@azure/msal-browser 3.0.0-beta.1 → 3.0.1

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.0.0-beta.1 2023-07-06 */
+/*! @azure/msal-browser v3.0.1 2023-08-11 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -203,11 +203,17 @@
         S256: "S256",
     };
     /**
-     * allowed values for response_mode
+     * allowed values for server response type
      */
-    const ResponseMode = {
+    const ServerResponseType = {
         QUERY: "query",
         FRAGMENT: "fragment",
+    };
+    /**
+     * allowed values for response_mode
+     */
+    const ResponseMode = {
+        ...ServerResponseType,
         FORM_POST: "form_post",
     };
     /**
@@ -360,7 +366,7 @@
         Pop: "pop",
     };
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -414,7 +420,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -459,7 +465,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -981,7 +987,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1108,7 +1114,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1308,12 +1314,12 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "14.0.0-beta.1";
+    const version$1 = "14.0.1";
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1325,15 +1331,15 @@
         AzurePublic: "https://login.microsoftonline.com",
         // Microsoft PPE
         AzurePpe: "https://login.windows-ppe.net",
-        // Microsoft Chinese national cloud
+        // Microsoft Chinese national/regional cloud
         AzureChina: "https://login.chinacloudapi.cn",
-        // Microsoft German national cloud ("Black Forest")
+        // Microsoft German national/regional cloud ("Black Forest")
         AzureGermany: "https://login.microsoftonline.de",
         // US Government cloud
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1433,12 +1439,20 @@
         },
         invalidAuthenticationHeader: {
             code: "invalid_authentication_header",
-            desc: "Invalid authentication header provided"
+            desc: "Invalid authentication header provided",
+        },
+        cannotSetOIDCOptions: {
+            code: "cannot_set_OIDCOptions",
+            desc: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
+        },
+        cannotAllowNativeBroker: {
+            code: "cannot_allow_native_broker",
+            desc: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
         },
         authorityMismatch: {
             code: "authority_mismatch",
-            desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority."
-        }
+            desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+        },
     };
     /**
      * Error thrown when there is an error in configuration of the MSAL.js library.
@@ -1587,6 +1601,18 @@
         static createInvalidAuthenticationHeaderError(invalidHeaderName, details) {
             return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, `${ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc}. Invalid header: ${invalidHeaderName}. Details: ${details}`);
         }
+        /**
+         * Throws error when provided non-default OIDCOptions when not in OIDC protocol mode
+         */
+        static createCannotSetOIDCOptionsError() {
+            return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotSetOIDCOptions.code, ClientConfigurationErrorMessage.cannotSetOIDCOptions.desc);
+        }
+        /**
+         * Throws error when allowNativeBroker is set to true when not in AAD protocol mode
+         */
+        static createCannotAllowNativeBrokerError() {
+            return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotAllowNativeBroker.code, ClientConfigurationErrorMessage.cannotAllowNativeBroker.desc);
+        }
         /**
          * Create an error when the authority provided in request does not match authority provided in account or MSAL.js configuration.
          */
@@ -1595,7 +1621,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1795,7 +1821,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1835,7 +1861,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1847,10 +1873,23 @@
         Default: 0,
         Adfs: 1,
         Dsts: 2,
-        Ciam: 3
+        Ciam: 3,
+    };
+
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Protocol modes supported by MSAL.
+     */
+    const ProtocolMode = {
+        AAD: "AAD",
+        OIDC: "OIDC",
     };
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1872,7 +1911,6 @@
      *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
      *      authorityType: Accounts authority type as a string
      *      name: Full name for the account, including given name and family name,
-     *      clientInfo: Full base64 encoded client info received from ESTS
      *      lastModificationTime: last time this entity was modified in the cache
      *      lastModificationApp:
      *      idTokenClaims: Object containing claims parsed from ID token
@@ -1899,24 +1937,6 @@
                 localAccountId: this.localAccountId,
             });
         }
-        /**
-         * returns the type of the cache (in this case account)
-         */
-        generateType() {
-            switch (this.authorityType) {
-                case CacheAccountType.ADFS_ACCOUNT_TYPE:
-                    return CacheType.ADFS;
-                case CacheAccountType.MSAV1_ACCOUNT_TYPE:
-                    return CacheType.MSA;
-                case CacheAccountType.MSSTS_ACCOUNT_TYPE:
-                    return CacheType.MSSTS;
-                case CacheAccountType.GENERIC_ACCOUNT_TYPE:
-                    return CacheType.GENERIC;
-                default: {
-                    throw ClientAuthError.createUnexpectedAccountTypeError();
-                }
-            }
-        }
         /**
          * Returns the AccountInfo interface for this account.
          */
@@ -1930,6 +1950,7 @@
                 name: this.name,
                 idTokenClaims: this.idTokenClaims,
                 nativeAccountId: this.nativeAccountId,
+                authorityType: this.authorityType,
             };
         }
         /**
@@ -1946,84 +1967,74 @@
         }
         /**
          * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-         * @param clientInfo
-         * @param authority
-         * @param idToken
-         * @param policy
+         * @param accountDetails
          */
-        static createAccount(clientInfo, homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
+        static createAccount(accountDetails, authority) {
             const account = new AccountEntity();
-            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
-            account.clientInfo = clientInfo;
-            account.homeAccountId = homeAccountId;
-            account.nativeAccountId = nativeAccountId;
-            const env = environment || (authority && authority.getPreferredCache());
+            if (authority.authorityType === AuthorityType.Adfs) {
+                account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
+            }
+            else if (authority.protocolMode === ProtocolMode.AAD) {
+                account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
+            }
+            else {
+                account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
+            }
+            account.clientInfo = accountDetails.clientInfo;
+            account.homeAccountId = accountDetails.homeAccountId;
+            account.nativeAccountId = accountDetails.nativeAccountId;
+            const env = accountDetails.environment ||
+                (authority && authority.getPreferredCache());
             if (!env) {
                 throw ClientAuthError.createInvalidCacheEnvironmentError();
             }
             account.environment = env;
             // non AAD scenarios can have empty realm
-            account.realm = idToken?.claims?.tid || Constants.EMPTY_STRING;
-            if (idToken) {
-                account.idTokenClaims = idToken.claims;
-                // How do you account for MSA CID here?
-                account.localAccountId =
-                    idToken?.claims?.oid ||
-                        idToken?.claims?.sub ||
-                        Constants.EMPTY_STRING;
-                /*
-                 * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-                 * In most cases it will contain a single email. This field should not be relied upon if a custom
-                 * policy is configured to return more than 1 email.
-                 */
-                const preferredUsername = idToken?.claims?.preferred_username;
-                const email = idToken?.claims?.emails
-                    ? idToken.claims.emails[0]
-                    : null;
-                account.username =
-                    preferredUsername || email || Constants.EMPTY_STRING;
-                account.name = idToken?.claims?.name;
-            }
-            account.cloudGraphHostName = cloudGraphHostName;
-            account.msGraphHost = msGraphHost;
+            account.realm =
+                accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
+            account.idTokenClaims = accountDetails.idTokenClaims;
+            // How do you account for MSA CID here?
+            account.localAccountId =
+                accountDetails.idTokenClaims.oid ||
+                    accountDetails.idTokenClaims.sub ||
+                    Constants.EMPTY_STRING;
+            /*
+             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+             * In most cases it will contain a single email. This field should not be relied upon if a custom
+             * policy is configured to return more than 1 email.
+             */
+            const preferredUsername = accountDetails.idTokenClaims.preferred_username ||
+                accountDetails.idTokenClaims.upn;
+            const email = accountDetails.idTokenClaims.emails
+                ? accountDetails.idTokenClaims.emails[0]
+                : null;
+            account.username = preferredUsername || email || Constants.EMPTY_STRING;
+            account.name = accountDetails.idTokenClaims.name;
+            account.cloudGraphHostName = accountDetails.cloudGraphHostName;
+            account.msGraphHost = accountDetails.msGraphHost;
             return account;
         }
         /**
-         * Builds non-AAD/ADFS account.
-         * @param authority
-         * @param idToken
+         * Creates an AccountEntity object from AccountInfo
+         * @param accountInfo
+         * @param cloudGraphHostName
+         * @param msGraphHost
+         * @returns
          */
-        static createGenericAccount(homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
+        static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
             const account = new AccountEntity();
             account.authorityType =
-                authority && authority.authorityType === AuthorityType.Adfs
-                    ? CacheAccountType.ADFS_ACCOUNT_TYPE
-                    : CacheAccountType.GENERIC_ACCOUNT_TYPE;
-            account.homeAccountId = homeAccountId;
-            // non AAD scenarios can have empty realm
-            account.realm = Constants.EMPTY_STRING;
-            const env = environment || (authority && authority.getPreferredCache());
-            if (!env) {
-                throw ClientAuthError.createInvalidCacheEnvironmentError();
-            }
-            if (idToken) {
-                // How do you account for MSA CID here?
