plugin-data-source-mssql 2.0.4 → 2.0.6

package/dist/tedious/node_modules/@azure/msal-browser/lib/custom-auth-path/msal-custom-auth.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.6.2 2026-03-27 */
+/*! @azure/msal-browser v5.8.0 2026-04-21 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -229,7 +229,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -281,7 +281,7 @@ const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -312,7 +312,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -332,7 +332,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -412,7 +412,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -435,7 +435,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -459,7 +459,7 @@ const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
 const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -498,7 +498,7 @@ const methodNotImplemented = "method_not_implemented";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -693,7 +693,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -814,18 +814,29 @@ function addSid(parameters, sid) {
     parameters.set(SID, sid);
 }
 /**
- * add claims
- * @param claims
- */
-function addClaims(parameters, claims, clientCapabilities) {
-    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
-    try {
-        JSON.parse(mergedClaims);
-    }
-    catch (e) {
-        throw createClientConfigurationError(invalidClaims);
+ * Adds claims to request parameters, conditionally excluding clientCapabilities
+ * when skipBrokerClaims is true and a brokered flow is in effect.
+ * @param parameters - The request parameters map
+ * @param claims - The claims string from the request
+ * @param clientCapabilities - The client capabilities from configuration
+ * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+ */
+function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+    // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
+    const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
+        ? undefined
+        : clientCapabilities;
+    if (!StringUtils.isEmptyObj(claims) ||
+        (configClaims && configClaims.length > 0)) {
+        const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
+        try {
+            JSON.parse(mergedClaims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+        parameters.set(CLAIMS, mergedClaims);
     }
-    parameters.set(CLAIMS, mergedClaims);
 }
 /**
  * add correlationId
@@ -1071,7 +1082,7 @@ function addResource(parameters, resource) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1180,7 +1191,7 @@ function normalizeUrlForComparison(url) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1219,7 +1230,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1480,12 +1491,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.4.0";
+const version$1 = "16.5.1";
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1494,7 +1505,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1535,6 +1546,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             username: preferred_username || upn || "",
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            upn: upn,
         };
     }
     else {
@@ -1562,7 +1574,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     }
     // ID token claims override passed in account info and tenant profile
     if (idTokenClaims) {
-        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
         updatedAccountInfo = {
@@ -1576,7 +1588,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1656,7 +1668,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1813,7 +1825,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1970,7 +1982,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1978,7 +1990,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2016,7 +2028,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2054,7 +2066,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2069,7 +2081,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2091,7 +2103,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2115,7 +2127,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2290,7 +2302,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2427,6 +2439,19 @@ class CacheManager {
             !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
             return false;
         }
+        if (!!tenantProfileFilter.username &&
+            !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
+                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+            return false;
+        }
+        if (!!tenantProfileFilter.loginHint &&
+            !this.matchLoginHintWithTenantProfile(tenantProfile, tenantProfileFilter.loginHint)) {
+            return false;
+        }
+        if (!!tenantProfileFilter.upn &&
+            !(tenantProfile.upn === tenantProfileFilter.upn)) {
+            return false;
+        }
         return true;
     }
     idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -2441,7 +2466,8 @@ class CacheManager {
                 return false;
             }
             if (!!tenantProfileFilter.username &&
-                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {
+                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username) &&
+                !this.matchUsername(idTokenClaims.upn, tenantProfileFilter.username)) {
                 return false;
             }
             if (!!tenantProfileFilter.name &&
@@ -2542,10 +2568,6 @@ class CacheManager {
                 !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                 return;
             }
-            if (!!accountFilter.username &&
-                !this.matchUsername(entity.username, accountFilter.username)) {
-                return;
-            }
             if (!!accountFilter.environment &&
                 !this.matchEnvironment(entity, accountFilter.environment, correlationId)) {
                 return;
@@ -2566,6 +2588,9 @@ class CacheManager {
             const tenantProfileFilter = {
                 localAccountId: accountFilter?.localAccountId,
                 name: accountFilter?.name,
+                username: accountFilter?.username,
+                loginHint: accountFilter?.loginHint,
+                upn: accountFilter?.upn,
             };
             const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                 return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -2816,11 +2841,11 @@ class CacheManager {
                 const numHomeIdTokens = homeIdTokenMap.size;
                 if (numHomeIdTokens < 1) {
                     this.commonLogger.info("0ooalx", correlationId);
-                    return idTokenMap.values().next().value;
+                    return idTokenMap.values().next().value ?? null;
                 }
                 else if (numHomeIdTokens === 1) {
                     this.commonLogger.info("1eq2vc", correlationId);
-                    return homeIdTokenMap.values().next().value;
+                    return homeIdTokenMap.values().next().value ?? null;
                 }
                 else {
                     // Multiple ID tokens for home tenant profile, remove all and return null
@@ -2836,7 +2861,7 @@ class CacheManager {
             return null;
         }
         this.commonLogger.info("1sm769", correlationId);
-        return idTokenMap.values().next().value;
+        return idTokenMap.values().next().value ?? null;
     }
     /**
      * Gets all idTokens matching the given filter
@@ -3148,6 +3173,17 @@ class CacheManager {
             typeof cachedUsername === "string" &&
             filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
     }
+    /**
+     * helper to match loginhints
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    matchLoginHintWithTenantProfile(tenantProfile, loginHintFilter) {
+        return (tenantProfile.loginHint === loginHintFilter ||
+            tenantProfile.username === loginHintFilter ||
+            tenantProfile.upn === loginHintFilter);
+    }
     /**
      * helper to match assertion
      * @param value
@@ -3240,6 +3276,10 @@ class CacheManager {
         if (tokenClaims.upn === loginHint) {
             return true;
         }
+        // check login hint against list of emails in token claims
+        if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
+            return true;
+        }
         return false;
     }
     /**
@@ -3391,7 +3431,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3405,7 +3445,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3460,7 +3500,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3555,213 +3595,34 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Error thrown when there is an error with the server code, for example, unavailability.
- */
-class ServerError extends AuthError {
-    constructor(errorCode, errorMessage, subError, errorNo, status) {
-        super(errorCode, errorMessage, subError);
-        this.name = "ServerError";
-        this.errorNo = errorNo;
-        this.status = status;
-        Object.setPrototypeOf(this, ServerError.prototype);
-    }
-}
-
-/*! @azure/msal-common v16.4.0 2026-03-27 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * MSAL-defined interaction required error code indicating no tokens are found in cache.
- * @public
- */
-const noTokensFound = "no_tokens_found";
-/**
- * MSAL-defined error code indicating a native account is unavailable on the platform.
- * @public
- */
-const nativeAccountUnavailable = "native_account_unavailable";
-/**
- * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
- * @public
- */
-const refreshTokenExpired = "refresh_token_expired";
-/**
- * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
- * @public
- */
-const uxNotAllowed = "ux_not_allowed";
-/**
- * Server-originated error code indicating interaction is required to complete the request.
- * @public
- */
-const interactionRequired = "interaction_required";
-/**
- * Server-originated error code indicating user consent is required.
- * @public
- */
-const consentRequired = "consent_required";
-/**
- * Server-originated error code indicating user login is required.
- * @public
- */
-const loginRequired = "login_required";
-/**
- * Server-originated error code indicating the token is invalid or corrupted.
- * @public
- */
-const badToken = "bad_token";
-/**
- * Server-originated error code indicating the user is in an interrupted state and interaction is required.
- * @public
- */
-const interruptedUser = "interrupted_user";
-
-/*! @azure/msal-common v16.4.0 2026-03-27 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
- */
-const InteractionRequiredServerErrorMessage = [
-    interactionRequired,
-    consentRequired,
-    loginRequired,
-    badToken,
-    uxNotAllowed,
-    interruptedUser,
-];
-const InteractionRequiredAuthSubErrorMessage = [
-    "message_only",
-    "additional_action",
-    "basic_action",
-    "user_password_expired",
-    "consent_required",
-    "bad_token",
-    "ux_not_allowed",
-    "interrupted_user",
-];
-/**
- * Error thrown when user interaction is required.
- */
-class InteractionRequiredAuthError extends AuthError {
-    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
-        super(errorCode, errorMessage, subError);
-        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
-        this.timestamp = timestamp || "";
-        this.traceId = traceId || "";
-        this.correlationId = correlationId || "";
-        this.claims = claims || "";
-        this.name = "InteractionRequiredAuthError";
-        this.errorNo = errorNo;
-    }
-}
-/**
- * Helper function used to determine if an error thrown by the server requires interaction to resolve
- * @param errorCode
- * @param errorString
- * @param subError
- */
-function isInteractionRequiredError(errorCode, errorString, subError) {
-    const isInteractionRequiredErrorCode = !!errorCode &&
-        InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
-    const isInteractionRequiredSubError = !!subError &&
-        InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
-    const isInteractionRequiredErrorDesc = !!errorString &&
-        InteractionRequiredServerErrorMessage.some((irErrorCode) => {
-            return errorString.indexOf(irErrorCode) > -1;
-        });
-    return (isInteractionRequiredErrorCode ||
-        isInteractionRequiredErrorDesc ||
-        isInteractionRequiredSubError);
-}
-/**
- * Creates an InteractionRequiredAuthError
- */
-function createInteractionRequiredAuthError(errorCode, errorMessage) {
-    return new InteractionRequiredAuthError(errorCode, errorMessage);
-}
-
-/*! @azure/msal-common v16.4.0 2026-03-27 */
-
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Appends user state with random guid, or returns random guid.
