@azure/msal-browser 5.4.0 → 5.5.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.4.0 2026-03-02 */
+/*! @azure/msal-browser v5.5.0 2026-03-13 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -238,7 +238,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -286,9 +286,10 @@
     const BROKER_REDIRECT_URI = "brk_redirect_uri";
     const INSTANCE_AWARE = "instance_aware";
     const EAR_JWK = "ear_jwk";
-    const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+    const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+    const RESOURCE = "resource";
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -319,7 +320,7 @@
         return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -339,7 +340,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -419,7 +420,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -442,7 +443,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -496,7 +497,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -537,7 +538,9 @@
     const userCanceled = "user_canceled";
     const methodNotImplemented = "method_not_implemented";
     const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
-    const platformBrokerError = "platform_broker_error";
+    const platformBrokerError = "platform_broker_error";
+    const resourceParameterRequired = "resource_parameter_required";
+    const misplacedResourceParam = "misplaced_resource_parameter";
 
     var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -558,6 +561,7 @@
         keyIdMissing: keyIdMissing,
         maxAgeTranspired: maxAgeTranspired,
         methodNotImplemented: methodNotImplemented,
+        misplacedResourceParam: misplacedResourceParam,
         multipleMatchingAppMetadata: multipleMatchingAppMetadata,
         multipleMatchingTokens: multipleMatchingTokens,
         nestedAppAuthBridgeDisabled: nestedAppAuthBridgeDisabled,
@@ -571,6 +575,7 @@
         openIdConfigError: openIdConfigError,
         platformBrokerError: platformBrokerError,
         requestCannotBeMade: requestCannotBeMade,
+        resourceParameterRequired: resourceParameterRequired,
         stateMismatch: stateMismatch,
         stateNotFound: stateNotFound,
         tokenClaimsCnfRequiredForSignedJwt: tokenClaimsCnfRequiredForSignedJwt,
@@ -580,7 +585,7 @@
         userCanceled: userCanceled
     });
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -775,7 +780,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1140,9 +1145,14 @@
         // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
         const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
         parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+    }
+    function addResource(parameters, resource) {
+        if (resource) {
+            parameters.set(RESOURCE, resource);
+        }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1251,7 +1261,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1290,7 +1300,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1565,12 +1575,12 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "16.2.0";
+    const version$1 = "16.3.0";
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1590,7 +1600,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1672,7 +1682,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1752,7 +1762,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1909,7 +1919,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2066,7 +2076,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2074,7 +2084,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2112,7 +2122,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2150,7 +2160,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2165,7 +2175,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2187,7 +2197,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2211,7 +2221,7 @@
         EAR: "EAR",
     };
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -2386,7 +2396,7 @@
             entity.hasOwnProperty("authorityType"));
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3483,7 +3493,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3528,9 +3538,12 @@
         "currRefreshCount",
         "expiredCacheRemovedCount",
         "upgradedCacheCount",
+        "networkRtt",
+        "redirectBridgeTimeoutMs",
+        "redirectBridgeMessageVersion",
     ]);
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3585,7 +3598,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3668,6 +3681,7 @@
             clientCapabilities: [],
             azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
             instanceAware: false,
+            isMcp: false,
             ...authOptions,
         };
     }
@@ -3679,7 +3693,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3698,7 +3712,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3762,7 +3776,7 @@
         uxNotAllowed: uxNotAllowed
     });
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3830,7 +3844,7 @@
         return new InteractionRequiredAuthError(errorCode, errorMessage);
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3898,7 +3912,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3963,7 +3977,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4034,7 +4048,7 @@
     const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
     const SetUserData = "setUserData";
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4127,7 +4141,7 @@
         };
     };
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4207,7 +4221,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4234,7 +4248,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4493,7 +4507,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4678,6 +4692,11 @@
                     : undefined;
                 // non AAD scenarios can have empty realm
                 cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+                // Set resource (to be used for MCP scenarios)
+                const resource = request.resource || null;
