plugin-data-source-mssql 2.0.4 → 2.0.6

package/dist/tedious/node_modules/@azure/msal-node/lib/msal-node.cjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node v5.1.1 2026-03-18 */
+/*! @azure/msal-node v5.1.4 2026-04-21 */
 'use strict';
 'use strict';
 
@@ -150,7 +150,7 @@ class Serializer {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -398,7 +398,7 @@ const EncodingTypes = {
     UTF8: "utf-8",
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -451,7 +451,7 @@ const INSTANCE_AWARE = "instance_aware";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -482,7 +482,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage(code));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -502,7 +502,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -582,7 +582,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -605,7 +605,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -659,7 +659,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -747,7 +747,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userCanceled: userCanceled
 });
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -942,7 +942,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1057,18 +1057,29 @@ function addSid(parameters, sid) {
     parameters.set(SID, sid);
 }
 /**
- * add claims
- * @param claims
- */
-function addClaims(parameters, claims, clientCapabilities) {
-    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
-    try {
-        JSON.parse(mergedClaims);
-    }
-    catch (e) {
-        throw createClientConfigurationError(invalidClaims);
+ * Adds claims to request parameters, conditionally excluding clientCapabilities
+ * when skipBrokerClaims is true and a brokered flow is in effect.
+ * @param parameters - The request parameters map
+ * @param claims - The claims string from the request
+ * @param clientCapabilities - The client capabilities from configuration
+ * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+ */
+function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+    // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
+    const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
+        ? undefined
+        : clientCapabilities;
+    if (!StringUtils.isEmptyObj(claims) ||
+        (configClaims && configClaims.length > 0)) {
+        const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
+        try {
+            JSON.parse(mergedClaims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+        parameters.set(CLAIMS, mergedClaims);
     }
-    parameters.set(CLAIMS, mergedClaims);
 }
 /**
  * add correlationId
@@ -1338,7 +1349,7 @@ function addResource(parameters, resource) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -1391,7 +1402,7 @@ function mapToQueryString(parameters) {
     return queryParameterArray.join("&");
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1430,7 +1441,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1691,12 +1702,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.4.0";
+const version$1 = "16.5.1";
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1716,7 +1727,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1757,6 +1768,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             username: preferred_username || upn || "",
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            upn: upn,
         };
     }
     else {
@@ -1784,7 +1796,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     }
     // ID token claims override passed in account info and tenant profile
     if (idTokenClaims) {
-        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
         updatedAccountInfo = {
@@ -1798,7 +1810,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1878,7 +1890,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2035,7 +2047,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2192,7 +2204,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2200,7 +2212,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2238,7 +2250,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2276,7 +2288,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2291,7 +2303,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2313,7 +2325,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2337,7 +2349,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2480,7 +2492,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2617,6 +2629,19 @@ class CacheManager {
             !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
             return false;
         }
+        if (!!tenantProfileFilter.username &&
+            !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
+                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+            return false;
+        }
+        if (!!tenantProfileFilter.loginHint &&
+            !this.matchLoginHintWithTenantProfile(tenantProfile, tenantProfileFilter.loginHint)) {
+            return false;
+        }
+        if (!!tenantProfileFilter.upn &&
+            !(tenantProfile.upn === tenantProfileFilter.upn)) {
+            return false;
+        }
         return true;
     }
     idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -2631,7 +2656,8 @@ class CacheManager {
                 return false;
             }
             if (!!tenantProfileFilter.username &&
-                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {
+                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username) &&
+                !this.matchUsername(idTokenClaims.upn, tenantProfileFilter.username)) {
                 return false;
             }
             if (!!tenantProfileFilter.name &&
@@ -2732,10 +2758,6 @@ class CacheManager {
                 !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                 return;
             }
-            if (!!accountFilter.username &&
-                !this.matchUsername(entity.username, accountFilter.username)) {
