@azure/msal-browser 4.5.0 → 4.7.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v4.5.0 2025-02-26 */
+/*! @azure/msal-browser v4.7.0 2025-03-11 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -310,7 +310,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -327,7 +327,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -376,7 +376,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -474,7 +474,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -726,7 +726,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -765,7 +765,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -956,12 +956,12 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "15.2.0";
+    const version$1 = "15.2.1";
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -981,7 +981,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1042,7 +1042,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1057,6 +1057,24 @@
         // Date.getTime() returns in milliseconds.
         return Math.round(new Date().getTime() / 1000.0);
     }
+    /**
+     * Converts JS Date object to seconds
+     * @param date Date
+     */
+    function toSecondsFromDate(date) {
+        // Convert date to seconds
+        return date.getTime() / 1000;
+    }
+    /**
+     * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
+     * @param seconds
+     */
+    function toDateFromSeconds(seconds) {
+        if (seconds) {
+            return new Date(Number(seconds) * 1000);
+        }
+        return new Date();
+    }
     /**
      * check if a token is expired based on given UTC time in seconds.
      * @param expiresOn
@@ -1079,7 +1097,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1406,7 +1424,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1460,7 +1478,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1598,7 +1616,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1695,7 +1713,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1886,7 +1904,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1926,7 +1944,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2005,7 +2023,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2020,7 +2038,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2042,7 +2060,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2055,7 +2073,7 @@
         OIDC: "OIDC",
     };
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2298,7 +2316,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2345,7 +2363,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2509,7 +2527,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2649,7 +2667,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2657,7 +2675,7 @@
     const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
     const cacheUnknownErrorCode = "cache_error_unknown";
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2684,7 +2702,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3869,7 +3887,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3968,7 +3986,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3978,7 +3996,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4028,7 +4046,7 @@
     const BROKER_CLIENT_ID = "brk_client_id";
     const BROKER_REDIRECT_URI = "brk_redirect_uri";
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4095,7 +4113,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4503,7 +4521,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4515,7 +4533,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4525,7 +4543,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4535,7 +4553,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5044,7 +5062,7 @@
         "encryptedCacheExpiredCount",
     ]);
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5140,7 +5158,7 @@
         };
     };
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5249,7 +5267,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6088,7 +6106,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6119,7 +6137,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6138,7 +6156,28 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function getRequestThumbprint(clientId, request, homeAccountId) {
+        return {
+            clientId: clientId,
+            authority: request.authority,
+            scopes: request.scopes,
+            homeAccountIdentifier: homeAccountId,
+            claims: request.claims,
+            authenticationScheme: request.authenticationScheme,
+            resourceRequestMethod: request.resourceRequestMethod,
+            resourceRequestUri: request.resourceRequestUri,
+            shrClaims: request.shrClaims,
+            sshKid: request.sshKid,
+            embeddedClientId: request.embeddedClientId || request.tokenBodyParameters?.clientId,
+        };
+    }
+
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6219,24 +6258,13 @@
                 ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
         }
         static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
-            const thumbprint = {
-                clientId: clientId,
-                authority: request.authority,
-                scopes: request.scopes,
-                homeAccountIdentifier: homeAccountIdentifier,
-                claims: request.claims,
-                authenticationScheme: request.authenticationScheme,
-                resourceRequestMethod: request.resourceRequestMethod,
-                resourceRequestUri: request.resourceRequestUri,
-                shrClaims: request.shrClaims,
-                sshKid: request.sshKid,
-            };
+            const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
             const key = this.generateThrottlingStorageKey(thumbprint);
             cacheManager.removeItem(key);
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6266,7 +6294,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6416,7 +6444,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6442,7 +6470,7 @@
         refreshTokenExpired: refreshTokenExpired
     });
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6530,7 +6558,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6602,7 +6630,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6686,7 +6714,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6713,7 +6741,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7005,10 +7033,11 @@
                     accessToken = cacheRecord.accessToken.secret;
