@azure/msal-browser 2.33.0 → 2.35.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.33.0 2023-02-06 */
+/*! @azure/msal-browser v2.35.0 2023-04-03 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -119,7 +119,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -206,7 +206,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -453,22 +453,6 @@
         CredentialType["ACCESS_TOKEN_WITH_AUTH_SCHEME"] = "AccessToken_With_AuthScheme";
         CredentialType["REFRESH_TOKEN"] = "RefreshToken";
     })(CredentialType || (CredentialType = {}));
-    /**
-     * Credential Type stored in the cache
-     */
-    var CacheSchemaType;
-    (function (CacheSchemaType) {
-        CacheSchemaType["ACCOUNT"] = "Account";
-        CacheSchemaType["CREDENTIAL"] = "Credential";
-        CacheSchemaType["ID_TOKEN"] = "IdToken";
-        CacheSchemaType["ACCESS_TOKEN"] = "AccessToken";
-        CacheSchemaType["REFRESH_TOKEN"] = "RefreshToken";
-        CacheSchemaType["APP_METADATA"] = "AppMetadata";
-        CacheSchemaType["TEMPORARY"] = "TempCache";
-        CacheSchemaType["TELEMETRY"] = "Telemetry";
-        CacheSchemaType["UNDEFINED"] = "Undefined";
-        CacheSchemaType["THROTTLING"] = "Throttling";
-    })(CacheSchemaType || (CacheSchemaType = {}));
     /**
      * Combine all cache types
      */
@@ -588,9 +572,10 @@
     (function (JsonTypes) {
         JsonTypes["Jwt"] = "JWT";
         JsonTypes["Jwk"] = "JWK";
+        JsonTypes["Pop"] = "pop";
     })(JsonTypes || (JsonTypes = {}));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -646,7 +631,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -721,7 +706,7 @@
         }
     };
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -925,6 +910,14 @@
         keyIdMissing: {
             code: "key_id_missing",
             desc: "A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key."
+        },
+        noNetworkConnectivity: {
+            code: "no_network_connectivity",
+            desc: "No network connectivity. Check your internet connection."
+        },
+        userCanceledError: {
+            code: "user_canceled",
+            desc: "User canceled the flow."
         }
     };
     /**
@@ -1213,10 +1206,22 @@
         ClientAuthError.createKeyIdMissingError = function () {
             return new ClientAuthError(ClientAuthErrorMessage.keyIdMissing.code, ClientAuthErrorMessage.keyIdMissing.desc);
         };
+        /**
+         * Create an error when the client does not have network connectivity
+         */
+        ClientAuthError.createNoNetworkConnectivityError = function () {
+            return new ClientAuthError(ClientAuthErrorMessage.noNetworkConnectivity.code, ClientAuthErrorMessage.noNetworkConnectivity.desc);
+        };
+        /**
+         * Create an error when the user cancels the flow
+         */
+        ClientAuthError.createUserCanceledError = function () {
+            return new ClientAuthError(ClientAuthErrorMessage.userCanceledError.code, ClientAuthErrorMessage.userCanceledError.desc);
+        };
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1341,7 +1346,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1531,12 +1536,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "10.0.0";
+    var version$1 = "12.0.0";
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1557,181 +1562,7 @@
         AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
     })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Base type for credentials to be stored in the cache: eg: ACCESS_TOKEN, ID_TOKEN etc
-     *
-     * Key:Value Schema:
-     *
-     * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
-     *
-     * Value Schema:
-     * {
-     *      homeAccountId: home account identifier for the auth scheme,
-     *      environment: entity that issued the token, represented as a full host
-     *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
-     *      clientId: client ID of the application
-     *      secret: Actual credential as a string
-     *      familyId: Family ID identifier, usually only used for refresh tokens
-     *      realm: Full tenant or organizational identifier that the account belongs to
-     *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
-     *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
-     *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
-     *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
-     * }
-     */
-    var CredentialEntity = /** @class */ (function () {
-        function CredentialEntity() {
-        }
-        /**
-         * Initializes a map with credential {CredentialType} regular expressions.
-         */
-        CredentialEntity._initRegex = function () {
-            var separator = Separators.CACHE_KEY_SEPARATOR;
-            CredentialEntity.credentialRegexMap = new Map();
-            for (var _i = 0, _a = Object.keys(CredentialType); _i < _a.length; _i++) {
-                var credKey = _a[_i];
-                var credVal = CredentialType[credKey].toLowerCase();
-                try {
-                    // Verify credential type is preceded by a valid host name (environment) using lookbehind
-                    CredentialEntity.credentialRegexMap.set(CredentialType[credKey], new RegExp("(?<=" + separator + CredentialEntity.credentialDomainRegex + ")" + separator + credVal + separator));
-                }
-                catch (err) {
-                    // Lookbehind is not supported (Safari or older versions of IE) - removing it
-                    CredentialEntity.credentialRegexMap.set(CredentialType[credKey], new RegExp("" + separator + CredentialEntity.credentialDomainRegex + separator + credVal + separator));
-                }
-            }
-        };
-        /**
-         * Generate Account Id key component as per the schema: <home_account_id>-<environment>
-         */
-        CredentialEntity.prototype.generateAccountId = function () {
-            return CredentialEntity.generateAccountIdForCacheKey(this.homeAccountId, this.environment);
-        };
-        /**
-         * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
-         */
-        CredentialEntity.prototype.generateCredentialId = function () {
-            return CredentialEntity.generateCredentialIdForCacheKey(this.credentialType, this.clientId, this.realm, this.familyId);
-        };
-        /**
-         * Generate target key component as per schema: <target>
-         */
-        CredentialEntity.prototype.generateTarget = function () {
-            return CredentialEntity.generateTargetForCacheKey(this.target);
-        };
-        /**
-         * generates credential key
-         */
-        CredentialEntity.prototype.generateCredentialKey = function () {
-            return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
-        };
-        /**
-         * returns the type of the cache (in this case credential)
-         */
-        CredentialEntity.prototype.generateType = function () {
-            switch (this.credentialType) {
-                case CredentialType.ID_TOKEN:
-                    return CacheType.ID_TOKEN;
-                case CredentialType.ACCESS_TOKEN:
-                case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                    return CacheType.ACCESS_TOKEN;
-                case CredentialType.REFRESH_TOKEN:
-                    return CacheType.REFRESH_TOKEN;
-                default: {
-                    throw ClientAuthError.createUnexpectedCredentialTypeError();
-                }
-            }
-        };
-        /**
-         * helper function to return `CredentialType`
-         * @param key
-         */
-        CredentialEntity.getCredentialType = function (key) {
-            var _a;
-            for (var _i = 0, _b = Object.keys(CredentialType); _i < _b.length; _i++) {
-                var credKey = _b[_i];
-                if ((_a = this.credentialRegexMap.get(CredentialType[credKey])) === null || _a === void 0 ? void 0 : _a.test(key.toLowerCase())) {
-                    return CredentialType[credKey];
-                }
-            }
-            return Constants.NOT_DEFINED;
-        };
-        /**
-         * generates credential key
-         * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
-         */
-        CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
-            var credentialKey = [
-                this.generateAccountIdForCacheKey(homeAccountId, environment),
-                this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-                this.generateTargetForCacheKey(target),
-                this.generateClaimsHashForCacheKey(requestedClaimsHash),
-                this.generateSchemeForCacheKey(tokenType)
-            ];
-            return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-        };
-        /**
-         * generates Account Id for keys
-         * @param homeAccountId
-         * @param environment
-         */
-        CredentialEntity.generateAccountIdForCacheKey = function (homeAccountId, environment) {
-            var accountId = [homeAccountId, environment];
-            return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-        };
-        /**
-         * Generates Credential Id for keys
-         * @param credentialType
-         * @param realm
-         * @param clientId
-         * @param familyId
-         */
-        CredentialEntity.generateCredentialIdForCacheKey = function (credentialType, clientId, realm, familyId) {
-            var clientOrFamilyId = credentialType === CredentialType.REFRESH_TOKEN
-                ? familyId || clientId
-                : clientId;
-            var credentialId = [
-                credentialType,
-                clientOrFamilyId,
-                realm || Constants.EMPTY_STRING,
-            ];
-            return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-        };
-        /**
-         * Generate target key component as per schema: <target>
-         */
-        CredentialEntity.generateTargetForCacheKey = function (scopes) {
-            return (scopes || Constants.EMPTY_STRING).toLowerCase();
-        };
-        /**
-         * Generate requested claims key component as per schema: <requestedClaims>
-         */
-        CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
-            return (requestedClaimsHash || Constants.EMPTY_STRING).toLowerCase();
-        };
-        /**
-         * Generate scheme key componenet as per schema: <scheme>
-         */
-        CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
-            /*
-             * PoP Tokens and SSH certs include scheme in cache key
-             * Cast to lowercase to handle "bearer" from ADFS
-             */
-            return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : Constants.EMPTY_STRING;
-        };
-        // Match host names like "login.microsoftonline.com", "https://accounts.google.com:4000", https://localhost:5000, etc.
-        CredentialEntity.credentialDomainRegex = "(https?:\\/\\/)?((([\\w-]+\\.)*([\\w-]{1,63})(\\.(\\w{2,63})))|(localhost))(\\:[0-9]{4,5})?";
-        return CredentialEntity;
-    }());
-    CredentialEntity._initRegex();
-
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1986,7 +1817,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2019,6 +1850,21 @@
             var inputScopes = scopeString.split(" ");
             return new ScopeSet(inputScopes);
         };
+        /**
+         * Creates the set of scopes to search for in cache lookups
+         * @param inputScopeString
+         * @returns
+         */
+        ScopeSet.createSearchScopes = function (inputScopeString) {
+            var scopeSet = new ScopeSet(inputScopeString);
+            if (!scopeSet.containsOnlyOIDCScopes()) {
+                scopeSet.removeOIDCScopes();
+            }
+            else {
+                scopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
+            }
+            return scopeSet;
+        };
         /**
          * Used to validate the scopes input parameter requested  by the developer.
          * @param {Array<string>} inputScopes - Developer requested permissions. Not all scopes are guaranteed to be included in the access token returned.
@@ -2170,7 +2016,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2208,7 +2054,7 @@
         };
     }
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2223,7 +2069,7 @@
         AuthorityType[AuthorityType["Dsts"] = 2] = "Dsts";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2462,7 +2308,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2514,7 +2360,7 @@
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2524,35 +2370,59 @@
      * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
      */
     var CacheManager = /** @class */ (function () {
-        function CacheManager(clientId, cryptoImpl) {
+        function CacheManager(clientId, cryptoImpl, logger) {
             this.clientId = clientId;
             this.cryptoImpl = cryptoImpl;
+            this.commonLogger = logger.clone(name$1, version$1);
         }
         /**
          * Returns all accounts in cache
          */
         CacheManager.prototype.getAllAccounts = function () {
             var _this = this;
-            var currentAccounts = this.getAccountsFilteredBy();
-            var accountValues = Object.keys(currentAccounts).map(function (accountKey) { return currentAccounts[accountKey]; });
-            var numAccounts = accountValues.length;
-            if (numAccounts < 1) {
+            var allAccountKeys = this.getAccountKeys();
+            if (allAccountKeys.length < 1) {
+                return [];
+            }
+            var accountEntities = allAccountKeys.reduce(function (accounts, key) {
+                var entity = _this.getAccount(key);
+                if (!entity) {
+                    return accounts;
+                }
+                accounts.push(entity);
+                return accounts;
+            }, []);
+            if (accountEntities.length < 1) {
                 return [];
             }
             else {
-                var allAccounts = accountValues.map(function (value) {
-                    var accountEntity = CacheManager.toObject(new AccountEntity(), value);
-                    var accountInfo = accountEntity.getAccountInfo();
-                    var idToken = _this.readIdTokenFromCache(_this.clientId, accountInfo);
-                    if (idToken && !accountInfo.idTokenClaims) {
-                        accountInfo.idToken = idToken.secret;
-                        accountInfo.idTokenClaims = new AuthToken(idToken.secret, _this.cryptoImpl).claims;
-                    }
-                    return accountInfo;
+                var allAccounts = accountEntities.map(function (accountEntity) {
+                    return _this.getAccountInfoFromEntity(accountEntity);
                 });
                 return allAccounts;
             }
         };
+        /**
+         * Gets accountInfo object based on provided filters
+         */
+        CacheManager.prototype.getAccountInfoFilteredBy = function (accountFilter) {
+            var allAccounts = this.getAccountsFilteredBy(accountFilter);
+            if (allAccounts.length > 0) {
+                return this.getAccountInfoFromEntity(allAccounts[0]);
+            }
+            else {
+                return null;
+            }
+        };
+        CacheManager.prototype.getAccountInfoFromEntity = function (accountEntity) {
+            var accountInfo = accountEntity.getAccountInfo();
+            var idToken = this.getIdToken(accountInfo);
+            if (idToken) {
+                accountInfo.idToken = idToken.secret;
+                accountInfo.idTokenClaims = new AuthToken(idToken.secret, this.cryptoImpl).claims;
+            }
+            return accountInfo;
+        };
         /**
          * saves a cache record
          * @param cacheRecord
@@ -2594,12 +2464,12 @@
          */
         CacheManager.prototype.saveAccessToken = function (credential) {
             return __awaiter(this, void 0, void 0, function () {
-                var currentTokenCache, currentScopes, currentAccessTokens, removedAccessTokens_1;
+                var accessTokenFilter, tokenKeys, currentScopes, removedAccessTokens;
                 var _this = this;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            currentTokenCache = this.getCredentialsFilteredBy({
+                            accessTokenFilter = {
                                 clientId: credential.clientId,
                                 credentialType: credential.credentialType,
                                 environment: credential.environment,
@@ -2607,22 +2477,25 @@
                                 realm: credential.realm,
                                 tokenType: credential.tokenType,
                                 requestedClaimsHash: credential.requestedClaimsHash
-                            });
+                            };
+                            tokenKeys = this.getTokenKeys();
                             currentScopes = ScopeSet.fromString(credential.target);
-                            currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
-                            if (!currentAccessTokens) return [3 /*break*/, 2];
-                            removedAccessTokens_1 = [];
-                            currentAccessTokens.forEach(function (tokenEntity) {
-                                var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
-                                if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                                    removedAccessTokens_1.push(_this.removeCredential(tokenEntity));
+                            removedAccessTokens = [];
+                            tokenKeys.accessToken.forEach(function (key) {
+                                if (!_this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
+                                    return;
+                                }
+                                var tokenEntity = _this.getAccessTokenCredential(key);
+                                if (tokenEntity && _this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
+                                    var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                                    if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
+                                        removedAccessTokens.push(_this.removeAccessToken(key));
+                                    }
                                 }
                             });
-                            return [4 /*yield*/, Promise.all(removedAccessTokens_1)];
+                            return [4 /*yield*/, Promise.all(removedAccessTokens)];
                         case 1:
                             _a.sent();
-                            _a.label = 2;
-                        case 2:
                             this.setAccessTokenCredential(credential);
                             return [2 /*return*/];
                     }
@@ -2637,149 +2510,151 @@
          * @param realm
          */
         CacheManager.prototype.getAccountsFilteredBy = function (accountFilter) {
-            return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING, accountFilter ? accountFilter.nativeAccountId : Constants.EMPTY_STRING);
-        };
-        /**
-         * retrieve accounts matching all provided filters; if no filter is set, get all accounts
-         * not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
-         * @param homeAccountId
-         * @param environment
-         * @param realm
-         */
-        CacheManager.prototype.getAccountsFilteredByInternal = function (homeAccountId, environment, realm, nativeAccountId) {
             var _this = this;
-            var allCacheKeys = this.getKeys();
-            var matchingAccounts = {};
-            allCacheKeys.forEach(function (cacheKey) {
+            var allAccountKeys = this.getAccountKeys();
+            var matchingAccounts = [];
+            allAccountKeys.forEach(function (cacheKey) {
+                if (!_this.isAccountKey(cacheKey, accountFilter.homeAccountId, accountFilter.realm)) {
+                    // Don't parse value if the key doesn't match the account filters
+                    return;
+                }
                 var entity = _this.getAccount(cacheKey);
                 if (!entity) {
                     return;
                 }
-                if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
+                if (!!accountFilter.homeAccountId && !_this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                     return;
                 }
-                if (!!environment && !_this.matchEnvironment(entity, environment)) {
+                if (!!accountFilter.localAccountId && !_this.matchLocalAccountId(entity, accountFilter.localAccountId)) {
+                    return;
+                }
+                if (!!accountFilter.username && !_this.matchUsername(entity, accountFilter.username)) {
                     return;
                 }
-                if (!!realm && !_this.matchRealm(entity, realm)) {
+                if (!!accountFilter.environment && !_this.matchEnvironment(entity, accountFilter.environment)) {
                     return;
                 }
-                if (!!nativeAccountId && !_this.matchNativeAccountId(entity, nativeAccountId)) {
+                if (!!accountFilter.realm && !_this.matchRealm(entity, accountFilter.realm)) {
                     return;
                 }
-                matchingAccounts[cacheKey] = entity;
+                if (!!accountFilter.nativeAccountId && !_this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
+                    return;
+                }
+                matchingAccounts.push(entity);
             });
             return matchingAccounts;
         };
         /**
-         * retrieve credentails matching all provided filters; if no filter is set, get all credentials
+         * Returns true if the given key matches our account key schema. Also matches homeAccountId and/or tenantId if provided
+         * @param key
          * @param homeAccountId
-         * @param environment
-         * @param credentialType
-         * @param clientId
-         * @param realm
-         * @param target
+         * @param tenantId
+         * @returns
          */
-        CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-            return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.userAssertionHash, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
+        CacheManager.prototype.isAccountKey = function (key, homeAccountId, tenantId) {
+            if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 3) {
+                // Account cache keys contain 3 items separated by '-' (each item may also contain '-')
+                return false;
+            }
+            if (homeAccountId && !key.toLowerCase().includes(homeAccountId.toLowerCase())) {
+                return false;
+            }
+            if (tenantId && !key.toLowerCase().includes(tenantId.toLowerCase())) {
+                return false;
+            }
+            // Do not check environment as aliasing can cause false negatives
+            return true;
         };
         /**
-         * Support function to help match credentials
-         * @param homeAccountId
-         * @param environment
-         * @param credentialType
-         * @param clientId
-         * @param realm
-         * @param target
-         * @param userAssertionHash
-         * @param tokenType
+         * Returns true if the given key matches our credential key schema.
