@azure/msal-browser 5.3.0 → 5.5.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.3.0 2026-02-24 */
+/*! @azure/msal-browser v5.5.0 2026-03-13 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -234,7 +234,7 @@ const JsonWebTokenTypes$1 = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -282,9 +282,10 @@ const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
-const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const RESOURCE = "resource";
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -315,7 +316,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -335,7 +336,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -415,7 +416,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -438,7 +439,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -492,7 +493,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -533,7 +534,9 @@ const noNetworkConnectivity$1 = "no_network_connectivity";
 const userCanceled = "user_canceled";
 const methodNotImplemented = "method_not_implemented";
 const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
-const platformBrokerError = "platform_broker_error";
+const platformBrokerError = "platform_broker_error";
+const resourceParameterRequired = "resource_parameter_required";
+const misplacedResourceParam = "misplaced_resource_parameter";
 
 var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -554,6 +557,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     keyIdMissing: keyIdMissing,
     maxAgeTranspired: maxAgeTranspired,
     methodNotImplemented: methodNotImplemented,
+    misplacedResourceParam: misplacedResourceParam,
     multipleMatchingAppMetadata: multipleMatchingAppMetadata,
     multipleMatchingTokens: multipleMatchingTokens,
     nestedAppAuthBridgeDisabled: nestedAppAuthBridgeDisabled,
@@ -567,6 +571,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     openIdConfigError: openIdConfigError,
     platformBrokerError: platformBrokerError,
     requestCannotBeMade: requestCannotBeMade,
+    resourceParameterRequired: resourceParameterRequired,
     stateMismatch: stateMismatch,
     stateNotFound: stateNotFound,
     tokenClaimsCnfRequiredForSignedJwt: tokenClaimsCnfRequiredForSignedJwt,
@@ -576,7 +581,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userCanceled: userCanceled
 });
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -771,7 +776,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1136,9 +1141,14 @@ function addEARParameters(parameters, jwk) {
     // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
     const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+function addResource(parameters, resource) {
+    if (resource) {
+        parameters.set(RESOURCE, resource);
+    }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1247,7 +1257,7 @@ function normalizeUrlForComparison(url) {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1286,7 +1296,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1561,12 +1571,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.1.0";
+const version$1 = "16.3.0";
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1586,7 +1596,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1668,7 +1678,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1748,7 +1758,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1905,7 +1915,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2062,7 +2072,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2070,7 +2080,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2108,7 +2118,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2146,7 +2156,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2161,7 +2171,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2183,7 +2193,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2207,7 +2217,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2382,7 +2392,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3479,7 +3489,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3494,6 +3504,12 @@ const PerformanceEventStatus = {
     InProgress: 1,
     Completed: 2,
 };
+/**
+ * Prefix used to mark telemetry field names as dynamic.
+ * Fields with this prefix in addFields/incrementFields calls will be routed
+ * to the PerformanceEvent.ext sub-object.
