@azure/msal-browser 3.0.0-beta.1 → 3.0.0

package/lib/msal-browser.cjs.js

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-browser v3.0.0 2023-08-08 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -199,11 +199,17 @@ const CodeChallengeMethodValues = {
     S256: "S256",
 };
 /**
- * allowed values for response_mode
+ * allowed values for server response type
  */
-const ResponseMode = {
+const ServerResponseType = {
     QUERY: "query",
     FRAGMENT: "fragment",
+};
+/**
+ * allowed values for response_mode
+ */
+const ResponseMode = {
+    ...ServerResponseType,
     FORM_POST: "form_post",
 };
 /**
@@ -356,7 +362,7 @@ const JsonTypes = {
     Pop: "pop",
 };
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -410,7 +416,7 @@ class AuthError extends Error {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -455,7 +461,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -977,7 +983,7 @@ class ClientAuthError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1104,7 +1110,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1304,12 +1310,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.0.0-beta.1";
+const version$1 = "14.0.0";
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1321,15 +1327,15 @@ const AzureCloudInstance = {
     AzurePublic: "https://login.microsoftonline.com",
     // Microsoft PPE
     AzurePpe: "https://login.windows-ppe.net",
-    // Microsoft Chinese national cloud
+    // Microsoft Chinese national/regional cloud
     AzureChina: "https://login.chinacloudapi.cn",
-    // Microsoft German national cloud ("Black Forest")
+    // Microsoft German national/regional cloud ("Black Forest")
     AzureGermany: "https://login.microsoftonline.de",
     // US Government cloud
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1429,12 +1435,20 @@ const ClientConfigurationErrorMessage = {
     },
     invalidAuthenticationHeader: {
         code: "invalid_authentication_header",
-        desc: "Invalid authentication header provided"
+        desc: "Invalid authentication header provided",
+    },
+    cannotSetOIDCOptions: {
+        code: "cannot_set_OIDCOptions",
+        desc: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
+    },
+    cannotAllowNativeBroker: {
+        code: "cannot_allow_native_broker",
+        desc: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
     },
     authorityMismatch: {
         code: "authority_mismatch",
-        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority."
-    }
+        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+    },
 };
 /**
  * Error thrown when there is an error in configuration of the MSAL.js library.
@@ -1583,6 +1597,18 @@ class ClientConfigurationError extends ClientAuthError {
     static createInvalidAuthenticationHeaderError(invalidHeaderName, details) {
         return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, `${ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc}. Invalid header: ${invalidHeaderName}. Details: ${details}`);
     }
+    /**
+     * Throws error when provided non-default OIDCOptions when not in OIDC protocol mode
+     */
+    static createCannotSetOIDCOptionsError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotSetOIDCOptions.code, ClientConfigurationErrorMessage.cannotSetOIDCOptions.desc);
+    }
+    /**
+     * Throws error when allowNativeBroker is set to true when not in AAD protocol mode
+     */
+    static createCannotAllowNativeBrokerError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotAllowNativeBroker.code, ClientConfigurationErrorMessage.cannotAllowNativeBroker.desc);
+    }
     /**
      * Create an error when the authority provided in request does not match authority provided in account or MSAL.js configuration.
      */
@@ -1591,7 +1617,7 @@ class ClientConfigurationError extends ClientAuthError {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1791,7 +1817,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1831,7 +1857,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1843,10 +1869,23 @@ const AuthorityType = {
     Default: 0,
     Adfs: 1,
     Dsts: 2,
-    Ciam: 3
+    Ciam: 3,
+};
+
+/*! @azure/msal-common v14.0.0 2023-08-08 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Protocol modes supported by MSAL.
+ */
+const ProtocolMode = {
+    AAD: "AAD",
+    OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1868,7 +1907,6 @@ const AuthorityType = {
  *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
  *      authorityType: Accounts authority type as a string
  *      name: Full name for the account, including given name and family name,
- *      clientInfo: Full base64 encoded client info received from ESTS
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
  *      idTokenClaims: Object containing claims parsed from ID token
@@ -1895,24 +1933,6 @@ class AccountEntity {
             localAccountId: this.localAccountId,
         });
     }
-    /**
-     * returns the type of the cache (in this case account)
-     */
-    generateType() {
-        switch (this.authorityType) {
-            case CacheAccountType.ADFS_ACCOUNT_TYPE:
-                return CacheType.ADFS;
-            case CacheAccountType.MSAV1_ACCOUNT_TYPE:
-                return CacheType.MSA;
-            case CacheAccountType.MSSTS_ACCOUNT_TYPE:
-                return CacheType.MSSTS;
-            case CacheAccountType.GENERIC_ACCOUNT_TYPE:
-                return CacheType.GENERIC;
-            default: {
-                throw ClientAuthError.createUnexpectedAccountTypeError();
-            }
-        }
-    }
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -1926,6 +1946,7 @@ class AccountEntity {
             name: this.name,
             idTokenClaims: this.idTokenClaims,
             nativeAccountId: this.nativeAccountId,
+            authorityType: this.authorityType,
         };
     }
     /**
@@ -1942,84 +1963,74 @@ class AccountEntity {
     }
     /**
      * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-     * @param clientInfo
-     * @param authority
-     * @param idToken
-     * @param policy
+     * @param accountDetails
      */
-    static createAccount(clientInfo, homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
+    static createAccount(accountDetails, authority) {
         const account = new AccountEntity();
-        account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
-        account.clientInfo = clientInfo;
-        account.homeAccountId = homeAccountId;
-        account.nativeAccountId = nativeAccountId;
-        const env = environment || (authority && authority.getPreferredCache());
+        if (authority.authorityType === AuthorityType.Adfs) {
+            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
+        }
+        else if (authority.protocolMode === ProtocolMode.AAD) {
+            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
+        }
+        else {
+            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        }
+        account.clientInfo = accountDetails.clientInfo;
+        account.homeAccountId = accountDetails.homeAccountId;
+        account.nativeAccountId = accountDetails.nativeAccountId;
+        const env = accountDetails.environment ||
+            (authority && authority.getPreferredCache());
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
         }
         account.environment = env;
         // non AAD scenarios can have empty realm
-        account.realm = idToken?.claims?.tid || Constants.EMPTY_STRING;
-        if (idToken) {
-            account.idTokenClaims = idToken.claims;
-            // How do you account for MSA CID here?
-            account.localAccountId =
-                idToken?.claims?.oid ||
-                    idToken?.claims?.sub ||
-                    Constants.EMPTY_STRING;
-            /*
-             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-             * In most cases it will contain a single email. This field should not be relied upon if a custom
-             * policy is configured to return more than 1 email.
-             */
-            const preferredUsername = idToken?.claims?.preferred_username;
-            const email = idToken?.claims?.emails
-                ? idToken.claims.emails[0]
-                : null;
-            account.username =
-                preferredUsername || email || Constants.EMPTY_STRING;
-            account.name = idToken?.claims?.name;
-        }
-        account.cloudGraphHostName = cloudGraphHostName;
-        account.msGraphHost = msGraphHost;
+        account.realm =
+            accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
+        account.idTokenClaims = accountDetails.idTokenClaims;
+        // How do you account for MSA CID here?
+        account.localAccountId =
+            accountDetails.idTokenClaims.oid ||
+                accountDetails.idTokenClaims.sub ||
+                Constants.EMPTY_STRING;
+        /*
+         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+         * In most cases it will contain a single email. This field should not be relied upon if a custom
+         * policy is configured to return more than 1 email.
+         */
+        const preferredUsername = accountDetails.idTokenClaims.preferred_username ||
+            accountDetails.idTokenClaims.upn;
+        const email = accountDetails.idTokenClaims.emails
+            ? accountDetails.idTokenClaims.emails[0]
+            : null;
+        account.username = preferredUsername || email || Constants.EMPTY_STRING;
+        account.name = accountDetails.idTokenClaims.name;
+        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
+        account.msGraphHost = accountDetails.msGraphHost;
         return account;
     }
     /**
-     * Builds non-AAD/ADFS account.
-     * @param authority
-     * @param idToken
+     * Creates an AccountEntity object from AccountInfo
+     * @param accountInfo
+     * @param cloudGraphHostName
+     * @param msGraphHost
+     * @returns
      */
-    static createGenericAccount(homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
+    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
         const account = new AccountEntity();
         account.authorityType =
-            authority && authority.authorityType === AuthorityType.Adfs
-                ? CacheAccountType.ADFS_ACCOUNT_TYPE
-                : CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        account.homeAccountId = homeAccountId;
-        // non AAD scenarios can have empty realm
-        account.realm = Constants.EMPTY_STRING;
-        const env = environment || (authority && authority.getPreferredCache());
-        if (!env) {
-            throw ClientAuthError.createInvalidCacheEnvironmentError();
-        }
-        if (idToken) {
-            // How do you account for MSA CID here?
-            account.localAccountId =
-                idToken?.claims?.oid ||
-                    idToken?.claims?.sub ||
-                    Constants.EMPTY_STRING;
-            // upn claim for most ADFS scenarios
-            account.username = idToken?.claims?.upn || Constants.EMPTY_STRING;
-            account.name = idToken?.claims?.name || Constants.EMPTY_STRING;
-            account.idTokenClaims = idToken?.claims;
-        }
-        account.environment = env;
+            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.homeAccountId = accountInfo.homeAccountId;
+        account.localAccountId = accountInfo.localAccountId;
+        account.nativeAccountId = accountInfo.nativeAccountId;
+        account.realm = accountInfo.tenantId;
+        account.environment = accountInfo.environment;
+        account.username = accountInfo.username;
+        account.name = accountInfo.name;
+        account.idTokenClaims = accountInfo.idTokenClaims;
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;
-        /*
-         * add uniqueName to claims
-         * account.name = idToken.claims.uniqueName;
-         */
         return account;
     }
     /**
@@ -2027,9 +2038,9 @@ class AccountEntity {
      * @param serverClientInfo
      * @param authType
      */
-    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idToken) {
-        const accountId = idToken?.claims?.sub
-            ? idToken.claims.sub
+    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
+        const accountId = idTokenClaims?.sub
+            ? idTokenClaims.sub
             : Constants.EMPTY_STRING;
         // since ADFS does not have tid and does not set client_info
         if (authType === AuthorityType.Adfs ||
@@ -2097,7 +2108,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2148,7 +2159,7 @@ class AuthToken {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2214,20 +2225,21 @@ class CacheManager {
      * saves a cache record
      * @param cacheRecord
      */
-    async saveCacheRecord(cacheRecord) {
+    async saveCacheRecord(cacheRecord, storeInCache) {
         if (!cacheRecord) {
             throw ClientAuthError.createNullOrUndefinedCacheRecord();
         }
         if (!!cacheRecord.account) {
             this.setAccount(cacheRecord.account);
         }
-        if (!!cacheRecord.idToken) {
+        if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
             this.setIdTokenCredential(cacheRecord.idToken);
         }
-        if (!!cacheRecord.accessToken) {
+        if (!!cacheRecord.accessToken && storeInCache?.accessToken !== false) {
             await this.saveAccessToken(cacheRecord.accessToken);
         }
-        if (!!cacheRecord.refreshToken) {
+        if (!!cacheRecord.refreshToken &&
+            storeInCache?.refreshToken !== false) {
             this.setRefreshTokenCredential(cacheRecord.refreshToken);
         }
         if (!!cacheRecord.appMetadata) {
@@ -3162,7 +3174,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3256,8 +3268,15 @@ function buildAuthOptions(authOptions) {
         ...authOptions,
     };
 }
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+function isOidcProtocolMode(config) {
+    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+}
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3274,7 +3293,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3371,7 +3390,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3407,7 +3426,7 @@ class NetworkManager {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3417,7 +3436,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3498,11 +3517,11 @@ class RequestValidator {
             }
         });
         // remove empty string parameters
-        return Object.fromEntries(Object.entries(eQParams).filter(kv => kv[1] !== ""));
+        return Object.fromEntries(Object.entries(eQParams).filter((kv) => kv[1] !== ""));
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3542,9 +3561,15 @@ class RequestParameterBuilder {
      * @param scopeSet
      * @param addOidcScopes
      */
-    addScopes(scopes, addOidcScopes = true) {
+    addScopes(scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+        // Always add openid to the scopes when adding OIDC scopes
+        if (addOidcScopes &&
+            !defaultScopes.includes("openid") &&
+            !scopes.includes("openid")) {
+            defaultScopes.push("openid");
+        }
         const requestScopes = addOidcScopes
-            ? [...(scopes || []), ...OIDC_DEFAULT_SCOPES]
+            ? [...(scopes || []), ...defaultScopes]
             : scopes || [];
         const scopeSet = new ScopeSet(requestScopes);
         this.parameters.set(AADServerParamKeys.SCOPE, encodeURIComponent(scopeSet.printScopes()));
@@ -3879,7 +3904,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3974,7 +3999,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4113,7 +4138,7 @@ class CredentialEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4172,7 +4197,7 @@ class IdTokenEntity extends CredentialEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4219,7 +4244,7 @@ class TimeUtils {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4333,7 +4358,7 @@ class AccessTokenEntity extends CredentialEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4395,7 +4420,7 @@ class RefreshTokenEntity extends CredentialEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4476,12 +4501,12 @@ class InteractionRequiredAuthError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-let CacheRecord$1 = class CacheRecord {
+class CacheRecord {
     constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
         this.account = accountEntity || null;
         this.idToken = idTokenEntity || null;
@@ -4489,9 +4514,9 @@ let CacheRecord$1 = class CacheRecord {
         this.refreshToken = refreshTokenEntity || null;
         this.appMetadata = appMetadataEntity || null;
     }
-};
+}
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4565,7 +4590,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4749,6 +4774,30 @@ class UrlString {
         }
         return Constants.EMPTY_STRING;
     }
+    /**
+     * Parses query server response string from given string.
