@azure/msal-browser 5.6.1 → 5.6.3

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.6.1 2026-03-19 */
+/*! @azure/msal-browser v5.6.3 2026-04-01 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -234,7 +234,7 @@ const JsonWebTokenTypes$1 = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -286,7 +286,7 @@ const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -317,7 +317,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -337,7 +337,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -417,7 +417,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -440,7 +440,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -494,7 +494,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -582,7 +582,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userCanceled: userCanceled
 });
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -777,7 +777,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1155,7 +1155,7 @@ function addResource(parameters, resource) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1264,7 +1264,7 @@ function normalizeUrlForComparison(url) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1303,7 +1303,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1578,12 +1578,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.4.0";
+const version$1 = "16.4.1";
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1603,7 +1603,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1685,7 +1685,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1765,7 +1765,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1922,7 +1922,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2079,7 +2079,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2087,7 +2087,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2125,7 +2125,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2163,7 +2163,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2178,7 +2178,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2200,7 +2200,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2224,7 +2224,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2399,7 +2399,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3501,7 +3501,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3546,12 +3546,13 @@ const IntFields = new Set([
     "currRefreshCount",
     "expiredCacheRemovedCount",
     "upgradedCacheCount",
+    "cacheMatchedAccounts",
     "networkRtt",
     "redirectBridgeTimeoutMs",
     "redirectBridgeMessageVersion",
 ]);
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3606,7 +3607,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3701,291 +3702,358 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
-
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Error thrown when there is an error with the server code, for example, unavailability.
- */
-class ServerError extends AuthError {
-    constructor(errorCode, errorMessage, subError, errorNo, status) {
-        super(errorCode, errorMessage, subError);
-        this.name = "ServerError";
-        this.errorNo = errorNo;
-        this.status = status;
-        Object.setPrototypeOf(this, ServerError.prototype);
+ * This class instance helps track the memory changes facilitating
+ * decisions to read from and write to the persistent cache
+ */ class TokenCacheContext {
+    constructor(tokenCache, hasChanged) {
+        this.cache = tokenCache;
+        this.hasChanged = hasChanged;
+    }
+    /**
+     * boolean which indicates the changes in cache
+     */
+    get cacheHasChanged() {
+        return this.hasChanged;
+    }
+    /**
+     * function to retrieve the token cache
+     */
+    get tokenCache() {
+        return this.cache;
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * MSAL-defined interaction required error code indicating no tokens are found in cache.
- * @public
- */
-const noTokensFound = "no_tokens_found";
-/**
- * MSAL-defined error code indicating a native account is unavailable on the platform.
- * @public
- */
-const nativeAccountUnavailable = "native_account_unavailable";
-/**
- * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
- * @public
- */
-const refreshTokenExpired = "refresh_token_expired";
-/**
- * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
- * @public
- */
-const uxNotAllowed = "ux_not_allowed";
-/**
- * Server-originated error code indicating interaction is required to complete the request.
- * @public
- */
-const interactionRequired = "interaction_required";
-/**
- * Server-originated error code indicating user consent is required.
- * @public
- */
-const consentRequired = "consent_required";
-/**
- * Server-originated error code indicating user login is required.
- * @public
+ * Utility functions for managing date and time operations.
  */
-const loginRequired = "login_required";
 /**
- * Server-originated error code indicating the token is invalid or corrupted.
- * @public
+ * return the current time in Unix time (seconds).
  */
-const badToken = "bad_token";
+function nowSeconds() {
+    // Date.getTime() returns in milliseconds.
+    return Math.round(new Date().getTime() / 1000.0);
+}
 /**
- * Server-originated error code indicating the user is in an interrupted state and interaction is required.
- * @public
- */
-const interruptedUser = "interrupted_user";
-
-var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    badToken: badToken,
-    consentRequired: consentRequired,
-    interactionRequired: interactionRequired,
-    interruptedUser: interruptedUser,
-    loginRequired: loginRequired,
-    nativeAccountUnavailable: nativeAccountUnavailable,
-    noTokensFound: noTokensFound,
-    refreshTokenExpired: refreshTokenExpired,
-    uxNotAllowed: uxNotAllowed
-});
-
-/*! @azure/msal-common v16.4.0 2026-03-19 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
+ * Converts JS Date object to seconds
+ * @param date Date
  */
+function toSecondsFromDate(date) {
+    // Convert date to seconds
+    return date.getTime() / 1000;
+}
 /**
- * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
+ * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
+ * @param seconds
  */
-const InteractionRequiredServerErrorMessage = [
-    interactionRequired,
-    consentRequired,
-    loginRequired,
-    badToken,
-    uxNotAllowed,
-    interruptedUser,
-];
-const InteractionRequiredAuthSubErrorMessage = [
-    "message_only",
-    "additional_action",
-    "basic_action",
-    "user_password_expired",
-    "consent_required",
-    "bad_token",
-    "ux_not_allowed",
-    "interrupted_user",
-];
+function toDateFromSeconds(seconds) {
+    if (seconds) {
+        return new Date(Number(seconds) * 1000);
+    }
+    return new Date();
+}
 /**
- * Error thrown when user interaction is required.
+ * check if a token is expired based on given UTC time in seconds.
+ * @param expiresOn
  */
-class InteractionRequiredAuthError extends AuthError {
-    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
-        super(errorCode, errorMessage, subError);
-        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
-        this.timestamp = timestamp || "";
-        this.traceId = traceId || "";
-        this.correlationId = correlationId || "";
-        this.claims = claims || "";
-        this.name = "InteractionRequiredAuthError";
-        this.errorNo = errorNo;
-    }
+function isTokenExpired(expiresOn, offset) {
+    // check for access token expiry
+    const expirationSec = Number(expiresOn) || 0;
+    const offsetCurrentTimeSec = nowSeconds() + offset;
+    // If current time + offset is greater than token expiration time, then token is expired.
+    return offsetCurrentTimeSec > expirationSec;
 }
 /**
- * Helper function used to determine if an error thrown by the server requires interaction to resolve
- * @param errorCode
- * @param errorString
- * @param subError
+ * Checks if a cache entry is expired based on the last updated time and cache retention days.
+ * @param lastUpdatedAt
+ * @param cacheRetentionDays
+ * @returns
  */
-function isInteractionRequiredError(errorCode, errorString, subError) {
-    const isInteractionRequiredErrorCode = !!errorCode &&
-        InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
-    const isInteractionRequiredSubError = !!subError &&
-        InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
-    const isInteractionRequiredErrorDesc = !!errorString &&
-        InteractionRequiredServerErrorMessage.some((irErrorCode) => {
-            return errorString.indexOf(irErrorCode) > -1;
-        });
-    return (isInteractionRequiredErrorCode ||
-        isInteractionRequiredErrorDesc ||
-        isInteractionRequiredSubError);
+function isCacheExpired(lastUpdatedAt, cacheRetentionDays) {
+    const cacheExpirationTimestamp = Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1000;
+    return Date.now() > cacheExpirationTimestamp;
 }
 /**
- * Creates an InteractionRequiredAuthError
+ * If the current time is earlier than the time that a token was cached at, we must discard the token
+ * i.e. The system clock was turned back after acquiring the cached token
+ * @param cachedAt
+ * @param offset
  */
-function createInteractionRequiredAuthError(errorCode, errorMessage) {
-    return new InteractionRequiredAuthError(errorCode, errorMessage);
+function wasClockTurnedBack(cachedAt) {
+    const cachedAtSec = Number(cachedAt);
+    return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Appends user state with random guid, or returns random guid.
