@azure/msal-browser 5.6.1 → 5.6.3

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.6.1 2026-03-19 */
+/*! @azure/msal-browser v5.6.3 2026-04-01 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -238,7 +238,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -290,7 +290,7 @@
     const RESOURCE = "resource";
     const CLI_DATA = "clidata";
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -321,7 +321,7 @@
         return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -341,7 +341,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -421,7 +421,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -444,7 +444,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -498,7 +498,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -586,7 +586,7 @@
         userCanceled: userCanceled
     });
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -781,7 +781,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1159,7 +1159,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1268,7 +1268,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1307,7 +1307,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1582,12 +1582,12 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "16.4.0";
+    const version$1 = "16.4.1";
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1607,7 +1607,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1689,7 +1689,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1769,7 +1769,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1926,7 +1926,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2083,7 +2083,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2091,7 +2091,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2129,7 +2129,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2167,7 +2167,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2182,7 +2182,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2204,7 +2204,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2228,7 +2228,7 @@
         EAR: "EAR",
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -2403,7 +2403,7 @@
             entity.hasOwnProperty("authorityType"));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3505,7 +3505,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3550,12 +3550,13 @@
         "currRefreshCount",
         "expiredCacheRemovedCount",
         "upgradedCacheCount",
+        "cacheMatchedAccounts",
         "networkRtt",
         "redirectBridgeTimeoutMs",
         "redirectBridgeMessageVersion",
     ]);
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3610,7 +3611,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3705,291 +3706,358 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
-
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     /**
-     * Error thrown when there is an error with the server code, for example, unavailability.
-     */
-    class ServerError extends AuthError {
-        constructor(errorCode, errorMessage, subError, errorNo, status) {
-            super(errorCode, errorMessage, subError);
-            this.name = "ServerError";
-            this.errorNo = errorNo;
-            this.status = status;
-            Object.setPrototypeOf(this, ServerError.prototype);
+     * This class instance helps track the memory changes facilitating
+     * decisions to read from and write to the persistent cache
+     */ class TokenCacheContext {
+        constructor(tokenCache, hasChanged) {
+            this.cache = tokenCache;
+            this.hasChanged = hasChanged;
+        }
+        /**
+         * boolean which indicates the changes in cache
+         */
+        get cacheHasChanged() {
+            return this.hasChanged;
+        }
+        /**
+         * function to retrieve the token cache
+         */
+        get tokenCache() {
+            return this.cache;
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     /**
-     * MSAL-defined interaction required error code indicating no tokens are found in cache.
-     * @public
-     */
-    const noTokensFound = "no_tokens_found";
-    /**
-     * MSAL-defined error code indicating a native account is unavailable on the platform.
-     * @public
-     */
-    const nativeAccountUnavailable = "native_account_unavailable";
-    /**
-     * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
-     * @public
-     */
-    const refreshTokenExpired = "refresh_token_expired";
-    /**
-     * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
-     * @public
-     */
-    const uxNotAllowed = "ux_not_allowed";
-    /**
-     * Server-originated error code indicating interaction is required to complete the request.
-     * @public
-     */
-    const interactionRequired = "interaction_required";
-    /**
-     * Server-originated error code indicating user consent is required.
-     * @public
-     */
-    const consentRequired = "consent_required";
-    /**
-     * Server-originated error code indicating user login is required.
-     * @public
+     * Utility functions for managing date and time operations.
      */
-    const loginRequired = "login_required";
     /**
-     * Server-originated error code indicating the token is invalid or corrupted.
-     * @public
+     * return the current time in Unix time (seconds).
      */
-    const badToken = "bad_token";
+    function nowSeconds() {
+        // Date.getTime() returns in milliseconds.
+        return Math.round(new Date().getTime() / 1000.0);
+    }
     /**
-     * Server-originated error code indicating the user is in an interrupted state and interaction is required.
-     * @public
-     */
-    const interruptedUser = "interrupted_user";
-
-    var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
-        __proto__: null,
-        badToken: badToken,
-        consentRequired: consentRequired,
-        interactionRequired: interactionRequired,
-        interruptedUser: interruptedUser,
-        loginRequired: loginRequired,
-        nativeAccountUnavailable: nativeAccountUnavailable,
-        noTokensFound: noTokensFound,
-        refreshTokenExpired: refreshTokenExpired,
-        uxNotAllowed: uxNotAllowed
-    });
-
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
+     * Converts JS Date object to seconds
+     * @param date Date
      */
+    function toSecondsFromDate(date) {
+        // Convert date to seconds
+        return date.getTime() / 1000;
+    }
     /**
-     * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
+     * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
+     * @param seconds
      */
-    const InteractionRequiredServerErrorMessage = [
-        interactionRequired,
-        consentRequired,
-        loginRequired,
-        badToken,
-        uxNotAllowed,
-        interruptedUser,
-    ];
-    const InteractionRequiredAuthSubErrorMessage = [
-        "message_only",
-        "additional_action",
-        "basic_action",
-        "user_password_expired",
-        "consent_required",
-        "bad_token",
-        "ux_not_allowed",
-        "interrupted_user",
-    ];
+    function toDateFromSeconds(seconds) {
+        if (seconds) {
+            return new Date(Number(seconds) * 1000);
+        }
+        return new Date();
+    }
     /**
-     * Error thrown when user interaction is required.
+     * check if a token is expired based on given UTC time in seconds.
+     * @param expiresOn
      */
-    class InteractionRequiredAuthError extends AuthError {
-        constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
-            super(errorCode, errorMessage, subError);
-            Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
-            this.timestamp = timestamp || "";
-            this.traceId = traceId || "";
-            this.correlationId = correlationId || "";
-            this.claims = claims || "";
-            this.name = "InteractionRequiredAuthError";
-            this.errorNo = errorNo;
-        }
+    function isTokenExpired(expiresOn, offset) {
+        // check for access token expiry
+        const expirationSec = Number(expiresOn) || 0;
+        const offsetCurrentTimeSec = nowSeconds() + offset;
+        // If current time + offset is greater than token expiration time, then token is expired.
+        return offsetCurrentTimeSec > expirationSec;
     }
     /**
-     * Helper function used to determine if an error thrown by the server requires interaction to resolve
-     * @param errorCode
-     * @param errorString
-     * @param subError
+     * Checks if a cache entry is expired based on the last updated time and cache retention days.
+     * @param lastUpdatedAt
+     * @param cacheRetentionDays
+     * @returns
      */
-    function isInteractionRequiredError(errorCode, errorString, subError) {
-        const isInteractionRequiredErrorCode = !!errorCode &&
-            InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
-        const isInteractionRequiredSubError = !!subError &&
-            InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
-        const isInteractionRequiredErrorDesc = !!errorString &&
-            InteractionRequiredServerErrorMessage.some((irErrorCode) => {
-                return errorString.indexOf(irErrorCode) > -1;
-            });
-        return (isInteractionRequiredErrorCode ||
-            isInteractionRequiredErrorDesc ||
-            isInteractionRequiredSubError);
+    function isCacheExpired(lastUpdatedAt, cacheRetentionDays) {
+        const cacheExpirationTimestamp = Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1000;
+        return Date.now() > cacheExpirationTimestamp;
     }
     /**
-     * Creates an InteractionRequiredAuthError
+     * If the current time is earlier than the time that a token was cached at, we must discard the token
+     * i.e. The system clock was turned back after acquiring the cached token
+     * @param cachedAt
+     * @param offset
      */
-    function createInteractionRequiredAuthError(errorCode, errorMessage) {
-        return new InteractionRequiredAuthError(errorCode, errorMessage);
+    function wasClockTurnedBack(cachedAt) {
+        const cachedAtSec = Number(cachedAt);
+        return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     /**
-     * Appends user state with random guid, or returns random guid.