- * @param cryptoObj
- * @param userState
- * @param meta
- */
-function setRequestState(cryptoObj, userState, meta) {
-    const libraryState = generateLibraryState(cryptoObj, meta);
-    return userState
-        ? `${libraryState}${RESOURCE_DELIM}${userState}`
-        : libraryState;
-}
-/**
- * Generates the state value used by the common library.
- * @param cryptoObj
- * @param meta
- */
-function generateLibraryState(cryptoObj, meta) {
-    if (!cryptoObj) {
-        throw createClientAuthError(noCryptoObject);
-    }
-    // Create a state object containing a unique id and the timestamp of the request creation
-    const stateObj = {
-        id: cryptoObj.createNewGuid(),
-    };
-    if (meta) {
-        stateObj.meta = meta;
-    }
-    const stateString = JSON.stringify(stateObj);
-    return cryptoObj.base64Encode(stateString);
-}
-/**
- * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
- * @param base64Decode
- * @param state
- */
-function parseRequestState(base64Decode, state) {
-    if (!base64Decode) {
-        throw createClientAuthError(noCryptoObject);
-    }
-    if (!state) {
-        throw createClientAuthError(invalidState);
+ * This class instance helps track the memory changes facilitating
+ * decisions to read from and write to the persistent cache
+ */ class TokenCacheContext {
+    constructor(tokenCache, hasChanged) {
+        this.cache = tokenCache;
+        this.hasChanged = hasChanged;
     }
-    try {
-        // Split the state between library state and user passed state and decode them separately
-        const splitState = state.split(RESOURCE_DELIM);
-        const libraryState = splitState[0];
-        const userState = splitState.length > 1
-            ? splitState.slice(1).join(RESOURCE_DELIM)
-            : "";
-        const libraryStateString = base64Decode(libraryState);
-        const libraryStateObj = JSON.parse(libraryStateString);
-        return {
-            userRequestState: userState || "",
-            libraryState: libraryStateObj,
-        };
+    /**
+     * boolean which indicates the changes in cache
+     */
+    get cacheHasChanged() {
+        return this.hasChanged;
     }
-    catch (e) {
-        throw createClientAuthError(invalidState);
+    /**
+     * function to retrieve the token cache
+     */
+    get tokenCache() {
+        return this.cache;
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3826,19 +3687,278 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Time spent sending/waiting for the response of a request to the token endpoint
+ * Create IdTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
  */
-const NetworkClientSendPostRequestAsync = "networkClientSendPostRequestAsync";
-const RefreshTokenClientExecutePostToTokenEndpoint = "refreshTokenClientExecutePostToTokenEndpoint";
-const AuthorizationCodeClientExecutePostToTokenEndpoint = "authorizationCodeClientExecutePostToTokenEndpoint";
+function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
+    const idTokenEntity = {
+        credentialType: CredentialType.ID_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: idToken,
+        realm: tenantId,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+    };
+    return idTokenEntity;
+}
 /**
- * Time spent on the network for refresh token acquisition
+ * Create AccessTokenEntity
+ * @param homeAccountId
+ * @param environment
+ * @param accessToken
+ * @param clientId
+ * @param tenantId
+ * @param scopes
+ * @param expiresOn
+ * @param extExpiresOn
+ */
+function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+    const atEntity = {
+        homeAccountId: homeAccountId,
+        credentialType: CredentialType.ACCESS_TOKEN,
+        secret: accessToken,
+        cachedAt: nowSeconds().toString(),
+        expiresOn: expiresOn.toString(),
+        extendedExpiresOn: extExpiresOn.toString(),
+        environment: environment,
+        clientId: clientId,
+        realm: tenantId,
+        target: scopes,
+        tokenType: tokenType || AuthenticationScheme.BEARER,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+    };
+    if (userAssertionHash) {
+        atEntity.userAssertionHash = userAssertionHash;
+    }
+    if (refreshOn) {
+        atEntity.refreshOn = refreshOn.toString();
+    }
+    /*
+     * Create Access Token With Auth Scheme instead of regular access token
+     * Cast to lower to handle "bearer" from ADFS
+     */
+    if (atEntity.tokenType?.toLowerCase() !==
+        AuthenticationScheme.BEARER.toLowerCase()) {
+        atEntity.credentialType =
+            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+        switch (atEntity.tokenType) {
+            case AuthenticationScheme.POP:
+                // Make sure keyId is present and add it to credential
+                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                if (!tokenClaims?.cnf?.kid) {
+                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                }
+                atEntity.keyId = tokenClaims.cnf.kid;
+                break;
+            case AuthenticationScheme.SSH:
+                atEntity.keyId = keyId;
+        }
+    }
+    return atEntity;
+}
+/**
+ * Create RefreshTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
+ */
+function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
+    const rtEntity = {
+        credentialType: CredentialType.REFRESH_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: refreshToken,
+        lastUpdatedAt: Date.now().toString(),
+    };
+    if (userAssertionHash) {
+        rtEntity.userAssertionHash = userAssertionHash;
+    }
+    if (familyId) {
+        rtEntity.familyId = familyId;
+    }
+    if (expiresOn) {
+        rtEntity.expiresOn = expiresOn.toString();
+    }
+    return rtEntity;
+}
+function isCredentialEntity(entity) {
+    return (entity.hasOwnProperty("homeAccountId") &&
+        entity.hasOwnProperty("environment") &&
+        entity.hasOwnProperty("credentialType") &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("secret"));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAccessTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity.hasOwnProperty("target") &&
+        (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
+            entity["credentialType"] ===
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isIdTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity["credentialType"] === CredentialType.ID_TOKEN);
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isRefreshTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity["credentialType"] === CredentialType.REFRESH_TOKEN);
+}
+/**
+ * validates if a given cache entry is "Telemetry", parses <key,value>
+ * @param key
+ * @param entity
+ */
+function isServerTelemetryEntity(key, entity) {
+    const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
+    let validateEntity = true;
+    if (entity) {
+        validateEntity =
+            entity.hasOwnProperty("failedRequests") &&
+                entity.hasOwnProperty("errors") &&
+                entity.hasOwnProperty("cacheHits");
+    }
+    return validateKey && validateEntity;
+}
+/**
+ * validates if a given cache entry is "Throttling", parses <key,value>
+ * @param key
+ * @param entity
+ */
+function isThrottlingEntity(key, entity) {
+    let validateKey = false;
+    if (key) {
+        validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
+    }
+    let validateEntity = true;
+    if (entity) {
+        validateEntity = entity.hasOwnProperty("throttleTime");
+    }
+    return validateKey && validateEntity;
+}
+/**
+ * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+ */
+function generateAppMetadataKey({ environment, clientId, }) {
+    const appMetaDataKeyArray = [
+        APP_METADATA,
+        environment,
+        clientId,
+    ];
+    return appMetaDataKeyArray
+        .join(CACHE_KEY_SEPARATOR$1)
+        .toLowerCase();
+}
+/*
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAppMetadataEntity(key, entity) {
+    if (!entity) {
+        return false;
+    }
+    return (key.indexOf(APP_METADATA) === 0 &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("environment"));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAuthorityMetadataEntity(key, entity) {
+    if (!entity) {
+        return false;
+    }
+    return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
+        entity.hasOwnProperty("aliases") &&
+        entity.hasOwnProperty("preferred_cache") &&
+        entity.hasOwnProperty("preferred_network") &&
+        entity.hasOwnProperty("canonical_authority") &&
+        entity.hasOwnProperty("authorization_endpoint") &&
+        entity.hasOwnProperty("token_endpoint") &&
+        entity.hasOwnProperty("issuer") &&
+        entity.hasOwnProperty("aliasesFromNetwork") &&
+        entity.hasOwnProperty("endpointsFromNetwork") &&
+        entity.hasOwnProperty("expiresAt") &&
+        entity.hasOwnProperty("jwks_uri"));
+}
+/**
+ * Reset the exiresAt value
+ */
+function generateAuthorityMetadataExpiresAt() {
+    return (nowSeconds() +
+        AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
+}
+function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
+    authorityMetadata.authorization_endpoint =
+        updatedValues.authorization_endpoint;
+    authorityMetadata.token_endpoint = updatedValues.token_endpoint;
+    authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
+    authorityMetadata.issuer = updatedValues.issuer;
+    authorityMetadata.endpointsFromNetwork = fromNetwork;
+    authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+}
+function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
+    authorityMetadata.aliases = updatedValues.aliases;
+    authorityMetadata.preferred_cache = updatedValues.preferred_cache;
+    authorityMetadata.preferred_network = updatedValues.preferred_network;
+    authorityMetadata.aliasesFromNetwork = fromNetwork;
+}
+/**
+ * Returns whether or not the data needs to be refreshed
+ */
+function isAuthorityMetadataExpired(metadata) {
+    return metadata.expiresAt <= nowSeconds();
+}
+
+/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Time spent sending/waiting for the response of a request to the token endpoint
+ */
+const NetworkClientSendPostRequestAsync = "networkClientSendPostRequestAsync";
+const RefreshTokenClientExecutePostToTokenEndpoint = "refreshTokenClientExecutePostToTokenEndpoint";
+const AuthorizationCodeClientExecutePostToTokenEndpoint = "authorizationCodeClientExecutePostToTokenEndpoint";
+/**
+ * Time spent on the network for refresh token acquisition
  */
 const RefreshTokenClientExecuteTokenRequest = "refreshTokenClientExecuteTokenRequest";
 /**
@@ -3897,7 +4017,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3990,7 +4110,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4070,293 +4190,213 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * This class instance helps track the memory changes facilitating
- * decisions to read from and write to the persistent cache
- */ class TokenCacheContext {
-    constructor(tokenCache, hasChanged) {
-        this.cache = tokenCache;
-        this.hasChanged = hasChanged;
-    }
-    /**
-     * boolean which indicates the changes in cache
-     */
-    get cacheHasChanged() {
-        return this.hasChanged;
-    }
-    /**
-     * function to retrieve the token cache
-     */
-    get tokenCache() {
-        return this.cache;
-    }
-}
-
-/*! @azure/msal-common v16.4.0 2026-03-27 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
+ * MSAL-defined interaction required error code indicating no tokens are found in cache.
