@azure/msal-browser 2.34.0 → 2.36.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.34.0 2023-03-07 */
+/*! @azure/msal-browser v2.36.0 2023-04-18 */
 'use strict';
 'use strict';
 
@@ -117,7 +117,7 @@ function __spread() {
     return ar;
 }
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*! *****************************************************************************
 Copyright (c) Microsoft Corporation.
 
@@ -204,7 +204,7 @@ function __spreadArrays() {
     return r;
 }
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -451,22 +451,6 @@ var CredentialType;
     CredentialType["ACCESS_TOKEN_WITH_AUTH_SCHEME"] = "AccessToken_With_AuthScheme";
     CredentialType["REFRESH_TOKEN"] = "RefreshToken";
 })(CredentialType || (CredentialType = {}));
-/**
- * Credential Type stored in the cache
- */
-var CacheSchemaType;
-(function (CacheSchemaType) {
-    CacheSchemaType["ACCOUNT"] = "Account";
-    CacheSchemaType["CREDENTIAL"] = "Credential";
-    CacheSchemaType["ID_TOKEN"] = "IdToken";
-    CacheSchemaType["ACCESS_TOKEN"] = "AccessToken";
-    CacheSchemaType["REFRESH_TOKEN"] = "RefreshToken";
-    CacheSchemaType["APP_METADATA"] = "AppMetadata";
-    CacheSchemaType["TEMPORARY"] = "TempCache";
-    CacheSchemaType["TELEMETRY"] = "Telemetry";
-    CacheSchemaType["UNDEFINED"] = "Undefined";
-    CacheSchemaType["THROTTLING"] = "Throttling";
-})(CacheSchemaType || (CacheSchemaType = {}));
 /**
  * Combine all cache types
  */
@@ -589,7 +573,7 @@ var JsonTypes;
     JsonTypes["Pop"] = "pop";
 })(JsonTypes || (JsonTypes = {}));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -645,7 +629,7 @@ var AuthError = /** @class */ (function (_super) {
     return AuthError;
 }(Error));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -720,7 +704,7 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
     }
 };
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1235,7 +1219,7 @@ var ClientAuthError = /** @class */ (function (_super) {
     return ClientAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1360,7 +1344,7 @@ var StringUtils = /** @class */ (function () {
     return StringUtils;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1550,12 +1534,12 @@ var Logger = /** @class */ (function () {
     return Logger;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /* eslint-disable header/header */
 var name$1 = "@azure/msal-common";
-var version$1 = "11.0.0";
+var version$1 = "12.0.0";
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1576,184 +1560,7 @@ exports.AzureCloudInstance = void 0;
     AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
 })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Base type for credentials to be stored in the cache: eg: ACCESS_TOKEN, ID_TOKEN etc
- *
- * Key:Value Schema:
- *
- * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      familyId: Family ID identifier, usually only used for refresh tokens
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
- *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
- *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
- * }
- */
-var CredentialEntity = /** @class */ (function () {
-    function CredentialEntity() {
-    }
-    /**
-     * Initializes a map with credential {CredentialType} regular expressions.
-     */
-    CredentialEntity._initRegex = function () {
-        var separator = Separators.CACHE_KEY_SEPARATOR;
-        CredentialEntity.credentialRegexMap = new Map();
-        for (var _i = 0, _a = Object.keys(CredentialType); _i < _a.length; _i++) {
-            var credKey = _a[_i];
-            var credVal = CredentialType[credKey].toLowerCase();
-            try {
-                // Verify credential type is preceded by a valid host name (environment) using lookbehind
-                CredentialEntity.credentialRegexMap.set(CredentialType[credKey], new RegExp("(?<=" + separator + CredentialEntity.credentialDomainRegex + ")" + separator + credVal + separator));
-            }
-            catch (err) {
-                // Lookbehind is not supported (Safari or older versions of IE) - removing it
-                CredentialEntity.credentialRegexMap.set(CredentialType[credKey], new RegExp("" + separator + CredentialEntity.credentialDomainRegex + separator + credVal + separator));
-            }
-        }
-    };
-    /**
-     * Generate Account Id key component as per the schema: <home_account_id>-<environment>
-     */
-    CredentialEntity.prototype.generateAccountId = function () {
-        return CredentialEntity.generateAccountIdForCacheKey(this.homeAccountId, this.environment);
-    };
-    /**
-     * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
-     */
-    CredentialEntity.prototype.generateCredentialId = function () {
-        return CredentialEntity.generateCredentialIdForCacheKey(this.credentialType, this.clientId, this.realm, this.familyId);
-    };
-    /**
-     * Generate target key component as per schema: <target>
-     */
-    CredentialEntity.prototype.generateTarget = function () {
-        return CredentialEntity.generateTargetForCacheKey(this.target);
-    };
-    /**
-     * generates credential key
-     */
-    CredentialEntity.prototype.generateCredentialKey = function () {
-        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
-    };
-    /**
-     * returns the type of the cache (in this case credential)
-     */
-    CredentialEntity.prototype.generateType = function () {
-        switch (this.credentialType) {
-            case CredentialType.ID_TOKEN:
-                return CacheType.ID_TOKEN;
-            case CredentialType.ACCESS_TOKEN:
-            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                return CacheType.ACCESS_TOKEN;
-            case CredentialType.REFRESH_TOKEN:
-                return CacheType.REFRESH_TOKEN;
-            default: {
-                throw ClientAuthError.createUnexpectedCredentialTypeError();
-            }
-        }
-    };
-    /**
-     * helper function to return `CredentialType`
-     * @param key
-     */
-    CredentialEntity.getCredentialType = function (key) {
-        var _a;
-        for (var _i = 0, _b = Object.keys(CredentialType); _i < _b.length; _i++) {
-            var credKey = _b[_i];
-            if ((_a = this.credentialRegexMap.get(CredentialType[credKey])) === null || _a === void 0 ? void 0 : _a.test(key.toLowerCase())) {
-                return CredentialType[credKey];
-            }
-        }
-        return Constants.NOT_DEFINED;
-    };
-    /**
-     * generates credential key
-     * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
-     */
-    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
-        var credentialKey = [
-            this.generateAccountIdForCacheKey(homeAccountId, environment),
-            this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-            this.generateTargetForCacheKey(target),
-            this.generateClaimsHashForCacheKey(requestedClaimsHash),
-            this.generateSchemeForCacheKey(tokenType)
-        ];
-        return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    };
-    /**
-     * generates Account Id for keys
-     * @param homeAccountId
-     * @param environment
-     */
-    CredentialEntity.generateAccountIdForCacheKey = function (homeAccountId, environment) {
-        var accountId = [homeAccountId, environment];
-        return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    };
-    /**
-     * Generates Credential Id for keys
-     * @param credentialType
-     * @param realm
-     * @param clientId
-     * @param familyId
-     */
-    CredentialEntity.generateCredentialIdForCacheKey = function (credentialType, clientId, realm, familyId) {
-        var clientOrFamilyId = credentialType === CredentialType.REFRESH_TOKEN
-            ? familyId || clientId
-            : clientId;
-        var credentialId = [
-            credentialType,
-            clientOrFamilyId,
-            realm || Constants.EMPTY_STRING,
-        ];
-        return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    };
-    /**
-     * Generate target key component as per schema: <target>
-     */
-    CredentialEntity.generateTargetForCacheKey = function (scopes) {
-        return (scopes || Constants.EMPTY_STRING).toLowerCase();
-    };
-    /**
-     * Generate requested claims key component as per schema: <requestedClaims>
-     */
-    CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
-        return (requestedClaimsHash || Constants.EMPTY_STRING).toLowerCase();
-    };
-    /**
-     * Generate scheme key componenet as per schema: <scheme>
-     */
-    CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
-        /*
-         * PoP Tokens and SSH certs include scheme in cache key
-         * Cast to lowercase to handle "bearer" from ADFS
-         */
-        return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : Constants.EMPTY_STRING;
-    };
-    /*
-     * Match host names like "login.microsoftonline.com", "https://accounts.google.com:4000", https://localhost:5000,
-     * "login.microsoftonline.com/common", "login.microsoftonline.com:4000/common", etc
-     */
-    CredentialEntity.credentialDomainRegex = "(https?:\\/\\/)?((([\\w-]+\\.)*([\\w-]{1,63})(\\.(\\w{2,63})))|(localhost))(\\:[0-9]{4,5})?(\\/[\\w-]+)?";
-    return CredentialEntity;
-}());
-CredentialEntity._initRegex();
-
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2008,7 +1815,7 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     return ClientConfigurationError;
 }(ClientAuthError));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2041,6 +1848,21 @@ var ScopeSet = /** @class */ (function () {
         var inputScopes = scopeString.split(" ");
         return new ScopeSet(inputScopes);
     };
+    /**
+     * Creates the set of scopes to search for in cache lookups
+     * @param inputScopeString
+     * @returns
+     */
+    ScopeSet.createSearchScopes = function (inputScopeString) {
+        var scopeSet = new ScopeSet(inputScopeString);
+        if (!scopeSet.containsOnlyOIDCScopes()) {
+            scopeSet.removeOIDCScopes();
+        }
+        else {
+            scopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
+        }
+        return scopeSet;
+    };
     /**
      * Used to validate the scopes input parameter requested  by the developer.
      * @param {Array<string>} inputScopes - Developer requested permissions. Not all scopes are guaranteed to be included in the access token returned.