-     * @param cryptoObj
-     * @param userState
-     * @param meta
+     * Create IdTokenEntity
+     * @param homeAccountId
+     * @param authenticationResult
+     * @param clientId
+     * @param authority
      */
-    function setRequestState(cryptoObj, userState, meta) {
-        const libraryState = generateLibraryState(cryptoObj, meta);
-        return userState
-            ? `${libraryState}${RESOURCE_DELIM}${userState}`
-            : libraryState;
+    function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
+        const idTokenEntity = {
+            credentialType: CredentialType.ID_TOKEN,
+            homeAccountId: homeAccountId,
+            environment: environment,
+            clientId: clientId,
+            secret: idToken,
+            realm: tenantId,
+            lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+        };
+        return idTokenEntity;
     }
     /**
-     * Generates the state value used by the common library.
-     * @param cryptoObj
-     * @param meta
+     * Create AccessTokenEntity
+     * @param homeAccountId
+     * @param environment
+     * @param accessToken
+     * @param clientId
+     * @param tenantId
+     * @param scopes
+     * @param expiresOn
+     * @param extExpiresOn
      */
-    function generateLibraryState(cryptoObj, meta) {
-        if (!cryptoObj) {
-            throw createClientAuthError(noCryptoObject);
-        }
-        // Create a state object containing a unique id and the timestamp of the request creation
-        const stateObj = {
-            id: cryptoObj.createNewGuid(),
+    function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+        const atEntity = {
+            homeAccountId: homeAccountId,
+            credentialType: CredentialType.ACCESS_TOKEN,
+            secret: accessToken,
+            cachedAt: nowSeconds().toString(),
+            expiresOn: expiresOn.toString(),
+            extendedExpiresOn: extExpiresOn.toString(),
+            environment: environment,
+            clientId: clientId,
+            realm: tenantId,
+            target: scopes,
+            tokenType: tokenType || AuthenticationScheme$1.BEARER,
+            lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
         };
-        if (meta) {
-            stateObj.meta = meta;
+        if (userAssertionHash) {
+            atEntity.userAssertionHash = userAssertionHash;
         }
-        const stateString = JSON.stringify(stateObj);
-        return cryptoObj.base64Encode(stateString);
+        if (refreshOn) {
+            atEntity.refreshOn = refreshOn.toString();
+        }
+        /*
+         * Create Access Token With Auth Scheme instead of regular access token
+         * Cast to lower to handle "bearer" from ADFS
+         */
+        if (atEntity.tokenType?.toLowerCase() !==
+            AuthenticationScheme$1.BEARER.toLowerCase()) {
+            atEntity.credentialType =
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+            switch (atEntity.tokenType) {
+                case AuthenticationScheme$1.POP:
+                    // Make sure keyId is present and add it to credential
+                    const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                    if (!tokenClaims?.cnf?.kid) {
+                        throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                    }
+                    atEntity.keyId = tokenClaims.cnf.kid;
+                    break;
+                case AuthenticationScheme$1.SSH:
+                    atEntity.keyId = keyId;
+            }
+        }
+        return atEntity;
     }
     /**
-     * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
-     * @param base64Decode
-     * @param state
+     * Create RefreshTokenEntity
+     * @param homeAccountId
+     * @param authenticationResult
+     * @param clientId
+     * @param authority
      */
-    function parseRequestState(base64Decode, state) {
-        if (!base64Decode) {
-            throw createClientAuthError(noCryptoObject);
+    function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
+        const rtEntity = {
+            credentialType: CredentialType.REFRESH_TOKEN,
+            homeAccountId: homeAccountId,
+            environment: environment,
+            clientId: clientId,
+            secret: refreshToken,
+            lastUpdatedAt: Date.now().toString(),
+        };
+        if (userAssertionHash) {
+            rtEntity.userAssertionHash = userAssertionHash;
         }
-        if (!state) {
-            throw createClientAuthError(invalidState);
+        if (familyId) {
+            rtEntity.familyId = familyId;
         }
-        try {
-            // Split the state between library state and user passed state and decode them separately
-            const splitState = state.split(RESOURCE_DELIM);
-            const libraryState = splitState[0];
-            const userState = splitState.length > 1
-                ? splitState.slice(1).join(RESOURCE_DELIM)
-                : "";
-            const libraryStateString = base64Decode(libraryState);
-            const libraryStateObj = JSON.parse(libraryStateString);
-            return {
-                userRequestState: userState || "",
-                libraryState: libraryStateObj,
-            };
+        if (expiresOn) {
+            rtEntity.expiresOn = expiresOn.toString();
         }
-        catch (e) {
-            throw createClientAuthError(invalidState);
+        return rtEntity;
+    }
+    function isCredentialEntity(entity) {
+        return (entity.hasOwnProperty("homeAccountId") &&
+            entity.hasOwnProperty("environment") &&
+            entity.hasOwnProperty("credentialType") &&
+            entity.hasOwnProperty("clientId") &&
+            entity.hasOwnProperty("secret"));
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    function isAccessTokenEntity(entity) {
+        if (!entity) {
+            return false;
         }
-    }
-
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
+        return (isCredentialEntity(entity) &&
+            entity.hasOwnProperty("realm") &&
+            entity.hasOwnProperty("target") &&
+            (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
+                entity["credentialType"] ===
+                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
      */
+    function isIdTokenEntity(entity) {
+        if (!entity) {
+            return false;
+        }
+        return (isCredentialEntity(entity) &&
+            entity.hasOwnProperty("realm") &&
+            entity["credentialType"] === CredentialType.ID_TOKEN);
+    }
     /**
-     * Utility functions for managing date and time operations.
+     * Validates an entity: checks for all expected params
+     * @param entity
      */
+    function isRefreshTokenEntity(entity) {
+        if (!entity) {
+            return false;
+        }
+        return (isCredentialEntity(entity) &&
+            entity["credentialType"] === CredentialType.REFRESH_TOKEN);
+    }
     /**
-     * return the current time in Unix time (seconds).
+     * validates if a given cache entry is "Telemetry", parses <key,value>
+     * @param key
+     * @param entity
      */
-    function nowSeconds() {
-        // Date.getTime() returns in milliseconds.