-                account.localAccountId =
-                    idToken?.claims?.oid ||
-                        idToken?.claims?.sub ||
-                        Constants.EMPTY_STRING;
-                // upn claim for most ADFS scenarios
-                account.username = idToken?.claims?.upn || Constants.EMPTY_STRING;
-                account.name = idToken?.claims?.name || Constants.EMPTY_STRING;
-                account.idTokenClaims = idToken?.claims;
-            }
-            account.environment = env;
+                accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
+            account.homeAccountId = accountInfo.homeAccountId;
+            account.localAccountId = accountInfo.localAccountId;
+            account.nativeAccountId = accountInfo.nativeAccountId;
+            account.realm = accountInfo.tenantId;
+            account.environment = accountInfo.environment;
+            account.username = accountInfo.username;
+            account.name = accountInfo.name;
+            account.idTokenClaims = accountInfo.idTokenClaims;
             account.cloudGraphHostName = cloudGraphHostName;
             account.msGraphHost = msGraphHost;
-            /*
-             * add uniqueName to claims
-             * account.name = idToken.claims.uniqueName;
-             */
             return account;
         }
         /**
@@ -2031,9 +2042,9 @@
          * @param serverClientInfo
          * @param authType
          */
-        static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idToken) {
-            const accountId = idToken?.claims?.sub
-                ? idToken.claims.sub
+        static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
+            const accountId = idTokenClaims?.sub
+                ? idTokenClaims.sub
                 : Constants.EMPTY_STRING;
             // since ADFS does not have tid and does not set client_info
             if (authType === AuthorityType.Adfs ||
@@ -2101,7 +2112,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2152,7 +2163,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2218,20 +2229,21 @@
          * saves a cache record
          * @param cacheRecord
          */
-        async saveCacheRecord(cacheRecord) {
+        async saveCacheRecord(cacheRecord, storeInCache) {
             if (!cacheRecord) {
                 throw ClientAuthError.createNullOrUndefinedCacheRecord();
             }
             if (!!cacheRecord.account) {
                 this.setAccount(cacheRecord.account);
             }
-            if (!!cacheRecord.idToken) {
+            if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
                 this.setIdTokenCredential(cacheRecord.idToken);
             }
-            if (!!cacheRecord.accessToken) {
+            if (!!cacheRecord.accessToken && storeInCache?.accessToken !== false) {
                 await this.saveAccessToken(cacheRecord.accessToken);
             }
-            if (!!cacheRecord.refreshToken) {
+            if (!!cacheRecord.refreshToken &&
+                storeInCache?.refreshToken !== false) {
                 this.setRefreshTokenCredential(cacheRecord.refreshToken);
             }
             if (!!cacheRecord.appMetadata) {
@@ -2645,7 +2657,11 @@
                 return null;
             }
             else if (numIdTokens > 1) {
-                throw ClientAuthError.createMultipleMatchingTokensInCacheError();
+                this.commonLogger.info("CacheManager:getIdToken - Multiple id tokens found, clearing them");
+                idTokens.forEach((idToken) => {
+                    this.removeIdToken(idToken.generateCredentialKey());
+                });
+                return null;
             }
             this.commonLogger.info("CacheManager:getIdToken - Returning id token");
             return idTokens[0];
@@ -2755,7 +2771,11 @@
                 return null;
             }
             else if (numAccessTokens > 1) {
-                throw ClientAuthError.createMultipleMatchingTokensInCacheError();
+                this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them");
+                accessTokens.forEach((accessToken) => {
+                    this.removeAccessToken(accessToken.generateCredentialKey());
+                });
+                return null;
             }
             this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
             return accessTokens[0];
@@ -3166,7 +3186,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3260,8 +3280,15 @@
             ...authOptions,
         };
     }
+    /**
+     * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+     * @param ClientConfiguration
+     */
+    function isOidcProtocolMode(config) {
+        return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+    }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3278,7 +3305,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3375,7 +3402,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3411,7 +3438,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3421,7 +3448,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3502,11 +3529,11 @@
                 }
             });
             // remove empty string parameters
-            return Object.fromEntries(Object.entries(eQParams).filter(kv => kv[1] !== ""));
+            return Object.fromEntries(Object.entries(eQParams).filter((kv) => kv[1] !== ""));
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3546,9 +3573,15 @@
          * @param scopeSet
          * @param addOidcScopes
          */
-        addScopes(scopes, addOidcScopes = true) {
+        addScopes(scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+            // Always add openid to the scopes when adding OIDC scopes
+            if (addOidcScopes &&
+                !defaultScopes.includes("openid") &&
+                !scopes.includes("openid")) {
+                defaultScopes.push("openid");
+            }
             const requestScopes = addOidcScopes
-                ? [...(scopes || []), ...OIDC_DEFAULT_SCOPES]
+                ? [...(scopes || []), ...defaultScopes]
                 : scopes || [];
             const scopeSet = new ScopeSet(requestScopes);
             this.parameters.set(AADServerParamKeys.SCOPE, encodeURIComponent(scopeSet.printScopes()));
@@ -3883,7 +3916,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3978,7 +4011,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4117,7 +4150,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4176,7 +4209,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4223,7 +4256,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4337,7 +4370,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4399,7 +4432,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4480,12 +4513,12 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    let CacheRecord$1 = class CacheRecord {
+    class CacheRecord {
         constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
             this.account = accountEntity || null;
             this.idToken = idTokenEntity || null;
@@ -4493,9 +4526,9 @@
             this.refreshToken = refreshTokenEntity || null;
             this.appMetadata = appMetadataEntity || null;
         }
-    };
+    }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4569,7 +4602,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4753,6 +4786,30 @@
             }
             return Constants.EMPTY_STRING;
         }
+        /**
+         * Parses query server response string from given string.
+         * Extract hash between '?code=' and '#' if trailing '# is present.
+         * Returns empty string if no query symbol is found.
+         * @param queryString
+         */
+        static parseQueryServerResponse(queryString) {
+            const queryIndex1 = queryString.indexOf("?code");
+            const queryIndex2 = queryString.indexOf("/?code");
+            const hashIndex = queryString.indexOf("#");
+            if (queryIndex2 > -1 && hashIndex > -1) {
+                return queryString.substring(queryIndex2 + 2, hashIndex);
+            }
+            else if (queryIndex2 > -1) {
+                return queryString.substring(queryIndex2 + 2);
+            }
+            else if (queryIndex1 > -1 && hashIndex > -1) {
+                return queryString.substring(queryIndex1 + 1, hashIndex);
+            }
+            else if (queryIndex1 > -1) {
+                return queryString.substring(queryIndex1 + 1);
+            }
+            return Constants.EMPTY_STRING;
+        }
         static constructAuthorityUriFromObject(urlObject) {
             return new UrlString(urlObject.Protocol +
                 "//" +
@@ -4798,6 +4855,21 @@
             }
             return deserializedQueryString;
         }
+        /**
+         * Returns either deserialized query string or deserialized hash, depending on the serverResponseType
+         * as a server auth code response object.
+         */
+        static getDeserializedCodeResponse(serverResponseType, hashFragment) {
+            const hashUrlString = new UrlString(hashFragment);
+            let serverParams;
+            if (serverResponseType === ServerResponseType.QUERY) {
+                serverParams = UrlString.getDeserializedQueryString(hashFragment);
+            }
+            else {
+                serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
+            }
+            return serverParams;
+        }
         /**
          * Check if the hash of the URL string contains known properties
          */
@@ -4814,7 +4886,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5017,6 +5089,7 @@
         UpdateCloudDiscoveryMetadataMeasurement: "updateCloudDiscoveryMetadataMeasurement",
         UsernamePasswordClientAcquireToken: "usernamePasswordClientAcquireToken",
         NativeMessageHandlerHandshake: "nativeMessageHandlerHandshake",
+        NativeGenerateAuthResult: "nativeGenerateAuthResult",
     };
     /**
      * State of the performance event.
@@ -5041,7 +5114,7 @@
         "status",
     ]);
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5126,7 +5199,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5195,7 +5268,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5222,7 +5295,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5249,12 +5322,25 @@
          */
         validateServerAuthorizationCodeResponse(serverResponseHash, cachedState, cryptoObj) {
             if (!serverResponseHash.state || !cachedState) {
-                throw !serverResponseHash.state
-                    ? ClientAuthError.createStateNotFoundError("Server State")
-                    : ClientAuthError.createStateNotFoundError("Cached State");
+                throw serverResponseHash.state
+                    ? ClientAuthError.createStateNotFoundError("Cached State")
+                    : ClientAuthError.createStateNotFoundError("Server State");
+            }
+            let decodedServerResponseHash;
+            let decodedCachedState;
+            try {
+                decodedServerResponseHash = decodeURIComponent(serverResponseHash.state);
             }
-            if (decodeURIComponent(serverResponseHash.state) !==
-                decodeURIComponent(cachedState)) {
+            catch (e) {
+                throw ClientAuthError.createInvalidStateError(serverResponseHash.state, `Server response hash URI could not be decoded`);
+            }
+            try {
+                decodedCachedState = decodeURIComponent(cachedState);
+            }
+            catch (e) {
+                throw ClientAuthError.createInvalidStateError(serverResponseHash.state, `Cached state URI could not be decoded`);
+            }
+            if (decodedServerResponseHash !== decodedCachedState) {
                 throw ClientAuthError.createStateMismatchError();
             }
             // Check for error
@@ -5314,7 +5400,7 @@
                 }
             }
             // generate homeAccountId
-            this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
+            this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj?.claims);
             // save the response tokens
             let requestStateObj;
             if (!!authCodePayload && !!authCodePayload.state) {
@@ -5347,7 +5433,7 @@
                         return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId);
                     }
                 }
-                await this.cacheStorage.saveCacheRecord(cacheRecord);
+                await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache);
             }
             finally {
                 if (this.persistencePlugin &&
@@ -5376,7 +5462,13 @@
             if (!StringUtils.isEmpty(serverTokenResponse.id_token) &&
                 !!idTokenObj) {
                 cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
-                cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
+                cachedAccount = AccountEntity.createAccount({
+                    homeAccountId: this.homeAccountIdentifier,
+                    idTokenClaims: idTokenObj.claims,
+                    clientInfo: serverTokenResponse.client_info,
+                    cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
+                    msGraphHost: authCodePayload?.msgraph_host,
+                }, authority);
             }
             // AccessToken
             let cachedAccessToken = null;
@@ -5418,35 +5510,7 @@
             if (!StringUtils.isEmpty(serverTokenResponse.foci)) {
                 cachedAppMetadata = AppMetadataEntity.createAppMetadataEntity(this.clientId, env, serverTokenResponse.foci);
             }
-            return new CacheRecord$1(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
-        }
-        /**
-         * Generate Account
-         * @param serverTokenResponse
-         * @param idToken
-         * @param authority
-         */
-        generateAccountEntity(serverTokenResponse, idToken, authority, authCodePayload) {
-            const authorityType = authority.authorityType;
-            const cloudGraphHostName = authCodePayload
-                ? authCodePayload.cloud_graph_host_name
-                : Constants.EMPTY_STRING;
-            const msGraphhost = authCodePayload
-                ? authCodePayload.msgraph_host
-                : Constants.EMPTY_STRING;
-            // ADFS does not require client_info in the response
-            if (authorityType === AuthorityType.Adfs) {
-                this.logger.verbose("Authority type is ADFS, creating ADFS account");
-                return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
-            }
-            // This fallback applies to B2C as well as they fall under an AAD account type.
-            if (StringUtils.isEmpty(serverTokenResponse.client_info) &&
-                authority.protocolMode === "AAD") {
-                throw ClientAuthError.createClientInfoEmptyError();
-            }
-            return serverTokenResponse.client_info
-                ? AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost)
-                : AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
+            return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
         }
         /**
          * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -5525,7 +5589,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5539,6 +5603,8 @@
             super(configuration, performanceClient);
             // Flag to indicate if client is for hybrid spa auth code redemption
             this.includeRedirectUri = true;
+            this.oidcDefaultScopes =
+                this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
         }
         /**
          * Creates the URL of the authorization request letting the user input credentials and consent to the
@@ -5577,7 +5643,7 @@
             const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
             const httpVerAuthority = response.headers?.[HeaderNames.X_MS_HTTP_VERSION];
             if (httpVerAuthority) {
-                atsMeasurement?.addStaticFields({
+                atsMeasurement?.add({
                     httpVerAuthority,
                 });
             }
@@ -5588,14 +5654,14 @@
             return responseHandler
                 .handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)
                 .then((result) => {
-                atsMeasurement?.endMeasurement({
+                atsMeasurement?.end({
                     success: true,
                 });
                 return result;
             })
                 .catch((error) => {
                 this.logger.verbose("Error in fetching token in ACC", request.correlationId);
-                atsMeasurement?.endMeasurement({
+                atsMeasurement?.end({
                     errorCode: error.errorCode,
                     subErrorCode: error.subError,
                     success: false,
@@ -5611,10 +5677,8 @@
         handleFragmentResponse(hashFragment, cachedState) {
             // Handle responses.
             const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);
-            // Deserialize hash fragment response parameters.