@@ -2192,7 +2014,7 @@ var ScopeSet = /** @class */ (function () {
     return ScopeSet;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2230,7 +2052,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2245,7 +2067,7 @@ var AuthorityType;
     AuthorityType[AuthorityType["Dsts"] = 2] = "Dsts";
 })(AuthorityType || (AuthorityType = {}));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2484,7 +2306,7 @@ var AccountEntity = /** @class */ (function () {
     return AccountEntity;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2536,7 +2358,7 @@ var AuthToken = /** @class */ (function () {
     return AuthToken;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2546,35 +2368,59 @@ var AuthToken = /** @class */ (function () {
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
  */
 var CacheManager = /** @class */ (function () {
-    function CacheManager(clientId, cryptoImpl) {
+    function CacheManager(clientId, cryptoImpl, logger) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
+        this.commonLogger = logger.clone(name$1, version$1);
     }
     /**
      * Returns all accounts in cache
      */
     CacheManager.prototype.getAllAccounts = function () {
         var _this = this;
-        var currentAccounts = this.getAccountsFilteredBy();
-        var accountValues = Object.keys(currentAccounts).map(function (accountKey) { return currentAccounts[accountKey]; });
-        var numAccounts = accountValues.length;
-        if (numAccounts < 1) {
+        var allAccountKeys = this.getAccountKeys();
+        if (allAccountKeys.length < 1) {
+            return [];
+        }
+        var accountEntities = allAccountKeys.reduce(function (accounts, key) {
+            var entity = _this.getAccount(key);
+            if (!entity) {
+                return accounts;
+            }
+            accounts.push(entity);
+            return accounts;
+        }, []);
+        if (accountEntities.length < 1) {
             return [];
         }
         else {
-            var allAccounts = accountValues.map(function (value) {
-                var accountEntity = CacheManager.toObject(new AccountEntity(), value);
-                var accountInfo = accountEntity.getAccountInfo();
-                var idToken = _this.readIdTokenFromCache(_this.clientId, accountInfo);
-                if (idToken && !accountInfo.idTokenClaims) {
-                    accountInfo.idToken = idToken.secret;
-                    accountInfo.idTokenClaims = new AuthToken(idToken.secret, _this.cryptoImpl).claims;
-                }
-                return accountInfo;
+            var allAccounts = accountEntities.map(function (accountEntity) {
+                return _this.getAccountInfoFromEntity(accountEntity);
             });
             return allAccounts;
         }
     };
+    /**
+     * Gets accountInfo object based on provided filters
+     */
+    CacheManager.prototype.getAccountInfoFilteredBy = function (accountFilter) {
+        var allAccounts = this.getAccountsFilteredBy(accountFilter);
+        if (allAccounts.length > 0) {
+            return this.getAccountInfoFromEntity(allAccounts[0]);
+        }
+        else {
+            return null;
+        }
+    };
+    CacheManager.prototype.getAccountInfoFromEntity = function (accountEntity) {
+        var accountInfo = accountEntity.getAccountInfo();
+        var idToken = this.getIdToken(accountInfo);
+        if (idToken) {
+            accountInfo.idToken = idToken.secret;
+            accountInfo.idTokenClaims = new AuthToken(idToken.secret, this.cryptoImpl).claims;
+        }
+        return accountInfo;
+    };
     /**
      * saves a cache record
      * @param cacheRecord
@@ -2616,12 +2462,12 @@ var CacheManager = /** @class */ (function () {
      */
     CacheManager.prototype.saveAccessToken = function (credential) {
         return __awaiter(this, void 0, void 0, function () {
-            var currentTokenCache, currentScopes, currentAccessTokens, removedAccessTokens_1;
+            var accessTokenFilter, tokenKeys, currentScopes, removedAccessTokens;
             var _this = this;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        currentTokenCache = this.getCredentialsFilteredBy({
+                        accessTokenFilter = {
                             clientId: credential.clientId,
                             credentialType: credential.credentialType,
                             environment: credential.environment,
@@ -2629,22 +2475,25 @@ var CacheManager = /** @class */ (function () {
                             realm: credential.realm,
                             tokenType: credential.tokenType,
                             requestedClaimsHash: credential.requestedClaimsHash
-                        });
+                        };
+                        tokenKeys = this.getTokenKeys();
                         currentScopes = ScopeSet.fromString(credential.target);
-                        currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
-                        if (!currentAccessTokens) return [3 /*break*/, 2];
-                        removedAccessTokens_1 = [];
-                        currentAccessTokens.forEach(function (tokenEntity) {
-                            var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
-                            if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                                removedAccessTokens_1.push(_this.removeCredential(tokenEntity));
+                        removedAccessTokens = [];
+                        tokenKeys.accessToken.forEach(function (key) {
+                            if (!_this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
+                                return;
+                            }
+                            var tokenEntity = _this.getAccessTokenCredential(key);
+                            if (tokenEntity && _this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
+                                var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                                if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
+                                    removedAccessTokens.push(_this.removeAccessToken(key));
+                                }
                             }
                         });
-                        return [4 /*yield*/, Promise.all(removedAccessTokens_1)];
+                        return [4 /*yield*/, Promise.all(removedAccessTokens)];
                     case 1:
                         _a.sent();
-                        _a.label = 2;
-                    case 2:
                         this.setAccessTokenCredential(credential);
                         return [2 /*return*/];
                 }
@@ -2659,149 +2508,151 @@ var CacheManager = /** @class */ (function () {
      * @param realm
      */
     CacheManager.prototype.getAccountsFilteredBy = function (accountFilter) {
-        return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING, accountFilter ? accountFilter.nativeAccountId : Constants.EMPTY_STRING);
-    };
-    /**
-     * retrieve accounts matching all provided filters; if no filter is set, get all accounts
-     * not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
-     * @param homeAccountId
-     * @param environment
-     * @param realm
-     */
-    CacheManager.prototype.getAccountsFilteredByInternal = function (homeAccountId, environment, realm, nativeAccountId) {
         var _this = this;
-        var allCacheKeys = this.getKeys();
-        var matchingAccounts = {};
-        allCacheKeys.forEach(function (cacheKey) {
+        var allAccountKeys = this.getAccountKeys();
+        var matchingAccounts = [];
+        allAccountKeys.forEach(function (cacheKey) {
+            if (!_this.isAccountKey(cacheKey, accountFilter.homeAccountId, accountFilter.realm)) {
+                // Don't parse value if the key doesn't match the account filters
+                return;
+            }
             var entity = _this.getAccount(cacheKey);
             if (!entity) {
                 return;
             }
-            if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
+            if (!!accountFilter.homeAccountId && !_this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                 return;
             }
-            if (!!environment && !_this.matchEnvironment(entity, environment)) {
+            if (!!accountFilter.localAccountId && !_this.matchLocalAccountId(entity, accountFilter.localAccountId)) {
+                return;
+            }
+            if (!!accountFilter.username && !_this.matchUsername(entity, accountFilter.username)) {
+                return;
+            }
+            if (!!accountFilter.environment && !_this.matchEnvironment(entity, accountFilter.environment)) {
                 return;
             }
-            if (!!realm && !_this.matchRealm(entity, realm)) {
+            if (!!accountFilter.realm && !_this.matchRealm(entity, accountFilter.realm)) {
                 return;
             }
-            if (!!nativeAccountId && !_this.matchNativeAccountId(entity, nativeAccountId)) {
+            if (!!accountFilter.nativeAccountId && !_this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
                 return;
             }
-            matchingAccounts[cacheKey] = entity;
+            matchingAccounts.push(entity);
         });
         return matchingAccounts;
     };
     /**
-     * retrieve credentails matching all provided filters; if no filter is set, get all credentials
+     * Returns true if the given key matches our account key schema. Also matches homeAccountId and/or tenantId if provided
+     * @param key
      * @param homeAccountId
-     * @param environment
-     * @param credentialType
-     * @param clientId
-     * @param realm
-     * @param target
+     * @param tenantId
+     * @returns
      */
-    CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.userAssertionHash, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
+    CacheManager.prototype.isAccountKey = function (key, homeAccountId, tenantId) {
+        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 3) {
+            // Account cache keys contain 3 items separated by '-' (each item may also contain '-')
+            return false;
+        }
+        if (homeAccountId && !key.toLowerCase().includes(homeAccountId.toLowerCase())) {
+            return false;
+        }
+        if (tenantId && !key.toLowerCase().includes(tenantId.toLowerCase())) {
+            return false;
+        }
+        // Do not check environment as aliasing can cause false negatives
+        return true;
     };
     /**
-     * Support function to help match credentials
-     * @param homeAccountId
-     * @param environment
-     * @param credentialType
-     * @param clientId
-     * @param realm
-     * @param target
-     * @param userAssertionHash
-     * @param tokenType
+     * Returns true if the given key matches our credential key schema.