-                return;
-            }
             if (!!accountFilter.environment &&
                 !this.matchEnvironment(entity, accountFilter.environment, correlationId)) {
                 return;
@@ -2756,6 +2778,9 @@ class CacheManager {
             const tenantProfileFilter = {
                 localAccountId: accountFilter?.localAccountId,
                 name: accountFilter?.name,
+                username: accountFilter?.username,
+                loginHint: accountFilter?.loginHint,
+                upn: accountFilter?.upn,
             };
             const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                 return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -3006,11 +3031,11 @@ class CacheManager {
                 const numHomeIdTokens = homeIdTokenMap.size;
                 if (numHomeIdTokens < 1) {
                     this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result", correlationId);
-                    return idTokenMap.values().next().value;
+                    return idTokenMap.values().next().value ?? null;
                 }
                 else if (numHomeIdTokens === 1) {
                     this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile", correlationId);
-                    return homeIdTokenMap.values().next().value;
+                    return homeIdTokenMap.values().next().value ?? null;
                 }
                 else {
                     // Multiple ID tokens for home tenant profile, remove all and return null
@@ -3026,7 +3051,7 @@ class CacheManager {
             return null;
         }
         this.commonLogger.info("CacheManager:getIdToken - Returning ID token", correlationId);
-        return idTokenMap.values().next().value;
+        return idTokenMap.values().next().value ?? null;
     }
     /**
      * Gets all idTokens matching the given filter
@@ -3338,6 +3363,17 @@ class CacheManager {
             typeof cachedUsername === "string" &&
             filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
     }
+    /**
+     * helper to match loginhints
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    matchLoginHintWithTenantProfile(tenantProfile, loginHintFilter) {
+        return (tenantProfile.loginHint === loginHintFilter ||
+            tenantProfile.username === loginHintFilter ||
+            tenantProfile.upn === loginHintFilter);
+    }
     /**
      * helper to match assertion
      * @param value
@@ -3430,6 +3466,10 @@ class CacheManager {
         if (tokenClaims.upn === loginHint) {
             return true;
         }
+        // check login hint against list of emails in token claims
+        if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
+            return true;
+        }
         return false;
     }
     /**
@@ -3581,7 +3621,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3595,7 +3635,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3650,7 +3690,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3745,190 +3785,34 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Error thrown when there is an error with the server code, for example, unavailability.
- */
-class ServerError extends AuthError {
-    constructor(errorCode, errorMessage, subError, errorNo, status) {
-        super(errorCode, errorMessage, subError);
-        this.name = "ServerError";
-        this.errorNo = errorNo;
-        this.status = status;
-        Object.setPrototypeOf(this, ServerError.prototype);
-    }
-}
-
-/*! @azure/msal-common v16.4.0 2026-03-18 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * MSAL-defined interaction required error code indicating no tokens are found in cache.
- * @public
- */
-const noTokensFound = "no_tokens_found";
-/**
- * MSAL-defined error code indicating a native account is unavailable on the platform.
- * @public
- */
-const nativeAccountUnavailable = "native_account_unavailable";
-/**
- * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
- * @public
- */
-const refreshTokenExpired = "refresh_token_expired";
-/**
- * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
- * @public
- */
-const uxNotAllowed = "ux_not_allowed";
-/**
- * Server-originated error code indicating interaction is required to complete the request.
- * @public
- */
-const interactionRequired = "interaction_required";
-/**
- * Server-originated error code indicating user consent is required.
- * @public
- */
-const consentRequired = "consent_required";
-/**
- * Server-originated error code indicating user login is required.
- * @public
- */
-const loginRequired = "login_required";
-/**
- * Server-originated error code indicating the token is invalid or corrupted.
- * @public
- */
-const badToken = "bad_token";
-/**
- * Server-originated error code indicating the user is in an interrupted state and interaction is required.
- * @public
- */
-const interruptedUser = "interrupted_user";
-
-var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    badToken: badToken,
-    consentRequired: consentRequired,
-    interactionRequired: interactionRequired,
-    interruptedUser: interruptedUser,
-    loginRequired: loginRequired,
-    nativeAccountUnavailable: nativeAccountUnavailable,
-    noTokensFound: noTokensFound,
-    refreshTokenExpired: refreshTokenExpired,
-    uxNotAllowed: uxNotAllowed
-});
-
-/*! @azure/msal-common v16.4.0 2026-03-18 */
-
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
- */
-const InteractionRequiredServerErrorMessage = [
-    interactionRequired,
-    consentRequired,
-    loginRequired,
-    badToken,
-    uxNotAllowed,
-    interruptedUser,
-];
-const InteractionRequiredAuthSubErrorMessage = [
-    "message_only",
-    "additional_action",
-    "basic_action",
-    "user_password_expired",
-    "consent_required",
-    "bad_token",
-    "ux_not_allowed",
-    "interrupted_user",
-];
-/**
- * Error thrown when user interaction is required.