+ */
+const EXT_FIELD_PREFIX = "ext.";
 const IntFields = new Set([
     "accessTokenSize",
     "durationMs",
@@ -3518,9 +3534,12 @@ const IntFields = new Set([
     "currRefreshCount",
     "expiredCacheRemovedCount",
     "upgradedCacheCount",
+    "networkRtt",
+    "redirectBridgeTimeoutMs",
+    "redirectBridgeMessageVersion",
 ]);
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3575,7 +3594,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3658,6 +3677,7 @@ function buildAuthOptions(authOptions) {
         clientCapabilities: [],
         azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
         instanceAware: false,
+        isMcp: false,
         ...authOptions,
     };
 }
@@ -3669,7 +3689,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3688,7 +3708,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3752,7 +3772,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uxNotAllowed: uxNotAllowed
 });
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3820,7 +3840,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3888,7 +3908,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3953,7 +3973,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4024,7 +4044,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4047,8 +4067,7 @@ const invoke = (callback, eventName, logger, telemetryClient, correlationId) =>
         const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
         if (correlationId) {
             // Track number of times this API is called in a single request
-            const eventCount = eventName + "CallCount";
-            telemetryClient.incrementFields({ [eventCount]: 1 }, correlationId);
+            telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
         }
         try {
             const result = callback(...args);
@@ -4092,8 +4111,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
         const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
         if (correlationId) {
             // Track number of times this API is called in a single request
-            const eventCount = eventName + "CallCount";
-            telemetryClient.incrementFields({ [eventCount]: 1 }, correlationId);
+            telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
         }
         return callback(...args)
             .then((response) => {
@@ -4119,7 +4137,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4199,7 +4217,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4226,7 +4244,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4485,7 +4503,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4670,6 +4688,11 @@ class ResponseHandler {
                 : undefined;
             // non AAD scenarios can have empty realm
             cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+            // Set resource (to be used for MCP scenarios)
+            const resource = request.resource || null;
+            if (resource) {
+                cachedAccessToken.resource = resource;
+            }
         }
         // refreshToken
         let cachedRefreshToken = null;
@@ -4821,7 +4844,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4831,7 +4854,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4849,7 +4872,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4870,7 +4893,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4956,7 +4979,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4987,7 +5010,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5101,7 +5124,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5113,7 +5136,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5123,7 +5146,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5133,7 +5156,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5238,7 +5261,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6058,7 +6081,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6092,7 +6115,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6212,6 +6235,7 @@ class AuthorizationCodeClient {
         }
         // Add scope array, parameter builder will add default scopes and dedupe
         addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+        addResource(parameters, request.resource);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
         // Add library metadata
@@ -6352,7 +6376,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6577,7 +6601,7 @@ class RefreshTokenClient {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6633,6 +6657,13 @@ class SilentFlowClient {
             this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
             throw createClientAuthError(tokenRefreshRequired);
         }
+        else if (request.resource) {
+            // cached access token must have a resource that matches the request resource for MCP scenarios
+            if (cachedAccessToken.resource !== request.resource) {
+                this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+                throw createClientAuthError(tokenRefreshRequired);
+            }
+        }
         else if (cachedAccessToken.refreshOn &&
             isTokenExpired(cachedAccessToken.refreshOn, 0)) {
             // must refresh (in the background) due to the refresh_in value
@@ -6686,7 +6717,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6701,7 +6732,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6727,6 +6758,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
         ...(request.extraScopesToConsent || []),
     ];
     addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addResource(parameters, request.resource);
     addRedirectUri(parameters, request.redirectUri);
     addCorrelationId(parameters, correlationId);
     // add response_mode. If not passed in it defaults to query.
@@ -6925,7 +6957,40 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
+ * If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
+ * This is used for MCP flows.
+ * @param isMcp - Flag indicating if application is an MCP app, from configuration
+ * @param request - Auth request
+ */
+function enforceResourceParameter(isMcp, request) {
+    if (!isMcp) {
+        return;
+    }
+    if (request.resource &&
+        (containsResourceParam(request.extraParameters) ||
+            containsResourceParam(request.extraQueryParameters))) {
+        throw createClientAuthError(misplacedResourceParam);
+    }
+    if (!request.resource) {
+        throw createClientAuthError(resourceParameterRequired);
+    }
+}
+function containsResourceParam(params) {
+    if (!params) {
+        return false;
+    }
+    return Object.prototype.hasOwnProperty.call(params, "resource");
+}
+
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6983,7 +7048,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7000,7 +7065,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7261,7 +7326,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7282,7 +7347,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7290,7 +7355,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7330,7 +7395,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v16.1.0 2026-02-24 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7629,9 +7694,13 @@ class PerformanceClient {
         if (error) {
             addError(error, this.logger, rootEvent);
         }
-        // Add sub-measurement attribute to root event.
