npm - @azure/msal-browser - Versions diffs - 5.3.0 → 5.5.0 - Mend

@azure/msal-browser 5.3.0 → 5.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (422) hide show

package/lib/custom-auth-path/msal-custom-auth.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.3.0 2026-02-24 */
+/*! @azure/msal-browser v5.5.0 2026-03-13 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -229,7 +229,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -277,9 +277,10 @@ const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
-const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const RESOURCE = "resource";
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -310,7 +311,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -330,7 +331,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -410,7 +411,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -433,7 +434,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -457,7 +458,7 @@ const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
 const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -492,9 +493,11 @@ const authorizationCodeMissingFromServerResponse = "authorization_code_missing_f
 const bindingKeyNotRemoved = "binding_key_not_removed";
 const endSessionEndpointNotSupported = "end_session_endpoint_not_supported";
 const keyIdMissing = "key_id_missing";
-const methodNotImplemented = "method_not_implemented";
+const methodNotImplemented = "method_not_implemented";
+const resourceParameterRequired = "resource_parameter_required";
+const misplacedResourceParam = "misplaced_resource_parameter";
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -689,7 +692,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1054,9 +1057,14 @@ function addEARParameters(parameters, jwk) {
     // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
     const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+function addResource(parameters, resource) {
+    if (resource) {
+        parameters.set(RESOURCE, resource);
+    }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1165,7 +1173,7 @@ function normalizeUrlForComparison(url) {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1204,7 +1212,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1465,12 +1473,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.1.0";
+const version$1 = "16.3.0";
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1479,7 +1487,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1561,7 +1569,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1641,7 +1649,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1798,7 +1806,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1955,7 +1963,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1963,7 +1971,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2001,7 +2009,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2039,7 +2047,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2054,7 +2062,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2076,7 +2084,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2100,7 +2108,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2275,7 +2283,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3371,7 +3379,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3385,7 +3393,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3440,7 +3448,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3523,6 +3531,7 @@ function buildAuthOptions(authOptions) {
         clientCapabilities: [],
         azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
         instanceAware: false,
+        isMcp: false,
         ...authOptions,
     };
 }
@@ -3534,7 +3543,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3553,7 +3562,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3604,7 +3613,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3672,7 +3681,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3740,7 +3749,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3805,7 +3814,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3876,7 +3885,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3899,8 +3908,7 @@ const invoke = (callback, eventName, logger, telemetryClient, correlationId) =>
         const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
         if (correlationId) {
             // Track number of times this API is called in a single request
-            const eventCount = eventName + "CallCount";
-            telemetryClient.incrementFields({ [eventCount]: 1 }, correlationId);
+            telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
         }
         try {
             const result = callback(...args);
@@ -3944,8 +3952,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
         const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
         if (correlationId) {
             // Track number of times this API is called in a single request
-            const eventCount = eventName + "CallCount";
-            telemetryClient.incrementFields({ [eventCount]: 1 }, correlationId);
+            telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
         }
         return callback(...args)
             .then((response) => {
@@ -3971,7 +3978,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4051,7 +4058,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4078,7 +4085,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4337,7 +4344,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4522,6 +4529,11 @@ class ResponseHandler {
                 : undefined;
             // non AAD scenarios can have empty realm
             cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+            // Set resource (to be used for MCP scenarios)
+            const resource = request.resource || null;
+            if (resource) {
+                cachedAccessToken.resource = resource;
+            }
         }
         // refreshToken
         let cachedRefreshToken = null;
@@ -4673,7 +4685,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4683,7 +4695,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4701,7 +4713,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4722,7 +4734,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4808,7 +4820,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4839,7 +4851,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4953,7 +4965,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4965,7 +4977,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4975,7 +4987,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4985,7 +4997,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5090,7 +5102,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5910,7 +5922,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5944,7 +5956,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6064,6 +6076,7 @@ class AuthorizationCodeClient {
         }
         // Add scope array, parameter builder will add default scopes and dedupe
         addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+        addResource(parameters, request.resource);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
         // Add library metadata
@@ -6204,7 +6217,7 @@ class AuthorizationCodeClient {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6429,7 +6442,7 @@ class RefreshTokenClient {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6485,6 +6498,13 @@ class SilentFlowClient {
             this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
             throw createClientAuthError(tokenRefreshRequired);
         }
+        else if (request.resource) {
+            // cached access token must have a resource that matches the request resource for MCP scenarios
+            if (cachedAccessToken.resource !== request.resource) {
+                this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+                throw createClientAuthError(tokenRefreshRequired);
+            }
+        }
         else if (cachedAccessToken.refreshOn &&
             isTokenExpired(cachedAccessToken.refreshOn, 0)) {
             // must refresh (in the background) due to the refresh_in value
@@ -6538,7 +6558,7 @@ class SilentFlowClient {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6553,7 +6573,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6579,6 +6599,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
         ...(request.extraScopesToConsent || []),
     ];
     addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addResource(parameters, request.resource);
     addRedirectUri(parameters, request.redirectUri);
     addCorrelationId(parameters, correlationId);
     // add response_mode. If not passed in it defaults to query.
@@ -6777,7 +6798,40 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
+ * If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
+ * This is used for MCP flows.
+ * @param isMcp - Flag indicating if application is an MCP app, from configuration
+ * @param request - Auth request
+ */
+function enforceResourceParameter(isMcp, request) {
+    if (!isMcp) {
+        return;
+    }
+    if (request.resource &&
+        (containsResourceParam(request.extraParameters) ||
+            containsResourceParam(request.extraQueryParameters))) {
+        throw createClientAuthError(misplacedResourceParam);
+    }
+    if (!request.resource) {
+        throw createClientAuthError(resourceParameterRequired);
+    }
+}
+function containsResourceParam(params) {
+    if (!params) {
+        return false;
+    }
+    return Object.prototype.hasOwnProperty.call(params, "resource");
+}
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6787,7 +6841,7 @@ function extractLoginHint(account) {
  */
 const unexpectedError = "unexpected_error";
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7048,7 +7102,7 @@ class ServerTelemetryManager {
     }
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7069,7 +7123,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7077,7 +7131,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7512,7 +7566,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.3.0";
+const version = "5.5.0";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8939,9 +8993,13 @@ function cancelPendingBridgeResponse(logger, correlationId) {
         activeBridgeMonitor = null;
     }
 }
-async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request) {
+async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient) {
     return new Promise((resolve, reject) => {
         logger.verbose("1rf6em", request.correlationId);
+        const correlationId = request.correlationId;
+        performanceClient.addFields({
+            redirectBridgeTimeoutMs: timeoutMs,
+        }, correlationId);
         const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
         const channel = new BroadcastChannel(libraryState.id);
         let responseString = undefined;
@@ -8959,6 +9017,12 @@ async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request)
         };
         channel.onmessage = (event) => {
             responseString = event.data.payload;
+            const messageVersion = event?.data && typeof event.data.v === "number"
+                ? event.data.v
+                : undefined;
+            performanceClient.addFields({