+     * @param key
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, userAssertionHash, tokenType, keyId, requestedClaimsHash) {
-        var _this = this;
-        var allCacheKeys = this.getKeys();
-        var matchingCredentials = {
-            idTokens: {},
-            accessTokens: {},
-            refreshTokens: {},
-        };
-        allCacheKeys.forEach(function (cacheKey) {
-            // don't parse any non-credential type cache entities
-            var credType = CredentialEntity.getCredentialType(cacheKey);
-            if (credType === Constants.NOT_DEFINED) {
-                return;
-            }
-            // Attempt retrieval
-            var entity = _this.getSpecificCredential(cacheKey, credType);
-            if (!entity) {
-                return;
-            }
-            if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
-                return;
-            }
-            /*
-             * homeAccountId can undefined, and we want to filter out cached items that have a homeAccountId of ""
-             * because we don't want a client_credential request to return a cached token that has a homeAccountId
-             */
-            if ((typeof homeAccountId === "string") && !_this.matchHomeAccountId(entity, homeAccountId)) {
-                return;
-            }
-            if (!!environment && !_this.matchEnvironment(entity, environment)) {
-                return;
-            }
-            if (!!realm && !_this.matchRealm(entity, realm)) {
-                return;
-            }
-            if (!!credentialType && !_this.matchCredentialType(entity, credentialType)) {
-                return;
-            }
-            if (!!clientId && !_this.matchClientId(entity, clientId)) {
-                return;
+    CacheManager.prototype.isCredentialKey = function (key) {
+        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 6) {
+            // Credential cache keys contain 6 items separated by '-' (each item may also contain '-')
+            return false;
+        }
+        var lowerCaseKey = key.toLowerCase();
+        // Credential keys must indicate what credential type they represent
+        if (lowerCaseKey.indexOf(CredentialType.ID_TOKEN.toLowerCase()) === -1 &&
+            lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN.toLowerCase()) === -1 &&
+            lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) === -1 &&
+            lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) === -1) {
+            return false;
+        }
+        if (lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) > -1) {
+            // Refresh tokens must contain the client id or family id
+            var clientIdValidation = "" + CredentialType.REFRESH_TOKEN + Separators.CACHE_KEY_SEPARATOR + this.clientId + Separators.CACHE_KEY_SEPARATOR;
+            var familyIdValidation = "" + CredentialType.REFRESH_TOKEN + Separators.CACHE_KEY_SEPARATOR + THE_FAMILY_ID + Separators.CACHE_KEY_SEPARATOR;
+            if (lowerCaseKey.indexOf(clientIdValidation.toLowerCase()) === -1 && lowerCaseKey.indexOf(familyIdValidation.toLowerCase()) === -1) {
+                return false;
             }
-            if (!!familyId && !_this.matchFamilyId(entity, familyId)) {
-                return;
-            }
-            /*
-             * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
-             * Resource specific refresh tokens case will be added when the support is deemed necessary
-             */
-            if (!!target && !_this.matchTarget(entity, target)) {
-                return;
+        }
+        else if (lowerCaseKey.indexOf(this.clientId.toLowerCase()) === -1) {
+            // Tokens must contain the clientId
+            return false;
+        }
+        return true;
+    };
+    /**
+     * Returns whether or not the given credential entity matches the filter
+     * @param entity
+     * @param filter
+     * @returns
+     */
+    CacheManager.prototype.credentialMatchesFilter = function (entity, filter) {
+        if (!!filter.clientId && !this.matchClientId(entity, filter.clientId)) {
+            return false;
+        }
+        if (!!filter.userAssertionHash && !this.matchUserAssertionHash(entity, filter.userAssertionHash)) {
+            return false;
+        }
+        /*
+         * homeAccountId can be undefined, and we want to filter out cached items that have a homeAccountId of ""
+         * because we don't want a client_credential request to return a cached token that has a homeAccountId
+         */
+        if ((typeof filter.homeAccountId === "string") && !this.matchHomeAccountId(entity, filter.homeAccountId)) {
+            return false;
+        }
+        if (!!filter.environment && !this.matchEnvironment(entity, filter.environment)) {
+            return false;
+        }
+        if (!!filter.realm && !this.matchRealm(entity, filter.realm)) {
+            return false;
+        }
+        if (!!filter.credentialType && !this.matchCredentialType(entity, filter.credentialType)) {
+            return false;
+        }
+        if (!!filter.familyId && !this.matchFamilyId(entity, filter.familyId)) {
+            return false;
+        }
+        /*
+         * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
+         * Resource specific refresh tokens case will be added when the support is deemed necessary
+         */
+        if (!!filter.target && !this.matchTarget(entity, filter.target)) {
+            return false;
+        }
+        // If request OR cached entity has requested Claims Hash, check if they match
+        if (filter.requestedClaimsHash || entity.requestedClaimsHash) {
+            // Don't match if either is undefined or they are different
+            if (entity.requestedClaimsHash !== filter.requestedClaimsHash) {
+                return false;
             }
-            // If request OR cached entity has requested Claims Hash, check if they match
-            if (requestedClaimsHash || entity.requestedClaimsHash) {
-                // Don't match if either is undefined or they are different
-                if (entity.requestedClaimsHash !== requestedClaimsHash) {
-                    return;
-                }
+        }
+        // Access Token with Auth Scheme specific matching
+        if (entity.credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
+            if (!!filter.tokenType && !this.matchTokenType(entity, filter.tokenType)) {
+                return false;
             }
-            // Access Token with Auth Scheme specific matching
-            if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
-                if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
-                    return;
-                }
-                // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-                if (tokenType === exports.AuthenticationScheme.SSH) {
-                    if (keyId && !_this.matchKeyId(entity, keyId)) {
-                        return;
-                    }
+            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+            if (filter.tokenType === exports.AuthenticationScheme.SSH) {
+                if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
+                    return false;
                 }
             }
-            // At this point, the entity matches the request, update cache key if key schema has changed
-            var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
-            switch (credType) {
-                case CredentialType.ID_TOKEN:
-                    matchingCredentials.idTokens[updatedCacheKey] = entity;
-                    break;
-                case CredentialType.ACCESS_TOKEN:
-                case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                    matchingCredentials.accessTokens[updatedCacheKey] = entity;
-                    break;
-                case CredentialType.REFRESH_TOKEN:
-                    matchingCredentials.refreshTokens[updatedCacheKey] = entity;
-                    break;
-            }
-        });
-        return matchingCredentials;
+        }
+        return true;
     };
     /**
      * retrieve appMetadata matching all provided filters; if no filter is set, get all appMetadata
@@ -2869,30 +2720,26 @@ var CacheManager = /** @class */ (function () {
      */
     CacheManager.prototype.removeAllAccounts = function () {
         return __awaiter(this, void 0, void 0, function () {
-            var allCacheKeys, removedAccounts;
+            var allAccountKeys, removedAccounts;
             var _this = this;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        allCacheKeys = this.getKeys();
+                        allAccountKeys = this.getAccountKeys();
                         removedAccounts = [];
-                        allCacheKeys.forEach(function (cacheKey) {
-                            var entity = _this.getAccount(cacheKey);
-                            if (!entity) {
-                                return;
-                            }
+                        allAccountKeys.forEach(function (cacheKey) {
                             removedAccounts.push(_this.removeAccount(cacheKey));
                         });
                         return [4 /*yield*/, Promise.all(removedAccounts)];
                     case 1:
                         _a.sent();
-                        return [2 /*return*/, true];
+                        return [2 /*return*/];
                 }
             });
         });
     };
     /**
-     * returns a boolean if the given account is removed
+     * Removes the account and related tokens for a given account key
      * @param account
      */
     CacheManager.prototype.removeAccount = function (accountKey) {
@@ -2906,7 +2753,10 @@ var CacheManager = /** @class */ (function () {
                             throw ClientAuthError.createNoAccountFoundError();
                         }
                         return [4 /*yield*/, this.removeAccountContext(account)];
-                    case 1: return [2 /*return*/, ((_a.sent()) && this.removeItem(accountKey, CacheSchemaType.ACCOUNT))];
+                    case 1:
+                        _a.sent();
+                        this.removeItem(accountKey);
+                        return [2 /*return*/];
                 }
             });
         });
@@ -2917,29 +2767,33 @@ var CacheManager = /** @class */ (function () {
      */
     CacheManager.prototype.removeAccountContext = function (account) {
         return __awaiter(this, void 0, void 0, function () {
-            var allCacheKeys, accountId, removedCredentials;
+            var allTokenKeys, accountId, removedCredentials;
             var _this = this;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        allCacheKeys = this.getKeys();
+                        allTokenKeys = this.getTokenKeys();
                         accountId = account.generateAccountId();
                         removedCredentials = [];
-                        allCacheKeys.forEach(function (cacheKey) {
-                            // don't parse any non-credential type cache entities
-                            var credType = CredentialEntity.getCredentialType(cacheKey);
-                            if (credType === Constants.NOT_DEFINED) {
-                                return;
+                        allTokenKeys.idToken.forEach(function (key) {
+                            if (key.indexOf(accountId) === 0) {
+                                _this.removeIdToken(key);
                             }
-                            var cacheEntity = _this.getSpecificCredential(cacheKey, credType);
-                            if (!!cacheEntity && accountId === cacheEntity.generateAccountId()) {
-                                removedCredentials.push(_this.removeCredential(cacheEntity));
+                        });
+                        allTokenKeys.accessToken.forEach(function (key) {
+                            if (key.indexOf(accountId) === 0) {
+                                removedCredentials.push(_this.removeAccessToken(key));
+                            }
+                        });
+                        allTokenKeys.refreshToken.forEach(function (key) {
+                            if (key.indexOf(accountId) === 0) {
+                                _this.removeRefreshToken(key);
                             }
                         });
                         return [4 /*yield*/, Promise.all(removedCredentials)];
                     case 1:
                         _a.sent();
-                        return [2 /*return*/, true];
+                        return [2 /*return*/];
                 }
             });
         });
@@ -2948,13 +2802,16 @@ var CacheManager = /** @class */ (function () {
      * returns a boolean if the given credential is removed
      * @param credential
      */
-    CacheManager.prototype.removeCredential = function (credential) {
+    CacheManager.prototype.removeAccessToken = function (key) {
         return __awaiter(this, void 0, void 0, function () {
-            var key, accessTokenWithAuthSchemeEntity, kid;
+            var credential, accessTokenWithAuthSchemeEntity, kid;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        key = credential.generateCredentialKey();
+                        credential = this.getAccessTokenCredential(key);
+                        if (!credential) {