-            const hashUrlString = new UrlString(hashFragment);
-            // Deserialize hash fragment response parameters.
-            const serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
+            const serverParams = UrlString.getDeserializedCodeResponse(this.config.authOptions.authority.options.OIDCOptions
+                ?.serverResponseType, hashFragment);
             // Get code response
             responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState, this.cryptoUtils);
             // throw when there is no auth code in the response
@@ -5686,7 +5750,8 @@
         async createTokenRequestBody(request) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);
             const parameterBuilder = new RequestParameterBuilder();
-            parameterBuilder.addClientId(this.config.authOptions.clientId);
+            parameterBuilder.addClientId(request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+                this.config.authOptions.clientId);
             /*
              * For hybrid spa flow, there will be a code but no verifier
              * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
@@ -5700,14 +5765,14 @@
                 parameterBuilder.addRedirectUri(request.redirectUri);
             }
             // Add scope array, parameter builder will add default scopes and dedupe
-            parameterBuilder.addScopes(request.scopes);
+            parameterBuilder.addScopes(request.scopes, true, this.oidcDefaultScopes);
             // add code: user set, not validated
             parameterBuilder.addAuthorizationCode(request.code);
             // Add library metadata
             parameterBuilder.addLibraryInfo(this.config.libraryInfo);
             parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
             parameterBuilder.addThrottling();
-            if (this.serverTelemetryManager) {
+            if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
                 parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
             }
             // add code_verifier if passed
@@ -5801,12 +5866,13 @@
         async createAuthCodeUrlQueryString(request) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, request.correlationId);
             const parameterBuilder = new RequestParameterBuilder();
-            parameterBuilder.addClientId(this.config.authOptions.clientId);
+            parameterBuilder.addClientId(request.extraQueryParameters?.[AADServerParamKeys.CLIENT_ID] ||
+                this.config.authOptions.clientId);
             const requestScopes = [
                 ...(request.scopes || []),
                 ...(request.extraScopesToConsent || []),
             ];
-            parameterBuilder.addScopes(requestScopes);
+            parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);
             // validate the redirectUri (to be a non null value)
             parameterBuilder.addRedirectUri(request.redirectUri);
             // generate the correlationId if not set by the user and add
@@ -5819,7 +5885,9 @@
             parameterBuilder.addResponseTypeCode();
             // add library info parameters
             parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+            if (!isOidcProtocolMode(this.config)) {
+                parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+            }
             // add client_info=1
             parameterBuilder.addClientInfo();
             if (request.codeChallenge && request.codeChallengeMethod) {
@@ -5961,7 +6029,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5982,11 +6050,11 @@
             this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
             const response = await this.executeTokenRequest(request, this.authority);
             const httpVerToken = response.headers?.[HeaderNames.X_MS_HTTP_VERSION];
-            atsMeasurement?.addStaticFields({
+            atsMeasurement?.add({
                 refreshTokenSize: response.body.refresh_token?.length || 0,
             });
             if (httpVerToken) {
-                atsMeasurement?.addStaticFields({
+                atsMeasurement?.add({
                     httpVerToken,
                 });
             }
@@ -5998,14 +6066,14 @@
             return responseHandler
                 .handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId)
                 .then((result) => {
-                atsMeasurement?.endMeasurement({
+                atsMeasurement?.end({
                     success: true,
                 });
                 return result;
             })
                 .catch((error) => {
                 this.logger.verbose("Error in fetching refresh token", request.correlationId);
-                atsMeasurement?.endMeasurement({
+                atsMeasurement?.end({
                     errorCode: error.errorCode,
                     subErrorCode: error.subError,
                     success: false,
@@ -6069,11 +6137,11 @@
             this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
             const refreshToken = this.cacheManager.getRefreshToken(request.account, foci);
             if (!refreshToken) {
-                atsMeasurement?.discardMeasurement();
+                atsMeasurement?.discard();
                 throw InteractionRequiredAuthError.createNoTokensFoundError();
             }
             // attach cached RT size to the current measurement
-            atsMeasurement?.endMeasurement({
+            atsMeasurement?.end({
                 success: true,
             });
             const refreshTokenRequest = {
@@ -6114,13 +6182,13 @@
             };
             return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)
                 .then((result) => {
-                acquireTokenMeasurement?.endMeasurement({
+                acquireTokenMeasurement?.end({
                     success: true,
                 });
                 return result;
             })
                 .catch((error) => {
-                acquireTokenMeasurement?.endMeasurement({
+                acquireTokenMeasurement?.end({
                     success: false,
                 });
                 throw error;
@@ -6136,13 +6204,13 @@
             const acquireTokenMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.BaseClientCreateTokenRequestHeaders, correlationId);
             const parameterBuilder = new RequestParameterBuilder();
             parameterBuilder.addClientId(this.config.authOptions.clientId);
-            parameterBuilder.addScopes(request.scopes);
+            parameterBuilder.addScopes(request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
             parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
             parameterBuilder.addClientInfo();
             parameterBuilder.addLibraryInfo(this.config.libraryInfo);
             parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
             parameterBuilder.addThrottling();
-            if (this.serverTelemetryManager) {
+            if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
                 parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
             }
             parameterBuilder.addCorrelationId(correlationId);
@@ -6167,7 +6235,7 @@
                     parameterBuilder.addSshJwk(request.sshJwk);
                 }
                 else {
-                    acquireTokenMeasurement?.endMeasurement({
+                    acquireTokenMeasurement?.end({
                         success: false,
                     });
                     throw ClientConfigurationError.createMissingSshJwkError();
@@ -6196,14 +6264,14 @@
                         break;
                 }
             }
-            acquireTokenMeasurement?.endMeasurement({
+            acquireTokenMeasurement?.end({
                 success: true,
             });
             return parameterBuilder.createQueryString();
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6306,7 +6374,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6318,7 +6386,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7195,21 +7263,16 @@
     };
     const EndpointMetadata = rawMetdataJSON.endpointMetadata;
     const InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
+    const InstanceDiscoveryMetadataAliases = new Set();
+    for (const key in InstanceDiscoveryMetadata) {
+        for (const metadata of InstanceDiscoveryMetadata[key].metadata) {
+            for (const alias of metadata.aliases) {
+                InstanceDiscoveryMetadataAliases.add(alias);
+            }
+        }
+    }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Protocol modes supported by MSAL.
-     */
-    const ProtocolMode = {
-        AAD: "AAD",
-        OIDC: "OIDC",
-    };
-
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7289,7 +7352,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7299,7 +7362,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7309,7 +7372,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7420,7 +7483,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7593,10 +7656,10 @@
          * @private
          */
         canReplaceTenant(authorityUri) {
-            return authorityUri.PathSegments.length === 1
-                && !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0])
-                && this.getAuthorityType(authorityUri) === AuthorityType.Default
-                && this.protocolMode === ProtocolMode.AAD;
+            return (authorityUri.PathSegments.length === 1 &&
+                !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0]) &&
+                this.getAuthorityType(authorityUri) === AuthorityType.Default &&
+                this.protocolMode === ProtocolMode.AAD);
         }
         /**
          * Replaces tenant in url path with current tenant. Defaults to common.
@@ -7617,8 +7680,9 @@
             const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
             currentAuthorityParts.forEach((currentPart, index) => {
                 let cachedPart = cachedAuthorityParts[index];
-                if (index === 0 && this.canReplaceTenant(cachedAuthorityUrlComponents)) {
-                    const tenantId = (new UrlString(this.metadata.authorization_endpoint)).getUrlComponents().PathSegments[0];
+                if (index === 0 &&
+                    this.canReplaceTenant(cachedAuthorityUrlComponents)) {
+                    const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
                     /**
                      * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
                      * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
@@ -7639,8 +7703,9 @@
          * The default open id configuration endpoint for any canonical authority.
          */
         get defaultOpenIdConfigurationEndpoint() {
+            const canonicalAuthorityHost = this.hostnameAndPort;
             if (this.authorityType === AuthorityType.Adfs ||
-                this.protocolMode === ProtocolMode.OIDC) {
+                !this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost)) {
                 return `${this.canonicalAuthority}.well-known/openid-configuration`;
             }
             return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
@@ -7683,41 +7748,65 @@
          */
         async updateEndpointMetadata(metadataEntity) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityUpdateEndpointMetadata, this.correlationId);
+            this.logger.verbose("Attempting to get endpoint metadata from authority configuration");
             let metadata = this.getEndpointMetadataFromConfig();
             if (metadata) {
+                this.logger.verbose("Found endpoint metadata in authority configuration");
                 metadataEntity.updateEndpointMetadata(metadata, false);
                 return AuthorityMetadataSource.CONFIG;
             }
+            this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.");
+            // skipAuthorityMetadataCache is used to bypass hardcoded authority metadata and force a network metadata cache lookup and network metadata request if no cached response is available.
+            if (this.authorityOptions.skipAuthorityMetadataCache) {
+                this.logger.verbose("Skipping hardcoded metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get endpoint metadata from the network metadata cache.");
+            }
+            else {
+                let hardcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
+                if (hardcodedMetadata) {
+                    this.logger.verbose("Found endpoint metadata from hardcoded values.");
+                    // If the user prefers to use an azure region replace the global endpoints with regional information.