-        return Math.round(new Date().getTime() / 1000.0);
+    function isServerTelemetryEntity(key, entity) {
+        const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
+        let validateEntity = true;
+        if (entity) {
+            validateEntity =
+                entity.hasOwnProperty("failedRequests") &&
+                    entity.hasOwnProperty("errors") &&
+                    entity.hasOwnProperty("cacheHits");
+        }
+        return validateKey && validateEntity;
     }
     /**
-     * Converts JS Date object to seconds
-     * @param date Date
+     * validates if a given cache entry is "Throttling", parses <key,value>
+     * @param key
+     * @param entity
      */
-    function toSecondsFromDate(date) {
-        // Convert date to seconds
-        return date.getTime() / 1000;
+    function isThrottlingEntity(key, entity) {
+        let validateKey = false;
+        if (key) {
+            validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
+        }
+        let validateEntity = true;
+        if (entity) {
+            validateEntity = entity.hasOwnProperty("throttleTime");
+        }
+        return validateKey && validateEntity;
     }
     /**
-     * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
-     * @param seconds
+     * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
      */
-    function toDateFromSeconds(seconds) {
-        if (seconds) {
-            return new Date(Number(seconds) * 1000);
+    function generateAppMetadataKey({ environment, clientId, }) {
+        const appMetaDataKeyArray = [
+            APP_METADATA,
+            environment,
+            clientId,
+        ];
+        return appMetaDataKeyArray
+            .join(CACHE_KEY_SEPARATOR$1)
+            .toLowerCase();
+    }
+    /*
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    function isAppMetadataEntity(key, entity) {
+        if (!entity) {
+            return false;
         }
-        return new Date();
+        return (key.indexOf(APP_METADATA) === 0 &&
+            entity.hasOwnProperty("clientId") &&
+            entity.hasOwnProperty("environment"));
     }
     /**
-     * check if a token is expired based on given UTC time in seconds.
-     * @param expiresOn
+     * Validates an entity: checks for all expected params
+     * @param entity
      */
-    function isTokenExpired(expiresOn, offset) {
-        // check for access token expiry
-        const expirationSec = Number(expiresOn) || 0;
-        const offsetCurrentTimeSec = nowSeconds() + offset;
-        // If current time + offset is greater than token expiration time, then token is expired.
-        return offsetCurrentTimeSec > expirationSec;
+    function isAuthorityMetadataEntity(key, entity) {
+        if (!entity) {
+            return false;
+        }
+        return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
+            entity.hasOwnProperty("aliases") &&
+            entity.hasOwnProperty("preferred_cache") &&
+            entity.hasOwnProperty("preferred_network") &&
+            entity.hasOwnProperty("canonical_authority") &&
+            entity.hasOwnProperty("authorization_endpoint") &&
+            entity.hasOwnProperty("token_endpoint") &&
+            entity.hasOwnProperty("issuer") &&
+            entity.hasOwnProperty("aliasesFromNetwork") &&
+            entity.hasOwnProperty("endpointsFromNetwork") &&
+            entity.hasOwnProperty("expiresAt") &&
+            entity.hasOwnProperty("jwks_uri"));
     }
     /**
-     * Checks if a cache entry is expired based on the last updated time and cache retention days.
-     * @param lastUpdatedAt
-     * @param cacheRetentionDays
-     * @returns
+     * Reset the exiresAt value
      */
-    function isCacheExpired(lastUpdatedAt, cacheRetentionDays) {
-        const cacheExpirationTimestamp = Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1000;
-        return Date.now() > cacheExpirationTimestamp;
+    function generateAuthorityMetadataExpiresAt() {
+        return (nowSeconds() +
+            AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
+    }
+    function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
+        authorityMetadata.authorization_endpoint =
+            updatedValues.authorization_endpoint;
+        authorityMetadata.token_endpoint = updatedValues.token_endpoint;
+        authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
+        authorityMetadata.issuer = updatedValues.issuer;
+        authorityMetadata.endpointsFromNetwork = fromNetwork;
+        authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+    }
+    function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
+        authorityMetadata.aliases = updatedValues.aliases;
+        authorityMetadata.preferred_cache = updatedValues.preferred_cache;
+        authorityMetadata.preferred_network = updatedValues.preferred_network;
+        authorityMetadata.aliasesFromNetwork = fromNetwork;
     }
     /**
-     * If the current time is earlier than the time that a token was cached at, we must discard the token
-     * i.e. The system clock was turned back after acquiring the cached token
-     * @param cachedAt
-     * @param offset
+     * Returns whether or not the data needs to be refreshed
      */
-    function wasClockTurnedBack(cachedAt) {
-        const cachedAtSec = Number(cachedAt);
-        return cachedAtSec > nowSeconds();
+    function isAuthorityMetadataExpired(metadata) {
+        return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4060,7 +4128,7 @@
     const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
     const SetUserData = "setUserData";
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4153,7 +4221,7 @@
         };
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4233,293 +4301,226 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     /**
-     * This class instance helps track the memory changes facilitating
-     * decisions to read from and write to the persistent cache
-     */ class TokenCacheContext {
-        constructor(tokenCache, hasChanged) {
-            this.cache = tokenCache;
-            this.hasChanged = hasChanged;
-        }
-        /**
-         * boolean which indicates the changes in cache
-         */
-        get cacheHasChanged() {
-            return this.hasChanged;
-        }
-        /**
-         * function to retrieve the token cache
-         */
-        get tokenCache() {
-            return this.cache;
-        }
-    }
-
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
+     * MSAL-defined interaction required error code indicating no tokens are found in cache.
+     * @public
      */
+    const noTokensFound = "no_tokens_found";
     /**
-     * Create IdTokenEntity
-     * @param homeAccountId
-     * @param authenticationResult
-     * @param clientId
-     * @param authority
+     * MSAL-defined error code indicating a native account is unavailable on the platform.
+     * @public
      */
-    function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
-        const idTokenEntity = {
-            credentialType: CredentialType.ID_TOKEN,
-            homeAccountId: homeAccountId,
-            environment: environment,
-            clientId: clientId,
-            secret: idToken,
-            realm: tenantId,
-            lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-        };
-        return idTokenEntity;
-    }
+    const nativeAccountUnavailable = "native_account_unavailable";
     /**
-     * Create AccessTokenEntity
-     * @param homeAccountId
-     * @param environment
-     * @param accessToken
-     * @param clientId
-     * @param tenantId
-     * @param scopes
-     * @param expiresOn
-     * @param extExpiresOn
+     * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
+     * @public
      */
-    function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
-        const atEntity = {
-            homeAccountId: homeAccountId,
-            credentialType: CredentialType.ACCESS_TOKEN,
-            secret: accessToken,
-            cachedAt: nowSeconds().toString(),
-            expiresOn: expiresOn.toString(),
-            extendedExpiresOn: extExpiresOn.toString(),
-            environment: environment,
-            clientId: clientId,
-            realm: tenantId,
-            target: scopes,
-            tokenType: tokenType || AuthenticationScheme$1.BEARER,
-            lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
-        };
-        if (userAssertionHash) {
-            atEntity.userAssertionHash = userAssertionHash;
-        }
-        if (refreshOn) {
-            atEntity.refreshOn = refreshOn.toString();
-        }
-        /*
-         * Create Access Token With Auth Scheme instead of regular access token
-         * Cast to lower to handle "bearer" from ADFS
-         */
-        if (atEntity.tokenType?.toLowerCase() !==
-            AuthenticationScheme$1.BEARER.toLowerCase()) {
-            atEntity.credentialType =
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-            switch (atEntity.tokenType) {
-                case AuthenticationScheme$1.POP:
-                    // Make sure keyId is present and add it to credential
-                    const tokenClaims = extractTokenClaims(accessToken, base64Decode);
-                    if (!tokenClaims?.cnf?.kid) {
-                        throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
-                    }
-                    atEntity.keyId = tokenClaims.cnf.kid;
-                    break;
-                case AuthenticationScheme$1.SSH:
-                    atEntity.keyId = keyId;
-            }
-        }
-        return atEntity;
-    }
+    const refreshTokenExpired = "refresh_token_expired";
     /**
-     * Create RefreshTokenEntity
-     * @param homeAccountId
-     * @param authenticationResult
-     * @param clientId
-     * @param authority
+     * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
+     * @public
      */
-    function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
-        const rtEntity = {
-            credentialType: CredentialType.REFRESH_TOKEN,
-            homeAccountId: homeAccountId,
-            environment: environment,
-            clientId: clientId,
-            secret: refreshToken,
-            lastUpdatedAt: Date.now().toString(),
-        };
-        if (userAssertionHash) {
-            rtEntity.userAssertionHash = userAssertionHash;
-        }
-        if (familyId) {
-            rtEntity.familyId = familyId;
-        }
-        if (expiresOn) {
-            rtEntity.expiresOn = expiresOn.toString();
-        }
-        return rtEntity;
-    }
-    function isCredentialEntity(entity) {
-        return (entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("credentialType") &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("secret"));
-    }
+    const uxNotAllowed = "ux_not_allowed";
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Server-originated error code indicating interaction is required to complete the request.
