@azure/msal-browser 5.4.0 → 5.5.0

package/lib/custom-auth-path/msal-custom-auth.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.4.0 2026-03-02 */
+/*! @azure/msal-browser v5.5.0 2026-03-13 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -229,7 +229,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -277,9 +277,10 @@ const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
-const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const RESOURCE = "resource";
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -310,7 +311,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -330,7 +331,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -410,7 +411,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -433,7 +434,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -457,7 +458,7 @@ const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
 const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -492,9 +493,11 @@ const authorizationCodeMissingFromServerResponse = "authorization_code_missing_f
 const bindingKeyNotRemoved = "binding_key_not_removed";
 const endSessionEndpointNotSupported = "end_session_endpoint_not_supported";
 const keyIdMissing = "key_id_missing";
-const methodNotImplemented = "method_not_implemented";
+const methodNotImplemented = "method_not_implemented";
+const resourceParameterRequired = "resource_parameter_required";
+const misplacedResourceParam = "misplaced_resource_parameter";
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -689,7 +692,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1054,9 +1057,14 @@ function addEARParameters(parameters, jwk) {
     // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
     const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+function addResource(parameters, resource) {
+    if (resource) {
+        parameters.set(RESOURCE, resource);
+    }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1165,7 +1173,7 @@ function normalizeUrlForComparison(url) {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1204,7 +1212,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1465,12 +1473,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.2.0";
+const version$1 = "16.3.0";
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1479,7 +1487,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1561,7 +1569,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1641,7 +1649,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1798,7 +1806,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1955,7 +1963,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1963,7 +1971,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2001,7 +2009,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2039,7 +2047,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2054,7 +2062,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2076,7 +2084,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2100,7 +2108,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2275,7 +2283,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3371,7 +3379,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3385,7 +3393,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3440,7 +3448,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3523,6 +3531,7 @@ function buildAuthOptions(authOptions) {
         clientCapabilities: [],
         azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
         instanceAware: false,
+        isMcp: false,
         ...authOptions,
     };
 }
@@ -3534,7 +3543,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3553,7 +3562,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3604,7 +3613,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3672,7 +3681,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3740,7 +3749,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3805,7 +3814,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3876,7 +3885,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3969,7 +3978,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4049,7 +4058,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4076,7 +4085,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4335,7 +4344,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4520,6 +4529,11 @@ class ResponseHandler {
                 : undefined;
             // non AAD scenarios can have empty realm
             cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+            // Set resource (to be used for MCP scenarios)
+            const resource = request.resource || null;
+            if (resource) {
+                cachedAccessToken.resource = resource;
+            }
         }
         // refreshToken
         let cachedRefreshToken = null;
@@ -4671,7 +4685,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4681,7 +4695,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4699,7 +4713,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4720,7 +4734,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4806,7 +4820,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4837,7 +4851,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4951,7 +4965,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4963,7 +4977,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4973,7 +4987,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4983,7 +4997,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5088,7 +5102,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5908,7 +5922,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5942,7 +5956,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6062,6 +6076,7 @@ class AuthorizationCodeClient {
         }
         // Add scope array, parameter builder will add default scopes and dedupe
         addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+        addResource(parameters, request.resource);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
         // Add library metadata
@@ -6202,7 +6217,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6427,7 +6442,7 @@ class RefreshTokenClient {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6483,6 +6498,13 @@ class SilentFlowClient {
             this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
             throw createClientAuthError(tokenRefreshRequired);
         }
+        else if (request.resource) {
+            // cached access token must have a resource that matches the request resource for MCP scenarios
+            if (cachedAccessToken.resource !== request.resource) {
+                this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+                throw createClientAuthError(tokenRefreshRequired);
+            }
+        }
         else if (cachedAccessToken.refreshOn &&
             isTokenExpired(cachedAccessToken.refreshOn, 0)) {
             // must refresh (in the background) due to the refresh_in value
@@ -6536,7 +6558,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6551,7 +6573,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6577,6 +6599,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
         ...(request.extraScopesToConsent || []),
     ];
     addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addResource(parameters, request.resource);
     addRedirectUri(parameters, request.redirectUri);
     addCorrelationId(parameters, correlationId);
     // add response_mode. If not passed in it defaults to query.
@@ -6775,7 +6798,40 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
+ * If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
+ * This is used for MCP flows.