+                    if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
+                        this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
+                        this.logger.verbose("Found azure region configuration. Updating endpoints with regional information.");
+                        hardcodedMetadata =
+                            await this.updateMetadataWithRegionalInformation(hardcodedMetadata);
+                    }
+                    metadataEntity.updateEndpointMetadata(hardcodedMetadata, false);
+                    return AuthorityMetadataSource.HARDCODED_VALUES;
+                }
+                else {
+                    this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.");
+                }
+            }
+            // Check cached metadata entity expiration status
+            const metadataEntityExpired = metadataEntity.isExpired();
             if (this.isAuthoritySameType(metadataEntity) &&
                 metadataEntity.endpointsFromNetwork &&
-                !metadataEntity.isExpired()) {
+                !metadataEntityExpired) {
                 // No need to update
+                this.logger.verbose("Found endpoint metadata in the cache.");
                 return AuthorityMetadataSource.CACHE;
             }
+            else if (metadataEntityExpired) {
+                this.logger.verbose("The metadata entity is expired.");
+            }
+            this.logger.verbose("Did not find cached endpoint metadata... Attempting to get endpoint metadata from the network.");
             this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork, this.correlationId);
             metadata = await this.getEndpointMetadataFromNetwork();
             if (metadata) {
+                this.logger.verbose("Endpoint metadata was successfully returned from getEndpointMetadataFromNetwork()");
                 // If the user prefers to use an azure region replace the global endpoints with regional information.
                 if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
                     this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
+                    this.logger.verbose("Found azure region configuration. Updating endpoints with regional information.");
                     metadata = await this.updateMetadataWithRegionalInformation(metadata);
                 }
                 metadataEntity.updateEndpointMetadata(metadata, true);
                 return AuthorityMetadataSource.NETWORK;
             }
-            let harcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
-            if (harcodedMetadata &&
-                !this.authorityOptions.skipAuthorityMetadataCache) {
-                // If the user prefers to use an azure region replace the global endpoints with regional information.
-                if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
-                    this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
-                    harcodedMetadata =
-                        await this.updateMetadataWithRegionalInformation(harcodedMetadata);
-                }
-                metadataEntity.updateEndpointMetadata(harcodedMetadata, false);
-                return AuthorityMetadataSource.HARDCODED_VALUES;
-            }
             else {
+                // Metadata could not be obtained from the config, cache, network or hardcoded values
+                this.logger.error("Did not find endpoint metadata from network... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
                 throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
             }
         }
@@ -7766,17 +7855,23 @@
                 const response = await this.networkInterface.sendGetRequestAsync(openIdConfigurationEndpoint, options);
                 const isValidResponse = isOpenIdConfigResponse(response.body);
                 if (isValidResponse) {
-                    perfEvent?.endMeasurement({ success: true });
+                    perfEvent?.end({ success: true });
                     return response.body;
                 }
                 else {
-                    perfEvent?.endMeasurement({ success: false, errorCode: "invalid_response" });
+                    perfEvent?.end({
+                        success: false,
+                        errorCode: "invalid_response",
+                    });
                     this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration`);
                     return null;
                 }
             }
             catch (e) {
-                perfEvent?.endMeasurement({ success: false, errorCode: "request_failure" });
+                perfEvent?.end({
+                    success: false,
+                    errorCode: "request_failure",
+                });
                 this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: ${e}`);
                 return null;
             }
@@ -7798,19 +7893,26 @@
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
             const userConfiguredAzureRegion = this.authorityOptions.azureRegionConfiguration?.azureRegion;
             if (userConfiguredAzureRegion) {
-                if (userConfiguredAzureRegion !== Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
-                    this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
-                    this.regionDiscoveryMetadata.region_used = userConfiguredAzureRegion;
+                if (userConfiguredAzureRegion !==
+                    Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
+                    this.regionDiscoveryMetadata.region_outcome =
+                        RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                    this.regionDiscoveryMetadata.region_used =
+                        userConfiguredAzureRegion;
                     return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
                 }
                 this.performanceClient?.setPreQueueTime(PerformanceEvents.RegionDiscoveryDetectRegion, this.correlationId);
-                const autodetectedRegionName = await this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration?.environmentRegion, this.regionDiscoveryMetadata);
+                const autodetectedRegionName = await this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration
+                    ?.environmentRegion, this.regionDiscoveryMetadata);
                 if (autodetectedRegionName) {
-                    this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
-                    this.regionDiscoveryMetadata.region_used = autodetectedRegionName;
+                    this.regionDiscoveryMetadata.region_outcome =
+                        RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
+                    this.regionDiscoveryMetadata.region_used =
+                        autodetectedRegionName;
                     return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
                 }
-                this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
+                this.regionDiscoveryMetadata.region_outcome =
+                    RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
             }
             return metadata;
         }
@@ -7822,7 +7924,7 @@
          */
         async updateCloudDiscoveryMetadata(metadataEntity) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityUpdateCloudDiscoveryMetadata, this.correlationId);
-            this.logger.verbose("Attempting to get cloud discovery metadata in the config");
+            this.logger.verbose("Attempting to get cloud discovery metadata  from authority configuration");
             this.logger.verbosePii(`Known Authorities: ${this.authorityOptions.knownAuthorities ||
             Constants.NOT_APPLICABLE}`);
             this.logger.verbosePii(`Authority Metadata: ${this.authorityOptions.authorityMetadata ||
@@ -7830,17 +7932,29 @@
             this.logger.verbosePii(`Canonical Authority: ${metadataEntity.canonical_authority || Constants.NOT_APPLICABLE}`);
             let metadata = this.getCloudDiscoveryMetadataFromConfig();
             if (metadata) {
-                this.logger.verbose("Found cloud discovery metadata in the config.");
+                this.logger.verbose("Found cloud discovery metadata in authority configuration");
                 metadataEntity.updateCloudDiscoveryMetadata(metadata, false);
                 return AuthorityMetadataSource.CONFIG;
             }
-            // If the cached metadata came from config but that config was not passed to this instance, we must go to the network
-            this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the cache.");
+            // If the cached metadata came from config but that config was not passed to this instance, we must go to hardcoded values
+            this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.");
+            if (this.options.skipAuthorityMetadataCache) {
+                this.logger.verbose("Skipping hardcoded cloud discovery metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get cloud discovery metadata from the network metadata cache.");
+            }
+            else {
+                const hardcodedMetadata = this.getCloudDiscoveryMetadataFromHardcodedValues();
+                if (hardcodedMetadata) {
+                    this.logger.verbose("Found cloud discovery metadata from hardcoded values.");
+                    metadataEntity.updateCloudDiscoveryMetadata(hardcodedMetadata, false);
+                    return AuthorityMetadataSource.HARDCODED_VALUES;
+                }
+                this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.");
+            }
             const metadataEntityExpired = metadataEntity.isExpired();
             if (this.isAuthoritySameType(metadataEntity) &&
                 metadataEntity.aliasesFromNetwork &&
                 !metadataEntityExpired) {
-                this.logger.verbose("Found metadata in the cache.");
+                this.logger.verbose("Found cloud discovery metadata in the cache.");
                 // No need to update
                 return AuthorityMetadataSource.CACHE;
             }
@@ -7855,15 +7969,8 @@
                 metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
                 return AuthorityMetadataSource.NETWORK;
             }
-            this.logger.verbose("Did not find cloud discovery metadata from the network... Attempting to get cloud discovery metadata from hardcoded values.");
-            const harcodedMetadata = this.getCloudDiscoveryMetadataFromHarcodedValues();
-            if (harcodedMetadata && !this.options.skipAuthorityMetadataCache) {
-                this.logger.verbose("Found cloud discovery metadata from hardcoded values.");
-                metadataEntity.updateCloudDiscoveryMetadata(harcodedMetadata, false);
-                return AuthorityMetadataSource.HARDCODED_VALUES;
-            }
             // Metadata could not be obtained from the config, cache, network or hardcoded values
-            this.logger.error("Did not find cloud discovery metadata from hardcoded values... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
+            this.logger.error("Did not find cloud discovery metadata from network... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
             throw ClientConfigurationError.createUntrustedAuthorityError();
         }
         /**
@@ -7968,9 +8075,11 @@
         /**
          * Get cloud discovery metadata for common authorities
          */
-        getCloudDiscoveryMetadataFromHarcodedValues() {
+        getCloudDiscoveryMetadataFromHardcodedValues() {
             if (this.canonicalAuthority in InstanceDiscoveryMetadata) {
-                return InstanceDiscoveryMetadata[this.canonicalAuthority];
+                const hardcodedMetadataResponse = InstanceDiscoveryMetadata[this.canonicalAuthority];
+                const metadata = Authority.getCloudDiscoveryMetadataFromNetworkResponse(hardcodedMetadataResponse.metadata, this.hostnameAndPort);
+                return metadata;
             }
             return null;
         }
@@ -8045,6 +8154,13 @@
         isAlias(host) {
             return this.metadata.aliases.indexOf(host) > -1;
         }
+        /**
+         * Returns whether or not the provided host is an alias of a known Microsoft authority for purposes of endpoint discovery
+         * @param host
+         */
+        isAliasOfKnownMicrosoftAuthority(host) {
+            return InstanceDiscoveryMetadataAliases.has(host);
+        }
         /**
          * Checks whether the provided host is that of a public cloud authority
          *
@@ -8086,15 +8202,17 @@
          * @param azureRegion string
          */
         static replaceWithRegionalInformation(metadata, azureRegion) {
-            metadata.authorization_endpoint =
-                Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
+            const regionalMetadata = { ...metadata };
+            regionalMetadata.authorization_endpoint =
+                Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
             // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
-            metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
-            if (metadata.end_session_endpoint) {
-                metadata.end_session_endpoint =
-                    Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+            regionalMetadata.token_endpoint =
+                Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
+            if (regionalMetadata.end_session_endpoint) {
+                regionalMetadata.end_session_endpoint =
+                    Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
             }
-            return metadata;
+            return regionalMetadata;
         }
         /**
          * Transform CIAM_AUTHORIY as per the below rules:
@@ -8106,11 +8224,14 @@
          * @param authority
          */
         static transformCIAMAuthority(authority) {
-            let ciamAuthority = authority.endsWith(Constants.FORWARD_SLASH) ? authority : `${authority}${Constants.FORWARD_SLASH}`;
+            let ciamAuthority = authority.endsWith(Constants.FORWARD_SLASH)
+                ? authority
+                : `${authority}${Constants.FORWARD_SLASH}`;
             const authorityUrl = new UrlString(authority);
             const authorityUrlComponents = authorityUrl.getUrlComponents();
             // check if transformation is needed
-            if (authorityUrlComponents.PathSegments.length === 0 && (authorityUrlComponents.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL))) {
+            if (authorityUrlComponents.PathSegments.length === 0 &&
+                authorityUrlComponents.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL)) {
                 const tenantIdOrDomain = authorityUrlComponents.HostNameAndPort.split(".")[0];
                 ciamAuthority = `${ciamAuthority}${tenantIdOrDomain}${Constants.AAD_TENANT_DOMAIN_SUFFIX}`;
             }
@@ -8118,15 +8239,15 @@
         }
     }
     // Reserved tenant domain names that will not be replaced with tenant id
-    Authority.reservedTenantDomains = (new Set([
+    Authority.reservedTenantDomains = new Set([
         "{tenant}",
         "{tenantid}",
         AADAuthorityConstants.COMMON,
         AADAuthorityConstants.CONSUMERS,
-        AADAuthorityConstants.ORGANIZATIONS
-    ]));
+        AADAuthorityConstants.ORGANIZATIONS,
+    ]);
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8176,7 +8297,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8206,7 +8327,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8232,7 +8353,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8249,7 +8370,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8291,7 +8412,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8330,7 +8451,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8388,7 +8509,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8587,7 +8708,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8604,8 +8725,10 @@
          * @param {Logger} logger Logger used by the application
          * @param {string} libraryName Name of the library
          * @param {string} libraryVersion Version of the library
+         * @param {ApplicationTelemetry} applicationTelemetry application name and version
+         * @param {Set<String>} intFields integer fields to be truncated
          */
-        constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
+        constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry, intFields) {
             this.authority = authority;
             this.libraryName = libraryName;
             this.libraryVersion = libraryVersion;
@@ -8616,6 +8739,10 @@
             this.eventsByCorrelationId = new Map();
             this.queueMeasurements = new Map();
             this.preQueueTimeByCorrelationId = new Map();
+            this.intFields = intFields || new Set();
+            for (const item of IntFields) {
+                this.intFields.add(item);
+            }
         }
         /**
          * Starts and returns an platform-specific implementation of IPerformanceMeasurement.