- */
-class InteractionRequiredAuthError extends AuthError {
-    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
-        super(errorCode, errorMessage, subError);
-        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
-        this.timestamp = timestamp || "";
-        this.traceId = traceId || "";
-        this.correlationId = correlationId || "";
-        this.claims = claims || "";
-        this.name = "InteractionRequiredAuthError";
-        this.errorNo = errorNo;
-    }
-}
-/**
- * Helper function used to determine if an error thrown by the server requires interaction to resolve
- * @param errorCode
- * @param errorString
- * @param subError
- */
-function isInteractionRequiredError(errorCode, errorString, subError) {
-    const isInteractionRequiredErrorCode = !!errorCode &&
-        InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
-    const isInteractionRequiredSubError = !!subError &&
-        InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
-    const isInteractionRequiredErrorDesc = !!errorString &&
-        InteractionRequiredServerErrorMessage.some((irErrorCode) => {
-            return errorString.indexOf(irErrorCode) > -1;
-        });
-    return (isInteractionRequiredErrorCode ||
-        isInteractionRequiredErrorDesc ||
-        isInteractionRequiredSubError);
-}
-/**
- * Creates an InteractionRequiredAuthError
- */
-function createInteractionRequiredAuthError(errorCode, errorMessage) {
-    return new InteractionRequiredAuthError(errorCode, errorMessage);
-}
-
-/*! @azure/msal-common v16.4.0 2026-03-18 */
-/**
- * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
- * @param base64Decode
- * @param state
- */
-function parseRequestState(base64Decode, state) {
-    if (!base64Decode) {
-        throw createClientAuthError(noCryptoObject);
-    }
-    if (!state) {
-        throw createClientAuthError(invalidState);
+ * This class instance helps track the memory changes facilitating
+ * decisions to read from and write to the persistent cache
+ */ class TokenCacheContext {
+    constructor(tokenCache, hasChanged) {
+        this.cache = tokenCache;
+        this.hasChanged = hasChanged;
     }
-    try {
-        // Split the state between library state and user passed state and decode them separately
-        const splitState = state.split(RESOURCE_DELIM);
-        const libraryState = splitState[0];
-        const userState = splitState.length > 1
-            ? splitState.slice(1).join(RESOURCE_DELIM)
-            : "";
-        const libraryStateString = base64Decode(libraryState);
-        const libraryStateObj = JSON.parse(libraryStateString);
-        return {
-            userRequestState: userState || "",
-            libraryState: libraryStateObj,
-        };
+    /**
+     * boolean which indicates the changes in cache
+     */
+    get cacheHasChanged() {
+        return this.hasChanged;
     }
-    catch (e) {
-        throw createClientAuthError(invalidState);
+    /**
+     * function to retrieve the token cache
+     */
+    get tokenCache() {
+        return this.cache;
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3983,34 +3867,293 @@ function delay(t, value) {
     return new Promise((resolve) => setTimeout(() => resolve(value), t));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Time spent sending/waiting for the response of a request to the token endpoint
- */
-const NetworkClientSendPostRequestAsync = "networkClientSendPostRequestAsync";
-const RefreshTokenClientExecutePostToTokenEndpoint = "refreshTokenClientExecutePostToTokenEndpoint";
-const AuthorizationCodeClientExecutePostToTokenEndpoint = "authorizationCodeClientExecutePostToTokenEndpoint";
-/**
- * Time spent on the network for refresh token acquisition
- */
-const RefreshTokenClientExecuteTokenRequest = "refreshTokenClientExecuteTokenRequest";
-/**
- * Time taken for acquiring refresh token , records RT size
- */
-const RefreshTokenClientAcquireToken = "refreshTokenClientAcquireToken";
-/**
- * Time taken for acquiring cached refresh token
+ * Create IdTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
  */
-const RefreshTokenClientAcquireTokenWithCachedRefreshToken = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
+function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
+    const idTokenEntity = {
+        credentialType: CredentialType.ID_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: idToken,
+        realm: tenantId,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+    };
+    return idTokenEntity;
+}
 /**
- * Helper function to create token request body in RefreshTokenClient (msal-common).
