@azure/msal-browser 4.5.0 → 4.7.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.5.0 2025-02-26 */
+/*! @azure/msal-browser v4.7.0 2025-03-11 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -306,7 +306,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -323,7 +323,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -372,7 +372,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -470,7 +470,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -722,7 +722,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -761,7 +761,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -952,12 +952,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.2.0";
+const version$1 = "15.2.1";
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -977,7 +977,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1038,7 +1038,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1053,6 +1053,24 @@ function nowSeconds() {
     // Date.getTime() returns in milliseconds.
     return Math.round(new Date().getTime() / 1000.0);
 }
+/**
+ * Converts JS Date object to seconds
+ * @param date Date
+ */
+function toSecondsFromDate(date) {
+    // Convert date to seconds
+    return date.getTime() / 1000;
+}
+/**
+ * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
+ * @param seconds
+ */
+function toDateFromSeconds(seconds) {
+    if (seconds) {
+        return new Date(Number(seconds) * 1000);
+    }
+    return new Date();
+}
 /**
  * check if a token is expired based on given UTC time in seconds.
  * @param expiresOn
@@ -1075,7 +1093,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1402,7 +1420,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1456,7 +1474,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1594,7 +1612,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1691,7 +1709,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1882,7 +1900,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1922,7 +1940,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2001,7 +2019,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2016,7 +2034,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2038,7 +2056,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2051,7 +2069,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2294,7 +2312,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2341,7 +2359,7 @@ function getDeserializedResponse(responseString) {
     return null;
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2505,7 +2523,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2645,7 +2663,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2653,7 +2671,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
 const cacheUnknownErrorCode = "cache_error_unknown";
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2680,7 +2698,7 @@ class CacheError extends Error {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3865,7 +3883,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3964,7 +3982,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3974,7 +3992,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4024,7 +4042,7 @@ const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
 const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4091,7 +4109,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4499,7 +4517,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4511,7 +4529,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4521,7 +4539,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4531,7 +4549,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5040,7 +5058,7 @@ const IntFields = new Set([
     "encryptedCacheExpiredCount",
 ]);
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5136,7 +5154,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5245,7 +5263,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6084,7 +6102,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6115,7 +6133,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6134,7 +6152,28 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function getRequestThumbprint(clientId, request, homeAccountId) {
+    return {
+        clientId: clientId,
+        authority: request.authority,
+        scopes: request.scopes,
+        homeAccountIdentifier: homeAccountId,
+        claims: request.claims,
+        authenticationScheme: request.authenticationScheme,
+        resourceRequestMethod: request.resourceRequestMethod,
+        resourceRequestUri: request.resourceRequestUri,
+        shrClaims: request.shrClaims,
+        sshKid: request.sshKid,
+        embeddedClientId: request.embeddedClientId || request.tokenBodyParameters?.clientId,
+    };
+}
+
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6215,24 +6254,13 @@ class ThrottlingUtils {
             ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
     }
     static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
-        const thumbprint = {
-            clientId: clientId,
-            authority: request.authority,
-            scopes: request.scopes,
-            homeAccountIdentifier: homeAccountIdentifier,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-        };
+        const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
         const key = this.generateThrottlingStorageKey(thumbprint);
         cacheManager.removeItem(key);
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6262,7 +6290,7 @@ function createNetworkError(error, httpStatus, responseHeaders) {
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6412,7 +6440,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6438,7 +6466,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6526,7 +6554,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6598,7 +6626,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6682,7 +6710,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6709,7 +6737,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7001,10 +7029,11 @@ class ResponseHandler {