                 }
                 responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
-                expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
-                extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+                // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
+                expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
+                extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
                 if (cacheRecord.accessToken.refreshOn) {
-                    refreshOn = new Date(Number(cacheRecord.accessToken.refreshOn) * 1000);
+                    refreshOn = toDateFromSeconds(cacheRecord.accessToken.refreshOn);
                 }
             }
             if (cacheRecord.appMetadata) {
@@ -7090,7 +7119,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7108,7 +7137,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7214,18 +7243,7 @@
                 }
             }
             const headers = this.createTokenRequestHeaders(ccsCredential || request.ccsCredential);
-            const thumbprint = {
-                clientId: request.tokenBodyParameters?.clientId ||
-                    this.config.authOptions.clientId,
-                authority: authority.canonicalAuthority,
-                scopes: request.scopes,
-                claims: request.claims,
-                authenticationScheme: request.authenticationScheme,
-                resourceRequestMethod: request.resourceRequestMethod,
-                resourceRequestUri: request.resourceRequestUri,
-                shrClaims: request.shrClaims,
-                sshKid: request.sshKid,
-            };
+            const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
             return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint);
         }
         /**
@@ -7558,7 +7576,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7678,18 +7696,7 @@
             const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
             const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
             const headers = this.createTokenRequestHeaders(request.ccsCredential);
-            const thumbprint = {
-                clientId: request.tokenBodyParameters?.clientId ||
-                    this.config.authOptions.clientId,
-                authority: authority.canonicalAuthority,
-                scopes: request.scopes,
-                claims: request.claims,
-                authenticationScheme: request.authenticationScheme,
-                resourceRequestMethod: request.resourceRequestMethod,
-                resourceRequestUri: request.resourceRequestUri,
-                shrClaims: request.shrClaims,
-                sshKid: request.sshKid,
-            };
+            const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
             return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint);
         }
         /**
@@ -7781,7 +7788,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7879,7 +7886,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7894,7 +7901,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7952,7 +7959,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8215,7 +8222,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8223,7 +8230,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8248,7 +8255,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8288,7 +8295,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8367,7 +8374,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-02-26 */
+    /*! @azure/msal-common v15.2.1 2025-03-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10404,7 +10411,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "4.5.0";
+    const version = "4.7.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12683,7 +12690,13 @@
              *
              * The next MSAL VFuture should map these both to same value if possible
              */
-            const accessTokenEntity = createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn ? result.expiresOn.getTime() / 1000 : 0, result.extExpiresOn ? result.extExpiresOn.getTime() / 1000 : 0, base64Decode, undefined, // refreshOn
+            const accessTokenEntity = createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), 
+            // Access token expiresOn stored in seconds, converting from AuthenticationResult expiresOn stored as Date
+            result.expiresOn
+                ? toSecondsFromDate(result.expiresOn)
+                : 0, result.extExpiresOn
+                ? toSecondsFromDate(result.extExpiresOn)
+                : 0, base64Decode, undefined, // refreshOn
             result.tokenType, undefined, // userAssertionHash
             request.sshKid, request.claims, claimsHash);
             const cacheRecord = {
@@ -12889,7 +12902,9 @@
         constructor(logger) {
             this.eventCallbacks = new Map();
             this.logger = logger || new Logger({});
-            this.broadcastChannel = new BroadcastChannel(BROADCAST_CHANNEL_NAME);
+            if (typeof BroadcastChannel !== "undefined") {
+                this.broadcastChannel = new BroadcastChannel(BROADCAST_CHANNEL_NAME);
+            }
             this.invokeCrossTabCallbacks = this.invokeCrossTabCallbacks.bind(this);
         }
         /**
@@ -12939,7 +12954,7 @@
                 case EventType.ACCOUNT_REMOVED:
                 case EventType.ACTIVE_ACCOUNT_CHANGED:
                     // Send event to other open tabs / MSAL instances on same domain
-                    this.broadcastChannel.postMessage(message);
+                    this.broadcastChannel?.postMessage(message);
                     break;
                 default:
                     // Emit event to callbacks registered in this instance
@@ -12972,13 +12987,13 @@
          * Listen for events broadcasted from other tabs/instances
          */
         subscribeCrossTab() {
-            this.broadcastChannel.addEventListener("message", this.invokeCrossTabCallbacks);
+            this.broadcastChannel?.addEventListener("message", this.invokeCrossTabCallbacks);
         }
         /**
          * Unsubscribe from broadcast events
          */
         unsubscribeCrossTab() {
-            this.broadcastChannel.removeEventListener("message", this.invokeCrossTabCallbacks);