@@ -8630,13 +8757,6 @@
         ) {
             return {};
         }
-        /**
-         * Get integral fields.
-         * Override to change the set.
-         */
-        getIntFields() {
-            return IntFields;
-        }
         /**
          * Gets map of pre-queue times by correlation Id
          *
@@ -8754,7 +8874,7 @@
             this.cacheEventByCorrelationId(inProgressEvent);
             // Return the event and functions the caller can use to properly end/flush the measurement
             return {
-                endMeasurement: (event) => {
+                end: (event) => {
                     return this.endMeasurement({
                         // Initial set of event properties
                         ...inProgressEvent,
@@ -8762,14 +8882,14 @@
                         ...event,
                     }, performanceMeasurement);
                 },
-                discardMeasurement: () => {
+                discard: () => {
                     return this.discardMeasurements(inProgressEvent.correlationId);
                 },
-                addStaticFields: (fields) => {
-                    return this.addStaticFields(fields, inProgressEvent.correlationId);
+                add: (fields) => {
+                    return this.addFields(fields, inProgressEvent.correlationId);
                 },
-                increment: (counters) => {
-                    return this.increment(counters, inProgressEvent.correlationId);
+                increment: (fields) => {
+                    return this.incrementFields(fields, inProgressEvent.correlationId);
                 },
                 measurement: performanceMeasurement,
                 event: inProgressEvent,
@@ -8834,7 +8954,7 @@
                 status: PerformanceEventStatus.Completed,
                 incompleteSubsCount,
             };
-            this.truncateIntegralFields(finalEvent, this.getIntFields());
+            this.truncateIntegralFields(finalEvent);
             this.emitEvents([finalEvent], event.correlationId);
             return finalEvent;
         }
@@ -8843,7 +8963,7 @@
          * @param fields
          * @param correlationId
          */
-        addStaticFields(fields, correlationId) {
+        addFields(fields, correlationId) {
             this.logger.trace("PerformanceClient: Updating static fields");
             const event = this.eventsByCorrelationId.get(correlationId);
             if (event) {
@@ -8858,18 +8978,21 @@
         }
         /**
          * Increment counters to be emitted when the measurements are flushed
-         * @param counters {Counters}
+         * @param fields {string[]}
          * @param correlationId {string} correlation identifier
          */
-        increment(counters, correlationId) {
+        incrementFields(fields, correlationId) {
             this.logger.trace("PerformanceClient: Updating counters");
             const event = this.eventsByCorrelationId.get(correlationId);
             if (event) {
-                for (const counter in counters) {
+                for (const counter in fields) {
                     if (!event.hasOwnProperty(counter)) {
                         event[counter] = 0;
                     }
-                    event[counter] += counters[counter];
+                    else if (isNaN(Number(event[counter]))) {
+                        return;
+                    }
+                    event[counter] += fields[counter];
                 }
             }
             else {
@@ -8987,8 +9110,8 @@
          * @param {PerformanceEvent} event performance event to update.
          * @param {Set<string>} intFields integral fields.
          */
-        truncateIntegralFields(event, intFields) {
-            intFields.forEach((key) => {
+        truncateIntegralFields(event) {
+            this.intFields.forEach((key) => {
                 if (key in event && typeof event[key] === "number") {
                     event[key] = Math.floor(event[key]);
                 }
@@ -8996,16 +9119,22 @@
         }
     }
 
-    /*! @azure/msal-common v14.0.0-beta.1 2023-07-06 */
+    /*! @azure/msal-common v14.0.1 2023-08-11 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     class StubPerformanceMeasurement {
-        startMeasurement() { return; }
-        endMeasurement() { return; }
-        flushMeasurement() { return null; }
+        startMeasurement() {
+            return;
+        }
+        endMeasurement() {
+            return;
+        }
+        flushMeasurement() {
+            return null;
+        }
     }
     class StubPerformanceClient extends PerformanceClient {
         generateId() {
@@ -9017,8 +9146,36 @@
         calculateQueuedTime() {
             return 0;
         }
-        addQueueMeasurement() { return; }
-        setPreQueueTime() { return; }
+        addQueueMeasurement() {
+            return;
+        }
+        setPreQueueTime() {
+            return;
+        }
+        endMeasurement() {
+            return null;
+        }
+        discardMeasurements() {
+            return;
+        }
+        removePerformanceCallback() {
+            return true;
+        }
+        addPerformanceCallback() {
+            return "";
+        }
+        emitEvents() {
+            return;
+        }
+        addFields() {
+            return;
+        }
+        incrementFields() {
+            return;
+        }
+        cacheEventByCorrelationId() {
+            return;
+        }
     }
 
     /*
@@ -9201,9 +9358,9 @@
             code: "native_connection_not_established",
             desc: "Connection to native platform has not been established. Please install a compatible browser extension and run initialize(). For more please visit aka.ms/msaljs/browser-errors.",
         },
-        nativeBrokerCalledBeforeInitialize: {
-            code: "native_broker_called_before_initialize",
-            desc: "You must call and await the initialize function before attempting to call any other MSAL API when native brokering is enabled. For more please visit aka.ms/msaljs/browser-errors.",
+        uninitializedPublicClientApplication: {
+            code: "uninitialized_public_client_application",
+            desc: "You must call and await the initialize function before attempting to call any other MSAL API. For more please visit aka.ms/msaljs/browser-errors.",
         },
         nativePromptNotSupported: {
             code: "native_prompt_not_supported",
@@ -9493,8 +9650,8 @@
         /**
          * Create an error thrown when the initialize function hasn't been called
          */
-        static createNativeBrokerCalledBeforeInitialize() {
-            return new BrowserAuthError(BrowserAuthErrorMessage.nativeBrokerCalledBeforeInitialize.code, BrowserAuthErrorMessage.nativeBrokerCalledBeforeInitialize.desc);
+        static createUninitializedPublicClientApplication() {
+            return new BrowserAuthError(BrowserAuthErrorMessage.uninitializedPublicClientApplication.code, BrowserAuthErrorMessage.uninitializedPublicClientApplication.desc);
         }
         /**
          * Create an error thrown when requesting a token directly from the native platform with an unsupported prompt parameter e.g. select_account, login or create
@@ -11175,6 +11332,23 @@
         setRedirectRequestContext(value) {
             this.setTemporaryCache(TemporaryCacheKeys.REDIRECT_CONTEXT, value, true);
         }
+        /**
+         * Builds credential entities from AuthenticationResult object and saves the resulting credentials to the cache
+         * @param result
+         * @param request
+         */
+        async hydrateCache(result, request) {
+            const idTokenEntity = IdTokenEntity.createIdTokenEntity(result.account?.homeAccountId, result.account?.environment, result.idToken, this.clientId, result.tenantId);
+            let claimsHash;
+            if (request.claims) {
+                claimsHash = await this.cryptoImpl.hashString(request.claims);
+            }
+            const accessTokenEntity = AccessTokenEntity.createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn?.getTime() || 0, result.extExpiresOn?.getTime() || 0, this.cryptoImpl, undefined, // refreshOn
+            result.tokenType, undefined, // userAssertionHash
+            request.sshKid, request.claims, claimsHash);
+            const cacheRecord = new CacheRecord(undefined, idTokenEntity, accessTokenEntity);
+            return this.saveCacheRecord(cacheRecord);
+        }
     }
     const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger) => {
         const cacheOptions = {
@@ -11188,20 +11362,9 @@
         return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger);
     };
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    class CacheRecord extends CacheRecord$1 {
-        constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
-            super(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity);
-            this.account = accountEntity;
-        }
-    }
-
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "3.0.0-beta.1";
+    const version = "3.0.1";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11537,13 +11700,12 @@
             }
         }
         /**
-         * Throws error if native brokering is enabled but initialize hasn't been called
-         * @param allowNativeBroker
+         * Throws error if initialize hasn't been called
          * @param initialized
          */
-        static blockNativeBrokerCalledBeforeInitialized(allowNativeBroker, initialized) {
-            if (allowNativeBroker && !initialized) {
-                throw BrowserAuthError.createNativeBrokerCalledBeforeInitialize();
+        static blockAPICallsBeforeInitialize(initialized) {
+            if (!initialized) {
+                throw BrowserAuthError.createUninitializedPublicClientApplication();
             }
         }
         /**
@@ -11702,6 +11864,7 @@
             this.logger.verbose("getDiscoveredAuthority called");
             const authorityOptions = {
                 protocolMode: this.config.auth.protocolMode,
+                OIDCOptions: this.config.auth.OIDCOptions,
                 knownAuthorities: this.config.auth.knownAuthorities,
                 cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
                 authorityMetadata: this.config.auth.authorityMetadata,
@@ -11911,6 +12074,7 @@
             const getAuthorityMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.correlationId);
             const authorityOptions = {
                 protocolMode: this.config.auth.protocolMode,
+                OIDCOptions: this.config.auth.OIDCOptions,
                 knownAuthorities: this.config.auth.knownAuthorities,
                 cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
                 authorityMetadata: this.config.auth.authorityMetadata,
@@ -11926,13 +12090,13 @@
             this.performanceClient.setPreQueueTime(PerformanceEvents.AuthorityFactoryCreateDiscoveredInstance, this.correlationId);
             return await AuthorityFactory.createDiscoveredInstance(builtAuthority, this.config.system.networkClient, this.browserStorage, authorityOptions, this.logger, this.performanceClient, this.correlationId)
                 .then((result) => {
-                getAuthorityMeasurement.endMeasurement({
+                getAuthorityMeasurement.end({
                     success: true,
                 });
                 return result;
             })
                 .catch((error) => {
-                getAuthorityMeasurement.endMeasurement({
+                getAuthorityMeasurement.end({
                     errorCode: error.errorCode,
                     subErrorCode: error.subError,
                     success: false,
@@ -11959,7 +12123,8 @@
                 redirectUri: redirectUri,
                 state: state,
                 nonce: request.nonce || this.browserCrypto.createNewGuid(),
-                responseMode: ResponseMode.FRAGMENT,
+                responseMode: this.config.auth.OIDCOptions
+                    .serverResponseType,
             };
             const account = request.account || this.browserStorage.getActiveAccount();
             if (account) {
@@ -12071,7 +12236,7 @@
             }
             // Acquire token with retrieved code.
             this.performanceClient.setPreQueueTime(PerformanceEvents.AuthClientAcquireToken, this.authCodeRequest.correlationId);
-            const tokenResponse = await this.authModule.acquireToken(this.authCodeRequest, authCodeResponse);
+            const tokenResponse = (await this.authModule.acquireToken(this.authCodeRequest, authCodeResponse));
             this.browserStorage.cleanRequestByState(state);
             return tokenResponse;
         }
@@ -12219,7 +12384,7 @@
                 }
             }
             // Acquire token with retrieved code.