+        // Add sub-measurement attribute to root event's ext field.
         if (!isRoot) {
-            rootEvent[event.name + "DurationMs"] = Math.floor(event.durationMs);
+            rootEvent.ext = {
+                ...rootEvent.ext,
+                ...event.ext,
+            };
+            rootEvent.ext[event.name + "DurationMs"] = Math.floor(event.durationMs);
             return { ...rootEvent };
         }
         if (isRoot &&
@@ -7677,10 +7746,32 @@ class PerformanceClient {
     addFields(fields, correlationId) {
         const event = this.eventsByCorrelationId.get(correlationId);
         if (event) {
-            this.eventsByCorrelationId.set(correlationId, {
+            const staticFields = {};
+            const dynamicFields = {};
+            for (const key in fields) {
+                if (key.startsWith(EXT_FIELD_PREFIX)) {
+                    const dynamicKey = key.slice(EXT_FIELD_PREFIX.length);
+                    const value = fields[key];
+                    if (typeof value === "string" ||
+                        typeof value === "number") {
+                        dynamicFields[dynamicKey] = value;
+                    }
+                }
+                else {
+                    staticFields[key] = fields[key];
+                }
+            }
+            const updatedEvent = {
                 ...event,
-                ...fields,
-            });
+                ...staticFields,
+            };
+            if (Object.keys(dynamicFields).length) {
+                updatedEvent.ext = {
+                    ...updatedEvent.ext,
+                    ...dynamicFields,
+                };
+            }
+            this.eventsByCorrelationId.set(correlationId, updatedEvent);
         }
         else {
             this.logger.trace("0thl6s", correlationId);
@@ -7695,13 +7786,32 @@ class PerformanceClient {
         const event = this.eventsByCorrelationId.get(correlationId);
         if (event) {
             for (const counter in fields) {
-                if (!event.hasOwnProperty(counter)) {
-                    event[counter] = 0;
+                if (counter.startsWith(EXT_FIELD_PREFIX)) {
+                    event.ext = event.ext || {};
+                    // Route to ext sub-object
+                    const dynamicKey = counter.slice(EXT_FIELD_PREFIX.length);
+                    const currentValue = event.ext[dynamicKey];
+                    if (currentValue === undefined) {
+                        event.ext[dynamicKey] = 0;
+                    }
+                    else if (isNaN(Number(currentValue))) {
+                        return;
+                    }
+                    event.ext[dynamicKey] =
+                        (Number(event.ext[dynamicKey]) || 0) +
+                            (fields[counter] ?? 0);
                 }
-                else if (isNaN(Number(event[counter]))) {
-                    return;
+                else {
+                    /* eslint-disable custom-msal/no-dynamic-telemetry-fields -- internal dispatching of static fields by name */
+                    if (!event.hasOwnProperty(counter)) {
+                        event[counter] = 0;
+                    }
+                    else if (isNaN(Number(event[counter]))) {
+                        return;
+                    }
+                    event[counter] += fields[counter];
+                    /* eslint-enable custom-msal/no-dynamic-telemetry-fields */
                 }
-                event[counter] += fields[counter];
             }
         }
         else {
@@ -7794,9 +7904,11 @@ class PerformanceClient {
      */
     truncateIntegralFields(event) {
         this.intFields.forEach((key) => {
+            /* eslint-disable custom-msal/no-dynamic-telemetry-fields -- internal truncation of known integer fields */
             if (key in event && typeof event[key] === "number") {
                 event[key] = Math.floor(event[key]);
             }
+            /* eslint-enable custom-msal/no-dynamic-telemetry-fields */
         });
     }
     /**
@@ -8717,9 +8829,13 @@ function cancelPendingBridgeResponse(logger, correlationId) {
         activeBridgeMonitor = null;
     }
 }
-async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request) {
+async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient) {
     return new Promise((resolve, reject) => {
         logger.verbose("1rf6em", request.correlationId);
+        const correlationId = request.correlationId;
+        performanceClient.addFields({
+            redirectBridgeTimeoutMs: timeoutMs,
+        }, correlationId);
         const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
         const channel = new BroadcastChannel(libraryState.id);
         let responseString = undefined;
@@ -8737,6 +8853,12 @@ async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request)
         };
         channel.onmessage = (event) => {
             responseString = event.data.payload;
+            const messageVersion = event?.data && typeof event.data.v === "number"
+                ? event.data.v
+                : undefined;
+            performanceClient.addFields({
+                redirectBridgeMessageVersion: messageVersion,
+            }, correlationId);
             // Clear the active monitor
             activeBridgeMonitor = null;
             clearTimeout(timeoutId);
@@ -10156,7 +10278,7 @@ const EventType = {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.3.0";