+ * Create AccessTokenEntity
+ * @param homeAccountId
+ * @param environment
+ * @param accessToken
+ * @param clientId
+ * @param tenantId
+ * @param scopes
+ * @param expiresOn
+ * @param extExpiresOn
  */
-const RefreshTokenClientCreateTokenRequestBody = "refreshTokenClientCreateTokenRequestBody";
-const SilentFlowClientGenerateResultFromCacheRecord = "silentFlowClientGenerateResultFromCacheRecord";
+function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+    const atEntity = {
+        homeAccountId: homeAccountId,
+        credentialType: CredentialType.ACCESS_TOKEN,
+        secret: accessToken,
+        cachedAt: nowSeconds().toString(),
+        expiresOn: expiresOn.toString(),
+        extendedExpiresOn: extExpiresOn.toString(),
+        environment: environment,
+        clientId: clientId,
+        realm: tenantId,
+        target: scopes,
+        tokenType: tokenType || AuthenticationScheme.BEARER,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+    };
+    if (userAssertionHash) {
+        atEntity.userAssertionHash = userAssertionHash;
+    }
+    if (refreshOn) {
+        atEntity.refreshOn = refreshOn.toString();
+    }
+    /*
+     * Create Access Token With Auth Scheme instead of regular access token
+     * Cast to lower to handle "bearer" from ADFS
+     */
+    if (atEntity.tokenType?.toLowerCase() !==
+        AuthenticationScheme.BEARER.toLowerCase()) {
+        atEntity.credentialType =
+            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+        switch (atEntity.tokenType) {
+            case AuthenticationScheme.POP:
+                // Make sure keyId is present and add it to credential
+                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                if (!tokenClaims?.cnf?.kid) {
+                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                }
+                atEntity.keyId = tokenClaims.cnf.kid;
+                break;
+            case AuthenticationScheme.SSH:
+                atEntity.keyId = keyId;
+        }
+    }
+    return atEntity;
+}
+/**
+ * Create RefreshTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
+ */
+function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
+    const rtEntity = {
+        credentialType: CredentialType.REFRESH_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: refreshToken,
+        lastUpdatedAt: Date.now().toString(),
+    };
+    if (userAssertionHash) {
+        rtEntity.userAssertionHash = userAssertionHash;
+    }
+    if (familyId) {
+        rtEntity.familyId = familyId;
+    }
+    if (expiresOn) {
+        rtEntity.expiresOn = expiresOn.toString();
+    }
+    return rtEntity;
+}
+function isCredentialEntity(entity) {
+    return (entity.hasOwnProperty("homeAccountId") &&
+        entity.hasOwnProperty("environment") &&
+        entity.hasOwnProperty("credentialType") &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("secret"));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAccessTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity.hasOwnProperty("target") &&
+        (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
+            entity["credentialType"] ===
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isIdTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity["credentialType"] === CredentialType.ID_TOKEN);
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isRefreshTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity["credentialType"] === CredentialType.REFRESH_TOKEN);
+}
+/**
+ * validates if a given cache entry is "Telemetry", parses <key,value>
+ * @param key
+ * @param entity
+ */
+function isServerTelemetryEntity(key, entity) {
+    const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
+    let validateEntity = true;
+    if (entity) {
+        validateEntity =
+            entity.hasOwnProperty("failedRequests") &&
+                entity.hasOwnProperty("errors") &&
+                entity.hasOwnProperty("cacheHits");
+    }
+    return validateKey && validateEntity;
+}
+/**
+ * validates if a given cache entry is "Throttling", parses <key,value>
+ * @param key
+ * @param entity
+ */
+function isThrottlingEntity(key, entity) {
+    let validateKey = false;
+    if (key) {
+        validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
+    }
+    let validateEntity = true;
+    if (entity) {
+        validateEntity = entity.hasOwnProperty("throttleTime");
+    }
+    return validateKey && validateEntity;
+}
+/**
+ * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+ */
+function generateAppMetadataKey({ environment, clientId, }) {
+    const appMetaDataKeyArray = [
+        APP_METADATA,
+        environment,
+        clientId,
+    ];
+    return appMetaDataKeyArray