                 accessToken = cacheRecord.accessToken.secret;
             }
             responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
-            expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
-            extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+            // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
+            expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
+            extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
             if (cacheRecord.accessToken.refreshOn) {
-                refreshOn = new Date(Number(cacheRecord.accessToken.refreshOn) * 1000);
+                refreshOn = toDateFromSeconds(cacheRecord.accessToken.refreshOn);
             }
         }
         if (cacheRecord.appMetadata) {
@@ -7086,7 +7115,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7104,7 +7133,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7210,18 +7239,7 @@ class AuthorizationCodeClient extends BaseClient {
             }
         }
         const headers = this.createTokenRequestHeaders(ccsCredential || request.ccsCredential);
-        const thumbprint = {
-            clientId: request.tokenBodyParameters?.clientId ||
-                this.config.authOptions.clientId,
-            authority: authority.canonicalAuthority,
-            scopes: request.scopes,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-        };
+        const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
         return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint);
     }
     /**
@@ -7554,7 +7572,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7674,18 +7692,7 @@ class RefreshTokenClient extends BaseClient {
         const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
         const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
         const headers = this.createTokenRequestHeaders(request.ccsCredential);
-        const thumbprint = {
-            clientId: request.tokenBodyParameters?.clientId ||
-                this.config.authOptions.clientId,
-            authority: authority.canonicalAuthority,
-            scopes: request.scopes,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-        };
+        const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
         return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint);
     }
     /**
@@ -7777,7 +7784,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7875,7 +7882,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7890,7 +7897,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7948,7 +7955,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8211,7 +8218,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8219,7 +8226,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8244,7 +8251,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8284,7 +8291,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8363,7 +8370,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.2.0 2025-02-26 */
+/*! @azure/msal-common v15.2.1 2025-03-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10400,7 +10407,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.5.0";
+const version = "4.7.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12679,7 +12686,13 @@ class BrowserCacheManager extends CacheManager {
          *
          * The next MSAL VFuture should map these both to same value if possible
          */
-        const accessTokenEntity = createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn ? result.expiresOn.getTime() / 1000 : 0, result.extExpiresOn ? result.extExpiresOn.getTime() / 1000 : 0, base64Decode, undefined, // refreshOn
+        const accessTokenEntity = createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), 
+        // Access token expiresOn stored in seconds, converting from AuthenticationResult expiresOn stored as Date
+        result.expiresOn
+            ? toSecondsFromDate(result.expiresOn)
+            : 0, result.extExpiresOn
+            ? toSecondsFromDate(result.extExpiresOn)
+            : 0, base64Decode, undefined, // refreshOn
         result.tokenType, undefined, // userAssertionHash
         request.sshKid, request.claims, claimsHash);
         const cacheRecord = {
@@ -12885,7 +12898,9 @@ class EventHandler {
     constructor(logger) {
         this.eventCallbacks = new Map();
         this.logger = logger || new Logger({});
-        this.broadcastChannel = new BroadcastChannel(BROADCAST_CHANNEL_NAME);
+        if (typeof BroadcastChannel !== "undefined") {
+            this.broadcastChannel = new BroadcastChannel(BROADCAST_CHANNEL_NAME);
+        }
         this.invokeCrossTabCallbacks = this.invokeCrossTabCallbacks.bind(this);
     }
     /**
@@ -12935,7 +12950,7 @@ class EventHandler {
             case EventType.ACCOUNT_REMOVED:
             case EventType.ACTIVE_ACCOUNT_CHANGED:
                 // Send event to other open tabs / MSAL instances on same domain
-                this.broadcastChannel.postMessage(message);
+                this.broadcastChannel?.postMessage(message);
                 break;
             default:
                 // Emit event to callbacks registered in this instance
@@ -12968,13 +12983,13 @@ class EventHandler {
      * Listen for events broadcasted from other tabs/instances
      */
     subscribeCrossTab() {
-        this.broadcastChannel.addEventListener("message", this.invokeCrossTabCallbacks);
+        this.broadcastChannel?.addEventListener("message", this.invokeCrossTabCallbacks);
     }
     /**
      * Unsubscribe from broadcast events
      */
     unsubscribeCrossTab() {
-        this.broadcastChannel.removeEventListener("message", this.invokeCrossTabCallbacks);
+        this.broadcastChannel?.removeEventListener("message", this.invokeCrossTabCallbacks);
     }
 }
 
