine-if-string-is-in-base64-using-javascript
 const base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
-const base64url = /^[A-Za-z0-9_-]*$/;
+const base64url = /^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-]{2,3})?$/;
 const httpProtocol = /^https?$/;
 // https://blog.stevenlevithan.com/archives/validate-phone-number#r4-3 (regex sans spaces) E.164: leading digit must be 1-9; total digits (excluding '+') between 7-15
 const e164 = /^\+[1-9]\d{6,14}$/;
@@ -5567,10 +5634,8 @@ function datetime(args) {
     const timeRegex = args.local ? `${qualified}|${timeSource({ precision: args.precision })}` : qualified;
     return new RegExp(`^${dateSource}T(?:${timeRegex})$`);
 }
-const string$1 = (params) => {
-    const regex = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
-    return new RegExp(`^${regex}$`);
-};
+// the unbounded form of `string()` as a literal, so every plain string shares one instance instead of building its own
+const anyString = /^[\s\S]{0,}$/;
 const integer = /^-?\d+$/;
 const number$1 = /^-?\d+(?:\.\d+)?$/;
 const boolean$1 = /^(?:true|false)$/i;
@@ -5599,16 +5664,6 @@ const numericOriginMap = {
 const $ZodCheckLessThan = /*@__PURE__*/ $constructor("$ZodCheckLessThan", (inst, def) => {
     $ZodCheck.init(inst, def);
     const origin = numericOriginMap[typeof def.value];
-    inst._zod.onattach.push((inst) => {
-        const bag = inst._zod.bag;
-        const curr = (def.inclusive ? bag.maximum : bag.exclusiveMaximum) ?? Number.POSITIVE_INFINITY;
-        if (def.value < curr) {
-            if (def.inclusive)
-                bag.maximum = def.value;
-            else
-                bag.exclusiveMaximum = def.value;
-        }
-    });
     inst._zod.check = (payload) => {
         if (def.inclusive ? payload.value <= def.value : payload.value < def.value) {
             return;
@@ -5627,16 +5682,6 @@ const $ZodCheckLessThan = /*@__PURE__*/ $constructor("$ZodCheckLessThan", (inst,
 const $ZodCheckGreaterThan = /*@__PURE__*/ $constructor("$ZodCheckGreaterThan", (inst, def) => {
     $ZodCheck.init(inst, def);
     const origin = numericOriginMap[typeof def.value];
-    inst._zod.onattach.push((inst) => {
-        const bag = inst._zod.bag;
-        const curr = (def.inclusive ? bag.minimum : bag.exclusiveMinimum) ?? Number.NEGATIVE_INFINITY;
-        if (def.value > curr) {
-            if (def.inclusive)
-                bag.minimum = def.value;
-            else
-                bag.exclusiveMinimum = def.value;
-        }
-    });
     inst._zod.check = (payload) => {
         if (def.inclusive ? payload.value >= def.value : payload.value > def.value) {
             return;
@@ -5655,10 +5700,6 @@ const $ZodCheckGreaterThan = /*@__PURE__*/ $constructor("$ZodCheckGreaterThan",
 const $ZodCheckMultipleOf = 
 /*@__PURE__*/ $constructor("$ZodCheckMultipleOf", (inst, def) => {
     $ZodCheck.init(inst, def);
-    inst._zod.onattach.push((inst) => {
-        var _a;
-        (_a = inst._zod.bag).multipleOf ?? (_a.multipleOf = def.value);
-    });
     inst._zod.check = (payload) => {
         if (typeof payload.value !== typeof def.value)
             throw new Error("Cannot mix number and bigint in multiple_of check.");
@@ -5684,14 +5725,6 @@ const $ZodCheckNumberFormat = /*@__PURE__*/ $constructor("$ZodCheckNumberFormat"
     const isInt = def.format?.includes("int");
     const origin = isInt ? "int" : "number";
     const [minimum, maximum] = NUMBER_FORMAT_RANGES[def.format];
-    inst._zod.onattach.push((inst) => {
-        const bag = inst._zod.bag;
-        bag.format = def.format;
-        bag.minimum = minimum;
-        bag.maximum = maximum;
-        if (isInt)
-            bag.pattern = integer;
-    });
     inst._zod.check = (payload) => {
         const input = payload.value;
         if (isInt) {
@@ -5781,11 +5814,6 @@ const $ZodCheckMaxLength = /*@__PURE__*/ $constructor("$ZodCheckMaxLength", (ins
     var _a;
     $ZodCheck.init(inst, def);
     (_a = inst._zod.def).when ?? (_a.when = _whenHasLength);
-    inst._zod.onattach.push((inst) => {
-        const curr = (inst._zod.bag.maximum ?? Number.POSITIVE_INFINITY);
-        if (def.maximum < curr)
-            inst._zod.bag.maximum = def.maximum;
-    });
     inst._zod.check = (payload) => {
         const input = payload.value;
         const units = input.length;
@@ -5809,11 +5837,6 @@ const $ZodCheckMinLength = /*@__PURE__*/ $constructor("$ZodCheckMinLength", (ins
     var _a;
     $ZodCheck.init(inst, def);
     (_a = inst._zod.def).when ?? (_a.when = _whenHasLength);
-    inst._zod.onattach.push((inst) => {
-        const curr = (inst._zod.bag.minimum ?? Number.NEGATIVE_INFINITY);
-        if (def.minimum > curr)
-            inst._zod.bag.minimum = def.minimum;
-    });
     inst._zod.check = (payload) => {
         const input = payload.value;
         const units = input.length;
@@ -5839,12 +5862,6 @@ const $ZodCheckLengthEquals = /*@__PURE__*/ $constructor("$ZodCheckLengthEquals"
     var _a;
     $ZodCheck.init(inst, def);
     (_a = inst._zod.def).when ?? (_a.when = _whenHasLength);
-    inst._zod.onattach.push((inst) => {
-        const bag = inst._zod.bag;
-        bag.minimum = def.length;
-        bag.maximum = def.length;
-        bag.length = def.length;
-    });
     inst._zod.check = (payload) => {
         const input = payload.value;
         const units = input.length;
@@ -5870,14 +5887,6 @@ const $ZodCheckLengthEquals = /*@__PURE__*/ $constructor("$ZodCheckLengthEquals"
 const $ZodCheckStringFormat = /*@__PURE__*/ $constructor("$ZodCheckStringFormat", (inst, def) => {
     var _a, _b;
     $ZodCheck.init(inst, def);
-    inst._zod.onattach.push((inst) => {
-        const bag = inst._zod.bag;
-        bag.format = def.format;
-        if (def.pattern) {
-            bag.patterns ?? (bag.patterns = new Set());
-            bag.patterns.add(def.pattern);
-        }
-    });
     if (def.pattern)
         (_a = inst._zod).check ?? (_a.check = (payload) => {
             def.pattern.lastIndex = 0;
@@ -5929,11 +5938,6 @@ const $ZodCheckIncludes = /*@__PURE__*/ $constructor("$ZodCheckIncludes", (inst,
     // (`{N,}`), not exactly `position` chars (`{N}`).
     const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position},}${escapedRegex}` : escapedRegex);
     def.pattern = pattern;
-    inst._zod.onattach.push((inst) => {
-        const bag = inst._zod.bag;
-        bag.patterns ?? (bag.patterns = new Set());
-        bag.patterns.add(pattern);
-    });
     inst._zod.check = (payload) => {
         if (payload.value.includes(def.includes, def.position))
             return;
@@ -5952,11 +5956,6 @@ const $ZodCheckStartsWith = /*@__PURE__*/ $constructor("$ZodCheckStartsWith", (i
     $ZodCheck.init(inst, def);
     const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
     def.pattern ?? (def.pattern = pattern);
-    inst._zod.onattach.push((inst) => {
-        const bag = inst._zod.bag;
-        bag.patterns ?? (bag.patterns = new Set());
-        bag.patterns.add(pattern);
-    });
     inst._zod.check = (payload) => {
         if (payload.value.startsWith(def.prefix))
             return;
@@ -5975,11 +5974,6 @@ const $ZodCheckEndsWith = /*@__PURE__*/ $constructor("$ZodCheckEndsWith", (inst,
     $ZodCheck.init(inst, def);
     const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
     def.pattern ?? (def.pattern = pattern);
-    inst._zod.onattach.push((inst) => {
-        const bag = inst._zod.bag;
-        bag.patterns ?? (bag.patterns = new Set());
-        bag.patterns.add(pattern);
-    });
     inst._zod.check = (payload) => {
         if (payload.value.endsWith(def.suffix))
             return;
@@ -5994,6 +5988,45 @@ const $ZodCheckEndsWith = /*@__PURE__*/ $constructor("$ZodCheckEndsWith", (inst,
         });
     };
 });
+///////////////////////////////////
+/////    $ZodCheckProperty    /////
+///////////////////////////////////
+function handleCheckPropertyResult(result, payload, property) {
+    if (result.issues.length) {
+        payload.issues.push(...prefixIssues(property, result.issues));
+    }
+}
+const $ZodCheckProperties = /*@__PURE__*/ $constructor("$ZodCheckProperties", (inst, def) => {
+    $ZodCheck.init(inst, def);
+    hide(inst, Symbol.iterator, function* () {
+        yield inst;
+    });
+    // key and schema snapshotted together: reading one live and the other cached lets a later mutation of the caller's shape object pair a stale key with a missing schema
+    let entries;
+    inst._zod.check = (payload) => {
+        // the base schema already typed the value, so only a nullish one is rejected here: the properties read on a primitive too, matching z.property() on a string's length
+        if (payload.value == null) {
+            payload.issues.push({ expected: "object", code: "invalid_type", input: payload.value, inst });
+            return undefined;
+        }
+        entries ?? (entries = Reflect.ownKeys(def.shape).map((key) => [key, def.shape[key]]));
+        const input = payload.value;
+        let proms;
+        for (const [key, schema] of entries) {
+            const result = schema._zod.run({ value: input[key], issues: [] }, {});
+            if (result instanceof Promise) {
+                proms ?? (proms = []);
+                proms.push(result.then((result) => handleCheckPropertyResult(result, payload, key)));
+            }
+            else {
+                handleCheckPropertyResult(result, payload, key);
+            }
+        }
+        if (proms)
+            return Promise.all(proms).then(() => undefined);
+        return undefined;
+    };
+});
 const $ZodCheckOverwrite = /*@__PURE__*/ $constructor("$ZodCheckOverwrite", (inst, def) => {
     $ZodCheck.init(inst, def);
     inst._zod.check = (payload) => {
@@ -6008,10 +6041,15 @@ class Doc {
         this.args = args;
         this.closed = closed;
     }
+    // the compiler catches a child's throw and keeps writing into this doc, so the indent has to unwind with it
     indented(fn) {
         this.indent += 1;
-        fn(this);
-        this.indent -= 1;
+        try {
+            fn(this);
+        }
+        finally {
+            this.indent -= 1;
+        }
     }
     write(arg) {
         if (typeof arg === "function") {
@@ -6037,8 +6075,8 @@ class Doc {
 
 const version$3 = {
     major: 4,
-    minor: 5,
-    patch: 4,
+    minor: 6,
+    patch: 5,
 };
 