+        .join(CACHE_KEY_SEPARATOR)
+        .toLowerCase();
+}
+/*
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAppMetadataEntity(key, entity) {
+    if (!entity) {
+        return false;
+    }
+    return (key.indexOf(APP_METADATA) === 0 &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("environment"));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAuthorityMetadataEntity(key, entity) {
+    if (!entity) {
+        return false;
+    }
+    return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
+        entity.hasOwnProperty("aliases") &&
+        entity.hasOwnProperty("preferred_cache") &&
+        entity.hasOwnProperty("preferred_network") &&
+        entity.hasOwnProperty("canonical_authority") &&
+        entity.hasOwnProperty("authorization_endpoint") &&
+        entity.hasOwnProperty("token_endpoint") &&
+        entity.hasOwnProperty("issuer") &&
+        entity.hasOwnProperty("aliasesFromNetwork") &&
+        entity.hasOwnProperty("endpointsFromNetwork") &&
+        entity.hasOwnProperty("expiresAt") &&
+        entity.hasOwnProperty("jwks_uri"));
+}
+/**
+ * Reset the exiresAt value
+ */
+function generateAuthorityMetadataExpiresAt() {
+    return (nowSeconds() +
+        AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
+}
+function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
+    authorityMetadata.authorization_endpoint =
+        updatedValues.authorization_endpoint;
+    authorityMetadata.token_endpoint = updatedValues.token_endpoint;
+    authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
+    authorityMetadata.issuer = updatedValues.issuer;
+    authorityMetadata.endpointsFromNetwork = fromNetwork;
+    authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+}
+function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
+    authorityMetadata.aliases = updatedValues.aliases;
+    authorityMetadata.preferred_cache = updatedValues.preferred_cache;
+    authorityMetadata.preferred_network = updatedValues.preferred_network;
+    authorityMetadata.aliasesFromNetwork = fromNetwork;
+}
+/**
+ * Returns whether or not the data needs to be refreshed
+ */
+function isAuthorityMetadataExpired(metadata) {
+    return metadata.expiresAt <= nowSeconds();
+}
+
+/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Time spent sending/waiting for the response of a request to the token endpoint
+ */
+const NetworkClientSendPostRequestAsync = "networkClientSendPostRequestAsync";
+const RefreshTokenClientExecutePostToTokenEndpoint = "refreshTokenClientExecutePostToTokenEndpoint";
+const AuthorizationCodeClientExecutePostToTokenEndpoint = "authorizationCodeClientExecutePostToTokenEndpoint";
+/**
+ * Time spent on the network for refresh token acquisition
+ */
+const RefreshTokenClientExecuteTokenRequest = "refreshTokenClientExecuteTokenRequest";
+/**
+ * Time taken for acquiring refresh token , records RT size
+ */
+const RefreshTokenClientAcquireToken = "refreshTokenClientAcquireToken";
+/**
+ * Time taken for acquiring cached refresh token
+ */
+const RefreshTokenClientAcquireTokenWithCachedRefreshToken = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
+/**
+ * Helper function to create token request body in RefreshTokenClient (msal-common).
+ */
+const RefreshTokenClientCreateTokenRequestBody = "refreshTokenClientCreateTokenRequestBody";
+const SilentFlowClientGenerateResultFromCacheRecord = "silentFlowClientGenerateResultFromCacheRecord";
 /**
  * APIs in Authorization Code Client (msal-common)
  */
@@ -4045,7 +4188,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
  */
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4138,7 +4281,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4218,293 +4361,190 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * This class instance helps track the memory changes facilitating
- * decisions to read from and write to the persistent cache
- */ class TokenCacheContext {
-    constructor(tokenCache, hasChanged) {
-        this.cache = tokenCache;
-        this.hasChanged = hasChanged;
-    }
-    /**
-     * boolean which indicates the changes in cache
-     */
-    get cacheHasChanged() {
-        return this.hasChanged;
-    }
-    /**
-     * function to retrieve the token cache
-     */
-    get tokenCache() {
-        return this.cache;
-    }
-}
-
-/*! @azure/msal-common v16.4.0 2026-03-18 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
+ * MSAL-defined interaction required error code indicating no tokens are found in cache.
+ * @public
  */
+const noTokensFound = "no_tokens_found";
 /**
- * Create IdTokenEntity
- * @param homeAccountId
- * @param authenticationResult
- * @param clientId
- * @param authority
+ * MSAL-defined error code indicating a native account is unavailable on the platform.