+ * @param isMcp - Flag indicating if application is an MCP app, from configuration
+ * @param request - Auth request
+ */
+function enforceResourceParameter(isMcp, request) {
+    if (!isMcp) {
+        return;
+    }
+    if (request.resource &&
+        (containsResourceParam(request.extraParameters) ||
+            containsResourceParam(request.extraQueryParameters))) {
+        throw createClientAuthError(misplacedResourceParam);
+    }
+    if (!request.resource) {
+        throw createClientAuthError(resourceParameterRequired);
+    }
+}
+function containsResourceParam(params) {
+    if (!params) {
+        return false;
+    }
+    return Object.prototype.hasOwnProperty.call(params, "resource");
+}
+
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6785,7 +6841,7 @@ function extractLoginHint(account) {
  */
 const unexpectedError = "unexpected_error";
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7046,7 +7102,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7067,7 +7123,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7075,7 +7131,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.3.0 2026-03-13 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7510,7 +7566,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.4.0";
+const version = "5.5.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8937,9 +8993,13 @@ function cancelPendingBridgeResponse(logger, correlationId) {
         activeBridgeMonitor = null;
     }
 }
-async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request) {
+async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient) {
     return new Promise((resolve, reject) => {
         logger.verbose("1rf6em", request.correlationId);
+        const correlationId = request.correlationId;
+        performanceClient.addFields({
+            redirectBridgeTimeoutMs: timeoutMs,
+        }, correlationId);
         const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
         const channel = new BroadcastChannel(libraryState.id);
         let responseString = undefined;
@@ -8957,6 +9017,12 @@ async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request)
         };
         channel.onmessage = (event) => {
             responseString = event.data.payload;
+            const messageVersion = event?.data && typeof event.data.v === "number"
+                ? event.data.v
+                : undefined;
+            performanceClient.addFields({
+                redirectBridgeMessageVersion: messageVersion,
+            }, correlationId);
             // Clear the active monitor
             activeBridgeMonitor = null;
             clearTimeout(timeoutId);
@@ -9427,6 +9493,7 @@ class StandardInteractionClient extends BaseInteractionClient {
                 authority: discoveredAuthority,
                 clientCapabilities: this.config.auth.clientCapabilities,
                 redirectUri: this.config.auth.redirectUri,
+                isMcp: this.config.auth.isMcp,
             },
             systemOptions: {
                 tokenRenewalOffsetSeconds: this.config.system.tokenRenewalOffsetSeconds,
@@ -9467,6 +9534,10 @@ class StandardInteractionClient extends BaseInteractionClient {
  */
 async function initializeAuthorizationRequest(request, interactionType, config, browserCrypto, browserStorage, logger, performanceClient, correlationId) {
     const redirectUri = getRedirectUri(request.redirectUri, config.auth.redirectUri, logger, correlationId);
+    if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
+        logger.warning("08qbvw", correlationId);
+        performanceClient.addFields({ isRedirectUriCrossOrigin: true }, correlationId);
+    }
     const browserState = {
         interactionType: interactionType,
     };
@@ -15894,6 +15965,9 @@ class BrowserCacheManager extends CacheManager {
             : 0, base64Decode, undefined, // refreshOn
         result.tokenType, undefined, // userAssertionHash
         request.sshKid);
+        if (request.resource) {
+            accessTokenEntity.resource = request.resource;
+        }
         const cacheRecord = {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
@@ -16756,6 +16830,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             correlationId: this.correlationId,
             state: response.state,
             fromPlatformBroker: true,
+            ...(request.resource && { resource: request.resource }),
         };
         return result;
     }
@@ -17484,6 +17559,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
             tenant: "",
         },
         instanceAware: false,
+        isMcp: false,
     };
     // Default cache options for browser
     const DEFAULT_CACHE_OPTIONS = {
@@ -17876,14 +17952,17 @@ class PlatformAuthDOMHandler {
     initializePlatformDOMRequest(request) {
         this.logger.trace("15d6yv", request.correlationId);
         const { accountId, clientId, authority, scope, redirectUri, correlationId, state, storeInCache, embeddedClientId, extraParameters, ...remainingProperties } = request;
-        const validExtraParameters = this.getDOMExtraParams(remainingProperties);
+        const validExtraParameters = this.getDOMExtraParams(remainingProperties, correlationId);
         const platformDOMRequest = {
             accountId: accountId,
             brokerId: this.getExtensionId(),
             authority: authority,
             clientId: clientId,
             correlationId: correlationId || this.correlationId,
-            extraParameters: { ...extraParameters, ...validExtraParameters },
+            extraParameters: {
+                ...extraParameters,
+                ...validExtraParameters,
+            },
             isSecurityTokenService: false,
             redirectUri: redirectUri,
             scope: scope,
@@ -17937,15 +18016,27 @@ class PlatformAuthDOMHandler {
         };
         return nativeResponse;
     }
-    getDOMExtraParams(extraParameters) {
-        const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
-            record[key] = String(value);
-            return record;
-        }, {});
-        const validExtraParams = {
-            ...stringifiedParams,
-        };
-        return validExtraParams;
+    getDOMExtraParams(extraParameters, correlationId) {
+        try {
+            const stringifiedProperties = {};
+            for (const [key, value] of Object.entries(extraParameters)) {
+                if (!value) {
+                    continue;
+                }
+                if (typeof value === "object") {
+                    stringifiedProperties[key] = JSON.stringify(value);
+                }
+                else {
+                    stringifiedProperties[key] = String(value);
+                }
+            }
+            return stringifiedProperties;
+        }
+        catch (e) {
+            this.logger.error("0eu9o3", correlationId);
+            this.logger.errorPii("17rpl5", correlationId);
+            return {};
+        }
     }
 }
 
@@ -18171,7 +18262,7 @@ class PopupClient extends StandardInteractionClient {
                 const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, correlationId, InteractionType.Popup, { popupWindow }, null);
                 // Wait for the redirect bridge response
-                const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request);
+                const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
                 const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
                 return await invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
             }
@@ -18206,7 +18297,7 @@ class PopupClient extends StandardInteractionClient {
         const form = await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
@@ -18231,7 +18322,7 @@ class PopupClient extends StandardInteractionClient {
         const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
@@ -18284,7 +18375,7 @@ class PopupClient extends StandardInteractionClient {
             // Open the popup window to requestUrl.