@@ -13588,7 +13603,7 @@ class NativeInteractionClient extends BaseInteractionClient {
      * Acquire token from native platform via browser extension
      * @param request
      */
-    async acquireToken(request) {
+    async acquireToken(request, cacheLookupPolicy) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
         this.logger.trace("NativeInteractionClient - acquireToken called.");
         // start the perf measurement
@@ -13609,6 +13624,10 @@ class NativeInteractionClient extends BaseInteractionClient {
                 return result;
             }
             catch (e) {
+                if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
+                    this.logger.info("MSAL internal Cache does not contain tokens, return error as per cache policy");
+                    throw e;
+                }
                 // continue with a native call for any and all errors
                 this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
             }
@@ -13934,7 +13953,8 @@ class NativeInteractionClient extends BaseInteractionClient {
             idTokenClaims: idTokenClaims,
             accessToken: responseAccessToken,
             fromCache: mats ? this.isResponseFromCache(mats) : false,
-            expiresOn: new Date(Number(reqTimestamp + response.expires_in) * 1000),
+            // Request timestamp and NativeResponse expires_in are in seconds, converting to Date for AuthenticationResult
+            expiresOn: toDateFromSeconds(reqTimestamp + response.expires_in),
             tokenType: tokenType,
             correlationId: this.correlationId,
             state: response.state,
@@ -15935,11 +15955,10 @@ class TokenCache {
         const scopes = response.scope
             ? ScopeSet.fromString(response.scope)
             : new ScopeSet(request.scopes);
-        const expiresOn = options.expiresOn ||
-            response.expires_in + new Date().getTime() / 1000;
+        const expiresOn = options.expiresOn || response.expires_in + nowSeconds();
         const extendedExpiresOn = options.extendedExpiresOn ||
             (response.ext_expires_in || response.expires_in) +
-                new Date().getTime() / 1000;
+                nowSeconds();
         const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
         await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
         return accessTokenEntity;
@@ -15979,8 +15998,9 @@ class TokenCache {
         if (cacheRecord?.accessToken) {
             accessToken = cacheRecord.accessToken.secret;
             responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
-            expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
-            extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+            // Access token expiresOn stored in seconds, converting to Date for AuthenticationResult
+            expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
+            extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
         }
         const accountEntity = cacheRecord.account;
         return {
@@ -16955,13 +16975,13 @@ class StandardController {
      * Acquire a token from native device (e.g. WAM)
      * @param request
      */
-    async acquireTokenNative(request, apiId, accountId) {
+    async acquireTokenNative(request, apiId, accountId, cacheLookupPolicy) {
         this.logger.trace("acquireTokenNative called");
         if (!this.nativeExtensionProvider) {
             throw createBrowserAuthError(nativeConnectionNotEstablished);
         }
         const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.nativeExtensionProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
-        return nativeClient.acquireToken(request);
+        return nativeClient.acquireToken(request, cacheLookupPolicy);
     }
     /**
      * Returns boolean indicating if this request can use the platform broker
@@ -17227,60 +17247,63 @@ class StandardController {
             throw createBrowserAuthError(noAccountError);
         }
         atsMeasurement.add({ accountType: getAccountType(account) });
-        const thumbprint = {
-            clientId: this.config.auth.clientId,
-            authority: request.authority || Constants.EMPTY_STRING,
-            scopes: request.scopes,
-            homeAccountIdentifier: account.homeAccountId,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-            shrOptions: request.shrOptions,
-        };
+        return this.acquireTokenSilentDeduped(request, account, correlationId)
+            .then((result) => {
+            atsMeasurement.end({
+                success: true,
+                fromCache: result.fromCache,
+                isNativeBroker: result.fromNativeBroker,
+                accessTokenSize: result.accessToken.length,
+                idTokenSize: result.idToken.length,
+            });
+            return {
+                ...result,
+                state: request.state,
+                correlationId: correlationId, // Ensures PWB scenarios can correctly match request to response
+            };
+        })
+            .catch((error) => {
+            if (error instanceof AuthError) {
+                // Ensures PWB scenarios can correctly match request to response
+                error.setCorrelationId(correlationId);
+            }
+            atsMeasurement.end({
+                success: false,
+            }, error);
+            throw error;
+        });
+    }
+    /**
+     * Checks if identical request is already in flight and returns reference to the existing promise or fires off a new one if this is the first
+     * @param request
+     * @param account
+     * @param correlationId
+     * @returns
+     */
+    async acquireTokenSilentDeduped(request, account, correlationId) {
+        const thumbprint = getRequestThumbprint(this.config.auth.clientId, {
+            ...request,