-            const tokenResponse = await this.authModule.acquireToken(this.authCodeRequest, authCodeResponse);
+            const tokenResponse = (await this.authModule.acquireToken(this.authCodeRequest, authCodeResponse));
             this.browserStorage.cleanRequestByState(state);
             return tokenResponse;
         }
@@ -12254,7 +12419,7 @@
         LOGOUT_SUCCESS: "msal:logoutSuccess",
         LOGOUT_FAILURE: "msal:logoutFailure",
         LOGOUT_END: "msal:logoutEnd",
-        RESTORE_FROM_BFCACHE: "msal:restoreFromBFCache"
+        RESTORE_FROM_BFCACHE: "msal:restoreFromBFCache",
     };
 
     /*
@@ -12367,8 +12532,8 @@
             const silentAuthClient = await this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions);
             this.logger.verbose("Silent auth client created");
             try {
-                const cachedToken = await silentAuthClient.acquireCachedToken(silentRequest);
-                acquireTokenMeasurement.endMeasurement({
+                const cachedToken = (await silentAuthClient.acquireCachedToken(silentRequest));
+                acquireTokenMeasurement.end({
                     success: true,
                     fromCache: true,
                 });
@@ -12380,7 +12545,7 @@
                         BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
                     this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
                 }
-                acquireTokenMeasurement.endMeasurement({
+                acquireTokenMeasurement.end({
                     errorCode: (error instanceof AuthError && error.errorCode) ||
                         undefined,
                     subErrorCode: (error instanceof AuthError && error.subError) || undefined,
@@ -12412,7 +12577,7 @@
             this.performanceClient.setPreQueueTime(PerformanceEvents.InitializeBaseRequest, this.correlationId);
             return {
                 ...request,
-                ...await this.initializeBaseRequest(request, account),
+                ...(await this.initializeBaseRequest(request, account)),
                 account: account,
                 forceRefresh: request.forceRefresh || false,
             };
@@ -12423,6 +12588,10 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
+    const BrokerServerParamKeys = {
+        BROKER_CLIENT_ID: "brk_client_id",
+        BROKER_REDIRECT_URI: "brk_redirect_uri",
+    };
     class NativeInteractionClient extends BaseInteractionClient {
         constructor(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, nativeStorageImpl, correlationId) {
             super(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
@@ -12446,7 +12615,7 @@
             // check if the tokens can be retrieved from internal cache
             try {
                 const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
-                nativeATMeasurement.endMeasurement({
+                nativeATMeasurement.end({
                     success: true,
                     isNativeBroker: false,
                     fromCache: true,
@@ -12466,7 +12635,7 @@
             const validatedResponse = this.validateNativeResponse(response);
             return this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
                 .then((result) => {
-                nativeATMeasurement.endMeasurement({
+                nativeATMeasurement.end({
                     success: true,
                     isNativeBroker: true,
                     requestId: result.requestId,
@@ -12474,7 +12643,7 @@
                 return result;
             })
                 .catch((error) => {
-                nativeATMeasurement.endMeasurement({
+                nativeATMeasurement.end({
                     success: false,
                     errorCode: error.errorCode,
                     subErrorCode: error.subError,
@@ -12520,7 +12689,10 @@
             try {
                 const silentRequest = this.createSilentCacheRequest(request, account);
                 const result = await this.silentCacheClient.acquireToken(silentRequest);
-                return result;
+                return {
+                    ...result,
+                    account,
+                };
             }
             catch (e) {
                 throw e;
@@ -12618,16 +12790,20 @@
             }
             // Get the preferred_cache domain for the given authority
             const authority = await this.getDiscoveredAuthority(request.authority);
-            const authorityPreferredCache = authority.getPreferredCache();
             // generate identifiers
             const idTokenObj = this.createIdTokenObj(response);
             const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenObj);
-            const accountEntity = this.createAccountEntity(response, homeAccountIdentifier, idTokenObj, authorityPreferredCache);
+            const accountEntity = AccountEntity.createAccount({
+                homeAccountId: homeAccountIdentifier,
+                idTokenClaims: idTokenObj.claims,
+                clientInfo: response.client_info,
+                nativeAccountId: response.account.id,
+            }, authority);
             // generate authenticationResult
             const result = await this.generateAuthenticationResult(response, request, idTokenObj, accountEntity, authority.canonicalAuthority, reqTimestamp);
             // cache accounts and tokens in the appropriate storage
             this.cacheAccount(accountEntity);
-            this.cacheNativeTokens(response, request, homeAccountIdentifier, accountEntity, idTokenObj, result.accessToken, result.tenantId, reqTimestamp);
+            this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenObj, result.accessToken, result.tenantId, reqTimestamp);
             return result;
         }
         /**
@@ -12646,20 +12822,9 @@
          */
         createHomeAccountIdentifier(response, idTokenObj) {
             // Save account in browser storage
-            const homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj);
+            const homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj.claims);
             return homeAccountIdentifier;
         }
-        /**
-         * Creates account entity
-         * @param response
-         * @param homeAccountIdentifier
-         * @param idTokenObj
-         * @param authority
-         * @returns
-         */
-        createAccountEntity(response, homeAccountIdentifier, idTokenObj, authority) {
-            return AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, authority, response.account.id);
-        }
         /**
          * Helper to generate scopes
          * @param response
@@ -12778,7 +12943,7 @@
          * @param tenantId
          * @param reqTimestamp
          */
-        cacheNativeTokens(response, request, homeAccountIdentifier, accountEntity, idTokenObj, responseAccessToken, tenantId, reqTimestamp) {
+        cacheNativeTokens(response, request, homeAccountIdentifier, idTokenObj, responseAccessToken, tenantId, reqTimestamp) {
             const cachedIdToken = IdTokenEntity.createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || Constants.EMPTY_STRING, request.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
             // cache accessToken in inmemory storage
             const expiresIn = request.tokenType === AuthenticationScheme.POP
@@ -12791,15 +12956,15 @@
             const cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenObj
                 ? idTokenObj.claims.tid || Constants.EMPTY_STRING
                 : tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, this.browserCrypto);
-            const nativeCacheRecord = new CacheRecord(accountEntity, cachedIdToken, cachedAccessToken);
-            this.nativeStorageManager.saveCacheRecord(nativeCacheRecord);
+            const nativeCacheRecord = new CacheRecord(undefined, cachedIdToken, cachedAccessToken);
+            this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
         }
         addTelemetryFromNativeResponse(response) {
             const mats = this.getMATSFromResponse(response);
             if (!mats) {
                 return null;
             }
-            this.performanceClient.addStaticFields({
+            this.performanceClient.addFields({
                 extensionId: this.nativeMessageHandler.getExtensionId(),
                 extensionVersion: this.nativeMessageHandler.getExtensionVersion(),
                 matsBrokerVersion: mats.broker_version,
@@ -12918,10 +13083,14 @@
                 extraParameters: {
                     ...request.extraQueryParameters,
                     ...request.tokenQueryParameters,
-                    telemetry: NativeConstants.MATS_TELEMETRY,
                 },
                 extendedExpiryToken: false, // Make this configurable?
             };
+            this.handleExtraBrokerParams(validatedRequest);
+            validatedRequest.extraParameters =
+                validatedRequest.extraParameters || {};
+            validatedRequest.extraParameters.telemetry =
+                NativeConstants.MATS_TELEMETRY;
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 // add POP request type
                 const shrParameters = {
@@ -12938,6 +13107,28 @@
             }
             return validatedRequest;
         }
+        /**
+         * Handles extra broker request parameters
+         * @param request {NativeTokenRequest}
+         * @private
+         */
+        handleExtraBrokerParams(request) {
+            if (!request.extraParameters) {
+                return;
+            }
+            if (request.extraParameters.hasOwnProperty(BrokerServerParamKeys.BROKER_CLIENT_ID) &&
+                request.extraParameters.hasOwnProperty(BrokerServerParamKeys.BROKER_REDIRECT_URI) &&
+                request.extraParameters.hasOwnProperty(AADServerParamKeys.CLIENT_ID)) {
+                const child_client_id = request.extraParameters[AADServerParamKeys.CLIENT_ID];
+                const child_redirect_uri = request.redirectUri;
+                const brk_redirect_uri = request.extraParameters[BrokerServerParamKeys.BROKER_REDIRECT_URI];
+                request.extraParameters = {
+                    child_client_id,
+                    child_redirect_uri,
+                };
+                request.redirectUri = brk_redirect_uri;
+            }
+        }
     }
 
     /*
@@ -13012,7 +13203,7 @@
                     method: NativeExtensionMethod.HandshakeRequest,
                 },
             };
-            this.handshakeEvent.addStaticFields({
+            this.handshakeEvent.add({
                 extensionId: this.extensionId,
                 extensionHandshakeTimeoutMs: this.handshakeTimeoutMs,
             });
@@ -13030,7 +13221,7 @@
                     window.removeEventListener("message", this.windowListener, false);
                     this.messageChannel.port1.close();
                     this.messageChannel.port2.close();
-                    this.handshakeEvent.endMeasurement({
+                    this.handshakeEvent.end({
                         extensionHandshakeTimedOut: true,
                         success: false,
                     });
@@ -13075,7 +13266,7 @@
                 this.messageChannel.port1.close();
                 this.messageChannel.port2.close();
                 window.removeEventListener("message", this.windowListener, false);
-                this.handshakeEvent.endMeasurement({
+                this.handshakeEvent.end({
                     success: false,
                     extensionInstalled: false,
                 });
@@ -13127,7 +13318,7 @@
                     this.extensionId = request.extensionId;
                     this.extensionVersion = request.body.version;
                     this.logger.verbose(`NativeMessageHandler - Received HandshakeResponse from extension: ${this.extensionId}`);
-                    this.handshakeEvent.endMeasurement({
+                    this.handshakeEvent.end({
                         extensionInstalled: true,
                         success: true,
                     });
@@ -13436,6 +13627,18 @@
                 this.performanceClient.setPreQueueTime(PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, validLogoutRequest.correlationId);
                 const authClient = await this.createAuthCodeClient(serverTelemetryManager, logoutRequest && logoutRequest.authority);
                 this.logger.verbose("Auth code client created");
+                if (authClient.authority.protocolMode === ProtocolMode.OIDC) {
+                    try {
+                        authClient.authority.endSessionEndpoint;
+                    }
+                    catch {
+                        if (validLogoutRequest.account?.homeAccountId) {
+                            this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId);
+                            this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Redirect, validLogoutRequest);
+                            return;
+                        }
+                    }
+                }
                 // Create logout string and navigate user window to logout.