 const $ZodType = /*@__PURE__*/ $constructor("$ZodType", (inst, def) => {
@@ -6164,16 +6202,24 @@ const $ZodType = /*@__PURE__*/ $constructor("$ZodType", (inst, def) => {
     },
 });
 /** The Standard Schema surface for `inst`. Shared so wrappers can extend it without forcing it. */
-const toStandardResult = (r) => r.success ? { value: r.data } : { issues: r.error?.issues };
+// a Standard Schema result only reports issues, so a failure finalizes them straight off the raw payload: no ZodError, and no lazy result to read through
+const toStandardResult = (r, ctx) => r.issues.length ? { issues: r.issues.map((iss) => finalizeIssue(iss, ctx, config())) } : { value: r.value };
+async function validateAsync(inst, value) {
+    const ctx = { async: true };
+    return toStandardResult((await inst._zod.run({ value, issues: [] }, ctx)), ctx);
+}
 function standardProps(inst) {
     return {
         validate: (value) => {
+            const ctx = { async: false };
             try {
-                return toStandardResult(safeParse$1(inst, value));
-            }
-            catch (_) {
-                return safeParseAsync$1(inst, value).then(toStandardResult);
+                const r = inst._zod.run({ value, issues: [] }, ctx);
+                if (!(r instanceof Promise))
+                    return toStandardResult(r, ctx);
             }
+            catch (_) { }
+            // async function so a synchronously throwing check rejects instead of escaping validate
+            return validateAsync(inst, value);
         },
         vendor: "zod",
         version: 1,
@@ -6181,7 +6227,8 @@ function standardProps(inst) {
 }
 const $ZodString = /*@__PURE__*/ $constructor("$ZodString", (inst, def) => {
     $ZodType.init(inst, def);
-    inst._zod.pattern = [...(inst?._zod.bag?.patterns ?? [])].pop() ?? string$1(inst._zod.bag);
+    // a format's own pattern, else unbounded; a template literal derives the check-aware form itself
+    inst._zod.pattern = def.pattern ?? anyString;
     inst._zod.parse = (payload, _) => {
         if (def.coerce)
             try {
@@ -6235,15 +6282,37 @@ const $ZodEmail = /*@__PURE__*/ $constructor("$ZodEmail", (inst, def) => {
 });
 /** The `://` guard rejected the input before the URL constructor saw it. */
 const URL_BAD_FORMAT = 1;
-/** The URL constructor rejected the input. */
+/** The URL parser rejected the input. */
 const URL_UNPARSEABLE = 2;
-/** Parses a URL for `$ZodURL`, applying the one guard the URL constructor cannot express. Returns the parsed URL, or a code naming the stage that rejected it — the runtime needs that distinction to pick an issue note, and compiled code only needs to know it is not a URL. */
+function canParseURL(input) {
+    try {
+        if (typeof URL !== "undefined" && typeof URL.canParse === "function")
+            return URL.canParse(input);
+        new URL(input);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function validateURL(trimmed, def) {
+    if (!("normalize" in def) && !("hostname" in def) && !("protocol" in def)) {
+        return canParseURL(trimmed) || URL_UNPARSEABLE;
+    }
+    return parseURLObject(trimmed, def);
+}
+/** Parses a URL while preserving the non-normalizing HTTP guard. */
 function parseURLObject(trimmed, def) {
     // When normalize is off, require :// for http/https URLs. This prevents strings like "http:example.com" or "https:/path" from being silently accepted
     if (!def.normalize && def.protocol?.source === httpProtocol.source && !/^https?:\/\//i.test(trimmed)) {
         return URL_BAD_FORMAT;
     }
     try {
+        if (typeof URL !== "undefined") {
+            const URLStatic = URL;
+            if (typeof URLStatic.parse === "function")
+                return URLStatic.parse(trimmed) ?? URL_UNPARSEABLE;
+        }
         // @ts-ignore
         return new URL(trimmed);
     }
@@ -6270,7 +6339,7 @@ const $ZodURL = /*@__PURE__*/ $constructor("$ZodURL", (inst, def) => {
         try {
             // Trim whitespace from input
             const trimmed = payload.value.trim();
-            const url = parseURLObject(trimmed, def);
+            const url = validateURL(trimmed, def);
             if (url === URL_BAD_FORMAT) {
                 payload.issues.push({
                     code: "invalid_format",
@@ -6292,6 +6361,10 @@ const $ZodURL = /*@__PURE__*/ $constructor("$ZodURL", (inst, def) => {
                 });
                 return;
             }
+            if (url === true) {
+                payload.value = stripTabAndNewline(trimmed);
+                return;
+            }
             if (def.hostname && !urlHostnameOk(url, def.hostname)) {
                 payload.issues.push({
                     code: "invalid_format",
@@ -6367,13 +6440,6 @@ const $ZodKSUID = /*@__PURE__*/ $constructor("$ZodKSUID", (inst, def) => {
 const $ZodISODateTime = /*@__PURE__*/ $constructor("$ZodISODateTime", (inst, def) => {
     def.pattern ?? (def.pattern = datetime(def));
     $ZodStringFormat.init(inst, def);
-    // these two drop the offset or seconds `date-time` requires — on the bag not the def, since `z.string().check(...)` lands the format on a different schema
-    if (def.local || def.precision === -1) {
-        inst._zod.bag.laxFormat = true;
-        inst._zod.onattach.push((s) => {
-            s._zod.bag.laxFormat = true;
-        });
-    }
 });
 const $ZodISODate = /*@__PURE__*/ $constructor("$ZodISODate", (inst, def) => {
     def.pattern ?? (def.pattern = date);
@@ -6390,26 +6456,17 @@ const $ZodISODuration = /*@__PURE__*/ $constructor("$ZodISODuration", (inst, def
 const $ZodIPv4 = /*@__PURE__*/ $constructor("$ZodIPv4", (inst, def) => {
     def.pattern ?? (def.pattern = ipv4);
     $ZodStringFormat.init(inst, def);
-    inst._zod.bag.format = `ipv4`;
 });
 /** An IPv6 address is written with hex digits, colons and dots, and nothing else. The guard is what makes the check below an IPv6 check: `new URL("http://[...]")` parses an authority, not an address, so `@` and `\` re-delimit it and `"::@1\\"` validates against the host `0.0.0.1`. The URL parser also deletes ASCII tab, LF and CR rather than failing, which is how `"::1\n"` validated as `::1`. */
 const ipv6Alphabet = /^[0-9a-fA-F:.]+$/;
 function isValidIPv6(value) {
     if (!ipv6Alphabet.test(value))
         return false;
-    try {
-        // @ts-ignore
-        new URL(`http://[${value}]`);
-        return true;
-    }
-    catch {
-        return false;
-    }
+    return canParseURL(`http://[${value}]`);
 }
 const $ZodIPv6 = /*@__PURE__*/ $constructor("$ZodIPv6", (inst, def) => {
     def.pattern ?? (def.pattern = ipv6);
     $ZodStringFormat.init(inst, def);
-    inst._zod.bag.format = `ipv6`;
     inst._zod.check = (payload) => {
         if (!isValidIPv6(payload.value)) {
             payload.issues.push({
@@ -6473,10 +6530,11 @@ function isValidBase64(data) {
         return false;
     }
 }
+// lax on purpose: the quantified regexes.base64 overflows the regex stack on multi-MB input and its leading ^$| alternation leaks through template-literal composition; isValidBase64 enforces length and padding
+const base64Charset = /^[0-9a-zA-Z+/]*={0,2}$/;
 const $ZodBase64 = /*@__PURE__*/ $constructor("$ZodBase64", (inst, def) => {
-    def.pattern ?? (def.pattern = base64);
+    def.pattern ?? (def.pattern = base64Charset);
     $ZodStringFormat.init(inst, def);
-    inst._zod.bag.contentEncoding = "base64";
     inst._zod.check = (payload) => {
         if (isValidBase64(payload.value))
             return;
@@ -6489,18 +6547,19 @@ const $ZodBase64 = /*@__PURE__*/ $constructor("$ZodBase64", (inst, def) => {
         });
     };
 });
-//////////////////////////////   ZodBase64   //////////////////////////////
+//////////////////////////////   ZodBase64URL   //////////////////////////////
+// lax on purpose: the quantified regexes.base64url overflows the regex stack on multi-MB input; isValidBase64 enforces length on the padded string
+const base64urlCharset = /^[A-Za-z0-9_-]*$/;
 function isValidBase64URL(data) {
-    if (!base64url.test(data))
+    if (!base64urlCharset.test(data))
         return false;
     const base64 = data.replace(/[-_]/g, (c) => (c === "-" ? "+" : "/"));
     const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
     return isValidBase64(padded);
 }
 const $ZodBase64URL = /*@__PURE__*/ $constructor("$ZodBase64URL", (inst, def) => {
-    def.pattern ?? (def.pattern = base64url);
+    def.pattern ?? (def.pattern = base64urlCharset);
     $ZodStringFormat.init(inst, def);
-    inst._zod.bag.contentEncoding = "base64url";
     inst._zod.check = (payload) => {
         if (isValidBase64URL(payload.value))
             return;
@@ -6556,7 +6615,7 @@ const $ZodJWT = /*@__PURE__*/ $constructor("$ZodJWT", (inst, def) => {
 });
 const $ZodNumber = /*@__PURE__*/ $constructor("$ZodNumber", (inst, def) => {
     $ZodType.init(inst, def);
-    inst._zod.pattern = inst._zod.bag.pattern ?? number$1;
+    inst._zod.pattern = number$1;
     inst._zod.parse = (payload, _ctx) => {
         if (def.coerce)
             try {
@@ -6648,6 +6707,7 @@ const $ZodArray = /*@__PURE__*/ $constructor("$ZodArray", (inst, def) => {
         }
         payload.value = memo ? memo.alloc(inst, payload, Array(input.length), ctx) : Array(input.length);
         const proms = [];
+        const abortEarly = ctx?.abortEarly;
         for (let i = 0; i < input.length; i++) {
             const item = input[i];
             const result = def.element._zod.run({
@@ -6659,6 +6719,9 @@ const $ZodArray = /*@__PURE__*/ $constructor("$ZodArray", (inst, def) => {
             }
             else {
                 handleArrayResult(result, payload, i);
+                // the element's payload is authoritative here, since handleArrayResult forwards every issue; an object's is not, because it drops a failed absent optional
+                if (abortEarly && result.issues.length !== 0 && aborted(result))
+                    break;
             }
         }
         if (proms.length) {
@@ -6693,7 +6756,7 @@ function handlePropertyResult(result, final, key, input, optin, optout) {
         return;
     }
     if (result.value === undefined) {
-        if (isPresent) {
+        if (isPresent || (optin === "defaulted" && !isOptionalOut)) {
             final.value[key] = undefined;
         }
     }
@@ -6725,14 +6788,21 @@ function normalizeDef(def) {
         optionalKeys: new Set(okeys),
     };
 }
-function handleCatchall(proms, input, payload, ctx, def, inst) {
+function handleCatchall(proms, input, payload, ctx, def, inst, abortEarly) {
     const unrecognized = [];
     const keySet = def.keySet;
     const _catchall = def.catchall._zod;
     const t = _catchall.def.type;
     const optin = _catchall.optin;
     const optout = _catchall.optout;
+    // starts at 0, not the current length: the shape phase already ran and may have aborted
+    let seen = 0;
     for (const key in input) {
+        if (abortEarly && payload.issues.length !== seen) {
+            if (aborted(payload, seen))
+                break;
+            seen = payload.issues.length;
+        }
         // Must precede the __proto__ branch: a declared key is not unrecognized, even though the shape loop deliberately strips __proto__ from the parsed output.
         if (keySet.has(key))
             continue;
@@ -6770,26 +6840,22 @@ function handleCatchall(proms, input, payload, ctx, def, inst) {
         return payload;
     });
 }
-// Whichever object a def's `shape` currently answers from: the one the caller passed until the first read, the frozen copy after it. Keyed by def, so a def rebuilt by a builder is simply absent rather than inheriting the source's. Read its keys with `Object.keys`, which does not invoke them — that is what lets a discriminated union check its discriminator without resolving an option whose getters reference the union being constructed.
-const propShapes = new WeakMap();
 const $ZodObject = /*@__PURE__*/ $constructor("$ZodObject", (inst, def) => {
     // requires cast because technically $ZodObject doesn't extend
     $ZodType.init(inst, def);
-    // const sh = def.shape;
     const desc = Object.getOwnPropertyDescriptor(def, "shape");
-    if (!desc?.get) {
-        const sh = def.shape;
-        propShapes.set(def, sh);
-        Object.defineProperty(def, "shape", {
-            get: () => {
-                const newSh = { ...sh };
-                Object.defineProperty(def, "shape", {
-                    value: newSh,
-                });
-                propShapes.set(def, newSh);
-                return newSh;
-            },
-        });
+    // a cloned def carries its source's accessor, which knows the shape it answers from; adopting that keeps the clone's keys readable without running it
+    const sh = desc?.get ? desc.get.raw : (def.shape ?? {});
+    if (sh) {
+        // Freezes the shape on first read, so its getters resolve once and every later read sees the same schemas.
+        const get = () => {
+            const newSh = { ...sh };
+            Object.defineProperty(def, "shape", { value: newSh });
+            get.raw = newSh;
+            return newSh;
+        };
+        get.raw = sh;
+        Object.defineProperty(def, "shape", { get });
     }
     const _normalized = cached(() => normalizeDef(def));
     defineLazyInternal(inst, "propValues", (zod) => {
@@ -6830,7 +6896,14 @@ const $ZodObject = /*@__PURE__*/ $constructor("$ZodObject", (inst, def) => {
         payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};
         const proms = [];
         const shape = value.shape;
+        const abortEarly = ctx?.abortEarly;
+        let seen = payload.issues.length;
         for (const key of value.allKeys) {
+            if (abortEarly && payload.issues.length !== seen) {
+                if (aborted(payload, seen))
+                    break;
+                seen = payload.issues.length;
+            }
             if (key === "__proto__")
                 continue;
             const el = shape[key];
@@ -6847,7 +6920,7 @@ const $ZodObject = /*@__PURE__*/ $constructor("$ZodObject", (inst, def) => {
         if (!catchall) {
             return proms.length ? Promise.all(proms).then(() => payload) : payload;
         }
-        return handleCatchall(proms, input, payload, ctx, _normalized.value, inst);
+        return handleCatchall(proms, input, payload, ctx, _normalized.value, inst, abortEarly === true);
     };
 });
 const $ZodObjectJIT = /*@__PURE__*/ $constructor("$ZodObjectJIT", (inst, def) => {
@@ -6862,12 +6935,18 @@ const $ZodObjectJIT = /*@__PURE__*/ $constructor("$ZodObjectJIT", (inst, def) =>
         // a symbol has no source literal, so it is read as `syms[i]` off the closed-over scope
         const doc = new Doc(["payload", "ctx"], { shape, inst, memo, syms });
         const parseStr = (k) => `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;
-        // Prefixes in place, like util.prefixIssues does for every interpreted path.
+        // prefixes in place, like util.prefixIssues. newResult must land before the early return: a catchall runs after this and would otherwise write onto the caller's input
         const prefixStr = (id, k) => `
+          let ${id}_ab = false;
           for (let i = 0; i < ${id}.issues.length; i++) {
             const iss = ${id}.issues[i];
             iss.path = iss.path ? [${k}, ...iss.path] : [${k}];
             payload.issues.push(iss);
+            if (iss.continue !== true) ${id}_ab = true;
+          }
+          if (${id}_ab && ctx && ctx.abortEarly) {
+            payload.value = newResult;
+            return payload;
           }`;
         doc.write(`const input = payload.value;`);
         const ids = Object.create(null);
@@ -6916,6 +6995,10 @@ const $ZodObjectJIT = /*@__PURE__*/ $constructor("$ZodObjectJIT", (inst, def) =>
             input: undefined,
             path: [${k}]
           });
+          if (ctx && ctx.abortEarly) {
+            payload.value = newResult;
+            return payload;
+          }
         }
 