+const version = "5.5.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11471,6 +11593,9 @@ class BrowserCacheManager extends CacheManager {
             : 0, base64Decode, undefined, // refreshOn
         result.tokenType, undefined, // userAssertionHash
         request.sshKid);
+        if (request.resource) {
+            accessTokenEntity.resource = request.resource;
+        }
         const cacheRecord = {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
@@ -12023,6 +12148,7 @@ class StandardInteractionClient extends BaseInteractionClient {
                 authority: discoveredAuthority,
                 clientCapabilities: this.config.auth.clientCapabilities,
                 redirectUri: this.config.auth.redirectUri,
+                isMcp: this.config.auth.isMcp,
             },
             systemOptions: {
                 tokenRenewalOffsetSeconds: this.config.system.tokenRenewalOffsetSeconds,
@@ -12063,6 +12189,10 @@ class StandardInteractionClient extends BaseInteractionClient {
  */
 async function initializeAuthorizationRequest(request, interactionType, config, browserCrypto, browserStorage, logger, performanceClient, correlationId) {
     const redirectUri = getRedirectUri(request.redirectUri, config.auth.redirectUri, logger, correlationId);
+    if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
+        logger.warning("08qbvw", correlationId);
+        performanceClient.addFields({ isRedirectUriCrossOrigin: true }, correlationId);
+    }
     const browserState = {
         interactionType: interactionType,
     };
@@ -12740,6 +12870,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             correlationId: this.correlationId,
             state: response.state,
             fromPlatformBroker: true,
+            ...(request.resource && { resource: request.resource }),
         };
         return result;
     }
@@ -13468,6 +13599,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
             tenant: "",
         },
         instanceAware: false,
+        isMcp: false,
     };
     // Default cache options for browser
     const DEFAULT_CACHE_OPTIONS = {
@@ -13860,14 +13992,17 @@ class PlatformAuthDOMHandler {
     initializePlatformDOMRequest(request) {
         this.logger.trace("15d6yv", request.correlationId);
         const { accountId, clientId, authority, scope, redirectUri, correlationId, state, storeInCache, embeddedClientId, extraParameters, ...remainingProperties } = request;
-        const validExtraParameters = this.getDOMExtraParams(remainingProperties);
+        const validExtraParameters = this.getDOMExtraParams(remainingProperties, correlationId);
         const platformDOMRequest = {
             accountId: accountId,
             brokerId: this.getExtensionId(),
             authority: authority,
             clientId: clientId,
             correlationId: correlationId || this.correlationId,
-            extraParameters: { ...extraParameters, ...validExtraParameters },
+            extraParameters: {
+                ...extraParameters,
+                ...validExtraParameters,
+            },
             isSecurityTokenService: false,
             redirectUri: redirectUri,
             scope: scope,
@@ -13921,15 +14056,27 @@ class PlatformAuthDOMHandler {
         };
         return nativeResponse;
     }
-    getDOMExtraParams(extraParameters) {
-        const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
-            record[key] = String(value);
-            return record;
-        }, {});
-        const validExtraParams = {
-            ...stringifiedParams,
-        };
-        return validExtraParams;
+    getDOMExtraParams(extraParameters, correlationId) {
+        try {
+            const stringifiedProperties = {};
+            for (const [key, value] of Object.entries(extraParameters)) {
+                if (!value) {
+                    continue;
+                }
+                if (typeof value === "object") {
+                    stringifiedProperties[key] = JSON.stringify(value);
+                }
+                else {
+                    stringifiedProperties[key] = String(value);
+                }
+            }
+            return stringifiedProperties;
+        }
+        catch (e) {
+            this.logger.error("0eu9o3", correlationId);
+            this.logger.errorPii("17rpl5", correlationId);
+            return {};
+        }
     }
 }
 
@@ -14173,7 +14320,7 @@ class PopupClient extends StandardInteractionClient {
                 const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, correlationId, exports.InteractionType.Popup, { popupWindow }, null);
                 // Wait for the redirect bridge response
-                const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request);
+                const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
                 const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
                 return await invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
             }
@@ -14208,7 +14355,7 @@ class PopupClient extends StandardInteractionClient {
         const form = await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
@@ -14233,7 +14380,7 @@ class PopupClient extends StandardInteractionClient {
         const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
@@ -14286,7 +14433,7 @@ class PopupClient extends StandardInteractionClient {
             // Open the popup window to requestUrl.