+                            return [2 /*return*/];
+                        }
                         if (!(credential.credentialType.toLowerCase() === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())) return [3 /*break*/, 4];
                         if (!(credential.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 4];
                         accessTokenWithAuthSchemeEntity = credential;
@@ -2970,7 +2827,7 @@ var CacheManager = /** @class */ (function () {
                     case 3:
                         _a.sent();
                         throw ClientAuthError.createBindingKeyNotRemovedError();
-                    case 4: return [2 /*return*/, this.removeItem(key, CacheSchemaType.CREDENTIAL)];
+                    case 4: return [2 /*return*/, this.removeItem(key)];
                 }
             });
         });
@@ -2983,7 +2840,7 @@ var CacheManager = /** @class */ (function () {
         var allCacheKeys = this.getKeys();
         allCacheKeys.forEach(function (cacheKey) {
             if (_this.isAppMetadata(cacheKey)) {
-                _this.removeItem(cacheKey, CacheSchemaType.APP_METADATA);
+                _this.removeItem(cacheKey);
             }
         });
         return true;
@@ -2996,12 +2853,13 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param authScheme
      */
-    CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
+    CacheManager.prototype.readCacheRecord = function (account, request, environment) {
+        var tokenKeys = this.getTokenKeys();
         var cachedAccount = this.readAccountFromCache(account);
-        var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
-        var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
-        var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
+        var cachedIdToken = this.getIdToken(account, tokenKeys);
+        var cachedAccessToken = this.getAccessToken(account, request, tokenKeys);
+        var cachedRefreshToken = this.getRefreshToken(account, false, tokenKeys);
+        var cachedAppMetadata = this.readAppMetadataFromCache(environment);
         if (cachedAccount && cachedIdToken) {
             cachedAccount.idTokenClaims = new AuthToken(cachedIdToken.secret, this.cryptoImpl).claims;
         }
@@ -3021,51 +2879,83 @@ var CacheManager = /** @class */ (function () {
         var accountKey = AccountEntity.generateAccountCacheKey(account);
         return this.getAccount(accountKey);
     };
-    /**
-     * Retrieve AccountEntity from cache
-     * @param nativeAccountId
-     * @returns AccountEntity or Null
-     */
-    CacheManager.prototype.readAccountFromCacheWithNativeAccountId = function (nativeAccountId) {
-        // fetch account from memory
-        var accountFilter = {
-            nativeAccountId: nativeAccountId
-        };
-        var accountCache = this.getAccountsFilteredBy(accountFilter);
-        var accounts = Object.keys(accountCache).map(function (key) { return accountCache[key]; });
-        if (accounts.length < 1) {
-            return null;
-        }
-        else if (accounts.length > 1) {
-            throw ClientAuthError.createMultipleMatchingAccountsInCacheError();
-        }
-        return accounts[0];
-    };
     /**
      * Retrieve IdTokenEntity from cache
      * @param clientId
      * @param account
      * @param inputRealm
      */
-    CacheManager.prototype.readIdTokenFromCache = function (clientId, account) {
+    CacheManager.prototype.getIdToken = function (account, tokenKeys) {
+        this.commonLogger.trace("CacheManager - getIdToken called");
         var idTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
             credentialType: CredentialType.ID_TOKEN,
-            clientId: clientId,
+            clientId: this.clientId,
             realm: account.tenantId,
         };
-        var credentialCache = this.getCredentialsFilteredBy(idTokenFilter);
-        var idTokens = Object.keys(credentialCache.idTokens).map(function (key) { return credentialCache.idTokens[key]; });
+        var idTokens = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
         var numIdTokens = idTokens.length;
         if (numIdTokens < 1) {
+            this.commonLogger.info("CacheManager:getIdToken - No token found");
             return null;
         }
         else if (numIdTokens > 1) {
             throw ClientAuthError.createMultipleMatchingTokensInCacheError();
         }
+        this.commonLogger.info("CacheManager:getIdToken - Returning id token");
         return idTokens[0];
     };
+    /**
+     * Gets all idTokens matching the given filter
+     * @param filter
+     * @returns
+     */
+    CacheManager.prototype.getIdTokensByFilter = function (filter, tokenKeys) {
+        var _this = this;
+        var idTokenKeys = tokenKeys && tokenKeys.idToken || this.getTokenKeys().idToken;
+        var idTokens = [];
+        idTokenKeys.forEach(function (key) {
+            if (!_this.idTokenKeyMatchesFilter(key, __assign({ clientId: _this.clientId }, filter))) {
+                return;
+            }
+            var idToken = _this.getIdTokenCredential(key);
+            if (idToken && _this.credentialMatchesFilter(idToken, filter)) {
+                idTokens.push(idToken);
+            }
+        });
+        return idTokens;
+    };
+    /**
+     * Validate the cache key against filter before retrieving and parsing cache value
+     * @param key
+     * @param filter
+     * @returns
+     */
+    CacheManager.prototype.idTokenKeyMatchesFilter = function (inputKey, filter) {
+        var key = inputKey.toLowerCase();
+        if (filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
+            return false;
+        }
+        return true;
+    };
+    /**
+     * Removes idToken from the cache
+     * @param key
+     */
+    CacheManager.prototype.removeIdToken = function (key) {
+        this.removeItem(key);
+    };
+    /**
+     * Removes refresh token from the cache
+     * @param key
+     */
+    CacheManager.prototype.removeRefreshToken = function (key) {
+        this.removeItem(key);
+    };
     /**
      * Retrieve AccessTokenEntity from cache
      * @param clientId
@@ -3073,8 +2963,10 @@ var CacheManager = /** @class */ (function () {
      * @param scopes
      * @param authScheme
      */
-    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
-        var scopes = new ScopeSet(request.scopes || []);
+    CacheManager.prototype.getAccessToken = function (account, request, tokenKeys) {
+        var _this = this;
+        this.commonLogger.trace("CacheManager - getAccessToken called");
+        var scopes = ScopeSet.createSearchScopes(request.scopes);
         var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
         /*
          * Distinguish between Bearer and PoP/SSH token cache types
@@ -3085,55 +2977,156 @@ var CacheManager = /** @class */ (function () {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
             credentialType: credentialType,
-            clientId: clientId,
+            clientId: this.clientId,
             realm: account.tenantId,
-            target: scopes.printScopesLowerCase(),
+            target: scopes,
             tokenType: authScheme,
             keyId: request.sshKid,
             requestedClaimsHash: request.requestedClaimsHash,
         };
-        var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
-        var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
+        var accessTokenKeys = tokenKeys && tokenKeys.accessToken || this.getTokenKeys().accessToken;
+        var accessTokens = [];
+        accessTokenKeys.forEach(function (key) {
+            // Validate key
+            if (_this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
+                var accessToken = _this.getAccessTokenCredential(key);
+                // Validate value
+                if (accessToken && _this.credentialMatchesFilter(accessToken, accessTokenFilter)) {
+                    accessTokens.push(accessToken);
+                }
+            }
+        });
         var numAccessTokens = accessTokens.length;
         if (numAccessTokens < 1) {
+            this.commonLogger.info("CacheManager:getAccessToken - No token found");
             return null;
         }
         else if (numAccessTokens > 1) {
             throw ClientAuthError.createMultipleMatchingTokensInCacheError();
         }
+        this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
         return accessTokens[0];
     };
+    /**
+     * Validate the cache key against filter before retrieving and parsing cache value
+     * @param key
+     * @param filter
+     * @param keyMustContainAllScopes
+     * @returns
+     */
+    CacheManager.prototype.accessTokenKeyMatchesFilter = function (inputKey, filter, keyMustContainAllScopes) {
+        var key = inputKey.toLowerCase();
+        if (filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.realm && key.indexOf(filter.realm.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.requestedClaimsHash && key.indexOf(filter.requestedClaimsHash.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.target) {
+            var scopes = filter.target.asArray();
+            for (var i = 0; i < scopes.length; i++) {
+                if (keyMustContainAllScopes && !key.includes(scopes[i].toLowerCase())) {
+                    // When performing a cache lookup a missing scope would be a cache miss
+                    return false;
+                }
+                else if (!keyMustContainAllScopes && key.includes(scopes[i].toLowerCase())) {
+                    // When performing a cache write, any token with a subset of requested scopes should be replaced
+                    return true;
+                }
+            }
+        }
+        return true;
+    };
+    /**
+     * Gets all access tokens matching the filter
+     * @param filter
+     * @returns
+     */
+    CacheManager.prototype.getAccessTokensByFilter = function (filter) {
+        var _this = this;
+        var tokenKeys = this.getTokenKeys();
+        var accessTokens = [];
+        tokenKeys.accessToken.forEach(function (key) {
+            if (!_this.accessTokenKeyMatchesFilter(key, filter, true)) {
+                return;
+            }
+            var accessToken = _this.getAccessTokenCredential(key);
+            if (accessToken && _this.credentialMatchesFilter(accessToken, filter)) {
+                accessTokens.push(accessToken);
+            }
+        });
+        return accessTokens;
+    };
     /**
      * Helper to retrieve the appropriate refresh token from cache
      * @param clientId
      * @param account
      * @param familyRT
      */
-    CacheManager.prototype.readRefreshTokenFromCache = function (clientId, account, familyRT) {
+    CacheManager.prototype.getRefreshToken = function (account, familyRT, tokenKeys) {
+        var _this = this;
+        this.commonLogger.trace("CacheManager - getRefreshToken called");
         var id = familyRT ? THE_FAMILY_ID : undefined;
         var refreshTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
             credentialType: CredentialType.REFRESH_TOKEN,
-            clientId: clientId,
+            clientId: this.clientId,
             familyId: id,
         };
-        var credentialCache = this.getCredentialsFilteredBy(refreshTokenFilter);
-        var refreshTokens = Object.keys(credentialCache.refreshTokens).map(function (key) { return credentialCache.refreshTokens[key]; });
+        var refreshTokenKeys = tokenKeys && tokenKeys.refreshToken || this.getTokenKeys().refreshToken;
+        var refreshTokens = [];
+        refreshTokenKeys.forEach(function (key) {
+            // Validate key
+            if (_this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
+                var refreshToken = _this.getRefreshTokenCredential(key);
+                // Validate value
+                if (refreshToken && _this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {
+                    refreshTokens.push(refreshToken);
+                }
+            }
+        });
         var numRefreshTokens = refreshTokens.length;
         if (numRefreshTokens < 1) {
+            this.commonLogger.info("CacheManager:getRefreshToken - No refresh token found.");
             return null;
         }
         // address the else case after remove functions address environment aliases
+        this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token");
         return refreshTokens[0];
     };
+    /**
+     * Validate the cache key against filter before retrieving and parsing cache value
+     * @param key
+     * @param filter
+     */
+    CacheManager.prototype.refreshTokenKeyMatchesFilter = function (inputKey, filter) {
+        var key = inputKey.toLowerCase();
+        if (filter.familyId && key.indexOf(filter.familyId.toLowerCase()) === -1) {
+            return false;
+        }
+        // If familyId is used, clientId is not in the key
+        if (!filter.familyId && filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) {
+            return false;
+        }
+        if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
+            return false;
+        }
+        return true;
+    };
     /**
      * Retrieve AppMetadataEntity from cache
      */
-    CacheManager.prototype.readAppMetadataFromCache = function (environment, clientId) {
+    CacheManager.prototype.readAppMetadataFromCache = function (environment) {
         var appMetadataFilter = {