+         * @param key
          */
-        CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, userAssertionHash, tokenType, keyId, requestedClaimsHash) {
-            var _this = this;
-            var allCacheKeys = this.getKeys();
-            var matchingCredentials = {
-                idTokens: {},
-                accessTokens: {},
-                refreshTokens: {},
-            };
-            allCacheKeys.forEach(function (cacheKey) {
-                // don't parse any non-credential type cache entities
-                var credType = CredentialEntity.getCredentialType(cacheKey);
-                if (credType === Constants.NOT_DEFINED) {
-                    return;
-                }
-                // Attempt retrieval
-                var entity = _this.getSpecificCredential(cacheKey, credType);
-                if (!entity) {
-                    return;
-                }
-                if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
-                    return;
-                }
-                /*
-                 * homeAccountId can undefined, and we want to filter out cached items that have a homeAccountId of ""
-                 * because we don't want a client_credential request to return a cached token that has a homeAccountId
-                 */
-                if ((typeof homeAccountId === "string") && !_this.matchHomeAccountId(entity, homeAccountId)) {
-                    return;
-                }
-                if (!!environment && !_this.matchEnvironment(entity, environment)) {
-                    return;
-                }
-                if (!!realm && !_this.matchRealm(entity, realm)) {
-                    return;
-                }
-                if (!!credentialType && !_this.matchCredentialType(entity, credentialType)) {
-                    return;
-                }
-                if (!!clientId && !_this.matchClientId(entity, clientId)) {
-                    return;
-                }
-                if (!!familyId && !_this.matchFamilyId(entity, familyId)) {
-                    return;
+        CacheManager.prototype.isCredentialKey = function (key) {
+            if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 6) {
+                // Credential cache keys contain 6 items separated by '-' (each item may also contain '-')
+                return false;
+            }
+            var lowerCaseKey = key.toLowerCase();
+            // Credential keys must indicate what credential type they represent
+            if (lowerCaseKey.indexOf(CredentialType.ID_TOKEN.toLowerCase()) === -1 &&
+                lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN.toLowerCase()) === -1 &&
+                lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) === -1 &&
+                lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) === -1) {
+                return false;
+            }
+            if (lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) > -1) {
+                // Refresh tokens must contain the client id or family id
+                var clientIdValidation = "" + CredentialType.REFRESH_TOKEN + Separators.CACHE_KEY_SEPARATOR + this.clientId + Separators.CACHE_KEY_SEPARATOR;
+                var familyIdValidation = "" + CredentialType.REFRESH_TOKEN + Separators.CACHE_KEY_SEPARATOR + THE_FAMILY_ID + Separators.CACHE_KEY_SEPARATOR;
+                if (lowerCaseKey.indexOf(clientIdValidation.toLowerCase()) === -1 && lowerCaseKey.indexOf(familyIdValidation.toLowerCase()) === -1) {
+                    return false;
                 }
-                /*
-                 * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
-                 * Resource specific refresh tokens case will be added when the support is deemed necessary
-                 */
-                if (!!target && !_this.matchTarget(entity, target)) {
-                    return;
+            }
+            else if (lowerCaseKey.indexOf(this.clientId.toLowerCase()) === -1) {
+                // Tokens must contain the clientId
+                return false;
+            }
+            return true;
+        };
+        /**
+         * Returns whether or not the given credential entity matches the filter
+         * @param entity
+         * @param filter
+         * @returns
+         */
+        CacheManager.prototype.credentialMatchesFilter = function (entity, filter) {
+            if (!!filter.clientId && !this.matchClientId(entity, filter.clientId)) {
+                return false;
+            }
+            if (!!filter.userAssertionHash && !this.matchUserAssertionHash(entity, filter.userAssertionHash)) {
+                return false;
+            }
+            /*
+             * homeAccountId can be undefined, and we want to filter out cached items that have a homeAccountId of ""
+             * because we don't want a client_credential request to return a cached token that has a homeAccountId
+             */
+            if ((typeof filter.homeAccountId === "string") && !this.matchHomeAccountId(entity, filter.homeAccountId)) {
+                return false;
+            }
+            if (!!filter.environment && !this.matchEnvironment(entity, filter.environment)) {
+                return false;
+            }
+            if (!!filter.realm && !this.matchRealm(entity, filter.realm)) {
+                return false;
+            }
+            if (!!filter.credentialType && !this.matchCredentialType(entity, filter.credentialType)) {
+                return false;
+            }
+            if (!!filter.familyId && !this.matchFamilyId(entity, filter.familyId)) {
+                return false;
+            }
+            /*
+             * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
+             * Resource specific refresh tokens case will be added when the support is deemed necessary
+             */
+            if (!!filter.target && !this.matchTarget(entity, filter.target)) {
+                return false;
+            }
+            // If request OR cached entity has requested Claims Hash, check if they match
+            if (filter.requestedClaimsHash || entity.requestedClaimsHash) {
+                // Don't match if either is undefined or they are different
+                if (entity.requestedClaimsHash !== filter.requestedClaimsHash) {
+                    return false;
                 }
-                // If request OR cached entity has requested Claims Hash, check if they match
-                if (requestedClaimsHash || entity.requestedClaimsHash) {
-                    // Don't match if either is undefined or they are different
-                    if (entity.requestedClaimsHash !== requestedClaimsHash) {
-                        return;
-                    }
+            }
+            // Access Token with Auth Scheme specific matching
+            if (entity.credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
+                if (!!filter.tokenType && !this.matchTokenType(entity, filter.tokenType)) {
+                    return false;
                 }
-                // Access Token with Auth Scheme specific matching
-                if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
-                    if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
-                        return;
-                    }
-                    // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-                    if (tokenType === exports.AuthenticationScheme.SSH) {
-                        if (keyId && !_this.matchKeyId(entity, keyId)) {
-                            return;
-                        }
+                // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                if (filter.tokenType === exports.AuthenticationScheme.SSH) {
+                    if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
+                        return false;
                     }
                 }
-                // At this point, the entity matches the request, update cache key if key schema has changed
-                var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
-                switch (credType) {
-                    case CredentialType.ID_TOKEN:
-                        matchingCredentials.idTokens[updatedCacheKey] = entity;
-                        break;
-                    case CredentialType.ACCESS_TOKEN:
-                    case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                        matchingCredentials.accessTokens[updatedCacheKey] = entity;
-                        break;
-                    case CredentialType.REFRESH_TOKEN:
-                        matchingCredentials.refreshTokens[updatedCacheKey] = entity;
-                        break;
-                }
-            });
-            return matchingCredentials;
+            }
+            return true;
         };
         /**
          * retrieve appMetadata matching all provided filters; if no filter is set, get all appMetadata
@@ -2847,30 +2722,26 @@
          */
         CacheManager.prototype.removeAllAccounts = function () {
             return __awaiter(this, void 0, void 0, function () {
-                var allCacheKeys, removedAccounts;
+                var allAccountKeys, removedAccounts;
                 var _this = this;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            allCacheKeys = this.getKeys();
+                            allAccountKeys = this.getAccountKeys();
                             removedAccounts = [];
-                            allCacheKeys.forEach(function (cacheKey) {
-                                var entity = _this.getAccount(cacheKey);
-                                if (!entity) {
-                                    return;
-                                }
+                            allAccountKeys.forEach(function (cacheKey) {
                                 removedAccounts.push(_this.removeAccount(cacheKey));
                             });
                             return [4 /*yield*/, Promise.all(removedAccounts)];
                         case 1:
                             _a.sent();
-                            return [2 /*return*/, true];
+                            return [2 /*return*/];
                     }
                 });
             });
         };
         /**
-         * returns a boolean if the given account is removed
+         * Removes the account and related tokens for a given account key
          * @param account
          */
         CacheManager.prototype.removeAccount = function (accountKey) {
@@ -2884,7 +2755,10 @@
                                 throw ClientAuthError.createNoAccountFoundError();
                             }
                             return [4 /*yield*/, this.removeAccountContext(account)];
-                        case 1: return [2 /*return*/, ((_a.sent()) && this.removeItem(accountKey, CacheSchemaType.ACCOUNT))];
+                        case 1:
+                            _a.sent();
+                            this.removeItem(accountKey);
+                            return [2 /*return*/];
                     }
                 });
             });
@@ -2895,29 +2769,33 @@
          */
         CacheManager.prototype.removeAccountContext = function (account) {
             return __awaiter(this, void 0, void 0, function () {
-                var allCacheKeys, accountId, removedCredentials;
+                var allTokenKeys, accountId, removedCredentials;
                 var _this = this;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            allCacheKeys = this.getKeys();
+                            allTokenKeys = this.getTokenKeys();
                             accountId = account.generateAccountId();
                             removedCredentials = [];
-                            allCacheKeys.forEach(function (cacheKey) {
-                                // don't parse any non-credential type cache entities
-                                var credType = CredentialEntity.getCredentialType(cacheKey);
-                                if (credType === Constants.NOT_DEFINED) {
-                                    return;
+                            allTokenKeys.idToken.forEach(function (key) {
+                                if (key.indexOf(accountId) === 0) {
+                                    _this.removeIdToken(key);
                                 }
-                                var cacheEntity = _this.getSpecificCredential(cacheKey, credType);
-                                if (!!cacheEntity && accountId === cacheEntity.generateAccountId()) {
-                                    removedCredentials.push(_this.removeCredential(cacheEntity));
+                            });
+                            allTokenKeys.accessToken.forEach(function (key) {
+                                if (key.indexOf(accountId) === 0) {
+                                    removedCredentials.push(_this.removeAccessToken(key));
+                                }
+                            });
+                            allTokenKeys.refreshToken.forEach(function (key) {
+                                if (key.indexOf(accountId) === 0) {
+                                    _this.removeRefreshToken(key);
                                 }
                             });
                             return [4 /*yield*/, Promise.all(removedCredentials)];
                         case 1:
                             _a.sent();
-                            return [2 /*return*/, true];
+                            return [2 /*return*/];
                     }
                 });
             });
@@ -2926,13 +2804,16 @@
          * returns a boolean if the given credential is removed
          * @param credential
          */
-        CacheManager.prototype.removeCredential = function (credential) {
+        CacheManager.prototype.removeAccessToken = function (key) {
             return __awaiter(this, void 0, void 0, function () {
-                var key, accessTokenWithAuthSchemeEntity, kid;
+                var credential, accessTokenWithAuthSchemeEntity, kid;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            key = credential.generateCredentialKey();
+                            credential = this.getAccessTokenCredential(key);
+                            if (!credential) {
+                                return [2 /*return*/];
+                            }
                             if (!(credential.credentialType.toLowerCase() === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())) return [3 /*break*/, 4];
                             if (!(credential.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 4];
                             accessTokenWithAuthSchemeEntity = credential;
@@ -2948,7 +2829,7 @@
                         case 3:
                             _a.sent();
                             throw ClientAuthError.createBindingKeyNotRemovedError();
-                        case 4: return [2 /*return*/, this.removeItem(key, CacheSchemaType.CREDENTIAL)];
+                        case 4: return [2 /*return*/, this.removeItem(key)];
                     }
                 });
             });
@@ -2961,7 +2842,7 @@
             var allCacheKeys = this.getKeys();
             allCacheKeys.forEach(function (cacheKey) {
                 if (_this.isAppMetadata(cacheKey)) {
-                    _this.removeItem(cacheKey, CacheSchemaType.APP_METADATA);
+                    _this.removeItem(cacheKey);
                 }
             });
             return true;
@@ -2974,12 +2855,13 @@
          * @param environment
          * @param authScheme
          */
-        CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
+        CacheManager.prototype.readCacheRecord = function (account, request, environment) {
+            var tokenKeys = this.getTokenKeys();
             var cachedAccount = this.readAccountFromCache(account);
-            var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-            var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
-            var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
-            var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
+            var cachedIdToken = this.getIdToken(account, tokenKeys);
+            var cachedAccessToken = this.getAccessToken(account, request, tokenKeys);
+            var cachedRefreshToken = this.getRefreshToken(account, false, tokenKeys);
+            var cachedAppMetadata = this.readAppMetadataFromCache(environment);
             if (cachedAccount && cachedIdToken) {
                 cachedAccount.idTokenClaims = new AuthToken(cachedIdToken.secret, this.cryptoImpl).claims;
             }
@@ -2999,51 +2881,83 @@
             var accountKey = AccountEntity.generateAccountCacheKey(account);
             return this.getAccount(accountKey);
         };
-        /**
-         * Retrieve AccountEntity from cache
-         * @param nativeAccountId
-         * @returns AccountEntity or Null
-         */
-        CacheManager.prototype.readAccountFromCacheWithNativeAccountId = function (nativeAccountId) {
-            // fetch account from memory
-            var accountFilter = {
-                nativeAccountId: nativeAccountId
-            };
-            var accountCache = this.getAccountsFilteredBy(accountFilter);
-            var accounts = Object.keys(accountCache).map(function (key) { return accountCache[key]; });
-            if (accounts.length < 1) {
-                return null;
-            }
-            else if (accounts.length > 1) {
-                throw ClientAuthError.createMultipleMatchingAccountsInCacheError();
-            }
-            return accountCache[0];
-        };
         /**
          * Retrieve IdTokenEntity from cache
          * @param clientId
          * @param account
          * @param inputRealm
          */
-        CacheManager.prototype.readIdTokenFromCache = function (clientId, account) {
+        CacheManager.prototype.getIdToken = function (account, tokenKeys) {
+            this.commonLogger.trace("CacheManager - getIdToken called");
             var idTokenFilter = {
                 homeAccountId: account.homeAccountId,
                 environment: account.environment,
                 credentialType: CredentialType.ID_TOKEN,
-                clientId: clientId,
+                clientId: this.clientId,
                 realm: account.tenantId,
             };
-            var credentialCache = this.getCredentialsFilteredBy(idTokenFilter);
-            var idTokens = Object.keys(credentialCache.idTokens).map(function (key) { return credentialCache.idTokens[key]; });
+            var idTokens = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
             var numIdTokens = idTokens.length;
             if (numIdTokens < 1) {
+                this.commonLogger.info("CacheManager:getIdToken - No token found");
                 return null;
             }
             else if (numIdTokens > 1) {
                 throw ClientAuthError.createMultipleMatchingTokensInCacheError();
             }
+            this.commonLogger.info("CacheManager:getIdToken - Returning id token");
             return idTokens[0];
         };
+        /**
+         * Gets all idTokens matching the given filter
+         * @param filter
+         * @returns
+         */
+        CacheManager.prototype.getIdTokensByFilter = function (filter, tokenKeys) {
+            var _this = this;
+            var idTokenKeys = tokenKeys && tokenKeys.idToken || this.getTokenKeys().idToken;
+            var idTokens = [];
+            idTokenKeys.forEach(function (key) {
+                if (!_this.idTokenKeyMatchesFilter(key, __assign({ clientId: _this.clientId }, filter))) {
+                    return;
+                }
+                var idToken = _this.getIdTokenCredential(key);
+                if (idToken && _this.credentialMatchesFilter(idToken, filter)) {
+                    idTokens.push(idToken);
+                }
+            });
+            return idTokens;
+        };
+        /**
+         * Validate the cache key against filter before retrieving and parsing cache value
+         * @param key
+         * @param filter
+         * @returns
+         */
+        CacheManager.prototype.idTokenKeyMatchesFilter = function (inputKey, filter) {
+            var key = inputKey.toLowerCase();
+            if (filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) {
+                return false;
+            }
+            if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
+                return false;
+            }
+            return true;
+        };
+        /**
+         * Removes idToken from the cache
+         * @param key
+         */
+        CacheManager.prototype.removeIdToken = function (key) {
+            this.removeItem(key);
+        };
+        /**
+         * Removes refresh token from the cache
+         * @param key
+         */
+        CacheManager.prototype.removeRefreshToken = function (key) {
+            this.removeItem(key);
+        };
         /**
          * Retrieve AccessTokenEntity from cache
          * @param clientId
@@ -3051,8 +2965,10 @@
          * @param scopes
          * @param authScheme
          */
-        CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
-            var scopes = new ScopeSet(request.scopes || []);