+ * @public
  */
+const noTokensFound = "no_tokens_found";
 /**
- * Create IdTokenEntity
- * @param homeAccountId
- * @param authenticationResult
- * @param clientId
- * @param authority
+ * MSAL-defined error code indicating a native account is unavailable on the platform.
+ * @public
  */
-function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
-    const idTokenEntity = {
-        credentialType: CredentialType.ID_TOKEN,
-        homeAccountId: homeAccountId,
-        environment: environment,
-        clientId: clientId,
-        secret: idToken,
-        realm: tenantId,
-        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-    };
-    return idTokenEntity;
-}
+const nativeAccountUnavailable = "native_account_unavailable";
 /**
- * Create AccessTokenEntity
- * @param homeAccountId
- * @param environment
- * @param accessToken
- * @param clientId
- * @param tenantId
- * @param scopes
- * @param expiresOn
- * @param extExpiresOn
+ * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
+ * @public
  */
-function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
-    const atEntity = {
-        homeAccountId: homeAccountId,
-        credentialType: CredentialType.ACCESS_TOKEN,
-        secret: accessToken,
-        cachedAt: nowSeconds().toString(),
-        expiresOn: expiresOn.toString(),
-        extendedExpiresOn: extExpiresOn.toString(),
-        environment: environment,
-        clientId: clientId,
-        realm: tenantId,
-        target: scopes,
-        tokenType: tokenType || AuthenticationScheme.BEARER,
-        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-    };
-    if (userAssertionHash) {
-        atEntity.userAssertionHash = userAssertionHash;
-    }
-    if (refreshOn) {
-        atEntity.refreshOn = refreshOn.toString();
-    }
-    /*
-     * Create Access Token With Auth Scheme instead of regular access token
-     * Cast to lower to handle "bearer" from ADFS
-     */
-    if (atEntity.tokenType?.toLowerCase() !==
-        AuthenticationScheme.BEARER.toLowerCase()) {
-        atEntity.credentialType =
-            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-        switch (atEntity.tokenType) {
-            case AuthenticationScheme.POP:
-                // Make sure keyId is present and add it to credential
-                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
-                if (!tokenClaims?.cnf?.kid) {
-                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
-                }
-                atEntity.keyId = tokenClaims.cnf.kid;
-                break;
-            case AuthenticationScheme.SSH:
-                atEntity.keyId = keyId;
-        }
-    }
-    return atEntity;
-}
+const refreshTokenExpired = "refresh_token_expired";
 /**
- * Create RefreshTokenEntity
- * @param homeAccountId
- * @param authenticationResult
- * @param clientId
- * @param authority
+ * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
+ * @public
  */
-function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
-    const rtEntity = {
-        credentialType: CredentialType.REFRESH_TOKEN,
-        homeAccountId: homeAccountId,
-        environment: environment,
-        clientId: clientId,
-        secret: refreshToken,
-        lastUpdatedAt: Date.now().toString(),
-    };
-    if (userAssertionHash) {
-        rtEntity.userAssertionHash = userAssertionHash;
-    }
-    if (familyId) {
-        rtEntity.familyId = familyId;
-    }
-    if (expiresOn) {
-        rtEntity.expiresOn = expiresOn.toString();
-    }
-    return rtEntity;
-}
-function isCredentialEntity(entity) {
-    return (entity.hasOwnProperty("homeAccountId") &&
-        entity.hasOwnProperty("environment") &&
-        entity.hasOwnProperty("credentialType") &&
-        entity.hasOwnProperty("clientId") &&
-        entity.hasOwnProperty("secret"));
-}
+const uxNotAllowed = "ux_not_allowed";
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Server-originated error code indicating interaction is required to complete the request.
+ * @public
  */
-function isAccessTokenEntity(entity) {
-    if (!entity) {
-        return false;
-    }
-    return (isCredentialEntity(entity) &&
-        entity.hasOwnProperty("realm") &&
-        entity.hasOwnProperty("target") &&
-        (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
-            entity["credentialType"] ===
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
-}
+const interactionRequired = "interaction_required";
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Server-originated error code indicating user consent is required.
+ * @public
  */
-function isIdTokenEntity(entity) {
-    if (!entity) {
-        return false;
-    }
-    return (isCredentialEntity(entity) &&
-        entity.hasOwnProperty("realm") &&
-        entity["credentialType"] === CredentialType.ID_TOKEN);
-}
+const consentRequired = "consent_required";
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Server-originated error code indicating user login is required.
+ * @public
  */
-function isRefreshTokenEntity(entity) {
-    if (!entity) {
-        return false;
-    }
-    return (isCredentialEntity(entity) &&
-        entity["credentialType"] === CredentialType.REFRESH_TOKEN);
-}
+const loginRequired = "login_required";
 /**
- * validates if a given cache entry is "Telemetry", parses <key,value>
- * @param key
- * @param entity
+ * Server-originated error code indicating the token is invalid or corrupted.
+ * @public
  */
-function isServerTelemetryEntity(key, entity) {
-    const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
-    let validateEntity = true;
-    if (entity) {
-        validateEntity =
-            entity.hasOwnProperty("failedRequests") &&
-                entity.hasOwnProperty("errors") &&
-                entity.hasOwnProperty("cacheHits");
+const badToken = "bad_token";
+/**
+ * Server-originated error code indicating the user is in an interrupted state and interaction is required.
+ * @public
+ */
+const interruptedUser = "interrupted_user";
+
+/*! @azure/msal-common v16.5.1 2026-04-21 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
+ */
+const InteractionRequiredServerErrorMessage = [
+    interactionRequired,
+    consentRequired,
+    loginRequired,
+    badToken,
+    uxNotAllowed,
+    interruptedUser,
+];
+const InteractionRequiredAuthSubErrorMessage = [
+    "message_only",
+    "additional_action",
+    "basic_action",
+    "user_password_expired",
+    "consent_required",
+    "bad_token",
+    "ux_not_allowed",
+    "interrupted_user",
+];
+/**
+ * Error thrown when user interaction is required.
+ */
+class InteractionRequiredAuthError extends AuthError {
+    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
+        super(errorCode, errorMessage, subError);
+        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
+        this.timestamp = timestamp || "";
+        this.traceId = traceId || "";
+        this.correlationId = correlationId || "";
+        this.claims = claims || "";
+        this.name = "InteractionRequiredAuthError";
+        this.errorNo = errorNo;
     }
-    return validateKey && validateEntity;
 }
 /**
- * validates if a given cache entry is "Throttling", parses <key,value>
- * @param key
- * @param entity
+ * Helper function used to determine if an error thrown by the server requires interaction to resolve
+ * @param errorCode
+ * @param errorString
+ * @param subError
  */
-function isThrottlingEntity(key, entity) {
-    let validateKey = false;
-    if (key) {
-        validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
-    }
-    let validateEntity = true;
-    if (entity) {
-        validateEntity = entity.hasOwnProperty("throttleTime");
-    }
-    return validateKey && validateEntity;
+function isInteractionRequiredError(errorCode, errorString, subError) {
+    const isInteractionRequiredErrorCode = !!errorCode &&
+        InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
+    const isInteractionRequiredSubError = !!subError &&
+        InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
+    const isInteractionRequiredErrorDesc = !!errorString &&
+        InteractionRequiredServerErrorMessage.some((irErrorCode) => {
+            return errorString.indexOf(irErrorCode) > -1;
+        });
+    return (isInteractionRequiredErrorCode ||
+        isInteractionRequiredErrorDesc ||
+        isInteractionRequiredSubError);
 }
 /**
- * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+ * Creates an InteractionRequiredAuthError
  */
-function generateAppMetadataKey({ environment, clientId, }) {
-    const appMetaDataKeyArray = [
-        APP_METADATA,
-        environment,
-        clientId,
-    ];
-    return appMetaDataKeyArray
-        .join(CACHE_KEY_SEPARATOR$1)
-        .toLowerCase();
-}
+function createInteractionRequiredAuthError(errorCode, errorMessage) {
+    return new InteractionRequiredAuthError(errorCode, errorMessage);
+}
+
+/*! @azure/msal-common v16.5.1 2026-04-21 */
+
 /*
- * Validates an entity: checks for all expected params
- * @param entity
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
  */
-function isAppMetadataEntity(key, entity) {
-    if (!entity) {
-        return false;
-    }
-    return (key.indexOf(APP_METADATA) === 0 &&
-        entity.hasOwnProperty("clientId") &&
-        entity.hasOwnProperty("environment"));
-}
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Error thrown when there is an error with the server code, for example, unavailability.