+     * Extract hash between '?code=' and '#' if trailing '# is present.
+     * Returns empty string if no query symbol is found.
+     * @param queryString
+     */
+    static parseQueryServerResponse(queryString) {
+        const queryIndex1 = queryString.indexOf("?code");
+        const queryIndex2 = queryString.indexOf("/?code");
+        const hashIndex = queryString.indexOf("#");
+        if (queryIndex2 > -1 && hashIndex > -1) {
+            return queryString.substring(queryIndex2 + 2, hashIndex);
+        }
+        else if (queryIndex2 > -1) {
+            return queryString.substring(queryIndex2 + 2);
+        }
+        else if (queryIndex1 > -1 && hashIndex > -1) {
+            return queryString.substring(queryIndex1 + 1, hashIndex);
+        }
+        else if (queryIndex1 > -1) {
+            return queryString.substring(queryIndex1 + 1);
+        }
+        return Constants.EMPTY_STRING;
+    }
     static constructAuthorityUriFromObject(urlObject) {
         return new UrlString(urlObject.Protocol +
             "//" +
@@ -4794,6 +4843,21 @@ class UrlString {
         }
         return deserializedQueryString;
     }
+    /**
+     * Returns either deserialized query string or deserialized hash, depending on the serverResponseType
+     * as a server auth code response object.
+     */
+    static getDeserializedCodeResponse(serverResponseType, hashFragment) {
+        const hashUrlString = new UrlString(hashFragment);
+        let serverParams;
+        if (serverResponseType === ServerResponseType.QUERY) {
+            serverParams = UrlString.getDeserializedQueryString(hashFragment);
+        }
+        else {
+            serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
+        }
+        return serverParams;
+    }
     /**
      * Check if the hash of the URL string contains known properties
      */
@@ -4810,7 +4874,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5013,6 +5077,7 @@ const PerformanceEvents = {
     UpdateCloudDiscoveryMetadataMeasurement: "updateCloudDiscoveryMetadataMeasurement",
     UsernamePasswordClientAcquireToken: "usernamePasswordClientAcquireToken",
     NativeMessageHandlerHandshake: "nativeMessageHandlerHandshake",
+    NativeGenerateAuthResult: "nativeGenerateAuthResult",
 };
 /**
  * State of the performance event.
@@ -5037,7 +5102,7 @@ const IntFields = new Set([
     "status",
 ]);
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5122,7 +5187,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5191,7 +5256,7 @@ class AppMetadataEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5218,7 +5283,7 @@ class AppMetadataEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5245,12 +5310,25 @@ class ResponseHandler {
      */
     validateServerAuthorizationCodeResponse(serverResponseHash, cachedState, cryptoObj) {
         if (!serverResponseHash.state || !cachedState) {
-            throw !serverResponseHash.state
-                ? ClientAuthError.createStateNotFoundError("Server State")
-                : ClientAuthError.createStateNotFoundError("Cached State");
+            throw serverResponseHash.state
+                ? ClientAuthError.createStateNotFoundError("Cached State")
+                : ClientAuthError.createStateNotFoundError("Server State");
+        }
+        let decodedServerResponseHash;
+        let decodedCachedState;
+        try {
+            decodedServerResponseHash = decodeURIComponent(serverResponseHash.state);
+        }
+        catch (e) {
+            throw ClientAuthError.createInvalidStateError(serverResponseHash.state, `Server response hash URI could not be decoded`);
+        }
+        try {
+            decodedCachedState = decodeURIComponent(cachedState);
         }
-        if (decodeURIComponent(serverResponseHash.state) !==
-            decodeURIComponent(cachedState)) {
+        catch (e) {
+            throw ClientAuthError.createInvalidStateError(serverResponseHash.state, `Cached state URI could not be decoded`);
+        }
+        if (decodedServerResponseHash !== decodedCachedState) {
             throw ClientAuthError.createStateMismatchError();
         }
         // Check for error
@@ -5310,7 +5388,7 @@ class ResponseHandler {
             }
         }
         // generate homeAccountId
-        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
+        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj?.claims);
         // save the response tokens
         let requestStateObj;
         if (!!authCodePayload && !!authCodePayload.state) {
@@ -5343,7 +5421,7 @@ class ResponseHandler {
                     return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache);
         }
         finally {
             if (this.persistencePlugin &&
@@ -5372,7 +5450,13 @@ class ResponseHandler {
         if (!StringUtils.isEmpty(serverTokenResponse.id_token) &&
             !!idTokenObj) {
             cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
-            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
+            cachedAccount = AccountEntity.createAccount({
+                homeAccountId: this.homeAccountIdentifier,
+                idTokenClaims: idTokenObj.claims,
+                clientInfo: serverTokenResponse.client_info,
+                cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
+                msGraphHost: authCodePayload?.msgraph_host,
+            }, authority);
         }
         // AccessToken
         let cachedAccessToken = null;
@@ -5414,35 +5498,7 @@ class ResponseHandler {
         if (!StringUtils.isEmpty(serverTokenResponse.foci)) {
             cachedAppMetadata = AppMetadataEntity.createAppMetadataEntity(this.clientId, env, serverTokenResponse.foci);
         }
-        return new CacheRecord$1(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
-    }
-    /**
-     * Generate Account
-     * @param serverTokenResponse
-     * @param idToken
-     * @param authority
-     */
-    generateAccountEntity(serverTokenResponse, idToken, authority, authCodePayload) {
-        const authorityType = authority.authorityType;
-        const cloudGraphHostName = authCodePayload
-            ? authCodePayload.cloud_graph_host_name
-            : Constants.EMPTY_STRING;
-        const msGraphhost = authCodePayload
-            ? authCodePayload.msgraph_host
-            : Constants.EMPTY_STRING;
-        // ADFS does not require client_info in the response
-        if (authorityType === AuthorityType.Adfs) {
-            this.logger.verbose("Authority type is ADFS, creating ADFS account");
-            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
-        }
-        // This fallback applies to B2C as well as they fall under an AAD account type.
-        if (StringUtils.isEmpty(serverTokenResponse.client_info) &&
-            authority.protocolMode === "AAD") {
-            throw ClientAuthError.createClientInfoEmptyError();
-        }
-        return serverTokenResponse.client_info
-            ? AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost)
-            : AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
+        return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
     }
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -5521,7 +5577,7 @@ class ResponseHandler {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5535,6 +5591,8 @@ class AuthorizationCodeClient extends BaseClient {
         super(configuration, performanceClient);
         // Flag to indicate if client is for hybrid spa auth code redemption
         this.includeRedirectUri = true;
+        this.oidcDefaultScopes =
+            this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
     }
     /**
      * Creates the URL of the authorization request letting the user input credentials and consent to the
@@ -5573,7 +5631,7 @@ class AuthorizationCodeClient extends BaseClient {
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
         const httpVerAuthority = response.headers?.[HeaderNames.X_MS_HTTP_VERSION];
         if (httpVerAuthority) {
-            atsMeasurement?.addStaticFields({
+            atsMeasurement?.add({
                 httpVerAuthority,
             });
         }
@@ -5584,14 +5642,14 @@ class AuthorizationCodeClient extends BaseClient {
         return responseHandler
             .handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)
             .then((result) => {
-            atsMeasurement?.endMeasurement({
+            atsMeasurement?.end({
                 success: true,
             });
             return result;
         })
             .catch((error) => {
             this.logger.verbose("Error in fetching token in ACC", request.correlationId);
-            atsMeasurement?.endMeasurement({
+            atsMeasurement?.end({
                 errorCode: error.errorCode,
                 subErrorCode: error.subError,
                 success: false,
@@ -5607,10 +5665,8 @@ class AuthorizationCodeClient extends BaseClient {
     handleFragmentResponse(hashFragment, cachedState) {
         // Handle responses.
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);
-        // Deserialize hash fragment response parameters.
-        const hashUrlString = new UrlString(hashFragment);
-        // Deserialize hash fragment response parameters.
-        const serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
+        const serverParams = UrlString.getDeserializedCodeResponse(this.config.authOptions.authority.options.OIDCOptions
+            ?.serverResponseType, hashFragment);
         // Get code response
         responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState, this.cryptoUtils);
         // throw when there is no auth code in the response
@@ -5696,14 +5752,14 @@ class AuthorizationCodeClient extends BaseClient {
             parameterBuilder.addRedirectUri(request.redirectUri);
         }
         // Add scope array, parameter builder will add default scopes and dedupe
-        parameterBuilder.addScopes(request.scopes);
+        parameterBuilder.addScopes(request.scopes, true, this.oidcDefaultScopes);
         // add code: user set, not validated
         parameterBuilder.addAuthorizationCode(request.code);
         // Add library metadata
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
         parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
-        if (this.serverTelemetryManager) {
+        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
         }
         // add code_verifier if passed
@@ -5802,7 +5858,7 @@ class AuthorizationCodeClient extends BaseClient {
             ...(request.scopes || []),
             ...(request.extraScopesToConsent || []),
         ];
-        parameterBuilder.addScopes(requestScopes);
+        parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);
         // validate the redirectUri (to be a non null value)
         parameterBuilder.addRedirectUri(request.redirectUri);
         // generate the correlationId if not set by the user and add
@@ -5815,7 +5871,9 @@ class AuthorizationCodeClient extends BaseClient {
         parameterBuilder.addResponseTypeCode();
         // add library info parameters
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+        if (!isOidcProtocolMode(this.config)) {
+            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+        }
         // add client_info=1
         parameterBuilder.addClientInfo();
         if (request.codeChallenge && request.codeChallengeMethod) {
@@ -5957,7 +6015,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5978,11 +6036,11 @@ class RefreshTokenClient extends BaseClient {
         this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
         const response = await this.executeTokenRequest(request, this.authority);
         const httpVerToken = response.headers?.[HeaderNames.X_MS_HTTP_VERSION];
-        atsMeasurement?.addStaticFields({
+        atsMeasurement?.add({
             refreshTokenSize: response.body.refresh_token?.length || 0,
         });
         if (httpVerToken) {
-            atsMeasurement?.addStaticFields({
+            atsMeasurement?.add({
                 httpVerToken,
             });
         }
@@ -5994,14 +6052,14 @@ class RefreshTokenClient extends BaseClient {
         return responseHandler
             .handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId)
             .then((result) => {
-            atsMeasurement?.endMeasurement({
+            atsMeasurement?.end({
                 success: true,
             });
             return result;
         })
             .catch((error) => {
             this.logger.verbose("Error in fetching refresh token", request.correlationId);
-            atsMeasurement?.endMeasurement({
+            atsMeasurement?.end({
                 errorCode: error.errorCode,
                 subErrorCode: error.subError,
                 success: false,
@@ -6065,11 +6123,11 @@ class RefreshTokenClient extends BaseClient {
         this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
         const refreshToken = this.cacheManager.getRefreshToken(request.account, foci);
         if (!refreshToken) {
-            atsMeasurement?.discardMeasurement();
+            atsMeasurement?.discard();
             throw InteractionRequiredAuthError.createNoTokensFoundError();
         }
         // attach cached RT size to the current measurement
-        atsMeasurement?.endMeasurement({
+        atsMeasurement?.end({
             success: true,
         });
         const refreshTokenRequest = {
@@ -6110,13 +6168,13 @@ class RefreshTokenClient extends BaseClient {
         };
         return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)
             .then((result) => {
-            acquireTokenMeasurement?.endMeasurement({
+            acquireTokenMeasurement?.end({
                 success: true,
             });
             return result;
         })
             .catch((error) => {
-            acquireTokenMeasurement?.endMeasurement({
+            acquireTokenMeasurement?.end({
                 success: false,
             });
             throw error;
@@ -6132,13 +6190,13 @@ class RefreshTokenClient extends BaseClient {
         const acquireTokenMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.BaseClientCreateTokenRequestHeaders, correlationId);
         const parameterBuilder = new RequestParameterBuilder();
         parameterBuilder.addClientId(this.config.authOptions.clientId);
-        parameterBuilder.addScopes(request.scopes);
+        parameterBuilder.addScopes(request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
         parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
         parameterBuilder.addClientInfo();
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
         parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
-        if (this.serverTelemetryManager) {
+        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
         }
         parameterBuilder.addCorrelationId(correlationId);
@@ -6163,7 +6221,7 @@ class RefreshTokenClient extends BaseClient {
                 parameterBuilder.addSshJwk(request.sshJwk);
             }
             else {
-                acquireTokenMeasurement?.endMeasurement({
+                acquireTokenMeasurement?.end({
                     success: false,
                 });
                 throw ClientConfigurationError.createMissingSshJwkError();
@@ -6192,14 +6250,14 @@ class RefreshTokenClient extends BaseClient {
                     break;
             }
         }
-        acquireTokenMeasurement?.endMeasurement({
+        acquireTokenMeasurement?.end({
             success: true,
         });
         return parameterBuilder.createQueryString();
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6302,7 +6360,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6314,7 +6372,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7191,21 +7249,16 @@ const rawMetdataJSON = {
 };
 const EndpointMetadata = rawMetdataJSON.endpointMetadata;
 const InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
+const InstanceDiscoveryMetadataAliases = new Set();
+for (const key in InstanceDiscoveryMetadata) {
+    for (const metadata of InstanceDiscoveryMetadata[key].metadata) {
+        for (const alias of metadata.aliases) {
+            InstanceDiscoveryMetadataAliases.add(alias);
+        }
+    }
+}
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Protocol modes supported by MSAL.