+     * @public
      */
-    function isAccessTokenEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (isCredentialEntity(entity) &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("target") &&
-            (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
-                entity["credentialType"] ===
-                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
-    }
+    const interactionRequired = "interaction_required";
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Server-originated error code indicating user consent is required.
+     * @public
+     */
+    const consentRequired = "consent_required";
+    /**
+     * Server-originated error code indicating user login is required.
+     * @public
+     */
+    const loginRequired = "login_required";
+    /**
+     * Server-originated error code indicating the token is invalid or corrupted.
+     * @public
+     */
+    const badToken = "bad_token";
+    /**
+     * Server-originated error code indicating the user is in an interrupted state and interaction is required.
+     * @public
+     */
+    const interruptedUser = "interrupted_user";
+
+    var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
+        __proto__: null,
+        badToken: badToken,
+        consentRequired: consentRequired,
+        interactionRequired: interactionRequired,
+        interruptedUser: interruptedUser,
+        loginRequired: loginRequired,
+        nativeAccountUnavailable: nativeAccountUnavailable,
+        noTokensFound: noTokensFound,
+        refreshTokenExpired: refreshTokenExpired,
+        uxNotAllowed: uxNotAllowed
+    });
+
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
      */
-    function isIdTokenEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (isCredentialEntity(entity) &&
-            entity.hasOwnProperty("realm") &&
-            entity["credentialType"] === CredentialType.ID_TOKEN);
-    }
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
      */
-    function isRefreshTokenEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (isCredentialEntity(entity) &&
-            entity["credentialType"] === CredentialType.REFRESH_TOKEN);
-    }
+    const InteractionRequiredServerErrorMessage = [
+        interactionRequired,
+        consentRequired,
+        loginRequired,
+        badToken,
+        uxNotAllowed,
+        interruptedUser,
+    ];
+    const InteractionRequiredAuthSubErrorMessage = [
+        "message_only",
+        "additional_action",
+        "basic_action",
+        "user_password_expired",
+        "consent_required",
+        "bad_token",
+        "ux_not_allowed",
+        "interrupted_user",
+    ];
     /**
-     * validates if a given cache entry is "Telemetry", parses <key,value>
-     * @param key
-     * @param entity
+     * Error thrown when user interaction is required.
      */
-    function isServerTelemetryEntity(key, entity) {
-        const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
-        let validateEntity = true;
-        if (entity) {
-            validateEntity =
-                entity.hasOwnProperty("failedRequests") &&
-                    entity.hasOwnProperty("errors") &&
-                    entity.hasOwnProperty("cacheHits");
+    class InteractionRequiredAuthError extends AuthError {
+        constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
+            super(errorCode, errorMessage, subError);
+            Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
+            this.timestamp = timestamp || "";
+            this.traceId = traceId || "";
+            this.correlationId = correlationId || "";
+            this.claims = claims || "";
+            this.name = "InteractionRequiredAuthError";
+            this.errorNo = errorNo;
         }
-        return validateKey && validateEntity;
     }
     /**
-     * validates if a given cache entry is "Throttling", parses <key,value>
-     * @param key
-     * @param entity
+     * Helper function used to determine if an error thrown by the server requires interaction to resolve
+     * @param errorCode
+     * @param errorString
+     * @param subError
      */
-    function isThrottlingEntity(key, entity) {
-        let validateKey = false;
-        if (key) {
-            validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
-        }
-        let validateEntity = true;
-        if (entity) {
-            validateEntity = entity.hasOwnProperty("throttleTime");
-        }
-        return validateKey && validateEntity;
+    function isInteractionRequiredError(errorCode, errorString, subError) {
+        const isInteractionRequiredErrorCode = !!errorCode &&
+            InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
+        const isInteractionRequiredSubError = !!subError &&
+            InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
+        const isInteractionRequiredErrorDesc = !!errorString &&
+            InteractionRequiredServerErrorMessage.some((irErrorCode) => {
+                return errorString.indexOf(irErrorCode) > -1;
+            });
+        return (isInteractionRequiredErrorCode ||
+            isInteractionRequiredErrorDesc ||
+            isInteractionRequiredSubError);
     }
     /**
-     * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+     * Creates an InteractionRequiredAuthError
      */
-    function generateAppMetadataKey({ environment, clientId, }) {
-        const appMetaDataKeyArray = [
-            APP_METADATA,
-            environment,
-            clientId,
-        ];
-        return appMetaDataKeyArray
-            .join(CACHE_KEY_SEPARATOR$1)
-            .toLowerCase();
-    }
+    function createInteractionRequiredAuthError(errorCode, errorMessage) {
+        return new InteractionRequiredAuthError(errorCode, errorMessage);
+    }
+
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
+
     /*
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
      */
-    function isAppMetadataEntity(key, entity) {
-        if (!entity) {
-            return false;
-        }
-        return (key.indexOf(APP_METADATA) === 0 &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("environment"));
-    }
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Error thrown when there is an error with the server code, for example, unavailability.
      */
-    function isAuthorityMetadataEntity(key, entity) {
-        if (!entity) {
-            return false;
+    class ServerError extends AuthError {
+        constructor(errorCode, errorMessage, subError, errorNo, status) {
+            super(errorCode, errorMessage, subError);
+            this.name = "ServerError";
+            this.errorNo = errorNo;
+            this.status = status;
+            Object.setPrototypeOf(this, ServerError.prototype);
         }
-        return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
-            entity.hasOwnProperty("aliases") &&
-            entity.hasOwnProperty("preferred_cache") &&
-            entity.hasOwnProperty("preferred_network") &&
-            entity.hasOwnProperty("canonical_authority") &&
-            entity.hasOwnProperty("authorization_endpoint") &&
-            entity.hasOwnProperty("token_endpoint") &&
-            entity.hasOwnProperty("issuer") &&
-            entity.hasOwnProperty("aliasesFromNetwork") &&
-            entity.hasOwnProperty("endpointsFromNetwork") &&
-            entity.hasOwnProperty("expiresAt") &&
-            entity.hasOwnProperty("jwks_uri"));
-    }
+    }
+
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
     /**
-     * Reset the exiresAt value
+     * Appends user state with random guid, or returns random guid.