+                if (resource) {
+                    cachedAccessToken.resource = resource;
+                }
             }
             // refreshToken
             let cachedRefreshToken = null;
@@ -4829,7 +4848,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4839,7 +4858,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4857,7 +4876,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4878,7 +4897,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4964,7 +4983,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4995,7 +5014,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5109,7 +5128,7 @@
         return response;
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5121,7 +5140,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5131,7 +5150,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5141,7 +5160,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5246,7 +5265,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6066,7 +6085,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6100,7 +6119,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6220,6 +6239,7 @@
             }
             // Add scope array, parameter builder will add default scopes and dedupe
             addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+            addResource(parameters, request.resource);
             // add code: user set, not validated
             addAuthorizationCode(parameters, request.code);
             // Add library metadata
@@ -6360,7 +6380,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6585,7 +6605,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6641,6 +6661,13 @@
                 this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
                 throw createClientAuthError(tokenRefreshRequired);
             }
+            else if (request.resource) {
+                // cached access token must have a resource that matches the request resource for MCP scenarios
+                if (cachedAccessToken.resource !== request.resource) {
+                    this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+                    throw createClientAuthError(tokenRefreshRequired);
+                }
+            }
             else if (cachedAccessToken.refreshOn &&
                 isTokenExpired(cachedAccessToken.refreshOn, 0)) {
                 // must refresh (in the background) due to the refresh_in value
@@ -6694,7 +6721,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6709,7 +6736,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6735,6 +6762,7 @@
             ...(request.extraScopesToConsent || []),
         ];
         addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addResource(parameters, request.resource);
         addRedirectUri(parameters, request.redirectUri);
         addCorrelationId(parameters, correlationId);
         // add response_mode. If not passed in it defaults to query.
@@ -6933,7 +6961,40 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
+     * If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
+     * This is used for MCP flows.
+     * @param isMcp - Flag indicating if application is an MCP app, from configuration
+     * @param request - Auth request
+     */
+    function enforceResourceParameter(isMcp, request) {
+        if (!isMcp) {
+            return;
+        }
+        if (request.resource &&
+            (containsResourceParam(request.extraParameters) ||
+                containsResourceParam(request.extraQueryParameters))) {
+            throw createClientAuthError(misplacedResourceParam);
+        }
+        if (!request.resource) {
+            throw createClientAuthError(resourceParameterRequired);
+        }
+    }
+    function containsResourceParam(params) {
+        if (!params) {
+            return false;
+        }
+        return Object.prototype.hasOwnProperty.call(params, "resource");
+    }
+
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6991,7 +7052,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7008,7 +7069,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7269,7 +7330,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7290,7 +7351,7 @@
         return new JoseHeaderError(code);
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7298,7 +7359,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7338,7 +7399,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.2.0 2026-03-02 */
+    /*! @azure/msal-common v16.3.0 2026-03-13 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8772,9 +8833,13 @@
             activeBridgeMonitor = null;
         }
     }
-    async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request) {
+    async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient) {
         return new Promise((resolve, reject) => {
             logger.verbose("1rf6em", request.correlationId);
+            const correlationId = request.correlationId;
+            performanceClient.addFields({
+                redirectBridgeTimeoutMs: timeoutMs,
+            }, correlationId);
             const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
             const channel = new BroadcastChannel(libraryState.id);
             let responseString = undefined;
@@ -8792,6 +8857,12 @@
             };
             channel.onmessage = (event) => {
                 responseString = event.data.payload;
+                const messageVersion = event?.data && typeof event.data.v === "number"
+                    ? event.data.v
+                    : undefined;
+                performanceClient.addFields({
+                    redirectBridgeMessageVersion: messageVersion,
+                }, correlationId);
                 // Clear the active monitor
                 activeBridgeMonitor = null;
                 clearTimeout(timeoutId);
@@ -10211,7 +10282,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "5.4.0";
+    const version = "5.5.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11526,6 +11597,9 @@