- */
-const ProtocolMode = {
-    AAD: "AAD",
-    OIDC: "OIDC",
-};
-
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7285,7 +7338,7 @@ class AuthorityMetadataEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7295,7 +7348,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7305,7 +7358,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7416,7 +7469,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7589,10 +7642,10 @@ class Authority {
      * @private
      */
     canReplaceTenant(authorityUri) {
-        return authorityUri.PathSegments.length === 1
-            && !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0])
-            && this.getAuthorityType(authorityUri) === AuthorityType.Default
-            && this.protocolMode === ProtocolMode.AAD;
+        return (authorityUri.PathSegments.length === 1 &&
+            !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0]) &&
+            this.getAuthorityType(authorityUri) === AuthorityType.Default &&
+            this.protocolMode === ProtocolMode.AAD);
     }
     /**
      * Replaces tenant in url path with current tenant. Defaults to common.
@@ -7613,8 +7666,9 @@ class Authority {
         const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
         currentAuthorityParts.forEach((currentPart, index) => {
             let cachedPart = cachedAuthorityParts[index];
-            if (index === 0 && this.canReplaceTenant(cachedAuthorityUrlComponents)) {
-                const tenantId = (new UrlString(this.metadata.authorization_endpoint)).getUrlComponents().PathSegments[0];
+            if (index === 0 &&
+                this.canReplaceTenant(cachedAuthorityUrlComponents)) {
+                const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
                 /**
                  * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
                  * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
@@ -7635,8 +7689,9 @@ class Authority {
      * The default open id configuration endpoint for any canonical authority.
      */
     get defaultOpenIdConfigurationEndpoint() {
+        const canonicalAuthorityHost = this.hostnameAndPort;
         if (this.authorityType === AuthorityType.Adfs ||
-            this.protocolMode === ProtocolMode.OIDC) {
+            !this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost)) {
             return `${this.canonicalAuthority}.well-known/openid-configuration`;
         }
         return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
@@ -7679,41 +7734,65 @@ class Authority {
      */
     async updateEndpointMetadata(metadataEntity) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityUpdateEndpointMetadata, this.correlationId);
+        this.logger.verbose("Attempting to get endpoint metadata from authority configuration");
         let metadata = this.getEndpointMetadataFromConfig();
         if (metadata) {
+            this.logger.verbose("Found endpoint metadata in authority configuration");
             metadataEntity.updateEndpointMetadata(metadata, false);
             return AuthorityMetadataSource.CONFIG;
         }
+        this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.");
+        // skipAuthorityMetadataCache is used to bypass hardcoded authority metadata and force a network metadata cache lookup and network metadata request if no cached response is available.
+        if (this.authorityOptions.skipAuthorityMetadataCache) {
+            this.logger.verbose("Skipping hardcoded metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get endpoint metadata from the network metadata cache.");
+        }
+        else {
+            let hardcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
+            if (hardcodedMetadata) {
+                this.logger.verbose("Found endpoint metadata from hardcoded values.");
+                // If the user prefers to use an azure region replace the global endpoints with regional information.
+                if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
+                    this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
+                    this.logger.verbose("Found azure region configuration. Updating endpoints with regional information.");
+                    hardcodedMetadata =
+                        await this.updateMetadataWithRegionalInformation(hardcodedMetadata);
+                }
+                metadataEntity.updateEndpointMetadata(hardcodedMetadata, false);
+                return AuthorityMetadataSource.HARDCODED_VALUES;
+            }
+            else {
+                this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.");
+            }
+        }
+        // Check cached metadata entity expiration status
+        const metadataEntityExpired = metadataEntity.isExpired();
         if (this.isAuthoritySameType(metadataEntity) &&
             metadataEntity.endpointsFromNetwork &&
-            !metadataEntity.isExpired()) {
+            !metadataEntityExpired) {
             // No need to update
+            this.logger.verbose("Found endpoint metadata in the cache.");
             return AuthorityMetadataSource.CACHE;
         }
+        else if (metadataEntityExpired) {
+            this.logger.verbose("The metadata entity is expired.");
+        }
+        this.logger.verbose("Did not find cached endpoint metadata... Attempting to get endpoint metadata from the network.");
         this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork, this.correlationId);
         metadata = await this.getEndpointMetadataFromNetwork();
         if (metadata) {
+            this.logger.verbose("Endpoint metadata was successfully returned from getEndpointMetadataFromNetwork()");
             // If the user prefers to use an azure region replace the global endpoints with regional information.
             if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
                 this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
+                this.logger.verbose("Found azure region configuration. Updating endpoints with regional information.");
                 metadata = await this.updateMetadataWithRegionalInformation(metadata);
             }
             metadataEntity.updateEndpointMetadata(metadata, true);
             return AuthorityMetadataSource.NETWORK;
         }
-        let harcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
-        if (harcodedMetadata &&
-            !this.authorityOptions.skipAuthorityMetadataCache) {
-            // If the user prefers to use an azure region replace the global endpoints with regional information.
-            if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
-                this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
-                harcodedMetadata =
-                    await this.updateMetadataWithRegionalInformation(harcodedMetadata);
-            }
-            metadataEntity.updateEndpointMetadata(harcodedMetadata, false);
-            return AuthorityMetadataSource.HARDCODED_VALUES;
-        }
         else {
+            // Metadata could not be obtained from the config, cache, network or hardcoded values
+            this.logger.error("Did not find endpoint metadata from network... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
             throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
         }
     }
@@ -7762,17 +7841,23 @@ class Authority {
             const response = await this.networkInterface.sendGetRequestAsync(openIdConfigurationEndpoint, options);
             const isValidResponse = isOpenIdConfigResponse(response.body);
             if (isValidResponse) {
-                perfEvent?.endMeasurement({ success: true });
+                perfEvent?.end({ success: true });
                 return response.body;
             }
             else {
-                perfEvent?.endMeasurement({ success: false, errorCode: "invalid_response" });
+                perfEvent?.end({
+                    success: false,
+                    errorCode: "invalid_response",
+                });
                 this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration`);
                 return null;
             }
         }
         catch (e) {
-            perfEvent?.endMeasurement({ success: false, errorCode: "request_failure" });
+            perfEvent?.end({
+                success: false,
+                errorCode: "request_failure",
+            });
             this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: ${e}`);
             return null;
         }
@@ -7794,19 +7879,26 @@ class Authority {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
         const userConfiguredAzureRegion = this.authorityOptions.azureRegionConfiguration?.azureRegion;
         if (userConfiguredAzureRegion) {
-            if (userConfiguredAzureRegion !== Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
-                this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
-                this.regionDiscoveryMetadata.region_used = userConfiguredAzureRegion;
+            if (userConfiguredAzureRegion !==
+                Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
+                this.regionDiscoveryMetadata.region_outcome =
+                    RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                this.regionDiscoveryMetadata.region_used =
+                    userConfiguredAzureRegion;
                 return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
             }
             this.performanceClient?.setPreQueueTime(PerformanceEvents.RegionDiscoveryDetectRegion, this.correlationId);
-            const autodetectedRegionName = await this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration?.environmentRegion, this.regionDiscoveryMetadata);
+            const autodetectedRegionName = await this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration
+                ?.environmentRegion, this.regionDiscoveryMetadata);
             if (autodetectedRegionName) {
-                this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
-                this.regionDiscoveryMetadata.region_used = autodetectedRegionName;
+                this.regionDiscoveryMetadata.region_outcome =
+                    RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
+                this.regionDiscoveryMetadata.region_used =
+                    autodetectedRegionName;
                 return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
             }
-            this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
+            this.regionDiscoveryMetadata.region_outcome =
+                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
         }
         return metadata;
     }
@@ -7818,7 +7910,7 @@ class Authority {
      */
     async updateCloudDiscoveryMetadata(metadataEntity) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityUpdateCloudDiscoveryMetadata, this.correlationId);
-        this.logger.verbose("Attempting to get cloud discovery metadata in the config");
+        this.logger.verbose("Attempting to get cloud discovery metadata  from authority configuration");
         this.logger.verbosePii(`Known Authorities: ${this.authorityOptions.knownAuthorities ||
             Constants.NOT_APPLICABLE}`);
         this.logger.verbosePii(`Authority Metadata: ${this.authorityOptions.authorityMetadata ||
@@ -7826,17 +7918,29 @@ class Authority {
         this.logger.verbosePii(`Canonical Authority: ${metadataEntity.canonical_authority || Constants.NOT_APPLICABLE}`);
         let metadata = this.getCloudDiscoveryMetadataFromConfig();
         if (metadata) {
-            this.logger.verbose("Found cloud discovery metadata in the config.");
+            this.logger.verbose("Found cloud discovery metadata in authority configuration");
             metadataEntity.updateCloudDiscoveryMetadata(metadata, false);
             return AuthorityMetadataSource.CONFIG;
         }
-        // If the cached metadata came from config but that config was not passed to this instance, we must go to the network
-        this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the cache.");
+        // If the cached metadata came from config but that config was not passed to this instance, we must go to hardcoded values
+        this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.");
+        if (this.options.skipAuthorityMetadataCache) {
+            this.logger.verbose("Skipping hardcoded cloud discovery metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get cloud discovery metadata from the network metadata cache.");
+        }
+        else {
+            const hardcodedMetadata = this.getCloudDiscoveryMetadataFromHardcodedValues();
+            if (hardcodedMetadata) {
+                this.logger.verbose("Found cloud discovery metadata from hardcoded values.");
+                metadataEntity.updateCloudDiscoveryMetadata(hardcodedMetadata, false);
+                return AuthorityMetadataSource.HARDCODED_VALUES;
+            }
+            this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.");
+        }
         const metadataEntityExpired = metadataEntity.isExpired();
         if (this.isAuthoritySameType(metadataEntity) &&
             metadataEntity.aliasesFromNetwork &&
             !metadataEntityExpired) {
-            this.logger.verbose("Found metadata in the cache.");
+            this.logger.verbose("Found cloud discovery metadata in the cache.");
             // No need to update
             return AuthorityMetadataSource.CACHE;
         }
@@ -7851,15 +7955,8 @@ class Authority {
             metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
             return AuthorityMetadataSource.NETWORK;
         }
-        this.logger.verbose("Did not find cloud discovery metadata from the network... Attempting to get cloud discovery metadata from hardcoded values.");
-        const harcodedMetadata = this.getCloudDiscoveryMetadataFromHarcodedValues();
-        if (harcodedMetadata && !this.options.skipAuthorityMetadataCache) {
-            this.logger.verbose("Found cloud discovery metadata from hardcoded values.");
-            metadataEntity.updateCloudDiscoveryMetadata(harcodedMetadata, false);
-            return AuthorityMetadataSource.HARDCODED_VALUES;
-        }
         // Metadata could not be obtained from the config, cache, network or hardcoded values
-        this.logger.error("Did not find cloud discovery metadata from hardcoded values... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
+        this.logger.error("Did not find cloud discovery metadata from network... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
         throw ClientConfigurationError.createUntrustedAuthorityError();
     }
     /**
@@ -7964,9 +8061,11 @@ class Authority {
     /**
      * Get cloud discovery metadata for common authorities
      */
-    getCloudDiscoveryMetadataFromHarcodedValues() {
+    getCloudDiscoveryMetadataFromHardcodedValues() {
         if (this.canonicalAuthority in InstanceDiscoveryMetadata) {
-            return InstanceDiscoveryMetadata[this.canonicalAuthority];
+            const hardcodedMetadataResponse = InstanceDiscoveryMetadata[this.canonicalAuthority];
+            const metadata = Authority.getCloudDiscoveryMetadataFromNetworkResponse(hardcodedMetadataResponse.metadata, this.hostnameAndPort);
+            return metadata;
         }
         return null;
     }
@@ -8041,6 +8140,13 @@ class Authority {
     isAlias(host) {
         return this.metadata.aliases.indexOf(host) > -1;
     }
+    /**
+     * Returns whether or not the provided host is an alias of a known Microsoft authority for purposes of endpoint discovery
+     * @param host
+     */
+    isAliasOfKnownMicrosoftAuthority(host) {
+        return InstanceDiscoveryMetadataAliases.has(host);
+    }
     /**
      * Checks whether the provided host is that of a public cloud authority
      *
@@ -8082,15 +8188,17 @@ class Authority {
      * @param azureRegion string
      */
     static replaceWithRegionalInformation(metadata, azureRegion) {
-        metadata.authorization_endpoint =
-            Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
+        const regionalMetadata = { ...metadata };
+        regionalMetadata.authorization_endpoint =
+            Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
         // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
-        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
-        if (metadata.end_session_endpoint) {
-            metadata.end_session_endpoint =
-                Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+        regionalMetadata.token_endpoint =
+            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
+        if (regionalMetadata.end_session_endpoint) {
+            regionalMetadata.end_session_endpoint =
+                Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
         }
-        return metadata;
+        return regionalMetadata;
     }
     /**
      * Transform CIAM_AUTHORIY as per the below rules:
@@ -8102,11 +8210,14 @@ class Authority {
      * @param authority
      */
     static transformCIAMAuthority(authority) {
-        let ciamAuthority = authority.endsWith(Constants.FORWARD_SLASH) ? authority : `${authority}${Constants.FORWARD_SLASH}`;
+        let ciamAuthority = authority.endsWith(Constants.FORWARD_SLASH)
+            ? authority
+            : `${authority}${Constants.FORWARD_SLASH}`;
         const authorityUrl = new UrlString(authority);
         const authorityUrlComponents = authorityUrl.getUrlComponents();
         // check if transformation is needed
-        if (authorityUrlComponents.PathSegments.length === 0 && (authorityUrlComponents.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL))) {
+        if (authorityUrlComponents.PathSegments.length === 0 &&
+            authorityUrlComponents.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL)) {
             const tenantIdOrDomain = authorityUrlComponents.HostNameAndPort.split(".")[0];
             ciamAuthority = `${ciamAuthority}${tenantIdOrDomain}${Constants.AAD_TENANT_DOMAIN_SUFFIX}`;
         }
@@ -8114,15 +8225,15 @@ class Authority {
     }
 }
 // Reserved tenant domain names that will not be replaced with tenant id
-Authority.reservedTenantDomains = (new Set([
+Authority.reservedTenantDomains = new Set([
     "{tenant}",
     "{tenantid}",
     AADAuthorityConstants.COMMON,
     AADAuthorityConstants.CONSUMERS,
-    AADAuthorityConstants.ORGANIZATIONS
-]));
+    AADAuthorityConstants.ORGANIZATIONS,
+]);
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8172,7 +8283,7 @@ class AuthorityFactory {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8202,7 +8313,7 @@ class ServerTelemetryEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8228,7 +8339,7 @@ class ThrottlingEntity {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8245,7 +8356,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8287,7 +8398,7 @@ class JoseHeaderError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8326,7 +8437,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8384,7 +8495,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8583,7 +8694,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8600,8 +8711,10 @@ class PerformanceClient {
      * @param {Logger} logger Logger used by the application
      * @param {string} libraryName Name of the library
      * @param {string} libraryVersion Version of the library
+     * @param {ApplicationTelemetry} applicationTelemetry application name and version
+     * @param {Set<String>} intFields integer fields to be truncated
      */
-    constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
+    constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry, intFields) {
         this.authority = authority;
         this.libraryName = libraryName;
         this.libraryVersion = libraryVersion;
@@ -8612,6 +8725,10 @@ class PerformanceClient {
         this.eventsByCorrelationId = new Map();
         this.queueMeasurements = new Map();
         this.preQueueTimeByCorrelationId = new Map();
+        this.intFields = intFields || new Set();
+        for (const item of IntFields) {
+            this.intFields.add(item);
+        }
     }
     /**
      * Starts and returns an platform-specific implementation of IPerformanceMeasurement.