+        CacheManager.prototype.getAccessToken = function (account, request, tokenKeys) {
+            var _this = this;
+            this.commonLogger.trace("CacheManager - getAccessToken called");
+            var scopes = ScopeSet.createSearchScopes(request.scopes);
             var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
             /*
              * Distinguish between Bearer and PoP/SSH token cache types
@@ -3063,55 +2979,156 @@
                 homeAccountId: account.homeAccountId,
                 environment: account.environment,
                 credentialType: credentialType,
-                clientId: clientId,
+                clientId: this.clientId,
                 realm: account.tenantId,
-                target: scopes.printScopesLowerCase(),
+                target: scopes,
                 tokenType: authScheme,
                 keyId: request.sshKid,
                 requestedClaimsHash: request.requestedClaimsHash,
             };
-            var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
-            var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
+            var accessTokenKeys = tokenKeys && tokenKeys.accessToken || this.getTokenKeys().accessToken;
+            var accessTokens = [];
+            accessTokenKeys.forEach(function (key) {
+                // Validate key
+                if (_this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
+                    var accessToken = _this.getAccessTokenCredential(key);
+                    // Validate value
+                    if (accessToken && _this.credentialMatchesFilter(accessToken, accessTokenFilter)) {
+                        accessTokens.push(accessToken);
+                    }
+                }
+            });
             var numAccessTokens = accessTokens.length;
             if (numAccessTokens < 1) {
+                this.commonLogger.info("CacheManager:getAccessToken - No token found");
                 return null;
             }
             else if (numAccessTokens > 1) {
                 throw ClientAuthError.createMultipleMatchingTokensInCacheError();
             }
+            this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
             return accessTokens[0];
         };
+        /**
+         * Validate the cache key against filter before retrieving and parsing cache value
+         * @param key
+         * @param filter
+         * @param keyMustContainAllScopes
+         * @returns
+         */
+        CacheManager.prototype.accessTokenKeyMatchesFilter = function (inputKey, filter, keyMustContainAllScopes) {
+            var key = inputKey.toLowerCase();
+            if (filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) {
+                return false;
+            }
+            if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
+                return false;
+            }
+            if (filter.realm && key.indexOf(filter.realm.toLowerCase()) === -1) {
+                return false;
+            }
+            if (filter.requestedClaimsHash && key.indexOf(filter.requestedClaimsHash.toLowerCase()) === -1) {
+                return false;
+            }
+            if (filter.target) {
+                var scopes = filter.target.asArray();
+                for (var i = 0; i < scopes.length; i++) {
+                    if (keyMustContainAllScopes && !key.includes(scopes[i].toLowerCase())) {
+                        // When performing a cache lookup a missing scope would be a cache miss
+                        return false;
+                    }
+                    else if (!keyMustContainAllScopes && key.includes(scopes[i].toLowerCase())) {
+                        // When performing a cache write, any token with a subset of requested scopes should be replaced
+                        return true;
+                    }
+                }
+            }
+            return true;
+        };
+        /**
+         * Gets all access tokens matching the filter
+         * @param filter
+         * @returns
+         */
+        CacheManager.prototype.getAccessTokensByFilter = function (filter) {
+            var _this = this;
+            var tokenKeys = this.getTokenKeys();
+            var accessTokens = [];
+            tokenKeys.accessToken.forEach(function (key) {
+                if (!_this.accessTokenKeyMatchesFilter(key, filter, true)) {
+                    return;
+                }
+                var accessToken = _this.getAccessTokenCredential(key);
+                if (accessToken && _this.credentialMatchesFilter(accessToken, filter)) {
+                    accessTokens.push(accessToken);
+                }
+            });
+            return accessTokens;
+        };
         /**
          * Helper to retrieve the appropriate refresh token from cache
          * @param clientId
          * @param account
          * @param familyRT
          */
-        CacheManager.prototype.readRefreshTokenFromCache = function (clientId, account, familyRT) {
+        CacheManager.prototype.getRefreshToken = function (account, familyRT, tokenKeys) {
+            var _this = this;
+            this.commonLogger.trace("CacheManager - getRefreshToken called");
             var id = familyRT ? THE_FAMILY_ID : undefined;
             var refreshTokenFilter = {
                 homeAccountId: account.homeAccountId,
                 environment: account.environment,
                 credentialType: CredentialType.REFRESH_TOKEN,
-                clientId: clientId,
+                clientId: this.clientId,
                 familyId: id,
             };
-            var credentialCache = this.getCredentialsFilteredBy(refreshTokenFilter);
-            var refreshTokens = Object.keys(credentialCache.refreshTokens).map(function (key) { return credentialCache.refreshTokens[key]; });
+            var refreshTokenKeys = tokenKeys && tokenKeys.refreshToken || this.getTokenKeys().refreshToken;
+            var refreshTokens = [];
+            refreshTokenKeys.forEach(function (key) {
+                // Validate key
+                if (_this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
+                    var refreshToken = _this.getRefreshTokenCredential(key);
+                    // Validate value
+                    if (refreshToken && _this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {
+                        refreshTokens.push(refreshToken);
+                    }
+                }
+            });
             var numRefreshTokens = refreshTokens.length;
             if (numRefreshTokens < 1) {
+                this.commonLogger.info("CacheManager:getRefreshToken - No refresh token found.");
                 return null;
             }
             // address the else case after remove functions address environment aliases
+            this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token");
             return refreshTokens[0];
         };
+        /**
+         * Validate the cache key against filter before retrieving and parsing cache value
+         * @param key
+         * @param filter
+         */
+        CacheManager.prototype.refreshTokenKeyMatchesFilter = function (inputKey, filter) {
+            var key = inputKey.toLowerCase();
+            if (filter.familyId && key.indexOf(filter.familyId.toLowerCase()) === -1) {
+                return false;
+            }
+            // If familyId is used, clientId is not in the key
+            if (!filter.familyId && filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) {
+                return false;
+            }
+            if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
+                return false;
+            }
+            return true;
+        };
         /**
          * Retrieve AppMetadataEntity from cache
          */
-        CacheManager.prototype.readAppMetadataFromCache = function (environment, clientId) {
+        CacheManager.prototype.readAppMetadataFromCache = function (environment) {
             var appMetadataFilter = {
                 environment: environment,
-                clientId: clientId,
+                clientId: this.clientId,
             };
             var appMetadata = this.getAppMetadataFilteredBy(appMetadataFilter);
             var appMetadataEntries = Object.keys(appMetadata).map(function (key) { return appMetadata[key]; });
@@ -3129,8 +3146,8 @@
          * @param environment
          * @param clientId
          */
-        CacheManager.prototype.isAppMetadataFOCI = function (environment, clientId) {
-            var appMetadata = this.readAppMetadataFromCache(environment, clientId);
+        CacheManager.prototype.isAppMetadataFOCI = function (environment) {
+            var appMetadata = this.readAppMetadataFromCache(environment);
             return !!(appMetadata && appMetadata.familyId === THE_FAMILY_ID);
         };
         /**
@@ -3141,6 +3158,24 @@
         CacheManager.prototype.matchHomeAccountId = function (entity, homeAccountId) {
             return !!((typeof entity.homeAccountId === "string") && (homeAccountId === entity.homeAccountId));
         };
+        /**
+         * helper to match account ids
+         * @param entity
+         * @param localAccountId
+         * @returns
+         */
+        CacheManager.prototype.matchLocalAccountId = function (entity, localAccountId) {
+            return !!((typeof entity.localAccountId === "string") && (localAccountId === entity.localAccountId));
+        };
+        /**
+         * helper to match usernames
+         * @param entity
+         * @param username
+         * @returns
+         */
+        CacheManager.prototype.matchUsername = function (entity, username) {
+            return !!((typeof entity.username === "string") && (username.toLowerCase() === entity.username.toLowerCase()));
+        };
         /**
          * helper to match assertion
          * @param value
@@ -3213,14 +3248,7 @@
                 return false;
             }
             var entityScopeSet = ScopeSet.fromString(entity.target);
-            var requestTargetScopeSet = ScopeSet.fromString(target);
-            if (!requestTargetScopeSet.containsOnlyOIDCScopes()) {
-                requestTargetScopeSet.removeOIDCScopes(); // ignore OIDC scopes
-            }
-            else {
-                requestTargetScopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
-            }
-            return entityScopeSet.containsScopeSet(requestTargetScopeSet);
+            return entityScopeSet.containsScopeSet(target);
         };
         /**
          * Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise
@@ -3258,27 +3286,6 @@
         CacheManager.prototype.generateAuthorityMetadataCacheKey = function (authority) {
             return AUTHORITY_METADATA_CONSTANTS.CACHE_KEY + "-" + this.clientId + "-" + authority;
         };
-        /**
-         * Returns the specific credential (IdToken/AccessToken/RefreshToken) from the cache
-         * @param key
-         * @param credType
-         */
-        CacheManager.prototype.getSpecificCredential = function (key, credType) {
-            switch (credType) {
-                case CredentialType.ID_TOKEN: {
-                    return this.getIdTokenCredential(key);
-                }
-                case CredentialType.ACCESS_TOKEN:
-                case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME: {
-                    return this.getAccessTokenCredential(key);
-                }
-                case CredentialType.REFRESH_TOKEN: {
-                    return this.getRefreshTokenCredential(key);
-                }
-                default:
-                    return null;
-            }
-        };
         /**
          * Helper to convert serialized data to object
          * @param obj
@@ -3377,6 +3384,14 @@
             var notImplErr = "Storage interface - getKeys() has not been implemented for the cacheStorage interface.";
             throw AuthError.createUnexpectedError(notImplErr);
         };
+        DefaultStorageClass.prototype.getAccountKeys = function () {
+            var notImplErr = "Storage interface - getAccountKeys() has not been implemented for the cacheStorage interface.";
+            throw AuthError.createUnexpectedError(notImplErr);
+        };
+        DefaultStorageClass.prototype.getTokenKeys = function () {
+            var notImplErr = "Storage interface - getTokenKeys() has not been implemented for the cacheStorage interface.";
+            throw AuthError.createUnexpectedError(notImplErr);
+        };
         DefaultStorageClass.prototype.clear = function () {
             return __awaiter(this, void 0, void 0, function () {
                 var notImplErr;
@@ -3393,7 +3408,7 @@
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3467,7 +3482,7 @@
             authOptions: buildAuthOptions(userAuthOptions),
             systemOptions: __assign(__assign({}, DEFAULT_SYSTEM_OPTIONS), userSystemOptions),
             loggerOptions: loggerOptions,
-            storageInterface: storageImplementation || new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION),
+            storageInterface: storageImplementation || new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),
             networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
             cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
             clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
@@ -3486,7 +3501,7 @@
         return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS, skipAuthorityMetadataCache: false }, authOptions);
     }
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3506,7 +3521,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3533,7 +3548,7 @@
             var value = cacheManager.getThrottlingCache(key);
             if (value) {
                 if (value.throttleTime < Date.now()) {
-                    cacheManager.removeItem(key, CacheSchemaType.THROTTLING);
+                    cacheManager.removeItem(key);
                     return;
                 }
                 throw new ServerError(((_a = value.errorCodes) === null || _a === void 0 ? void 0 : _a.join(" ")) || Constants.EMPTY_STRING, value.errorMessage, value.subError);
@@ -3597,12 +3612,12 @@
                 sshKid: request.sshKid
             };
             var key = this.generateThrottlingStorageKey(thumbprint);
-            return cacheManager.removeItem(key, CacheSchemaType.THROTTLING);
+            cacheManager.removeItem(key);
         };
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3651,7 +3666,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3662,7 +3677,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3753,7 +3768,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4131,7 +4146,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4233,7 +4248,145 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Base type for credentials to be stored in the cache: eg: ACCESS_TOKEN, ID_TOKEN etc
+     *
+     * Key:Value Schema:
+     *
+     * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
+     *
+     * Value Schema:
+     * {
+     *      homeAccountId: home account identifier for the auth scheme,
+     *      environment: entity that issued the token, represented as a full host
+     *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
+     *      clientId: client ID of the application
+     *      secret: Actual credential as a string
+     *      familyId: Family ID identifier, usually only used for refresh tokens
+     *      realm: Full tenant or organizational identifier that the account belongs to
+     *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
+     *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+     *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
+     *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
+     * }
+     */
+    var CredentialEntity = /** @class */ (function () {
+        function CredentialEntity() {
+        }
+        /**
+         * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+         */
+        CredentialEntity.prototype.generateAccountId = function () {
+            return CredentialEntity.generateAccountIdForCacheKey(this.homeAccountId, this.environment);
+        };
+        /**
+         * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
+         */
+        CredentialEntity.prototype.generateCredentialId = function () {
+            return CredentialEntity.generateCredentialIdForCacheKey(this.credentialType, this.clientId, this.realm, this.familyId);
+        };
+        /**
+         * Generate target key component as per schema: <target>
+         */
+        CredentialEntity.prototype.generateTarget = function () {
+            return CredentialEntity.generateTargetForCacheKey(this.target);
+        };
+        /**
+         * generates credential key
+         */
+        CredentialEntity.prototype.generateCredentialKey = function () {
+            return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
+        };
+        /**
+         * returns the type of the cache (in this case credential)
+         */
+        CredentialEntity.prototype.generateType = function () {
+            switch (this.credentialType) {
+                case CredentialType.ID_TOKEN:
+                    return CacheType.ID_TOKEN;
+                case CredentialType.ACCESS_TOKEN:
+                case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
+                    return CacheType.ACCESS_TOKEN;
+                case CredentialType.REFRESH_TOKEN:
+                    return CacheType.REFRESH_TOKEN;
+                default: {
+                    throw ClientAuthError.createUnexpectedCredentialTypeError();
+                }
+            }
+        };
+        /**
+         * generates credential key
+         * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
+         */
+        CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
+            var credentialKey = [
+                this.generateAccountIdForCacheKey(homeAccountId, environment),
+                this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
+                this.generateTargetForCacheKey(target),
+                this.generateClaimsHashForCacheKey(requestedClaimsHash),
+                this.generateSchemeForCacheKey(tokenType)
+            ];
+            return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+        };
+        /**
+         * generates Account Id for keys
+         * @param homeAccountId
+         * @param environment
+         */
+        CredentialEntity.generateAccountIdForCacheKey = function (homeAccountId, environment) {
+            var accountId = [homeAccountId, environment];
+            return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+        };
+        /**
+         * Generates Credential Id for keys
+         * @param credentialType
+         * @param realm
+         * @param clientId
+         * @param familyId
+         */
+        CredentialEntity.generateCredentialIdForCacheKey = function (credentialType, clientId, realm, familyId) {
+            var clientOrFamilyId = credentialType === CredentialType.REFRESH_TOKEN
+                ? familyId || clientId
+                : clientId;
+            var credentialId = [
+                credentialType,
+                clientOrFamilyId,
+                realm || Constants.EMPTY_STRING,
+            ];
+            return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+        };
+        /**
+         * Generate target key component as per schema: <target>
+         */
+        CredentialEntity.generateTargetForCacheKey = function (scopes) {
+            return (scopes || Constants.EMPTY_STRING).toLowerCase();
+        };
+        /**
+         * Generate requested claims key component as per schema: <requestedClaims>
+         */
+        CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
+            return (requestedClaimsHash || Constants.EMPTY_STRING).toLowerCase();
+        };
+        /**
+         * Generate scheme key componenet as per schema: <scheme>
+         */
+        CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
+            /*
+             * PoP Tokens and SSH certs include scheme in cache key
+             * Cast to lowercase to handle "bearer" from ADFS
+             */
+            return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : Constants.EMPTY_STRING;
+        };
+        return CredentialEntity;
+    }());
+
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4297,7 +4450,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4347,7 +4500,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4461,7 +4614,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4528,7 +4681,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4607,7 +4760,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4623,7 +4776,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4694,7 +4847,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4928,7 +5081,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5065,6 +5218,7 @@
          * Internal API for initializing silent request in SilentCacheClient (msal-browser)
          */
         PerformanceEvents["InitializeSilentRequest"] = "initializeSilentRequest";
+        PerformanceEvents["InitializeClientApplication"] = "initializeClientApplication";
         /**
          * Helper function in SilentIframeClient class (msal-browser).