                 : 0, base64Decode, undefined, // refreshOn
             result.tokenType, undefined, // userAssertionHash
             request.sshKid);
+            if (request.resource) {
+                accessTokenEntity.resource = request.resource;
+            }
             const cacheRecord = {
                 idToken: idTokenEntity,
                 accessToken: accessTokenEntity,
@@ -12078,6 +12152,7 @@
                     authority: discoveredAuthority,
                     clientCapabilities: this.config.auth.clientCapabilities,
                     redirectUri: this.config.auth.redirectUri,
+                    isMcp: this.config.auth.isMcp,
                 },
                 systemOptions: {
                     tokenRenewalOffsetSeconds: this.config.system.tokenRenewalOffsetSeconds,
@@ -12118,6 +12193,10 @@
      */
     async function initializeAuthorizationRequest(request, interactionType, config, browserCrypto, browserStorage, logger, performanceClient, correlationId) {
         const redirectUri = getRedirectUri(request.redirectUri, config.auth.redirectUri, logger, correlationId);
+        if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
+            logger.warning("08qbvw", correlationId);
+            performanceClient.addFields({ isRedirectUriCrossOrigin: true }, correlationId);
+        }
         const browserState = {
             interactionType: interactionType,
         };
@@ -12795,6 +12874,7 @@
                 correlationId: this.correlationId,
                 state: response.state,
                 fromPlatformBroker: true,
+                ...(request.resource && { resource: request.resource }),
             };
             return result;
         }
@@ -13523,6 +13603,7 @@
                 tenant: "",
             },
             instanceAware: false,
+            isMcp: false,
         };
         // Default cache options for browser
         const DEFAULT_CACHE_OPTIONS = {
@@ -13915,14 +13996,17 @@
         initializePlatformDOMRequest(request) {
             this.logger.trace("15d6yv", request.correlationId);
             const { accountId, clientId, authority, scope, redirectUri, correlationId, state, storeInCache, embeddedClientId, extraParameters, ...remainingProperties } = request;
-            const validExtraParameters = this.getDOMExtraParams(remainingProperties);
+            const validExtraParameters = this.getDOMExtraParams(remainingProperties, correlationId);
             const platformDOMRequest = {
                 accountId: accountId,
                 brokerId: this.getExtensionId(),
                 authority: authority,
                 clientId: clientId,
                 correlationId: correlationId || this.correlationId,
-                extraParameters: { ...extraParameters, ...validExtraParameters },
+                extraParameters: {
+                    ...extraParameters,
+                    ...validExtraParameters,
+                },
                 isSecurityTokenService: false,
                 redirectUri: redirectUri,
                 scope: scope,
@@ -13976,15 +14060,27 @@
             };
             return nativeResponse;
         }
-        getDOMExtraParams(extraParameters) {
-            const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
-                record[key] = String(value);
-                return record;
-            }, {});
-            const validExtraParams = {
-                ...stringifiedParams,
-            };
-            return validExtraParams;
+        getDOMExtraParams(extraParameters, correlationId) {
+            try {
+                const stringifiedProperties = {};
+                for (const [key, value] of Object.entries(extraParameters)) {
+                    if (!value) {
+                        continue;
+                    }
+                    if (typeof value === "object") {
+                        stringifiedProperties[key] = JSON.stringify(value);
+                    }
+                    else {
+                        stringifiedProperties[key] = String(value);
+                    }
+                }
+                return stringifiedProperties;
+            }
+            catch (e) {
+                this.logger.error("0eu9o3", correlationId);
+                this.logger.errorPii("17rpl5", correlationId);
+                return {};
+            }
         }
     }
 
@@ -14228,7 +14324,7 @@
                     const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
                     this.eventHandler.emitEvent(EventType.POPUP_OPENED, correlationId, exports.InteractionType.Popup, { popupWindow }, null);
                     // Wait for the redirect bridge response
-                    const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request);
+                    const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
                     const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
                     return await invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
                 }
@@ -14263,7 +14359,7 @@
             const form = await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient);
             form.submit();
             // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest);
+            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest, this.performanceClient);
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
             if (!serverParams.ear_jwe && serverParams.code) {
                 const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
@@ -14288,7 +14384,7 @@
             const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
             form.submit();
             // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request);
+            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
             return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
@@ -14341,7 +14437,7 @@
                 // Open the popup window to requestUrl.