+     * @param cryptoObj
+     * @param userState
+     * @param meta
      */
-    function generateAuthorityMetadataExpiresAt() {
-        return (nowSeconds() +
-            AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
-    }
-    function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
-        authorityMetadata.authorization_endpoint =
-            updatedValues.authorization_endpoint;
-        authorityMetadata.token_endpoint = updatedValues.token_endpoint;
-        authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
-        authorityMetadata.issuer = updatedValues.issuer;
-        authorityMetadata.endpointsFromNetwork = fromNetwork;
-        authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+    function setRequestState(cryptoObj, userState, meta) {
+        const libraryState = generateLibraryState(cryptoObj, meta);
+        return userState
+            ? `${libraryState}${RESOURCE_DELIM}${userState}`
+            : libraryState;
     }
-    function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
-        authorityMetadata.aliases = updatedValues.aliases;
-        authorityMetadata.preferred_cache = updatedValues.preferred_cache;
-        authorityMetadata.preferred_network = updatedValues.preferred_network;
-        authorityMetadata.aliasesFromNetwork = fromNetwork;
+    /**
+     * Generates the state value used by the common library.
+     * @param cryptoObj
+     * @param meta
+     */
+    function generateLibraryState(cryptoObj, meta) {
+        if (!cryptoObj) {
+            throw createClientAuthError(noCryptoObject);
+        }
+        // Create a state object containing a unique id and the timestamp of the request creation
+        const stateObj = {
+            id: cryptoObj.createNewGuid(),
+        };
+        if (meta) {
+            stateObj.meta = meta;
+        }
+        const stateString = JSON.stringify(stateObj);
+        return cryptoObj.base64Encode(stateString);
     }
     /**
-     * Returns whether or not the data needs to be refreshed
+     * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
+     * @param base64Decode
+     * @param state
      */
-    function isAuthorityMetadataExpired(metadata) {
-        return metadata.expiresAt <= nowSeconds();
+    function parseRequestState(base64Decode, state) {
+        if (!base64Decode) {
+            throw createClientAuthError(noCryptoObject);
+        }
+        if (!state) {
+            throw createClientAuthError(invalidState);
+        }
+        try {
+            // Split the state between library state and user passed state and decode them separately
+            const splitState = state.split(RESOURCE_DELIM);
+            const libraryState = splitState[0];
+            const userState = splitState.length > 1
+                ? splitState.slice(1).join(RESOURCE_DELIM)
+                : "";
+            const libraryStateString = base64Decode(libraryState);
+            const libraryStateObj = JSON.parse(libraryStateString);
+            return {
+                userRequestState: userState || "",
+                libraryState: libraryStateObj,
+            };
+        }
+        catch (e) {
+            throw createClientAuthError(invalidState);
+        }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4675,7 +4676,7 @@
             if (serverTokenResponse.id_token && !!idTokenClaims) {
                 cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
                 cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
-                this.logger);
+                this.logger, this.performanceClient);
             }
             // AccessToken
             let cachedAccessToken = null;
@@ -4826,17 +4827,24 @@
             };
         }
     }
-    function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+    function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
         logger?.verbose("09jz0t", correlationId);
-        // Check if base account is already cached
-        const accountKeys = cacheStorage.getAccountKeys();
-        const baseAccountKey = accountKeys.find((accountKey) => {
-            return accountKey.startsWith(homeAccountId);
-        });
-        let cachedAccount = null;
-        if (baseAccountKey) {
-            cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId);
+        /*
+         * Check if base account is already cached. Filter by homeAccountId (identifies
+         * the user's home identity) and environment (identifies the cloud) — the two
+         * tenant-agnostic properties that uniquely locate a base AccountEntity.
+         */
+        const accountEnvironment = environment || authority.getPreferredCache();
+        const matchedAccounts = cacheStorage.getAccountsFilteredBy({ homeAccountId, environment: accountEnvironment }, correlationId);
+        performanceClient?.addFields({ cacheMatchedAccounts: matchedAccounts.length }, correlationId);
+        if (matchedAccounts.length > 1) {
+            /*
+             * Base accounts are expected to be unique for a given homeAccountId in normal cache usage.
+             * If multiple matches exist, ignore the cache hit rather than arbitrarily choosing one.
+             */
+            logger?.warning("0x7ad1", correlationId);
         }
+        const cachedAccount = matchedAccounts.length === 1 ? matchedAccounts[0] : null;
         const baseAccount = cachedAccount ||
             createAccountEntity({
                 homeAccountId,
@@ -4860,7 +4868,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4870,7 +4878,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4888,7 +4896,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4909,7 +4917,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4995,7 +5003,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5026,7 +5034,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5140,7 +5148,7 @@
         return response;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5152,7 +5160,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5162,7 +5170,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5172,7 +5180,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5277,7 +5285,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6097,7 +6105,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6131,7 +6139,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6392,7 +6400,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6617,7 +6625,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6733,7 +6741,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6748,7 +6756,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6975,7 +6983,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7008,7 +7016,7 @@
         return Object.prototype.hasOwnProperty.call(params, "resource");
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7066,7 +7074,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7083,7 +7091,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7344,7 +7352,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7365,7 +7373,7 @@
         return new JoseHeaderError(code);
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7373,7 +7381,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7413,7 +7421,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.4.0 2026-03-19 */
+    /*! @azure/msal-common v16.4.1 2026-04-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7943,6 +7951,136 @@
         }
     }
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * acquireTokenFromCache (msal-browser).
+     * Internal API for acquiring token from cache
+     */
+    const AcquireTokenFromCache = "acquireTokenFromCache";
+    /**
+     * acquireTokenByRefreshToken API (msal-browser and msal-node).
+     * Used to renew an access token using a refresh token against the token endpoint.
+     */
+    const AcquireTokenByRefreshToken = "acquireTokenByRefreshToken";
+    /**
+     * acquireTokenSilentAsync (msal-browser).
+     * Internal API for acquireTokenSilent.
+     */
+    const AcquireTokenSilentAsync = "acquireTokenSilentAsync";
+    /**
+     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
+     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
+     */
+    const CryptoOptsGetPublicKeyThumbprint = "cryptoOptsGetPublicKeyThumbprint";
+    /**
+     * signJwt API in CryptoOpts class (msal-browser).
+     * Used to signed a pop token.
+     */
+    const CryptoOptsSignJwt = "cryptoOptsSignJwt";
+    /**
+     * acquireToken API in the SilentCacheClient class (msal-browser).
+     * Used to read access tokens from the cache.
+     */
+    const SilentCacheClientAcquireToken = "silentCacheClientAcquireToken";
+    /**
+     * acquireToken API in the SilentIframeClient class (msal-browser).
+     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
+     */
+    const SilentIframeClientAcquireToken = "silentIframeClientAcquireToken";
+    const AwaitConcurrentIframe = "awaitConcurrentIframe"; // Time spent waiting for a concurrent iframe to complete
+    /**
+     * acquireToken API in SilentRereshClient (msal-browser).
+     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
+     */
+    const SilentRefreshClientAcquireToken = "silentRefreshClientAcquireToken";
+    /**
+     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
+     * Used to load authority metadata for a request.
+     */
+    const StandardInteractionClientGetDiscoveredAuthority = "standardInteractionClientGetDiscoveredAuthority";
+    /**
+     * acquireToken API in NativeInteractionClient class (msal-browser).
+     * Used to acquire a token from Native component when native brokering is enabled.
+     */
+    const NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
+    /**
+     * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
+     */
+    const RefreshTokenClientAcquireTokenByRefreshToken = "refreshTokenClientAcquireTokenByRefreshToken";
+    /**
+     * acquireTokenBySilentIframe (msal-browser).