             environment: environment,
-            clientId: clientId,
+            clientId: this.clientId,
         };
         var appMetadata = this.getAppMetadataFilteredBy(appMetadataFilter);
         var appMetadataEntries = Object.keys(appMetadata).map(function (key) { return appMetadata[key]; });
@@ -3151,8 +3144,8 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param clientId
      */
-    CacheManager.prototype.isAppMetadataFOCI = function (environment, clientId) {
-        var appMetadata = this.readAppMetadataFromCache(environment, clientId);
+    CacheManager.prototype.isAppMetadataFOCI = function (environment) {
+        var appMetadata = this.readAppMetadataFromCache(environment);
         return !!(appMetadata && appMetadata.familyId === THE_FAMILY_ID);
     };
     /**
@@ -3163,6 +3156,24 @@ var CacheManager = /** @class */ (function () {
     CacheManager.prototype.matchHomeAccountId = function (entity, homeAccountId) {
         return !!((typeof entity.homeAccountId === "string") && (homeAccountId === entity.homeAccountId));
     };
+    /**
+     * helper to match account ids
+     * @param entity
+     * @param localAccountId
+     * @returns
+     */
+    CacheManager.prototype.matchLocalAccountId = function (entity, localAccountId) {
+        return !!((typeof entity.localAccountId === "string") && (localAccountId === entity.localAccountId));
+    };
+    /**
+     * helper to match usernames
+     * @param entity
+     * @param username
+     * @returns
+     */
+    CacheManager.prototype.matchUsername = function (entity, username) {
+        return !!((typeof entity.username === "string") && (username.toLowerCase() === entity.username.toLowerCase()));
+    };
     /**
      * helper to match assertion
      * @param value
@@ -3235,14 +3246,7 @@ var CacheManager = /** @class */ (function () {
             return false;
         }
         var entityScopeSet = ScopeSet.fromString(entity.target);
-        var requestTargetScopeSet = ScopeSet.fromString(target);
-        if (!requestTargetScopeSet.containsOnlyOIDCScopes()) {
-            requestTargetScopeSet.removeOIDCScopes(); // ignore OIDC scopes
-        }
-        else {
-            requestTargetScopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
-        }
-        return entityScopeSet.containsScopeSet(requestTargetScopeSet);
+        return entityScopeSet.containsScopeSet(target);
     };
     /**
      * Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise
@@ -3280,27 +3284,6 @@ var CacheManager = /** @class */ (function () {
     CacheManager.prototype.generateAuthorityMetadataCacheKey = function (authority) {
         return AUTHORITY_METADATA_CONSTANTS.CACHE_KEY + "-" + this.clientId + "-" + authority;
     };
-    /**
-     * Returns the specific credential (IdToken/AccessToken/RefreshToken) from the cache
-     * @param key
-     * @param credType
-     */
-    CacheManager.prototype.getSpecificCredential = function (key, credType) {
-        switch (credType) {
-            case CredentialType.ID_TOKEN: {
-                return this.getIdTokenCredential(key);
-            }
-            case CredentialType.ACCESS_TOKEN:
-            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME: {
-                return this.getAccessTokenCredential(key);
-            }
-            case CredentialType.REFRESH_TOKEN: {
-                return this.getRefreshTokenCredential(key);
-            }
-            default:
-                return null;
-        }
-    };
     /**
      * Helper to convert serialized data to object
      * @param obj
@@ -3399,6 +3382,14 @@ var DefaultStorageClass = /** @class */ (function (_super) {
         var notImplErr = "Storage interface - getKeys() has not been implemented for the cacheStorage interface.";
         throw AuthError.createUnexpectedError(notImplErr);
     };
+    DefaultStorageClass.prototype.getAccountKeys = function () {
+        var notImplErr = "Storage interface - getAccountKeys() has not been implemented for the cacheStorage interface.";
+        throw AuthError.createUnexpectedError(notImplErr);
+    };
+    DefaultStorageClass.prototype.getTokenKeys = function () {
+        var notImplErr = "Storage interface - getTokenKeys() has not been implemented for the cacheStorage interface.";
+        throw AuthError.createUnexpectedError(notImplErr);
+    };
     DefaultStorageClass.prototype.clear = function () {
         return __awaiter(this, void 0, void 0, function () {
             var notImplErr;
@@ -3415,7 +3406,7 @@ var DefaultStorageClass = /** @class */ (function (_super) {
     return DefaultStorageClass;
 }(CacheManager));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3489,7 +3480,7 @@ function buildClientConfiguration(_a) {
         authOptions: buildAuthOptions(userAuthOptions),
         systemOptions: __assign(__assign({}, DEFAULT_SYSTEM_OPTIONS), userSystemOptions),
         loggerOptions: loggerOptions,
-        storageInterface: storageImplementation || new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION),
+        storageInterface: storageImplementation || new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),
         networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
@@ -3508,7 +3499,7 @@ function buildAuthOptions(authOptions) {
     return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS, skipAuthorityMetadataCache: false }, authOptions);
 }
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3528,7 +3519,7 @@ var ServerError = /** @class */ (function (_super) {
     return ServerError;
 }(AuthError));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3555,7 +3546,7 @@ var ThrottlingUtils = /** @class */ (function () {
         var value = cacheManager.getThrottlingCache(key);
         if (value) {
             if (value.throttleTime < Date.now()) {
-                cacheManager.removeItem(key, CacheSchemaType.THROTTLING);
+                cacheManager.removeItem(key);
                 return;
             }
             throw new ServerError(((_a = value.errorCodes) === null || _a === void 0 ? void 0 : _a.join(" ")) || Constants.EMPTY_STRING, value.errorMessage, value.subError);
@@ -3619,12 +3610,12 @@ var ThrottlingUtils = /** @class */ (function () {
             sshKid: request.sshKid
         };
         var key = this.generateThrottlingStorageKey(thumbprint);
-        return cacheManager.removeItem(key, CacheSchemaType.THROTTLING);
+        cacheManager.removeItem(key);
     };
     return ThrottlingUtils;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3673,7 +3664,7 @@ var NetworkManager = /** @class */ (function () {
     return NetworkManager;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3684,7 +3675,7 @@ var CcsCredentialType;
     CcsCredentialType["UPN"] = "UPN";
 })(CcsCredentialType || (CcsCredentialType = {}));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3775,7 +3766,7 @@ var RequestValidator = /** @class */ (function () {
     return RequestValidator;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4153,7 +4144,7 @@ var RequestParameterBuilder = /** @class */ (function () {
     return RequestParameterBuilder;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4205,57 +4196,195 @@ var BaseClient = /** @class */ (function () {
                     break;
             }
         }
-        return headers;
+        return headers;
+    };
+    /**
+     * Http post to token endpoint
+     * @param tokenEndpoint
+     * @param queryString
+     * @param headers
+     * @param thumbprint
+     */
+    BaseClient.prototype.executePostToTokenEndpoint = function (tokenEndpoint, queryString, headers, thumbprint) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers })];
+                    case 1:
+                        response = _a.sent();
+                        if (this.config.serverTelemetryManager && response.status < 500 && response.status !== 429) {
+                            // Telemetry data successfully logged by server, clear Telemetry cache
+                            this.config.serverTelemetryManager.clearTelemetryCache();
+                        }
+                        return [2 /*return*/, response];
+                }
+            });
+        });
+    };
+    /**
+     * Updates the authority object of the client. Endpoint discovery must be completed.
+     * @param updatedAuthority
+     */
+    BaseClient.prototype.updateAuthority = function (updatedAuthority) {
+        if (!updatedAuthority.discoveryComplete()) {
+            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Updated authority has not completed endpoint discovery.");
+        }
+        this.authority = updatedAuthority;
+    };
+    /**
+     * Creates query string for the /token request
+     * @param request
+     */
+    BaseClient.prototype.createTokenQueryParameters = function (request) {
+        var parameterBuilder = new RequestParameterBuilder();
+        if (request.tokenQueryParameters) {
+            parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);
+        }
+        return parameterBuilder.createQueryString();
+    };
+    return BaseClient;
+}());
+
+/*! @azure/msal-common v12.0.0 2023-04-03 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Base type for credentials to be stored in the cache: eg: ACCESS_TOKEN, ID_TOKEN etc
+ *
+ * Key:Value Schema:
+ *
+ * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
+ *
+ * Value Schema:
+ * {
+ *      homeAccountId: home account identifier for the auth scheme,
+ *      environment: entity that issued the token, represented as a full host
+ *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
+ *      clientId: client ID of the application
+ *      secret: Actual credential as a string
+ *      familyId: Family ID identifier, usually only used for refresh tokens
+ *      realm: Full tenant or organizational identifier that the account belongs to
+ *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
+ *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+ *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
+ *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
+ * }
+ */
+var CredentialEntity = /** @class */ (function () {
+    function CredentialEntity() {
+    }
+    /**
+     * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+     */
+    CredentialEntity.prototype.generateAccountId = function () {
+        return CredentialEntity.generateAccountIdForCacheKey(this.homeAccountId, this.environment);
+    };
+    /**
+     * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
+     */
+    CredentialEntity.prototype.generateCredentialId = function () {
+        return CredentialEntity.generateCredentialIdForCacheKey(this.credentialType, this.clientId, this.realm, this.familyId);
+    };
+    /**
+     * Generate target key component as per schema: <target>
+     */
+    CredentialEntity.prototype.generateTarget = function () {
+        return CredentialEntity.generateTargetForCacheKey(this.target);
+    };
+    /**
+     * generates credential key
+     */
+    CredentialEntity.prototype.generateCredentialKey = function () {
+        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
+    };
+    /**
+     * returns the type of the cache (in this case credential)
+     */
+    CredentialEntity.prototype.generateType = function () {
+        switch (this.credentialType) {
+            case CredentialType.ID_TOKEN:
+                return CacheType.ID_TOKEN;
+            case CredentialType.ACCESS_TOKEN:
+            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
+                return CacheType.ACCESS_TOKEN;
+            case CredentialType.REFRESH_TOKEN:
+                return CacheType.REFRESH_TOKEN;
+            default: {
+                throw ClientAuthError.createUnexpectedCredentialTypeError();
+            }
+        }
     };
     /**
-     * Http post to token endpoint
-     * @param tokenEndpoint
-     * @param queryString
-     * @param headers
-     * @param thumbprint
+     * generates credential key
+     * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
      */
-    BaseClient.prototype.executePostToTokenEndpoint = function (tokenEndpoint, queryString, headers, thumbprint) {
-        return __awaiter(this, void 0, void 0, function () {
-            var response;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers })];
-                    case 1:
-                        response = _a.sent();
-                        if (this.config.serverTelemetryManager && response.status < 500 && response.status !== 429) {
-                            // Telemetry data successfully logged by server, clear Telemetry cache
-                            this.config.serverTelemetryManager.clearTelemetryCache();
-                        }
-                        return [2 /*return*/, response];
-                }
-            });
-        });
+    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
+        var credentialKey = [
+            this.generateAccountIdForCacheKey(homeAccountId, environment),
+            this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
+            this.generateTargetForCacheKey(target),
+            this.generateClaimsHashForCacheKey(requestedClaimsHash),
+            this.generateSchemeForCacheKey(tokenType)
+        ];
+        return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
     /**
-     * Updates the authority object of the client. Endpoint discovery must be completed.