+            this.broadcastChannel?.removeEventListener("message", this.invokeCrossTabCallbacks);
         }
     }
 
@@ -13592,7 +13607,7 @@
          * Acquire token from native platform via browser extension
          * @param request
          */
-        async acquireToken(request) {
+        async acquireToken(request, cacheLookupPolicy) {
             this.performanceClient.addQueueMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
             this.logger.trace("NativeInteractionClient - acquireToken called.");
             // start the perf measurement
@@ -13613,6 +13628,10 @@
                     return result;
                 }
                 catch (e) {
+                    if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
+                        this.logger.info("MSAL internal Cache does not contain tokens, return error as per cache policy");
+                        throw e;
+                    }
                     // continue with a native call for any and all errors
                     this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
                 }
@@ -13938,7 +13957,8 @@
                 idTokenClaims: idTokenClaims,
                 accessToken: responseAccessToken,
                 fromCache: mats ? this.isResponseFromCache(mats) : false,
-                expiresOn: new Date(Number(reqTimestamp + response.expires_in) * 1000),
+                // Request timestamp and NativeResponse expires_in are in seconds, converting to Date for AuthenticationResult
+                expiresOn: toDateFromSeconds(reqTimestamp + response.expires_in),
                 tokenType: tokenType,
                 correlationId: this.correlationId,
                 state: response.state,
@@ -15939,11 +15959,10 @@
             const scopes = response.scope
                 ? ScopeSet.fromString(response.scope)
                 : new ScopeSet(request.scopes);
-            const expiresOn = options.expiresOn ||
-                response.expires_in + new Date().getTime() / 1000;
+            const expiresOn = options.expiresOn || response.expires_in + nowSeconds();
             const extendedExpiresOn = options.extendedExpiresOn ||
                 (response.ext_expires_in || response.expires_in) +
-                    new Date().getTime() / 1000;
+                    nowSeconds();
             const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
             await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
             return accessTokenEntity;
@@ -15983,8 +16002,9 @@
             if (cacheRecord?.accessToken) {
                 accessToken = cacheRecord.accessToken.secret;
                 responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
-                expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
-                extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+                // Access token expiresOn stored in seconds, converting to Date for AuthenticationResult
+                expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
+                extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
             }
             const accountEntity = cacheRecord.account;
             return {
@@ -16959,13 +16979,13 @@
          * Acquire a token from native device (e.g. WAM)
          * @param request
          */
-        async acquireTokenNative(request, apiId, accountId) {
+        async acquireTokenNative(request, apiId, accountId, cacheLookupPolicy) {
             this.logger.trace("acquireTokenNative called");
             if (!this.nativeExtensionProvider) {
                 throw createBrowserAuthError(nativeConnectionNotEstablished);
             }
             const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.nativeExtensionProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
-            return nativeClient.acquireToken(request);
+            return nativeClient.acquireToken(request, cacheLookupPolicy);
         }
         /**
          * Returns boolean indicating if this request can use the platform broker
@@ -17231,60 +17251,63 @@
                 throw createBrowserAuthError(noAccountError);
             }
             atsMeasurement.add({ accountType: getAccountType(account) });
-            const thumbprint = {
-                clientId: this.config.auth.clientId,
-                authority: request.authority || Constants.EMPTY_STRING,
-                scopes: request.scopes,
-                homeAccountIdentifier: account.homeAccountId,
-                claims: request.claims,
-                authenticationScheme: request.authenticationScheme,
-                resourceRequestMethod: request.resourceRequestMethod,
-                resourceRequestUri: request.resourceRequestUri,
-                shrClaims: request.shrClaims,
-                sshKid: request.sshKid,
-                shrOptions: request.shrOptions,
-            };
+            return this.acquireTokenSilentDeduped(request, account, correlationId)
+                .then((result) => {
+                atsMeasurement.end({
+                    success: true,
+                    fromCache: result.fromCache,
+                    isNativeBroker: result.fromNativeBroker,
+                    accessTokenSize: result.accessToken.length,
+                    idTokenSize: result.idToken.length,
+                });
+                return {
+                    ...result,
+                    state: request.state,
+                    correlationId: correlationId, // Ensures PWB scenarios can correctly match request to response
+                };
+            })
+                .catch((error) => {
+                if (error instanceof AuthError) {
+                    // Ensures PWB scenarios can correctly match request to response
+                    error.setCorrelationId(correlationId);
+                }
+                atsMeasurement.end({
+                    success: false,
+                }, error);
+                throw error;
+            });
+        }
+        /**
+         * Checks if identical request is already in flight and returns reference to the existing promise or fires off a new one if this is the first
+         * @param request
+         * @param account
+         * @param correlationId
+         * @returns
+         */
+        async acquireTokenSilentDeduped(request, account, correlationId) {