+     * Internal API for acquiring token by silent Iframe
+     */
+    const AcquireTokenBySilentIframe = "acquireTokenBySilentIframe";
+    /**
+     * Internal API for initializing base request in BaseInteractionClient (msal-browser)
+     */
+    const InitializeBaseRequest = "initializeBaseRequest";
+    /**
+     * Internal API for initializing silent request in SilentCacheClient (msal-browser)
+     */
+    const InitializeSilentRequest = "initializeSilentRequest";
+    const InitializeCache = "initializeCache";
+    /**
+     * Helper function in SilentIframeClient class (msal-browser).
+     */
+    const SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
+    /**
+     * SilentHandler
+     */
+    const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
+    const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
+    const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
+    /**
+     * Helper functions in StandardInteractionClient class (msal-browser)
+     */
+    const StandardInteractionClientCreateAuthCodeClient = "standardInteractionClientCreateAuthCodeClient";
+    const StandardInteractionClientGetClientConfiguration = "standardInteractionClientGetClientConfiguration";
+    const StandardInteractionClientInitializeAuthorizationRequest = "standardInteractionClientInitializeAuthorizationRequest";
+    const SilentFlowClientAcquireCachedToken = "silentFlowClientAcquireCachedToken";
+    const GetStandardParams = "getStandardParams";
+    const HandleCodeResponse = "handleCodeResponse";
+    const HandleResponseEar = "handleResponseEar";
+    const HandleResponsePlatformBroker = "handleResponsePlatformBroker";
+    const HandleResponseCode = "handleResponseCode";
+    const AuthClientAcquireToken = "authClientAcquireToken";
+    const DeserializeResponse = "deserializeResponse";
+    const AuthorityFactoryCreateDiscoveredInstance = "authorityFactoryCreateDiscoveredInstance";
+    const AcquireTokenByCodeAsync = "acquireTokenByCodeAsync";
+    const HandleRedirectPromiseMeasurement = "handleRedirectPromise";
+    const HandleNativeRedirectPromiseMeasurement = "handleNativeRedirectPromise";
+    const NativeMessageHandlerHandshake = "nativeMessageHandlerHandshake";
+    const RemoveHiddenIframe = "removeHiddenIframe";
+    const ImportExistingCache = "importExistingCache";
+    /**
+     * Crypto Operations
+     */
+    const GeneratePkceCodes = "generatePkceCodes";
+    const GenerateCodeVerifier = "generateCodeVerifier";
+    const GenerateCodeChallengeFromVerifier = "generateCodeChallengeFromVerifier";
+    const Sha256Digest = "sha256Digest";
+    const GetRandomValues = "getRandomValues";
+    const GenerateHKDF = "generateHKDF";
+    const GenerateBaseKey = "generateBaseKey";
+    const Base64Decode = "base64Decode";
+    const UrlEncodeArr = "urlEncodeArr";
+    const Encrypt = "encrypt";
+    const Decrypt = "decrypt";
+    const GenerateEarKey = "generateEarKey";
+    const DecryptEarResponse = "decryptEarResponse";
+    const LoadAccount = "loadAccount";
+    const LoadIdToken = "loadIdToken";
+    const LoadAccessToken = "loadAccessToken";
+    const LoadRefreshToken = "loadRefreshToken";
+    /**
+     * Background telemetry measurement that tracks whether a late bridge response
+     * arrives after the iframe timeout has already fired.
+     */
+    const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8849,20 +8987,35 @@
             activeBridgeMonitor = null;
         }
     }
-    async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient) {
+    async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient, experimentalConfig) {
         return new Promise((resolve, reject) => {
             logger.verbose("1rf6em", request.correlationId);
             const correlationId = request.correlationId;
             performanceClient.addFields({
                 redirectBridgeTimeoutMs: timeoutMs,
+                lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false,
             }, correlationId);
             const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
             const channel = new BroadcastChannel(libraryState.id);
             let responseString = undefined;
+            let timedOut$1 = false;
+            let lateTimeoutId;
+            let lateMeasurement;
             const timeoutId = window.setTimeout(() => {
                 // Clear the active monitor
                 activeBridgeMonitor = null;
-                channel.close();
+                if (experimentalConfig?.iframeTimeoutTelemetry) {
+                    lateMeasurement = performanceClient.startMeasurement(WaitForBridgeLateResponse, correlationId);
+                    timedOut$1 = true;
+                    lateTimeoutId = window.setTimeout(() => {
+                        lateMeasurement?.end({ success: false });
+                        clearTimeout(lateTimeoutId);
+                        channel.close();
+                    }, 60000); // 60s late response timeout to allow for telemetry of late responses
+                }
+                else {
+                    channel.close();
+                }
                 reject(createBrowserAuthError(timedOut, "redirect_bridge_timeout"));
             }, timeoutMs);
             // Track this monitor so it can be cancelled if needed
@@ -8876,6 +9029,14 @@
                 const messageVersion = event?.data && typeof event.data.v === "number"
                     ? event.data.v
                     : undefined;
+                if (timedOut$1) {
+                    lateMeasurement?.end({
+                        success: responseString ? true : false,
+                    });
+                    clearTimeout(lateTimeoutId);
+                    channel.close();
+                    return;
+                }
                 performanceClient.addFields({
                     redirectBridgeMessageVersion: messageVersion,
                 }, correlationId);
@@ -9038,130 +9199,6 @@
         waitForBridgeResponse: waitForBridgeResponse
     });
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * acquireTokenFromCache (msal-browser).
-     * Internal API for acquiring token from cache
-     */
-    const AcquireTokenFromCache = "acquireTokenFromCache";
-    /**
-     * acquireTokenByRefreshToken API (msal-browser and msal-node).
-     * Used to renew an access token using a refresh token against the token endpoint.
-     */
-    const AcquireTokenByRefreshToken = "acquireTokenByRefreshToken";
-    /**
-     * acquireTokenSilentAsync (msal-browser).
-     * Internal API for acquireTokenSilent.
-     */
-    const AcquireTokenSilentAsync = "acquireTokenSilentAsync";
-    /**
-     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
-     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
-     */
-    const CryptoOptsGetPublicKeyThumbprint = "cryptoOptsGetPublicKeyThumbprint";
-    /**
-     * signJwt API in CryptoOpts class (msal-browser).
-     * Used to signed a pop token.
-     */
-    const CryptoOptsSignJwt = "cryptoOptsSignJwt";
-    /**
-     * acquireToken API in the SilentCacheClient class (msal-browser).
-     * Used to read access tokens from the cache.
-     */
-    const SilentCacheClientAcquireToken = "silentCacheClientAcquireToken";
-    /**
-     * acquireToken API in the SilentIframeClient class (msal-browser).
-     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
-     */
-    const SilentIframeClientAcquireToken = "silentIframeClientAcquireToken";
-    const AwaitConcurrentIframe = "awaitConcurrentIframe"; // Time spent waiting for a concurrent iframe to complete
-    /**
-     * acquireToken API in SilentRereshClient (msal-browser).
-     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
-     */
-    const SilentRefreshClientAcquireToken = "silentRefreshClientAcquireToken";
-    /**
-     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
-     * Used to load authority metadata for a request.
-     */
-    const StandardInteractionClientGetDiscoveredAuthority = "standardInteractionClientGetDiscoveredAuthority";
-    /**
-     * acquireToken API in NativeInteractionClient class (msal-browser).
-     * Used to acquire a token from Native component when native brokering is enabled.