@@ -8626,13 +8743,6 @@ class PerformanceClient {
     ) {
         return {};
     }
-    /**
-     * Get integral fields.
-     * Override to change the set.
-     */
-    getIntFields() {
-        return IntFields;
-    }
     /**
      * Gets map of pre-queue times by correlation Id
      *
@@ -8750,7 +8860,7 @@ class PerformanceClient {
         this.cacheEventByCorrelationId(inProgressEvent);
         // Return the event and functions the caller can use to properly end/flush the measurement
         return {
-            endMeasurement: (event) => {
+            end: (event) => {
                 return this.endMeasurement({
                     // Initial set of event properties
                     ...inProgressEvent,
@@ -8758,14 +8868,14 @@ class PerformanceClient {
                     ...event,
                 }, performanceMeasurement);
             },
-            discardMeasurement: () => {
+            discard: () => {
                 return this.discardMeasurements(inProgressEvent.correlationId);
             },
-            addStaticFields: (fields) => {
-                return this.addStaticFields(fields, inProgressEvent.correlationId);
+            add: (fields) => {
+                return this.addFields(fields, inProgressEvent.correlationId);
             },
-            increment: (counters) => {
-                return this.increment(counters, inProgressEvent.correlationId);
+            increment: (fields) => {
+                return this.incrementFields(fields, inProgressEvent.correlationId);
             },
             measurement: performanceMeasurement,
             event: inProgressEvent,
@@ -8830,7 +8940,7 @@ class PerformanceClient {
             status: PerformanceEventStatus.Completed,
             incompleteSubsCount,
         };
-        this.truncateIntegralFields(finalEvent, this.getIntFields());
+        this.truncateIntegralFields(finalEvent);
         this.emitEvents([finalEvent], event.correlationId);
         return finalEvent;
     }
@@ -8839,7 +8949,7 @@ class PerformanceClient {
      * @param fields
      * @param correlationId
      */
-    addStaticFields(fields, correlationId) {
+    addFields(fields, correlationId) {
         this.logger.trace("PerformanceClient: Updating static fields");
         const event = this.eventsByCorrelationId.get(correlationId);
         if (event) {
@@ -8854,18 +8964,21 @@ class PerformanceClient {
     }
     /**
      * Increment counters to be emitted when the measurements are flushed
-     * @param counters {Counters}
+     * @param fields {string[]}
      * @param correlationId {string} correlation identifier
      */
-    increment(counters, correlationId) {
+    incrementFields(fields, correlationId) {
         this.logger.trace("PerformanceClient: Updating counters");
         const event = this.eventsByCorrelationId.get(correlationId);
         if (event) {
-            for (const counter in counters) {
+            for (const counter in fields) {
                 if (!event.hasOwnProperty(counter)) {
                     event[counter] = 0;
                 }
-                event[counter] += counters[counter];
+                else if (isNaN(Number(event[counter]))) {
+                    return;
+                }
+                event[counter] += fields[counter];
             }
         }
         else {
@@ -8983,8 +9096,8 @@ class PerformanceClient {
      * @param {PerformanceEvent} event performance event to update.
      * @param {Set<string>} intFields integral fields.
      */
-    truncateIntegralFields(event, intFields) {
-        intFields.forEach((key) => {
+    truncateIntegralFields(event) {
+        this.intFields.forEach((key) => {
             if (key in event && typeof event[key] === "number") {
                 event[key] = Math.floor(event[key]);
             }
@@ -8992,16 +9105,22 @@ class PerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 class StubPerformanceMeasurement {
-    startMeasurement() { return; }
-    endMeasurement() { return; }
-    flushMeasurement() { return null; }
+    startMeasurement() {
+        return;
+    }
+    endMeasurement() {
+        return;
+    }
+    flushMeasurement() {
+        return null;
+    }
 }
 class StubPerformanceClient extends PerformanceClient {
     generateId() {
@@ -9013,8 +9132,36 @@ class StubPerformanceClient extends PerformanceClient {
     calculateQueuedTime() {
         return 0;
     }
-    addQueueMeasurement() { return; }
-    setPreQueueTime() { return; }
+    addQueueMeasurement() {
+        return;
+    }
+    setPreQueueTime() {
+        return;
+    }
+    endMeasurement() {
+        return null;
+    }
+    discardMeasurements() {
+        return;
+    }
+    removePerformanceCallback() {
+        return true;
+    }
+    addPerformanceCallback() {
+        return "";
+    }
+    emitEvents() {
+        return;
+    }
+    addFields() {
+        return;
+    }
+    incrementFields() {
+        return;
+    }
+    cacheEventByCorrelationId() {
+        return;
+    }
 }
 
 /*
@@ -9197,9 +9344,9 @@ const BrowserAuthErrorMessage = {
         code: "native_connection_not_established",
         desc: "Connection to native platform has not been established. Please install a compatible browser extension and run initialize(). For more please visit aka.ms/msaljs/browser-errors.",
     },
-    nativeBrokerCalledBeforeInitialize: {
-        code: "native_broker_called_before_initialize",
-        desc: "You must call and await the initialize function before attempting to call any other MSAL API when native brokering is enabled. For more please visit aka.ms/msaljs/browser-errors.",
+    uninitializedPublicClientApplication: {
+        code: "uninitialized_public_client_application",
+        desc: "You must call and await the initialize function before attempting to call any other MSAL API. For more please visit aka.ms/msaljs/browser-errors.",
     },
     nativePromptNotSupported: {
         code: "native_prompt_not_supported",
@@ -9489,8 +9636,8 @@ class BrowserAuthError extends AuthError {
     /**
      * Create an error thrown when the initialize function hasn't been called
      */
-    static createNativeBrokerCalledBeforeInitialize() {
-        return new BrowserAuthError(BrowserAuthErrorMessage.nativeBrokerCalledBeforeInitialize.code, BrowserAuthErrorMessage.nativeBrokerCalledBeforeInitialize.desc);
+    static createUninitializedPublicClientApplication() {
+        return new BrowserAuthError(BrowserAuthErrorMessage.uninitializedPublicClientApplication.code, BrowserAuthErrorMessage.uninitializedPublicClientApplication.desc);
     }
     /**
      * Create an error thrown when requesting a token directly from the native platform with an unsupported prompt parameter e.g. select_account, login or create
@@ -11171,6 +11318,23 @@ class BrowserCacheManager extends CacheManager {
     setRedirectRequestContext(value) {
         this.setTemporaryCache(TemporaryCacheKeys.REDIRECT_CONTEXT, value, true);
     }
+    /**
+     * Builds credential entities from AuthenticationResult object and saves the resulting credentials to the cache
+     * @param result
+     * @param request
+     */
+    async hydrateCache(result, request) {
+        const idTokenEntity = IdTokenEntity.createIdTokenEntity(result.account?.homeAccountId, result.account?.environment, result.idToken, this.clientId, result.tenantId);
+        let claimsHash;
+        if (request.claims) {
+            claimsHash = await this.cryptoImpl.hashString(request.claims);
+        }
+        const accessTokenEntity = AccessTokenEntity.createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn?.getTime() || 0, result.extExpiresOn?.getTime() || 0, this.cryptoImpl, undefined, // refreshOn
+        result.tokenType, undefined, // userAssertionHash
+        request.sshKid, request.claims, claimsHash);
+        const cacheRecord = new CacheRecord(undefined, idTokenEntity, accessTokenEntity);
+        return this.saveCacheRecord(cacheRecord);
+    }
 }
 const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger) => {
     const cacheOptions = {
@@ -11184,20 +11348,9 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger) => {
     return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger);
 };
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class CacheRecord extends CacheRecord$1 {
-    constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
-        super(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity);
-        this.account = accountEntity;
-    }
-}
-
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.0.0-beta.1";
+const version = "3.0.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11533,13 +11686,12 @@ class BrowserUtils {
         }
     }
     /**
-     * Throws error if native brokering is enabled but initialize hasn't been called
-     * @param allowNativeBroker
+     * Throws error if initialize hasn't been called
      * @param initialized
      */
-    static blockNativeBrokerCalledBeforeInitialized(allowNativeBroker, initialized) {
-        if (allowNativeBroker && !initialized) {
-            throw BrowserAuthError.createNativeBrokerCalledBeforeInitialize();
+    static blockAPICallsBeforeInitialize(initialized) {
+        if (!initialized) {
+            throw BrowserAuthError.createUninitializedPublicClientApplication();
         }
     }
     /**
@@ -11698,6 +11850,7 @@ class BaseInteractionClient {
         this.logger.verbose("getDiscoveredAuthority called");
         const authorityOptions = {
             protocolMode: this.config.auth.protocolMode,
+            OIDCOptions: this.config.auth.OIDCOptions,
             knownAuthorities: this.config.auth.knownAuthorities,
             cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
             authorityMetadata: this.config.auth.authorityMetadata,
@@ -11907,6 +12060,7 @@ class StandardInteractionClient extends BaseInteractionClient {
         const getAuthorityMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.correlationId);
         const authorityOptions = {
             protocolMode: this.config.auth.protocolMode,
+            OIDCOptions: this.config.auth.OIDCOptions,
             knownAuthorities: this.config.auth.knownAuthorities,
             cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
             authorityMetadata: this.config.auth.authorityMetadata,
@@ -11922,13 +12076,13 @@ class StandardInteractionClient extends BaseInteractionClient {
         this.performanceClient.setPreQueueTime(PerformanceEvents.AuthorityFactoryCreateDiscoveredInstance, this.correlationId);
         return await AuthorityFactory.createDiscoveredInstance(builtAuthority, this.config.system.networkClient, this.browserStorage, authorityOptions, this.logger, this.performanceClient, this.correlationId)
             .then((result) => {
-            getAuthorityMeasurement.endMeasurement({
+            getAuthorityMeasurement.end({
                 success: true,
             });
             return result;
         })
             .catch((error) => {
-            getAuthorityMeasurement.endMeasurement({
+            getAuthorityMeasurement.end({
                 errorCode: error.errorCode,
                 subErrorCode: error.subError,
                 success: false,
@@ -11955,7 +12109,8 @@ class StandardInteractionClient extends BaseInteractionClient {
             redirectUri: redirectUri,
             state: state,
             nonce: request.nonce || this.browserCrypto.createNewGuid(),
-            responseMode: ResponseMode.FRAGMENT,
+            responseMode: this.config.auth.OIDCOptions
+                .serverResponseType,
         };
         const account = request.account || this.browserStorage.getActiveAccount();
         if (account) {
@@ -12067,7 +12222,7 @@ class InteractionHandler {
         }
         // Acquire token with retrieved code.
         this.performanceClient.setPreQueueTime(PerformanceEvents.AuthClientAcquireToken, this.authCodeRequest.correlationId);
-        const tokenResponse = await this.authModule.acquireToken(this.authCodeRequest, authCodeResponse);
+        const tokenResponse = (await this.authModule.acquireToken(this.authCodeRequest, authCodeResponse));
         this.browserStorage.cleanRequestByState(state);
         return tokenResponse;
     }
@@ -12215,7 +12370,7 @@ class RedirectHandler extends InteractionHandler {
             }
         }
         // Acquire token with retrieved code.