+            const thumbprint = getRequestThumbprint(this.config.auth.clientId, {
+                ...request,
+                authority: request.authority || this.config.auth.authority,
+                correlationId: correlationId,
+            }, account.homeAccountId);
             const silentRequestKey = JSON.stringify(thumbprint);
-            const cachedResponse = this.activeSilentTokenRequests.get(silentRequestKey);
-            if (typeof cachedResponse === "undefined") {
+            const inProgressRequest = this.activeSilentTokenRequests.get(silentRequestKey);
+            if (typeof inProgressRequest === "undefined") {
                 this.logger.verbose("acquireTokenSilent called for the first time, storing active request", correlationId);
-                const response = invokeAsync(this.acquireTokenSilentAsync.bind(this), PerformanceEvents.AcquireTokenSilentAsync, this.logger, this.performanceClient, correlationId)({
+                this.performanceClient.addFields({ deduped: false }, correlationId);
+                const activeRequest = invokeAsync(this.acquireTokenSilentAsync.bind(this), PerformanceEvents.AcquireTokenSilentAsync, this.logger, this.performanceClient, correlationId)({
                     ...request,
                     correlationId,
-                }, account)
-                    .then((result) => {
+                }, account);
+                this.activeSilentTokenRequests.set(silentRequestKey, activeRequest);
+                return activeRequest.finally(() => {
                     this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.end({
-                        success: true,
-                        fromCache: result.fromCache,
-                        isNativeBroker: result.fromNativeBroker,
-                        cacheLookupPolicy: request.cacheLookupPolicy,
-                        accessTokenSize: result.accessToken.length,
-                        idTokenSize: result.idToken.length,
-                    });
-                    return result;
-                })
-                    .catch((error) => {
-                    this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.end({
-                        success: false,
-                    }, error);
-                    throw error;
                 });
-                this.activeSilentTokenRequests.set(silentRequestKey, response);
-                return {
-                    ...(await response),
-                    state: request.state,
-                };
             }
             else {
                 this.logger.verbose("acquireTokenSilent has been called previously, returning the result from the first call", correlationId);
-                // Discard measurements for memoized calls, as they are usually only a couple of ms and will artificially deflate metrics
-                atsMeasurement.discard();
-                return {
-                    ...(await cachedResponse),
-                    state: request.state,
-                };
+                this.performanceClient.addFields({ deduped: true }, correlationId);
+                return inProgressRequest;
             }
         }
         /**
@@ -17388,10 +17411,11 @@
          * @returns
          */
         async acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy) {
+            // if the cache policy is set to access_token only, we should not be hitting the native layer yet
             if (NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider, silentRequest.authenticationScheme) &&
                 silentRequest.account.nativeAccountId) {
                 this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
-                return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(async (e) => {
+                return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
                     // If native token acquisition fails for availability reasons fallback to web flow
                     if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                         this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow");
@@ -17404,6 +17428,10 @@
             }
             else {
                 this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow");
+                // add logs to identify embedded cache retrieval
+                if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
+                    this.logger.verbose("acquireTokenSilent - cache lookup policy set to AccessToken, attempting to acquire token from local cache");
+                }
                 return invokeAsync(this.acquireTokenFromCache.bind(this), PerformanceEvents.AcquireTokenFromCache, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy).catch((cacheError) => {
                     if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
                         throw cacheError;
@@ -17510,7 +17538,8 @@
             if (!response.token.id_token || !response.token.access_token) {
                 throw createClientAuthError(nullOrEmptyToken);
             }
-            const expiresOn = new Date((reqTimestamp + (response.token.expires_in || 0)) * 1000);
+            // Request timestamp and AuthResult expires_in are in seconds, converting to Date for AuthenticationResult
+            const expiresOn = toDateFromSeconds(reqTimestamp + (response.token.expires_in || 0));
             const idTokenClaims = extractTokenClaims(response.token.id_token, this.crypto.base64Decode);
             const account = this.fromNaaAccountInfo(response.account, response.token.id_token, idTokenClaims);
             const scopes = response.token.scope || request.scope;
@@ -17639,10 +17668,10 @@
                 idTokenClaims: idTokenClaims || {},
                 accessToken: accessToken.secret,
                 fromCache: true,
-                expiresOn: new Date(Number(accessToken.expiresOn) * 1000),
+                expiresOn: toDateFromSeconds(accessToken.expiresOn),
+                extExpiresOn: toDateFromSeconds(accessToken.extendedExpiresOn),
                 tokenType: request.authenticationScheme || AuthenticationScheme.BEARER,
                 correlationId,
-                extExpiresOn: new Date(Number(accessToken.extendedExpiresOn) * 1000),
                 state: request.state,
             };
             return authenticationResult;