+            authority: request.authority || this.config.auth.authority,
+            correlationId: correlationId,
+        }, account.homeAccountId);
         const silentRequestKey = JSON.stringify(thumbprint);
-        const cachedResponse = this.activeSilentTokenRequests.get(silentRequestKey);
-        if (typeof cachedResponse === "undefined") {
+        const inProgressRequest = this.activeSilentTokenRequests.get(silentRequestKey);
+        if (typeof inProgressRequest === "undefined") {
             this.logger.verbose("acquireTokenSilent called for the first time, storing active request", correlationId);
-            const response = invokeAsync(this.acquireTokenSilentAsync.bind(this), PerformanceEvents.AcquireTokenSilentAsync, this.logger, this.performanceClient, correlationId)({
+            this.performanceClient.addFields({ deduped: false }, correlationId);
+            const activeRequest = invokeAsync(this.acquireTokenSilentAsync.bind(this), PerformanceEvents.AcquireTokenSilentAsync, this.logger, this.performanceClient, correlationId)({
                 ...request,
                 correlationId,
-            }, account)
-                .then((result) => {
+            }, account);
+            this.activeSilentTokenRequests.set(silentRequestKey, activeRequest);
+            return activeRequest.finally(() => {
                 this.activeSilentTokenRequests.delete(silentRequestKey);
-                atsMeasurement.end({
-                    success: true,
-                    fromCache: result.fromCache,
-                    isNativeBroker: result.fromNativeBroker,
-                    cacheLookupPolicy: request.cacheLookupPolicy,
-                    accessTokenSize: result.accessToken.length,
-                    idTokenSize: result.idToken.length,
-                });
-                return result;
-            })
-                .catch((error) => {
-                this.activeSilentTokenRequests.delete(silentRequestKey);
-                atsMeasurement.end({
-                    success: false,
-                }, error);
-                throw error;
             });
-            this.activeSilentTokenRequests.set(silentRequestKey, response);
-            return {
-                ...(await response),
-                state: request.state,
-            };
         }
         else {
             this.logger.verbose("acquireTokenSilent has been called previously, returning the result from the first call", correlationId);
-            // Discard measurements for memoized calls, as they are usually only a couple of ms and will artificially deflate metrics
-            atsMeasurement.discard();
-            return {
-                ...(await cachedResponse),
-                state: request.state,
-            };
+            this.performanceClient.addFields({ deduped: true }, correlationId);
+            return inProgressRequest;
         }
     }
     /**
@@ -17384,10 +17407,11 @@ class StandardController {
      * @returns
      */
     async acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy) {
+        // if the cache policy is set to access_token only, we should not be hitting the native layer yet
         if (NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider, silentRequest.authenticationScheme) &&
             silentRequest.account.nativeAccountId) {
             this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
-            return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(async (e) => {
+            return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
                 // If native token acquisition fails for availability reasons fallback to web flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow");
@@ -17400,6 +17424,10 @@ class StandardController {
         }
         else {
             this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow");
+            // add logs to identify embedded cache retrieval
+            if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
+                this.logger.verbose("acquireTokenSilent - cache lookup policy set to AccessToken, attempting to acquire token from local cache");
+            }
             return invokeAsync(this.acquireTokenFromCache.bind(this), PerformanceEvents.AcquireTokenFromCache, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy).catch((cacheError) => {
                 if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
                     throw cacheError;
@@ -17506,7 +17534,8 @@ class NestedAppAuthAdapter {
         if (!response.token.id_token || !response.token.access_token) {
             throw createClientAuthError(nullOrEmptyToken);
         }
-        const expiresOn = new Date((reqTimestamp + (response.token.expires_in || 0)) * 1000);
+        // Request timestamp and AuthResult expires_in are in seconds, converting to Date for AuthenticationResult
+        const expiresOn = toDateFromSeconds(reqTimestamp + (response.token.expires_in || 0));
         const idTokenClaims = extractTokenClaims(response.token.id_token, this.crypto.base64Decode);
         const account = this.fromNaaAccountInfo(response.account, response.token.id_token, idTokenClaims);
         const scopes = response.token.scope || request.scope;
@@ -17635,10 +17664,10 @@ class NestedAppAuthAdapter {
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken.secret,
             fromCache: true,
-            expiresOn: new Date(Number(accessToken.expiresOn) * 1000),
+            expiresOn: toDateFromSeconds(accessToken.expiresOn),
+            extExpiresOn: toDateFromSeconds(accessToken.extendedExpiresOn),
             tokenType: request.authenticationScheme || AuthenticationScheme.BEARER,
             correlationId,
-            extExpiresOn: new Date(Number(accessToken.extendedExpiresOn) * 1000),
             state: request.state,
         };
         return authenticationResult;