         if (${id}_present) {
@@ -6928,16 +7011,17 @@ const $ZodObjectJIT = /*@__PURE__*/ $constructor("$ZodObjectJIT", (inst, def) =>
                 doc.write(`
         if (${id}.issues.length) {${prefixStr(id, k)}
         }
-        
-        if (${id}.value === undefined) {
-          if (${isPresent}) {
-            newResult[${k}] = undefined;
-          }
-        } else {
+      `);
+                if (optin === "defaulted") {
+                    doc.write(`newResult[${k}] = ${id}.value;`);
+                }
+                else {
+                    doc.write(`
+        if (${id}.value !== undefined || ${isPresent}) {
           newResult[${k}] = ${id}.value;
         }
-
       `);
+                }
             }
         }
         doc.write(`payload.value = newResult;`);
@@ -6971,7 +7055,7 @@ const $ZodObjectJIT = /*@__PURE__*/ $constructor("$ZodObjectJIT", (inst, def) =>
             payload = fastpass(payload, ctx);
             if (!catchall)
                 return payload;
-            return handleCatchall([], input, payload, ctx, value, inst);
+            return handleCatchall([], input, payload, ctx, value, inst, ctx?.abortEarly === true);
         }
         return superParse(payload, ctx);
     };
@@ -7181,6 +7265,7 @@ const $ZodRecord = /*@__PURE__*/ $constructor("$ZodRecord", (inst, def) => {
             });
             return payload;
         }
+        // no guard in either loop below: a record's invalid_key aborts but an enclosing intersection can reconcile it, so a stopped loop hides keys the sibling does not own and the intersection then rejects nothing
         const proms = [];
         const values = def.keyType._zod.values;
         if (values && !def.partial) {
@@ -7340,9 +7425,11 @@ const $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
     const values = getEnumValues(def.entries);
     const valuesSet = new Set(values);
     inst._zod.values = valuesSet;
-    const patternValues = values.filter((k) => propertyKeyTypes.has(typeof k));
-    // unmatchable fallback, RE2-safe: an empty alternation would compile to /^()$/, which matches ""
-    inst._zod.pattern = new RegExp(patternValues.length ? `^(${patternValues.map((o) => escapeRegex(o.toString())).join("|")})$` : "^[^\\s\\S]$");
+    defineLazyInternal(inst, "pattern", (zod) => {
+        const patternValues = getEnumValues(zod.def.entries).filter((k) => propertyKeyTypes.has(typeof k));
+        // unmatchable fallback, RE2-safe: an empty alternation would compile to /^()$/, which matches ""
+        return new RegExp(patternValues.length ? `^(${patternValues.map((o) => escapeRegex(o.toString())).join("|")})$` : "^[^\\s\\S]$");
+    });
     inst._zod.parse = (payload, _ctx) => {
         const input = payload.value;
         if (valuesSet.has(input)) {
@@ -7361,12 +7448,15 @@ const $ZodLiteral = /*@__PURE__*/ $constructor("$ZodLiteral", (inst, def) => {
     $ZodType.init(inst, def);
     const values = new Set(def.values);
     inst._zod.values = values;
-    // unmatchable fallback, RE2-safe: an empty alternation would compile to /^()$/, which matches ""
-    inst._zod.pattern = new RegExp(def.values.length
-        ? `^(${def.values
-            .map((o) => (typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)))
-            .join("|")})$`
-        : "^[^\\s\\S]$");
+    defineLazyInternal(inst, "pattern", (zod) => {
+        const vals = zod.def.values;
+        // unmatchable fallback, RE2-safe: an empty alternation would compile to /^()$/, which matches ""
+        return new RegExp(vals.length
+            ? `^(${vals
+                .map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o))
+                .join("|")})$`
+            : "^[^\\s\\S]$");
+    });
     inst._zod.parse = (payload, _ctx) => {
         const input = payload.value;
         if (values.has(input)) {
@@ -7666,32 +7756,62 @@ class $ZodCyclicError extends Error {
 /** Keyed off the context object every schema in one parse call already shares. */
 const STATE$1 = "~memo";
 const NO_ISSUES = [];
+// a value a cycle can close through
+function isRef(value) {
+    return value !== null && typeof value === "object";
+}
 // Receivers prefix paths in place, so the cache and every hand-out need their own copies.
 function cloneIssues(issues) {
     return issues.map((iss) => (iss.path ? { ...iss, path: iss.path.slice() } : { ...iss }));
 }
 const recursive = /*@__PURE__*/ new WeakMap();
+/** What the walk established, in order of certainty: ordered so the strongest answer among children wins. */
+const NONE = 0;
+const ASSUMED = 1;
+const PROVEN = 2;
 /** Whether this schema's subtree contains a cycle, so one parse can re-enter it. */
-function isRecursive(inst, stack) {
+function isRecursive(inst, stack, resolve) {
     const cached = recursive.get(inst);
     if (cached !== undefined)
-        return cached;
+        return cached ? PROVEN : NONE;
     // Relative to the walk in progress, so not cached.
     if (stack.has(inst))
-        return true;
+        return PROVEN;
     stack.add(inst);
-    let result = false;
+    let result = NONE;
     const check = (child) => {
-        if (!result && child?._zod && isRecursive(child, stack))
-            result = true;
+        if (result !== PROVEN && child?._zod) {
+            const answer = isRecursive(child, stack);
+            if (answer > result)
+                result = answer;
+        }
+    };
+    // `Reflect.ownKeys` rather than `Object.keys`, so a cycle through a declared symbol key is still seen
+    const shape = (sh, spread) => {
+        let answer = NONE;
+        for (const key of Reflect.ownKeys(sh)) {
+            const desc = Object.getOwnPropertyDescriptor(sh, key);
+            // an object resolves its shape by spread, so a key it does not enumerate is never parsed; `z.properties` reads every own key and so keeps them all
+            if (!desc.enumerable)
+                continue;
+            // resolving runs user code, and a factory mints a fresh subtree per read, so an edge the walk can't follow counts as a cycle
+            const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack) : NONE;
+            if (child > answer)
+                answer = child;
+        }
+        return answer;
+    };
+    const merge = (answer) => {
+        if (answer > result)
+            result = answer;
     };
     const def = inst._zod.def;
     const kind = def.type;
     switch (kind) {
         case "object": {
-            // `Reflect.ownKeys` rather than `Object.keys`, so a cycle through a declared symbol key is still seen
-            for (const key of Reflect.ownKeys(def.shape))
-                check(def.shape[key]);
+            const raw = rawShape(def);
+            // a def with no raw shape answers `shape` from an accessor of its own, and running that can mint a whole fresh subtree
+            merge(raw ? shape(raw) : ASSUMED);
             check(def.catchall);
             break;
         }
@@ -7738,10 +7858,13 @@ function isRecursive(inst, stack) {
             check(def.input);
             check(def.output);
             break;
-        // reading `_zod.innerType` resolves the getter once and caches it
-        case "lazy":
-            check(inst._zod.innerType);
+        // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
+        case "lazy": {
+            const inner = def._cachedInner ?? (undefined);
+            // walked with resolution off: one hop sees past the deferral, and a lazy that yields only another unresolved lazy is generative, so it stops there
+            merge(inner ? isRecursive(inner, stack) : ASSUMED);
             break;
+        }
         // a leaf by choice: `parts` are regex fragments, not data positions
         case "template_literal":
         // leaves
@@ -7783,13 +7906,18 @@ function isRecursive(inst, stack) {
         }
     }
     stack.delete(inst);
-    recursive.set(inst, result);
-    return result;
+    return settle(inst, result);
+}
+/** An assumed answer must not outlive the resolution that settles it, so only a certain one is cached. */
+function settle(inst, answer) {
+    if (answer !== ASSUMED)
+        recursive.set(inst, answer === PROVEN);
+    return answer;
 }
 function bucketFor(state, inst) {
     let bucket = state.buckets.get(inst);
     if (!bucket) {
-        bucket = new Map();
+        bucket = new WeakMap();
         state.buckets.set(inst, bucket);
     }
     return bucket;
@@ -7828,7 +7956,8 @@ const memo = {
     attach(inst) {
         var _a;
         let isRecursiveInst;
-        // `bucket` memoized for one parse; a recursive schema is re-entered many times and its bucket never changes
+        let rechecked = false;
+        // a recursive schema is re-entered many times per parse and its bucket never changes
         let lastCtx;
         let lastBucket;
         // Wraps `parse` in a deferred so it sees the container's final parse. Core's own deferred copies `parse` into `run` when there are no checks, and it ran first, so `run` is patched to match; with checks, `run` reads `parse` dynamically.
@@ -7837,21 +7966,26 @@ const memo = {
             const base = inst._zod.parse;
             const wrapped = (payload, ctx) => {
                 if (isRecursiveInst === undefined) {
-                    isRecursiveInst = isRecursive(inst, new Set());
-                    if (!isRecursiveInst) {
+                    const walked = isRecursive(inst, new Set());
+                    if (walked === NONE) {
                         // Nothing here can ever fire, so take it back out.
                         inst._zod.parse = base;
                         if (inst._zod.run === wrapped)
                             inst._zod.run = base;
                         return base(payload, ctx);
                     }
+                    // this parse resolves the deferred edges on its own path, so ask once more before latching
+                    if (walked === PROVEN || rechecked)
+                        isRecursiveInst = true;
+                    else
+                        rechecked = true;
                 }
                 const input = payload.value;
-                if (input === null || typeof input !== "object")
+                if (!isRef(input))
                     return base(payload, ctx);
                 let state = ctx[STATE$1];
                 if (!state) {
-                    state = { buckets: new Map(), backEdges: undefined };
+                    state = { buckets: new WeakMap(), backEdges: undefined };
                     ctx[STATE$1] = state;
                 }
                 let bucket;
@@ -7873,7 +8007,7 @@ const memo = {
                     else {
                         // Still being parsed: its own checks cover it, so skip them here.
                         payload.memo = true;
-                        state.backEdges ?? (state.backEdges = new Set());
+                        state.backEdges ?? (state.backEdges = new WeakSet());
                         state.backEdges.add(hit.value);
                     }
                     return payload;
@@ -7909,7 +8043,7 @@ function memoizer() {
 /** Whether this value is a node a back-edge resolved to before it finished. */
 function isBackEdge(ctx, value) {
     const backEdges = ctx[STATE$1]?.backEdges;
-    return backEdges !== undefined && value !== null && typeof value === "object" && backEdges.has(value);
+    return backEdges !== undefined && isRef(value) && backEdges.has(value);
 }
 