-        const tokenResponse = await this.authModule.acquireToken(this.authCodeRequest, authCodeResponse);
+        const tokenResponse = (await this.authModule.acquireToken(this.authCodeRequest, authCodeResponse));
         this.browserStorage.cleanRequestByState(state);
         return tokenResponse;
     }
@@ -12250,7 +12405,7 @@ const EventType = {
     LOGOUT_SUCCESS: "msal:logoutSuccess",
     LOGOUT_FAILURE: "msal:logoutFailure",
     LOGOUT_END: "msal:logoutEnd",
-    RESTORE_FROM_BFCACHE: "msal:restoreFromBFCache"
+    RESTORE_FROM_BFCACHE: "msal:restoreFromBFCache",
 };
 
 /*
@@ -12363,8 +12518,8 @@ class SilentCacheClient extends StandardInteractionClient {
         const silentAuthClient = await this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions);
         this.logger.verbose("Silent auth client created");
         try {
-            const cachedToken = await silentAuthClient.acquireCachedToken(silentRequest);
-            acquireTokenMeasurement.endMeasurement({
+            const cachedToken = (await silentAuthClient.acquireCachedToken(silentRequest));
+            acquireTokenMeasurement.end({
                 success: true,
                 fromCache: true,
             });
@@ -12376,7 +12531,7 @@ class SilentCacheClient extends StandardInteractionClient {
                     BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
                 this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
             }
-            acquireTokenMeasurement.endMeasurement({
+            acquireTokenMeasurement.end({
                 errorCode: (error instanceof AuthError && error.errorCode) ||
                     undefined,
                 subErrorCode: (error instanceof AuthError && error.subError) || undefined,
@@ -12408,7 +12563,7 @@ class SilentCacheClient extends StandardInteractionClient {
         this.performanceClient.setPreQueueTime(PerformanceEvents.InitializeBaseRequest, this.correlationId);
         return {
             ...request,
-            ...await this.initializeBaseRequest(request, account),
+            ...(await this.initializeBaseRequest(request, account)),
             account: account,
             forceRefresh: request.forceRefresh || false,
         };
@@ -12442,7 +12597,7 @@ class NativeInteractionClient extends BaseInteractionClient {
         // check if the tokens can be retrieved from internal cache
         try {
             const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
-            nativeATMeasurement.endMeasurement({
+            nativeATMeasurement.end({
                 success: true,
                 isNativeBroker: false,
                 fromCache: true,
@@ -12462,7 +12617,7 @@ class NativeInteractionClient extends BaseInteractionClient {
         const validatedResponse = this.validateNativeResponse(response);
         return this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
             .then((result) => {
-            nativeATMeasurement.endMeasurement({
+            nativeATMeasurement.end({
                 success: true,
                 isNativeBroker: true,
                 requestId: result.requestId,
@@ -12470,7 +12625,7 @@ class NativeInteractionClient extends BaseInteractionClient {
             return result;
         })
             .catch((error) => {
-            nativeATMeasurement.endMeasurement({
+            nativeATMeasurement.end({
                 success: false,
                 errorCode: error.errorCode,
                 subErrorCode: error.subError,
@@ -12516,7 +12671,10 @@ class NativeInteractionClient extends BaseInteractionClient {
         try {
             const silentRequest = this.createSilentCacheRequest(request, account);
             const result = await this.silentCacheClient.acquireToken(silentRequest);
-            return result;
+            return {
+                ...result,
+                account,
+            };
         }
         catch (e) {
             throw e;
@@ -12614,16 +12772,20 @@ class NativeInteractionClient extends BaseInteractionClient {
         }
         // Get the preferred_cache domain for the given authority
         const authority = await this.getDiscoveredAuthority(request.authority);
-        const authorityPreferredCache = authority.getPreferredCache();
         // generate identifiers
         const idTokenObj = this.createIdTokenObj(response);
         const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenObj);
-        const accountEntity = this.createAccountEntity(response, homeAccountIdentifier, idTokenObj, authorityPreferredCache);
+        const accountEntity = AccountEntity.createAccount({
+            homeAccountId: homeAccountIdentifier,
+            idTokenClaims: idTokenObj.claims,
+            clientInfo: response.client_info,
+            nativeAccountId: response.account.id,
+        }, authority);
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(response, request, idTokenObj, accountEntity, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
         this.cacheAccount(accountEntity);
-        this.cacheNativeTokens(response, request, homeAccountIdentifier, accountEntity, idTokenObj, result.accessToken, result.tenantId, reqTimestamp);
+        this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenObj, result.accessToken, result.tenantId, reqTimestamp);
         return result;
     }
     /**
@@ -12642,20 +12804,9 @@ class NativeInteractionClient extends BaseInteractionClient {
      */
     createHomeAccountIdentifier(response, idTokenObj) {
         // Save account in browser storage
-        const homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj);
+        const homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj.claims);
         return homeAccountIdentifier;
     }
-    /**
-     * Creates account entity
-     * @param response
-     * @param homeAccountIdentifier
-     * @param idTokenObj
-     * @param authority
-     * @returns
-     */
-    createAccountEntity(response, homeAccountIdentifier, idTokenObj, authority) {
-        return AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, authority, response.account.id);
-    }
     /**
      * Helper to generate scopes
      * @param response
@@ -12774,7 +12925,7 @@ class NativeInteractionClient extends BaseInteractionClient {
      * @param tenantId
      * @param reqTimestamp
      */
-    cacheNativeTokens(response, request, homeAccountIdentifier, accountEntity, idTokenObj, responseAccessToken, tenantId, reqTimestamp) {
+    cacheNativeTokens(response, request, homeAccountIdentifier, idTokenObj, responseAccessToken, tenantId, reqTimestamp) {
         const cachedIdToken = IdTokenEntity.createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || Constants.EMPTY_STRING, request.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
         // cache accessToken in inmemory storage
         const expiresIn = request.tokenType === AuthenticationScheme.POP
@@ -12787,15 +12938,15 @@ class NativeInteractionClient extends BaseInteractionClient {
         const cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenObj
             ? idTokenObj.claims.tid || Constants.EMPTY_STRING
             : tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, this.browserCrypto);
-        const nativeCacheRecord = new CacheRecord(accountEntity, cachedIdToken, cachedAccessToken);
-        this.nativeStorageManager.saveCacheRecord(nativeCacheRecord);
+        const nativeCacheRecord = new CacheRecord(undefined, cachedIdToken, cachedAccessToken);
+        this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
     }
     addTelemetryFromNativeResponse(response) {
         const mats = this.getMATSFromResponse(response);
         if (!mats) {
             return null;
         }
-        this.performanceClient.addStaticFields({
+        this.performanceClient.addFields({
             extensionId: this.nativeMessageHandler.getExtensionId(),
             extensionVersion: this.nativeMessageHandler.getExtensionVersion(),
             matsBrokerVersion: mats.broker_version,
@@ -13008,7 +13159,7 @@ class NativeMessageHandler {
                 method: NativeExtensionMethod.HandshakeRequest,
             },
         };
-        this.handshakeEvent.addStaticFields({
+        this.handshakeEvent.add({
             extensionId: this.extensionId,
             extensionHandshakeTimeoutMs: this.handshakeTimeoutMs,
         });
@@ -13026,7 +13177,7 @@ class NativeMessageHandler {
                 window.removeEventListener("message", this.windowListener, false);
                 this.messageChannel.port1.close();
                 this.messageChannel.port2.close();
-                this.handshakeEvent.endMeasurement({
+                this.handshakeEvent.end({
                     extensionHandshakeTimedOut: true,
                     success: false,
                 });
@@ -13071,7 +13222,7 @@ class NativeMessageHandler {
             this.messageChannel.port1.close();
             this.messageChannel.port2.close();
             window.removeEventListener("message", this.windowListener, false);
-            this.handshakeEvent.endMeasurement({
+            this.handshakeEvent.end({
                 success: false,
                 extensionInstalled: false,
             });
@@ -13123,7 +13274,7 @@ class NativeMessageHandler {
                 this.extensionId = request.extensionId;
                 this.extensionVersion = request.body.version;
                 this.logger.verbose(`NativeMessageHandler - Received HandshakeResponse from extension: ${this.extensionId}`);
-                this.handshakeEvent.endMeasurement({
+                this.handshakeEvent.end({
                     extensionInstalled: true,
                     success: true,
                 });
@@ -13432,6 +13583,18 @@ class RedirectClient extends StandardInteractionClient {
             this.performanceClient.setPreQueueTime(PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, validLogoutRequest.correlationId);
             const authClient = await this.createAuthCodeClient(serverTelemetryManager, logoutRequest && logoutRequest.authority);
             this.logger.verbose("Auth code client created");
+            if (authClient.authority.protocolMode === ProtocolMode.OIDC) {
+                try {
+                    authClient.authority.endSessionEndpoint;
+                }
+                catch {
+                    if (validLogoutRequest.account?.homeAccountId) {
+                        this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId);
+                        this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Redirect, validLogoutRequest);
+                        return;
+                    }
+                }
+            }
             // Create logout string and navigate user window to logout.
             const logoutUri = authClient.getLogoutUri(validLogoutRequest);
             this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Redirect, validLogoutRequest);
@@ -13606,7 +13769,7 @@ class PopupClient extends StandardInteractionClient {
                 this.logger.verbose("Account id found in hash, calling WAM for token");
                 // end measurement for server call with native brokering enabled
                 if (fetchNativeAccountIdMeasurement) {
-                    fetchNativeAccountIdMeasurement.endMeasurement({
+                    fetchNativeAccountIdMeasurement.end({
                         success: true,
                         isNativeBroker: true,
                     });
@@ -13663,6 +13826,30 @@ class PopupClient extends StandardInteractionClient {
             this.performanceClient.setPreQueueTime(PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, validRequest.correlationId);
             const authClient = await this.createAuthCodeClient(serverTelemetryManager, requestAuthority);
             this.logger.verbose("Auth code client created");
+            try {
+                authClient.authority.endSessionEndpoint;
+            }
+            catch {
+                if (validRequest.account?.homeAccountId &&
+                    validRequest.postLogoutRedirectUri &&
+                    authClient.authority.protocolMode === ProtocolMode.OIDC) {
+                    this.browserStorage.removeAccount(validRequest.account?.homeAccountId);
+                    this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
+                    if (mainWindowRedirectUri) {
+                        const navigationOptions = {
+                            apiId: ApiId.logoutPopup,
+                            timeout: this.config.system.redirectNavigationTimeout,
+                            noHistory: false,
+                        };
+                        const absoluteUrl = UrlString.getAbsoluteUrl(mainWindowRedirectUri, BrowserUtils.getCurrentUri());
+                        await this.navigationClient.navigateInternal(absoluteUrl, navigationOptions);
+                    }
+                    if (popup) {
+                        popup.close();
+                    }
+                    return;
+                }
+            }
             // Create logout string and navigate user window to logout.
             const logoutUri = authClient.getLogoutUri(validRequest);
             this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
@@ -13747,7 +13934,7 @@ class PopupClient extends StandardInteractionClient {
                     return;
                 }
                 let href = Constants.EMPTY_STRING;
-                let hash = Constants.EMPTY_STRING;
+                let serverResponseString = Constants.EMPTY_STRING;
                 try {
                     /*
                      * Will throw if cross origin,
@@ -13755,7 +13942,8 @@ class PopupClient extends StandardInteractionClient {
                      * since we need the interval to keep running while on STS UI.
                      */
                     href = popupWindow.location.href;
-                    hash = popupWindow.location.hash;
+                    serverResponseString =
+                        this.extractServerResponseStringFromPopup(popupWindow, href);
                 }
                 catch (e) { }
                 // Don't process blank pages or cross domain
@@ -13768,17 +13956,17 @@ class PopupClient extends StandardInteractionClient {
                  * as popup operations can take a long time.