          */
@@ -5130,6 +5284,7 @@
         PerformanceEvents["HandleRedirectPromiseMeasurement"] = "handleRedirectPromiseMeasurement";
         PerformanceEvents["UpdateCloudDiscoveryMetadataMeasurement"] = "updateCloudDiscoveryMetadataMeasurement";
         PerformanceEvents["UsernamePasswordClientAcquireToken"] = "usernamePasswordClientAcquireToken";
+        PerformanceEvents["NativeMessageHandlerHandshake"] = "nativeMessageHandlerHandshake";
     })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
     /**
      * State of the performance event.
@@ -5155,7 +5310,7 @@
         "status",
     ]);
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5264,7 +5419,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5334,7 +5489,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5370,7 +5525,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5502,7 +5657,7 @@
                             _b.sent();
                             _b.label = 7;
                         case 7: return [7 /*endfinally*/];
-                        case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code, serverRequestId)];
+                        case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse, serverRequestId)];
                     }
                 });
             });
@@ -5588,7 +5743,7 @@
          * @param fromTokenCache
          * @param stateString
          */
-        ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code, requestId) {
+        ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, serverTokenResponse, requestId) {
             var _a, _b, _c;
             return __awaiter(this, void 0, void 0, function () {
                 var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
@@ -5624,6 +5779,10 @@
                             }
                             uid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.oid) || (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.sub) || Constants.EMPTY_STRING;
                             tid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.tid) || Constants.EMPTY_STRING;
+                            // for hybrid + native bridge enablement, send back the native account Id
+                            if ((serverTokenResponse === null || serverTokenResponse === void 0 ? void 0 : serverTokenResponse.spa_accountid) && !!cacheRecord.account) {
+                                cacheRecord.account.nativeAccountId = serverTokenResponse === null || serverTokenResponse === void 0 ? void 0 : serverTokenResponse.spa_accountid;
+                            }
                             return [2 /*return*/, {
                                     authority: authority.canonicalAuthority,
                                     uniqueId: uid,
@@ -5643,7 +5802,7 @@
                                     state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                     cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
                                     msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
-                                    code: code,
+                                    code: serverTokenResponse === null || serverTokenResponse === void 0 ? void 0 : serverTokenResponse.spa_code,
                                     fromNativeBroker: false,
                                 }];
                     }
@@ -5653,7 +5812,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6131,7 +6290,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6211,7 +6370,7 @@
                     if (!request.account) {
                         throw ClientAuthError.createNoAccountInSilentRequestError();
                     }
-                    isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, this.config.authOptions.clientId);
+                    isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment);
                     // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
                     if (isFOCI) {
                         try {
@@ -6250,7 +6409,7 @@
                     (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.addQueueMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
                     atsMeasurement = (_b = this.performanceClient) === null || _b === void 0 ? void 0 : _b.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
                     this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
-                    refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
+                    refreshToken = this.cacheManager.getRefreshToken(request.account, foci);
                     if (!refreshToken) {
                         atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.discardMeasurement();
                         throw InteractionRequiredAuthError.createNoTokensFoundError();
@@ -6405,7 +6564,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6470,7 +6629,7 @@
                                 throw ClientAuthError.createNoAccountInSilentRequestError();
                             }
                             environment = request.authority || this.authority.getPreferredCache();
-                            cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, request, environment);
+                            cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
                             if (!cacheRecord.accessToken) {
                                 // Must refresh due to non-existent access_token.
                                 (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
@@ -6529,7 +6688,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6541,7 +6700,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6550,7 +6709,7 @@
     var EndpointMetadata = rawMetdataJSON.endpointMetadata;
     var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6564,7 +6723,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6641,7 +6800,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6651,7 +6810,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6661,7 +6820,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6793,7 +6952,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7528,7 +7687,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7591,7 +7750,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7622,7 +7781,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7650,7 +7809,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7667,7 +7826,7 @@
         }
     };
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7712,7 +7871,7 @@
         return JoseHeaderError;
     }(AuthError));
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7742,8 +7901,8 @@
                 throw JoseHeaderError.createMissingAlgError();
             }
             var shrHeader = new JoseHeader({
-                // Access Token PoP headers must have type JWT, but the type header can be overriden for special cases
-                typ: shrHeaderOptions.typ || JsonTypes.Jwt,
+                // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
+                typ: shrHeaderOptions.typ || JsonTypes.Pop,
                 kid: shrHeaderOptions.kid,
                 alg: shrHeaderOptions.alg
             });
@@ -7752,7 +7911,7 @@
         return JoseHeader;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7811,7 +7970,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7973,7 +8132,7 @@
         return ServerTelemetryManager;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8000,11 +8159,8 @@
             this.logger = logger;
             this.callbacks = new Map();
             this.eventsByCorrelationId = new Map();
-            this.staticFieldsByCorrelationId = new Map();
-            this.measurementsById = new Map();
             this.queueMeasurements = new Map();
             this.preQueueTimeByCorrelationId = new Map();
-            this.countersByCorrelationId = new Map();
         }
         /**
          * Starts and returns an platform-specific implementation of IPerformanceMeasurement.
@@ -8045,16 +8201,16 @@
          * @returns {number}
          */
         PerformanceClient.prototype.getPreQueueTime = function (eventName, correlationId) {
-            var preQueueTimesByEvents = this.preQueueTimeByCorrelationId.get(correlationId);
-            if (!preQueueTimesByEvents) {
+            var preQueueEvent = this.preQueueTimeByCorrelationId.get(correlationId);
+            if (!preQueueEvent) {
                 this.logger.trace("PerformanceClient.getPreQueueTime: no pre-queue times found for correlationId: " + correlationId + ", unable to add queue measurement");
                 return;
             }
-            else if (!preQueueTimesByEvents.get(eventName)) {
+            else if (preQueueEvent.name !== eventName) {
                 this.logger.trace("PerformanceClient.getPreQueueTime: no pre-queue time found for " + eventName + ", unable to add queue measurement");
                 return;
             }
-            return preQueueTimesByEvents.get(eventName);
+            return preQueueEvent.time;
         };
         /**
          * Calculates the difference between current time and time when function was queued.
@@ -8082,12 +8238,13 @@
         /**
          * Adds queue measurement time to QueueMeasurements array for given correlation ID.
          *
-         * @param {PerformanceEvents} name
+         * @param {PerformanceEvents} eventName
          * @param {?string} correlationId
-         * @param {?number} time
+         * @param {?number} queueTime
+         * @param {?boolean} manuallyCompleted - indicator for manually completed queue measurements
          * @returns
          */
-        PerformanceClient.prototype.addQueueMeasurement = function (eventName, correlationId, queueTime) {
+        PerformanceClient.prototype.addQueueMeasurement = function (eventName, correlationId, queueTime, manuallyCompleted) {
             if (!correlationId) {
                 this.logger.trace("PerformanceClient.addQueueMeasurement: correlationId not provided for " + eventName + ", cannot add queue measurement");
                 return;
@@ -8100,7 +8257,7 @@
                 this.logger.trace("PerformanceClient.addQueueMeasurement: no queue time provided for " + eventName);
                 return;
             }
-            var queueMeasurement = { eventName: eventName, queueTime: queueTime };
+            var queueMeasurement = { eventName: eventName, queueTime: queueTime, manuallyCompleted: manuallyCompleted };
             // Adds to existing correlation Id if present in queueMeasurements
             var existingMeasurements = this.queueMeasurements.get(correlationId);
             if (existingMeasurements) {
@@ -8113,6 +8270,8 @@
                 var measurementArray = [queueMeasurement];
                 this.queueMeasurements.set(correlationId, measurementArray);
             }
+            // Delete processed pre-queue event.
+            this.preQueueTimeByCorrelationId.delete(correlationId);
         };
         /**
          * Starts measuring performance for a given operation. Returns a function that should be used to end the measurement.
@@ -8131,17 +8290,8 @@
             }
             // Duplicate code to address spelling error will be removed at the next major version bump.
             this.logger.trace("PerformanceClient: Performance measurement started for " + measureName, eventCorrelationId);
-            var validMeasurement;
-            var performanceMeasuremeant = this.startPerformanceMeasuremeant(measureName, eventCorrelationId);
-            if (performanceMeasuremeant.startMeasurement) {
-                performanceMeasuremeant.startMeasurement();
-                validMeasurement = performanceMeasuremeant;
-            }
-            else {
-                var performanceMeasurement = this.startPerformanceMeasurement(measureName, eventCorrelationId);
-                performanceMeasurement.startMeasurement();
-                validMeasurement = performanceMeasurement;
-            }
+            var performanceMeasurement = this.startPerformanceMeasuremeant(measureName, eventCorrelationId);
+            performanceMeasurement.startMeasurement();
             var inProgressEvent = {
                 eventId: this.generateId(),
                 status: PerformanceEventStatus.InProgress,
@@ -8152,27 +8302,15 @@
                 name: measureName,
                 startTimeMs: Date.now(),
                 correlationId: eventCorrelationId,
-            };
-            // Store in progress events so they can be discarded if not ended properly
-            this.cacheEventByCorrelationId(inProgressEvent);
-            var staticFields = {
                 appName: (_a = this.applicationTelemetry) === null || _a === void 0 ? void 0 : _a.appName,
                 appVersion: (_b = this.applicationTelemetry) === null || _b === void 0 ? void 0 : _b.appVersion,
             };
-            this.addStaticFields(staticFields, eventCorrelationId);
-            this.cacheMeasurement(inProgressEvent, validMeasurement);
+            // Store in progress events so they can be discarded if not ended properly
+            this.cacheEventByCorrelationId(inProgressEvent);
             // Return the event and functions the caller can use to properly end/flush the measurement
             return {
                 endMeasurement: function (event) {
-                    var completedEvent = _this.endMeasurement(__assign(__assign({}, inProgressEvent), event));
-                    if (completedEvent) {
-                        // Cache event so that submeasurements can be added downstream
-                        _this.cacheEventByCorrelationId(completedEvent);
-                    }
-                    return completedEvent;
-                },
-                flushMeasurement: function () {
-                    return _this.flushMeasurements(inProgressEvent.name, inProgressEvent.correlationId);
+                    return _this.endMeasurement(__assign(__assign({}, inProgressEvent), event), performanceMeasurement);
                 },
                 discardMeasurement: function () {
                     return _this.discardMeasurements(inProgressEvent.correlationId);
@@ -8183,40 +8321,66 @@
                 increment: function (counters) {
                     return _this.increment(counters, inProgressEvent.correlationId);
                 },
-                measurement: validMeasurement,
+                measurement: performanceMeasurement,
                 event: inProgressEvent
             };
         };
         /**
          * Stops measuring the performance for an operation. Should only be called directly by PerformanceClient classes,
          * as consumers should instead use the function returned by startMeasurement.
+         * Adds a new field named as "[event name]DurationMs" for sub-measurements, completes and emits an event
+         * otherwise.
          *
          * @param {PerformanceEvent} event
+         * @param {IPerformanceMeasurement} measurement
          * @returns {(PerformanceEvent | null)}
          */
-        PerformanceClient.prototype.endMeasurement = function (event) {
-            var performanceMeasurement = this.measurementsById.get(event.eventId);
-            if (performanceMeasurement) {
-                // Immediately delete so that the same event isnt ended twice
-                this.measurementsById.delete(event.eventId);
-                performanceMeasurement.endMeasurement();
-                var durationMs = performanceMeasurement.flushMeasurement();
-                // null indicates no measurement was taken (e.g. needed performance APIs not present)
-                if (durationMs !== null) {
-                    this.logger.trace("PerformanceClient: Performance measurement ended for " + event.name + ": " + durationMs + " ms", event.correlationId);
-                    var completedEvent = __assign(__assign({ 
-                        // Allow duration to be overwritten when event ends (e.g. testing), but not status
-                        durationMs: Math.round(durationMs) }, event), { status: PerformanceEventStatus.Completed });
-                    return completedEvent;
-                }
-                else {
-                    this.logger.trace("PerformanceClient: Performance measurement not taken", event.correlationId);
-                }
+        PerformanceClient.prototype.endMeasurement = function (event, measurement) {
+            var _this = this;
+            var _a, _b;
+            var rootEvent = this.eventsByCorrelationId.get(event.correlationId);
+            if (!rootEvent) {
+                this.logger.trace("PerformanceClient: Measurement not found for " + event.eventId, event.correlationId);
+                return null;
+            }
+            var isRoot = event.eventId === rootEvent.eventId;
+            var queueInfo = {
+                totalQueueTime: 0,
+                totalQueueCount: 0,
+                manuallyCompletedCount: 0
+            };
+            if (isRoot) {
+                queueInfo = this.getQueueInfo(event.correlationId);
+                this.discardCache(rootEvent.correlationId);
             }
             else {
-                this.logger.trace("PerformanceClient: Measurement not found for " + event.eventId, event.correlationId);
+                (_a = rootEvent.incompleteSubMeasurements) === null || _a === void 0 ? void 0 : _a.delete(event.eventId);
             }
-            return null;
+            measurement === null || measurement === void 0 ? void 0 : measurement.endMeasurement();
+            var durationMs = measurement === null || measurement === void 0 ? void 0 : measurement.flushMeasurement();
+            // null indicates no measurement was taken (e.g. needed performance APIs not present)
+            if (!durationMs) {
+                this.logger.trace("PerformanceClient: Performance measurement not taken", rootEvent.correlationId);
+                return null;
+            }
+            this.logger.trace("PerformanceClient: Performance measurement ended for " + event.name + ": " + durationMs + " ms", event.correlationId);
+            // Add sub-measurement attribute to root event.
+            if (!isRoot) {
+                rootEvent[event.name + "DurationMs"] = Math.floor(durationMs);
+                return __assign({}, rootEvent);
+            }
+            var finalEvent = __assign(__assign({}, rootEvent), event);
+            var incompleteSubsCount = 0;
+            // Incomplete sub-measurements are discarded. They are likely an instrumentation bug that should be fixed.