-     */
-    const NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
-    /**
-     * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
-     */
-    const RefreshTokenClientAcquireTokenByRefreshToken = "refreshTokenClientAcquireTokenByRefreshToken";
-    /**
-     * acquireTokenBySilentIframe (msal-browser).
-     * Internal API for acquiring token by silent Iframe
-     */
-    const AcquireTokenBySilentIframe = "acquireTokenBySilentIframe";
-    /**
-     * Internal API for initializing base request in BaseInteractionClient (msal-browser)
-     */
-    const InitializeBaseRequest = "initializeBaseRequest";
-    /**
-     * Internal API for initializing silent request in SilentCacheClient (msal-browser)
-     */
-    const InitializeSilentRequest = "initializeSilentRequest";
-    const InitializeCache = "initializeCache";
-    /**
-     * Helper function in SilentIframeClient class (msal-browser).
-     */
-    const SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
-    /**
-     * SilentHandler
-     */
-    const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
-    const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
-    const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
-    /**
-     * Helper functions in StandardInteractionClient class (msal-browser)
-     */
-    const StandardInteractionClientCreateAuthCodeClient = "standardInteractionClientCreateAuthCodeClient";
-    const StandardInteractionClientGetClientConfiguration = "standardInteractionClientGetClientConfiguration";
-    const StandardInteractionClientInitializeAuthorizationRequest = "standardInteractionClientInitializeAuthorizationRequest";
-    const SilentFlowClientAcquireCachedToken = "silentFlowClientAcquireCachedToken";
-    const GetStandardParams = "getStandardParams";
-    const HandleCodeResponse = "handleCodeResponse";
-    const HandleResponseEar = "handleResponseEar";
-    const HandleResponsePlatformBroker = "handleResponsePlatformBroker";
-    const HandleResponseCode = "handleResponseCode";
-    const AuthClientAcquireToken = "authClientAcquireToken";
-    const DeserializeResponse = "deserializeResponse";
-    const AuthorityFactoryCreateDiscoveredInstance = "authorityFactoryCreateDiscoveredInstance";
-    const AcquireTokenByCodeAsync = "acquireTokenByCodeAsync";
-    const HandleRedirectPromiseMeasurement = "handleRedirectPromise";
-    const HandleNativeRedirectPromiseMeasurement = "handleNativeRedirectPromise";
-    const NativeMessageHandlerHandshake = "nativeMessageHandlerHandshake";
-    const ImportExistingCache = "importExistingCache";
-    /**
-     * Crypto Operations
-     */
-    const GeneratePkceCodes = "generatePkceCodes";
-    const GenerateCodeVerifier = "generateCodeVerifier";
-    const GenerateCodeChallengeFromVerifier = "generateCodeChallengeFromVerifier";
-    const Sha256Digest = "sha256Digest";
-    const GetRandomValues = "getRandomValues";
-    const GenerateHKDF = "generateHKDF";
-    const GenerateBaseKey = "generateBaseKey";
-    const Base64Decode = "base64Decode";
-    const UrlEncodeArr = "urlEncodeArr";
-    const Encrypt = "encrypt";
-    const Decrypt = "decrypt";
-    const GenerateEarKey = "generateEarKey";
-    const DecryptEarResponse = "decryptEarResponse";
-    const LoadAccount = "loadAccount";
-    const LoadIdToken = "loadIdToken";
-    const LoadAccessToken = "loadAccessToken";
-    const LoadRefreshToken = "loadRefreshToken";
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -10298,7 +10335,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "5.6.1";
+    const version = "5.6.3";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12762,9 +12799,9 @@
             }
             // Get the preferred_cache domain for the given authority
             const authority = await getDiscoveredAuthority(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, request.authority);
-            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, undefined, // environment
+            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, authority.getPreferredCache(), // environment
             idTokenClaims.tid, undefined, // auth code payload
-            response.account.id);
+            response.account.id, this.logger, this.performanceClient);
             // Ensure expires_in is in number format
             response.expires_in = Number(response.expires_in);
             // generate authenticationResult
@@ -13649,7 +13686,7 @@
      *
      * @returns Configuration object
      */
-    function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system: userInputSystem, telemetry: userInputTelemetry, }, isBrowserEnvironment) {
+    function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system: userInputSystem, experimental: userInputExperimental, telemetry: userInputTelemetry, }, isBrowserEnvironment) {
         // Default auth options for browser
         const DEFAULT_AUTH_OPTIONS = {
             clientId: "",
@@ -13721,6 +13758,9 @@
             },
             client: new StubPerformanceClient(),
         };
+        const DEFAULT_EXPERIMENTAL_OPTIONS = {
+            iframeTimeoutTelemetry: false,
+        };
         // Throw an error if user has set OIDCOptions without being in OIDC protocol mode
         if (userInputSystem?.protocolMode !== ProtocolMode.OIDC &&
             userInputAuth?.OIDCOptions) {
@@ -13744,6 +13784,10 @@
             },
             cache: { ...DEFAULT_CACHE_OPTIONS, ...userInputCache },
             system: providedSystemOptions,
+            experimental: {
+                ...DEFAULT_EXPERIMENTAL_OPTIONS,
+                ...userInputExperimental,
+            },
             telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...userInputTelemetry },
         };
         return overlayedConfig;
@@ -15160,6 +15204,16 @@
         authFrame.setAttribute("allow", "local-network-access *");
         document.body.appendChild(authFrame);
         return authFrame;
+    }
+    /**
+     * @hidden
+     * Removes a hidden iframe from `document.body` if it is a direct child.
+     * @param iframe - The iframe element to remove.
+     */
+    function removeHiddenIframe(iframe) {
+        if (document.body === iframe.parentNode) {
+            document.body.removeChild(iframe);
+        }
     }
 
     /*
@@ -15255,9 +15309,15 @@
                 earJwk: earJwk,
                 codeChallenge: pkceCodes.challenge,
             };
-            await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+            const iframe = await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
             const responseType = this.config.auth.OIDCOptions.responseMode;
-            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+            let responseString;
+            try {
+                responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+            }
+            finally {
+                invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
+            }
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
             if (!serverParams.ear_jwe && serverParams.code) {
                 // If server doesn't support EAR, they may fallback to auth code flow instead
@@ -15295,18 +15355,25 @@
                 ...request,
                 codeChallenge: pkceCodes.challenge,
             };
+            let iframe;
             if (request.httpMethod === HttpMethod.POST) {
-                await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+                iframe = await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
             }
             else {
                 // Create authorize request url
                 const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
                 // Get the frame handle for the silent request
-                await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId);
+                iframe = await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId);
             }
             const responseType = this.config.auth.OIDCOptions.responseMode;
             // Wait for response from the redirect bridge.