 const error = () => {
@@ -7951,7 +8085,9 @@ const error = () => {
         base64url: "base64url-encoded string",
         json_string: "JSON string",
         e164: "E.164 number",
+        currency_code: "currency code",
         credit_card: "credit card number",
+        iban: "IBAN",
         jwt: "JWT",
         template_literal: "input",
     };
@@ -8085,12 +8221,14 @@ function registry() {
 (_a = globalThis).__zod_globalRegistry ?? (_a.__zod_globalRegistry = registry());
 const globalRegistry = globalThis.__zod_globalRegistry;
 
+function snapshotChecks(def) {
+    if (def.checks)
+        def.checks = [...def.checks];
+    return def;
+}
 // @__NO_SIDE_EFFECTS__
 function _string(Class, params) {
-    return new Class({
-        type: "string",
-        ...normalizeParams(params),
-    });
+    return new Class(snapshotChecks({ type: "string", ...normalizeParams(params) }));
 }
 // @__NO_SIDE_EFFECTS__
 function _email(Class, params) {
@@ -8362,11 +8500,7 @@ function _isoDuration(Class, params) {
 }
 // @__NO_SIDE_EFFECTS__
 function _number(Class, params) {
-    return new Class({
-        type: "number",
-        checks: [],
-        ...normalizeParams(params),
-    });
+    return new Class(snapshotChecks({ type: "number", checks: [], ...normalizeParams(params) }));
 }
 // @__NO_SIDE_EFFECTS__
 function _int(Class, params) {
@@ -8520,6 +8654,14 @@ function _endsWith(suffix, params) {
     });
 }
 // @__NO_SIDE_EFFECTS__
+function _properties(shape, params) {
+    return new $ZodCheckProperties({
+        check: "properties",
+        shape,
+        ...normalizeParams(params),
+    });
+}
+// @__NO_SIDE_EFFECTS__
 function _overwrite(tx) {
     return new $ZodCheckOverwrite({
         check: "overwrite",
@@ -8678,7 +8820,8 @@ function handleUnrepresentable(schema, ctx, json, params, message) {
     Object.assign(json, result);
     return true;
 }
-function process$1(schema, ctx, _params = { path: [], schemaPath: [] }) {
+// never rename this back to `process`: bundler polyfills inject a top-level `const process` that a lexical declaration of the same name collides with (#6397)
+function processSchema(schema, ctx, _params = { path: [], schemaPath: [] }) {
     var _a;
     const def = schema._zod.def;
     // check for schema in seens
@@ -8724,7 +8867,7 @@ function process$1(schema, ctx, _params = { path: [], schemaPath: [] }) {
             // Also set ref if processor didn't (for inheritance)
             if (!result.ref)
                 result.ref = parent;
-            process$1(parent, ctx, params);
+            processSchema(parent, ctx, params);
             ctx.seen.get(parent).isParent = true;
         }
     }
@@ -8861,8 +9004,6 @@ function extractDefs(ctx, schema
         if (seen.count > 1) {
             if (ctx.reused === "ref") {
                 extractToDef(entry);
-                // biome-ignore lint:
-                continue;
             }
         }
     }
@@ -9251,18 +9392,111 @@ function isTransforming(_schema, _ctx) {
  */
 const createToJSONSchemaMethod = (schema, processors = {}) => (params) => {
     const ctx = initializeContext({ ...params, processors });
-    process$1(schema, ctx);
+    processSchema(schema, ctx);
     extractDefs(ctx, schema);
     return finalize(ctx, schema);
 };
 const createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {
     const { libraryOptions, target } = params ?? {};
     const ctx = initializeContext({ ...(libraryOptions ?? {}), target, io, processors });
-    process$1(schema, ctx);
+    processSchema(schema, ctx);
     extractDefs(ctx, schema);
     return finalize(ctx, schema);
 };
 