+            (_b = finalEvent.incompleteSubMeasurements) === null || _b === void 0 ? void 0 : _b.forEach(function (subMeasurement) {
+                _this.logger.trace("PerformanceClient: Incomplete submeasurement " + subMeasurement.name + " found for " + event.name, finalEvent.correlationId);
+                incompleteSubsCount++;
+            });
+            finalEvent.incompleteSubMeasurements = undefined;
+            finalEvent = __assign(__assign({}, finalEvent), { durationMs: Math.round(durationMs), queuedTimeMs: queueInfo.totalQueueTime, queuedCount: queueInfo.totalQueueCount, queuedManuallyCompletedCount: queueInfo.manuallyCompletedCount, status: PerformanceEventStatus.Completed, incompleteSubsCount: incompleteSubsCount });
+            this.truncateIntegralFields(finalEvent, this.getIntFields());
+            this.emitEvents([finalEvent], event.correlationId);
+            return finalEvent;
         };
         /**
          * Saves extra information to be emitted when the measurements are flushed
@@ -8224,14 +8388,13 @@
          * @param correlationId
          */
         PerformanceClient.prototype.addStaticFields = function (fields, correlationId) {
-            var existingStaticFields = this.staticFieldsByCorrelationId.get(correlationId);
-            if (existingStaticFields) {
-                this.logger.trace("PerformanceClient: Updating static fields");
-                this.staticFieldsByCorrelationId.set(correlationId, __assign(__assign({}, existingStaticFields), fields));
+            this.logger.trace("PerformanceClient: Updating static fields");
+            var event = this.eventsByCorrelationId.get(correlationId);
+            if (event) {
+                this.eventsByCorrelationId.set(correlationId, __assign(__assign({}, event), fields));
             }
             else {
-                this.logger.trace("PerformanceClient: Adding static fields");
-                this.staticFieldsByCorrelationId.set(correlationId, fields);
+                this.logger.trace("PerformanceClient: Event not found for", correlationId);
             }
         };
         /**
@@ -8240,18 +8403,18 @@
          * @param correlationId {string} correlation identifier
          */
         PerformanceClient.prototype.increment = function (counters, correlationId) {
-            var existing = this.countersByCorrelationId.get(correlationId);
-            if (!existing) {
-                this.logger.trace("PerformanceClient: Setting counters");
-                this.countersByCorrelationId.set(correlationId, __assign({}, counters));
-                return;
-            }
             this.logger.trace("PerformanceClient: Updating counters");
-            for (var counter in counters) {
-                if (!existing.hasOwnProperty(counter)) {
-                    existing[counter] = 0;
+            var event = this.eventsByCorrelationId.get(correlationId);
+            if (event) {
+                for (var counter in counters) {
+                    if (!event.hasOwnProperty(counter)) {
+                        event[counter] = 0;
+                    }
+                    event[counter] += counters[counter];
                 }
-                existing[counter] += counters[counter];
+            }
+            else {
+                this.logger.trace("PerformanceClient: Event not found for", correlationId);
             }
         };
         /**
@@ -8264,117 +8427,35 @@
          * @param {PerformanceEvent} event
          */
         PerformanceClient.prototype.cacheEventByCorrelationId = function (event) {
-            var existingEvents = this.eventsByCorrelationId.get(event.correlationId);
-            if (existingEvents) {
+            var rootEvent = this.eventsByCorrelationId.get(event.correlationId);
+            if (rootEvent) {
                 this.logger.trace("PerformanceClient: Performance measurement for " + event.name + " added/updated", event.correlationId);
-                existingEvents.set(event.eventId, event);
+                rootEvent.incompleteSubMeasurements = rootEvent.incompleteSubMeasurements || new Map();
+                rootEvent.incompleteSubMeasurements.set(event.eventId, { name: event.name, startTimeMs: event.startTimeMs });
             }
             else {
                 this.logger.trace("PerformanceClient: Performance measurement for " + event.name + " started", event.correlationId);
-                this.eventsByCorrelationId.set(event.correlationId, new Map().set(event.eventId, event));
+                this.eventsByCorrelationId.set(event.correlationId, __assign({}, event));
             }
         };
-        /**
-         * Cache measurements by their id.
-         *
-         * @private
-         * @param {PerformanceEvent} event
-         * @param {IPerformanceMeasurement} measurement
-         */
-        PerformanceClient.prototype.cacheMeasurement = function (event, measurement) {
-            this.measurementsById.set(event.eventId, measurement);
-        };
-        /**
-         * Gathers and emits performance events for measurements taked for the given top-level API and correlation ID.
-         *
-         * @param {PerformanceEvents} measureName
-         * @param {string} correlationId
-         */
-        PerformanceClient.prototype.flushMeasurements = function (measureName, correlationId) {
-            var _this = this;
-            this.logger.trace("PerformanceClient: Performance measurements flushed for " + measureName, correlationId);
-            /**
-             * Adds all queue time and count measurements for given correlation ID
-             * then deletes queue times for given correlation ID from queueMeasurements map.
-             */
+        PerformanceClient.prototype.getQueueInfo = function (correlationId) {
             var queueMeasurementForCorrelationId = this.queueMeasurements.get(correlationId);
             if (!queueMeasurementForCorrelationId) {
                 this.logger.trace("PerformanceClient: no queue measurements found for for correlationId: " + correlationId);
             }
             var totalQueueTime = 0;
             var totalQueueCount = 0;
+            var manuallyCompletedCount = 0;
             queueMeasurementForCorrelationId === null || queueMeasurementForCorrelationId === void 0 ? void 0 : queueMeasurementForCorrelationId.forEach(function (measurement) {
                 totalQueueTime += measurement.queueTime;
                 totalQueueCount++;
+                manuallyCompletedCount += measurement.manuallyCompleted ? 1 : 0;
             });
-            var eventsForCorrelationId = this.eventsByCorrelationId.get(correlationId);
-            var staticFields = this.staticFieldsByCorrelationId.get(correlationId);
-            var counters = this.countersByCorrelationId.get(correlationId);
-            if (eventsForCorrelationId) {
-                this.discardCache(correlationId);
-                /*
-                 * Manually end incomplete submeasurements to ensure there arent orphaned/never ending events.
-                 * Incomplete submeasurements are likely an instrumentation bug that should be fixed.
-                 * IE only supports Map.forEach.
-                 */
-                var completedEvents_1 = [];
-                var incompleteSubsCount_1 = 0;
-                eventsForCorrelationId.forEach(function (event) {
-                    if (event.name !== measureName && event.status !== PerformanceEventStatus.Completed) {
-                        _this.logger.trace("PerformanceClient: Incomplete submeasurement " + event.name + " found for " + measureName, correlationId);
-                        incompleteSubsCount_1++;
-                        var completedEvent = _this.endMeasurement(event);
-                        if (completedEvent) {
-                            completedEvents_1.push(completedEvent);
-                        }
-                    }
-                    completedEvents_1.push(event);
-                });
-                // Sort events by start time (earliest first)
-                var sortedCompletedEvents = completedEvents_1.sort(function (eventA, eventB) { return eventA.startTimeMs - eventB.startTimeMs; });
-                // Take completed top level event and add completed submeasurements durations as properties
-                var topLevelEvents = sortedCompletedEvents.filter(function (event) { return event.name === measureName && event.status === PerformanceEventStatus.Completed; });
-                if (topLevelEvents.length > 0) {
-                    /*
-                     * Only take the first top-level event if there are multiple events with the same correlation id.
-                     * This greatly simplifies logic for submeasurements.
-                     */
-                    if (topLevelEvents.length > 1) {
-                        this.logger.verbose("PerformanceClient: Multiple distinct top-level performance events found, using the first", correlationId);
-                    }
-                    var topLevelEvent = topLevelEvents[0];
-                    this.logger.verbose("PerformanceClient: Measurement found for " + measureName, correlationId);
-                    // Build event object with top level and sub measurements
-                    var eventToEmit = sortedCompletedEvents.reduce(function (previous, current) {
-                        if (current.name !== measureName) {
-                            _this.logger.trace("PerformanceClient: Complete submeasurement found for " + current.name, correlationId);
-                            // TODO: Emit additional properties for each subMeasurement
-                            var subMeasurementName = current.name + "DurationMs";
-                            /*
-                             * Some code paths, such as resolving an authority, can occur multiple times.
-                             * Only take the first measurement, since the second could be read from the cache,
-                             * or due to the same correlation id being used for two distinct requests.
-                             */
-                            if (!previous[subMeasurementName]) {
-                                previous[subMeasurementName] = current.durationMs;
-                            }
-                            else {
-                                _this.logger.verbose("PerformanceClient: Submeasurement for " + measureName + " already exists for " + current.name + ", ignoring", correlationId);
-                            }
-                        }
-                        return previous;
-                    }, topLevelEvent);
-                    var finalEvent = __assign(__assign(__assign(__assign({}, eventToEmit), staticFields), counters), { queuedTimeMs: totalQueueTime, queuedCount: totalQueueCount, incompleteSubsCount: incompleteSubsCount_1 });
-                    this.truncateIntegralFields(finalEvent, this.getIntFields());
-                    this.emitEvents([finalEvent], eventToEmit.correlationId);
-                }
-                else {
-                    this.logger.verbose("PerformanceClient: No completed top-level measurements found for " + measureName, correlationId);
-                }
-            }
-            else {
-                this.logger.verbose("PerformanceClient: No measurements found", correlationId);
-            }
+            return {
+                totalQueueTime: totalQueueTime,
+                totalQueueCount: totalQueueCount,
+                manuallyCompletedCount: manuallyCompletedCount
+            };
         };
         /**
          * Removes measurements for a given correlation id.
@@ -8388,14 +8469,10 @@
         /**
          * Removes cache for a given correlation id.
          *
-         * @param {string} correlation identifier
+         * @param {string} correlationId correlation identifier
          */
         PerformanceClient.prototype.discardCache = function (correlationId) {
             this.discardMeasurements(correlationId);
-            this.logger.trace("PerformanceClient: Static fields discarded", correlationId);
-            this.staticFieldsByCorrelationId.delete(correlationId);
-            this.logger.trace("PerformanceClient: Counters discarded", correlationId);
-            this.countersByCorrelationId.delete(correlationId);
             this.logger.trace("PerformanceClient: QueueMeasurements discarded", correlationId);
             this.queueMeasurements.delete(correlationId);
             this.logger.trace("PerformanceClient: Pre-queue times discarded", correlationId);
@@ -8458,7 +8535,7 @@
         return PerformanceClient;
     }());
 
-    /*! @azure/msal-common v10.0.0 2023-02-06 */
+    /*! @azure/msal-common v12.0.0 2023-04-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8661,6 +8738,10 @@
             code: "auth_code_or_nativeAccountId_required",
             desc: "An authorization code or nativeAccountId must be provided to this flow."
         },
+        spaCodeAndNativeAccountPresent: {
+            code: "spa_code_and_nativeAccountId_present",
+            desc: "Request cannot contain both spa code and native account id."
+        },
         databaseUnavailable: {
             code: "database_unavailable",
             desc: "IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts."
@@ -8933,6 +9014,12 @@
         BrowserAuthError.createAuthCodeOrNativeAccountIdRequiredError = function () {
             return new BrowserAuthError(BrowserAuthErrorMessage.authCodeOrNativeAccountRequired.code, BrowserAuthErrorMessage.authCodeOrNativeAccountRequired.desc);
         };
+        /**
+         * Create an error when both authorization code and native account ID are provided
+         */
+        BrowserAuthError.createSpaCodeAndNativeAccountIdPresentError = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.spaCodeAndNativeAccountPresent.code, BrowserAuthErrorMessage.spaCodeAndNativeAccountPresent.desc);
+        };
         /**
          * Create an error when IndexedDB is unavailable
          */
@@ -9064,6 +9151,11 @@
         TemporaryCacheKeys["NATIVE_REQUEST"] = "request.native";
         TemporaryCacheKeys["REDIRECT_CONTEXT"] = "request.redirect.context";
     })(TemporaryCacheKeys || (TemporaryCacheKeys = {}));
+    var StaticCacheKeys;
+    (function (StaticCacheKeys) {
+        StaticCacheKeys["ACCOUNT_KEYS"] = "msal.account.keys";
+        StaticCacheKeys["TOKEN_KEYS"] = "msal.token.keys";
+    })(StaticCacheKeys || (StaticCacheKeys = {}));
     /**
      * Cache keys stored in-memory
      */
@@ -9409,7 +9501,7 @@
     var BrowserCacheManager = /** @class */ (function (_super) {
         __extends$1(BrowserCacheManager, _super);
         function BrowserCacheManager(clientId, cacheConfig, cryptoImpl, logger) {
-            var _this = _super.call(this, clientId, cryptoImpl) || this;
+            var _this = _super.call(this, clientId, cryptoImpl, logger) || this;
             // Cookie life calculation (hours * minutes * seconds * ms)
             _this.COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
             _this.cacheConfig = cacheConfig;
@@ -9417,8 +9509,11 @@
             _this.internalStorage = new MemoryStorage();
             _this.browserStorage = _this.setupBrowserStorage(_this.cacheConfig.cacheLocation);
             _this.temporaryCacheStorage = _this.setupTemporaryCacheStorage(_this.cacheConfig.cacheLocation);
-            // Migrate any cache entries from older versions of MSAL.
-            _this.migrateCacheEntries();
+            // Migrate cache entries from older versions of MSAL.
+            if (cacheConfig.cacheMigrationEnabled) {
+                _this.migrateCacheEntries();
+                _this.createKeyMaps();
+            }
             return _this;
         }
         /**
@@ -9492,6 +9587,91 @@
                 this.setTemporaryCache(newKey, value, true);
             }
         };
+        /**
+         * Searches all cache entries for MSAL accounts and creates the account key map
+         * This is used to migrate users from older versions of MSAL which did not create the map.
+         * @returns
+         */
+        BrowserCacheManager.prototype.createKeyMaps = function () {
+            var _this = this;
+            this.logger.trace("BrowserCacheManager - createKeyMaps called.");
+            var accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+            var tokenKeys = this.getItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId);
+            if (accountKeys && tokenKeys) {
+                this.logger.verbose("BrowserCacheManager:createKeyMaps - account and token key maps already exist, skipping migration.");
+                // Key maps already exist, no need to iterate through cache
+                return;
+            }
+            var allKeys = this.browserStorage.getKeys();
+            allKeys.forEach(function (key) {
+                if (_this.isCredentialKey(key)) {
+                    // Get item, parse, validate and write key to map
+                    var value = _this.getItem(key);
+                    if (value) {
+                        var credObj = _this.validateAndParseJson(value);
+                        if (credObj && credObj.hasOwnProperty("credentialType")) {
+                            switch (credObj["credentialType"]) {
+                                case CredentialType.ID_TOKEN:
+                                    if (IdTokenEntity.isIdTokenEntity(credObj)) {
+                                        _this.logger.trace("BrowserCacheManager:createKeyMaps - idToken found, saving key to token key map");
+                                        _this.logger.tracePii("BrowserCacheManager:createKeyMaps - idToken with key: " + key + " found, saving key to token key map");
+                                        var idTokenEntity = CacheManager.toObject(new IdTokenEntity(), credObj);
+                                        var newKey = _this.updateCredentialCacheKey(key, idTokenEntity);
+                                        _this.addTokenKey(newKey, CredentialType.ID_TOKEN);
+                                        return;
+                                    }
+                                    else {
+                                        _this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching idToken schema with value containing idToken credentialType field but value failed IdTokenEntity validation, skipping.");
+                                        _this.logger.tracePii("BrowserCacheManager:createKeyMaps - failed idToken validation on key: " + key);
+                                    }
+                                    break;
+                                case CredentialType.ACCESS_TOKEN:
+                                case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
+                                    if (AccessTokenEntity.isAccessTokenEntity(credObj)) {
+                                        _this.logger.trace("BrowserCacheManager:createKeyMaps - accessToken found, saving key to token key map");
+                                        _this.logger.tracePii("BrowserCacheManager:createKeyMaps - accessToken with key: " + key + " found, saving key to token key map");
+                                        var accessTokenEntity = CacheManager.toObject(new AccessTokenEntity(), credObj);
+                                        var newKey = _this.updateCredentialCacheKey(key, accessTokenEntity);
+                                        _this.addTokenKey(newKey, CredentialType.ACCESS_TOKEN);
+                                        return;
+                                    }
+                                    else {
+                                        _this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching accessToken schema with value containing accessToken credentialType field but value failed AccessTokenEntity validation, skipping.");
+                                        _this.logger.tracePii("BrowserCacheManager:createKeyMaps - failed accessToken validation on key: " + key);
+                                    }
+                                    break;
+                                case CredentialType.REFRESH_TOKEN:
+                                    if (RefreshTokenEntity.isRefreshTokenEntity(credObj)) {
+                                        _this.logger.trace("BrowserCacheManager:createKeyMaps - refreshToken found, saving key to token key map");
+                                        _this.logger.tracePii("BrowserCacheManager:createKeyMaps - refreshToken with key: " + key + " found, saving key to token key map");
+                                        var refreshTokenEntity = CacheManager.toObject(new RefreshTokenEntity(), credObj);
+                                        var newKey = _this.updateCredentialCacheKey(key, refreshTokenEntity);
+                                        _this.addTokenKey(newKey, CredentialType.REFRESH_TOKEN);
+                                        return;
+                                    }
+                                    else {
+                                        _this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching refreshToken schema with value containing refreshToken credentialType field but value failed RefreshTokenEntity validation, skipping.");
+                                        _this.logger.tracePii("BrowserCacheManager:createKeyMaps - failed refreshToken validation on key: " + key);
+                                    }
+                                    break;
+                                // If credentialType isn't one of our predefined ones, it may not be an MSAL cache value. Ignore.