             const popupWindow = this.openPopup(logoutUri, popupParams);
             this.eventHandler.emitEvent(EventType.POPUP_OPENED, validRequest.correlationId, exports.InteractionType.Popup, { popupWindow }, null);
-            await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest).catch(() => {
+            await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest, this.performanceClient).catch(() => {
                 // Swallow any errors related to monitoring the window. Server logout is best effort
             });
             if (mainWindowRedirectUri) {
@@ -15034,7 +15181,7 @@ class SilentIframeClient extends StandardInteractionClient {
         };
         await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
         const responseType = this.config.auth.OIDCOptions.responseMode;
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             // If server doesn't support EAR, they may fallback to auth code flow instead
@@ -15083,7 +15230,7 @@ class SilentIframeClient extends StandardInteractionClient {
         }
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
@@ -15236,6 +15383,22 @@ class SilentAuthCodeClient extends StandardInteractionClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+ * @returns Network connection information, or an empty object if not available.
+ */
+function getNetworkInfo() {
+    if (typeof window === "undefined" || !window.navigator) {
+        return {};
+    }
+    const connection = "connection" in window.navigator
+        ? window.navigator.connection
+        : undefined;
+    return {
+        effectiveType: connection?.effectiveType,
+        rtt: connection?.rtt,
+    };
+}
 function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
     const frameInstances = 
     // @ts-ignore
@@ -15255,12 +15418,13 @@ function collectInstanceStats(currentClientId, performanceEvent, logger, correla
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-function preflightCheck(initialized, performanceEvent, account) {
+function preflightCheck(initialized, performanceEvent, config, request) {
     try {
         preflightCheck$1(initialized);
+        enforceResourceParameter(config.auth.isMcp, request);
     }
     catch (e) {
-        performanceEvent.end({ success: false }, e, account);
+        performanceEvent.end({ success: false }, e, request.account);
         throw e;
     }
 }
@@ -15361,6 +15525,7 @@ class StandardController {
         this.eventHandler.emitEvent(EventType.INITIALIZE_START, correlationId);
         // Broker applications are initialized twice, so we avoid double-counting it
         this.logMultipleInstances(initMeasurement, correlationId);
+        initMeasurement.add({ isMcp: this.config.auth.isMcp });
         await invokeAsync(this.browserStorage.initialize.bind(this.browserStorage), InitializeCache, this.logger, this.performanceClient, correlationId)(correlationId);
         if (allowPlatformBroker) {
             try {
@@ -15538,6 +15703,7 @@ class StandardController {
         };
         try {
             redirectPreflightCheck(this.initialized, this.config);
+            enforceResourceParameter(this.config.auth.isMcp, request);
             this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Redirect, request);
             let result;
@@ -15602,7 +15768,7 @@ class StandardController {
         });
         try {
             this.logger.verbose("0ch87b", correlationId);
-            preflightCheck(this.initialized, atPopupMeasurement, request.account);
+            preflightCheck(this.initialized, atPopupMeasurement, this.config, request);
             this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN, request.overrideInteractionInProgress, correlationId);
         }
         catch (e) {
@@ -15716,7 +15882,7 @@ class StandardController {
         this.ssoSilentMeasurement?.add({
             scenarioId: request.scenarioId,
         });
-        preflightCheck(this.initialized, this.ssoSilentMeasurement, request.account);
+        preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
         });
@@ -15780,7 +15946,7 @@ class StandardController {
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.trace("0ch6ga", correlationId);
         const atbcMeasurement = this.performanceClient.startMeasurement(AcquireTokenByCode, correlationId);