+                redirectBridgeMessageVersion: messageVersion,
+            }, correlationId);
             // Clear the active monitor
             activeBridgeMonitor = null;
             clearTimeout(timeoutId);
@@ -9429,6 +9493,7 @@ class StandardInteractionClient extends BaseInteractionClient {
                 authority: discoveredAuthority,
                 clientCapabilities: this.config.auth.clientCapabilities,
                 redirectUri: this.config.auth.redirectUri,
+                isMcp: this.config.auth.isMcp,
             },
             systemOptions: {
                 tokenRenewalOffsetSeconds: this.config.system.tokenRenewalOffsetSeconds,
@@ -9469,6 +9534,10 @@ class StandardInteractionClient extends BaseInteractionClient {
  */
 async function initializeAuthorizationRequest(request, interactionType, config, browserCrypto, browserStorage, logger, performanceClient, correlationId) {
     const redirectUri = getRedirectUri(request.redirectUri, config.auth.redirectUri, logger, correlationId);
+    if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
+        logger.warning("08qbvw", correlationId);
+        performanceClient.addFields({ isRedirectUriCrossOrigin: true }, correlationId);
+    }
     const browserState = {
         interactionType: interactionType,
     };
@@ -15896,6 +15965,9 @@ class BrowserCacheManager extends CacheManager {
             : 0, base64Decode, undefined, // refreshOn
         result.tokenType, undefined, // userAssertionHash
         request.sshKid);
+        if (request.resource) {
+            accessTokenEntity.resource = request.resource;
+        }
         const cacheRecord = {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
@@ -16758,6 +16830,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             correlationId: this.correlationId,
             state: response.state,
             fromPlatformBroker: true,
+            ...(request.resource && { resource: request.resource }),
         };
         return result;
     }
@@ -17486,6 +17559,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
             tenant: "",
         },
         instanceAware: false,
+        isMcp: false,
     };
     // Default cache options for browser
     const DEFAULT_CACHE_OPTIONS = {
@@ -17878,14 +17952,17 @@ class PlatformAuthDOMHandler {
     initializePlatformDOMRequest(request) {
         this.logger.trace("15d6yv", request.correlationId);
         const { accountId, clientId, authority, scope, redirectUri, correlationId, state, storeInCache, embeddedClientId, extraParameters, ...remainingProperties } = request;
-        const validExtraParameters = this.getDOMExtraParams(remainingProperties);
+        const validExtraParameters = this.getDOMExtraParams(remainingProperties, correlationId);
         const platformDOMRequest = {
             accountId: accountId,
             brokerId: this.getExtensionId(),
             authority: authority,
             clientId: clientId,
             correlationId: correlationId || this.correlationId,
-            extraParameters: { ...extraParameters, ...validExtraParameters },
+            extraParameters: {
+                ...extraParameters,
+                ...validExtraParameters,
+            },
             isSecurityTokenService: false,
             redirectUri: redirectUri,
             scope: scope,
@@ -17939,15 +18016,27 @@ class PlatformAuthDOMHandler {
         };
         return nativeResponse;
     }
-    getDOMExtraParams(extraParameters) {
-        const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
-            record[key] = String(value);
-            return record;
-        }, {});
-        const validExtraParams = {
-            ...stringifiedParams,
-        };
-        return validExtraParams;
+    getDOMExtraParams(extraParameters, correlationId) {
+        try {
+            const stringifiedProperties = {};
+            for (const [key, value] of Object.entries(extraParameters)) {
+                if (!value) {
+                    continue;
+                }
+                if (typeof value === "object") {
+                    stringifiedProperties[key] = JSON.stringify(value);
+                }
+                else {
+                    stringifiedProperties[key] = String(value);
+                }
+            }
+            return stringifiedProperties;
+        }
+        catch (e) {
+            this.logger.error("0eu9o3", correlationId);
+            this.logger.errorPii("17rpl5", correlationId);
+            return {};
+        }
     }
 }
@@ -18173,7 +18262,7 @@ class PopupClient extends StandardInteractionClient {
                 const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, correlationId, InteractionType.Popup, { popupWindow }, null);
                 // Wait for the redirect bridge response
-                const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request);
+                const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
                 const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
                 return await invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
             }
@@ -18208,7 +18297,7 @@ class PopupClient extends StandardInteractionClient {
         const form = await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
@@ -18233,7 +18322,7 @@ class PopupClient extends StandardInteractionClient {
         const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
@@ -18286,7 +18375,7 @@ class PopupClient extends StandardInteractionClient {
             // Open the popup window to requestUrl.