  */
-function isAuthorityMetadataEntity(key, entity) {
-    if (!entity) {
-        return false;
+class ServerError extends AuthError {
+    constructor(errorCode, errorMessage, subError, errorNo, status) {
+        super(errorCode, errorMessage, subError);
+        this.name = "ServerError";
+        this.errorNo = errorNo;
+        this.status = status;
+        Object.setPrototypeOf(this, ServerError.prototype);
     }
-    return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
-        entity.hasOwnProperty("aliases") &&
-        entity.hasOwnProperty("preferred_cache") &&
-        entity.hasOwnProperty("preferred_network") &&
-        entity.hasOwnProperty("canonical_authority") &&
-        entity.hasOwnProperty("authorization_endpoint") &&
-        entity.hasOwnProperty("token_endpoint") &&
-        entity.hasOwnProperty("issuer") &&
-        entity.hasOwnProperty("aliasesFromNetwork") &&
-        entity.hasOwnProperty("endpointsFromNetwork") &&
-        entity.hasOwnProperty("expiresAt") &&
-        entity.hasOwnProperty("jwks_uri"));
-}
+}
+
+/*! @azure/msal-common v16.5.1 2026-04-21 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
 /**
- * Reset the exiresAt value
+ * Appends user state with random guid, or returns random guid.
+ * @param cryptoObj
+ * @param userState
+ * @param meta
  */
-function generateAuthorityMetadataExpiresAt() {
-    return (nowSeconds() +
-        AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
-}
-function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
-    authorityMetadata.authorization_endpoint =
-        updatedValues.authorization_endpoint;
-    authorityMetadata.token_endpoint = updatedValues.token_endpoint;
-    authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
-    authorityMetadata.issuer = updatedValues.issuer;
-    authorityMetadata.endpointsFromNetwork = fromNetwork;
-    authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+function setRequestState(cryptoObj, userState, meta) {
+    const libraryState = generateLibraryState(cryptoObj, meta);
+    return userState
+        ? `${libraryState}${RESOURCE_DELIM}${userState}`
+        : libraryState;
 }
-function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
-    authorityMetadata.aliases = updatedValues.aliases;
-    authorityMetadata.preferred_cache = updatedValues.preferred_cache;
-    authorityMetadata.preferred_network = updatedValues.preferred_network;
-    authorityMetadata.aliasesFromNetwork = fromNetwork;
+/**
+ * Generates the state value used by the common library.
+ * @param cryptoObj
+ * @param meta
+ */
+function generateLibraryState(cryptoObj, meta) {
+    if (!cryptoObj) {
+        throw createClientAuthError(noCryptoObject);
+    }
+    // Create a state object containing a unique id and the timestamp of the request creation
+    const stateObj = {
+        id: cryptoObj.createNewGuid(),
+    };
+    if (meta) {
+        stateObj.meta = meta;
+    }
+    const stateString = JSON.stringify(stateObj);
+    return cryptoObj.base64Encode(stateString);
 }
 /**
- * Returns whether or not the data needs to be refreshed
+ * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
+ * @param base64Decode
+ * @param state
  */
-function isAuthorityMetadataExpired(metadata) {
-    return metadata.expiresAt <= nowSeconds();
+function parseRequestState(base64Decode, state) {
+    if (!base64Decode) {
+        throw createClientAuthError(noCryptoObject);
+    }
+    if (!state) {
+        throw createClientAuthError(invalidState);
+    }
+    try {
+        // Split the state between library state and user passed state and decode them separately
+        const splitState = state.split(RESOURCE_DELIM);
+        const libraryState = splitState[0];
+        const userState = splitState.length > 1
+            ? splitState.slice(1).join(RESOURCE_DELIM)
+            : "";
+        const libraryStateString = base64Decode(libraryState);
+        const libraryStateObj = JSON.parse(libraryStateString);
+        return {
+            userRequestState: userState || "",
+            libraryState: libraryStateObj,
+        };
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState);
+    }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4512,7 +4552,7 @@ class ResponseHandler {
         if (serverTokenResponse.id_token && !!idTokenClaims) {
             cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
             cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
-            this.logger);
+            this.logger, this.performanceClient);
         }
         // AccessToken
         let cachedAccessToken = null;
@@ -4663,17 +4703,24 @@ class ResponseHandler {
         };
     }
 }
-function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
     logger?.verbose("09jz0t", correlationId);
-    // Check if base account is already cached
-    const accountKeys = cacheStorage.getAccountKeys();
-    const baseAccountKey = accountKeys.find((accountKey) => {
-        return accountKey.startsWith(homeAccountId);
-    });
-    let cachedAccount = null;
-    if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId);
+    /*
+     * Check if base account is already cached. Filter by homeAccountId (identifies
+     * the user's home identity) and environment (identifies the cloud) — the two
+     * tenant-agnostic properties that uniquely locate a base AccountEntity.
+     */
+    const accountEnvironment = environment || authority.getPreferredCache();
+    const matchedAccounts = cacheStorage.getAccountsFilteredBy({ homeAccountId, environment: accountEnvironment }, correlationId);
+    performanceClient?.addFields({ cacheMatchedAccounts: matchedAccounts.length }, correlationId);
+    if (matchedAccounts.length > 1) {
+        /*
+         * Base accounts are expected to be unique for a given homeAccountId in normal cache usage.
+         * If multiple matches exist, ignore the cache hit rather than arbitrarily choosing one.
+         */
+        logger?.warning("0x7ad1", correlationId);
     }
+    const cachedAccount = matchedAccounts.length === 1 ? matchedAccounts[0] : null;
     const baseAccount = cachedAccount ||
         createAccountEntity({
             homeAccountId,
@@ -4697,7 +4744,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4707,7 +4754,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4725,7 +4772,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4746,7 +4793,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4832,7 +4879,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4863,7 +4910,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4977,7 +5024,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4989,7 +5036,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4999,7 +5046,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5009,7 +5056,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5114,7 +5161,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5934,7 +5981,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5968,7 +6015,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6133,11 +6180,6 @@ class AuthorizationCodeClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         let ccsCred = undefined;
         if (request.clientInfo) {
             try {
@@ -6186,6 +6228,7 @@ class AuthorizationCodeClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
     /**
@@ -6229,7 +6272,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6419,11 +6462,6 @@ class RefreshTokenClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
             switch (request.ccsCredential.type) {
@@ -6450,11 +6488,12 @@ class RefreshTokenClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6570,7 +6609,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6585,7 +6624,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6709,14 +6748,10 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.state) {
         addState(parameters, request.state);
     }
-    if (request.claims ||
-        (authOptions.clientCapabilities &&
-            authOptions.clientCapabilities.length > 0)) {
-        addClaims(parameters, request.claims, authOptions.clientCapabilities);
-    }
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
+    addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -6812,7 +6847,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6845,7 +6880,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6855,7 +6890,7 @@ function containsResourceParam(params) {
  */
 const unexpectedError = "unexpected_error";
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7116,7 +7151,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7137,7 +7172,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7145,7 +7180,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v16.4.0 2026-03-27 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7580,7 +7615,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.6.2";
+const version = "5.8.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8136,6 +8171,7 @@ const StandardInteractionClientGetDiscoveredAuthority = "standardInteractionClie
  * Used to acquire a token from Native component when native brokering is enabled.
  */
 const NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
+const NativeInteractionClientAcquireTokenRedirect = "nativeInteractionClientAcquireToken";
 /**
  * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
  */
@@ -8200,7 +8236,12 @@ const UrlEncodeArr = "urlEncodeArr";
 const Encrypt = "encrypt";
 const Decrypt = "decrypt";
 const GenerateEarKey = "generateEarKey";
-const DecryptEarResponse = "decryptEarResponse";
+const DecryptEarResponse = "decryptEarResponse";
+/**
+ * Background telemetry measurement that tracks whether a late bridge response
+ * arrives after the iframe timeout has already fired.