+ * @public
  */
-function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
-    const idTokenEntity = {
-        credentialType: CredentialType.ID_TOKEN,
-        homeAccountId: homeAccountId,
-        environment: environment,
-        clientId: clientId,
-        secret: idToken,
-        realm: tenantId,
-        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-    };
-    return idTokenEntity;
-}
+const nativeAccountUnavailable = "native_account_unavailable";
 /**
- * Create AccessTokenEntity
- * @param homeAccountId
- * @param environment
- * @param accessToken
- * @param clientId
- * @param tenantId
- * @param scopes
- * @param expiresOn
- * @param extExpiresOn
+ * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
+ * @public
  */
-function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
-    const atEntity = {
-        homeAccountId: homeAccountId,
-        credentialType: CredentialType.ACCESS_TOKEN,
-        secret: accessToken,
-        cachedAt: nowSeconds().toString(),
-        expiresOn: expiresOn.toString(),
-        extendedExpiresOn: extExpiresOn.toString(),
-        environment: environment,
-        clientId: clientId,
-        realm: tenantId,
-        target: scopes,
-        tokenType: tokenType || AuthenticationScheme.BEARER,
-        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-    };
-    if (userAssertionHash) {
-        atEntity.userAssertionHash = userAssertionHash;
-    }
-    if (refreshOn) {
-        atEntity.refreshOn = refreshOn.toString();
-    }
-    /*
-     * Create Access Token With Auth Scheme instead of regular access token
-     * Cast to lower to handle "bearer" from ADFS
-     */
-    if (atEntity.tokenType?.toLowerCase() !==
-        AuthenticationScheme.BEARER.toLowerCase()) {
-        atEntity.credentialType =
-            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-        switch (atEntity.tokenType) {
-            case AuthenticationScheme.POP:
-                // Make sure keyId is present and add it to credential
-                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
-                if (!tokenClaims?.cnf?.kid) {
-                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
-                }
-                atEntity.keyId = tokenClaims.cnf.kid;
-                break;
-            case AuthenticationScheme.SSH:
-                atEntity.keyId = keyId;
-        }
-    }
-    return atEntity;
-}
+const refreshTokenExpired = "refresh_token_expired";
 /**
- * Create RefreshTokenEntity
- * @param homeAccountId
- * @param authenticationResult
- * @param clientId
- * @param authority
+ * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
+ * @public
  */
-function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
-    const rtEntity = {
-        credentialType: CredentialType.REFRESH_TOKEN,
-        homeAccountId: homeAccountId,
-        environment: environment,
-        clientId: clientId,
-        secret: refreshToken,
-        lastUpdatedAt: Date.now().toString(),
-    };
-    if (userAssertionHash) {
-        rtEntity.userAssertionHash = userAssertionHash;
-    }
-    if (familyId) {
-        rtEntity.familyId = familyId;
-    }
-    if (expiresOn) {
-        rtEntity.expiresOn = expiresOn.toString();
-    }
-    return rtEntity;
-}
-function isCredentialEntity(entity) {
-    return (entity.hasOwnProperty("homeAccountId") &&
-        entity.hasOwnProperty("environment") &&
-        entity.hasOwnProperty("credentialType") &&
-        entity.hasOwnProperty("clientId") &&
-        entity.hasOwnProperty("secret"));
-}
+const uxNotAllowed = "ux_not_allowed";
+/**
+ * Server-originated error code indicating interaction is required to complete the request.
+ * @public
+ */
+const interactionRequired = "interaction_required";
+/**
+ * Server-originated error code indicating user consent is required.
+ * @public
+ */
+const consentRequired = "consent_required";
+/**
+ * Server-originated error code indicating user login is required.
+ * @public
+ */
+const loginRequired = "login_required";
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Server-originated error code indicating the token is invalid or corrupted.
+ * @public
  */
-function isAccessTokenEntity(entity) {
-    if (!entity) {
-        return false;
-    }
-    return (isCredentialEntity(entity) &&
-        entity.hasOwnProperty("realm") &&
-        entity.hasOwnProperty("target") &&
-        (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
-            entity["credentialType"] ===
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
-}
+const badToken = "bad_token";
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Server-originated error code indicating the user is in an interrupted state and interaction is required.
+ * @public
+ */
+const interruptedUser = "interrupted_user";
+
+var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    badToken: badToken,
+    consentRequired: consentRequired,
+    interactionRequired: interactionRequired,
+    interruptedUser: interruptedUser,
+    loginRequired: loginRequired,
+    nativeAccountUnavailable: nativeAccountUnavailable,
+    noTokensFound: noTokensFound,
+    refreshTokenExpired: refreshTokenExpired,
+    uxNotAllowed: uxNotAllowed
+});
+
+/*! @azure/msal-common v16.5.1 2026-04-21 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
  */
-function isIdTokenEntity(entity) {
-    if (!entity) {
-        return false;
-    }
-    return (isCredentialEntity(entity) &&
-        entity.hasOwnProperty("realm") &&
-        entity["credentialType"] === CredentialType.ID_TOKEN);
-}
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
  */
-function isRefreshTokenEntity(entity) {
-    if (!entity) {
-        return false;
-    }
-    return (isCredentialEntity(entity) &&
-        entity["credentialType"] === CredentialType.REFRESH_TOKEN);
-}
+const InteractionRequiredServerErrorMessage = [
+    interactionRequired,
+    consentRequired,
+    loginRequired,
+    badToken,
+    uxNotAllowed,
+    interruptedUser,
+];
+const InteractionRequiredAuthSubErrorMessage = [
+    "message_only",
+    "additional_action",
+    "basic_action",
+    "user_password_expired",
+    "consent_required",
+    "bad_token",
+    "ux_not_allowed",
+    "interrupted_user",
+];
 /**
- * validates if a given cache entry is "Telemetry", parses <key,value>
- * @param key
- * @param entity
+ * Error thrown when user interaction is required.