                  */
                 ticks++;
-                if (hash) {
+                if (serverResponseString) {
                     this.logger.verbose("PopupHandler.monitorPopupForHash - found hash in url");
                     clearInterval(intervalId);
                     this.cleanPopup(popupWindow);
-                    if (UrlString.hashContainsKnownProperties(hash)) {
+                    if (UrlString.hashContainsKnownProperties(serverResponseString)) {
                         this.logger.verbose("PopupHandler.monitorPopupForHash - hash contains known properties, returning.");
-                        resolve(hash);
+                        resolve(serverResponseString);
                     }
                     else {
                         this.logger.error("PopupHandler.monitorPopupForHash - found hash in url but it does not contain known properties. Check that your router is not changing the hash prematurely.");
-                        this.logger.errorPii(`PopupHandler.monitorPopupForHash - hash found: ${hash}`);
+                        this.logger.errorPii(`PopupHandler.monitorPopupForHash - hash found: ${serverResponseString}`);
                         reject(BrowserAuthError.createHashDoesNotContainKnownPropertiesError());
                     }
                 }
@@ -13959,6 +14147,20 @@ class PopupClient extends StandardInteractionClient {
         const homeAccountId = request.account && request.account.homeAccountId;
         return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
     }
+    /**
+     * Extracts the server response from the popup window
+     */
+    extractServerResponseStringFromPopup(popupWindow, href) {
+        let serverResponseString;
+        if (this.config.auth.OIDCOptions?.serverResponseType ===
+            ServerResponseType.QUERY) {
+            serverResponseString = UrlString.parseQueryServerResponse(href);
+        }
+        else {
+            serverResponseString = popupWindow.location.hash;
+        }
+        return serverResponseString;
+    }
 }
 
 /*
@@ -14033,6 +14235,14 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         navigateToLoginRequestUrl: true,
         clientCapabilities: [],
         protocolMode: ProtocolMode.AAD,
+        OIDCOptions: {
+            serverResponseType: ServerResponseType.FRAGMENT,
+            defaultScopes: [
+                Constants.OPENID_SCOPE,
+                Constants.PROFILE_SCOPE,
+                Constants.OFFLINE_ACCESS_SCOPE,
+            ],
+        },
         azureCloudOptions: {
             azureCloudInstance: AzureCloudInstance.None,
             tenant: Constants.EMPTY_STRING,
@@ -14077,7 +14287,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS,
         asyncPopups: false,
         allowRedirectInIframe: false,
-        allowNativeBroker: true,
+        allowNativeBroker: false,
         nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
         pollIntervalMilliseconds: BrowserConstants.DEFAULT_POLL_INTERVAL_MS,
@@ -14091,9 +14301,33 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
             appName: Constants.EMPTY_STRING,
             appVersion: Constants.EMPTY_STRING,
         },
+        client: new StubPerformanceClient(DEFAULT_AUTH_OPTIONS.clientId, DEFAULT_AUTH_OPTIONS.authority, new Logger(DEFAULT_LOGGER_OPTIONS, name, version), name, version, {
+            appName: Constants.EMPTY_STRING,
+            appVersion: Constants.EMPTY_STRING,
+        }),
     };
+    // Throw an error if user has set OIDCOptions without being in OIDC protocol mode
+    if (userInputAuth?.protocolMode !== ProtocolMode.OIDC &&
+        userInputAuth?.OIDCOptions) {
+        // Logger has not been created yet
+        // eslint-disable-next-line no-console
+        console.warn(ClientConfigurationError.createCannotSetOIDCOptionsError());
+    }
+    // Throw an error if user has set allowNativeBroker to true without being in AAD protocol mode
+    if (userInputAuth?.protocolMode &&
+        userInputAuth.protocolMode !== ProtocolMode.AAD &&
+        providedSystemOptions?.allowNativeBroker) {
+        throw ClientConfigurationError.createCannotAllowNativeBrokerError();
+    }
     const overlayedConfig = {
-        auth: { ...DEFAULT_AUTH_OPTIONS, ...userInputAuth },
+        auth: {
+            ...DEFAULT_AUTH_OPTIONS,
+            ...userInputAuth,
+            OIDCOptions: {
+                ...DEFAULT_AUTH_OPTIONS.OIDCOptions,
+                ...userInputAuth?.OIDCOptions,
+            },
+        },
         cache: { ...DEFAULT_CACHE_OPTIONS, ...userInputCache },
         system: { ...DEFAULT_BROWSER_SYSTEM_OPTIONS, ...providedSystemOptions },
         telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...userInputTelemetry },
@@ -14292,7 +14526,7 @@ class SilentIframeClient extends StandardInteractionClient {
         if (request.prompt &&
             request.prompt !== PromptValue.NONE &&
             request.prompt !== PromptValue.NO_SESSION) {
-            acquireTokenMeasurement.endMeasurement({
+            acquireTokenMeasurement.end({
                 success: false,
             });
             throw BrowserAuthError.createSilentPromptValueError(request.prompt);
@@ -14312,7 +14546,7 @@ class SilentIframeClient extends StandardInteractionClient {
             this.logger.verbose("Auth code client created");
             this.performanceClient.setPreQueueTime(PerformanceEvents.SilentIframeClientTokenHelper, request.correlationId);
             return await this.silentTokenHelper(authClient, silentRequest).then((result) => {
-                acquireTokenMeasurement.endMeasurement({
+                acquireTokenMeasurement.end({
                     success: true,
                     fromCache: false,
                     requestId: result.requestId,
@@ -14326,7 +14560,7 @@ class SilentIframeClient extends StandardInteractionClient {
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             this.browserStorage.cleanRequestByState(silentRequest.state);
-            acquireTokenMeasurement.endMeasurement({
+            acquireTokenMeasurement.end({
                 errorCode: (e instanceof AuthError && e.errorCode) || undefined,
                 subErrorCode: (e instanceof AuthError && e.subError) || undefined,
                 success: false,
@@ -14406,7 +14640,7 @@ class SilentRefreshClient extends StandardInteractionClient {
         this.performanceClient.setPreQueueTime(PerformanceEvents.InitializeBaseRequest, request.correlationId);
         const silentRequest = {
             ...request,
-            ...await this.initializeBaseRequest(request, request.account)
+            ...(await this.initializeBaseRequest(request, request.account)),
         };
         const acquireTokenMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.SilentRefreshClientAcquireToken, silentRequest.correlationId);
         const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow);
@@ -14418,7 +14652,7 @@ class SilentRefreshClient extends StandardInteractionClient {
             .acquireTokenByRefreshToken(silentRequest)
             .then((result) => result)
             .then((result) => {
-            acquireTokenMeasurement.endMeasurement({
+            acquireTokenMeasurement.end({
                 success: true,
                 fromCache: result.fromCache,
                 requestId: result.requestId,
@@ -14428,7 +14662,7 @@ class SilentRefreshClient extends StandardInteractionClient {
             .catch((e) => {
             e.setCorrelationId(this.correlationId);
             serverTelemetryManager.cacheFailedRequest(e);
-            acquireTokenMeasurement.endMeasurement({
+            acquireTokenMeasurement.end({
                 errorCode: e.errorCode,
                 subErrorCode: e.subError,
                 success: false,
@@ -15606,7 +15840,7 @@ class CryptoOps {
             requestUri: request.resourceRequestUri,
         });
         if (publicKeyThumbMeasurement) {
-            publicKeyThumbMeasurement.endMeasurement({
+            publicKeyThumbMeasurement.end({
                 success: true,
             });
         }
@@ -15662,7 +15896,7 @@ class CryptoOps {
         const encodedSignature = this.b64Encode.urlEncodeArr(new Uint8Array(signatureBuffer));
         const signedJwt = `${tokenString}.${encodedSignature}`;
         if (signJwtMeasurement) {
-            signJwtMeasurement.endMeasurement({
+            signJwtMeasurement.end({
                 success: true,
             });
         }
@@ -15685,231 +15919,16 @@ CryptoOps.EXTRACTABLE = true;
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-class BrowserPerformanceMeasurement {
-    constructor(name, correlationId) {
-        this.correlationId = correlationId;
-        this.measureName = BrowserPerformanceMeasurement.makeMeasureName(name, correlationId);
-        this.startMark = BrowserPerformanceMeasurement.makeStartMark(name, correlationId);
-        this.endMark = BrowserPerformanceMeasurement.makeEndMark(name, correlationId);
-    }
-    static makeMeasureName(name, correlationId) {
-        return `msal.measure.${name}.${correlationId}`;
-    }
-    static makeStartMark(name, correlationId) {
-        return `msal.start.${name}.${correlationId}`;
-    }
-    static makeEndMark(name, correlationId) {
-        return `msal.end.${name}.${correlationId}`;
-    }
-    static supportsBrowserPerformance() {
-        return (typeof window !== "undefined" &&
-            typeof window.performance !== "undefined" &&
-            typeof window.performance.mark === "function" &&
-            typeof window.performance.measure === "function" &&
-            typeof window.performance.clearMarks === "function" &&
-            typeof window.performance.clearMeasures === "function" &&
-            typeof window.performance.getEntriesByName === "function");
-    }
-    /**
-     * Flush browser marks and measurements.
-     * @param {string} correlationId
-     * @param {SubMeasurement} measurements
-     */
-    static flushMeasurements(correlationId, measurements) {
-        if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
-            try {
-                measurements.forEach((measurement) => {
-                    const measureName = BrowserPerformanceMeasurement.makeMeasureName(measurement.name, correlationId);
-                    const entriesForMeasurement = window.performance.getEntriesByName(measureName, "measure");
-                    if (entriesForMeasurement.length > 0) {
-                        window.performance.clearMeasures(measureName);
-                        window.performance.clearMarks(BrowserPerformanceMeasurement.makeStartMark(measureName, correlationId));
-                        window.performance.clearMarks(BrowserPerformanceMeasurement.makeEndMark(measureName, correlationId));
-                    }
-                });
-            }
-            catch (e) {
-                // Silently catch and return null
-            }
-        }
-    }
-    startMeasurement() {
-        if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
-            try {
-                window.performance.mark(this.startMark);
-            }
-            catch (e) {
-                // Silently catch
-            }
-        }
-    }
-    endMeasurement() {
-        if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
-            try {
-                window.performance.mark(this.endMark);
-                window.performance.measure(this.measureName, this.startMark, this.endMark);
-            }
-            catch (e) {
-                // Silently catch
-            }
-        }
-    }
-    flushMeasurement() {
-        if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
-            try {
-                const entriesForMeasurement = window.performance.getEntriesByName(this.measureName, "measure");
-                if (entriesForMeasurement.length > 0) {
-                    const durationMs = entriesForMeasurement[0].duration;
-                    window.performance.clearMeasures(this.measureName);
-                    window.performance.clearMarks(this.startMark);
-                    window.performance.clearMarks(this.endMark);
-                    return durationMs;
-                }
-            }
-            catch (e) {
-                // Silently catch and return null
-            }
-        }
-        return null;
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class BrowserPerformanceClient extends PerformanceClient {
-    constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
-        super(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry);
-        this.browserCrypto = new BrowserCrypto(this.logger);
-        this.guidGenerator = new GuidGenerator(this.browserCrypto);
-    }
-    startPerformanceMeasurement(measureName, correlationId) {
-        return new BrowserPerformanceMeasurement(measureName, correlationId);
-    }
-    generateId() {
-        return this.guidGenerator.generateGuid();
-    }
-    getPageVisibility() {
-        return document.visibilityState?.toString() || null;
-    }
-    deleteIncompleteSubMeasurements(inProgressEvent) {
-        const rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
-        const isRootEvent = rootEvent && rootEvent.eventId === inProgressEvent.event.eventId;
-        const incompleteMeasurements = [];
-        if (isRootEvent && rootEvent?.incompleteSubMeasurements) {
-            rootEvent.incompleteSubMeasurements.forEach((subMeasurement) => {
-                incompleteMeasurements.push({ ...subMeasurement });
-            });
-        }
-        // Clean up remaining marks for incomplete sub-measurements
-        if (incompleteMeasurements.length > 0) {
-            BrowserPerformanceMeasurement.flushMeasurements(inProgressEvent.event.correlationId, incompleteMeasurements);
-        }
-    }
-    supportsBrowserPerformanceNow() {
-        return (typeof window !== "undefined" &&
-            typeof window.performance !== "undefined" &&
-            typeof window.performance.now === "function");
-    }
-    /**
-     * Starts measuring performance for a given operation. Returns a function that should be used to end the measurement.
-     * Also captures browser page visibilityState.
-     *
-     * @param {PerformanceEvents} measureName
-     * @param {?string} [correlationId]
-     * @returns {((event?: Partial<PerformanceEvent>) => PerformanceEvent| null)}
-     */
-    startMeasurement(measureName, correlationId) {
-        // Capture page visibilityState and then invoke start/end measurement
-        const startPageVisibility = this.getPageVisibility();
-        const inProgressEvent = super.startMeasurement(measureName, correlationId);
-        return {
-            ...inProgressEvent,
-            endMeasurement: (event) => {
-                const res = inProgressEvent.endMeasurement({
-                    startPageVisibility,
-                    endPageVisibility: this.getPageVisibility(),
-                    ...event,
-                });
-                this.deleteIncompleteSubMeasurements(inProgressEvent);
-                return res;
-            },
-            discardMeasurement: () => {
-                inProgressEvent.discardMeasurement();
-                this.deleteIncompleteSubMeasurements(inProgressEvent);
-                inProgressEvent.measurement.flushMeasurement();
-            },
-        };
-    }
-    /**
-     * Adds pre-queue time to preQueueTimeByCorrelationId map.
-     * @param {PerformanceEvents} eventName
-     * @param {?string} correlationId
-     * @returns
-     */
-    setPreQueueTime(eventName, correlationId) {
-        if (!this.supportsBrowserPerformanceNow()) {
-            this.logger.trace(`BrowserPerformanceClient: window performance API not available, unable to set telemetry queue time for ${eventName}`);
-            return;
-        }
-        if (!correlationId) {
-            this.logger.trace(`BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to set telemetry queue time`);
-            return;
-        }
-        const preQueueEvent = this.preQueueTimeByCorrelationId.get(correlationId);
-        /**
-         * Manually complete queue measurement if there is an incomplete pre-queue event.
-         * Incomplete pre-queue events are instrumentation bugs that should be fixed.
-         */
-        if (preQueueEvent) {
-            this.logger.trace(`BrowserPerformanceClient: Incomplete pre-queue ${preQueueEvent.name} found`, correlationId);
-            this.addQueueMeasurement(preQueueEvent.name, correlationId, undefined, true);
-        }
-        this.preQueueTimeByCorrelationId.set(correlationId, {
-            name: eventName,
-            time: window.performance.now(),
-        });
-    }
-    /**
-     * Calculates and adds queue time measurement for given performance event.
-     *
-     * @param {PerformanceEvents} eventName
-     * @param {?string} correlationId
-     * @param {?number} queueTime
-     * @param {?boolean} manuallyCompleted - indicator for manually completed queue measurements
-     * @returns
-     */
-    addQueueMeasurement(eventName, correlationId, queueTime, manuallyCompleted) {
-        if (!this.supportsBrowserPerformanceNow()) {
-            this.logger.trace(`BrowserPerformanceClient: window performance API not available, unable to add queue measurement for ${eventName}`);
-            return;
-        }
-        if (!correlationId) {
-            this.logger.trace(`BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to add queue measurement`);
-            return;
-        }
-        const preQueueTime = super.getPreQueueTime(eventName, correlationId);
-        if (!preQueueTime) {
-            return;
-        }
-        const currentTime = window.performance.now();
-        const resQueueTime = queueTime || super.calculateQueuedTime(preQueueTime, currentTime);
-        return super.addQueueMeasurement(eventName, correlationId, resQueueTime, manuallyCompleted);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
+/**
+ * Warning: This set of exports is purely intended to be used by other MSAL libraries, and should be considered potentially unstable. We strongly discourage using them directly, you do so at your own risk.