-     * @param updatedAuthority
+     * generates Account Id for keys
+     * @param homeAccountId
+     * @param environment
      */
-    BaseClient.prototype.updateAuthority = function (updatedAuthority) {
-        if (!updatedAuthority.discoveryComplete()) {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Updated authority has not completed endpoint discovery.");
-        }
-        this.authority = updatedAuthority;
+    CredentialEntity.generateAccountIdForCacheKey = function (homeAccountId, environment) {
+        var accountId = [homeAccountId, environment];
+        return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
     /**
-     * Creates query string for the /token request
-     * @param request
+     * Generates Credential Id for keys
+     * @param credentialType
+     * @param realm
+     * @param clientId
+     * @param familyId
      */
-    BaseClient.prototype.createTokenQueryParameters = function (request) {
-        var parameterBuilder = new RequestParameterBuilder();
-        if (request.tokenQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);
-        }
-        return parameterBuilder.createQueryString();
+    CredentialEntity.generateCredentialIdForCacheKey = function (credentialType, clientId, realm, familyId) {
+        var clientOrFamilyId = credentialType === CredentialType.REFRESH_TOKEN
+            ? familyId || clientId
+            : clientId;
+        var credentialId = [
+            credentialType,
+            clientOrFamilyId,
+            realm || Constants.EMPTY_STRING,
+        ];
+        return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
-    return BaseClient;
+    /**
+     * Generate target key component as per schema: <target>
+     */
+    CredentialEntity.generateTargetForCacheKey = function (scopes) {
+        return (scopes || Constants.EMPTY_STRING).toLowerCase();
+    };
+    /**
+     * Generate requested claims key component as per schema: <requestedClaims>
+     */
+    CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
+        return (requestedClaimsHash || Constants.EMPTY_STRING).toLowerCase();
+    };
+    /**
+     * Generate scheme key componenet as per schema: <scheme>
+     */
+    CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
+        /*
+         * PoP Tokens and SSH certs include scheme in cache key
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : Constants.EMPTY_STRING;
+    };
+    return CredentialEntity;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4319,7 +4448,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
     return IdTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4369,7 +4498,7 @@ var TimeUtils = /** @class */ (function () {
     return TimeUtils;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4483,7 +4612,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
     return AccessTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4550,7 +4679,7 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
     return RefreshTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4629,7 +4758,7 @@ var InteractionRequiredAuthError = /** @class */ (function (_super) {
     return InteractionRequiredAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4645,7 +4774,7 @@ var CacheRecord = /** @class */ (function () {
     return CacheRecord;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4716,7 +4845,7 @@ var ProtocolUtils = /** @class */ (function () {
     return ProtocolUtils;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4950,7 +5079,7 @@ var UrlString = /** @class */ (function () {
     return UrlString;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5179,7 +5308,7 @@ var IntFields = new Set([
     "status",
 ]);
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5288,7 +5417,7 @@ var PopTokenGenerator = /** @class */ (function () {
     return PopTokenGenerator;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5358,7 +5487,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return AppMetadataEntity;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5394,7 +5523,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return TokenCacheContext;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5681,7 +5810,7 @@ var ResponseHandler = /** @class */ (function () {
     return ResponseHandler;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6159,7 +6288,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     return AuthorizationCodeClient;
 }(BaseClient));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6239,7 +6368,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                 if (!request.account) {
                     throw ClientAuthError.createNoAccountInSilentRequestError();
                 }
-                isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, this.config.authOptions.clientId);
+                isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment);
                 // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
                 if (isFOCI) {
                     try {
@@ -6278,7 +6407,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                 (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.addQueueMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
                 atsMeasurement = (_b = this.performanceClient) === null || _b === void 0 ? void 0 : _b.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
                 this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
-                refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
+                refreshToken = this.cacheManager.getRefreshToken(request.account, foci);
                 if (!refreshToken) {
                     atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.discardMeasurement();
                     throw InteractionRequiredAuthError.createNoTokensFoundError();
@@ -6433,7 +6562,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
     return RefreshTokenClient;
 }(BaseClient));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6498,7 +6627,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
                             throw ClientAuthError.createNoAccountInSilentRequestError();
                         }
                         environment = request.authority || this.authority.getPreferredCache();
-                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, request, environment);
+                        cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
                         if (!cacheRecord.accessToken) {
                             // Must refresh due to non-existent access_token.
                             (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
@@ -6557,7 +6686,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     return SilentFlowClient;
 }(BaseClient));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6569,7 +6698,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6578,7 +6707,7 @@ var rawMetdataJSON = { "endpointMetadata": { "https://login.microsoftonline.com/
 var EndpointMetadata = rawMetdataJSON.endpointMetadata;
 var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6592,7 +6721,7 @@ exports.ProtocolMode = void 0;
     ProtocolMode["OIDC"] = "OIDC";
 })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6669,7 +6798,7 @@ var AuthorityMetadataEntity = /** @class */ (function () {
     return AuthorityMetadataEntity;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6679,7 +6808,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6689,7 +6818,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6821,7 +6950,7 @@ var RegionDiscovery = /** @class */ (function () {
     return RegionDiscovery;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7556,7 +7685,7 @@ var Authority = /** @class */ (function () {
     return Authority;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7619,7 +7748,7 @@ var AuthorityFactory = /** @class */ (function () {
     return AuthorityFactory;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7650,7 +7779,7 @@ var ServerTelemetryEntity = /** @class */ (function () {
     return ServerTelemetryEntity;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7678,7 +7807,7 @@ var ThrottlingEntity = /** @class */ (function () {
     return ThrottlingEntity;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7695,7 +7824,7 @@ var StubbedNetworkModule = {
     }
 };
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7740,7 +7869,7 @@ var JoseHeaderError = /** @class */ (function (_super) {
     return JoseHeaderError;
 }(AuthError));
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7780,7 +7909,7 @@ var JoseHeader = /** @class */ (function () {
     return JoseHeader;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7839,7 +7968,7 @@ var AuthenticationHeaderParser = /** @class */ (function () {
     return AuthenticationHeaderParser;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8001,7 +8130,7 @@ var ServerTelemetryManager = /** @class */ (function () {
     return ServerTelemetryManager;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8404,7 +8533,7 @@ var PerformanceClient = /** @class */ (function () {
     return PerformanceClient;
 }());
 
-/*! @azure/msal-common v11.0.0 2023-03-07 */
+/*! @azure/msal-common v12.0.0 2023-04-03 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9020,6 +9149,11 @@ var TemporaryCacheKeys;
     TemporaryCacheKeys["NATIVE_REQUEST"] = "request.native";
     TemporaryCacheKeys["REDIRECT_CONTEXT"] = "request.redirect.context";
 })(TemporaryCacheKeys || (TemporaryCacheKeys = {}));
+var StaticCacheKeys;
+(function (StaticCacheKeys) {
+    StaticCacheKeys["ACCOUNT_KEYS"] = "msal.account.keys";
+    StaticCacheKeys["TOKEN_KEYS"] = "msal.token.keys";
+})(StaticCacheKeys || (StaticCacheKeys = {}));
 /**
  * Cache keys stored in-memory
  */
@@ -9365,16 +9499,19 @@ var BrowserProtocolUtils = /** @class */ (function () {
 var BrowserCacheManager = /** @class */ (function (_super) {
     __extends$1(BrowserCacheManager, _super);
     function BrowserCacheManager(clientId, cacheConfig, cryptoImpl, logger) {
-        var _this = _super.call(this, clientId, cryptoImpl) || this;
+        var _this = _super.call(this, clientId, cryptoImpl, logger) || this;
         // Cookie life calculation (hours * minutes * seconds * ms)
         _this.COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
         _this.cacheConfig = cacheConfig;
         _this.logger = logger;
         _this.internalStorage = new MemoryStorage();
         _this.browserStorage = _this.setupBrowserStorage(_this.cacheConfig.cacheLocation);
-        _this.temporaryCacheStorage = _this.setupTemporaryCacheStorage(_this.cacheConfig.cacheLocation);
-        // Migrate any cache entries from older versions of MSAL.
-        _this.migrateCacheEntries();
+        _this.temporaryCacheStorage = _this.setupTemporaryCacheStorage(_this.cacheConfig.temporaryCacheLocation, _this.cacheConfig.cacheLocation);
+        // Migrate cache entries from older versions of MSAL.
+        if (cacheConfig.cacheMigrationEnabled) {
+            _this.migrateCacheEntries();
+            _this.createKeyMaps();
+        }
         return _this;
     }
     /**
@@ -9386,7 +9523,6 @@ var BrowserCacheManager = /** @class */ (function (_super) {
             case exports.BrowserCacheLocation.LocalStorage:
             case exports.BrowserCacheLocation.SessionStorage:
                 try {
-                    // Temporary cache items will always be stored in session storage to mitigate problems caused by multiple tabs
                     return new BrowserStorage(cacheLocation);
                 }
                 catch (e) {
@@ -9399,16 +9535,20 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         return new MemoryStorage();
     };
     /**
-     *
+     * Returns a window storage class implementing the IWindowStorage interface that corresponds to the configured temporaryCacheLocation.
+     * @param temporaryCacheLocation
      * @param cacheLocation
      */
-    BrowserCacheManager.prototype.setupTemporaryCacheStorage = function (cacheLocation) {
+    BrowserCacheManager.prototype.setupTemporaryCacheStorage = function (temporaryCacheLocation, cacheLocation) {
         switch (cacheLocation) {
             case exports.BrowserCacheLocation.LocalStorage:
             case exports.BrowserCacheLocation.SessionStorage:
                 try {
-                    // Temporary cache items will always be stored in session storage to mitigate problems caused by multiple tabs
-                    return new BrowserStorage(exports.BrowserCacheLocation.SessionStorage);
+                    /*
+                     * When users do not explicitly choose their own temporaryCacheLocation,
+                     * temporary cache items will always be stored in session storage to mitigate problems caused by multiple tabs
+                     */
+                    return new BrowserStorage(temporaryCacheLocation || exports.BrowserCacheLocation.SessionStorage);
                 }
                 catch (e) {
                     this.logger.verbose(e);
@@ -9448,6 +9588,91 @@ var BrowserCacheManager = /** @class */ (function (_super) {
             this.setTemporaryCache(newKey, value, true);
         }
     };
+    /**
+     * Searches all cache entries for MSAL accounts and creates the account key map
+     * This is used to migrate users from older versions of MSAL which did not create the map.