- * @param cryptoObj
- * @param userState
- * @param meta
+ * Create IdTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
  */
-function setRequestState(cryptoObj, userState, meta) {
-    const libraryState = generateLibraryState(cryptoObj, meta);
-    return userState
-        ? `${libraryState}${RESOURCE_DELIM}${userState}`
-        : libraryState;
+function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
+    const idTokenEntity = {
+        credentialType: CredentialType.ID_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: idToken,
+        realm: tenantId,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+    };
+    return idTokenEntity;
 }
 /**
- * Generates the state value used by the common library.
- * @param cryptoObj
- * @param meta
+ * Create AccessTokenEntity
+ * @param homeAccountId
+ * @param environment
+ * @param accessToken
+ * @param clientId
+ * @param tenantId
+ * @param scopes
+ * @param expiresOn
+ * @param extExpiresOn
  */
-function generateLibraryState(cryptoObj, meta) {
-    if (!cryptoObj) {
-        throw createClientAuthError(noCryptoObject);
-    }
-    // Create a state object containing a unique id and the timestamp of the request creation
-    const stateObj = {
-        id: cryptoObj.createNewGuid(),
+function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+    const atEntity = {
+        homeAccountId: homeAccountId,
+        credentialType: CredentialType.ACCESS_TOKEN,
+        secret: accessToken,
+        cachedAt: nowSeconds().toString(),
+        expiresOn: expiresOn.toString(),
+        extendedExpiresOn: extExpiresOn.toString(),
+        environment: environment,
+        clientId: clientId,
+        realm: tenantId,
+        target: scopes,
+        tokenType: tokenType || AuthenticationScheme$1.BEARER,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
     };
-    if (meta) {
-        stateObj.meta = meta;
+    if (userAssertionHash) {
+        atEntity.userAssertionHash = userAssertionHash;
     }
-    const stateString = JSON.stringify(stateObj);
-    return cryptoObj.base64Encode(stateString);
+    if (refreshOn) {
+        atEntity.refreshOn = refreshOn.toString();
+    }
+    /*
+     * Create Access Token With Auth Scheme instead of regular access token
+     * Cast to lower to handle "bearer" from ADFS
+     */
+    if (atEntity.tokenType?.toLowerCase() !==
+        AuthenticationScheme$1.BEARER.toLowerCase()) {
+        atEntity.credentialType =
+            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+        switch (atEntity.tokenType) {
+            case AuthenticationScheme$1.POP:
+                // Make sure keyId is present and add it to credential
+                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                if (!tokenClaims?.cnf?.kid) {
+                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                }
+                atEntity.keyId = tokenClaims.cnf.kid;
+                break;
+            case AuthenticationScheme$1.SSH:
+                atEntity.keyId = keyId;
+        }
+    }
+    return atEntity;
 }
 /**
- * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
- * @param base64Decode
- * @param state
+ * Create RefreshTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
  */
-function parseRequestState(base64Decode, state) {
-    if (!base64Decode) {
-        throw createClientAuthError(noCryptoObject);
+function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
+    const rtEntity = {
+        credentialType: CredentialType.REFRESH_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: refreshToken,
+        lastUpdatedAt: Date.now().toString(),
+    };
+    if (userAssertionHash) {
+        rtEntity.userAssertionHash = userAssertionHash;
     }
-    if (!state) {
-        throw createClientAuthError(invalidState);
+    if (familyId) {
+        rtEntity.familyId = familyId;
     }
-    try {
-        // Split the state between library state and user passed state and decode them separately
-        const splitState = state.split(RESOURCE_DELIM);
-        const libraryState = splitState[0];
-        const userState = splitState.length > 1
-            ? splitState.slice(1).join(RESOURCE_DELIM)
-            : "";
-        const libraryStateString = base64Decode(libraryState);
-        const libraryStateObj = JSON.parse(libraryStateString);
-        return {
-            userRequestState: userState || "",
-            libraryState: libraryStateObj,
-        };
+    if (expiresOn) {
+        rtEntity.expiresOn = expiresOn.toString();
     }
-    catch (e) {
-        throw createClientAuthError(invalidState);
+    return rtEntity;
+}
+function isCredentialEntity(entity) {
+    return (entity.hasOwnProperty("homeAccountId") &&
+        entity.hasOwnProperty("environment") &&
+        entity.hasOwnProperty("credentialType") &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("secret"));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAccessTokenEntity(entity) {
+    if (!entity) {
+        return false;
     }
-}
-
-/*! @azure/msal-common v16.4.0 2026-03-19 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
+    return (isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity.hasOwnProperty("target") &&
+        (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
+            entity["credentialType"] ===
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
  */
+function isIdTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity["credentialType"] === CredentialType.ID_TOKEN);
+}
 /**
- * Utility functions for managing date and time operations.
+ * Validates an entity: checks for all expected params
+ * @param entity
  */
+function isRefreshTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity["credentialType"] === CredentialType.REFRESH_TOKEN);
+}
 /**
- * return the current time in Unix time (seconds).
+ * validates if a given cache entry is "Telemetry", parses <key,value>
+ * @param key
+ * @param entity
  */
-function nowSeconds() {
-    // Date.getTime() returns in milliseconds.
-    return Math.round(new Date().getTime() / 1000.0);
+function isServerTelemetryEntity(key, entity) {
+    const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
+    let validateEntity = true;
+    if (entity) {
+        validateEntity =
+            entity.hasOwnProperty("failedRequests") &&
+                entity.hasOwnProperty("errors") &&
+                entity.hasOwnProperty("cacheHits");
+    }
+    return validateKey && validateEntity;
 }
 /**
- * Converts JS Date object to seconds
- * @param date Date
+ * validates if a given cache entry is "Throttling", parses <key,value>
+ * @param key
+ * @param entity
  */
-function toSecondsFromDate(date) {
-    // Convert date to seconds
-    return date.getTime() / 1000;
+function isThrottlingEntity(key, entity) {
+    let validateKey = false;
+    if (key) {
+        validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
+    }
+    let validateEntity = true;
+    if (entity) {
+        validateEntity = entity.hasOwnProperty("throttleTime");
+    }
+    return validateKey && validateEntity;
 }
 /**
- * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
- * @param seconds
+ * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
  */
-function toDateFromSeconds(seconds) {
-    if (seconds) {
-        return new Date(Number(seconds) * 1000);
+function generateAppMetadataKey({ environment, clientId, }) {
+    const appMetaDataKeyArray = [
+        APP_METADATA,
+        environment,
+        clientId,
+    ];
+    return appMetaDataKeyArray
+        .join(CACHE_KEY_SEPARATOR$1)
+        .toLowerCase();
+}
+/*
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAppMetadataEntity(key, entity) {
+    if (!entity) {
+        return false;
     }
-    return new Date();
+    return (key.indexOf(APP_METADATA) === 0 &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("environment"));
 }
 /**
- * check if a token is expired based on given UTC time in seconds.