+                            }
+                        }
+                    }
+                }
+                if (_this.isAccountKey(key)) {
+                    var value = _this.getItem(key);
+                    if (value) {
+                        var accountObj = _this.validateAndParseJson(value);
+                        if (accountObj && AccountEntity.isAccountEntity(accountObj)) {
+                            _this.logger.trace("BrowserCacheManager:createKeyMaps - account found, saving key to account key map");
+                            _this.logger.tracePii("BrowserCacheManager:createKeyMaps - account with key: " + key + " found, saving key to account key map");
+                            _this.addAccountKeyToMap(key);
+                        }
+                    }
+                }
+            });
+        };
         /**
          * Parses passed value as JSON object, JSON.parse() will throw an error.
          * @param input
@@ -9531,12 +9711,15 @@
          * @param accountKey
          */
         BrowserCacheManager.prototype.getAccount = function (accountKey) {
+            this.logger.trace("BrowserCacheManager.getAccount called");
             var account = this.getItem(accountKey);
             if (!account) {
+                this.removeAccountKeyFromMap(accountKey);
                 return null;
             }
             var parsedAccount = this.validateAndParseJson(account);
             if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
+                this.removeAccountKeyFromMap(accountKey);
                 return null;
             }
             return CacheManager.toObject(new AccountEntity(), parsedAccount);
@@ -9550,6 +9733,207 @@
             this.logger.trace("BrowserCacheManager.setAccount called");
             var key = account.generateAccountKey();
             this.setItem(key, JSON.stringify(account));
+            this.addAccountKeyToMap(key);
+        };
+        /**
+         * Returns the array of account keys currently cached
+         * @returns
+         */
+        BrowserCacheManager.prototype.getAccountKeys = function () {
+            this.logger.trace("BrowserCacheManager.getAccountKeys called");
+            var accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+            if (accountKeys) {
+                return JSON.parse(accountKeys);
+            }
+            this.logger.verbose("BrowserCacheManager.getAccountKeys - No account keys found");
+            return [];
+        };
+        /**
+         * Add a new account to the key map
+         * @param key
+         */
+        BrowserCacheManager.prototype.addAccountKeyToMap = function (key) {
+            this.logger.trace("BrowserCacheManager.addAccountKeyToMap called");
+            this.logger.tracePii("BrowserCacheManager.addAccountKeyToMap called with key: " + key);
+            var accountKeys = this.getAccountKeys();
+            if (accountKeys.indexOf(key) === -1) {
+                // Only add key if it does not already exist in the map
+                accountKeys.push(key);
+                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+                this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
+            }
+            else {
+                this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key already exists in map");
+            }
+        };
+        /**
+         * Remove an account from the key map
+         * @param key
+         */
+        BrowserCacheManager.prototype.removeAccountKeyFromMap = function (key) {
+            this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called");
+            this.logger.tracePii("BrowserCacheManager.removeAccountKeyFromMap called with key: " + key);
+            var accountKeys = this.getAccountKeys();
+            var removalIndex = accountKeys.indexOf(key);
+            if (removalIndex > -1) {
+                accountKeys.splice(removalIndex, 1);
+                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+                this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
+            }
+            else {
+                this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap key not found in existing map");
+            }
+        };
+        /**
+         * Extends inherited removeAccount function to include removal of the account key from the map
+         * @param key
+         */
+        BrowserCacheManager.prototype.removeAccount = function (key) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    _super.prototype.removeAccount.call(this, key);
+                    this.removeAccountKeyFromMap(key);
+                    return [2 /*return*/];
+                });
+            });
+        };
+        /**
+         * Removes given idToken from the cache and from the key map
+         * @param key
+         */
+        BrowserCacheManager.prototype.removeIdToken = function (key) {
+            _super.prototype.removeIdToken.call(this, key);
+            this.removeTokenKey(key, CredentialType.ID_TOKEN);
+        };
+        /**
+         * Removes given accessToken from the cache and from the key map
+         * @param key
+         */
+        BrowserCacheManager.prototype.removeAccessToken = function (key) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    _super.prototype.removeAccessToken.call(this, key);
+                    this.removeTokenKey(key, CredentialType.ACCESS_TOKEN);
+                    return [2 /*return*/];
+                });
+            });
+        };
+        /**
+         * Removes given refreshToken from the cache and from the key map
+         * @param key
+         */
+        BrowserCacheManager.prototype.removeRefreshToken = function (key) {
+            _super.prototype.removeRefreshToken.call(this, key);
+            this.removeTokenKey(key, CredentialType.REFRESH_TOKEN);
+        };
+        /**
+         * Gets the keys for the cached tokens associated with this clientId
+         * @returns
+         */
+        BrowserCacheManager.prototype.getTokenKeys = function () {
+            this.logger.trace("BrowserCacheManager.getTokenKeys called");
+            var item = this.getItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId);
+            if (item) {
+                var tokenKeys = this.validateAndParseJson(item);
+                if (tokenKeys &&
+                    tokenKeys.hasOwnProperty("idToken") &&
+                    tokenKeys.hasOwnProperty("accessToken") &&
+                    tokenKeys.hasOwnProperty("refreshToken")) {
+                    return tokenKeys;
+                }
+                else {
+                    this.logger.error("BrowserCacheManager.getTokenKeys - Token keys found but in an unknown format. Returning empty key map.");
+                }
+            }
+            else {
+                this.logger.verbose("BrowserCacheManager.getTokenKeys - No token keys found");
+            }
+            return {
+                idToken: [],
+                accessToken: [],
+                refreshToken: []
+            };
+        };
+        /**
+         * Adds the given key to the token key map
+         * @param key
+         * @param type
+         */
+        BrowserCacheManager.prototype.addTokenKey = function (key, type) {
+            this.logger.trace("BrowserCacheManager addTokenKey called");
+            var tokenKeys = this.getTokenKeys();
+            switch (type) {
+                case CredentialType.ID_TOKEN:
+                    if (tokenKeys.idToken.indexOf(key) === -1) {
+                        this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
+                        tokenKeys.idToken.push(key);
+                    }
+                    break;
+                case CredentialType.ACCESS_TOKEN:
+                    if (tokenKeys.accessToken.indexOf(key) === -1) {
+                        this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map");
+                        tokenKeys.accessToken.push(key);
+                    }
+                    break;
+                case CredentialType.REFRESH_TOKEN:
+                    if (tokenKeys.refreshToken.indexOf(key) === -1) {
+                        this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
+                        tokenKeys.refreshToken.push(key);
+                    }
+                    break;
+                default:
+                    this.logger.error("BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: " + type);
+                    ClientAuthError.createUnexpectedCredentialTypeError();
+            }
+            this.setItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId, JSON.stringify(tokenKeys));
+        };
+        /**
+         * Removes the given key from the token key map
+         * @param key
+         * @param type
+         */
+        BrowserCacheManager.prototype.removeTokenKey = function (key, type) {
+            this.logger.trace("BrowserCacheManager removeTokenKey called");
+            var tokenKeys = this.getTokenKeys();
+            switch (type) {
+                case CredentialType.ID_TOKEN:
+                    this.logger.infoPii("BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: " + key + " from map");
+                    var idRemoval = tokenKeys.idToken.indexOf(key);
+                    if (idRemoval > -1) {
+                        this.logger.info("BrowserCacheManager: removeTokenKey - idToken removed from map");
+                        tokenKeys.idToken.splice(idRemoval, 1);
+                    }
+                    else {
+                        this.logger.info("BrowserCacheManager: removeTokenKey - idToken does not exist in map. Either it was previously removed or it was never added.");
+                    }
+                    break;
+                case CredentialType.ACCESS_TOKEN:
+                    this.logger.infoPii("BrowserCacheManager: removeTokenKey - attempting to remove accessToken with key: " + key + " from map");
+                    var accessRemoval = tokenKeys.accessToken.indexOf(key);
+                    if (accessRemoval > -1) {
+                        this.logger.info("BrowserCacheManager: removeTokenKey - accessToken removed from map");
+                        tokenKeys.idToken.splice(accessRemoval, 1);
+                    }
+                    else {
+                        this.logger.info("BrowserCacheManager: removeTokenKey - accessToken does not exist in map. Either it was previously removed or it was never added.");
+                    }
+                    break;
+                case CredentialType.REFRESH_TOKEN:
+                    this.logger.infoPii("BrowserCacheManager: removeTokenKey - attempting to remove refreshToken with key: " + key + " from map");
+                    var refreshRemoval = tokenKeys.refreshToken.indexOf(key);
+                    if (refreshRemoval > -1) {
+                        this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken removed from map");
+                        tokenKeys.idToken.splice(refreshRemoval, 1);
+                    }
+                    else {
+                        this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken does not exist in map. Either it was previously removed or it was never added.");
+                    }
+                    break;
+                default:
+                    this.logger.error("BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: " + type);
+                    ClientAuthError.createUnexpectedCredentialTypeError();
+            }
+            this.setItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId, JSON.stringify(tokenKeys));
         };
         /**
          * generates idToken entity from a string
@@ -9559,11 +9943,13 @@
             var value = this.getItem(idTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
+                this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
                 return null;
             }
             var parsedIdToken = this.validateAndParseJson(value);
             if (!parsedIdToken || !IdTokenEntity.isIdTokenEntity(parsedIdToken)) {
                 this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
+                this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit");
@@ -9577,6 +9963,7 @@
             this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
             var idTokenKey = idToken.generateCredentialKey();
             this.setItem(idTokenKey, JSON.stringify(idToken));
+            this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
         };
         /**
          * generates accessToken entity from a string
@@ -9586,11 +9973,13 @@
             var value = this.getItem(accessTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
+                this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
                 return null;
             }
             var parsedAccessToken = this.validateAndParseJson(value);
             if (!parsedAccessToken || !AccessTokenEntity.isAccessTokenEntity(parsedAccessToken)) {
                 this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
+                this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit");
@@ -9604,6 +9993,7 @@
             this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
             var accessTokenKey = accessToken.generateCredentialKey();
             this.setItem(accessTokenKey, JSON.stringify(accessToken));
+            this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
         };
         /**
          * generates refreshToken entity from a string
@@ -9613,11 +10003,13 @@
             var value = this.getItem(refreshTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
+                this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
                 return null;
             }
             var parsedRefreshToken = this.validateAndParseJson(value);
             if (!parsedRefreshToken || !RefreshTokenEntity.isRefreshTokenEntity(parsedRefreshToken)) {
                 this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
+                this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit");
@@ -9631,6 +10023,7 @@
             this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
             var refreshTokenKey = refreshToken.generateCredentialKey();
             this.setItem(refreshTokenKey, JSON.stringify(refreshToken));
+            this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
         };
         /**
          * fetch appMetadata entity from the platform cache
@@ -9928,7 +10321,6 @@
                 this.logger.trace("BrowserCacheManager.removeItem: storeAuthStateInCookie is true, clearing item cookie");
                 this.clearItemCookie(key);
             }
-            return true;
         };
         /**
          * Checks whether key is in cache.