+     * @returns
+     */
+    BrowserCacheManager.prototype.createKeyMaps = function () {
+        var _this = this;
+        this.logger.trace("BrowserCacheManager - createKeyMaps called.");
+        var accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+        var tokenKeys = this.getItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId);
+        if (accountKeys && tokenKeys) {
+            this.logger.verbose("BrowserCacheManager:createKeyMaps - account and token key maps already exist, skipping migration.");
+            // Key maps already exist, no need to iterate through cache
+            return;
+        }
+        var allKeys = this.browserStorage.getKeys();
+        allKeys.forEach(function (key) {
+            if (_this.isCredentialKey(key)) {
+                // Get item, parse, validate and write key to map
+                var value = _this.getItem(key);
+                if (value) {
+                    var credObj = _this.validateAndParseJson(value);
+                    if (credObj && credObj.hasOwnProperty("credentialType")) {
+                        switch (credObj["credentialType"]) {
+                            case CredentialType.ID_TOKEN:
+                                if (IdTokenEntity.isIdTokenEntity(credObj)) {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - idToken found, saving key to token key map");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - idToken with key: " + key + " found, saving key to token key map");
+                                    var idTokenEntity = CacheManager.toObject(new IdTokenEntity(), credObj);
+                                    var newKey = _this.updateCredentialCacheKey(key, idTokenEntity);
+                                    _this.addTokenKey(newKey, CredentialType.ID_TOKEN);
+                                    return;
+                                }
+                                else {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching idToken schema with value containing idToken credentialType field but value failed IdTokenEntity validation, skipping.");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - failed idToken validation on key: " + key);
+                                }
+                                break;
+                            case CredentialType.ACCESS_TOKEN:
+                            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
+                                if (AccessTokenEntity.isAccessTokenEntity(credObj)) {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - accessToken found, saving key to token key map");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - accessToken with key: " + key + " found, saving key to token key map");
+                                    var accessTokenEntity = CacheManager.toObject(new AccessTokenEntity(), credObj);
+                                    var newKey = _this.updateCredentialCacheKey(key, accessTokenEntity);
+                                    _this.addTokenKey(newKey, CredentialType.ACCESS_TOKEN);
+                                    return;
+                                }
+                                else {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching accessToken schema with value containing accessToken credentialType field but value failed AccessTokenEntity validation, skipping.");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - failed accessToken validation on key: " + key);
+                                }
+                                break;
+                            case CredentialType.REFRESH_TOKEN:
+                                if (RefreshTokenEntity.isRefreshTokenEntity(credObj)) {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - refreshToken found, saving key to token key map");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - refreshToken with key: " + key + " found, saving key to token key map");
+                                    var refreshTokenEntity = CacheManager.toObject(new RefreshTokenEntity(), credObj);
+                                    var newKey = _this.updateCredentialCacheKey(key, refreshTokenEntity);
+                                    _this.addTokenKey(newKey, CredentialType.REFRESH_TOKEN);
+                                    return;
+                                }
+                                else {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching refreshToken schema with value containing refreshToken credentialType field but value failed RefreshTokenEntity validation, skipping.");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - failed refreshToken validation on key: " + key);
+                                }
+                                break;
+                            // If credentialType isn't one of our predefined ones, it may not be an MSAL cache value. Ignore.
+                        }
+                    }
+                }
+            }
+            if (_this.isAccountKey(key)) {
+                var value = _this.getItem(key);
+                if (value) {
+                    var accountObj = _this.validateAndParseJson(value);
+                    if (accountObj && AccountEntity.isAccountEntity(accountObj)) {
+                        _this.logger.trace("BrowserCacheManager:createKeyMaps - account found, saving key to account key map");
+                        _this.logger.tracePii("BrowserCacheManager:createKeyMaps - account with key: " + key + " found, saving key to account key map");
+                        _this.addAccountKeyToMap(key);
+                    }
+                }
+            }
+        });
+    };
     /**
      * Parses passed value as JSON object, JSON.parse() will throw an error.
      * @param input
@@ -9487,12 +9712,15 @@ var BrowserCacheManager = /** @class */ (function (_super) {
      * @param accountKey
      */
     BrowserCacheManager.prototype.getAccount = function (accountKey) {
+        this.logger.trace("BrowserCacheManager.getAccount called");
         var account = this.getItem(accountKey);
         if (!account) {
+            this.removeAccountKeyFromMap(accountKey);
             return null;
         }
         var parsedAccount = this.validateAndParseJson(account);
         if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
+            this.removeAccountKeyFromMap(accountKey);
             return null;
         }
         return CacheManager.toObject(new AccountEntity(), parsedAccount);
@@ -9506,6 +9734,207 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         this.logger.trace("BrowserCacheManager.setAccount called");
         var key = account.generateAccountKey();
         this.setItem(key, JSON.stringify(account));
+        this.addAccountKeyToMap(key);
+    };
+    /**
+     * Returns the array of account keys currently cached
+     * @returns
+     */
+    BrowserCacheManager.prototype.getAccountKeys = function () {
+        this.logger.trace("BrowserCacheManager.getAccountKeys called");
+        var accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+        if (accountKeys) {
+            return JSON.parse(accountKeys);
+        }
+        this.logger.verbose("BrowserCacheManager.getAccountKeys - No account keys found");
+        return [];
+    };
+    /**
+     * Add a new account to the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.addAccountKeyToMap = function (key) {
+        this.logger.trace("BrowserCacheManager.addAccountKeyToMap called");
+        this.logger.tracePii("BrowserCacheManager.addAccountKeyToMap called with key: " + key);
+        var accountKeys = this.getAccountKeys();
+        if (accountKeys.indexOf(key) === -1) {
+            // Only add key if it does not already exist in the map
+            accountKeys.push(key);
+            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
+        }
+        else {
+            this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key already exists in map");
+        }
+    };
+    /**
+     * Remove an account from the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeAccountKeyFromMap = function (key) {
+        this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called");
+        this.logger.tracePii("BrowserCacheManager.removeAccountKeyFromMap called with key: " + key);
+        var accountKeys = this.getAccountKeys();
+        var removalIndex = accountKeys.indexOf(key);
+        if (removalIndex > -1) {
+            accountKeys.splice(removalIndex, 1);
+            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
+        }
+        else {
+            this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap key not found in existing map");
+        }
+    };
+    /**
+     * Extends inherited removeAccount function to include removal of the account key from the map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeAccount = function (key) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                _super.prototype.removeAccount.call(this, key);
+                this.removeAccountKeyFromMap(key);
+                return [2 /*return*/];
+            });
+        });
+    };
+    /**
+     * Removes given idToken from the cache and from the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeIdToken = function (key) {
+        _super.prototype.removeIdToken.call(this, key);
+        this.removeTokenKey(key, CredentialType.ID_TOKEN);
+    };
+    /**
+     * Removes given accessToken from the cache and from the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeAccessToken = function (key) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                _super.prototype.removeAccessToken.call(this, key);
+                this.removeTokenKey(key, CredentialType.ACCESS_TOKEN);
+                return [2 /*return*/];
+            });
+        });
+    };
+    /**
+     * Removes given refreshToken from the cache and from the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeRefreshToken = function (key) {
+        _super.prototype.removeRefreshToken.call(this, key);
+        this.removeTokenKey(key, CredentialType.REFRESH_TOKEN);
+    };
+    /**
+     * Gets the keys for the cached tokens associated with this clientId
+     * @returns
+     */
+    BrowserCacheManager.prototype.getTokenKeys = function () {
+        this.logger.trace("BrowserCacheManager.getTokenKeys called");
+        var item = this.getItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId);
+        if (item) {
+            var tokenKeys = this.validateAndParseJson(item);
+            if (tokenKeys &&
+                tokenKeys.hasOwnProperty("idToken") &&
+                tokenKeys.hasOwnProperty("accessToken") &&
+                tokenKeys.hasOwnProperty("refreshToken")) {
+                return tokenKeys;
+            }
+            else {
+                this.logger.error("BrowserCacheManager.getTokenKeys - Token keys found but in an unknown format. Returning empty key map.");
+            }
+        }
+        else {
+            this.logger.verbose("BrowserCacheManager.getTokenKeys - No token keys found");
+        }
+        return {
+            idToken: [],
+            accessToken: [],
+            refreshToken: []
+        };
+    };
+    /**
+     * Adds the given key to the token key map
+     * @param key
+     * @param type
+     */
+    BrowserCacheManager.prototype.addTokenKey = function (key, type) {
+        this.logger.trace("BrowserCacheManager addTokenKey called");
+        var tokenKeys = this.getTokenKeys();
+        switch (type) {
+            case CredentialType.ID_TOKEN:
+                if (tokenKeys.idToken.indexOf(key) === -1) {
+                    this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
+                    tokenKeys.idToken.push(key);
+                }
+                break;
+            case CredentialType.ACCESS_TOKEN:
+                if (tokenKeys.accessToken.indexOf(key) === -1) {
+                    this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map");
+                    tokenKeys.accessToken.push(key);
+                }
+                break;
+            case CredentialType.REFRESH_TOKEN:
+                if (tokenKeys.refreshToken.indexOf(key) === -1) {
+                    this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
+                    tokenKeys.refreshToken.push(key);
+                }
+                break;
+            default:
+                this.logger.error("BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: " + type);
+                ClientAuthError.createUnexpectedCredentialTypeError();
+        }
+        this.setItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId, JSON.stringify(tokenKeys));
+    };
+    /**
+     * Removes the given key from the token key map
+     * @param key
+     * @param type
+     */
+    BrowserCacheManager.prototype.removeTokenKey = function (key, type) {
+        this.logger.trace("BrowserCacheManager removeTokenKey called");
+        var tokenKeys = this.getTokenKeys();
+        switch (type) {
+            case CredentialType.ID_TOKEN:
+                this.logger.infoPii("BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: " + key + " from map");
+                var idRemoval = tokenKeys.idToken.indexOf(key);
+                if (idRemoval > -1) {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - idToken removed from map");
+                    tokenKeys.idToken.splice(idRemoval, 1);
+                }
+                else {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - idToken does not exist in map. Either it was previously removed or it was never added.");
+                }
+                break;
+            case CredentialType.ACCESS_TOKEN:
+                this.logger.infoPii("BrowserCacheManager: removeTokenKey - attempting to remove accessToken with key: " + key + " from map");
+                var accessRemoval = tokenKeys.accessToken.indexOf(key);
+                if (accessRemoval > -1) {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - accessToken removed from map");
+                    tokenKeys.accessToken.splice(accessRemoval, 1);
+                }
+                else {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - accessToken does not exist in map. Either it was previously removed or it was never added.");
+                }
+                break;
+            case CredentialType.REFRESH_TOKEN:
+                this.logger.infoPii("BrowserCacheManager: removeTokenKey - attempting to remove refreshToken with key: " + key + " from map");
+                var refreshRemoval = tokenKeys.refreshToken.indexOf(key);
+                if (refreshRemoval > -1) {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken removed from map");
+                    tokenKeys.refreshToken.splice(refreshRemoval, 1);
+                }
+                else {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken does not exist in map. Either it was previously removed or it was never added.");
+                }
+                break;
+            default:
+                this.logger.error("BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: " + type);
+                ClientAuthError.createUnexpectedCredentialTypeError();
+        }
+        this.setItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId, JSON.stringify(tokenKeys));
     };
     /**
      * generates idToken entity from a string
@@ -9515,11 +9944,13 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         var value = this.getItem(idTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
+            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
             return null;
         }
         var parsedIdToken = this.validateAndParseJson(value);
         if (!parsedIdToken || !IdTokenEntity.isIdTokenEntity(parsedIdToken)) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
+            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit");
@@ -9533,6 +9964,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
         var idTokenKey = idToken.generateCredentialKey();
         this.setItem(idTokenKey, JSON.stringify(idToken));
+        this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
     };
     /**
      * generates accessToken entity from a string
@@ -9542,11 +9974,13 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         var value = this.getItem(accessTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
+            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
             return null;
         }
         var parsedAccessToken = this.validateAndParseJson(value);
         if (!parsedAccessToken || !AccessTokenEntity.isAccessTokenEntity(parsedAccessToken)) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
+            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit");
@@ -9560,6 +9994,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
         var accessTokenKey = accessToken.generateCredentialKey();
         this.setItem(accessTokenKey, JSON.stringify(accessToken));
+        this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
     };
     /**
      * generates refreshToken entity from a string
@@ -9569,11 +10004,13 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         var value = this.getItem(refreshTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
+            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
             return null;
         }
         var parsedRefreshToken = this.validateAndParseJson(value);
         if (!parsedRefreshToken || !RefreshTokenEntity.isRefreshTokenEntity(parsedRefreshToken)) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
+            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit");
@@ -9587,6 +10024,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
         var refreshTokenKey = refreshToken.generateCredentialKey();
         this.setItem(refreshTokenKey, JSON.stringify(refreshToken));
+        this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
     };
     /**
      * fetch appMetadata entity from the platform cache
@@ -9884,7 +10322,6 @@ var BrowserCacheManager = /** @class */ (function (_super) {
             this.logger.trace("BrowserCacheManager.removeItem: storeAuthStateInCookie is true, clearing item cookie");
             this.clearItemCookie(key);
         }
-        return true;
     };
     /**
      * Checks whether key is in cache.