+const narrowMin = (agg, key, value) => {
+    if (agg[key] === undefined || value > agg[key])
+        agg[key] = value;
+};
+const narrowMax = (agg, key, value) => {
+    if (agg[key] === undefined || value < agg[key])
+        agg[key] = value;
+};
+const narrowBoth = (agg, value) => {
+    narrowMin(agg, "minimum", value);
+    narrowMax(agg, "maximum", value);
+};
+const addDivisor = (agg, value) => {
+    agg.multipleOf ?? (agg.multipleOf = []);
+    if (!agg.multipleOf.includes(value))
+        agg.multipleOf.push(value);
+};
+const addPattern = (agg, pattern) => {
+    agg.patterns ?? (agg.patterns = new Set());
+    agg.patterns.add(pattern);
+};
+const intersectMime = (agg, mime) => {
+    agg.mime = agg.mime ? agg.mime.filter((m) => mime.includes(m)) : [...mime];
+};
+// last-wins, matching the bag's historical write order; the flag keeps an integer format from being lost to a later float one
+const setFormat = (agg, format) => {
+    agg.format = format;
+    if (format.includes("int"))
+        agg.isInt = true;
+};
+const minContributor = (agg, def) => narrowMin(agg, "minimum", def.minimum);
+const maxContributor = (agg, def) => narrowMax(agg, "maximum", def.maximum);
+const formatContributor = (ranges) => (agg, def) => {
+    setFormat(agg, def.format);
+    const [minimum, maximum] = ranges[def.format];
+    narrowMin(agg, "minimum", minimum);
+    narrowMax(agg, "maximum", maximum);
+};
+const contributors = {
+    greater_than: (agg, def) => narrowMin(agg, def.inclusive ? "minimum" : "exclusiveMinimum", def.value),
+    less_than: (agg, def) => narrowMax(agg, def.inclusive ? "maximum" : "exclusiveMaximum", def.value),
+    multiple_of: (agg, def) => addDivisor(agg, def.value),
+    number_format: formatContributor(NUMBER_FORMAT_RANGES),
+    bigint_format: formatContributor(BIGINT_FORMAT_RANGES),
+    min_length: minContributor,
+    max_length: maxContributor,
+    length_equals: (agg, def) => narrowBoth(agg, def.length),
+    min_size: minContributor,
+    max_size: maxContributor,
+    size_equals: (agg, def) => narrowBoth(agg, def.size),
+    string_format: (agg, def) => {
+        setFormat(agg, def.format);
+        if (def.pattern)
+            addPattern(agg, def.pattern);
+        if (def.format === "base64" || def.format === "base64url")
+            agg.contentEncoding = def.format;
+        if (def.local || def.precision === -1)
+            agg.laxFormat = true;
+    },
+    mime_type: (agg, def) => intersectMime(agg, def.mime),
+};
+function aggregateChecks(schema) {
+    const agg = {};
+    const def = schema._zod.def;
+    // a format schema is its own first check, same rule as $ZodType init
+    const list = schema._zod.traits.has("$ZodCheck")
+        ? [schema, ...(def.checks ?? [])]
+        : (def.checks ?? []);
+    for (const ch of list)
+        contributors[ch._zod.def.check]?.(agg, ch._zod.def);
+    // reconcile with the bag so third-party onattach contributions still land; first-party residue is never tighter than the fold, so merging it back is idempotent for one and additive for the other
+    const bag = schema._zod.bag;
+    if (bag.minimum !== undefined)
+        narrowMin(agg, "minimum", bag.minimum);
+    if (bag.exclusiveMinimum !== undefined)
+        narrowMin(agg, "exclusiveMinimum", bag.exclusiveMinimum);
+    if (bag.maximum !== undefined)
+        narrowMax(agg, "maximum", bag.maximum);
+    if (bag.exclusiveMaximum !== undefined)
+        narrowMax(agg, "exclusiveMaximum", bag.exclusiveMaximum);
+    if (bag.multipleOf !== undefined)
+        addDivisor(agg, bag.multipleOf);
+    if (bag.format !== undefined) {
+        agg.format ?? (agg.format = bag.format);
+        if (bag.format.includes("int"))
+            agg.isInt = true;
+    }
+    if (bag.mime)
+        intersectMime(agg, bag.mime);
+    for (const pattern of bag.patterns ?? [])
+        addPattern(agg, pattern);
+    return agg;
+}
 const formatMap = {
     guid: "uuid",
     url: "uri",
@@ -9271,11 +9505,16 @@ const formatMap = {
     regex: "", // do not set
 };
 // ==================== SIMPLE TYPE PROCESSORS ====================
+// the runtime patterns are lax so parse paths never overflow the regex stack; the emitted schema swaps in the exact block forms, which zod itself never executes
+const exactPatterns = new Map([
+    [base64Charset, base64],
+    [base64urlCharset, base64url],
+]);
+const exactPattern = (p) => exactPatterns.get(p) ?? p;
 const stringProcessor = (schema, ctx, _json, _params) => {
     const json = _json;
     json.type = "string";
-    const { minimum, maximum, format, patterns, contentEncoding, laxFormat } = schema._zod
-        .bag;
+    const { minimum, maximum, format, patterns, contentEncoding, laxFormat } = aggregateChecks(schema);
     if (typeof minimum === "number")
         json.minLength = minimum;
     if (typeof maximum === "number")
@@ -9293,7 +9532,7 @@ const stringProcessor = (schema, ctx, _json, _params) => {
     if (contentEncoding)
         json.contentEncoding = contentEncoding;
     if (patterns && patterns.size > 0) {
-        const patternList = [...patterns];
+        const patternList = [...patterns].map(exactPattern);
         if (patternList.length === 1)
             json.pattern = patternList[0].source;
         else if (patternList.length > 1) {
@@ -9310,11 +9549,8 @@ const stringProcessor = (schema, ctx, _json, _params) => {
 };
 const numberProcessor = (schema, ctx, _json, params) => {
     const json = _json;
-    const { minimum, maximum, format, multipleOf, exclusiveMaximum, exclusiveMinimum } = schema._zod.bag;
-    if (typeof format === "string" && format.includes("int"))
-        json.type = "integer";
-    else
-        json.type = "number";
+    const { minimum, maximum, multipleOf, exclusiveMaximum, exclusiveMinimum, isInt } = aggregateChecks(schema);
+    json.type = isInt ? "integer" : "number";
     // when both minimum and exclusiveMinimum exist, pick the more restrictive one
     const exMin = typeof exclusiveMinimum === "number" && exclusiveMinimum >= (minimum ?? Number.NEGATIVE_INFINITY);
     const exMax = typeof exclusiveMaximum === "number" && exclusiveMaximum <= (maximum ?? Number.POSITIVE_INFINITY);
@@ -9343,12 +9579,21 @@ const numberProcessor = (schema, ctx, _json, params) => {
     else if (typeof maximum === "number") {
         json.maximum = maximum;
     }
-    if (typeof multipleOf === "number") {
+    if (multipleOf) {
         // JSON Schema requires a divisor strictly greater than zero, and a non-finite one does not survive JSON at all. A negative divisor accepts exactly what its absolute value accepts, so it still maps; zero, NaN and Infinity have no keyword form.
-        if (Number.isFinite(multipleOf) && multipleOf !== 0)
-            json.multipleOf = Math.abs(multipleOf);
-        else
-            handleUnrepresentable(schema, ctx, json, params, `A multipleOf divisor of ${multipleOf} cannot be represented in JSON Schema`);
+        const divisors = new Set();
+        for (const divisor of multipleOf) {
+            if (Number.isFinite(divisor) && divisor !== 0)
+                divisors.add(Math.abs(divisor));
+            else
+                handleUnrepresentable(schema, ctx, json, params, `A multipleOf divisor of ${divisor} cannot be represented in JSON Schema`);
+        }
+        // chained divisors are a conjunction the keyword cannot carry alone, so extras ride an allOf, same as stacked patterns
+        const [first, ...rest] = divisors;
+        if (first !== undefined)
+            json.multipleOf = first;
+        if (rest.length)
+            json.allOf = [...(json.allOf ?? []), ...rest.map((m) => ({ multipleOf: m }))];
     }
 };
 const booleanProcessor = (_schema, _ctx, json, _params) => {
@@ -9432,13 +9677,13 @@ const transformProcessor = (schema, ctx, json, params) => {
 const arrayProcessor = (schema, ctx, _json, params) => {
     const json = _json;
     const def = schema._zod.def;
-    const { minimum, maximum } = schema._zod.bag;
+    const { minimum, maximum } = aggregateChecks(schema);
     if (typeof minimum === "number")
         json.minItems = minimum;
     if (typeof maximum === "number")
         json.maxItems = maximum;
     json.type = "array";
-    json.items = process$1(def.element, ctx, {
+    json.items = processSchema(def.element, ctx, {
         ...params,
         path: [...params.path, "items"],
     });
@@ -9472,24 +9717,21 @@ const objectProcessor = (schema, ctx, _json, params) => {
     json.properties = {};
     for (const key in shape) {
         // assignProp so a __proto__ key becomes an own property instead of hitting the inherited setter on the plain {} we build into
-        assignProp(json.properties, key, process$1(shape[key], ctx, {
+        assignProp(json.properties, key, processSchema(shape[key], ctx, {
             ...params,
             path: [...params.path, "properties", key],
         }));
     }
     // required keys
-    const allKeys = new Set(Object.keys(shape));
-    const requiredKeys = new Set([...allKeys].filter((key) => {
+    const requiredKeys = [];
+    for (const key of Object.keys(shape)) {
         const field = def.shape[key];
-        if (ctx.io === "input") {
-            return inputOptin(field) === undefined;
+        if (ctx.io === "input" ? inputOptin(field) === undefined : field._zod.optout === undefined) {
+            requiredKeys.push(key);
         }
-        else {
-            return field._zod.optout === undefined;
-        }
-    }));
-    if (requiredKeys.size > 0) {
-        json.required = Array.from(requiredKeys);
+    }
+    if (requiredKeys.length > 0) {
+        json.required = requiredKeys;
     }
     // catchall
     if (def.catchall?._zod.def.type === "never") {
@@ -9502,7 +9744,7 @@ const objectProcessor = (schema, ctx, _json, params) => {
             json.additionalProperties = false;
     }
     else if (def.catchall) {
-        json.additionalProperties = process$1(def.catchall, ctx, {
+        json.additionalProperties = processSchema(def.catchall, ctx, {
             ...params,
             path: [...params.path, "additionalProperties"],
         });
@@ -9512,7 +9754,7 @@ const unionProcessor = (schema, ctx, json, params) => {
     const def = schema._zod.def;
     // Exclusive unions (inclusive === false) use oneOf (exactly one match) instead of anyOf (one or more matches). This includes both z.xor() and discriminated unions
     const isExclusive = def.inclusive === false;
-    const options = def.options.map((x, i) => process$1(x, ctx, {
+    const options = def.options.map((x, i) => processSchema(x, ctx, {
         ...params,
         path: [...params.path, isExclusive ? "oneOf" : "anyOf", i],
     }));
@@ -9525,11 +9767,11 @@ const unionProcessor = (schema, ctx, json, params) => {
 };
 const intersectionProcessor = (schema, ctx, json, params) => {
     const def = schema._zod.def;
-    const a = process$1(def.left, ctx, {
+    const a = processSchema(def.left, ctx, {
         ...params,
         path: [...params.path, "allOf", 0],
     });
-    const b = process$1(def.right, ctx, {
+    const b = processSchema(def.right, ctx, {
         ...params,
         path: [...params.path, "allOf", 1],
     });
@@ -9629,23 +9871,22 @@ const recordProcessor = (schema, ctx, _json, params) => {
     json.type = "object";
     // For looseRecord with regex patterns, use patternProperties. This correctly represents "only validate keys matching the pattern" semantics and composes well with allOf (intersections)
     const keyType = def.keyType;
-    const keyBag = keyType._zod.bag;
-    const patterns = keyBag?.patterns;
+    const patterns = aggregateChecks(keyType).patterns;
     if (def.mode === "loose" && patterns && patterns.size > 0) {
         // Use patternProperties for looseRecord with regex patterns
-        const valueSchema = process$1(def.valueType, ctx, {
+        const valueSchema = processSchema(def.valueType, ctx, {
             ...params,
             path: [...params.path, "patternProperties", "*"],
         });
         json.patternProperties = {};
         for (const pattern of patterns) {
-            assignProp(json.patternProperties, pattern.source, valueSchema);
+            assignProp(json.patternProperties, exactPattern(pattern).source, valueSchema);
         }
     }
     else {
         // Default behavior: use propertyNames + additionalProperties
         if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") {
-            json.propertyNames = process$1(def.keyType, ctx, {
+            json.propertyNames = processSchema(def.keyType, ctx, {
                 ...params,
                 path: [...params.path, "propertyNames"],
             });
@@ -9657,7 +9898,7 @@ const recordProcessor = (schema, ctx, _json, params) => {
             }
             pending.push(schema);
         }
-        json.additionalProperties = process$1(def.valueType, ctx, {
+        json.additionalProperties = processSchema(def.valueType, ctx, {
             ...params,
             path: [...params.path, "additionalProperties"],
         });
@@ -9675,7 +9916,7 @@ const recordProcessor = (schema, ctx, _json, params) => {
 };
 const nullableProcessor = (schema, ctx, json, params) => {
     const def = schema._zod.def;
-    const inner = process$1(def.innerType, ctx, params);
+    const inner = processSchema(def.innerType, ctx, params);
     const seen = ctx.seen.get(schema);
     if (ctx.target === "openapi-3.0") {
         seen.ref = def.innerType;
@@ -9687,7 +9928,7 @@ const nullableProcessor = (schema, ctx, json, params) => {
 };
 const nonoptionalProcessor = (schema, ctx, _json, params) => {
     const def = schema._zod.def;
-    process$1(def.innerType, ctx, params);
+    processSchema(def.innerType, ctx, params);
     const seen = ctx.seen.get(schema);
     seen.ref = def.innerType;
 };
@@ -9710,7 +9951,7 @@ function serializeDefaultValue(value, schema, ctx, json, params) {
 }
 const defaultProcessor = (schema, ctx, json, params) => {
     const def = schema._zod.def;
-    process$1(def.innerType, ctx, params);
+    processSchema(def.innerType, ctx, params);
     const seen = ctx.seen.get(schema);
     seen.ref = def.innerType;
     const value = serializeDefaultValue(def.defaultValue, schema, ctx, json, params);
@@ -9719,7 +9960,7 @@ const defaultProcessor = (schema, ctx, json, params) => {
 };
 const prefaultProcessor = (schema, ctx, json, params) => {
     const def = schema._zod.def;
-    process$1(def.innerType, ctx, params);
+    processSchema(def.innerType, ctx, params);
     const seen = ctx.seen.get(schema);
     seen.ref = def.innerType;
     if (ctx.io !== "input")
@@ -9730,7 +9971,7 @@ const prefaultProcessor = (schema, ctx, json, params) => {
 };
 const catchProcessor = (schema, ctx, json, params) => {
     const def = schema._zod.def;
-    process$1(def.innerType, ctx, params);
+    processSchema(def.innerType, ctx, params);
     const seen = ctx.seen.get(schema);
     seen.ref = def.innerType;
     let catchValue;
@@ -9747,20 +9988,20 @@ const pipeProcessor = (schema, ctx, _json, params) => {
     const def = schema._zod.def;
     const inIsTransform = def.in._zod.traits.has("$ZodTransform");
     const innerType = ctx.io === "input" ? (inIsTransform ? def.out : def.in) : def.out;
-    process$1(innerType, ctx, params);
+    processSchema(innerType, ctx, params);
     const seen = ctx.seen.get(schema);
     seen.ref = innerType;
 };
 const readonlyProcessor = (schema, ctx, json, params) => {
     const def = schema._zod.def;
-    process$1(def.innerType, ctx, params);
+    processSchema(def.innerType, ctx, params);
     const seen = ctx.seen.get(schema);
     seen.ref = def.innerType;
     json.readOnly = true;
 };
 const optionalProcessor = (schema, ctx, _json, params) => {
     const def = schema._zod.def;
-    process$1(def.innerType, ctx, params);
+    processSchema(def.innerType, ctx, params);
     const seen = ctx.seen.get(schema);
     seen.ref = def.innerType;
 };
@@ -9977,6 +10218,12 @@ const ZodType = /*@__PURE__*/ $constructor("ZodType", (inst, def) => {
     set spa(value) {
         own(this, "spa", value);
     },
+    validate(data, params) {
+        return validate(this, data, params);
+    },
+    validateAsync(data, params) {
+        return validateAsync$1(this, data, params);
+    },
     encode: function _encode(data, params) {
         return encode(this, data, params, { callee: _encode });
     },
@@ -10018,10 +10265,11 @@ const _ZodString = /*@__PURE__*/ $constructor("_ZodString", (inst, def) => {
     $ZodString.init(inst, def);
     ZodType.init(inst, def);
     inst._zod.processJSONSchema = (ctx, json, params) => stringProcessor(inst, ctx, json);
-    const bag = inst._zod.bag;
-    inst.format = bag.format ?? null;
-    inst.minLength = bag.minimum ?? null;
-    inst.maxLength = bag.maximum ?? null;
+}, 
+/*@__PURE__*/ derived({
+    format: (inst) => aggregateChecks(inst).format ?? null,
+    minLength: (inst) => aggregateChecks(inst).minimum ?? null,
+    maxLength: (inst) => aggregateChecks(inst).maximum ?? null,
 }, {
     regex(...args) {
         return this.check(_regex(...args));
@@ -10068,7 +10316,7 @@ const _ZodString = /*@__PURE__*/ $constructor("_ZodString", (inst, def) => {
     slugify() {
         return this.check(_slugify());
     },
-});
+}));
 const ZodString = /*@__PURE__*/ $constructor("ZodString", (inst, def) => {
     $ZodString.init(inst, def);
     _ZodString.init(inst, def);
@@ -10277,14 +10525,22 @@ const ZodNumber = /*@__PURE__*/ $constructor("ZodNumber", (inst, def) => {
     $ZodNumber.init(inst, def);
     ZodType.init(inst, def);
     inst._zod.processJSONSchema = (ctx, json, params) => numberProcessor(inst, ctx, json, params);
-    const bag = inst._zod.bag;
-    inst.minValue =
-        Math.max(bag.minimum ?? Number.NEGATIVE_INFINITY, bag.exclusiveMinimum ?? Number.NEGATIVE_INFINITY) ?? null;
-    inst.maxValue =
-        Math.min(bag.maximum ?? Number.POSITIVE_INFINITY, bag.exclusiveMaximum ?? Number.POSITIVE_INFINITY) ?? null;
-    inst.isInt = (bag.format ?? "").includes("int") || Number.isSafeInteger(bag.multipleOf ?? 0.5);
     inst.isFinite = true;
-    inst.format = bag.format ?? null;
+}, 
+/*@__PURE__*/ derived({
+    minValue: (inst) => {
+        const { minimum, exclusiveMinimum } = aggregateChecks(inst);
+        return Math.max(minimum ?? Number.NEGATIVE_INFINITY, exclusiveMinimum ?? Number.NEGATIVE_INFINITY);
+    },
+    maxValue: (inst) => {
+        const { maximum, exclusiveMaximum } = aggregateChecks(inst);
+        return Math.min(maximum ?? Number.POSITIVE_INFINITY, exclusiveMaximum ?? Number.POSITIVE_INFINITY);
+    },
+    isInt: (inst) => {
+        const { isInt, multipleOf } = aggregateChecks(inst);
+        return !!isInt || !!multipleOf?.some(Number.isSafeInteger);
+    },
+    format: (inst) => aggregateChecks(inst).format ?? null,
 }, {
     gt(value, params) {
         return this.check(_gt(value, params));
@@ -10331,7 +10587,7 @@ const ZodNumber = /*@__PURE__*/ $constructor("ZodNumber", (inst, def) => {
     finite() {
         return this;
     },
-});
+}));
 function number(params) {
     return _number(ZodNumber, params);
 }
@@ -10403,19 +10659,20 @@ const ZodObject = /*@__PURE__*/ $constructor("ZodObject", (inst, def) => {
         return _enum(Object.keys(this._zod.def.shape));
     },
     catchall(catchall) {
-        return this.clone({ ...this._zod.def, catchall: catchall });
+        // `mergeDefs` rather than a spread: spreading reads `shape`, and resolving it can mint a whole fresh subtree
+        return this.clone(mergeDefs(this._zod.def, { catchall: catchall }));
     },
     passthrough() {
-        return this.clone({ ...this._zod.def, catchall: unknown() });
+        return this.clone(mergeDefs(this._zod.def, { catchall: unknown() }));
     },
     loose() {
-        return this.clone({ ...this._zod.def, catchall: unknown() });
+        return this.clone(mergeDefs(this._zod.def, { catchall: unknown() }));
     },
     strict() {
-        return this.clone({ ...this._zod.def, catchall: never() });
+        return this.clone(mergeDefs(this._zod.def, { catchall: never() }));
     },
     strip() {
-        return this.clone({ ...this._zod.def, catchall: undefined });
+        return this.clone(mergeDefs(this._zod.def, { catchall: undefined }));
     },
     extend(incoming) {
         return extend(this, incoming);
@@ -10505,7 +10762,8 @@ const ZodEnum = /*@__PURE__*/ $constructor("ZodEnum", (inst, def) => {
     ZodType.init(inst, def);
     inst._zod.processJSONSchema = (ctx, json, params) => enumProcessor(inst, ctx, json);
     inst.enum = def.entries;
-    inst.options = Object.values(def.entries);
+    // reuse the parsed value set so a numeric TS enum's reverse-mapping keys stay out
+    inst.options = [...inst._zod.values];
     const keys = new Set(Object.keys(def.entries));
     inst.extract = (values, params) => {
         const newEntries = {};
@@ -10762,8 +11020,16 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
     return _superRefine(fn, params);
 }
+const ZodInstanceOf = /*@__PURE__*/ $constructor("ZodInstanceOf", (inst, def) => {
+    ZodCustom.init(inst, def);
+}, {
+    properties(shape, params) {
+        // asserts in place, so the narrowed output type is truthful without a wrapper
+        return this.check(_properties(shape, params));
+    },
+});
 function _instanceof(cls, params = {}) {
-    const inst = new ZodCustom({
+    const inst = new ZodInstanceOf({
         type: "custom",
         check: "custom",
         fn: (data) => data instanceof cls,
@@ -10792,13 +11058,14 @@ const ZodIssueCode = {
     custom: "custom",
 };
 