-        preflightCheck(this.initialized, atbcMeasurement);
+        preflightCheck(this.initialized, atbcMeasurement, this.config, request);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Silent, request);
         atbcMeasurement.add({ scenarioId: request.scenarioId });
         try {
@@ -16282,7 +16448,7 @@ class StandardController {
             cacheLookupPolicy: request.cacheLookupPolicy,
             scenarioId: request.scenarioId,
         });
-        preflightCheck(this.initialized, atsMeasurement, request.account);
+        preflightCheck(this.initialized, atsMeasurement, this.config, request);
         this.logger.verbose("0x1c4s", correlationId);
         const account = request.account || this.getActiveAccount();
         if (!account) {
@@ -16738,6 +16904,7 @@ class NestedAppAuthAdapter {
             platformBrokerId: request.account?.homeAccountId,
             clientId: this.clientId,
             authority: request.authority,
+            resource: request.resource,
             scope: scopes.join(" "),
             correlationId,
             claims: !StringUtils.isEmptyObj(claims) ? claims : undefined,
@@ -17008,6 +17175,7 @@ class NestedAppAuthController {
         const atPopupMeasurement = this.performanceClient.startMeasurement(AcquireTokenPopup, correlationId);
         atPopupMeasurement.add({ nestedAppAuthRequest: true });
         try {
+            enforceResourceParameter(this.config.auth.isMcp, validRequest);
             const naaRequest = this.nestedAppAuthAdapter.toNaaTokenRequest(validRequest);
             const reqTimestamp = nowSeconds();
             const response = await this.bridgeProxy.getTokenInteractive(naaRequest);
@@ -17074,6 +17242,7 @@ class NestedAppAuthController {
             nestedAppAuthRequest: true,
         });
         try {
+            enforceResourceParameter(this.config.auth.isMcp, validRequest);
             const naaRequest = this.nestedAppAuthAdapter.toNaaTokenRequest(validRequest);
             naaRequest.forceRefresh = validRequest.forceRefresh;
             const reqTimestamp = nowSeconds();
@@ -17208,6 +17377,14 @@ class NestedAppAuthController {
             this.logger.verbose("18egye", correlationId);
             return Promise.resolve(null);
         }
+        else if (authRequest.resource) {
+            const requestedResource = authRequest.resource;
+            const cachedResource = cachedAccessToken.resource;
+            if (!cachedResource || cachedResource !== requestedResource) {
+                this.logger.verbose("0qraxd", correlationId);
+                return Promise.resolve(null);
+            }
+        }
         const cachedIdToken = this.browserStorage.getIdToken(currentAccount, authRequest.correlationId, tokenKeys, currentAccount.tenantId);
         if (!cachedIdToken) {
             this.logger.verbose("0d68kd", correlationId);
@@ -18377,11 +18554,14 @@ class BrowserPerformanceClient extends PerformanceClient {
         return {
             ...inProgressEvent,
             end: (event, error, account) => {
+                const networkInfo = getNetworkInfo();
                 const res = inProgressEvent.end({
                     ...event,
                     startPageVisibility,
                     endPageVisibility: this.getPageVisibility(),
                     durationMs: getPerfDurationMs(startTime),
+                    networkEffectiveType: networkInfo.effectiveType,
+                    networkRtt: networkInfo.rtt,
                 }, error, account);
                 void browserMeasurement?.then((measurement) => measurement.endMeasurement());
                 this.deleteIncompleteSubMeasurements(inProgressEvent);
@@ -18553,6 +18733,7 @@ exports.StubPerformanceClient = StubPerformanceClient;
 exports.WrapperSKU = WrapperSKU;
 exports.createNestablePublicClientApplication = createNestablePublicClientApplication;
 exports.createStandardPublicClientApplication = createStandardPublicClientApplication;
+exports.enforceResourceParameter = enforceResourceParameter;
 exports.isPlatformBrokerAvailable = isPlatformBrokerAvailable;
 exports.loadExternalTokens = loadExternalTokens;
 exports.stubbedPublicClientApplication = stubbedPublicClientApplication;