@@ -10356,14 +10748,15 @@
         var cacheOptions = {
             cacheLocation: exports.BrowserCacheLocation.MemoryStorage,
             storeAuthStateInCookie: false,
-            secureCookies: false
+            secureCookies: false,
+            cacheMigrationEnabled: false
         };
         return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger);
     };
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.33.0";
+    var version = "2.35.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11834,15 +12227,18 @@
          */
         NativeInteractionClient.prototype.acquireTokensFromCache = function (nativeAccountId, request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var accountEntity, account, silentRequest, result, e_2;
+                var account, silentRequest, result, e_2;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            accountEntity = this.browserStorage.readAccountFromCacheWithNativeAccountId(nativeAccountId);
-                            if (!accountEntity) {
+                            if (!nativeAccountId) {
+                                this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided");
+                                throw ClientAuthError.createNoAccountFoundError();
+                            }
+                            account = this.browserStorage.getAccountInfoFilteredBy({ nativeAccountId: nativeAccountId });
+                            if (!account) {
                                 throw ClientAuthError.createNoAccountFoundError();
                             }
-                            account = accountEntity.getAccountInfo();
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, 3, , 4]);
@@ -11973,60 +12369,92 @@
          */
         NativeInteractionClient.prototype.handleNativeResponse = function (response, request, reqTimestamp) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var mats, idTokenObj, authority, authorityPreferredCache, homeAccountIdentifier, accountEntity, responseScopes, accountProperties, uid, tid, responseAccessToken, responseTokenType, _a, popTokenGenerator, shrParameters, result, idTokenEntity, expiresIn, tokenExpirationSeconds, accessTokenEntity;
-                var _this = this;
-                return __generator$1(this, function (_b) {
-                    switch (_b.label) {
+                var authority, authorityPreferredCache, idTokenObj, homeAccountIdentifier, accountEntity, result;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
                         case 0:
                             this.logger.trace("NativeInteractionClient - handleNativeResponse called.");
-                            mats = this.getMATSFromResponse(response);
-                            this.performanceClient.addStaticFields({
-                                extensionId: this.nativeMessageHandler.getExtensionId(),
-                                extensionVersion: this.nativeMessageHandler.getExtensionVersion(),
-                                matsBrokerVersion: mats ? mats.broker_version : undefined,
-                                matsAccountJoinOnStart: mats ? mats.account_join_on_start : undefined,
-                                matsAccountJoinOnEnd: mats ? mats.account_join_on_end : undefined,
-                                matsDeviceJoin: mats ? mats.device_join : undefined,
-                                matsPromptBehavior: mats ? mats.prompt_behavior : undefined,
-                                matsApiErrorCode: mats ? mats.api_error_code : undefined,
-                                matsUiVisible: mats ? mats.ui_visible : undefined,
-                                matsSilentCode: mats ? mats.silent_code : undefined,
-                                matsSilentBiSubCode: mats ? mats.silent_bi_sub_code : undefined,
-                                matsSilentMessage: mats ? mats.silent_message : undefined,
-                                matsSilentStatus: mats ? mats.silent_status : undefined,
-                                matsHttpStatus: mats ? mats.http_status : undefined,
-                                matsHttpEventCount: mats ? mats.http_event_count : undefined
-                            }, this.correlationId);
                             if (response.account.id !== request.accountId) {
                                 // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
                                 throw NativeAuthError.createUserSwitchError();
                             }
-                            idTokenObj = new AuthToken(response.id_token || Constants.EMPTY_STRING, this.browserCrypto);
                             return [4 /*yield*/, this.getDiscoveredAuthority(request.authority)];
                         case 1:
-                            authority = _b.sent();
+                            authority = _a.sent();
                             authorityPreferredCache = authority.getPreferredCache();
-                            homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj);
-                            accountEntity = AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, authorityPreferredCache, response.account.id);
-                            this.browserStorage.setAccount(accountEntity);
-                            responseScopes = response.scope ? ScopeSet.fromString(response.scope) : ScopeSet.fromString(request.scope);
-                            accountProperties = response.account.properties || {};
-                            uid = accountProperties["UID"] || idTokenObj.claims.oid || idTokenObj.claims.sub || Constants.EMPTY_STRING;
-                            tid = accountProperties["TenantId"] || idTokenObj.claims.tid || Constants.EMPTY_STRING;
-                            responseTokenType = exports.AuthenticationScheme.BEARER;
-                            _a = request.tokenType;
-                            switch (_a) {
-                                case exports.AuthenticationScheme.POP: return [3 /*break*/, 2];
-                            }
-                            return [3 /*break*/, 4];
+                            idTokenObj = this.createIdTokenObj(response);
+                            homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenObj);
+                            accountEntity = this.createAccountEntity(response, homeAccountIdentifier, idTokenObj, authorityPreferredCache);
+                            return [4 /*yield*/, this.generateAuthenticationResult(response, request, idTokenObj, accountEntity, authority.canonicalAuthority, reqTimestamp)];
                         case 2:
-                            // Set the token type to POP in the response
-                            responseTokenType = exports.AuthenticationScheme.POP;
+                            result = _a.sent();
+                            // cache accounts and tokens in the appropriate storage
+                            this.cacheAccount(accountEntity);
+                            this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenObj, result.accessToken, result.tenantId, reqTimestamp);
+                            return [2 /*return*/, result];
+                    }
+                });
+            });
+        };
+        /**
+         * Create an idToken Object (not entity)
+         * @param response
+         * @returns
+         */
+        NativeInteractionClient.prototype.createIdTokenObj = function (response) {
+            return new AuthToken(response.id_token || Constants.EMPTY_STRING, this.browserCrypto);
+        };
+        /**
+         * creates an homeAccountIdentifier for the account
+         * @param response
+         * @param idTokenObj
+         * @returns
+         */
+        NativeInteractionClient.prototype.createHomeAccountIdentifier = function (response, idTokenObj) {
+            // Save account in browser storage
+            var homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj);
+            return homeAccountIdentifier;
+        };
+        /**
+         * Creates account entity
+         * @param response
+         * @param homeAccountIdentifier
+         * @param idTokenObj
+         * @param authority
+         * @returns
+         */
+        NativeInteractionClient.prototype.createAccountEntity = function (response, homeAccountIdentifier, idTokenObj, authority) {
+            return AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, authority, response.account.id);
+        };
+        /**
+         * Helper to generate scopes
+         * @param response
+         * @param request
+         * @returns
+         */
+        NativeInteractionClient.prototype.generateScopes = function (response, request) {
+            return response.scope ? ScopeSet.fromString(response.scope) : ScopeSet.fromString(request.scope);
+        };
+        /**
+         * If PoP token is requesred, records the PoP token if returned from the WAM, else generates one in the browser
+         * @param request
+         * @param response
+         */
+        NativeInteractionClient.prototype.generatePopAccessToken = function (response, request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var popTokenGenerator, shrParameters;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            if (!(request.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
+                            /**
+                             * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
+                             * is still received, SHR is calculated locally
+                             */
                             // Check if native layer returned an SHR token
                             if (response.shr) {
                                 this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer");
-                                responseAccessToken = response.shr;
-                                return [3 /*break*/, 5];
+                                return [2 /*return*/, response.shr];
                             }
                             popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
                             shrParameters = {
@@ -12043,17 +12471,39 @@
                                 throw ClientAuthError.createKeyIdMissingError();
                             }
                             return [4 /*yield*/, popTokenGenerator.signPopToken(response.access_token, request.keyId, shrParameters)];
-                        case 3:
-                            responseAccessToken = _b.sent();
-                            return [3 /*break*/, 5];
-                        case 4:
-                            {
-                                responseAccessToken = response.access_token;
-                            }
-                            _b.label = 5;
-                        case 5:
+                        case 1: return [2 /*return*/, _a.sent()];
+                        case 2: return [2 /*return*/, response.access_token];
+                    }
+                });
+            });
+        };
+        /**
+         * Generates authentication result
+         * @param response
+         * @param request
+         * @param idTokenObj
+         * @param accountEntity
+         * @param authority
+         * @param reqTimestamp
+         * @returns
+         */
+        NativeInteractionClient.prototype.generateAuthenticationResult = function (response, request, idTokenObj, accountEntity, authority, reqTimestamp) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var mats, responseScopes, accountProperties, uid, tid, responseAccessToken, tokenType, result;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            mats = this.addTelemetryFromNativeResponse(response);
+                            responseScopes = response.scope ? ScopeSet.fromString(response.scope) : ScopeSet.fromString(request.scope);
+                            accountProperties = response.account.properties || {};
+                            uid = accountProperties["UID"] || idTokenObj.claims.oid || idTokenObj.claims.sub || Constants.EMPTY_STRING;
+                            tid = accountProperties["TenantId"] || idTokenObj.claims.tid || Constants.EMPTY_STRING;
+                            return [4 /*yield*/, this.generatePopAccessToken(response, request)];
+                        case 1:
+                            responseAccessToken = _a.sent();
+                            tokenType = (request.tokenType === exports.AuthenticationScheme.POP) ? exports.AuthenticationScheme.POP : exports.AuthenticationScheme.BEARER;
                             result = {
-                                authority: authority.canonicalAuthority,
+                                authority: authority,
                                 uniqueId: uid,
                                 tenantId: tid,
                                 scopes: responseScopes.asArray(),
@@ -12063,30 +12513,78 @@
                                 accessToken: responseAccessToken,
                                 fromCache: mats ? this.isResponseFromCache(mats) : false,
                                 expiresOn: new Date(Number(reqTimestamp + response.expires_in) * 1000),
-                                tokenType: responseTokenType,
+                                tokenType: tokenType,
                                 correlationId: this.correlationId,
                                 state: response.state,
                                 fromNativeBroker: true
                             };
-                            idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || Constants.EMPTY_STRING, request.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
-                            this.nativeStorageManager.setIdTokenCredential(idTokenEntity);
-                            expiresIn = (responseTokenType === exports.AuthenticationScheme.POP)
-                                ? Constants.SHR_NONCE_VALIDITY
-                                : (typeof response.expires_in === "string"
-                                    ? parseInt(response.expires_in, 10)
-                                    : response.expires_in) || 0;
-                            tokenExpirationSeconds = reqTimestamp + expiresIn;
-                            accessTokenEntity = AccessTokenEntity.createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, tid, responseScopes.printScopes(), tokenExpirationSeconds, 0, this.browserCrypto);
-                            this.nativeStorageManager.setAccessTokenCredential(accessTokenEntity);
-                            // Remove any existing cached tokens for this account in browser storage
-                            this.browserStorage.removeAccountContext(accountEntity).catch(function (e) {
-                                _this.logger.error("Error occurred while removing account context from browser storage. " + e);
-                            });
                             return [2 /*return*/, result];
                     }
                 });
             });
         };
+        /**
+         * cache the account entity in browser storage
+         * @param accountEntity
+         */
+        NativeInteractionClient.prototype.cacheAccount = function (accountEntity) {
+            var _this = this;
+            // Store the account info and hence `nativeAccountId` in browser cache
+            this.browserStorage.setAccount(accountEntity);
+            // Remove any existing cached tokens for this account in browser storage
+            this.browserStorage.removeAccountContext(accountEntity).catch(function (e) {
+                _this.logger.error("Error occurred while removing account context from browser storage. " + e);
+            });
+        };
+        /**
+         * Stores the access_token and id_token in inmemory storage
+         * @param response
+         * @param request
+         * @param homeAccountIdentifier
+         * @param idTokenObj
+         * @param responseAccessToken
+         * @param tenantId
+         * @param reqTimestamp
+         */
+        NativeInteractionClient.prototype.cacheNativeTokens = function (response, request, homeAccountIdentifier, idTokenObj, responseAccessToken, tenantId, reqTimestamp) {
+            // cache idToken in inmemory storage
+            var idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || Constants.EMPTY_STRING, request.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+            this.nativeStorageManager.setIdTokenCredential(idTokenEntity);
+            // cache accessToken in inmemory storage
+            var expiresIn = (request.tokenType === exports.AuthenticationScheme.POP)
+                ? Constants.SHR_NONCE_VALIDITY
+                : (typeof response.expires_in === "string"
+                    ? parseInt(response.expires_in, 10)
+                    : response.expires_in) || 0;
+            var tokenExpirationSeconds = reqTimestamp + expiresIn;
+            var responseScopes = this.generateScopes(response, request);
+            var accessTokenEntity = AccessTokenEntity.createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, this.browserCrypto);
+            this.nativeStorageManager.setAccessTokenCredential(accessTokenEntity);
+        };
+        NativeInteractionClient.prototype.addTelemetryFromNativeResponse = function (response) {
+            var mats = this.getMATSFromResponse(response);
+            if (!mats) {
+                return null;
+            }
+            this.performanceClient.addStaticFields({
+                extensionId: this.nativeMessageHandler.getExtensionId(),
+                extensionVersion: this.nativeMessageHandler.getExtensionVersion(),
+                matsBrokerVersion: mats.broker_version,
+                matsAccountJoinOnStart: mats.account_join_on_start,
+                matsAccountJoinOnEnd: mats.account_join_on_end,
+                matsDeviceJoin: mats.device_join,
+                matsPromptBehavior: mats.prompt_behavior,
+                matsApiErrorCode: mats.api_error_code,
+                matsUiVisible: mats.ui_visible,
+                matsSilentCode: mats.silent_code,
+                matsSilentBiSubCode: mats.silent_bi_sub_code,
+                matsSilentMessage: mats.silent_message,
+                matsSilentStatus: mats.silent_status,
+                matsHttpStatus: mats.http_status,
+                matsHttpEventCount: mats.http_event_count
+            }, this.correlationId);
+            return mats;
+        };
         /**
          * Validates native platform response before processing
          * @param response
@@ -12205,7 +12703,7 @@
      * Licensed under the MIT License.
      */
     var NativeMessageHandler = /** @class */ (function () {
-        function NativeMessageHandler(logger, handshakeTimeoutMs, extensionId) {
+        function NativeMessageHandler(logger, handshakeTimeoutMs, performanceClient, extensionId) {
             this.logger = logger;
             this.handshakeTimeoutMs = handshakeTimeoutMs;
             this.extensionId = extensionId;
@@ -12214,6 +12712,8 @@
             this.responseId = 0;
             this.messageChannel = new MessageChannel();
             this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
+            this.performanceClient = performanceClient;
+            this.handshakeEvent = performanceClient.startMeasurement(exports.PerformanceEvents.NativeMessageHandlerHandshake);
         }
         /**
          * Sends a given message to the extension and resolves with the extension response
@@ -12242,10 +12742,11 @@
         };
         /**
          * Returns an instance of the MessageHandler that has successfully established a connection with an extension
-         * @param logger
-         * @param handshakeTimeoutMs
+         * @param {Logger} logger
+         * @param {number} handshakeTimeoutMs
+         * @param {IPerformanceClient} performanceClient
          */
-        NativeMessageHandler.createProvider = function (logger, handshakeTimeoutMs) {
+        NativeMessageHandler.createProvider = function (logger, handshakeTimeoutMs, performanceClient) {
             return __awaiter$1(this, void 0, void 0, function () {
                 var preferredProvider, backupProvider;
                 return __generator$1(this, function (_a) {
@@ -12255,14 +12756,14 @@
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, 3, , 5]);
-                            preferredProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, NativeConstants.PREFERRED_EXTENSION_ID);
+                            preferredProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, performanceClient, NativeConstants.PREFERRED_EXTENSION_ID);
                             return [4 /*yield*/, preferredProvider.sendHandshakeRequest()];
                         case 2:
                             _a.sent();
                             return [2 /*return*/, preferredProvider];
                         case 3:
                             _a.sent();
-                            backupProvider = new NativeMessageHandler(logger, handshakeTimeoutMs);
+                            backupProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, performanceClient);
                             return [4 /*yield*/, backupProvider.sendHandshakeRequest()];
                         case 4:
                             _a.sent();
@@ -12291,6 +12792,10 @@
                             method: NativeExtensionMethod.HandshakeRequest
                         }
                     };
+                    this.handshakeEvent.addStaticFields({
+                        extensionId: this.extensionId,
+                        extensionHandshakeTimeoutMs: this.handshakeTimeoutMs
+                    });
                     this.messageChannel.port1.onmessage = function (event) {
                         _this.onChannelMessage(event);
                     };
@@ -12305,6 +12810,7 @@
                                 window.removeEventListener("message", _this.windowListener, false);
                                 _this.messageChannel.port1.close();
                                 _this.messageChannel.port2.close();
+                                _this.handshakeEvent.endMeasurement({ extensionHandshakeTimedOut: true, success: false });
                                 reject(BrowserAuthError.createNativeHandshakeTimeoutError());
                                 _this.handshakeResolvers.delete(req.responseId);
                             }, _this.handshakeTimeoutMs); // Use a reasonable timeout in milliseconds here
@@ -12338,6 +12844,7 @@
                 window.removeEventListener("message", this.windowListener, false);
                 var handshakeResolver = this.handshakeResolvers.get(request.responseId);
                 if (handshakeResolver) {
+                    this.handshakeEvent.endMeasurement({ success: false, extensionInstalled: false });
                     handshakeResolver.reject(BrowserAuthError.createNativeExtensionNotInstalledError());
                 }
             }
@@ -12385,6 +12892,7 @@
                     this.extensionId = request.extensionId;
                     this.extensionVersion = request.body.version;
                     this.logger.verbose("NativeMessageHandler - Received HandshakeResponse from extension: " + this.extensionId);
+                    this.handshakeEvent.endMeasurement({ extensionInstalled: true, success: true });
                     handshakeResolver.resolve();
                     this.handshakeResolvers.delete(request.responseId);
                 }
@@ -13373,7 +13881,9 @@
         var DEFAULT_CACHE_OPTIONS = {
             cacheLocation: exports.BrowserCacheLocation.SessionStorage,
             storeAuthStateInCookie: false,
-            secureCookies: false
+            secureCookies: false,
+            // Default cache migration to true if cache location is localStorage since entries are preserved across tabs/windows. Migration has little to no benefit in sessionStorage and memoryStorage
+            cacheMigrationEnabled: userInputCache && userInputCache.cacheLocation === exports.BrowserCacheLocation.LocalStorage ? true : false
         };
         // Default logger options for browser
         var DEFAULT_LOGGER_OPTIONS = {
@@ -15454,10 +15964,19 @@
     var BrowserPerformanceMeasurement = /** @class */ (function () {
         function BrowserPerformanceMeasurement(name, correlationId) {
             this.correlationId = correlationId;
-            this.measureName = "msal.measure." + name + "." + this.correlationId;
-            this.startMark = "msal.start." + name + "." + this.correlationId;
-            this.endMark = "msal.end." + name + "." + this.correlationId;
+            this.measureName = BrowserPerformanceMeasurement.makeMeasureName(name, correlationId);
+            this.startMark = BrowserPerformanceMeasurement.makeStartMark(name, correlationId);
+            this.endMark = BrowserPerformanceMeasurement.makeEndMark(name, correlationId);
         }
+        BrowserPerformanceMeasurement.makeMeasureName = function (name, correlationId) {
+            return "msal.measure." + name + "." + correlationId;
+        };
+        BrowserPerformanceMeasurement.makeStartMark = function (name, correlationId) {
+            return "msal.start." + name + "." + correlationId;
+        };
+        BrowserPerformanceMeasurement.makeEndMark = function (name, correlationId) {
+            return "msal.end." + name + "." + correlationId;
+        };
         BrowserPerformanceMeasurement.supportsBrowserPerformance = function () {
             return typeof window !== "undefined" &&
                 typeof window.performance !== "undefined" &&
@@ -15467,6 +15986,29 @@
                 typeof window.performance.clearMeasures === "function" &&
                 typeof window.performance.getEntriesByName === "function";
         };
+        /**
+         * Flush browser marks and measurements.