- * @param expiresOn
+ * Validates an entity: checks for all expected params
+ * @param entity
  */
-function isTokenExpired(expiresOn, offset) {
-    // check for access token expiry
-    const expirationSec = Number(expiresOn) || 0;
-    const offsetCurrentTimeSec = nowSeconds() + offset;
-    // If current time + offset is greater than token expiration time, then token is expired.
-    return offsetCurrentTimeSec > expirationSec;
+function isAuthorityMetadataEntity(key, entity) {
+    if (!entity) {
+        return false;
+    }
+    return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
+        entity.hasOwnProperty("aliases") &&
+        entity.hasOwnProperty("preferred_cache") &&
+        entity.hasOwnProperty("preferred_network") &&
+        entity.hasOwnProperty("canonical_authority") &&
+        entity.hasOwnProperty("authorization_endpoint") &&
+        entity.hasOwnProperty("token_endpoint") &&
+        entity.hasOwnProperty("issuer") &&
+        entity.hasOwnProperty("aliasesFromNetwork") &&
+        entity.hasOwnProperty("endpointsFromNetwork") &&
+        entity.hasOwnProperty("expiresAt") &&
+        entity.hasOwnProperty("jwks_uri"));
 }
 /**
- * Checks if a cache entry is expired based on the last updated time and cache retention days.
- * @param lastUpdatedAt
- * @param cacheRetentionDays
- * @returns
+ * Reset the exiresAt value
  */
-function isCacheExpired(lastUpdatedAt, cacheRetentionDays) {
-    const cacheExpirationTimestamp = Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1000;
-    return Date.now() > cacheExpirationTimestamp;
+function generateAuthorityMetadataExpiresAt() {
+    return (nowSeconds() +
+        AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
+}
+function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
+    authorityMetadata.authorization_endpoint =
+        updatedValues.authorization_endpoint;
+    authorityMetadata.token_endpoint = updatedValues.token_endpoint;
+    authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
+    authorityMetadata.issuer = updatedValues.issuer;
+    authorityMetadata.endpointsFromNetwork = fromNetwork;
+    authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+}
+function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
+    authorityMetadata.aliases = updatedValues.aliases;
+    authorityMetadata.preferred_cache = updatedValues.preferred_cache;
+    authorityMetadata.preferred_network = updatedValues.preferred_network;
+    authorityMetadata.aliasesFromNetwork = fromNetwork;
 }
 /**
- * If the current time is earlier than the time that a token was cached at, we must discard the token
- * i.e. The system clock was turned back after acquiring the cached token
- * @param cachedAt
- * @param offset
+ * Returns whether or not the data needs to be refreshed
  */
-function wasClockTurnedBack(cachedAt) {
-    const cachedAtSec = Number(cachedAt);
-    return cachedAtSec > nowSeconds();
+function isAuthorityMetadataExpired(metadata) {
+    return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4056,7 +4124,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4149,7 +4217,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4229,293 +4297,226 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * This class instance helps track the memory changes facilitating
- * decisions to read from and write to the persistent cache
- */ class TokenCacheContext {
-    constructor(tokenCache, hasChanged) {
-        this.cache = tokenCache;
-        this.hasChanged = hasChanged;
-    }
-    /**
-     * boolean which indicates the changes in cache
-     */
-    get cacheHasChanged() {
-        return this.hasChanged;
-    }
-    /**
-     * function to retrieve the token cache
-     */
-    get tokenCache() {
-        return this.cache;
-    }
-}
-
-/*! @azure/msal-common v16.4.0 2026-03-19 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
+ * MSAL-defined interaction required error code indicating no tokens are found in cache.
+ * @public
  */
+const noTokensFound = "no_tokens_found";
 /**
- * Create IdTokenEntity
- * @param homeAccountId
- * @param authenticationResult
- * @param clientId
- * @param authority
+ * MSAL-defined error code indicating a native account is unavailable on the platform.
+ * @public
  */
-function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
-    const idTokenEntity = {
-        credentialType: CredentialType.ID_TOKEN,
-        homeAccountId: homeAccountId,
-        environment: environment,
-        clientId: clientId,
-        secret: idToken,
-        realm: tenantId,
-        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-    };
-    return idTokenEntity;
-}
+const nativeAccountUnavailable = "native_account_unavailable";
 /**
- * Create AccessTokenEntity
- * @param homeAccountId
- * @param environment
- * @param accessToken
- * @param clientId
- * @param tenantId
- * @param scopes
- * @param expiresOn
- * @param extExpiresOn
+ * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
+ * @public
  */
-function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
-    const atEntity = {
-        homeAccountId: homeAccountId,
-        credentialType: CredentialType.ACCESS_TOKEN,
-        secret: accessToken,
-        cachedAt: nowSeconds().toString(),
-        expiresOn: expiresOn.toString(),
-        extendedExpiresOn: extExpiresOn.toString(),
-        environment: environment,
-        clientId: clientId,
-        realm: tenantId,
-        target: scopes,
-        tokenType: tokenType || AuthenticationScheme$1.BEARER,
-        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-    };
-    if (userAssertionHash) {
-        atEntity.userAssertionHash = userAssertionHash;
-    }
-    if (refreshOn) {
-        atEntity.refreshOn = refreshOn.toString();
-    }
-    /*
-     * Create Access Token With Auth Scheme instead of regular access token
-     * Cast to lower to handle "bearer" from ADFS
-     */
-    if (atEntity.tokenType?.toLowerCase() !==
-        AuthenticationScheme$1.BEARER.toLowerCase()) {
-        atEntity.credentialType =
-            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-        switch (atEntity.tokenType) {
-            case AuthenticationScheme$1.POP:
-                // Make sure keyId is present and add it to credential
-                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
-                if (!tokenClaims?.cnf?.kid) {
-                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
-                }
-                atEntity.keyId = tokenClaims.cnf.kid;
-                break;
-            case AuthenticationScheme$1.SSH:
-                atEntity.keyId = keyId;
-        }
-    }
-    return atEntity;
-}
+const refreshTokenExpired = "refresh_token_expired";
 /**
- * Create RefreshTokenEntity
- * @param homeAccountId
- * @param authenticationResult
- * @param clientId
- * @param authority
+ * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
+ * @public
  */
-function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
-    const rtEntity = {
-        credentialType: CredentialType.REFRESH_TOKEN,
-        homeAccountId: homeAccountId,
-        environment: environment,
-        clientId: clientId,
-        secret: refreshToken,
-        lastUpdatedAt: Date.now().toString(),
-    };
-    if (userAssertionHash) {
-        rtEntity.userAssertionHash = userAssertionHash;
-    }
-    if (familyId) {
-        rtEntity.familyId = familyId;
-    }
-    if (expiresOn) {
-        rtEntity.expiresOn = expiresOn.toString();
-    }
-    return rtEntity;
-}
-function isCredentialEntity(entity) {
-    return (entity.hasOwnProperty("homeAccountId") &&
-        entity.hasOwnProperty("environment") &&
-        entity.hasOwnProperty("credentialType") &&
-        entity.hasOwnProperty("clientId") &&
-        entity.hasOwnProperty("secret"));
-}
+const uxNotAllowed = "ux_not_allowed";
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Server-originated error code indicating interaction is required to complete the request.