  */
-function isServerTelemetryEntity(key, entity) {
-    const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
-    let validateEntity = true;
-    if (entity) {
-        validateEntity =
-            entity.hasOwnProperty("failedRequests") &&
-                entity.hasOwnProperty("errors") &&
-                entity.hasOwnProperty("cacheHits");
+class InteractionRequiredAuthError extends AuthError {
+    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
+        super(errorCode, errorMessage, subError);
+        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
+        this.timestamp = timestamp || "";
+        this.traceId = traceId || "";
+        this.correlationId = correlationId || "";
+        this.claims = claims || "";
+        this.name = "InteractionRequiredAuthError";
+        this.errorNo = errorNo;
     }
-    return validateKey && validateEntity;
 }
 /**
- * validates if a given cache entry is "Throttling", parses <key,value>
- * @param key
- * @param entity
+ * Helper function used to determine if an error thrown by the server requires interaction to resolve
+ * @param errorCode
+ * @param errorString
+ * @param subError
  */
-function isThrottlingEntity(key, entity) {
-    let validateKey = false;
-    if (key) {
-        validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
-    }
-    let validateEntity = true;
-    if (entity) {
-        validateEntity = entity.hasOwnProperty("throttleTime");
-    }
-    return validateKey && validateEntity;
+function isInteractionRequiredError(errorCode, errorString, subError) {
+    const isInteractionRequiredErrorCode = !!errorCode &&
+        InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
+    const isInteractionRequiredSubError = !!subError &&
+        InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
+    const isInteractionRequiredErrorDesc = !!errorString &&
+        InteractionRequiredServerErrorMessage.some((irErrorCode) => {
+            return errorString.indexOf(irErrorCode) > -1;
+        });
+    return (isInteractionRequiredErrorCode ||
+        isInteractionRequiredErrorDesc ||
+        isInteractionRequiredSubError);
 }
 /**
- * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+ * Creates an InteractionRequiredAuthError
  */
-function generateAppMetadataKey({ environment, clientId, }) {
-    const appMetaDataKeyArray = [
-        APP_METADATA,
-        environment,
-        clientId,
-    ];
-    return appMetaDataKeyArray
-        .join(CACHE_KEY_SEPARATOR)
-        .toLowerCase();
-}
+function createInteractionRequiredAuthError(errorCode, errorMessage) {
+    return new InteractionRequiredAuthError(errorCode, errorMessage);
+}
+
+/*! @azure/msal-common v16.5.1 2026-04-21 */
+
 /*
- * Validates an entity: checks for all expected params
- * @param entity
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
  */
-function isAppMetadataEntity(key, entity) {
-    if (!entity) {
-        return false;
-    }
-    return (key.indexOf(APP_METADATA) === 0 &&
-        entity.hasOwnProperty("clientId") &&
-        entity.hasOwnProperty("environment"));
-}
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Error thrown when there is an error with the server code, for example, unavailability.
  */
-function isAuthorityMetadataEntity(key, entity) {
-    if (!entity) {
-        return false;
+class ServerError extends AuthError {
+    constructor(errorCode, errorMessage, subError, errorNo, status) {
+        super(errorCode, errorMessage, subError);
+        this.name = "ServerError";
+        this.errorNo = errorNo;
+        this.status = status;
+        Object.setPrototypeOf(this, ServerError.prototype);
     }
-    return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
-        entity.hasOwnProperty("aliases") &&
-        entity.hasOwnProperty("preferred_cache") &&
-        entity.hasOwnProperty("preferred_network") &&
-        entity.hasOwnProperty("canonical_authority") &&
-        entity.hasOwnProperty("authorization_endpoint") &&
-        entity.hasOwnProperty("token_endpoint") &&
-        entity.hasOwnProperty("issuer") &&
-        entity.hasOwnProperty("aliasesFromNetwork") &&
-        entity.hasOwnProperty("endpointsFromNetwork") &&
-        entity.hasOwnProperty("expiresAt") &&
-        entity.hasOwnProperty("jwks_uri"));
-}
-/**
- * Reset the exiresAt value
- */
-function generateAuthorityMetadataExpiresAt() {
-    return (nowSeconds() +
-        AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
-}
-function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
-    authorityMetadata.authorization_endpoint =
-        updatedValues.authorization_endpoint;
-    authorityMetadata.token_endpoint = updatedValues.token_endpoint;
-    authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
-    authorityMetadata.issuer = updatedValues.issuer;
-    authorityMetadata.endpointsFromNetwork = fromNetwork;
-    authorityMetadata.jwks_uri = updatedValues.jwks_uri;
-}
-function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
-    authorityMetadata.aliases = updatedValues.aliases;
-    authorityMetadata.preferred_cache = updatedValues.preferred_cache;
-    authorityMetadata.preferred_network = updatedValues.preferred_network;
-    authorityMetadata.aliasesFromNetwork = fromNetwork;
-}
+}
+
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /**
- * Returns whether or not the data needs to be refreshed
+ * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
+ * @param base64Decode
+ * @param state
  */
-function isAuthorityMetadataExpired(metadata) {