+ * Breaking changes to these APIs will be shipped under a minor version, instead of a major version.
  */
+// Cache Manager
 
 var internals = /*#__PURE__*/Object.freeze({
     __proto__: null,
     BrowserCacheManager: BrowserCacheManager,
     BrowserConstants: BrowserConstants,
-    BrowserPerformanceClient: BrowserPerformanceClient,
-    BrowserPerformanceMeasurement: BrowserPerformanceMeasurement,
     CacheRecord: CacheRecord,
     CryptoOps: CryptoOps,
     EventHandler: EventHandler,
@@ -16127,8 +16146,9 @@ class TokenCache {
         const idToken = new AuthToken(response.id_token, this.cryptoObj);
         let cacheRecord;
         let authority;
+        let cacheRecordAccount;
         if (request.account) {
-            const cacheRecordAccount = this.loadAccount(idToken, request.account.environment, undefined, undefined, request.account.homeAccountId);
+            cacheRecordAccount = AccountEntity.createFromAccountInfo(request.account);
             cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment));
         }
         else if (request.authority) {
@@ -16144,12 +16164,12 @@ class TokenCache {
             // "clientInfo" from options takes precedence over "clientInfo" in response
             if (options.clientInfo) {
                 this.logger.trace("TokenCache - homeAccountId from options");
-                const cacheRecordAccount = this.loadAccount(idToken, authority.hostnameAndPort, options.clientInfo, authority.authorityType);
+                cacheRecordAccount = this.loadAccount(idToken, authority, options.clientInfo);
                 cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
             }
             else if (response.client_info) {
                 this.logger.trace("TokenCache - homeAccountId from response");
-                const cacheRecordAccount = this.loadAccount(idToken, authority.hostnameAndPort, response.client_info, authority.authorityType);
+                cacheRecordAccount = this.loadAccount(idToken, authority, response.client_info);
                 cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
             }
             else {
@@ -16159,7 +16179,7 @@ class TokenCache {
         else {
             throw BrowserAuthError.createUnableToLoadTokenError("Please provide a request with an account or a request with authority.");
         }
-        return this.generateAuthenticationResult(request, idToken, cacheRecord, authority);
+        return this.generateAuthenticationResult(request, idToken, cacheRecord, cacheRecordAccount, authority);
     }
     /**
      * Helper function to load account to msal-browser cache
@@ -16170,20 +16190,23 @@ class TokenCache {
      * @param requestHomeAccountId
      * @returns `AccountEntity`
      */
-    loadAccount(idToken, environment, clientInfo, authorityType, requestHomeAccountId) {
+    loadAccount(idToken, authority, clientInfo, requestHomeAccountId) {
         let homeAccountId;
         if (requestHomeAccountId) {
             homeAccountId = requestHomeAccountId;
         }
-        else if (authorityType !== undefined && clientInfo) {
-            homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authorityType, this.logger, this.cryptoObj, idToken);
+        else if (authority.authorityType !== undefined && clientInfo) {
+            homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idToken.claims);
         }
         if (!homeAccountId) {
             throw BrowserAuthError.createUnableToLoadTokenError("Unexpected missing homeAccountId");
         }
-        const accountEntity = clientInfo
-            ? AccountEntity.createAccount(clientInfo, homeAccountId, idToken, undefined, undefined, undefined, environment)
-            : AccountEntity.createGenericAccount(homeAccountId, idToken, undefined, undefined, undefined, environment);
+        const accountEntity = AccountEntity.createAccount({
+            homeAccountId,
+            idTokenClaims: idToken.claims,
+            clientInfo,
+            environment: authority.hostnameAndPort,
+        }, authority);
         if (this.isBrowserEnvironment) {
             this.logger.verbose("TokenCache - loading account");
             this.storage.setAccount(accountEntity);
@@ -16277,7 +16300,7 @@ class TokenCache {
      * @param authority
      * @returns `AuthenticationResult`
      */
-    generateAuthenticationResult(request, idTokenObj, cacheRecord, authority) {
+    generateAuthenticationResult(request, idTokenObj, cacheRecord, accountEntity, authority) {
         let accessToken = Constants.EMPTY_STRING;
         let responseScopes = [];
         let expiresOn = null;
@@ -16299,7 +16322,7 @@ class TokenCache {
             uniqueId: uid,
             tenantId: tid,
             scopes: responseScopes,
-            account: cacheRecord.account.getAccountInfo(),
+            account: accountEntity.getAccountInfo(),
             idToken: idTokenObj ? idTokenObj.rawToken : Constants.EMPTY_STRING,
             idTokenClaims: idTokenObj ? idTokenObj.claims : {},
             accessToken: accessToken,
@@ -16311,9 +16334,8 @@ class TokenCache {
             familyId: Constants.EMPTY_STRING,
             tokenType: cacheRecord?.accessToken?.tokenType || Constants.EMPTY_STRING,
             state: Constants.EMPTY_STRING,
-            cloudGraphHostName: cacheRecord?.account?.cloudGraphHostName ||
-                Constants.EMPTY_STRING,
-            msGraphHost: cacheRecord?.account?.msGraphHost || Constants.EMPTY_STRING,
+            cloudGraphHostName: accountEntity.cloudGraphHostName || Constants.EMPTY_STRING,
+            msGraphHost: accountEntity.msGraphHost || Constants.EMPTY_STRING,
             code: undefined,
             fromNativeBroker: false,
         };
@@ -16439,9 +16461,7 @@ class StandardController {
         // Initial hybrid spa map
         this.hybridAuthCodeResponses = new Map();
         // Initialize performance client
-        this.performanceClient = this.isBrowserEnvironment
-            ? new BrowserPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application)
-            : new StubPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application);
+        this.performanceClient = this.config.telemetry.client;
         // Initialize the crypto class.
         this.browserCrypto = this.isBrowserEnvironment
             ? new CryptoOps(this.logger, this.performanceClient)
@@ -16507,7 +16527,7 @@ class StandardController {
         }
         this.initialized = true;
         this.eventHandler.emitEvent(EventType.INITIALIZE_END);
-        initMeasurement.endMeasurement({ allowNativeBroker, success: true });
+        initMeasurement.end({ allowNativeBroker, success: true });
     }
     // #region Redirect Flow
     /**
@@ -16519,8 +16539,14 @@ class StandardController {
      */
     async handleRedirectPromise(hash) {
         this.logger.verbose("handleRedirectPromise called");
-        // Block token acquisition before initialize has been called if native brokering is enabled
-        BrowserUtils.blockNativeBrokerCalledBeforeInitialized(this.config.system.allowNativeBroker, this.initialized);
+        // Block token acquisition before initialize has been called
+        BrowserUtils.blockAPICallsBeforeInitialize(this.initialized);
+        let foundServerResponse = hash;
+        if (this.config.auth.OIDCOptions?.serverResponseType ===
+            ServerResponseType.QUERY) {
+            const url = window.location.href;
+            foundServerResponse = UrlString.parseQueryServerResponse(url);
+        }
         const loggedInAccounts = this.getAllAccounts();
         if (this.isBrowserEnvironment) {
             /**
@@ -16528,7 +16554,7 @@ class StandardController {
              * otherwise return the promise from the first invocation. Prevents race conditions when handleRedirectPromise is called
              * several times concurrently.
              */
-            const redirectResponseKey = hash || Constants.EMPTY_STRING;
+            const redirectResponseKey = foundServerResponse || Constants.EMPTY_STRING;
             let response = this.redirectResponse.get(redirectResponseKey);
             if (typeof response === "undefined") {
                 this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
@@ -16538,7 +16564,7 @@ class StandardController {
                 if (request &&
                     NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
                     this.nativeExtensionProvider &&
-                    !hash) {
+                    !foundServerResponse) {
                     this.logger.trace("handleRedirectPromise - acquiring token from native platform");
                     const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, this.nativeInternalStorage, request.correlationId);
                     redirectResponse = nativeClient.handleRedirectPromise();
@@ -16548,7 +16574,7 @@ class StandardController {
                     const correlationId = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || Constants.EMPTY_STRING;
                     const redirectClient = this.createRedirectClient(correlationId);
                     redirectResponse =
-                        redirectClient.handleRedirectPromise(hash);
+                        redirectClient.handleRedirectPromise(foundServerResponse);
                 }
                 response = redirectResponse
                     .then((result) => {
@@ -16679,7 +16705,7 @@ class StandardController {
             result = this.acquireTokenNative(request, ApiId.acquireTokenPopup)
                 .then((response) => {
                 this.browserStorage.setInteractionInProgress(false);
-                atPopupMeasurement.endMeasurement({
+                atPopupMeasurement.end({
                     success: true,
                     isNativeBroker: true,
                     requestId: response.requestId,
@@ -16717,11 +16743,11 @@ class StandardController {
             else {
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Popup, result);
             }
-            atPopupMeasurement.addStaticFields({
+            atPopupMeasurement.add({
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             });
-            atPopupMeasurement.endMeasurement({
+            atPopupMeasurement.end({
                 success: true,
                 requestId: result.requestId,
             });
@@ -16734,7 +16760,7 @@ class StandardController {
             else {
                 this.eventHandler.emitEvent(EventType.LOGIN_FAILURE, exports.InteractionType.Popup, null, e);
             }
-            atPopupMeasurement.endMeasurement({
+            atPopupMeasurement.end({
                 errorCode: e.errorCode,
                 subErrorCode: e.subError,
                 success: false,
@@ -16806,11 +16832,11 @@ class StandardController {
         return result
             .then((response) => {
             this.eventHandler.emitEvent(EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, response);
-            this.ssoSilentMeasurement?.addStaticFields({
+            this.ssoSilentMeasurement?.add({
                 accessTokenSize: response.accessToken.length,
                 idTokenSize: response.idToken.length,
             });
-            this.ssoSilentMeasurement?.endMeasurement({
+            this.ssoSilentMeasurement?.end({
                 success: true,
                 isNativeBroker: response.fromNativeBroker,
                 requestId: response.requestId,
@@ -16819,7 +16845,7 @@ class StandardController {
         })
             .catch((e) => {
             this.eventHandler.emitEvent(EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e);
-            this.ssoSilentMeasurement?.endMeasurement({
+            this.ssoSilentMeasurement?.end({
                 errorCode: e.errorCode,
                 subErrorCode: e.subError,
                 success: false,
@@ -16863,11 +16889,11 @@ class StandardController {
                         .then((result) => {
                         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
                         this.hybridAuthCodeResponses.delete(hybridAuthCode);
-                        atbcMeasurement.addStaticFields({
+                        atbcMeasurement.add({
                             accessTokenSize: result.accessToken.length,
                             idTokenSize: result.idToken.length,
                         });
-                        atbcMeasurement.endMeasurement({
+                        atbcMeasurement.end({
                             success: true,
                             isNativeBroker: result.fromNativeBroker,
                             requestId: result.requestId,
@@ -16877,7 +16903,7 @@ class StandardController {
                         .catch((error) => {
                         this.hybridAuthCodeResponses.delete(hybridAuthCode);
                         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, error);
-                        atbcMeasurement.endMeasurement({
+                        atbcMeasurement.end({
                             errorCode: error.errorCode,
                             subErrorCode: error.subError,
                             success: false,
@@ -16888,7 +16914,7 @@ class StandardController {
                 }
                 else {
                     this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
-                    atbcMeasurement.discardMeasurement();
+                    atbcMeasurement.discard();
                 }
                 return response;
             }
@@ -16912,7 +16938,7 @@ class StandardController {
         }
         catch (e) {
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
-            atbcMeasurement.endMeasurement({
+            atbcMeasurement.end({
                 errorCode: (e instanceof AuthError && e.errorCode) || undefined,
                 subErrorCode: (e instanceof AuthError && e.subError) || undefined,
                 success: false,
@@ -16937,7 +16963,7 @@ class StandardController {
         const silentTokenResult = await silentAuthCodeClient
             .acquireToken(request)
             .then((response) => {
-            this.acquireTokenByCodeAsyncMeasurement?.endMeasurement({
+            this.acquireTokenByCodeAsyncMeasurement?.end({
                 success: true,
                 fromCache: response.fromCache,
                 isNativeBroker: response.fromNativeBroker,
@@ -16946,7 +16972,7 @@ class StandardController {
             return response;
         })
             .catch((tokenRenewalError) => {
-            this.acquireTokenByCodeAsyncMeasurement?.endMeasurement({
+            this.acquireTokenByCodeAsyncMeasurement?.end({
                 errorCode: tokenRenewalError.errorCode,
                 subErrorCode: tokenRenewalError.subError,
                 success: false,
@@ -17156,6 +17182,26 @@ class StandardController {
         return this.browserStorage.getActiveAccount();
     }
     // #endregion
+    /**
+     * Hydrates the cache with the tokens from an AuthenticationResult
+     * @param result
+     * @param request
+     * @returns
+     */
+    async hydrateCache(result, request) {
+        this.logger.verbose("hydrateCache called");
+        // Account gets saved to browser storage regardless of native or not
+        const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
+        this.browserStorage.setAccount(accountEntity);
+        if (result.fromNativeBroker) {
+            this.logger.verbose("Response was from native broker, storing in-memory");
+            // Tokens from native broker are stored in-memory
+            return this.nativeInternalStorage.hydrateCache(result, request);
+        }
+        else {
+            return this.browserStorage.hydrateCache(result, request);
+        }
+    }
     // #region Helpers
     /**
      * Helper to validate app environment before making an auth request
@@ -17174,13 +17220,8 @@ class StandardController {
         BrowserUtils.blockReloadInHiddenIframes();
         // Block redirectUri opened in a popup from calling MSAL APIs
         BrowserUtils.blockAcquireTokenInPopups();
-        /*
-         * Block token acquisition before initialize has been called if native brokering is enabled in top-frame.