             const popupWindow = this.openPopup(logoutUri, popupParams);
             this.eventHandler.emitEvent(EventType.POPUP_OPENED, validRequest.correlationId, InteractionType.Popup, { popupWindow }, null);
-            await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest).catch(() => {
+            await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest, this.performanceClient).catch(() => {
                 // Swallow any errors related to monitoring the window. Server logout is best effort
             });
             if (mainWindowRedirectUri) {
@@ -19032,7 +19123,7 @@ class SilentIframeClient extends StandardInteractionClient {
         };
         await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
         const responseType = this.config.auth.OIDCOptions.responseMode;
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             // If server doesn't support EAR, they may fallback to auth code flow instead
@@ -19081,7 +19172,7 @@ class SilentIframeClient extends StandardInteractionClient {
         }
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request);
+        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
@@ -19234,6 +19325,10 @@ class SilentAuthCodeClient extends StandardInteractionClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+ * @returns Network connection information, or an empty object if not available.
+ */
 function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
     const frameInstances = 
     // @ts-ignore
@@ -19253,12 +19348,13 @@ function collectInstanceStats(currentClientId, performanceEvent, logger, correla
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-function preflightCheck(initialized, performanceEvent, account) {
+function preflightCheck(initialized, performanceEvent, config, request) {
     try {
         preflightCheck$1(initialized);
+        enforceResourceParameter(config.auth.isMcp, request);
     }
     catch (e) {
-        performanceEvent.end({ success: false }, e, account);
+        performanceEvent.end({ success: false }, e, request.account);
         throw e;
     }
 }
@@ -19359,6 +19455,7 @@ class StandardController {
         this.eventHandler.emitEvent(EventType.INITIALIZE_START, correlationId);
         // Broker applications are initialized twice, so we avoid double-counting it
         this.logMultipleInstances(initMeasurement, correlationId);
+        initMeasurement.add({ isMcp: this.config.auth.isMcp });
         await invokeAsync(this.browserStorage.initialize.bind(this.browserStorage), InitializeCache, this.logger, this.performanceClient, correlationId)(correlationId);
         if (allowPlatformBroker) {
             try {
@@ -19536,6 +19633,7 @@ class StandardController {
         };
         try {
             redirectPreflightCheck(this.initialized, this.config);
+            enforceResourceParameter(this.config.auth.isMcp, request);
             this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Redirect, request);
             let result;
@@ -19600,7 +19698,7 @@ class StandardController {
         });
         try {
             this.logger.verbose("0ch87b", correlationId);
-            preflightCheck(this.initialized, atPopupMeasurement, request.account);
+            preflightCheck(this.initialized, atPopupMeasurement, this.config, request);
             this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN, request.overrideInteractionInProgress, correlationId);
         }
         catch (e) {
@@ -19714,7 +19812,7 @@ class StandardController {
         this.ssoSilentMeasurement?.add({
             scenarioId: request.scenarioId,
         });
-        preflightCheck(this.initialized, this.ssoSilentMeasurement, request.account);
+        preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
         });
@@ -19778,7 +19876,7 @@ class StandardController {
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.trace("0ch6ga", correlationId);
         const atbcMeasurement = this.performanceClient.startMeasurement(AcquireTokenByCode, correlationId);
-        preflightCheck(this.initialized, atbcMeasurement);
+        preflightCheck(this.initialized, atbcMeasurement, this.config, request);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Silent, request);
         atbcMeasurement.add({ scenarioId: request.scenarioId });
         try {
@@ -20280,7 +20378,7 @@ class StandardController {
             cacheLookupPolicy: request.cacheLookupPolicy,
             scenarioId: request.scenarioId,
         });
-        preflightCheck(this.initialized, atsMeasurement, request.account);
+        preflightCheck(this.initialized, atsMeasurement, this.config, request);
         this.logger.verbose("0x1c4s", correlationId);
         const account = request.account || this.getActiveAccount();
         if (!account) {