+ * @public
  */
-function isAccessTokenEntity(entity) {
-    if (!entity) {
-        return false;
-    }
-    return (isCredentialEntity(entity) &&
-        entity.hasOwnProperty("realm") &&
-        entity.hasOwnProperty("target") &&
-        (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
-            entity["credentialType"] ===
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
-}
+const interactionRequired = "interaction_required";
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Server-originated error code indicating user consent is required.
+ * @public
+ */
+const consentRequired = "consent_required";
+/**
+ * Server-originated error code indicating user login is required.
+ * @public
+ */
+const loginRequired = "login_required";
+/**
+ * Server-originated error code indicating the token is invalid or corrupted.
+ * @public
+ */
+const badToken = "bad_token";
+/**
+ * Server-originated error code indicating the user is in an interrupted state and interaction is required.
+ * @public
+ */
+const interruptedUser = "interrupted_user";
+
+var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    badToken: badToken,
+    consentRequired: consentRequired,
+    interactionRequired: interactionRequired,
+    interruptedUser: interruptedUser,
+    loginRequired: loginRequired,
+    nativeAccountUnavailable: nativeAccountUnavailable,
+    noTokensFound: noTokensFound,
+    refreshTokenExpired: refreshTokenExpired,
+    uxNotAllowed: uxNotAllowed
+});
+
+/*! @azure/msal-common v16.4.1 2026-04-01 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
  */
-function isIdTokenEntity(entity) {
-    if (!entity) {
-        return false;
-    }
-    return (isCredentialEntity(entity) &&
-        entity.hasOwnProperty("realm") &&
-        entity["credentialType"] === CredentialType.ID_TOKEN);
-}
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
  */
-function isRefreshTokenEntity(entity) {
-    if (!entity) {
-        return false;
-    }
-    return (isCredentialEntity(entity) &&
-        entity["credentialType"] === CredentialType.REFRESH_TOKEN);
-}
+const InteractionRequiredServerErrorMessage = [
+    interactionRequired,
+    consentRequired,
+    loginRequired,
+    badToken,
+    uxNotAllowed,
+    interruptedUser,
+];
+const InteractionRequiredAuthSubErrorMessage = [
+    "message_only",
+    "additional_action",
+    "basic_action",
+    "user_password_expired",
+    "consent_required",
+    "bad_token",
+    "ux_not_allowed",
+    "interrupted_user",
+];
 /**
- * validates if a given cache entry is "Telemetry", parses <key,value>
- * @param key
- * @param entity
+ * Error thrown when user interaction is required.
  */
-function isServerTelemetryEntity(key, entity) {
-    const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
-    let validateEntity = true;
-    if (entity) {
-        validateEntity =
-            entity.hasOwnProperty("failedRequests") &&
-                entity.hasOwnProperty("errors") &&
-                entity.hasOwnProperty("cacheHits");
+class InteractionRequiredAuthError extends AuthError {
+    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
+        super(errorCode, errorMessage, subError);
+        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
+        this.timestamp = timestamp || "";
+        this.traceId = traceId || "";
+        this.correlationId = correlationId || "";
+        this.claims = claims || "";
+        this.name = "InteractionRequiredAuthError";
+        this.errorNo = errorNo;
     }
-    return validateKey && validateEntity;
 }
 /**
- * validates if a given cache entry is "Throttling", parses <key,value>
- * @param key
- * @param entity
+ * Helper function used to determine if an error thrown by the server requires interaction to resolve
+ * @param errorCode
+ * @param errorString
+ * @param subError
  */
-function isThrottlingEntity(key, entity) {
-    let validateKey = false;
-    if (key) {
-        validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
-    }
-    let validateEntity = true;
-    if (entity) {
-        validateEntity = entity.hasOwnProperty("throttleTime");
-    }
-    return validateKey && validateEntity;
+function isInteractionRequiredError(errorCode, errorString, subError) {
+    const isInteractionRequiredErrorCode = !!errorCode &&
+        InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
+    const isInteractionRequiredSubError = !!subError &&
+        InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
+    const isInteractionRequiredErrorDesc = !!errorString &&
+        InteractionRequiredServerErrorMessage.some((irErrorCode) => {
+            return errorString.indexOf(irErrorCode) > -1;
+        });
+    return (isInteractionRequiredErrorCode ||
+        isInteractionRequiredErrorDesc ||
+        isInteractionRequiredSubError);
 }
 /**
- * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+ * Creates an InteractionRequiredAuthError
  */
-function generateAppMetadataKey({ environment, clientId, }) {
-    const appMetaDataKeyArray = [
-        APP_METADATA,
-        environment,
-        clientId,
-    ];
-    return appMetaDataKeyArray
-        .join(CACHE_KEY_SEPARATOR$1)
-        .toLowerCase();
-}
+function createInteractionRequiredAuthError(errorCode, errorMessage) {
+    return new InteractionRequiredAuthError(errorCode, errorMessage);
+}
+
+/*! @azure/msal-common v16.4.1 2026-04-01 */
+
 /*
- * Validates an entity: checks for all expected params
- * @param entity
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
  */
-function isAppMetadataEntity(key, entity) {
-    if (!entity) {
-        return false;
-    }
-    return (key.indexOf(APP_METADATA) === 0 &&
-        entity.hasOwnProperty("clientId") &&
-        entity.hasOwnProperty("environment"));
-}
 /**
- * Validates an entity: checks for all expected params
- * @param entity
+ * Error thrown when there is an error with the server code, for example, unavailability.
  */
-function isAuthorityMetadataEntity(key, entity) {
-    if (!entity) {
-        return false;
+class ServerError extends AuthError {
+    constructor(errorCode, errorMessage, subError, errorNo, status) {
+        super(errorCode, errorMessage, subError);
+        this.name = "ServerError";
+        this.errorNo = errorNo;
+        this.status = status;
+        Object.setPrototypeOf(this, ServerError.prototype);
     }
-    return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
-        entity.hasOwnProperty("aliases") &&
-        entity.hasOwnProperty("preferred_cache") &&
-        entity.hasOwnProperty("preferred_network") &&
-        entity.hasOwnProperty("canonical_authority") &&
-        entity.hasOwnProperty("authorization_endpoint") &&
-        entity.hasOwnProperty("token_endpoint") &&
-        entity.hasOwnProperty("issuer") &&
-        entity.hasOwnProperty("aliasesFromNetwork") &&
-        entity.hasOwnProperty("endpointsFromNetwork") &&
-        entity.hasOwnProperty("expiresAt") &&
-        entity.hasOwnProperty("jwks_uri"));
-}
+}
+
+/*! @azure/msal-common v16.4.1 2026-04-01 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
 /**
- * Reset the exiresAt value
+ * Appends user state with random guid, or returns random guid.