+ */
+const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9008,20 +9049,35 @@ function cancelPendingBridgeResponse(logger, correlationId) {
         activeBridgeMonitor = null;
     }
 }
-async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient) {
+async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient, experimentalConfig) {
     return new Promise((resolve, reject) => {
         logger.verbose("1rf6em", request.correlationId);
         const correlationId = request.correlationId;
         performanceClient.addFields({
             redirectBridgeTimeoutMs: timeoutMs,
+            lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false,
         }, correlationId);
         const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
         const channel = new BroadcastChannel(libraryState.id);
         let responseString = undefined;
+        let timedOut$1 = false;
+        let lateTimeoutId;
+        let lateMeasurement;
         const timeoutId = window.setTimeout(() => {
             // Clear the active monitor
             activeBridgeMonitor = null;
-            channel.close();
+            if (experimentalConfig?.iframeTimeoutTelemetry) {
+                lateMeasurement = performanceClient.startMeasurement(WaitForBridgeLateResponse, correlationId);
+                timedOut$1 = true;
+                lateTimeoutId = window.setTimeout(() => {
+                    lateMeasurement?.end({ success: false });
+                    clearTimeout(lateTimeoutId);
+                    channel.close();
+                }, 60000); // 60s late response timeout to allow for telemetry of late responses
+            }
+            else {
+                channel.close();
+            }
             reject(createBrowserAuthError(timedOut, "redirect_bridge_timeout"));
         }, timeoutMs);
         // Track this monitor so it can be cancelled if needed
@@ -9035,6 +9091,14 @@ async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request,
             const messageVersion = event?.data && typeof event.data.v === "number"
                 ? event.data.v
                 : undefined;
+            if (timedOut$1) {
+                lateMeasurement?.end({
+                    success: responseString ? true : false,
+                });
+                clearTimeout(lateTimeoutId);
+                channel.close();
+                return;
+            }
             performanceClient.addFields({
                 redirectBridgeMessageVersion: messageVersion,
             }, correlationId);
@@ -14154,7 +14218,12 @@ const SsoSilent = "ssoSilent";
 // Initialize client application
 const InitializeClientApplication = "initializeClientApplication";
 // Update cache storage
-const LocalStorageUpdated = "localStorageUpdated";
+const LocalStorageUpdated = "localStorageUpdated";
+/**
+ * SSO capability verification call (msal-browser).
+ * Fire-and-forget SSO verification call made after interactive authentication completes.
+ */
+const SsoCapable = "ssoCapable";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14163,14 +14232,15 @@ const LocalStorageUpdated = "localStorageUpdated";
 const PREFIX = "msal";
 const BROWSER_PREFIX = "browser";
 const CACHE_KEY_SEPARATOR = "|";
-const CREDENTIAL_SCHEMA_VERSION = 2;
-const ACCOUNT_SCHEMA_VERSION = 2;
+const CREDENTIAL_SCHEMA_VERSION = 3;
+const ACCOUNT_SCHEMA_VERSION = 3;
 const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
 const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
 const PLATFORM_AUTH_DOM_SUPPORT = `${PREFIX}.${BROWSER_PREFIX}.platform.auth.dom`;
 const VERSION_CACHE_KEY = `${PREFIX}.version`;
 const ACCOUNT_KEYS = "account.keys";
 const TOKEN_KEYS = "token.keys";
+const SSO_CAPABLE = `${PREFIX}.${BROWSER_PREFIX}.sso.capable`;
 function getAccountKeysCacheKey(schema = ACCOUNT_SCHEMA_VERSION) {
     if (schema < 1) {
         return `${PREFIX}.${ACCOUNT_KEYS}`;
@@ -14948,7 +15018,9 @@ class BrowserCacheManager extends CacheManager {
                 }
                 await this.setUserData(newIdTokenKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
                 this.performanceClient.incrementFields({ migratedITCount: 1 }, correlationId);
-                currentCredentialKeys.idToken.push(newIdTokenKey);
+                if (!currentCredentialKeys.idToken.includes(newIdTokenKey)) {
+                    currentCredentialKeys.idToken.push(newIdTokenKey);
+                }
             }
         }
         this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
@@ -15797,10 +15869,8 @@ class BrowserCacheManager extends CacheManager {
         return `${PREFIX}.${this.clientId}.${key}`;
     }
     /**
-     * Cache Key: msal.<schema_version>-<home_account_id>-<environment>-<credential_type>-<client_id or familyId>-<realm>-<scopes>-<claims hash>-<scheme>
-     * IdToken Example: uid.utid-login.microsoftonline.com-idtoken-app_client_id-contoso.com
-     * AccessToken Example: uid.utid-login.microsoftonline.com-accesstoken-app_client_id-contoso.com-scope1 scope2--pop
-     * RefreshToken Example: uid.utid-login.microsoftonline.com-refreshtoken-1-contoso.com
+     * Generate Credential Key. All changes to the key REQUIRE a schema version update.
+     * Cache Key: msal.<schema_version>|<home_account_id>|<environment>|<credential_type>|<client_id or familyId>|<realm>|<scopes>|<scheme>
      * @param credentialEntity
      * @returns
      */
@@ -16356,7 +16426,6 @@ const userSwitch = "user_switch";
 const USER_INTERACTION_REQUIRED = "USER_INTERACTION_REQUIRED";
 const USER_CANCEL = "USER_CANCEL";
 const NO_NETWORK = "NO_NETWORK";
-const PERSISTENT_ERROR = "PERSISTENT_ERROR";
 const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
 const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
@@ -16380,8 +16449,7 @@ class NativeAuthError extends AuthError {
 function isFatalNativeAuthError(error) {
     if (error.ext &&
         error.ext.status &&
-        (error.ext.status === PERSISTENT_ERROR ||
-            error.ext.status === DISABLED)) {
+        error.ext.status === DISABLED) {
         return true;
     }
     if (error.ext &&
@@ -16507,12 +16575,12 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
     async acquireToken(request, cacheLookupPolicy) {
         this.logger.trace("03qeos", this.correlationId);
         // start the perf measurement
-        const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, request.correlationId);
+        const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
         const reqTimestamp = nowSeconds();
         const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
         try {
             // initialize native request
-            const nativeRequest = await this.initializeNativeRequest(request);
+            const nativeRequest = await this.initializePlatformRequest(request);
             // check if the tokens can be retrieved from internal cache
             try {
                 const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
@@ -16526,6 +16594,10 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             catch (e) {
                 if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
                     this.logger.info("0eitbc", this.correlationId);
+                    nativeATMeasurement.end({
+                        success: false,
+                        brokerErrorCode: "cache_request_failed",
+                    });
                     throw e;
                 }
                 // continue with a native call for any and all errors
@@ -16547,7 +16619,6 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
                     success: false,
                     errorCode: error.errorCode,
                     subErrorCode: error.subError,
-                    isNativeBroker: true,
                 });
                 throw error;
             });
@@ -16556,6 +16627,9 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             if (e instanceof NativeAuthError) {
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
             }
+            nativeATMeasurement.end({
+                success: false,
+            });
             throw e;
         }
     }
@@ -16588,7 +16662,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // fetch the account from browser cache
         const account = this.browserStorage.getBaseAccountInfo({
             nativeAccountId,
-        }, request.correlationId);
+        }, this.correlationId);
         if (!account) {
             throw createClientAuthError(noAccountFound);
         }
@@ -16596,13 +16670,14 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         try {
             const silentRequest = this.createSilentCacheRequest(request, account);
             const result = await this.silentCacheClient.acquireToken(silentRequest);
-            const fullAccount = {
-                ...account,
-                idTokenClaims: result?.idTokenClaims,
-                idToken: result?.idToken,
-            };
+            const idToken = this.browserStorage.getIdToken(account, this.correlationId, this.browserStorage.getTokenKeys(), account.tenantId);
+            const idTokenClaims = extractTokenClaims(idToken?.secret || "", base64Decode);
+            const fullAccount = updateAccountTenantProfileData(account, undefined, // tenantProfile optional
+            idTokenClaims, idToken?.secret);
             return {
                 ...result,
+                idToken: idToken?.secret || "",
+                idTokenClaims: idTokenClaims,
                 account: fullAccount,
             };
         }
@@ -16618,7 +16693,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      */
     async acquireTokenRedirect(request, rootMeasurement, options) {
         this.logger.trace("0luikq", this.correlationId);
-        const nativeRequest = await this.initializeNativeRequest(request);
+        const nativeRequest = await this.initializePlatformRequest(request);
         const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
         try {
             await this.platformAuthProvider.sendMessage(nativeRequest);
@@ -16650,7 +16725,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param performanceClient {IPerformanceClient?}
      * @param correlationId {string?} correlation identifier
      */
-    async handleRedirectPromise(performanceClient, correlationId) {
+    async handleRedirectPromise() {
         this.logger.trace("1c5lhw", this.correlationId);
         if (!this.browserStorage.isInteractionInProgress(true)) {
             this.logger.info("0le6uv", this.correlationId);
@@ -16660,9 +16735,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const cachedRequest = this.browserStorage.getCachedNativeRequest();
         if (!cachedRequest) {
             this.logger.verbose("0a6zjb", this.correlationId);
-            if (performanceClient && correlationId) {
-                performanceClient?.addFields({ errorCode: "no_cached_request" }, correlationId);
-            }
+            this.performanceClient?.addFields({ errorCode: "no_cached_request" }, this.correlationId);
             return null;
         }
         const { prompt, ...request } = cachedRequest;
@@ -16677,6 +16750,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
             const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
             serverTelemetryManager.clearNativeBrokerErrorCode();
+            this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
             return authResult;
         }
         catch (e) {
@@ -16717,16 +16791,17 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         }
         // Get the preferred_cache domain for the given authority
         const authority = await getDiscoveredAuthority(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, request.authority);
-        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, undefined, // environment
+        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, authority.getPreferredCache(), // environment
         idTokenClaims.tid, undefined, // auth code payload
-        response.account.id);
+        response.account.id, this.logger, this.performanceClient);
         // Ensure expires_in is in number format
         response.expires_in = Number(response.expires_in);