                 const logoutUri = authClient.getLogoutUri(validLogoutRequest);
                 this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Redirect, validLogoutRequest);
@@ -13610,7 +13813,7 @@
                     this.logger.verbose("Account id found in hash, calling WAM for token");
                     // end measurement for server call with native brokering enabled
                     if (fetchNativeAccountIdMeasurement) {
-                        fetchNativeAccountIdMeasurement.endMeasurement({
+                        fetchNativeAccountIdMeasurement.end({
                             success: true,
                             isNativeBroker: true,
                         });
@@ -13667,6 +13870,30 @@
                 this.performanceClient.setPreQueueTime(PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, validRequest.correlationId);
                 const authClient = await this.createAuthCodeClient(serverTelemetryManager, requestAuthority);
                 this.logger.verbose("Auth code client created");
+                try {
+                    authClient.authority.endSessionEndpoint;
+                }
+                catch {
+                    if (validRequest.account?.homeAccountId &&
+                        validRequest.postLogoutRedirectUri &&
+                        authClient.authority.protocolMode === ProtocolMode.OIDC) {
+                        this.browserStorage.removeAccount(validRequest.account?.homeAccountId);
+                        this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
+                        if (mainWindowRedirectUri) {
+                            const navigationOptions = {
+                                apiId: ApiId.logoutPopup,
+                                timeout: this.config.system.redirectNavigationTimeout,
+                                noHistory: false,
+                            };
+                            const absoluteUrl = UrlString.getAbsoluteUrl(mainWindowRedirectUri, BrowserUtils.getCurrentUri());
+                            await this.navigationClient.navigateInternal(absoluteUrl, navigationOptions);
+                        }
+                        if (popup) {
+                            popup.close();
+                        }
+                        return;
+                    }
+                }
                 // Create logout string and navigate user window to logout.
                 const logoutUri = authClient.getLogoutUri(validRequest);
                 this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
@@ -13751,7 +13978,7 @@
                         return;
                     }
                     let href = Constants.EMPTY_STRING;
-                    let hash = Constants.EMPTY_STRING;
+                    let serverResponseString = Constants.EMPTY_STRING;
                     try {
                         /*
                          * Will throw if cross origin,
@@ -13759,7 +13986,8 @@
                          * since we need the interval to keep running while on STS UI.
                          */
                         href = popupWindow.location.href;
-                        hash = popupWindow.location.hash;
+                        serverResponseString =
+                            this.extractServerResponseStringFromPopup(popupWindow, href);
                     }
                     catch (e) { }
                     // Don't process blank pages or cross domain
@@ -13772,17 +14000,17 @@
                      * as popup operations can take a long time.
                      */
                     ticks++;
-                    if (hash) {
+                    if (serverResponseString) {
                         this.logger.verbose("PopupHandler.monitorPopupForHash - found hash in url");
                         clearInterval(intervalId);
                         this.cleanPopup(popupWindow);
-                        if (UrlString.hashContainsKnownProperties(hash)) {
+                        if (UrlString.hashContainsKnownProperties(serverResponseString)) {
                             this.logger.verbose("PopupHandler.monitorPopupForHash - hash contains known properties, returning.");
-                            resolve(hash);
+                            resolve(serverResponseString);
                         }
                         else {
                             this.logger.error("PopupHandler.monitorPopupForHash - found hash in url but it does not contain known properties. Check that your router is not changing the hash prematurely.");
-                            this.logger.errorPii(`PopupHandler.monitorPopupForHash - hash found: ${hash}`);
+                            this.logger.errorPii(`PopupHandler.monitorPopupForHash - hash found: ${serverResponseString}`);
                             reject(BrowserAuthError.createHashDoesNotContainKnownPropertiesError());
                         }
                     }
@@ -13963,6 +14191,20 @@
             const homeAccountId = request.account && request.account.homeAccountId;
             return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
         }
+        /**
+         * Extracts the server response from the popup window
+         */
+        extractServerResponseStringFromPopup(popupWindow, href) {
+            let serverResponseString;
+            if (this.config.auth.OIDCOptions?.serverResponseType ===
+                ServerResponseType.QUERY) {
+                serverResponseString = UrlString.parseQueryServerResponse(href);
+            }
+            else {
+                serverResponseString = popupWindow.location.hash;
+            }
+            return serverResponseString;
+        }
     }
 
     /*
@@ -14037,7 +14279,15 @@
             navigateToLoginRequestUrl: true,
             clientCapabilities: [],
             protocolMode: ProtocolMode.AAD,
-            azureCloudOptions: {
+            OIDCOptions: {
+                serverResponseType: ServerResponseType.FRAGMENT,
+                defaultScopes: [
+                    Constants.OPENID_SCOPE,
+                    Constants.PROFILE_SCOPE,
+                    Constants.OFFLINE_ACCESS_SCOPE,
+                ],
+            },
+            azureCloudOptions: {
                 azureCloudInstance: AzureCloudInstance.None,
                 tenant: Constants.EMPTY_STRING,
             },
@@ -14081,7 +14331,7 @@
             redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS,
             asyncPopups: false,
             allowRedirectInIframe: false,
-            allowNativeBroker: true,
+            allowNativeBroker: false,
             nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
                 DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
             pollIntervalMilliseconds: BrowserConstants.DEFAULT_POLL_INTERVAL_MS,
@@ -14095,9 +14345,33 @@
                 appName: Constants.EMPTY_STRING,
                 appVersion: Constants.EMPTY_STRING,
             },
+            client: new StubPerformanceClient(DEFAULT_AUTH_OPTIONS.clientId, DEFAULT_AUTH_OPTIONS.authority, new Logger(DEFAULT_LOGGER_OPTIONS, name, version), name, version, {
+                appName: Constants.EMPTY_STRING,
+                appVersion: Constants.EMPTY_STRING,
+            }),
         };
+        // Throw an error if user has set OIDCOptions without being in OIDC protocol mode
+        if (userInputAuth?.protocolMode !== ProtocolMode.OIDC &&
+            userInputAuth?.OIDCOptions) {
+            // Logger has not been created yet
+            // eslint-disable-next-line no-console
+            console.warn(ClientConfigurationError.createCannotSetOIDCOptionsError());
+        }
+        // Throw an error if user has set allowNativeBroker to true without being in AAD protocol mode
+        if (userInputAuth?.protocolMode &&
+            userInputAuth.protocolMode !== ProtocolMode.AAD &&
+            providedSystemOptions?.allowNativeBroker) {
+            throw ClientConfigurationError.createCannotAllowNativeBrokerError();
+        }
         const overlayedConfig = {
-            auth: { ...DEFAULT_AUTH_OPTIONS, ...userInputAuth },
+            auth: {
+                ...DEFAULT_AUTH_OPTIONS,
+                ...userInputAuth,
+                OIDCOptions: {
+                    ...DEFAULT_AUTH_OPTIONS.OIDCOptions,
+                    ...userInputAuth?.OIDCOptions,
+                },
+            },
             cache: { ...DEFAULT_CACHE_OPTIONS, ...userInputCache },
             system: { ...DEFAULT_BROWSER_SYSTEM_OPTIONS, ...providedSystemOptions },
             telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...userInputTelemetry },
@@ -14296,7 +14570,7 @@
             if (request.prompt &&
                 request.prompt !== PromptValue.NONE &&
                 request.prompt !== PromptValue.NO_SESSION) {
-                acquireTokenMeasurement.endMeasurement({
+                acquireTokenMeasurement.end({
                     success: false,
                 });
                 throw BrowserAuthError.createSilentPromptValueError(request.prompt);
@@ -14316,7 +14590,7 @@
                 this.logger.verbose("Auth code client created");
                 this.performanceClient.setPreQueueTime(PerformanceEvents.SilentIframeClientTokenHelper, request.correlationId);
                 return await this.silentTokenHelper(authClient, silentRequest).then((result) => {
-                    acquireTokenMeasurement.endMeasurement({
+                    acquireTokenMeasurement.end({
                         success: true,
                         fromCache: false,
                         requestId: result.requestId,
@@ -14330,7 +14604,7 @@
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
                 this.browserStorage.cleanRequestByState(silentRequest.state);
-                acquireTokenMeasurement.endMeasurement({
+                acquireTokenMeasurement.end({
                     errorCode: (e instanceof AuthError && e.errorCode) || undefined,
                     subErrorCode: (e instanceof AuthError && e.subError) || undefined,
                     success: false,
@@ -14410,7 +14684,7 @@
             this.performanceClient.setPreQueueTime(PerformanceEvents.InitializeBaseRequest, request.correlationId);
             const silentRequest = {
                 ...request,
-                ...await this.initializeBaseRequest(request, request.account)
+                ...(await this.initializeBaseRequest(request, request.account)),
             };
             const acquireTokenMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.SilentRefreshClientAcquireToken, silentRequest.correlationId);
             const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow);
@@ -14422,7 +14696,7 @@
                 .acquireTokenByRefreshToken(silentRequest)
                 .then((result) => result)
                 .then((result) => {
-                acquireTokenMeasurement.endMeasurement({
+                acquireTokenMeasurement.end({
                     success: true,
                     fromCache: result.fromCache,
                     requestId: result.requestId,
@@ -14432,7 +14706,7 @@
                 .catch((e) => {
                 e.setCorrelationId(this.correlationId);
                 serverTelemetryManager.cacheFailedRequest(e);
-                acquireTokenMeasurement.endMeasurement({
+                acquireTokenMeasurement.end({
                     errorCode: e.errorCode,
                     subErrorCode: e.subError,
                     success: false,
@@ -15610,7 +15884,7 @@
                 requestUri: request.resourceRequestUri,
             });
             if (publicKeyThumbMeasurement) {
-                publicKeyThumbMeasurement.endMeasurement({
+                publicKeyThumbMeasurement.end({
                     success: true,
                 });
             }
@@ -15666,7 +15940,7 @@
             const encodedSignature = this.b64Encode.urlEncodeArr(new Uint8Array(signatureBuffer));
             const signedJwt = `${tokenString}.${encodedSignature}`;
             if (signJwtMeasurement) {
-                signJwtMeasurement.endMeasurement({
+                signJwtMeasurement.end({
                     success: true,
                 });
             }
@@ -15689,231 +15963,16 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    class BrowserPerformanceMeasurement {
-        constructor(name, correlationId) {
-            this.correlationId = correlationId;
-            this.measureName = BrowserPerformanceMeasurement.makeMeasureName(name, correlationId);
-            this.startMark = BrowserPerformanceMeasurement.makeStartMark(name, correlationId);
-            this.endMark = BrowserPerformanceMeasurement.makeEndMark(name, correlationId);
-        }
-        static makeMeasureName(name, correlationId) {
-            return `msal.measure.${name}.${correlationId}`;
-        }
-        static makeStartMark(name, correlationId) {
-            return `msal.start.${name}.${correlationId}`;
-        }
-        static makeEndMark(name, correlationId) {
-            return `msal.end.${name}.${correlationId}`;
-        }
-        static supportsBrowserPerformance() {
-            return (typeof window !== "undefined" &&
-                typeof window.performance !== "undefined" &&
-                typeof window.performance.mark === "function" &&
-                typeof window.performance.measure === "function" &&
-                typeof window.performance.clearMarks === "function" &&
-                typeof window.performance.clearMeasures === "function" &&
-                typeof window.performance.getEntriesByName === "function");
-        }
-        /**
-         * Flush browser marks and measurements.