-    return metadata.expiresAt <= nowSeconds();
+function parseRequestState(base64Decode, state) {
+    if (!base64Decode) {
+        throw createClientAuthError(noCryptoObject);
+    }
+    if (!state) {
+        throw createClientAuthError(invalidState);
+    }
+    try {
+        // Split the state between library state and user passed state and decode them separately
+        const splitState = state.split(RESOURCE_DELIM);
+        const libraryState = splitState[0];
+        const userState = splitState.length > 1
+            ? splitState.slice(1).join(RESOURCE_DELIM)
+            : "";
+        const libraryStateString = base64Decode(libraryState);
+        const libraryStateObj = JSON.parse(libraryStateString);
+        return {
+            userRequestState: userState || "",
+            libraryState: libraryStateObj,
+        };
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState);
+    }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4660,7 +4700,7 @@ class ResponseHandler {
         if (serverTokenResponse.id_token && !!idTokenClaims) {
             cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
             cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
-            this.logger);
+            this.logger, this.performanceClient);
         }
         // AccessToken
         let cachedAccessToken = null;
@@ -4811,17 +4851,24 @@ class ResponseHandler {
         };
     }
 }
-function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
     logger?.verbose("setCachedAccount called", correlationId);
-    // Check if base account is already cached
-    const accountKeys = cacheStorage.getAccountKeys();
-    const baseAccountKey = accountKeys.find((accountKey) => {
-        return accountKey.startsWith(homeAccountId);
-    });
-    let cachedAccount = null;
-    if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId);
+    /*
+     * Check if base account is already cached. Filter by homeAccountId (identifies
+     * the user's home identity) and environment (identifies the cloud) — the two
+     * tenant-agnostic properties that uniquely locate a base AccountEntity.
+     */
+    const accountEnvironment = environment || authority.getPreferredCache();
+    const matchedAccounts = cacheStorage.getAccountsFilteredBy({ homeAccountId, environment: accountEnvironment }, correlationId);
+    performanceClient?.addFields({ cacheMatchedAccounts: matchedAccounts.length }, correlationId);
+    if (matchedAccounts.length > 1) {
+        /*
+         * Base accounts are expected to be unique for a given homeAccountId in normal cache usage.
+         * If multiple matches exist, ignore the cache hit rather than arbitrarily choosing one.
+         */
+        logger?.warning("Multiple base accounts matched homeAccountId. Ignoring cached account and creating a new base account.", correlationId);
     }
+    const cachedAccount = matchedAccounts.length === 1 ? matchedAccounts[0] : null;
     const baseAccount = cachedAccount ||
         createAccountEntity({
             homeAccountId,
@@ -4845,7 +4892,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4855,7 +4902,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4873,7 +4920,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4894,7 +4941,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4980,7 +5027,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5011,7 +5058,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5125,7 +5172,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5137,7 +5184,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5147,7 +5194,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5157,7 +5204,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5262,7 +5309,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6085,7 +6132,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6119,7 +6166,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6284,11 +6331,6 @@ class AuthorizationCodeClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         let ccsCred = undefined;
         if (request.clientInfo) {
             try {
@@ -6337,6 +6379,7 @@ class AuthorizationCodeClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
     /**
@@ -6380,7 +6423,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6570,11 +6613,6 @@ class RefreshTokenClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
             switch (request.ccsCredential.type) {
@@ -6601,11 +6639,12 @@ class RefreshTokenClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6721,7 +6760,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6837,14 +6876,10 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.state) {
         addState(parameters, request.state);
     }
-    if (request.claims ||
-        (authOptions.clientCapabilities &&
-            authOptions.clientCapabilities.length > 0)) {
-        addClaims(parameters, request.claims, authOptions.clientCapabilities);
-    }
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
+    addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -6874,7 +6909,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6907,7 +6942,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6924,7 +6959,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v16.4.0 2026-03-18 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9127,7 +9162,7 @@ class ClientAssertion {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-node";
-const version = "5.1.1";
+const version = "5.1.4";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.