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
         await this.cacheAccount(baseAccount, isKmsi(idTokenClaims));
-        await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
+        await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.tenantId, reqTimestamp, authority.getPreferredCache() // environment
+        );
         return result;
     }
     /**
@@ -16865,8 +16940,8 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param tenantId
      * @param reqTimestamp
      */
-    cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, responseAccessToken, tenantId, reqTimestamp) {
-        const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || "", request.clientId, idTokenClaims.tid || "");
+    async cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, tenantId, reqTimestamp, environment) {
+        const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, environment, response.id_token || "", request.clientId, idTokenClaims.tid || "");
         // cache accessToken in inmemory storage
         const expiresIn = request.tokenType === AuthenticationScheme.POP
             ? SHR_NONCE_VALIDITY
@@ -16875,9 +16950,13 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
                 : response.expires_in) || 0;
         const tokenExpirationSeconds = reqTimestamp + expiresIn;
         const responseScopes = this.generateScopes(response.scope, request.scope);
-        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+        // save idtoken credential in configured browser storage
+        if (!!cachedIdToken && request.storeInCache?.idToken !== false) {
+            await this.browserStorage.setIdTokenCredential(cachedIdToken, this.correlationId, isKmsi(idTokenClaims));
+        }
+        // save access token credential in memory storage
         const nativeCacheRecord = {
-            idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
         return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), this.apiId, request.storeInCache);
@@ -16945,15 +17024,23 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * Translates developer provided request object into NativeRequest object
      * @param request
      */
-    async initializeNativeRequest(request) {
-        this.logger.trace("04j6wj", this.correlationId);
+    async initializePlatformRequest(request) {
+        this.logger.trace("1xdm2a", this.correlationId);
         const canonicalAuthority = await this.getCanonicalAuthority(request);
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims = request.skipBrokerClaims && !!request.embeddedClientId
+            ? undefined
+            : this.config.auth.clientCapabilities;
         // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
-        const { scopes, ...remainingProperties } = request;
+        const { scopes, claims, ...remainingProperties } = request;
         const scopeSet = new ScopeSet(scopes || []);
         scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
+        const mergedClaims = configClaims && configClaims.length
+            ? addClientCapabilitiesToClaims(claims, configClaims)
+            : claims;
         const validatedRequest = {
             ...remainingProperties,
+            claims: mergedClaims,
             accountId: this.accountId,
             clientId: this.config.auth.clientId,
             authority: canonicalAuthority.urlString,
@@ -17023,12 +17110,12 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         switch (this.apiId) {
             case ApiId.ssoSilent:
             case ApiId.acquireTokenSilent_silentFlow:
-                this.logger.trace("1hiwaz", this.correlationId);
+                this.logger.trace("12n1y2", this.correlationId);
                 return PromptValue.NONE;
         }
         // Prompt not provided, request may proceed and native broker decides if it needs to prompt
         if (!prompt) {
-            this.logger.trace("1qlu04", this.correlationId);
+            this.logger.trace("0uid1p", this.correlationId);
             return undefined;
         }
         // If request is interactive, check if prompt provided is allowed to go directly to native broker
@@ -17036,10 +17123,10 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             case PromptValue.NONE:
             case PromptValue.CONSENT:
             case PromptValue.LOGIN:
-                this.logger.trace("1ynje4", this.correlationId);
+                this.logger.trace("0i0hco", this.correlationId);
                 return prompt;
             default:
-                this.logger.trace("0nkr6q", this.correlationId);
+                this.logger.trace("0w3tpw", this.correlationId);
                 throw createBrowserAuthError(nativePromptNotSupported);
         }
     }
@@ -17075,7 +17162,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         this.performanceClient?.addFields({
             embeddedClientId: child_client_id,
             embeddedRedirectUri: child_redirect_uri,
-        }, request.correlationId);
+        }, this.correlationId);
     }
 }
 
@@ -17162,6 +17249,10 @@ async function getStandardParameters(config, authority, request, logger, perform
     if (request.platformBroker) {
         // signal ests that this is a WAM call
         addNativeBroker(parameters);
+        // instrument JS-platform bridge specific fields
+        performanceClient.addFields({
+            isPlatformAuthorizeRequest: true,
+        }, request.correlationId);
         // pass the req_cnf for POP
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const cryptoOps = new CryptoOps(logger, performanceClient);
@@ -17604,7 +17695,7 @@ const DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS = 2000;
  *
  * @returns Configuration object
  */
-function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system: userInputSystem, telemetry: userInputTelemetry, }, isBrowserEnvironment) {
+function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system: userInputSystem, experimental: userInputExperimental, telemetry: userInputTelemetry, }, isBrowserEnvironment) {
     // Default auth options for browser
     const DEFAULT_AUTH_OPTIONS = {
         clientId: "",
@@ -17631,6 +17722,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         },
         instanceAware: false,
         isMcp: false,
+        verifySSO: false,
     };
     // Default cache options for browser
     const DEFAULT_CACHE_OPTIONS = {
@@ -17676,6 +17768,9 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         },
         client: new StubPerformanceClient(),
     };
+    const DEFAULT_EXPERIMENTAL_OPTIONS = {
+        iframeTimeoutTelemetry: false,
+    };
     // Throw an error if user has set OIDCOptions without being in OIDC protocol mode
     if (userInputSystem?.protocolMode !== ProtocolMode.OIDC &&
         userInputAuth?.OIDCOptions) {
@@ -17699,6 +17794,10 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         },
         cache: { ...DEFAULT_CACHE_OPTIONS, ...userInputCache },
         system: providedSystemOptions,
+        experimental: {
+            ...DEFAULT_EXPERIMENTAL_OPTIONS,
+            ...userInputExperimental,
+        },
         telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...userInputTelemetry },
     };
     return overlayedConfig;
@@ -17718,7 +17817,7 @@ class PlatformAuthExtensionHandler {
         this.messageChannel = new MessageChannel();
         this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
         this.performanceClient = performanceClient;
-        this.handshakeEvent = performanceClient.startMeasurement(NativeMessageHandlerHandshake);
+        this.handshakeEvent = this.performanceClient.startMeasurement(NativeMessageHandlerHandshake);
         this.platformAuthType =
             PlatformAuthConstants.PLATFORM_EXTENSION_PROVIDER;
     }
@@ -18158,7 +18257,7 @@ function isDomEnabledForPlatformAuth() {
     }
 }
 /**
- * Returns boolean indicating whether or not the request should attempt to use native broker
+ * Returns boolean indicating whether or not the request should attempt to use platform broker
  * @param logger
  * @param config
  * @param correlationId
@@ -18440,6 +18539,10 @@ class PopupClient extends StandardInteractionClient {
                     return;
                 }
             }
+            // Redirect bridge requires "state" param to work properly
+            validRequest.state = setRequestState(this.browserCrypto, validRequest.state || "", {
+                interactionType: InteractionType.Popup,
+            });
             // Create logout string and navigate user window to logout.
             const logoutUri = authClient.getLogoutUri(validRequest);
             this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, validRequest.correlationId, InteractionType.Popup, validRequest);
@@ -18980,6 +19083,10 @@ class RedirectClient extends StandardInteractionClient {
                     }
                 }
             }
+            // Redirect bridge requires "state" param to work properly
+            validLogoutRequest.state = setRequestState(this.browserCrypto, validLogoutRequest.state || "", {
+                interactionType: InteractionType.Redirect,
+            });
             // Create logout string and navigate user window to logout.
             const logoutUri = authClient.getLogoutUri(validLogoutRequest);
             if (validLogoutRequest.account?.homeAccountId) {
@@ -19206,7 +19313,7 @@ class SilentIframeClient extends StandardInteractionClient {
         const responseType = this.config.auth.OIDCOptions.responseMode;
         let responseString;
         try {
-            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
         }
         finally {
             invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -19228,6 +19335,38 @@ class SilentIframeClient extends StandardInteractionClient {
             return invokeAsync(handleResponseEAR, HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
     }
+    /**
+     * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+     * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+     * @param request - The SSO silent request
+     * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+     */
+    async verifySso(request) {
+        const inputRequest = { ...request };
+        if (!inputRequest.prompt) {
+            inputRequest.prompt = PromptValue.NONE;
+        }
+        // Create silent request
+        const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
+        const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
+            serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger),
+            requestAuthority: silentRequest.authority,
+            requestAzureCloudOptions: silentRequest.azureCloudOptions,
+            requestExtraQueryParameters: silentRequest.extraQueryParameters,
+            account: silentRequest.account,
+        });
+        const { serverParams } = await this.silentAuthorizeHelper(authClient, silentRequest);
+        const correlationId = silentRequest.correlationId;
+        // Validate the response - this checks for errors and validates state
+        validateAuthorizationResponse(serverParams, silentRequest.state);
+        // Verify a valid authorization code is present
+        if (!serverParams.code) {
+            this.logger.warning("0y34ti", correlationId);
+            return false;
+        }
+        this.logger.verbose("0kkkcj", correlationId);
+        return true;
+    }
     /**
      * Currently Unsupported
      */
@@ -19242,6 +19381,16 @@ class SilentIframeClient extends StandardInteractionClient {
      * @param userRequestScopes
      */
     async silentTokenHelper(authClient, request) {
+        const { serverParams, pkceCodes } = await this.silentAuthorizeHelper(authClient, request);
+        return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, request.correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+    }
+    /**
+     * Shared helper that generates PKCE codes, builds the /authorize URL,
+     * loads it in a hidden iframe, waits for the redirect-bridge response,
+     * and returns the deserialized server parameters along with the PKCE codes
+     * and the request that was sent.