+ * @param cryptoObj
+ * @param userState
+ * @param meta
  */
-function generateAuthorityMetadataExpiresAt() {
-    return (nowSeconds() +
-        AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
-}
-function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
-    authorityMetadata.authorization_endpoint =
-        updatedValues.authorization_endpoint;
-    authorityMetadata.token_endpoint = updatedValues.token_endpoint;
-    authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
-    authorityMetadata.issuer = updatedValues.issuer;
-    authorityMetadata.endpointsFromNetwork = fromNetwork;
-    authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+function setRequestState(cryptoObj, userState, meta) {
+    const libraryState = generateLibraryState(cryptoObj, meta);
+    return userState
+        ? `${libraryState}${RESOURCE_DELIM}${userState}`
+        : libraryState;
 }
-function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
-    authorityMetadata.aliases = updatedValues.aliases;
-    authorityMetadata.preferred_cache = updatedValues.preferred_cache;
-    authorityMetadata.preferred_network = updatedValues.preferred_network;
-    authorityMetadata.aliasesFromNetwork = fromNetwork;
+/**
+ * Generates the state value used by the common library.
+ * @param cryptoObj
+ * @param meta
+ */
+function generateLibraryState(cryptoObj, meta) {
+    if (!cryptoObj) {
+        throw createClientAuthError(noCryptoObject);
+    }
+    // Create a state object containing a unique id and the timestamp of the request creation
+    const stateObj = {
+        id: cryptoObj.createNewGuid(),
+    };
+    if (meta) {
+        stateObj.meta = meta;
+    }
+    const stateString = JSON.stringify(stateObj);
+    return cryptoObj.base64Encode(stateString);
 }
 /**
- * Returns whether or not the data needs to be refreshed
+ * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
+ * @param base64Decode
+ * @param state
  */
-function isAuthorityMetadataExpired(metadata) {
-    return metadata.expiresAt <= nowSeconds();
+function parseRequestState(base64Decode, state) {
+    if (!base64Decode) {
+        throw createClientAuthError(noCryptoObject);
+    }
+    if (!state) {
+        throw createClientAuthError(invalidState);
+    }
+    try {
+        // Split the state between library state and user passed state and decode them separately
+        const splitState = state.split(RESOURCE_DELIM);
+        const libraryState = splitState[0];
+        const userState = splitState.length > 1
+            ? splitState.slice(1).join(RESOURCE_DELIM)
+            : "";
+        const libraryStateString = base64Decode(libraryState);
+        const libraryStateObj = JSON.parse(libraryStateString);
+        return {
+            userRequestState: userState || "",
+            libraryState: libraryStateObj,
+        };
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState);
+    }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4671,7 +4672,7 @@ class ResponseHandler {
         if (serverTokenResponse.id_token && !!idTokenClaims) {
             cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
             cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
-            this.logger);
+            this.logger, this.performanceClient);
         }
         // AccessToken
         let cachedAccessToken = null;
@@ -4822,17 +4823,24 @@ class ResponseHandler {
         };
     }
 }
-function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
     logger?.verbose("09jz0t", correlationId);
-    // Check if base account is already cached
-    const accountKeys = cacheStorage.getAccountKeys();
-    const baseAccountKey = accountKeys.find((accountKey) => {
-        return accountKey.startsWith(homeAccountId);
-    });
-    let cachedAccount = null;
-    if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId);
+    /*
+     * Check if base account is already cached. Filter by homeAccountId (identifies
+     * the user's home identity) and environment (identifies the cloud) — the two
+     * tenant-agnostic properties that uniquely locate a base AccountEntity.
+     */
+    const accountEnvironment = environment || authority.getPreferredCache();
+    const matchedAccounts = cacheStorage.getAccountsFilteredBy({ homeAccountId, environment: accountEnvironment }, correlationId);
+    performanceClient?.addFields({ cacheMatchedAccounts: matchedAccounts.length }, correlationId);
+    if (matchedAccounts.length > 1) {
+        /*
+         * Base accounts are expected to be unique for a given homeAccountId in normal cache usage.
+         * If multiple matches exist, ignore the cache hit rather than arbitrarily choosing one.
+         */
+        logger?.warning("0x7ad1", correlationId);
     }
+    const cachedAccount = matchedAccounts.length === 1 ? matchedAccounts[0] : null;
     const baseAccount = cachedAccount ||
         createAccountEntity({
             homeAccountId,
@@ -4856,7 +4864,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4866,7 +4874,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4884,7 +4892,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4905,7 +4913,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4991,7 +4999,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5022,7 +5030,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5136,7 +5144,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5148,7 +5156,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5158,7 +5166,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5168,7 +5176,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5273,7 +5281,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6093,7 +6101,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6127,7 +6135,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6388,7 +6396,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6613,7 +6621,7 @@ class RefreshTokenClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6729,7 +6737,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6744,7 +6752,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6971,7 +6979,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7004,7 +7012,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7062,7 +7070,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7079,7 +7087,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7340,7 +7348,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7361,7 +7369,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7369,7 +7377,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7409,7 +7417,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v16.4.0 2026-03-19 */
+/*! @azure/msal-common v16.4.1 2026-04-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7939,6 +7947,136 @@ class PerformanceClient {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * acquireTokenFromCache (msal-browser).
+ * Internal API for acquiring token from cache
+ */
+const AcquireTokenFromCache = "acquireTokenFromCache";
+/**
+ * acquireTokenByRefreshToken API (msal-browser and msal-node).
+ * Used to renew an access token using a refresh token against the token endpoint.
+ */
+const AcquireTokenByRefreshToken = "acquireTokenByRefreshToken";
+/**
+ * acquireTokenSilentAsync (msal-browser).
+ * Internal API for acquireTokenSilent.
+ */
+const AcquireTokenSilentAsync = "acquireTokenSilentAsync";
+/**
+ * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
+ * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
+ */
+const CryptoOptsGetPublicKeyThumbprint = "cryptoOptsGetPublicKeyThumbprint";
+/**
+ * signJwt API in CryptoOpts class (msal-browser).
+ * Used to signed a pop token.
+ */
+const CryptoOptsSignJwt = "cryptoOptsSignJwt";
+/**
+ * acquireToken API in the SilentCacheClient class (msal-browser).
+ * Used to read access tokens from the cache.
+ */
+const SilentCacheClientAcquireToken = "silentCacheClientAcquireToken";
+/**
+ * acquireToken API in the SilentIframeClient class (msal-browser).
+ * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
+ */
+const SilentIframeClientAcquireToken = "silentIframeClientAcquireToken";
+const AwaitConcurrentIframe = "awaitConcurrentIframe"; // Time spent waiting for a concurrent iframe to complete
+/**
+ * acquireToken API in SilentRereshClient (msal-browser).
+ * Used to acquire a new set of tokens from the token endpoint using a refresh token.
+ */
+const SilentRefreshClientAcquireToken = "silentRefreshClientAcquireToken";
+/**
+ * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
+ * Used to load authority metadata for a request.
+ */
+const StandardInteractionClientGetDiscoveredAuthority = "standardInteractionClientGetDiscoveredAuthority";
+/**
+ * acquireToken API in NativeInteractionClient class (msal-browser).
+ * Used to acquire a token from Native component when native brokering is enabled.
+ */
+const NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
+/**
+ * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
+ */
+const RefreshTokenClientAcquireTokenByRefreshToken = "refreshTokenClientAcquireTokenByRefreshToken";
+/**
+ * acquireTokenBySilentIframe (msal-browser).
