• passkey-sample/package-lock.json: Language not supported

passkey-sample/src/utils/tokenUtils.js:1

• getAccessToken documents/uses a { token, decodedToken, error } return shape, but in the MFA-expired branch it returns acquireTokenRedirect(...) (MSAL returns Promise<void> for redirect). Callers that do result.error will crash when this path is hit. Fix by keeping the return type consistent (e.g., trigger redirect and then return { token:null, decodedToken:null, error:'Redirecting...' }, or throw a sentinel error that callers handle), rather than returning the redirect promise.
  passkey-sample/src/services/PasskeyService.js:1
• This assumes creationOptions.excludeCredentials is always present and an array. WebAuthn creation options may omit excludeCredentials, which would throw here. Fix by defaulting to an empty array and only mapping when it’s an array; also consider avoiding mutation of the creationOptions argument (create a new array and use it in publicKey).
  passkey-sample/src/services/GraphApiClient.js:1
• Accept-Encoding is a forbidden request header in browsers and cannot be set reliably; it should be removed. Also, setting Content-Type: application/json on GET/DELETE requests (with no body) can trigger unnecessary CORS preflights; consider only setting Content-Type when a request body is present.
  passkey-sample/vite.config.js:1
• The comment says WebSocket-based HMR is disabled in favor of polling, but the config still explicitly uses wss HMR (which is WebSocket-based). Either update the comment to reflect what’s actually configured, or change the configuration to a polling-based alternative (e.g., enabling server.watch.usePolling and/or disabling HMR when hasSSL).
  passkey-sample/src/utils/passkeyUtils.js:1
• The JSDoc claims “exponential backoff”, but the implementation is linear (baseDelay * attempt). Either update the docs to say linear backoff, or change the delay calculation to exponential (e.g., baseDelay * 2^(attempt-1)) to match the comment.
  passkey-sample/src/styles/App.css:1
• There are duplicated selectors for .iconText, .navbarStyle, and .navbarButton, with conflicting declarations (e.g., .navbarStyle padding with and without !important). This makes style behavior harder to reason about. Consolidate each selector to a single definition and remove redundant/conflicting declarations.
  passkey-sample/src/services/PasskeyService.js:1
• fetchUserPasskey returns a collection of passkeys, but the name is singular. Rename to fetchUserPasskeys (or similar) to match the return value and avoid confusion at call sites.