-            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+            let responseString;
+            try {
+                responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+            }
+            finally {
+                invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
+            }
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
             return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
@@ -15562,22 +15629,32 @@
             this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient, this.eventHandler);
             this.activeSilentTokenRequests = new Map();
             // Register listener functions
-            this.trackPageVisibility = this.trackPageVisibility.bind(this);
+            this.trackStateChange = this.trackStateChange.bind(this);
             // Register listener functions
-            this.trackPageVisibilityWithMeasurement =
-                this.trackPageVisibilityWithMeasurement.bind(this);
+            this.trackStateChangeWithMeasurement =
+                this.trackStateChangeWithMeasurement.bind(this);
         }
         static async createController(operatingContext, request) {
             const controller = new StandardController(operatingContext);
             await controller.initialize(request);
             return controller;
         }
-        trackPageVisibility(correlationId) {
+        trackStateChange(correlationId, event) {
             if (!correlationId) {
                 return;
             }
-            this.logger.info("16v6hv", correlationId);
-            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+            if (event.type === "visibilitychange") {
+                this.logger.info("16v6hv", correlationId);
+                this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+            }
+            else if (event.type === "online") {
+                this.logger.info("0zirfd", correlationId);
+                this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+            }
+            else if (event.type === "offline") {
+                this.logger.info("1xk9ef", correlationId);
+                this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+            }
         }
         /**
          * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -15919,15 +15996,40 @@
                 }
             });
         }
-        trackPageVisibilityWithMeasurement() {
+        trackStateChangeWithMeasurement(event) {
             const measurement = this.ssoSilentMeasurement ||
                 this.acquireTokenByCodeAsyncMeasurement;
             if (!measurement) {
                 return;
             }
-            measurement.increment({
-                visibilityChangeCount: 1,
-            });
+            if (event.type === "visibilitychange") {
+                this.logger.info("0yzimq", measurement.event.correlationId);
+                measurement.increment({
+                    visibilityChangeCount: 1,
+                });
+            }
+            else if (event.type === "online") {
+                this.logger.info("1caf53", measurement.event.correlationId);
+                measurement.increment({
+                    onlineStatusChangeCount: 1,
+                });
+            }
+            else if (event.type === "offline") {
+                this.logger.info("0fdyk7", measurement.event.correlationId);
+                measurement.increment({
+                    onlineStatusChangeCount: 1,
+                });
+            }
+        }
+        addStateChangeListeners(listener) {
+            document.addEventListener("visibilitychange", listener);
+            window.addEventListener("online", listener);
+            window.addEventListener("offline", listener);
+        }
+        removeStateChangeListeners(listener) {
+            document.removeEventListener("visibilitychange", listener);
+            window.removeEventListener("online", listener);
+            window.removeEventListener("offline", listener);
         }
         // #endregion
         // #region Silent Flow
@@ -15961,8 +16063,9 @@
             preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
             this.ssoSilentMeasurement?.increment({
                 visibilityChangeCount: 0,
+                onlineStatusChangeCount: 0,
             });
-            document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
             const loggedInAccounts = this.getAllAccounts();
             this.logger.verbose("0w1b45", correlationId);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Silent, validRequest);
@@ -16005,7 +16108,7 @@
                 throw e;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+                this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
             });
         }
         /**
@@ -16112,8 +16215,9 @@
                 this.performanceClient.startMeasurement(AcquireTokenByCodeAsync, correlationId);
             this.acquireTokenByCodeAsyncMeasurement?.increment({
                 visibilityChangeCount: 0,
+                onlineStatusChangeCount: 0,
             });
-            document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
             const silentAuthCodeClient = this.createSilentAuthCodeClient(correlationId);
             const silentTokenResult = await silentAuthCodeClient
                 .acquireToken(request)
@@ -16132,7 +16236,7 @@
                 throw tokenRenewalError;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+                this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
             });
             return silentTokenResult;
         }
@@ -16594,12 +16698,12 @@
          * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
          */
         async acquireTokenSilentAsync(request, account) {
-            const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+            const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, request.correlationId, exports.InteractionType.Silent, request);
             if (request.correlationId) {
-                this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+                this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
             }
-            document.addEventListener("visibilitychange", trackPageVisibility);
+            this.addStateChangeListeners(trackStateChange);
             const silentRequest = await invokeAsync(initializeSilentRequest, InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
             const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
             const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
@@ -16681,7 +16785,7 @@
                 throw tokenRenewalError;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", trackPageVisibility);
+                this.removeStateChangeListeners(trackStateChange);
             });
         }
         /**
@@ -18281,7 +18385,7 @@
             const storage = new BrowserCacheManager(browserConfig.auth.clientId, browserConfig.cache, cryptoOps, logger, browserConfig.telemetry.client, new EventHandler(logger), buildStaticAuthorityOptions(browserConfig.auth));
             const authorityString = request.authority || browserConfig.auth.authority;
             const authority = await createDiscoveredInstance(Authority.generateAuthority(authorityString, request.azureCloudOptions), browserConfig.system.networkClient, storage, authorityOptions, logger, correlationId, performanceClient);
-            const cacheRecordAccount = await invokeAsync(loadAccount, LoadAccount, logger, performanceClient, correlationId)(request, options.clientInfo || response.client_info || "", correlationId, storage, logger, cryptoOps, authority, idTokenClaims);
+            const cacheRecordAccount = await invokeAsync(loadAccount, LoadAccount, logger, performanceClient, correlationId)(request, options.clientInfo || response.client_info || "", correlationId, storage, logger, cryptoOps, authority, idTokenClaims, performanceClient);
             const idToken = await invokeAsync(loadIdToken, LoadIdToken, logger, performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, kmsi, correlationId, storage, logger, config.auth.clientId);
             const accessToken = await invokeAsync(loadAccessToken, LoadAccessToken, logger, performanceClient, correlationId)(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, kmsi, options, correlationId, storage, logger, config.auth.clientId);
             const refreshToken = await invokeAsync(loadRefreshToken, LoadRefreshToken, logger, performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, kmsi, correlationId, storage, logger, config.auth.clientId, performanceClient);
@@ -18307,7 +18411,7 @@
      * @param requestHomeAccountId
      * @returns `AccountEntity`
      */
-    async function loadAccount(request, clientInfo, correlationId, storage, logger, cryptoObj, authority, idTokenClaims) {
+    async function loadAccount(request, clientInfo, correlationId, storage, logger, cryptoObj, authority, idTokenClaims, performanceClient) {
         logger.verbose("0ke46k", correlationId);
         if (request.account) {
             const accountEntity = createAccountEntityFromAccountInfo(request.account);
@@ -18322,7 +18426,7 @@
         const claimsTenantId = idTokenClaims?.tid;
         const cachedAccount = buildAccountToCache(storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.getPreferredCache(), claimsTenantId, undefined, // authCodePayload
         undefined, // nativeAccountId
-        logger);
+        logger, performanceClient);
         await storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}), ApiId.loadExternalTokens);
         return cachedAccount;
     }
@@ -18594,6 +18698,9 @@
         getPageVisibility() {
             return document.visibilityState?.toString() || null;
         }
+        getOnlineStatus() {
+            return typeof navigator !== "undefined" ? navigator.onLine : null;
+        }
         deleteIncompleteSubMeasurements(inProgressEvent) {
             void getPerfMeasurementModule()?.then((module) => {
                 const rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
@@ -18620,6 +18727,7 @@
         startMeasurement(measureName, correlationId) {
             // Capture page visibilityState and then invoke start/end measurement
             const startPageVisibility = this.getPageVisibility();
+            const startOnlineStatus = this.getOnlineStatus();
             const inProgressEvent = super.startMeasurement(measureName, correlationId);
             const startTime = supportsBrowserPerformanceNow()
                 ? window.performance.now()
@@ -18635,6 +18743,7 @@
                     const res = inProgressEvent.end({
                         ...event,
                         startPageVisibility,
+                        startOnlineStatus,
                         endPageVisibility: this.getPageVisibility(),
                         durationMs: getPerfDurationMs(startTime),
                         networkEffectiveType: networkInfo.effectiveType,