+         * @param {string} correlationId
+         * @param {SubMeasurement} measurements
+         */
+        BrowserPerformanceMeasurement.flushMeasurements = function (correlationId, measurements) {
+            if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
+                try {
+                    measurements.forEach(function (measurement) {
+                        var measureName = BrowserPerformanceMeasurement.makeMeasureName(measurement.name, correlationId);
+                        var entriesForMeasurement = window.performance.getEntriesByName(measureName, "measure");
+                        if (entriesForMeasurement.length > 0) {
+                            window.performance.clearMeasures(measureName);
+                            window.performance.clearMarks(BrowserPerformanceMeasurement.makeStartMark(measureName, correlationId));
+                            window.performance.clearMarks(BrowserPerformanceMeasurement.makeEndMark(measureName, correlationId));
+                        }
+                    });
+                }
+                catch (e) {
+                    // Silently catch and return null
+                }
+            }
+        };
         BrowserPerformanceMeasurement.prototype.startMeasurement = function () {
             if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
                 try {
@@ -15531,6 +16073,20 @@
             var _a;
             return ((_a = document.visibilityState) === null || _a === void 0 ? void 0 : _a.toString()) || null;
         };
+        BrowserPerformanceClient.prototype.deleteIncompleteSubMeasurements = function (inProgressEvent) {
+            var rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
+            var isRootEvent = rootEvent && rootEvent.eventId === inProgressEvent.event.eventId;
+            var incompleteMeasurements = [];
+            if (isRootEvent && (rootEvent === null || rootEvent === void 0 ? void 0 : rootEvent.incompleteSubMeasurements)) {
+                rootEvent.incompleteSubMeasurements.forEach(function (subMeasurement) {
+                    incompleteMeasurements.push(__assign$1({}, subMeasurement));
+                });
+            }
+            // Clean up remaining marks for incomplete sub-measurements
+            if (incompleteMeasurements.length > 0) {
+                BrowserPerformanceMeasurement.flushMeasurements(inProgressEvent.event.correlationId, incompleteMeasurements);
+            }
+        };
         BrowserPerformanceClient.prototype.supportsBrowserPerformanceNow = function () {
             return typeof window !== "undefined" &&
                 typeof window.performance !== "undefined" &&
@@ -15550,7 +16106,13 @@
             var startPageVisibility = this.getPageVisibility();
             var inProgressEvent = _super.prototype.startMeasurement.call(this, measureName, correlationId);
             return __assign$1(__assign$1({}, inProgressEvent), { endMeasurement: function (event) {
-                    return inProgressEvent.endMeasurement(__assign$1({ startPageVisibility: startPageVisibility, endPageVisibility: _this.getPageVisibility() }, event));
+                    var res = inProgressEvent.endMeasurement(__assign$1({ startPageVisibility: startPageVisibility, endPageVisibility: _this.getPageVisibility() }, event));
+                    _this.deleteIncompleteSubMeasurements(inProgressEvent);
+                    return res;
+                }, discardMeasurement: function () {
+                    inProgressEvent.discardMeasurement();
+                    _this.deleteIncompleteSubMeasurements(inProgressEvent);
+                    inProgressEvent.measurement.flushMeasurement();
                 } });
         };
         /**
@@ -15568,26 +16130,27 @@
                 this.logger.trace("BrowserPerformanceClient: correlationId for " + eventName + " not provided, unable to set telemetry queue time");
                 return;
             }
-            var preQueueTimesByEvents = this.preQueueTimeByCorrelationId.get(correlationId);
-            if (preQueueTimesByEvents) {
-                preQueueTimesByEvents.set(eventName, window.performance.now());
-                this.preQueueTimeByCorrelationId.set(correlationId, preQueueTimesByEvents);
-            }
-            else {
-                var preQueueTimes = new Map();
-                preQueueTimes.set(eventName, window.performance.now());
-                this.preQueueTimeByCorrelationId.set(correlationId, preQueueTimes);
+            var preQueueEvent = this.preQueueTimeByCorrelationId.get(correlationId);
+            /**
+             * Manually complete queue measurement if there is an incomplete pre-queue event.
+             * Incomplete pre-queue events are instrumentation bugs that should be fixed.
+             */
+            if (preQueueEvent) {
+                this.logger.trace("BrowserPerformanceClient: Incomplete pre-queue " + preQueueEvent.name + " found", correlationId);
+                this.addQueueMeasurement(preQueueEvent.name, correlationId, undefined, true);
             }
+            this.preQueueTimeByCorrelationId.set(correlationId, { name: eventName, time: window.performance.now() });
         };
         /**
          * Calculates and adds queue time measurement for given performance event.
          *
-         * @param {PerformanceEvents} name
+         * @param {PerformanceEvents} eventName
          * @param {?string} correlationId
-         * @param {?number} preQueueTime
+         * @param {?number} queueTime
+         * @param {?boolean} manuallyCompleted - indicator for manually completed queue measurements
          * @returns
          */
-        BrowserPerformanceClient.prototype.addQueueMeasurement = function (eventName, correlationId) {
+        BrowserPerformanceClient.prototype.addQueueMeasurement = function (eventName, correlationId, queueTime, manuallyCompleted) {
             if (!this.supportsBrowserPerformanceNow()) {
                 this.logger.trace("BrowserPerformanceClient: window performance API not available, unable to add queue measurement for " + eventName);
                 return;
@@ -15601,8 +16164,8 @@
                 return;
             }
             var currentTime = window.performance.now();
-            var queueTime = _super.prototype.calculateQueuedTime.call(this, preQueueTime, currentTime);
-            return _super.prototype.addQueueMeasurement.call(this, eventName, correlationId, queueTime);
+            var resQueueTime = queueTime || _super.prototype.calculateQueuedTime.call(this, preQueueTime, currentTime);
+            return _super.prototype.addQueueMeasurement.call(this, eventName, correlationId, resQueueTime, manuallyCompleted);
         };
         return BrowserPerformanceClient;
     }(PerformanceClient));
@@ -15621,6 +16184,7 @@
         SilentIframeClient: SilentIframeClient,
         SilentCacheClient: SilentCacheClient,
         SilentRefreshClient: SilentRefreshClient,
+        NativeInteractionClient: NativeInteractionClient,
         RedirectHandler: RedirectHandler,
         EventHandler: EventHandler,
         NativeMessageHandler: NativeMessageHandler,
@@ -16002,7 +16566,8 @@
             var nativeCacheOptions = {
                 cacheLocation: exports.BrowserCacheLocation.MemoryStorage,
                 storeAuthStateInCookie: false,
-                secureCookies: false
+                secureCookies: false,
+                cacheMigrationEnabled: false
             };
             this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger);
             // Initialize the token cache
@@ -16015,7 +16580,7 @@
          */
         ClientApplication.prototype.initialize = function () {
             return __awaiter$1(this, void 0, void 0, function () {
-                var _a, e_1;
+                var allowNativeBroker, initMeasurement, _a, e_1;
                 return __generator$1(this, function (_b) {
                     switch (_b.label) {
                         case 0:
@@ -16024,13 +16589,15 @@
                                 this.logger.info("initialize has already been called, exiting early.");
                                 return [2 /*return*/];
                             }
+                            allowNativeBroker = this.config.system.allowNativeBroker;
+                            initMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.InitializeClientApplication);
                             this.eventHandler.emitEvent(exports.EventType.INITIALIZE_START);
-                            if (!this.config.system.allowNativeBroker) return [3 /*break*/, 4];
+                            if (!allowNativeBroker) return [3 /*break*/, 4];
                             _b.label = 1;
                         case 1:
                             _b.trys.push([1, 3, , 4]);
                             _a = this;
-                            return [4 /*yield*/, NativeMessageHandler.createProvider(this.logger, this.config.system.nativeBrokerHandshakeTimeout)];
+                            return [4 /*yield*/, NativeMessageHandler.createProvider(this.logger, this.config.system.nativeBrokerHandshakeTimeout, this.performanceClient)];
                         case 2:
                             _a.nativeExtensionProvider = _b.sent();
                             return [3 /*break*/, 4];
@@ -16041,6 +16608,7 @@
                         case 4:
                             this.initialized = true;
                             this.eventHandler.emitEvent(exports.EventType.INITIALIZE_END);
+                            initMeasurement.endMeasurement({ allowNativeBroker: allowNativeBroker, success: true });
                             return [2 /*return*/];
                     }
                 });
@@ -16216,7 +16784,6 @@
                         isNativeBroker: true,
                         requestId: response.requestId
                     });
-                    atPopupMeasurement.flushMeasurement();
                     return response;
                 }).catch(function (e) {
                     if (e instanceof NativeAuthError && e.isFatal()) {
@@ -16256,7 +16823,6 @@
                     success: true,
                     requestId: result.requestId
                 });
-                atPopupMeasurement.flushMeasurement();
                 return result;
             }).catch(function (e) {
                 if (loggedInAccounts.length > 0) {
@@ -16270,7 +16836,6 @@
                     subErrorCode: e.subError,
                     success: false
                 });
-                atPopupMeasurement.flushMeasurement();
                 // Since this function is syncronous we need to reject
                 return Promise.reject(e);
             });
@@ -16336,7 +16901,7 @@
                         result = silentIframeClient.acquireToken(validRequest);
                     }
                     return [2 /*return*/, result.then(function (response) {
-                            var _a, _b, _c;
+                            var _a, _b;
                             _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, response);
                             (_a = _this.ssoSilentMeasurement) === null || _a === void 0 ? void 0 : _a.addStaticFields({
                                 accessTokenSize: response.accessToken.length,
@@ -16347,17 +16912,15 @@
                                 isNativeBroker: response.fromNativeBroker,
                                 requestId: response.requestId
                             });
-                            (_c = _this.ssoSilentMeasurement) === null || _c === void 0 ? void 0 : _c.flushMeasurement();
                             return response;
                         }).catch(function (e) {
-                            var _a, _b;
+                            var _a;
                             _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e);
                             (_a = _this.ssoSilentMeasurement) === null || _a === void 0 ? void 0 : _a.endMeasurement({
                                 errorCode: e.errorCode,
                                 subErrorCode: e.subError,
                                 success: false
                             });
-                            (_b = _this.ssoSilentMeasurement) === null || _b === void 0 ? void 0 : _b.flushMeasurement();
                             throw e;
                         }).finally(function () {
                             document.removeEventListener("visibilitychange", _this.trackPageVisibilityWithMeasurement);
@@ -16386,7 +16949,11 @@
                     this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_START, exports.InteractionType.Silent, request);
                     atbcMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenByCode, request.correlationId);
                     try {
-                        if (request.code) {
+                        if (request.code && request.nativeAccountId) {
+                            // Throw error in case server returns both spa_code and spa_accountid in exchange for auth code.
+                            throw BrowserAuthError.createSpaCodeAndNativeAccountIdPresentError();
+                        }
+                        else if (request.code) {
                             hybridAuthCode_1 = request.code;
                             response = this.hybridAuthCodeResponses.get(hybridAuthCode_1);
                             if (!response) {
@@ -16404,7 +16971,6 @@
                                         isNativeBroker: result.fromNativeBroker,
                                         requestId: result.requestId
                                     });
-                                    atbcMeasurement.flushMeasurement();
                                     return result;
                                 })
                                     .catch(function (error) {
@@ -16415,16 +16981,12 @@
                                         subErrorCode: error.subError,
                                         success: false
                                     });
-                                    atbcMeasurement.flushMeasurement();
                                     throw error;
                                 });
                                 this.hybridAuthCodeResponses.set(hybridAuthCode_1, response);
                             }
                             else {
                                 this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
-                                atbcMeasurement.endMeasurement({
-                                    success: true
-                                });
                                 atbcMeasurement.discardMeasurement();
                             }
                             return [2 /*return*/, response];
@@ -16638,15 +17200,20 @@
          * (the account object is created at the time of successful login)
          * or null when no matching account is found.
          * This API is provided for convenience but getAccountById should be used for best reliability
-         * @param userName
+         * @param username
          * @returns The account object stored in MSAL
          */
-        ClientApplication.prototype.getAccountByUsername = function (userName) {
-            var allAccounts = this.getAllAccounts();
-            if (!StringUtils.isEmpty(userName) && allAccounts && allAccounts.length) {
-                this.logger.verbose("Account matching username found, returning");
-                this.logger.verbosePii("Returning signed-in accounts matching username: " + userName);
-                return allAccounts.filter(function (accountObj) { return accountObj.username.toLowerCase() === userName.toLowerCase(); })[0] || null;
+        ClientApplication.prototype.getAccountByUsername = function (username) {
+            this.logger.trace("getAccountByUsername called");
+            if (!username) {
+                this.logger.warning("getAccountByUsername: No username provided");
+                return null;
+            }
+            var account = this.browserStorage.getAccountInfoFilteredBy({ username: username });
+            if (account) {
+                this.logger.verbose("getAccountByUsername: Account matching username found, returning");
+                this.logger.verbosePii("getAccountByUsername: Returning signed-in accounts matching username: " + username);
+                return account;
             }
             else {
                 this.logger.verbose("getAccountByUsername: No matching account found, returning null");
@@ -16661,11 +17228,16 @@
          * @returns The account object stored in MSAL
          */
         ClientApplication.prototype.getAccountByHomeId = function (homeAccountId) {
-            var allAccounts = this.getAllAccounts();
-            if (!StringUtils.isEmpty(homeAccountId) && allAccounts && allAccounts.length) {
-                this.logger.verbose("Account matching homeAccountId found, returning");
-                this.logger.verbosePii("Returning signed-in accounts matching homeAccountId: " + homeAccountId);
-                return allAccounts.filter(function (accountObj) { return accountObj.homeAccountId === homeAccountId; })[0] || null;
+            this.logger.trace("getAccountByHomeId called");
+            if (!homeAccountId) {
+                this.logger.warning("getAccountByHomeId: No homeAccountId provided");
+                return null;
+            }
+            var account = this.browserStorage.getAccountInfoFilteredBy({ homeAccountId: homeAccountId });
+            if (account) {
+                this.logger.verbose("getAccountByHomeId: Account matching homeAccountId found, returning");
+                this.logger.verbosePii("getAccountByHomeId: Returning signed-in accounts matching homeAccountId: " + homeAccountId);
+                return account;
             }
             else {
                 this.logger.verbose("getAccountByHomeId: No matching account found, returning null");
@@ -16680,11 +17252,16 @@
          * @returns The account object stored in MSAL
          */
         ClientApplication.prototype.getAccountByLocalId = function (localAccountId) {
-            var allAccounts = this.getAllAccounts();
-            if (!StringUtils.isEmpty(localAccountId) && allAccounts && allAccounts.length) {
-                this.logger.verbose("Account matching localAccountId found, returning");
-                this.logger.verbosePii("Returning signed-in accounts matching localAccountId: " + localAccountId);
-                return allAccounts.filter(function (accountObj) { return accountObj.localAccountId === localAccountId; })[0] || null;
+            this.logger.trace("getAccountByLocalId called");
+            if (!localAccountId) {
+                this.logger.warning("getAccountByLocalId: No localAccountId provided");
+                return null;
+            }
+            var account = this.browserStorage.getAccountInfoFilteredBy({ localAccountId: localAccountId });
+            if (account) {
+                this.logger.verbose("getAccountByLocalId: Account matching localAccountId found, returning");
+                this.logger.verbosePii("getAccountByLocalId: Returning signed-in accounts matching localAccountId: " + localAccountId);
+                return account;
             }
             else {
                 this.logger.verbose("getAccountByLocalId: No matching account found, returning null");
@@ -17075,7 +17652,6 @@
                                 cacheLookupPolicy: request.cacheLookupPolicy,
                                 requestId: result.requestId,
                             });
-                            atsMeasurement.flushMeasurement();
                             return result;
                         })
                             .catch(function (error) {
@@ -17085,7 +17661,6 @@
                                 subErrorCode: error.subError,
                                 success: false
                             });
-                            atsMeasurement.flushMeasurement();
                             throw error;
                         });
                         this.activeSilentTokenRequests.set(silentRequestKey, response);
@@ -17093,9 +17668,6 @@
                     }
                     else {
                         this.logger.verbose("acquireTokenSilent has been called previously, returning the result from the first call", correlationId);
-                        atsMeasurement.endMeasurement({
-                            success: true
-                        });
                         // Discard measurements for memoized calls, as they are usually only a couple of ms and will artificially deflate metrics
                         atsMeasurement.discardMeasurement();
                         return [2 /*return*/, cachedResponse];