-         * Skip check if application is embedded.
-         */
-        if (!isAppEmbedded) {
-            BrowserUtils.blockNativeBrokerCalledBeforeInitialized(this.config.system.allowNativeBroker, this.initialized);
-        }
+        // Block token acquisition before initialize has been called
+        BrowserUtils.blockAPICallsBeforeInitialize(this.initialized);
         // Block redirects if memory storage is enabled but storeAuthStateInCookie is not
         if (interactionType === exports.InteractionType.Redirect &&
             this.config.cache.cacheLocation ===
@@ -17506,7 +17547,7 @@ class StandardController {
     async acquireTokenSilent(request) {
         const correlationId = this.getRequestCorrelationId(request);
         const atsMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenSilent, correlationId);
-        atsMeasurement.addStaticFields({
+        atsMeasurement.add({
             cacheLookupPolicy: request.cacheLookupPolicy,
         });
         this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
@@ -17538,11 +17579,11 @@ class StandardController {
             }, account)
                 .then((result) => {
                 this.activeSilentTokenRequests.delete(silentRequestKey);
-                atsMeasurement.addStaticFields({
+                atsMeasurement.add({
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
                 });
-                atsMeasurement.endMeasurement({
+                atsMeasurement.end({
                     success: true,
                     fromCache: result.fromCache,
                     isNativeBroker: result.fromNativeBroker,
@@ -17553,7 +17594,7 @@ class StandardController {
             })
                 .catch((error) => {
                 this.activeSilentTokenRequests.delete(silentRequestKey);
-                atsMeasurement.endMeasurement({
+                atsMeasurement.end({
                     errorCode: error.errorCode,
                     subErrorCode: error.subError,
                     success: false,
@@ -17566,7 +17607,7 @@ class StandardController {
         else {
             this.logger.verbose("acquireTokenSilent has been called previously, returning the result from the first call", correlationId);
             // Discard measurements for memoized calls, as they are usually only a couple of ms and will artificially deflate metrics
-            atsMeasurement.discardMeasurement();
+            atsMeasurement.discard();
             return cachedResponse;
         }
     }
@@ -17650,7 +17691,7 @@ class StandardController {
         return result
             .then((response) => {
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
-            this.atsAsyncMeasurement?.endMeasurement({
+            this.atsAsyncMeasurement?.end({
                 success: true,
                 fromCache: response.fromCache,
                 isNativeBroker: response.fromNativeBroker,
@@ -17660,7 +17701,7 @@ class StandardController {
         })
             .catch((tokenRenewalError) => {
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError);
-            this.atsAsyncMeasurement?.endMeasurement({
+            this.atsAsyncMeasurement?.end({
                 errorCode: tokenRenewalError.errorCode,
                 subErrorCode: tokenRenewalError.subError,
                 success: false,
@@ -17984,6 +18025,15 @@ class PublicClientApplication {
     getConfiguration() {
         return this.controller.getConfiguration();
     }
+    /**
+     * Hydrates cache with the tokens and account in the AuthenticationResult object
+     * @param result
+     * @param request - The request object that was used to obtain the AuthenticationResult
+     * @returns
+     */
+    async hydrateCache(result, request) {
+        return this.controller.hydrateCache(result, request);
+    }
 }
 
 /*
@@ -18081,6 +18131,9 @@ const stubbedPublicClientApplication = {
     getConfiguration: () => {
         throw BrowserConfigurationAuthError.createStubPcaInstanceCalledError();
     },
+    hydrateCache: () => {
+        return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
+    },
 };
 
 /*
@@ -18192,6 +18245,227 @@ class SignedHttpRequest {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+class BrowserPerformanceMeasurement {
+    constructor(name, correlationId) {
+        this.correlationId = correlationId;
+        this.measureName = BrowserPerformanceMeasurement.makeMeasureName(name, correlationId);
+        this.startMark = BrowserPerformanceMeasurement.makeStartMark(name, correlationId);
+        this.endMark = BrowserPerformanceMeasurement.makeEndMark(name, correlationId);
+    }
+    static makeMeasureName(name, correlationId) {
+        return `msal.measure.${name}.${correlationId}`;
+    }
+    static makeStartMark(name, correlationId) {
+        return `msal.start.${name}.${correlationId}`;
+    }
+    static makeEndMark(name, correlationId) {
+        return `msal.end.${name}.${correlationId}`;
+    }
+    static supportsBrowserPerformance() {
+        return (typeof window !== "undefined" &&
+            typeof window.performance !== "undefined" &&
+            typeof window.performance.mark === "function" &&
+            typeof window.performance.measure === "function" &&
+            typeof window.performance.clearMarks === "function" &&
+            typeof window.performance.clearMeasures === "function" &&
+            typeof window.performance.getEntriesByName === "function");
+    }
+    /**
+     * Flush browser marks and measurements.
+     * @param {string} correlationId
+     * @param {SubMeasurement} measurements
+     */
+    static flushMeasurements(correlationId, measurements) {
+        if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
+            try {
+                measurements.forEach((measurement) => {
+                    const measureName = BrowserPerformanceMeasurement.makeMeasureName(measurement.name, correlationId);
+                    const entriesForMeasurement = window.performance.getEntriesByName(measureName, "measure");
+                    if (entriesForMeasurement.length > 0) {
+                        window.performance.clearMeasures(measureName);
+                        window.performance.clearMarks(BrowserPerformanceMeasurement.makeStartMark(measureName, correlationId));
+                        window.performance.clearMarks(BrowserPerformanceMeasurement.makeEndMark(measureName, correlationId));
+                    }
+                });
+            }
+            catch (e) {
+                // Silently catch and return null
+            }
+        }
+    }
+    startMeasurement() {
+        if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
+            try {
+                window.performance.mark(this.startMark);
+            }
+            catch (e) {
+                // Silently catch
+            }
+        }
+    }
+    endMeasurement() {
+        if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
+            try {
+                window.performance.mark(this.endMark);
+                window.performance.measure(this.measureName, this.startMark, this.endMark);
+            }
+            catch (e) {
+                // Silently catch
+            }
+        }
+    }
+    flushMeasurement() {
+        if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
+            try {
+                const entriesForMeasurement = window.performance.getEntriesByName(this.measureName, "measure");
+                if (entriesForMeasurement.length > 0) {
+                    const durationMs = entriesForMeasurement[0].duration;
+                    window.performance.clearMeasures(this.measureName);
+                    window.performance.clearMarks(this.startMark);
+                    window.performance.clearMarks(this.endMark);
+                    return durationMs;
+                }
+            }
+            catch (e) {
+                // Silently catch and return null
+            }
+        }
+        return null;
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+class BrowserPerformanceClient extends PerformanceClient {
+    constructor(configuration, intFields) {
+        super(configuration.auth.clientId, configuration.auth.authority || `${Constants.DEFAULT_AUTHORITY}`, new Logger(configuration.system?.loggerOptions || {}, name, version), name, version, configuration.telemetry?.application || {
+            appName: "",
+            appVersion: "",
+        }, intFields);
+        this.browserCrypto = new BrowserCrypto(this.logger);
+        this.guidGenerator = new GuidGenerator(this.browserCrypto);
+    }
+    startPerformanceMeasurement(measureName, correlationId) {
+        return new BrowserPerformanceMeasurement(measureName, correlationId);
+    }
+    generateId() {
+        return this.guidGenerator.generateGuid();
+    }
+    getPageVisibility() {
+        return document.visibilityState?.toString() || null;
+    }
+    deleteIncompleteSubMeasurements(inProgressEvent) {
+        const rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
+        const isRootEvent = rootEvent && rootEvent.eventId === inProgressEvent.event.eventId;
+        const incompleteMeasurements = [];
+        if (isRootEvent && rootEvent?.incompleteSubMeasurements) {
+            rootEvent.incompleteSubMeasurements.forEach((subMeasurement) => {
+                incompleteMeasurements.push({ ...subMeasurement });
+            });
+        }
+        // Clean up remaining marks for incomplete sub-measurements
+        if (incompleteMeasurements.length > 0) {
+            BrowserPerformanceMeasurement.flushMeasurements(inProgressEvent.event.correlationId, incompleteMeasurements);
+        }
+    }
+    supportsBrowserPerformanceNow() {
+        return (typeof window !== "undefined" &&
+            typeof window.performance !== "undefined" &&
+            typeof window.performance.now === "function");
+    }
+    /**
+     * Starts measuring performance for a given operation. Returns a function that should be used to end the measurement.
+     * Also captures browser page visibilityState.
+     *
+     * @param {PerformanceEvents} measureName
+     * @param {?string} [correlationId]
+     * @returns {((event?: Partial<PerformanceEvent>) => PerformanceEvent| null)}
+     */
+    startMeasurement(measureName, correlationId) {
+        // Capture page visibilityState and then invoke start/end measurement
+        const startPageVisibility = this.getPageVisibility();
+        const inProgressEvent = super.startMeasurement(measureName, correlationId);
+        return {
+            ...inProgressEvent,
+            end: (event) => {
+                const res = inProgressEvent.end({
+                    startPageVisibility,
+                    endPageVisibility: this.getPageVisibility(),
+                    ...event,
+                });
+                this.deleteIncompleteSubMeasurements(inProgressEvent);
+                return res;
+            },
+            discard: () => {
+                inProgressEvent.discard();
+                this.deleteIncompleteSubMeasurements(inProgressEvent);
+                inProgressEvent.measurement.flushMeasurement();
+            },
+        };
+    }
+    /**
+     * Adds pre-queue time to preQueueTimeByCorrelationId map.
+     * @param {PerformanceEvents} eventName
+     * @param {?string} correlationId
+     * @returns
+     */
+    setPreQueueTime(eventName, correlationId) {
+        if (!this.supportsBrowserPerformanceNow()) {
+            this.logger.trace(`BrowserPerformanceClient: window performance API not available, unable to set telemetry queue time for ${eventName}`);
+            return;
+        }
+        if (!correlationId) {
+            this.logger.trace(`BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to set telemetry queue time`);
+            return;
+        }
+        const preQueueEvent = this.preQueueTimeByCorrelationId.get(correlationId);
+        /**
+         * Manually complete queue measurement if there is an incomplete pre-queue event.
+         * Incomplete pre-queue events are instrumentation bugs that should be fixed.
+         */
+        if (preQueueEvent) {
+            this.logger.trace(`BrowserPerformanceClient: Incomplete pre-queue ${preQueueEvent.name} found`, correlationId);
+            this.addQueueMeasurement(preQueueEvent.name, correlationId, undefined, true);
+        }
+        this.preQueueTimeByCorrelationId.set(correlationId, {
+            name: eventName,
+            time: window.performance.now(),
+        });
+    }
+    /**
+     * Calculates and adds queue time measurement for given performance event.
+     *
+     * @param {PerformanceEvents} eventName
+     * @param {?string} correlationId
+     * @param {?number} queueTime
+     * @param {?boolean} manuallyCompleted - indicator for manually completed queue measurements
+     * @returns
+     */
+    addQueueMeasurement(eventName, correlationId, queueTime, manuallyCompleted) {
+        if (!this.supportsBrowserPerformanceNow()) {
+            this.logger.trace(`BrowserPerformanceClient: window performance API not available, unable to add queue measurement for ${eventName}`);
+            return;
+        }
+        if (!correlationId) {
+            this.logger.trace(`BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to add queue measurement`);
+            return;
+        }
+        const preQueueTime = super.getPreQueueTime(eventName, correlationId);
+        if (!preQueueTime) {
+            return;
+        }
+        const currentTime = window.performance.now();
+        const resQueueTime = queueTime || super.calculateQueuedTime(preQueueTime, currentTime);
+        return super.addQueueMeasurement(eventName, correlationId, resQueueTime, manuallyCompleted);
+    }
+}
+
 exports.AccountEntity = AccountEntity;
 exports.ApiId = ApiId;
 exports.AuthError = AuthError;
@@ -18204,6 +18478,8 @@ exports.BrowserAuthErrorMessage = BrowserAuthErrorMessage;
 exports.BrowserCacheLocation = BrowserCacheLocation;
 exports.BrowserConfigurationAuthError = BrowserConfigurationAuthError;
 exports.BrowserConfigurationAuthErrorMessage = BrowserConfigurationAuthErrorMessage;
+exports.BrowserPerformanceClient = BrowserPerformanceClient;
+exports.BrowserPerformanceMeasurement = BrowserPerformanceMeasurement;
 exports.BrowserUtils = BrowserUtils;
 exports.CacheLookupPolicy = CacheLookupPolicy;
 exports.ClientAuthError = ClientAuthError;
@@ -18224,6 +18500,7 @@ exports.PromptValue = PromptValue;
 exports.ProtocolMode = ProtocolMode;
 exports.PublicClientApplication = PublicClientApplication;
 exports.ServerError = ServerError;
+exports.ServerResponseType = ServerResponseType;
 exports.SignedHttpRequest = SignedHttpRequest;
 exports.StringUtils = StringUtils;
 exports.UrlString = UrlString;