                 const popupWindow = this.openPopup(logoutUri, popupParams);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, validRequest.correlationId, exports.InteractionType.Popup, { popupWindow }, null);
-                await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest).catch(() => {
+                await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest, this.performanceClient).catch(() => {
                     // Swallow any errors related to monitoring the window. Server logout is best effort
                 });
                 if (mainWindowRedirectUri) {
@@ -15089,7 +15185,7 @@
             };
             await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
             const responseType = this.config.auth.OIDCOptions.responseMode;
-            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request);
+            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
             if (!serverParams.ear_jwe && serverParams.code) {
                 // If server doesn't support EAR, they may fallback to auth code flow instead
@@ -15138,7 +15234,7 @@
             }
             const responseType = this.config.auth.OIDCOptions.responseMode;
             // Wait for response from the redirect bridge.
-            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request);
+            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
             return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
@@ -15291,6 +15387,22 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
+    /**
+     * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+     * @returns Network connection information, or an empty object if not available.
+     */
+    function getNetworkInfo() {
+        if (typeof window === "undefined" || !window.navigator) {
+            return {};
+        }
+        const connection = "connection" in window.navigator
+            ? window.navigator.connection
+            : undefined;
+        return {
+            effectiveType: connection?.effectiveType,
+            rtt: connection?.rtt,
+        };
+    }
     function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
         const frameInstances = 
         // @ts-ignore
@@ -15310,12 +15422,13 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    function preflightCheck(initialized, performanceEvent, account) {
+    function preflightCheck(initialized, performanceEvent, config, request) {
         try {
             preflightCheck$1(initialized);
+            enforceResourceParameter(config.auth.isMcp, request);
         }
         catch (e) {
-            performanceEvent.end({ success: false }, e, account);
+            performanceEvent.end({ success: false }, e, request.account);
             throw e;
         }
     }
@@ -15416,6 +15529,7 @@
             this.eventHandler.emitEvent(EventType.INITIALIZE_START, correlationId);
             // Broker applications are initialized twice, so we avoid double-counting it
             this.logMultipleInstances(initMeasurement, correlationId);
+            initMeasurement.add({ isMcp: this.config.auth.isMcp });
             await invokeAsync(this.browserStorage.initialize.bind(this.browserStorage), InitializeCache, this.logger, this.performanceClient, correlationId)(correlationId);
             if (allowPlatformBroker) {
                 try {
@@ -15593,6 +15707,7 @@
             };
             try {
                 redirectPreflightCheck(this.initialized, this.config);
+                enforceResourceParameter(this.config.auth.isMcp, request);
                 this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Redirect, request);
                 let result;
@@ -15657,7 +15772,7 @@
             });
             try {
                 this.logger.verbose("0ch87b", correlationId);
-                preflightCheck(this.initialized, atPopupMeasurement, request.account);
+                preflightCheck(this.initialized, atPopupMeasurement, this.config, request);
                 this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN, request.overrideInteractionInProgress, correlationId);
             }
             catch (e) {
@@ -15771,7 +15886,7 @@
             this.ssoSilentMeasurement?.add({
                 scenarioId: request.scenarioId,
             });
-            preflightCheck(this.initialized, this.ssoSilentMeasurement, request.account);
+            preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
             this.ssoSilentMeasurement?.increment({