             const popupWindow = this.openPopup(logoutUri, popupParams);
             this.eventHandler.emitEvent(EventType.POPUP_OPENED, validRequest.correlationId, InteractionType.Popup, { popupWindow }, null);
-            await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest).catch(() => {
+            await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest, this.performanceClient).catch(() => {
                 // Swallow any errors related to monitoring the window. Server logout is best effort
             });
             if (mainWindowRedirectUri) {
@@ -19034,7 +19123,7 @@ class SilentIframeClient extends StandardInteractionClient {
         };
         await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
         const responseType = this.config.auth.OIDCOptions.responseMode;
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             // If server doesn't support EAR, they may fallback to auth code flow instead
@@ -19083,7 +19172,7 @@ class SilentIframeClient extends StandardInteractionClient {
         }
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
@@ -19236,6 +19325,10 @@ class SilentAuthCodeClient extends StandardInteractionClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+ * @returns Network connection information, or an empty object if not available.
+ */
 function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
     const frameInstances =
     // @ts-ignore
@@ -19255,12 +19348,13 @@ function collectInstanceStats(currentClientId, performanceEvent, logger, correla
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-function preflightCheck(initialized, performanceEvent, account) {
+function preflightCheck(initialized, performanceEvent, config, request) {
     try {
         preflightCheck$1(initialized);
+        enforceResourceParameter(config.auth.isMcp, request);
     }
     catch (e) {
-        performanceEvent.end({ success: false }, e, account);
+        performanceEvent.end({ success: false }, e, request.account);
         throw e;
     }
 }
@@ -19361,6 +19455,7 @@ class StandardController {
         this.eventHandler.emitEvent(EventType.INITIALIZE_START, correlationId);
         // Broker applications are initialized twice, so we avoid double-counting it
         this.logMultipleInstances(initMeasurement, correlationId);
+        initMeasurement.add({ isMcp: this.config.auth.isMcp });
         await invokeAsync(this.browserStorage.initialize.bind(this.browserStorage), InitializeCache, this.logger, this.performanceClient, correlationId)(correlationId);
         if (allowPlatformBroker) {
             try {
@@ -19538,6 +19633,7 @@ class StandardController {
         };
         try {
             redirectPreflightCheck(this.initialized, this.config);
+            enforceResourceParameter(this.config.auth.isMcp, request);
             this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Redirect, request);
             let result;
@@ -19602,7 +19698,7 @@ class StandardController {
         });
         try {
             this.logger.verbose("0ch87b", correlationId);
-            preflightCheck(this.initialized, atPopupMeasurement, request.account);
+            preflightCheck(this.initialized, atPopupMeasurement, this.config, request);
             this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN, request.overrideInteractionInProgress, correlationId);
         }
         catch (e) {
@@ -19716,7 +19812,7 @@ class StandardController {
         this.ssoSilentMeasurement?.add({
             scenarioId: request.scenarioId,
         });
-        preflightCheck(this.initialized, this.ssoSilentMeasurement, request.account);
+        preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
         });
@@ -19780,7 +19876,7 @@ class StandardController {
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.trace("0ch6ga", correlationId);
         const atbcMeasurement = this.performanceClient.startMeasurement(AcquireTokenByCode, correlationId);
-        preflightCheck(this.initialized, atbcMeasurement);
+        preflightCheck(this.initialized, atbcMeasurement, this.config, request);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Silent, request);
         atbcMeasurement.add({ scenarioId: request.scenarioId });
         try {
@@ -20282,7 +20378,7 @@ class StandardController {
             cacheLookupPolicy: request.cacheLookupPolicy,
             scenarioId: request.scenarioId,
         });
-        preflightCheck(this.initialized, atsMeasurement, request.account);
+        preflightCheck(this.initialized, atsMeasurement, this.config, request);
         this.logger.verbose("0x1c4s", correlationId);
         const account = request.account || this.getActiveAccount();
         if (!account) {