+     */
+    async silentAuthorizeHelper(authClient, request) {
         const correlationId = request.correlationId;
         const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
         const silentRequest = {
@@ -19262,13 +19411,13 @@ class SilentIframeClient extends StandardInteractionClient {
         // Wait for response from the redirect bridge.
         let responseString;
         try {
-            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
         }
         finally {
             invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
         }
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
-        return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        return { serverParams, pkceCodes, silentRequest };
     }
 }
 
@@ -19510,22 +19659,32 @@ class StandardController {
         this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient, this.eventHandler);
         this.activeSilentTokenRequests = new Map();
         // Register listener functions
-        this.trackPageVisibility = this.trackPageVisibility.bind(this);
+        this.trackStateChange = this.trackStateChange.bind(this);
         // Register listener functions
-        this.trackPageVisibilityWithMeasurement =
-            this.trackPageVisibilityWithMeasurement.bind(this);
+        this.trackStateChangeWithMeasurement =
+            this.trackStateChangeWithMeasurement.bind(this);
     }
     static async createController(operatingContext, request) {
         const controller = new StandardController(operatingContext);
         await controller.initialize(request);
         return controller;
     }
-    trackPageVisibility(correlationId) {
+    trackStateChange(correlationId, event) {
         if (!correlationId) {
             return;
         }
-        this.logger.info("16v6hv", correlationId);
-        this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        if (event.type === "visibilitychange") {
+            this.logger.info("16v6hv", correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "online") {
+            this.logger.info("0zirfd", correlationId);
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "offline") {
+            this.logger.info("1xk9ef", correlationId);
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -19625,22 +19784,25 @@ class StandardController {
         }
         const loggedInAccounts = this.getAllAccounts();
         const platformBrokerRequest = this.browserStorage.getCachedNativeRequest();
-        const useNative = platformBrokerRequest &&
-            this.platformAuthProvider &&
-            !options?.hash;
+        const useNative = platformBrokerRequest && !options?.hash;
         let rootMeasurement;
         let redirectResponse;
+        let cachedRedirectRequest;
         try {
             if (useNative && this.platformAuthProvider) {
                 const correlationId = platformBrokerRequest?.correlationId || "";
                 this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, InteractionType.Redirect);
                 rootMeasurement = this.performanceClient.startMeasurement(AcquireTokenRedirect, correlationId);
                 this.logger.trace("12v7is", correlationId);
+                rootMeasurement.add({
+                    isPlatformBrokerRequest: true,
+                });
                 const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.platformAuthProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
-                redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
+                redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)();
             }
             else {
                 const [standardRequest, codeVerifier] = this.browserStorage.getCachedRequest("");
+                cachedRedirectRequest = standardRequest;
                 const correlationId = standardRequest.correlationId;
                 this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, InteractionType.Redirect);
                 // Reset rootMeasurement now that we have correlationId
@@ -19669,6 +19831,8 @@ class StandardController {
                 rootMeasurement.end({
                     success: true,
                 }, undefined, result.account);
+                // Fire-and-forget SSO capability verification in background
+                this.verifySsoCapability(cachedRedirectRequest, InteractionType.Redirect);
             }
             else {
                 /*
@@ -19734,12 +19898,14 @@ class StandardController {
             if (this.platformAuthProvider &&
                 this.canUsePlatformBroker(request)) {
                 const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.platformAuthProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-                result = nativeClient
-                    .acquireTokenRedirect(request, atrMeasurement)
-                    .catch((e) => {
+                result = invokeAsync(nativeClient.acquireTokenRedirect.bind(nativeClient), NativeInteractionClientAcquireTokenRedirect, this.logger, this.performanceClient, correlationId)(request, atrMeasurement).catch((e) => {
+                    atrMeasurement.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    });
                     if (e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)) {
-                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                         const redirectClient = this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
@@ -19805,6 +19971,9 @@ class StandardController {
         let result;
         const pkce = this.getPreGeneratedPkceCodes(correlationId);
         if (this.canUsePlatformBroker(request)) {
+            atPopupMeasurement.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative({
                 ...request,
                 correlationId,
@@ -19817,9 +19986,13 @@ class StandardController {
                 return response;
             })
                 .catch((e) => {
+                atPopupMeasurement.add({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                });
                 if (e instanceof NativeAuthError &&
                     isFatalNativeAuthError(e)) {
-                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                     const popupClient = this.createPopupClient(correlationId);
                     return popupClient.acquireToken(request, pkce);
                 }
@@ -19850,6 +20023,8 @@ class StandardController {
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             }, undefined, result.account);
+            // SSO capability verification in background
+            this.verifySsoCapability(request, InteractionType.Popup);
             return result;
         })
             .catch((e) => {
@@ -19867,15 +20042,137 @@ class StandardController {
             }
         });
     }
-    trackPageVisibilityWithMeasurement() {
+    trackStateChangeWithMeasurement(event) {
         const measurement = this.ssoSilentMeasurement ||
             this.acquireTokenByCodeAsyncMeasurement;
         if (!measurement) {
             return;
         }
-        measurement.increment({
-            visibilityChangeCount: 1,
+        if (event.type === "visibilitychange") {
+            this.logger.info("0yzimq", measurement.event.correlationId);
+            measurement.increment({
+                visibilityChangeCount: 1,
+            });
+        }
+        else if (event.type === "online") {
+            this.logger.info("1caf53", measurement.event.correlationId);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+        else if (event.type === "offline") {
+            this.logger.info("0fdyk7", measurement.event.correlationId);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+    }
+    addStateChangeListeners(listener) {
+        document.addEventListener("visibilitychange", listener);
+        window.addEventListener("online", listener);
+        window.addEventListener("offline", listener);
+    }
+    removeStateChangeListeners(listener) {
+        document.removeEventListener("visibilitychange", listener);
+        window.removeEventListener("online", listener);
+        window.removeEventListener("offline", listener);
+    }
+    /**
+     * Reads the cached ssoCapable value from localStorage.
+     * @returns The cached ssoCapable boolean value, or undefined if not cached or expired.
+     */
+    getCachedSsoCapable() {
+        try {
+            const cachedValue = window.localStorage.getItem(SSO_CAPABLE);
+            if (cachedValue) {
+                const parsed = JSON.parse(cachedValue);
+                if (parsed &&
+                    typeof parsed.ssoCapable === "boolean" &&
+                    parsed.expiresOn &&
+                    Date.now() < parsed.expiresOn) {
+                    return parsed.ssoCapable;
+                }
+            }
+        }
+        catch {
+            // If parsing fails, return undefined
+        }
+        return undefined;
+    }
+    /**
+     * SSO capability verification in the background.
+     * This method makes an iframe request to /authorize to verify SSO capability without calling /token.
+     * This method does not block the caller and tracks telemetry for success/failure.
+     * This method only executes if verifySSO is set to true in the auth configuration.
+     * The result is cached in localStorage with a 24-hour TTL; the SSO verification call
+     * is only attempted when the cached value is absent or expired.