-var isMergeableObject;
-var hasRequiredIsMergeableObject;
+var cjs;
+var hasRequiredCjs;
 
-function requireIsMergeableObject () {
-	if (hasRequiredIsMergeableObject) return isMergeableObject;
-	hasRequiredIsMergeableObject = 1;
-	isMergeableObject = function isMergeableObject(value) {
+function requireCjs () {
+	if (hasRequiredCjs) return cjs;
+	hasRequiredCjs = 1;
+
+	var isMergeableObject = function isMergeableObject(value) {
 		return isNonNullObject(value)
 			&& !isSpecial(value)
 	};
@@ -10822,16 +11089,6 @@ function requireIsMergeableObject () {
 	function isReactElement(value) {
 		return value.$$typeof === REACT_ELEMENT_TYPE
 	}
-	return isMergeableObject;
-}
-
-var deepmerge_1;
-var hasRequiredDeepmerge;
-
-function requireDeepmerge () {
-	if (hasRequiredDeepmerge) return deepmerge_1;
-	hasRequiredDeepmerge = 1;
-	var defaultIsMergeableObject = requireIsMergeableObject();
 
 	function emptyTarget(val) {
 		return Array.isArray(val) ? [] : {}
@@ -10908,7 +11165,7 @@ function requireDeepmerge () {
 	function deepmerge(target, source, options) {
 		options = options || {};
 		options.arrayMerge = options.arrayMerge || defaultArrayMerge;
-		options.isMergeableObject = options.isMergeableObject || defaultIsMergeableObject;
+		options.isMergeableObject = options.isMergeableObject || isMergeableObject;
 		// cloneUnlessOtherwiseSpecified is added to `options` so that custom arrayMerge()
 		// implementations can use it. The caller may not replace it.
 		options.cloneUnlessOtherwiseSpecified = cloneUnlessOtherwiseSpecified;
@@ -10936,12 +11193,14 @@ function requireDeepmerge () {
 		}, {})
 	};
 
-	deepmerge_1 = deepmerge;
-	return deepmerge_1;
+	var deepmerge_1 = deepmerge;
+
+	cjs = deepmerge_1;
+	return cjs;
 }
 
-var deepmergeExports = requireDeepmerge();
-var deepmerge = /*@__PURE__*/getDefaultExportFromCjs(deepmergeExports);
+var cjsExports = requireCjs();
+var deepmerge = /*@__PURE__*/getDefaultExportFromCjs(cjsExports);
 