+ * Internal API for acquiring token by silent Iframe
+ */
+const AcquireTokenBySilentIframe = "acquireTokenBySilentIframe";
+/**
+ * Internal API for initializing base request in BaseInteractionClient (msal-browser)
+ */
+const InitializeBaseRequest = "initializeBaseRequest";
+/**
+ * Internal API for initializing silent request in SilentCacheClient (msal-browser)
+ */
+const InitializeSilentRequest = "initializeSilentRequest";
+const InitializeCache = "initializeCache";
+/**
+ * Helper function in SilentIframeClient class (msal-browser).
+ */
+const SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
+/**
+ * SilentHandler
+ */
+const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
+const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
+const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
+/**
+ * Helper functions in StandardInteractionClient class (msal-browser)
+ */
+const StandardInteractionClientCreateAuthCodeClient = "standardInteractionClientCreateAuthCodeClient";
+const StandardInteractionClientGetClientConfiguration = "standardInteractionClientGetClientConfiguration";
+const StandardInteractionClientInitializeAuthorizationRequest = "standardInteractionClientInitializeAuthorizationRequest";
+const SilentFlowClientAcquireCachedToken = "silentFlowClientAcquireCachedToken";
+const GetStandardParams = "getStandardParams";
+const HandleCodeResponse = "handleCodeResponse";
+const HandleResponseEar = "handleResponseEar";
+const HandleResponsePlatformBroker = "handleResponsePlatformBroker";
+const HandleResponseCode = "handleResponseCode";
+const AuthClientAcquireToken = "authClientAcquireToken";
+const DeserializeResponse = "deserializeResponse";
+const AuthorityFactoryCreateDiscoveredInstance = "authorityFactoryCreateDiscoveredInstance";
+const AcquireTokenByCodeAsync = "acquireTokenByCodeAsync";
+const HandleRedirectPromiseMeasurement = "handleRedirectPromise";
+const HandleNativeRedirectPromiseMeasurement = "handleNativeRedirectPromise";
+const NativeMessageHandlerHandshake = "nativeMessageHandlerHandshake";
+const RemoveHiddenIframe = "removeHiddenIframe";
+const ImportExistingCache = "importExistingCache";
+/**
+ * Crypto Operations
+ */
+const GeneratePkceCodes = "generatePkceCodes";
+const GenerateCodeVerifier = "generateCodeVerifier";
+const GenerateCodeChallengeFromVerifier = "generateCodeChallengeFromVerifier";
+const Sha256Digest = "sha256Digest";
+const GetRandomValues = "getRandomValues";
+const GenerateHKDF = "generateHKDF";
+const GenerateBaseKey = "generateBaseKey";
+const Base64Decode = "base64Decode";
+const UrlEncodeArr = "urlEncodeArr";
+const Encrypt = "encrypt";
+const Decrypt = "decrypt";
+const GenerateEarKey = "generateEarKey";
+const DecryptEarResponse = "decryptEarResponse";
+const LoadAccount = "loadAccount";
+const LoadIdToken = "loadIdToken";
+const LoadAccessToken = "loadAccessToken";
+const LoadRefreshToken = "loadRefreshToken";
+/**
+ * Background telemetry measurement that tracks whether a late bridge response
+ * arrives after the iframe timeout has already fired.
+ */
+const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8845,20 +8983,35 @@ function cancelPendingBridgeResponse(logger, correlationId) {
         activeBridgeMonitor = null;
     }
 }
-async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient) {
+async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient, experimentalConfig) {
     return new Promise((resolve, reject) => {
         logger.verbose("1rf6em", request.correlationId);
         const correlationId = request.correlationId;
         performanceClient.addFields({
             redirectBridgeTimeoutMs: timeoutMs,
+            lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false,
         }, correlationId);
         const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
         const channel = new BroadcastChannel(libraryState.id);
         let responseString = undefined;
+        let timedOut$1 = false;
+        let lateTimeoutId;
+        let lateMeasurement;
         const timeoutId = window.setTimeout(() => {
             // Clear the active monitor
             activeBridgeMonitor = null;
-            channel.close();
+            if (experimentalConfig?.iframeTimeoutTelemetry) {
+                lateMeasurement = performanceClient.startMeasurement(WaitForBridgeLateResponse, correlationId);
+                timedOut$1 = true;
+                lateTimeoutId = window.setTimeout(() => {
+                    lateMeasurement?.end({ success: false });
+                    clearTimeout(lateTimeoutId);
+                    channel.close();
+                }, 60000); // 60s late response timeout to allow for telemetry of late responses
+            }
+            else {
+                channel.close();
+            }
             reject(createBrowserAuthError(timedOut, "redirect_bridge_timeout"));
         }, timeoutMs);
         // Track this monitor so it can be cancelled if needed
@@ -8872,6 +9025,14 @@ async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request,
             const messageVersion = event?.data && typeof event.data.v === "number"
                 ? event.data.v
                 : undefined;
+            if (timedOut$1) {
+                lateMeasurement?.end({
+                    success: responseString ? true : false,
+                });
+                clearTimeout(lateTimeoutId);
+                channel.close();
+                return;
+            }
             performanceClient.addFields({
                 redirectBridgeMessageVersion: messageVersion,
             }, correlationId);
@@ -9034,130 +9195,6 @@ var BrowserUtils = /*#__PURE__*/Object.freeze({
     waitForBridgeResponse: waitForBridgeResponse
 });
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * acquireTokenFromCache (msal-browser).
- * Internal API for acquiring token from cache
- */
-const AcquireTokenFromCache = "acquireTokenFromCache";
-/**
- * acquireTokenByRefreshToken API (msal-browser and msal-node).
- * Used to renew an access token using a refresh token against the token endpoint.
- */
-const AcquireTokenByRefreshToken = "acquireTokenByRefreshToken";
-/**
- * acquireTokenSilentAsync (msal-browser).
- * Internal API for acquireTokenSilent.
- */
-const AcquireTokenSilentAsync = "acquireTokenSilentAsync";
-/**
- * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
- * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
- */
-const CryptoOptsGetPublicKeyThumbprint = "cryptoOptsGetPublicKeyThumbprint";
-/**
- * signJwt API in CryptoOpts class (msal-browser).
- * Used to signed a pop token.
- */
-const CryptoOptsSignJwt = "cryptoOptsSignJwt";
-/**
- * acquireToken API in the SilentCacheClient class (msal-browser).
- * Used to read access tokens from the cache.
- */
-const SilentCacheClientAcquireToken = "silentCacheClientAcquireToken";
-/**
- * acquireToken API in the SilentIframeClient class (msal-browser).
- * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
- */
-const SilentIframeClientAcquireToken = "silentIframeClientAcquireToken";
-const AwaitConcurrentIframe = "awaitConcurrentIframe"; // Time spent waiting for a concurrent iframe to complete
-/**
- * acquireToken API in SilentRereshClient (msal-browser).
- * Used to acquire a new set of tokens from the token endpoint using a refresh token.
- */
-const SilentRefreshClientAcquireToken = "silentRefreshClientAcquireToken";
-/**
- * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
- * Used to load authority metadata for a request.