+     * @param request - The original request used for the authentication flow
+     * @param interactionType - The interactionType of the AT operation for logging purposes
+     */
+    verifySsoCapability(request, interactionType) {
+        // Check if SSO capability verification is enabled
+        if (!this.config.auth.verifySSO) {
+            return;
+        }
+        // Check TTL: derive ssoCapable state from localStorage and skip if not expired
+        const ssoCacheKey = SSO_CAPABLE;
+        const SSO_CAPABLE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+        const cachedSsoCapable = this.getCachedSsoCapable();
+        if (cachedSsoCapable !== undefined) {
+            this.logger.verbose("13poou", "");
+            return;
+        }
+        const correlationId = createNewGuid();
+        const ssoCapableMeasurement = this.performanceClient.startMeasurement(SsoCapable, correlationId);
+        ssoCapableMeasurement.add({
+            "ext.interactionType": interactionType,
         });
+        this.logger.verbose("0pbr0i", correlationId);
+        /*
+         * Use setTimeout to ensure this runs in a separate macrotask after the current call stack completes
+         * This ensures the result is returned to the caller before the SSO verification starts and doesn't affect performance
+         */
+        setTimeout(() => {
+            const ssoVerificationRequest = {
+                ...request,
+                correlationId: correlationId,
+            };
+            const silentIframeClient = this.createSilentIframeClient(correlationId);
+            silentIframeClient
+                .verifySso(ssoVerificationRequest)
+                .then((result) => {
+                this.logger.verbose("1gd1iv", correlationId);
+                // TBD to add profileTelemetry later in localStorage with 24h TTL
+                try {
+                    const cacheEntry = JSON.stringify({
+                        ssoCapable: result,
+                        expiresOn: Date.now() + SSO_CAPABLE_TTL_MS,
+                    });
+                    window.localStorage.setItem(ssoCacheKey, cacheEntry);
+                }
+                catch {
+                    this.logger.warning("18lmoj", correlationId);
+                }
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: result,
+                }, undefined);
+            })
+                .catch((error) => {
+                this.logger.warning("05g83w", correlationId);
+                // reset the cache
+                try {
+                    window.localStorage.removeItem(ssoCacheKey);
+                }
+                catch {
+                    this.logger.warning("0nlf9q", correlationId);
+                }
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: false,
+                }, error);
+            });
+        }, 0);
     }
     // #endregion
     // #region Silent Flow
@@ -19898,28 +20195,35 @@ class StandardController {
         const correlationId = this.getRequestCorrelationId(request);
         const validRequest = {
             ...request,
-            // will be PromptValue.NONE or PromptValue.NO_SESSION
-            prompt: request.prompt,
             correlationId: correlationId,
         };
         this.ssoSilentMeasurement = this.performanceClient.startMeasurement(SsoSilent, correlationId);
         this.ssoSilentMeasurement?.add({
             scenarioId: request.scenarioId,
+            ssoCapable: this.getCachedSsoCapable(),
         });
         preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const loggedInAccounts = this.getAllAccounts();
         this.logger.verbose("0w1b45", correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Silent, validRequest);
         let result;
         if (this.canUsePlatformBroker(validRequest)) {
+            this.ssoSilentMeasurement?.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
+                this.ssoSilentMeasurement?.add({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                });
                 // If native token acquisition fails for availability reasons fallback to standard flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
-                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                     const silentIframeClient = this.createSilentIframeClient(validRequest.correlationId);
                     return silentIframeClient.acquireToken(validRequest);
                 }
@@ -19953,7 +20257,7 @@ class StandardController {
             throw e;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
     }
     /**
@@ -19992,7 +20296,6 @@ class StandardController {
                         this.hybridAuthCodeResponses.delete(hybridAuthCode);
                         atbcMeasurement.end({
                             success: true,
-                            isNativeBroker: result.fromPlatformBroker,
                             accessTokenSize: result.accessToken.length,
                             idTokenSize: result.idToken.length,
                         }, undefined, result.account);
@@ -20016,10 +20319,17 @@ class StandardController {
             }
             else if (request.nativeAccountId) {
                 if (this.canUsePlatformBroker(request, request.nativeAccountId)) {
+                    atbcMeasurement.add({
+                        isPlatformBrokerRequest: true,
+                    });
                     const result = await this.acquireTokenNative({
                         ...request,
                         correlationId,
                     }, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
+                        atbcMeasurement.add({
+                            brokerErrorName: e.name,
+                            brokerErrorCode: e.errorCode,
+                        });
                         // If native token acquisition fails for availability reasons fallback to standard flow
                         if (e instanceof NativeAuthError &&
                             isFatalNativeAuthError(e)) {
@@ -20060,8 +20370,9 @@ class StandardController {
             this.performanceClient.startMeasurement(AcquireTokenByCodeAsync, correlationId);
         this.acquireTokenByCodeAsyncMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const silentAuthCodeClient = this.createSilentAuthCodeClient(correlationId);
         const silentTokenResult = await silentAuthCodeClient
             .acquireToken(request)
@@ -20069,7 +20380,6 @@ class StandardController {
             this.acquireTokenByCodeAsyncMeasurement?.end({
                 success: true,
                 fromCache: response.fromCache,
-                isNativeBroker: response.fromPlatformBroker,
             });
             return response;
         })
@@ -20080,7 +20390,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
         return silentTokenResult;
     }
@@ -20218,9 +20528,25 @@ class StandardController {
         const accountEntity = createAccountEntityFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
         await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims), ApiId.hydrateCache);
         if (result.fromPlatformBroker) {
-            this.logger.verbose("1fxyu8", result.correlationId);
-            // Tokens from native broker are stored in-memory
-            return this.nativeInternalStorage.hydrateCache(result, request);
+            this.logger.verbose("1i5atf", result.correlationId);
+            // Create idToken entity and store in browser storage
+            const idTokenEntity = createIdTokenEntity(result.account.homeAccountId, result.account.environment, result.idToken, this.config.auth.clientId, result.tenantId);
+            // Create accessToken entity and store in native internal storage
+            const accessTokenEntity = createAccessTokenEntity(result.account.homeAccountId, result.account.environment, result.accessToken, this.config.auth.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn
+                ? toSecondsFromDate(result.expiresOn)
+                : 0, result.extExpiresOn
+                ? toSecondsFromDate(result.extExpiresOn)
+                : 0, base64Decode, undefined, // refreshOn
+            result.tokenType, undefined, // userAssertionHash
+            request.sshKid);
+            if (request.resource) {
+                accessTokenEntity.resource = request.resource;
+            }
+            const kmsi = isKmsi(result.idTokenClaims);
+            // Store idToken in browser storage
+            await this.browserStorage.setIdTokenCredential(idTokenEntity, result.correlationId, kmsi);
+            // Store accessToken in native internal storage
+            await this.nativeInternalStorage.setAccessTokenCredential(accessTokenEntity, result.correlationId, kmsi);
         }
         else {
             return this.browserStorage.hydrateCache(result, request);
@@ -20238,7 +20564,7 @@ class StandardController {
             throw createBrowserAuthError(nativeConnectionNotEstablished);
         }
         const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.platformAuthProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-        return nativeClient.acquireToken(request, cacheLookupPolicy);
+        return invokeAsync(nativeClient.acquireToken.bind(nativeClient), NativeInteractionClientAcquireToken, this.logger, this.performanceClient, correlationId)(request, cacheLookupPolicy);
     }
     /**
      * Returns boolean indicating if this request can use the platform broker
@@ -20252,7 +20578,7 @@ class StandardController {
             return false;
         }
         if (!isPlatformAuthAllowed(this.config, this.logger, correlationId, this.platformAuthProvider, request.authenticationScheme)) {
-            this.logger.trace("1m4bzf", correlationId);
+            this.logger.trace("0yoy1g", correlationId);
             return false;
         }
         if (request.prompt) {
@@ -20284,7 +20610,9 @@ class StandardController {
                 loginHint: request.loginHint,
                 sid: request.sid,
             }) ||
-            this.getActiveAccount();
+            (!request.loginHint && !request.sid
+                ? this.getActiveAccount()
+                : null);
         return (account && account.nativeAccountId) || "";
     }
     /**
@@ -20471,6 +20799,7 @@ class StandardController {
         atsMeasurement.add({
             cacheLookupPolicy: request.cacheLookupPolicy,
             scenarioId: request.scenarioId,
+            ssoCapable: this.getCachedSsoCapable(),
         });
         preflightCheck(this.initialized, atsMeasurement, this.config, request);
         this.logger.verbose("0x1c4s", correlationId);
@@ -20483,7 +20812,6 @@ class StandardController {
             atsMeasurement.end({
                 success: true,
                 fromCache: result.fromCache,
-                isNativeBroker: result.fromPlatformBroker,
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             }, undefined, result.account);
@@ -20542,12 +20870,12 @@ class StandardController {
      * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
      */
     async acquireTokenSilentAsync(request, account) {
-        const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+        const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, request.correlationId, InteractionType.Silent, request);
         if (request.correlationId) {
-            this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
         }
-        document.addEventListener("visibilitychange", trackPageVisibility);
+        this.addStateChangeListeners(trackStateChange);
         const silentRequest = await invokeAsync(initializeSilentRequest, InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
         const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
         const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
@@ -20629,7 +20957,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", trackPageVisibility);
+            this.removeStateChangeListeners(trackStateChange);
         });
     }
     /**
@@ -20643,7 +20971,12 @@ class StandardController {
         if (isPlatformAuthAllowed(this.config, this.logger, silentRequest.correlationId, this.platformAuthProvider, silentRequest.authenticationScheme) &&
             silentRequest.account.nativeAccountId) {
             this.logger.verbose("0sczo4", silentRequest.correlationId);
+            this.performanceClient.addFields({ isPlatformBrokerRequest: true }, silentRequest.correlationId);
             return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
+                this.performanceClient.addFields({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                }, silentRequest.correlationId);
                 // If native token acquisition fails for availability reasons fallback to web flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.logger.verbose("07rkmb", silentRequest.correlationId);