@@ -10311,15 +10748,17 @@ var BrowserCacheManager = /** @class */ (function (_super) {
 var DEFAULT_BROWSER_CACHE_MANAGER = function (clientId, logger) {
     var cacheOptions = {
         cacheLocation: exports.BrowserCacheLocation.MemoryStorage,
+        temporaryCacheLocation: exports.BrowserCacheLocation.MemoryStorage,
         storeAuthStateInCookie: false,
-        secureCookies: false
+        secureCookies: false,
+        cacheMigrationEnabled: false
     };
     return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger);
 };
 
 /* eslint-disable header/header */
 var name = "@azure/msal-browser";
-var version = "2.34.0";
+var version = "2.36.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11790,15 +12229,18 @@ var NativeInteractionClient = /** @class */ (function (_super) {
      */
     NativeInteractionClient.prototype.acquireTokensFromCache = function (nativeAccountId, request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var accountEntity, account, silentRequest, result, e_2;
+            var account, silentRequest, result, e_2;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        accountEntity = this.browserStorage.readAccountFromCacheWithNativeAccountId(nativeAccountId);
-                        if (!accountEntity) {
+                        if (!nativeAccountId) {
+                            this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided");
+                            throw ClientAuthError.createNoAccountFoundError();
+                        }
+                        account = this.browserStorage.getAccountInfoFilteredBy({ nativeAccountId: nativeAccountId });
+                        if (!account) {
                             throw ClientAuthError.createNoAccountFoundError();
                         }
-                        account = accountEntity.getAccountInfo();
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
@@ -11938,10 +12380,6 @@ var NativeInteractionClient = /** @class */ (function (_super) {
                             // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
                             throw NativeAuthError.createUserSwitchError();
                         }
-                        if (response.account.id !== request.accountId) {
-                            // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
-                            throw NativeAuthError.createUserSwitchError();
-                        }
                         return [4 /*yield*/, this.getDiscoveredAuthority(request.authority)];
                     case 1:
                         authority = _a.sent();
@@ -13444,8 +13882,11 @@ function buildConfiguration(_a, isBrowserEnvironment) {
     // Default cache options for browser
     var DEFAULT_CACHE_OPTIONS = {
         cacheLocation: exports.BrowserCacheLocation.SessionStorage,
+        temporaryCacheLocation: exports.BrowserCacheLocation.SessionStorage,
         storeAuthStateInCookie: false,
-        secureCookies: false
+        secureCookies: false,
+        // Default cache migration to true if cache location is localStorage since entries are preserved across tabs/windows. Migration has little to no benefit in sessionStorage and memoryStorage
+        cacheMigrationEnabled: userInputCache && userInputCache.cacheLocation === exports.BrowserCacheLocation.LocalStorage ? true : false
     };
     // Default logger options for browser
     var DEFAULT_LOGGER_OPTIONS = {
@@ -15701,7 +16142,7 @@ var BrowserPerformanceClient = /** @class */ (function (_super) {
             this.logger.trace("BrowserPerformanceClient: Incomplete pre-queue " + preQueueEvent.name + " found", correlationId);
             this.addQueueMeasurement(preQueueEvent.name, correlationId, undefined, true);
         }
-        this.preQueueTimeByCorrelationId.set(eventName, { name: eventName, time: window.performance.now() });
+        this.preQueueTimeByCorrelationId.set(correlationId, { name: eventName, time: window.performance.now() });
     };
     /**
      * Calculates and adds queue time measurement for given performance event.
@@ -16127,8 +16568,10 @@ var ClientApplication = /** @class */ (function () {
         // initialize in memory storage for native flows
         var nativeCacheOptions = {
             cacheLocation: exports.BrowserCacheLocation.MemoryStorage,
+            temporaryCacheLocation: exports.BrowserCacheLocation.MemoryStorage,
             storeAuthStateInCookie: false,
-            secureCookies: false
+            secureCookies: false,
+            cacheMigrationEnabled: false
         };
         this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger);
         // Initialize the token cache
@@ -16761,15 +17204,20 @@ var ClientApplication = /** @class */ (function () {
      * (the account object is created at the time of successful login)
      * or null when no matching account is found.
      * This API is provided for convenience but getAccountById should be used for best reliability
-     * @param userName
+     * @param username
      * @returns The account object stored in MSAL
      */
-    ClientApplication.prototype.getAccountByUsername = function (userName) {
-        var allAccounts = this.getAllAccounts();
-        if (!StringUtils.isEmpty(userName) && allAccounts && allAccounts.length) {
-            this.logger.verbose("Account matching username found, returning");
-            this.logger.verbosePii("Returning signed-in accounts matching username: " + userName);
-            return allAccounts.filter(function (accountObj) { return accountObj.username.toLowerCase() === userName.toLowerCase(); })[0] || null;
+    ClientApplication.prototype.getAccountByUsername = function (username) {
+        this.logger.trace("getAccountByUsername called");
+        if (!username) {
+            this.logger.warning("getAccountByUsername: No username provided");
+            return null;
+        }
+        var account = this.browserStorage.getAccountInfoFilteredBy({ username: username });
+        if (account) {
+            this.logger.verbose("getAccountByUsername: Account matching username found, returning");
+            this.logger.verbosePii("getAccountByUsername: Returning signed-in accounts matching username: " + username);
+            return account;
         }
         else {
             this.logger.verbose("getAccountByUsername: No matching account found, returning null");
@@ -16784,11 +17232,16 @@ var ClientApplication = /** @class */ (function () {
      * @returns The account object stored in MSAL
      */
     ClientApplication.prototype.getAccountByHomeId = function (homeAccountId) {
-        var allAccounts = this.getAllAccounts();
-        if (!StringUtils.isEmpty(homeAccountId) && allAccounts && allAccounts.length) {
-            this.logger.verbose("Account matching homeAccountId found, returning");
-            this.logger.verbosePii("Returning signed-in accounts matching homeAccountId: " + homeAccountId);
-            return allAccounts.filter(function (accountObj) { return accountObj.homeAccountId === homeAccountId; })[0] || null;
+        this.logger.trace("getAccountByHomeId called");
+        if (!homeAccountId) {
+            this.logger.warning("getAccountByHomeId: No homeAccountId provided");
+            return null;
+        }
+        var account = this.browserStorage.getAccountInfoFilteredBy({ homeAccountId: homeAccountId });
+        if (account) {
+            this.logger.verbose("getAccountByHomeId: Account matching homeAccountId found, returning");
+            this.logger.verbosePii("getAccountByHomeId: Returning signed-in accounts matching homeAccountId: " + homeAccountId);
+            return account;
         }
         else {
             this.logger.verbose("getAccountByHomeId: No matching account found, returning null");
@@ -16803,11 +17256,16 @@ var ClientApplication = /** @class */ (function () {
      * @returns The account object stored in MSAL
      */
     ClientApplication.prototype.getAccountByLocalId = function (localAccountId) {
-        var allAccounts = this.getAllAccounts();
-        if (!StringUtils.isEmpty(localAccountId) && allAccounts && allAccounts.length) {
-            this.logger.verbose("Account matching localAccountId found, returning");
-            this.logger.verbosePii("Returning signed-in accounts matching localAccountId: " + localAccountId);
-            return allAccounts.filter(function (accountObj) { return accountObj.localAccountId === localAccountId; })[0] || null;
+        this.logger.trace("getAccountByLocalId called");
+        if (!localAccountId) {
+            this.logger.warning("getAccountByLocalId: No localAccountId provided");
+            return null;
+        }
+        var account = this.browserStorage.getAccountInfoFilteredBy({ localAccountId: localAccountId });
+        if (account) {
+            this.logger.verbose("getAccountByLocalId: Account matching localAccountId found, returning");
+            this.logger.verbosePii("getAccountByLocalId: Returning signed-in accounts matching localAccountId: " + localAccountId);
+            return account;
         }
         else {
             this.logger.verbose("getAccountByLocalId: No matching account found, returning null");