- */
-const StandardInteractionClientGetDiscoveredAuthority = "standardInteractionClientGetDiscoveredAuthority";
-/**
- * acquireToken API in NativeInteractionClient class (msal-browser).
- * Used to acquire a token from Native component when native brokering is enabled.
- */
-const NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
-/**
- * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
- */
-const RefreshTokenClientAcquireTokenByRefreshToken = "refreshTokenClientAcquireTokenByRefreshToken";
-/**
- * acquireTokenBySilentIframe (msal-browser).
- * Internal API for acquiring token by silent Iframe
- */
-const AcquireTokenBySilentIframe = "acquireTokenBySilentIframe";
-/**
- * Internal API for initializing base request in BaseInteractionClient (msal-browser)
- */
-const InitializeBaseRequest = "initializeBaseRequest";
-/**
- * Internal API for initializing silent request in SilentCacheClient (msal-browser)
- */
-const InitializeSilentRequest = "initializeSilentRequest";
-const InitializeCache = "initializeCache";
-/**
- * Helper function in SilentIframeClient class (msal-browser).
- */
-const SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
-/**
- * SilentHandler
- */
-const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
-const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
-const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
-/**
- * Helper functions in StandardInteractionClient class (msal-browser)
- */
-const StandardInteractionClientCreateAuthCodeClient = "standardInteractionClientCreateAuthCodeClient";
-const StandardInteractionClientGetClientConfiguration = "standardInteractionClientGetClientConfiguration";
-const StandardInteractionClientInitializeAuthorizationRequest = "standardInteractionClientInitializeAuthorizationRequest";
-const SilentFlowClientAcquireCachedToken = "silentFlowClientAcquireCachedToken";
-const GetStandardParams = "getStandardParams";
-const HandleCodeResponse = "handleCodeResponse";
-const HandleResponseEar = "handleResponseEar";
-const HandleResponsePlatformBroker = "handleResponsePlatformBroker";
-const HandleResponseCode = "handleResponseCode";
-const AuthClientAcquireToken = "authClientAcquireToken";
-const DeserializeResponse = "deserializeResponse";
-const AuthorityFactoryCreateDiscoveredInstance = "authorityFactoryCreateDiscoveredInstance";
-const AcquireTokenByCodeAsync = "acquireTokenByCodeAsync";
-const HandleRedirectPromiseMeasurement = "handleRedirectPromise";
-const HandleNativeRedirectPromiseMeasurement = "handleNativeRedirectPromise";
-const NativeMessageHandlerHandshake = "nativeMessageHandlerHandshake";
-const ImportExistingCache = "importExistingCache";
-/**
- * Crypto Operations
- */
-const GeneratePkceCodes = "generatePkceCodes";
-const GenerateCodeVerifier = "generateCodeVerifier";
-const GenerateCodeChallengeFromVerifier = "generateCodeChallengeFromVerifier";
-const Sha256Digest = "sha256Digest";
-const GetRandomValues = "getRandomValues";
-const GenerateHKDF = "generateHKDF";
-const GenerateBaseKey = "generateBaseKey";
-const Base64Decode = "base64Decode";
-const UrlEncodeArr = "urlEncodeArr";
-const Encrypt = "encrypt";
-const Decrypt = "decrypt";
-const GenerateEarKey = "generateEarKey";
-const DecryptEarResponse = "decryptEarResponse";
-const LoadAccount = "loadAccount";
-const LoadIdToken = "loadIdToken";
-const LoadAccessToken = "loadAccessToken";
-const LoadRefreshToken = "loadRefreshToken";
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -10294,7 +10331,7 @@ const EventType = {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.6.1";
+const version = "5.6.3";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12758,9 +12795,9 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         }
         // Get the preferred_cache domain for the given authority
         const authority = await getDiscoveredAuthority(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, request.authority);
-        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, undefined, // environment
+        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, authority.getPreferredCache(), // environment
         idTokenClaims.tid, undefined, // auth code payload
-        response.account.id);
+        response.account.id, this.logger, this.performanceClient);
         // Ensure expires_in is in number format
         response.expires_in = Number(response.expires_in);
         // generate authenticationResult
@@ -13645,7 +13682,7 @@ const DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS = 2000;
  *
  * @returns Configuration object
  */
-function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system: userInputSystem, telemetry: userInputTelemetry, }, isBrowserEnvironment) {
+function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system: userInputSystem, experimental: userInputExperimental, telemetry: userInputTelemetry, }, isBrowserEnvironment) {
     // Default auth options for browser
     const DEFAULT_AUTH_OPTIONS = {
         clientId: "",
@@ -13717,6 +13754,9 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         },
         client: new StubPerformanceClient(),
     };
+    const DEFAULT_EXPERIMENTAL_OPTIONS = {
+        iframeTimeoutTelemetry: false,
+    };
     // Throw an error if user has set OIDCOptions without being in OIDC protocol mode
     if (userInputSystem?.protocolMode !== ProtocolMode.OIDC &&
         userInputAuth?.OIDCOptions) {
@@ -13740,6 +13780,10 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         },
         cache: { ...DEFAULT_CACHE_OPTIONS, ...userInputCache },
         system: providedSystemOptions,
+        experimental: {
+            ...DEFAULT_EXPERIMENTAL_OPTIONS,
+            ...userInputExperimental,
+        },
         telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...userInputTelemetry },
     };
     return overlayedConfig;
@@ -15156,6 +15200,16 @@ function createHiddenIframe() {
     authFrame.setAttribute("allow", "local-network-access *");
     document.body.appendChild(authFrame);
     return authFrame;
+}
+/**
+ * @hidden
+ * Removes a hidden iframe from `document.body` if it is a direct child.
+ * @param iframe - The iframe element to remove.