 /**
  * Enum representing the severity levels of telemetry items.
@@ -11075,7 +11334,7 @@ const TelemetryCustomEventSchema = TelemetryEventSchema.extend({
     type: literal(TelemetryType.Custom),
 }).passthrough();
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11129,7 +11388,7 @@ const RESOURCE = "resource";
 const CLI_DATA = "clidata";
 const ATTRIBUTE_TOKENS = "attribute_tokens";
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11363,7 +11622,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11392,7 +11651,7 @@ function createAuthError(code, correlationId, additionalMessage) {
     return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage$1(code));
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11415,7 +11674,7 @@ function createClientAuthError(errorCode, correlationId, additionalMessage) {
     return new ClientAuthError(errorCode, correlationId, additionalMessage);
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11453,7 +11712,7 @@ const methodNotImplemented = "method_not_implemented";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11491,7 +11750,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11557,7 +11816,7 @@ function getJWSPayload(authToken, correlationId) {
     return matches[2];
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11645,7 +11904,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11659,7 +11918,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11681,7 +11940,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11705,7 +11964,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /**
  * Returns the AccountInfo interface for this account.
  * @internal
@@ -11894,7 +12153,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11904,7 +12163,7 @@ function isAccountEntity(entity) {
  */
 const unexpectedError = "unexpected_error";
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11924,7 +12183,7 @@ function createClientConfigurationError(errorCode, correlationId) {
     return new ClientConfigurationError(errorCode, correlationId);
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11955,7 +12214,7 @@ const invalidDpopHtu = "invalid_dpop_htu";
 const invalidDpopNonce = "invalid_dpop_nonce";
 const dpopMissingResourceContext = "dpop_missing_resource_context";
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11967,7 +12226,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12047,7 +12306,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12205,7 +12464,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12359,7 +12618,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12368,7 +12627,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12378,7 +12637,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12388,7 +12647,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12459,7 +12718,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12552,7 +12811,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12663,7 +12922,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12728,7 +12987,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13015,7 +13274,7 @@ function serializeAttributeTokens(attributeTokens) {
     return [...attributeTokens].sort().join(" ");
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13983,7 +14242,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14017,7 +14276,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14213,7 +14472,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14699,7 +14958,7 @@ function addAttributeTokens(parameters, attributeTokens) {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14821,7 +15080,7 @@ function validateUrl(url, logger, correlationId) {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14869,7 +15128,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14892,7 +15151,7 @@ const DEFAULT_TOKEN_BINDING_KEY_MANAGER = {
     },
 };
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -15167,12 +15426,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$2 = "16.14.0";
+const version$2 = "16.14.1";
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -15180,7 +15439,7 @@ const version$2 = "16.14.0";
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -15218,7 +15477,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16405,7 +16664,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -16419,7 +16678,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16477,7 +16736,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16575,7 +16834,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -16602,7 +16861,7 @@ function isOidcProtocolMode(config) {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16623,7 +16882,7 @@ function createJoseHeaderError(code, correlationId) {
     return new JoseHeaderError(code, correlationId);
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -16648,7 +16907,7 @@ function isPlainObject(value) {
     return Object.getPrototypeOf(value) === proto;
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -16658,7 +16917,7 @@ const missingAlgError = "missing_alg_error";
 const missingJwkError = "missing_jwk_error";
 const invalidJwkError = "invalid_jwk_error";
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16724,7 +16983,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16825,7 +17084,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16970,7 +17229,7 @@ class DpopProofGenerator {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -17021,7 +17280,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17088,7 +17347,7 @@ function createInteractionRequiredAuthError(errorCode, correlationId, errorMessa
     return new InteractionRequiredAuthError(errorCode, correlationId, errorMessage);
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17107,7 +17366,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17178,7 +17437,7 @@ function parseRequestState(base64Decode, state, correlationId) {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17251,11 +17510,26 @@ class ResponseHandler {
         let idTokenClaims;
         if (serverTokenResponse.id_token) {
             idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode, request.correlationId);
-            // token nonce check (TODO: Add a warning if no nonce is given?)
-            if (authCodePayload && authCodePayload.nonce) {
-                if (idTokenClaims.nonce !== authCodePayload.nonce) {
-                    throw createClientAuthError(nonceMismatch, request.correlationId);
-                }
+        }
+        /*
+         * Callers opt in to strict nonce-presence validation by including
+         * the nonce property, even when its value is undefined.
+         */
+        if (authCodePayload &&
+            Object.prototype.hasOwnProperty.call(authCodePayload, "nonce")) {
+            const expectedNonce = authCodePayload.nonce;
+            const tokenNonce = idTokenClaims?.nonce;
+            // Warn when the ID Token nonce cannot be bound to the request.
+            if (tokenNonce !== undefined && expectedNonce === undefined) {
+                this.logger.warning("0thba9", request.correlationId);
+                throw createClientAuthError(nonceMismatch, request.correlationId);
+            }
+            // If the request supplies a nonce, the ID Token value must be a matching string.
+            if (expectedNonce !== undefined &&
+                (typeof expectedNonce !== "string" ||
+                    typeof tokenNonce !== "string" ||
+                    expectedNonce !== tokenNonce)) {
+                throw createClientAuthError(nonceMismatch, request.correlationId);
             }
         }
         // generate homeAccountId
@@ -17591,7 +17865,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -17601,7 +17875,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -17620,7 +17894,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint, fmiP
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17644,7 +17918,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17730,7 +18004,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17761,7 +18035,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17894,7 +18168,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18158,7 +18432,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18385,7 +18659,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18619,7 +18893,7 @@ class RefreshTokenClient {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18912,7 +19186,7 @@ class StubServerTelemetryManager extends ServerTelemetryManager {
     clearNativeBrokerErrorCode() { }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19039,7 +19313,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19055,7 +19329,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19088,7 +19362,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -19215,7 +19489,7 @@ const DecryptEarResponse = "decryptEarResponse";
  */
 const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19238,7 +19512,7 @@ function createBrowserAuthError(errorCode, correlationId, subError) {
     return new BrowserAuthError(errorCode, correlationId, subError);
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -19296,7 +19570,7 @@ const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
 const timedOut = "timed_out";
 const emptyResponse = "empty_response";
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19335,7 +19609,7 @@ function base64DecToArr(base64String) {
     return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19521,7 +19795,7 @@ const iFrameRenewalPolicies = [
     CacheLookupPolicy.RefreshTokenAndNetwork,
 ];
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -19566,7 +19840,7 @@ function base64EncArr(aBytes) {
     return btoa(binString);
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19913,7 +20187,7 @@ async function computeJwkThumbprint(publicJwk, correlationId) {
     return hashString(thumbprintJson);
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19933,7 +20207,7 @@ function createBrowserConfigurationAuthError(errorCode, correlationId) {
     return new BrowserConfigurationAuthError(errorCode, correlationId, getDefaultErrorMessage(errorCode));
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -19941,7 +20215,7 @@ function createBrowserConfigurationAuthError(errorCode, correlationId) {
 const storageNotSupported = "storage_not_supported";
 const inMemRedirectUnavailable = "in_mem_redirect_unavailable";
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20282,7 +20556,7 @@ function createGuid() {
     return createNewGuid();
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20485,7 +20759,7 @@ class DatabaseStorage {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -20531,7 +20805,7 @@ class MemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20669,7 +20943,7 @@ class AsyncMemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20817,7 +21091,7 @@ TokenBindingKeyManager.TOKEN_BINDING_KEY_USAGES = [
     "verify",
 ];
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20953,7 +21227,7 @@ class CryptoOps {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21000,7 +21274,7 @@ const LocalStorageUpdated = "localStorageUpdated";
  */
 const SsoCapable = "ssoCapable";
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21029,7 +21303,7 @@ function getTokenKeysCacheKey(clientId, schema = CREDENTIAL_SCHEMA_VERSION) {
     return `${PREFIX}.${schema}.${TOKEN_KEYS}.${clientId}`;
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21120,7 +21394,7 @@ function getCookieExpirationTime(cookieLifeDays) {
     return expr.toUTCString();
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21162,7 +21436,7 @@ function getTokenKeys(clientId, storage, schemaVersion) {
     };
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21173,7 +21447,7 @@ function isEncrypted(data) {
         data.hasOwnProperty("data"));
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21475,7 +21749,7 @@ class LocalStorage {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21517,7 +21791,7 @@ class SessionStorage {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21545,12 +21819,12 @@ const EventType = {
     BROKER_CONNECTION_ESTABLISHED: "msal:brokerConnectionEstablished",
 };
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version$1 = "5.20.0";
+const version$1 = "5.23.0";
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21567,7 +21841,7 @@ function removeElementFromArray(array, element) {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23013,7 +23287,7 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient, even
     return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger, performanceClient, eventHandler, staticAuthorityOptions, tokenBindingKeyManager);
 };
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -23060,7 +23334,7 @@ function getActiveAccount(browserStorage, correlationId) {
     return browserStorage.getActiveAccount(correlationId);
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23164,7 +23438,7 @@ class EventHandler {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23307,7 +23581,7 @@ async function clearCacheOnLogout(browserStorage, browserCrypto, logger, correla
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23445,7 +23719,7 @@ function validateRequestMethod(interactionRequest, protocolMode) {
     return httpMethod;
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23652,7 +23926,7 @@ async function initializeAuthorizationRequest(request, interactionType, config,
     return validatedRequest;
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -23670,7 +23944,7 @@ async function initializeAuthorizationRequest(request, interactionType, config,
  */
 const POPUP_RELAY_RESPONSE_TYPE = "msal:popup-relay-response:v1";
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23776,7 +24050,7 @@ async function waitForPopupRelayResponse(timeoutMs, logger, request, popupWindow
     });
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23800,7 +24074,7 @@ function extractBrowserRequestState(browserCrypto, state, correlationId) {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23839,7 +24113,7 @@ function validateInteractionType(response, browserCrypto, interactionType, corre
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23928,7 +24202,52 @@ class InteractionHandler {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Token types supported by the platform broker request contract.
+ */
+const PlatformAuthTokenType = {
+    DPOP_WITH_PROOF: "dpop+proof",
+};
+const PROOF_OF_POSSESSION_TOKEN_TYPES = [
+    AuthenticationScheme.POP,
+    AuthenticationScheme.DPOP,
+    PlatformAuthTokenType.DPOP_WITH_PROOF,
+];
+/**
+ * Returns whether a platform broker token type requires proof request metadata.
+ */
+function isProofOfPossessionTokenType(tokenType) {
+    return (tokenType !== undefined &&
+        PROOF_OF_POSSESSION_TOKEN_TYPES.includes(tokenType));
+}
+/**
+ * Adds canonical proof request fields to the broker no-cache property bag.
+ */
+function createPlatformAuthExtraParametersNoCache(extraParametersNoCache, isProofOfPossessionRequest, resourceRequestMethod, resourceRequestUri, dpopNonce) {
+    if (!isProofOfPossessionRequest) {
+        return extraParametersNoCache;
+    }
+    return {
+        ...extraParametersNoCache,
+        ...(resourceRequestMethod && {
+            pop_method: resourceRequestMethod,
+        }),
+        ...(resourceRequestUri && {
+            pop_url: resourceRequestUri,
+        }),
+        ...(dpopNonce && {
+            pop_nonce: dpopNonce,
+        }),
+    };
+}
+
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -23937,7 +24256,7 @@ const contentError = "ContentError";
 const pageException = "PageException";
 const userSwitch = "user_switch";
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -23950,7 +24269,7 @@ const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
 const UI_NOT_ALLOWED = "UI_NOT_ALLOWED";
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24022,7 +24341,7 @@ function createNativeAuthError(code, correlationId, description, ext) {
     return error;
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24071,7 +24390,7 @@ class SilentCacheClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24214,6 +24533,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             scopes: ScopeSet.fromString(request.scope, this.correlationId).asArray(),
             account: cachedAccount,
             forceRefresh: false,
+            resource: request.extraParameters?.resource,
         };
         // Preserve FMI partition semantics for silent cache filtering.
         if (request.attributeTokens) {
@@ -24551,6 +24871,9 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             }
             : undefined;
         const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, request.correlationId, undefined, request.tokenType, undefined, request.keyId, additionalCacheKeyComponents);
+        if (request.extraParameters?.resource) {
+            cachedAccessToken.resource = request.extraParameters.resource;
+        }
         // save idtoken credential in configured browser storage
         if (!!cachedIdToken && storeInCache?.idToken !== false) {
             await this.browserStorage.setIdTokenCredential(cachedIdToken, this.correlationId, isKmsi(idTokenClaims));
@@ -24635,7 +24958,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
          * scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
          * attributeTokens is destructured out because PlatformAuthRequest represents it as a pre-serialized string, not the caller-provided Array<string>.
          */
-        const { scopes, claims } = request;
+        const { scopes, claims, extraParametersNoCache, dpopNonce } = request;
         const scopeSet = new ScopeSet(scopes || [], this.correlationId);
         scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
         const mergedClaims = buildMergedClaims(claims, configClaims?.length ? configClaims : undefined);
@@ -24668,6 +24991,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             resourceRequestUri: request.resourceRequestUri,
             shrClaims: request.shrClaims,
             shrNonce: request.shrNonce,
+            extraParametersNoCache: createPlatformAuthExtraParametersNoCache(extraParametersNoCache, isProofOfPossessionTokenType(request.authenticationScheme), request.resourceRequestMethod, request.resourceRequestUri, dpopNonce),
         };
         if (hasAttributeTokens) {
             validatedRequest.attributeTokens =
@@ -24791,7 +25115,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25104,7 +25428,7 @@ async function handleResponseEAR(request, response, apiId, config, authority, br
     return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, apiId, additionalData, undefined, undefined, undefined, undefined));
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25159,7 +25483,7 @@ async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceCl
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25202,7 +25526,7 @@ class NavigationClient {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25349,7 +25673,7 @@ function getHeaderDict(headers) {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25480,7 +25804,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
     return overlayedConfig;
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25507,9 +25831,12 @@ class PlatformAuthExtensionHandler {
     async sendMessage(request) {
         this.logger.trace(`0on4p2 ${this.platformAuthType}`, request.correlationId);
         // fall back to native calls
+        const extensionRequest = { ...request };
+        delete extensionRequest.resourceRequestMethod;
+        delete extensionRequest.resourceRequestUri;
         const messageBody = {
             method: NativeExtensionMethod.GetToken,
-            request: request,
+            request: extensionRequest,
         };
         const req = {
             channel: PlatformAuthConstants.CHANNEL_ID,
@@ -25741,7 +26068,7 @@ class PlatformAuthExtensionHandler {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25802,7 +26129,9 @@ class PlatformAuthDOMHandler {
     }
     initializePlatformDOMRequest(request) {
         this.logger.trace(`15d6yv ${this.platformAuthType}`, request.correlationId);
-        const { accountId, clientId, authority, scope, redirectUri, correlationId, state, extraParameters, ...remainingProperties } = request;
+        const { accountId, clientId, authority, scope, redirectUri, correlationId, state, preferBinding, enclave, reqCnf, extraParametersNoCache, extraParameters, ...remainingProperties } = request;
+        delete remainingProperties.resourceRequestMethod;
+        delete remainingProperties.resourceRequestUri;
         const validExtraParameters = this.getDOMExtraParams(remainingProperties, correlationId);
         const platformDOMRequest = {
             accountId: accountId,
@@ -25818,6 +26147,10 @@ class PlatformAuthDOMHandler {
             redirectUri: redirectUri,
             scope: scope,
             state: state,
+            preferBinding: preferBinding,
+            enclave: enclave,
+            requestConfirmation: reqCnf,
+            extraParametersNoCache,
         };
         return platformDOMRequest;
     }
@@ -25851,6 +26184,8 @@ class PlatformAuthDOMHandler {
     }
     convertToPlatformBrokerResponse(response, correlationId) {
         this.logger.trace(`14913t ${this.platformAuthType}`, correlationId);
+        const responseProperties = response.properties || {};
+        const bindingAttested = this.parseDOMBoolean(responseProperties.binding_attested, "binding_attested", correlationId);
         const nativeResponse = {
             access_token: response.accessToken,
             id_token: response.idToken,
@@ -25859,12 +26194,24 @@ class PlatformAuthDOMHandler {
             expires_in: response.expiresIn,
             scope: response.scopes,
             state: response.state || "",
-            properties: response.properties || {},
+            properties: responseProperties,
             extendedLifetimeToken: response.extendedLifetimeToken ?? false,
             shr: response.proofOfPossessionPayload,
+            token_type: responseProperties.token_type,
+            DPoP: responseProperties.dpop_proof,
+            binding_attested: bindingAttested,
         };
         return nativeResponse;
     }
+    parseDOMBoolean(value, propertyName, correlationId) {
+        if (value === undefined) {
+            return undefined;
+        }
+        if (value === "true" || value === "false") {
+            return value === "true";
+        }
+        throw createAuthError(unexpectedError, correlationId, `Platform broker returned invalid ${propertyName} value.`);
+    }
     getDOMExtraParams(extraParameters, correlationId) {
         try {
             const stringifiedProperties = {};
@@ -25889,7 +26236,7 @@ class PlatformAuthDOMHandler {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout, enablePlatformBrokerDOMSupport) {
     logger.trace("134j0v", correlationId);
     logger.trace(`04c81g ${enablePlatformBrokerDOMSupport}`, correlationId);
@@ -25954,7 +26301,7 @@ function isPlatformAuthAllowed(config, logger, correlationId, platformAuthProvid
     return true;
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26463,7 +26810,7 @@ class PopupClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26493,12 +26840,17 @@ class RedirectClient extends StandardInteractionClient {
     async acquireToken(request) {
         const validRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, InteractionType.Redirect, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
         validRequest.platformBroker = isPlatformAuthAllowed(this.config, this.logger, this.correlationId, this.platformAuthProvider, request.authenticationScheme);
+        let rejectBackButtonCancellation;
+        const backButtonCancellation = new Promise((_, reject) => {
+            rejectBackButtonCancellation = reject;
+        });
         const handleBackButton = (event) => {
             // Clear temporary cache if the back button is clicked during the redirect flow.
             if (event.persisted) {
                 this.logger.verbose("0udvtt", this.correlationId);
                 this.browserStorage.resetRequestCache(this.correlationId);
                 this.eventHandler.emitEvent(EventType.RESTORE_FROM_BFCACHE, this.correlationId, InteractionType.Redirect);
+                rejectBackButtonCancellation(createBrowserAuthError(userCancelled, this.correlationId));
             }
         };
         const redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
@@ -26508,12 +26860,10 @@ class RedirectClient extends StandardInteractionClient {
         // Clear temporary cache if the back button is clicked during the redirect flow.
         window.addEventListener("pageshow", handleBackButton);
         try {
-            if (this.config.system.protocolMode === ProtocolMode.EAR) {
-                await this.executeEarFlow(validRequest);
-            }
-            else {
-                await this.executeCodeFlow(validRequest);
-            }
+            const redirectOperation = this.config.system.protocolMode === ProtocolMode.EAR
+                ? this.executeEarFlow(validRequest)
+                : this.executeCodeFlow(validRequest);
+            await Promise.race([redirectOperation, backButtonCancellation]);
         }
         catch (e) {
             if (e instanceof AuthError) {
@@ -26910,7 +27260,7 @@ class RedirectClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26976,7 +27326,7 @@ function removeHiddenIframe(iframe) {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27214,7 +27564,7 @@ class SilentIframeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27281,7 +27631,7 @@ class SilentRefreshClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27294,7 +27644,7 @@ class HybridSpaAuthorizationCodeClient extends AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27367,7 +27717,7 @@ class SilentAuthCodeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
     const frameInstances = 
     // @ts-ignore
@@ -27383,7 +27733,7 @@ function collectInstanceStats(currentClientId, performanceEvent, logger, correla
     });
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28883,7 +29233,7 @@ function checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheL
     return isSilentlyResolvable && tryIframeRenewal;
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28988,7 +29338,7 @@ class BaseOperatingContext {
     }
 }
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29035,7 +29385,7 @@ StandardOperatingContext.MODULE_NAME = "";
  */
 StandardOperatingContext.ID = "StandardOperatingContext";
 