                 visibilityChangeCount: 0,
             });
@@ -15835,7 +15950,7 @@
             const correlationId = this.getRequestCorrelationId(request);
             this.logger.trace("0ch6ga", correlationId);
             const atbcMeasurement = this.performanceClient.startMeasurement(AcquireTokenByCode, correlationId);
-            preflightCheck(this.initialized, atbcMeasurement);
+            preflightCheck(this.initialized, atbcMeasurement, this.config, request);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Silent, request);
             atbcMeasurement.add({ scenarioId: request.scenarioId });
             try {
@@ -16337,7 +16452,7 @@
                 cacheLookupPolicy: request.cacheLookupPolicy,
                 scenarioId: request.scenarioId,
             });
-            preflightCheck(this.initialized, atsMeasurement, request.account);
+            preflightCheck(this.initialized, atsMeasurement, this.config, request);
             this.logger.verbose("0x1c4s", correlationId);
             const account = request.account || this.getActiveAccount();
             if (!account) {
@@ -16793,6 +16908,7 @@
                 platformBrokerId: request.account?.homeAccountId,
                 clientId: this.clientId,
                 authority: request.authority,
+                resource: request.resource,
                 scope: scopes.join(" "),
                 correlationId,
                 claims: !StringUtils.isEmptyObj(claims) ? claims : undefined,
@@ -17063,6 +17179,7 @@
             const atPopupMeasurement = this.performanceClient.startMeasurement(AcquireTokenPopup, correlationId);
             atPopupMeasurement.add({ nestedAppAuthRequest: true });
             try {
+                enforceResourceParameter(this.config.auth.isMcp, validRequest);
                 const naaRequest = this.nestedAppAuthAdapter.toNaaTokenRequest(validRequest);
                 const reqTimestamp = nowSeconds();
                 const response = await this.bridgeProxy.getTokenInteractive(naaRequest);
@@ -17129,6 +17246,7 @@
                 nestedAppAuthRequest: true,
             });
             try {
+                enforceResourceParameter(this.config.auth.isMcp, validRequest);
                 const naaRequest = this.nestedAppAuthAdapter.toNaaTokenRequest(validRequest);
                 naaRequest.forceRefresh = validRequest.forceRefresh;
                 const reqTimestamp = nowSeconds();
@@ -17263,6 +17381,14 @@
                 this.logger.verbose("18egye", correlationId);
                 return Promise.resolve(null);
             }
+            else if (authRequest.resource) {
+                const requestedResource = authRequest.resource;
+                const cachedResource = cachedAccessToken.resource;
+                if (!cachedResource || cachedResource !== requestedResource) {
+                    this.logger.verbose("0qraxd", correlationId);
+                    return Promise.resolve(null);
+                }
+            }
             const cachedIdToken = this.browserStorage.getIdToken(currentAccount, authRequest.correlationId, tokenKeys, currentAccount.tenantId);
             if (!cachedIdToken) {
                 this.logger.verbose("0d68kd", correlationId);
@@ -18432,11 +18558,14 @@
             return {
                 ...inProgressEvent,
                 end: (event, error, account) => {
+                    const networkInfo = getNetworkInfo();
                     const res = inProgressEvent.end({
                         ...event,
                         startPageVisibility,
                         endPageVisibility: this.getPageVisibility(),
                         durationMs: getPerfDurationMs(startTime),
+                        networkEffectiveType: networkInfo.effectiveType,
+                        networkRtt: networkInfo.rtt,
                     }, error, account);
                     void browserMeasurement?.then((measurement) => measurement.endMeasurement());
                     this.deleteIncompleteSubMeasurements(inProgressEvent);
@@ -18608,6 +18737,7 @@
     exports.WrapperSKU = WrapperSKU;
     exports.createNestablePublicClientApplication = createNestablePublicClientApplication;
     exports.createStandardPublicClientApplication = createStandardPublicClientApplication;
+    exports.enforceResourceParameter = enforceResourceParameter;
     exports.isPlatformBrokerAvailable = isPlatformBrokerAvailable;
     exports.loadExternalTokens = loadExternalTokens;
     exports.stubbedPublicClientApplication = stubbedPublicClientApplication;