+ */
+function removeHiddenIframe(iframe) {
+    if (document.body === iframe.parentNode) {
+        document.body.removeChild(iframe);
+    }
 }
 
 /*
@@ -15251,9 +15305,15 @@ class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+        const iframe = await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
         const responseType = this.config.auth.OIDCOptions.responseMode;
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+        let responseString;
+        try {
+            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+        }
+        finally {
+            invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
+        }
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             // If server doesn't support EAR, they may fallback to auth code flow instead
@@ -15291,18 +15351,25 @@ class SilentIframeClient extends StandardInteractionClient {
             ...request,
             codeChallenge: pkceCodes.challenge,
         };
+        let iframe;
         if (request.httpMethod === HttpMethod.POST) {
-            await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+            iframe = await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
         }
         else {
             // Create authorize request url
             const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
             // Get the frame handle for the silent request
-            await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId);
+            iframe = await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId);
         }
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+        let responseString;
+        try {
+            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+        }
+        finally {
+            invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
+        }
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
@@ -15558,22 +15625,32 @@ class StandardController {
         this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient, this.eventHandler);
         this.activeSilentTokenRequests = new Map();
         // Register listener functions
-        this.trackPageVisibility = this.trackPageVisibility.bind(this);
+        this.trackStateChange = this.trackStateChange.bind(this);
         // Register listener functions
-        this.trackPageVisibilityWithMeasurement =
-            this.trackPageVisibilityWithMeasurement.bind(this);
+        this.trackStateChangeWithMeasurement =
+            this.trackStateChangeWithMeasurement.bind(this);
     }
     static async createController(operatingContext, request) {
         const controller = new StandardController(operatingContext);
         await controller.initialize(request);
         return controller;
     }
-    trackPageVisibility(correlationId) {
+    trackStateChange(correlationId, event) {
         if (!correlationId) {
             return;
         }
-        this.logger.info("16v6hv", correlationId);
-        this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        if (event.type === "visibilitychange") {
+            this.logger.info("16v6hv", correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "online") {
+            this.logger.info("0zirfd", correlationId);
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "offline") {
+            this.logger.info("1xk9ef", correlationId);
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -15915,15 +15992,40 @@ class StandardController {
             }
         });
     }
-    trackPageVisibilityWithMeasurement() {
+    trackStateChangeWithMeasurement(event) {
         const measurement = this.ssoSilentMeasurement ||
             this.acquireTokenByCodeAsyncMeasurement;
         if (!measurement) {
             return;
         }
-        measurement.increment({
-            visibilityChangeCount: 1,
-        });
+        if (event.type === "visibilitychange") {
+            this.logger.info("0yzimq", measurement.event.correlationId);
+            measurement.increment({
+                visibilityChangeCount: 1,
+            });
+        }
+        else if (event.type === "online") {
+            this.logger.info("1caf53", measurement.event.correlationId);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+        else if (event.type === "offline") {
+            this.logger.info("0fdyk7", measurement.event.correlationId);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+    }
+    addStateChangeListeners(listener) {
+        document.addEventListener("visibilitychange", listener);
+        window.addEventListener("online", listener);
+        window.addEventListener("offline", listener);
+    }
+    removeStateChangeListeners(listener) {
+        document.removeEventListener("visibilitychange", listener);
+        window.removeEventListener("online", listener);
+        window.removeEventListener("offline", listener);
     }
     // #endregion
     // #region Silent Flow
@@ -15957,8 +16059,9 @@ class StandardController {
         preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const loggedInAccounts = this.getAllAccounts();
         this.logger.verbose("0w1b45", correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Silent, validRequest);
@@ -16001,7 +16104,7 @@ class StandardController {
             throw e;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
     }
     /**
@@ -16108,8 +16211,9 @@ class StandardController {
             this.performanceClient.startMeasurement(AcquireTokenByCodeAsync, correlationId);
         this.acquireTokenByCodeAsyncMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const silentAuthCodeClient = this.createSilentAuthCodeClient(correlationId);
         const silentTokenResult = await silentAuthCodeClient
             .acquireToken(request)
@@ -16128,7 +16232,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
         return silentTokenResult;
     }
@@ -16590,12 +16694,12 @@ class StandardController {
      * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
      */
     async acquireTokenSilentAsync(request, account) {
-        const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+        const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, request.correlationId, exports.InteractionType.Silent, request);
         if (request.correlationId) {
-            this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
         }
-        document.addEventListener("visibilitychange", trackPageVisibility);
+        this.addStateChangeListeners(trackStateChange);
         const silentRequest = await invokeAsync(initializeSilentRequest, InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
         const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
         const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
@@ -16677,7 +16781,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", trackPageVisibility);
+            this.removeStateChangeListeners(trackStateChange);
         });
     }
     /**
@@ -18277,7 +18381,7 @@ async function loadExternalTokens(config, request, response, options, performanc
         const storage = new BrowserCacheManager(browserConfig.auth.clientId, browserConfig.cache, cryptoOps, logger, browserConfig.telemetry.client, new EventHandler(logger), buildStaticAuthorityOptions(browserConfig.auth));
         const authorityString = request.authority || browserConfig.auth.authority;
         const authority = await createDiscoveredInstance(Authority.generateAuthority(authorityString, request.azureCloudOptions), browserConfig.system.networkClient, storage, authorityOptions, logger, correlationId, performanceClient);
-        const cacheRecordAccount = await invokeAsync(loadAccount, LoadAccount, logger, performanceClient, correlationId)(request, options.clientInfo || response.client_info || "", correlationId, storage, logger, cryptoOps, authority, idTokenClaims);
+        const cacheRecordAccount = await invokeAsync(loadAccount, LoadAccount, logger, performanceClient, correlationId)(request, options.clientInfo || response.client_info || "", correlationId, storage, logger, cryptoOps, authority, idTokenClaims, performanceClient);
         const idToken = await invokeAsync(loadIdToken, LoadIdToken, logger, performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, kmsi, correlationId, storage, logger, config.auth.clientId);
         const accessToken = await invokeAsync(loadAccessToken, LoadAccessToken, logger, performanceClient, correlationId)(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, kmsi, options, correlationId, storage, logger, config.auth.clientId);
         const refreshToken = await invokeAsync(loadRefreshToken, LoadRefreshToken, logger, performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, kmsi, correlationId, storage, logger, config.auth.clientId, performanceClient);
@@ -18303,7 +18407,7 @@ async function loadExternalTokens(config, request, response, options, performanc
  * @param requestHomeAccountId
  * @returns `AccountEntity`
  */
-async function loadAccount(request, clientInfo, correlationId, storage, logger, cryptoObj, authority, idTokenClaims) {
+async function loadAccount(request, clientInfo, correlationId, storage, logger, cryptoObj, authority, idTokenClaims, performanceClient) {
     logger.verbose("0ke46k", correlationId);
     if (request.account) {
         const accountEntity = createAccountEntityFromAccountInfo(request.account);
@@ -18318,7 +18422,7 @@ async function loadAccount(request, clientInfo, correlationId, storage, logger,
     const claimsTenantId = idTokenClaims?.tid;
     const cachedAccount = buildAccountToCache(storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.getPreferredCache(), claimsTenantId, undefined, // authCodePayload
     undefined, // nativeAccountId
-    logger);
+    logger, performanceClient);
     await storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}), ApiId.loadExternalTokens);
     return cachedAccount;
 }
@@ -18590,6 +18694,9 @@ class BrowserPerformanceClient extends PerformanceClient {
     getPageVisibility() {
         return document.visibilityState?.toString() || null;
     }
+    getOnlineStatus() {
+        return typeof navigator !== "undefined" ? navigator.onLine : null;
+    }
     deleteIncompleteSubMeasurements(inProgressEvent) {
         void getPerfMeasurementModule()?.then((module) => {
             const rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
@@ -18616,6 +18723,7 @@ class BrowserPerformanceClient extends PerformanceClient {
     startMeasurement(measureName, correlationId) {
         // Capture page visibilityState and then invoke start/end measurement
         const startPageVisibility = this.getPageVisibility();
+        const startOnlineStatus = this.getOnlineStatus();
         const inProgressEvent = super.startMeasurement(measureName, correlationId);
         const startTime = supportsBrowserPerformanceNow()
             ? window.performance.now()
@@ -18631,6 +18739,7 @@ class BrowserPerformanceClient extends PerformanceClient {
                 const res = inProgressEvent.end({
                     ...event,
                     startPageVisibility,
+                    startOnlineStatus,
                     endPageVisibility: this.getPageVisibility(),
                     durationMs: getPerfDurationMs(startTime),
                     networkEffectiveType: networkInfo.effectiveType,