-/*! @azure/msal-browser v5.20.0 2026-08-28 */
+/*! @azure/msal-browser v5.23.0 2026-09-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29667,7 +30017,7 @@ const createClientLogCallback = (provider, metadata, scope) => {
 };
 
 // Generated by genversion.
-const version = '12.0.0';
+const version = '12.0.1';
 
 /**
  * Zod schema for telemetry configuration validation.
@@ -31658,4 +32008,4 @@ const configureMsal = (configure) => ({
 });
 
 export { TelemetryEventSchema as $, reduce as A, lastValueFrom as B, filter as C, BaseModuleProvider as D, EMPTY_SUBSCRIPTION as E, catchError as F, of as G, object as H, _instanceof as I, _enum as J, string as K, boolean as L, ModuleEventLevel as M, record as N, Observable as O, union as P, __rest as Q, __assign as R, Subscription as S, switchMap as T, observeOn as U, deepmerge as V, BaseConfigBuilder as W, TelemetryExceptionSchema as X, TelemetryItemNames as Y, TelemetryType as Z, __extends as _, arrRemove as a, TelemetryMetricSchema as a0, TelemetryCustomEventSchema as a1, array as a2, TelemetryLevel as a3, enableMSAL as a4, MsalConfigurator as a5, module$1 as a6, __values as b, createErrorClass as c, __spreadArray as d, errorContext as e, __read as f, SafeSubscriber as g, EmptyError as h, isFunction as i, executeSchedule as j, innerFrom as k, createOperatorSubscriber as l, map as m, mergeMap as n, operate as o, identity as p, isArrayLike as q, isScheduler as r, popScheduler as s, popNumber as t, EMPTY as u, from as v, mergeInternals as w, scanInternals as x, noop as y, popResultSelector as z };
-//# sourceMappingURL=module-DMrP0Kg2.js.map
+//# sourceMappingURL=module-Xg35JJRU.js.map