-         * @param {string} correlationId
-         * @param {SubMeasurement} measurements
-         */
-        static flushMeasurements(correlationId, measurements) {
-            if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
-                try {
-                    measurements.forEach((measurement) => {
-                        const measureName = BrowserPerformanceMeasurement.makeMeasureName(measurement.name, correlationId);
-                        const entriesForMeasurement = window.performance.getEntriesByName(measureName, "measure");
-                        if (entriesForMeasurement.length > 0) {
-                            window.performance.clearMeasures(measureName);
-                            window.performance.clearMarks(BrowserPerformanceMeasurement.makeStartMark(measureName, correlationId));
-                            window.performance.clearMarks(BrowserPerformanceMeasurement.makeEndMark(measureName, correlationId));
-                        }
-                    });
-                }
-                catch (e) {
-                    // Silently catch and return null
-                }
-            }
-        }
-        startMeasurement() {
-            if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
-                try {
-                    window.performance.mark(this.startMark);
-                }
-                catch (e) {
-                    // Silently catch
-                }
-            }
-        }
-        endMeasurement() {
-            if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
-                try {
-                    window.performance.mark(this.endMark);
-                    window.performance.measure(this.measureName, this.startMark, this.endMark);
-                }
-                catch (e) {
-                    // Silently catch
-                }
-            }
-        }
-        flushMeasurement() {
-            if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
-                try {
-                    const entriesForMeasurement = window.performance.getEntriesByName(this.measureName, "measure");
-                    if (entriesForMeasurement.length > 0) {
-                        const durationMs = entriesForMeasurement[0].duration;
-                        window.performance.clearMeasures(this.measureName);
-                        window.performance.clearMarks(this.startMark);
-                        window.performance.clearMarks(this.endMark);
-                        return durationMs;
-                    }
-                }
-                catch (e) {
-                    // Silently catch and return null
-                }
-            }
-            return null;
-        }
-    }
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    class BrowserPerformanceClient extends PerformanceClient {
-        constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
-            super(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry);
-            this.browserCrypto = new BrowserCrypto(this.logger);
-            this.guidGenerator = new GuidGenerator(this.browserCrypto);
-        }
-        startPerformanceMeasurement(measureName, correlationId) {
-            return new BrowserPerformanceMeasurement(measureName, correlationId);
-        }
-        generateId() {
-            return this.guidGenerator.generateGuid();
-        }
-        getPageVisibility() {
-            return document.visibilityState?.toString() || null;
-        }
-        deleteIncompleteSubMeasurements(inProgressEvent) {
-            const rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
-            const isRootEvent = rootEvent && rootEvent.eventId === inProgressEvent.event.eventId;
-            const incompleteMeasurements = [];
-            if (isRootEvent && rootEvent?.incompleteSubMeasurements) {
-                rootEvent.incompleteSubMeasurements.forEach((subMeasurement) => {
-                    incompleteMeasurements.push({ ...subMeasurement });
-                });
-            }
-            // Clean up remaining marks for incomplete sub-measurements
-            if (incompleteMeasurements.length > 0) {
-                BrowserPerformanceMeasurement.flushMeasurements(inProgressEvent.event.correlationId, incompleteMeasurements);
-            }
-        }
-        supportsBrowserPerformanceNow() {
-            return (typeof window !== "undefined" &&
-                typeof window.performance !== "undefined" &&
-                typeof window.performance.now === "function");
-        }
-        /**
-         * Starts measuring performance for a given operation. Returns a function that should be used to end the measurement.
-         * Also captures browser page visibilityState.
-         *
-         * @param {PerformanceEvents} measureName
-         * @param {?string} [correlationId]
-         * @returns {((event?: Partial<PerformanceEvent>) => PerformanceEvent| null)}
-         */
-        startMeasurement(measureName, correlationId) {
-            // Capture page visibilityState and then invoke start/end measurement
-            const startPageVisibility = this.getPageVisibility();
-            const inProgressEvent = super.startMeasurement(measureName, correlationId);
-            return {
-                ...inProgressEvent,
-                endMeasurement: (event) => {
-                    const res = inProgressEvent.endMeasurement({
-                        startPageVisibility,
-                        endPageVisibility: this.getPageVisibility(),
-                        ...event,
-                    });
-                    this.deleteIncompleteSubMeasurements(inProgressEvent);
-                    return res;
-                },
-                discardMeasurement: () => {
-                    inProgressEvent.discardMeasurement();
-                    this.deleteIncompleteSubMeasurements(inProgressEvent);
-                    inProgressEvent.measurement.flushMeasurement();
-                },
-            };
-        }
-        /**
-         * Adds pre-queue time to preQueueTimeByCorrelationId map.
-         * @param {PerformanceEvents} eventName
-         * @param {?string} correlationId
-         * @returns
-         */
-        setPreQueueTime(eventName, correlationId) {
-            if (!this.supportsBrowserPerformanceNow()) {
-                this.logger.trace(`BrowserPerformanceClient: window performance API not available, unable to set telemetry queue time for ${eventName}`);
-                return;
-            }
-            if (!correlationId) {
-                this.logger.trace(`BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to set telemetry queue time`);
-                return;
-            }
-            const preQueueEvent = this.preQueueTimeByCorrelationId.get(correlationId);
-            /**
-             * Manually complete queue measurement if there is an incomplete pre-queue event.
-             * Incomplete pre-queue events are instrumentation bugs that should be fixed.
-             */
-            if (preQueueEvent) {
-                this.logger.trace(`BrowserPerformanceClient: Incomplete pre-queue ${preQueueEvent.name} found`, correlationId);
-                this.addQueueMeasurement(preQueueEvent.name, correlationId, undefined, true);
-            }
-            this.preQueueTimeByCorrelationId.set(correlationId, {
-                name: eventName,
-                time: window.performance.now(),
-            });
-        }
-        /**
-         * Calculates and adds queue time measurement for given performance event.
-         *
-         * @param {PerformanceEvents} eventName
-         * @param {?string} correlationId
-         * @param {?number} queueTime
-         * @param {?boolean} manuallyCompleted - indicator for manually completed queue measurements
-         * @returns
-         */
-        addQueueMeasurement(eventName, correlationId, queueTime, manuallyCompleted) {
-            if (!this.supportsBrowserPerformanceNow()) {
-                this.logger.trace(`BrowserPerformanceClient: window performance API not available, unable to add queue measurement for ${eventName}`);
-                return;
-            }
-            if (!correlationId) {
-                this.logger.trace(`BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to add queue measurement`);
-                return;
-            }
-            const preQueueTime = super.getPreQueueTime(eventName, correlationId);
-            if (!preQueueTime) {
-                return;
-            }
-            const currentTime = window.performance.now();
-            const resQueueTime = queueTime || super.calculateQueuedTime(preQueueTime, currentTime);
-            return super.addQueueMeasurement(eventName, correlationId, resQueueTime, manuallyCompleted);
-        }
-    }
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
+    /**
+     * Warning: This set of exports is purely intended to be used by other MSAL libraries, and should be considered potentially unstable. We strongly discourage using them directly, you do so at your own risk.
+     * Breaking changes to these APIs will be shipped under a minor version, instead of a major version.
      */
+    // Cache Manager
 
     var internals = /*#__PURE__*/Object.freeze({
         __proto__: null,
         BrowserCacheManager: BrowserCacheManager,
         BrowserConstants: BrowserConstants,
-        BrowserPerformanceClient: BrowserPerformanceClient,
-        BrowserPerformanceMeasurement: BrowserPerformanceMeasurement,
         CacheRecord: CacheRecord,
         CryptoOps: CryptoOps,
         EventHandler: EventHandler,
@@ -16131,8 +16190,9 @@
             const idToken = new AuthToken(response.id_token, this.cryptoObj);
             let cacheRecord;
             let authority;
+            let cacheRecordAccount;
             if (request.account) {
-                const cacheRecordAccount = this.loadAccount(idToken, request.account.environment, undefined, undefined, request.account.homeAccountId);
+                cacheRecordAccount = AccountEntity.createFromAccountInfo(request.account);
                 cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment));
             }
             else if (request.authority) {
@@ -16148,12 +16208,12 @@
                 // "clientInfo" from options takes precedence over "clientInfo" in response
                 if (options.clientInfo) {
                     this.logger.trace("TokenCache - homeAccountId from options");
-                    const cacheRecordAccount = this.loadAccount(idToken, authority.hostnameAndPort, options.clientInfo, authority.authorityType);
+                    cacheRecordAccount = this.loadAccount(idToken, authority, options.clientInfo);
                     cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
                 }
                 else if (response.client_info) {
                     this.logger.trace("TokenCache - homeAccountId from response");
-                    const cacheRecordAccount = this.loadAccount(idToken, authority.hostnameAndPort, response.client_info, authority.authorityType);
+                    cacheRecordAccount = this.loadAccount(idToken, authority, response.client_info);
                     cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
                 }
                 else {
@@ -16163,7 +16223,7 @@
             else {
                 throw BrowserAuthError.createUnableToLoadTokenError("Please provide a request with an account or a request with authority.");
             }
-            return this.generateAuthenticationResult(request, idToken, cacheRecord, authority);
+            return this.generateAuthenticationResult(request, idToken, cacheRecord, cacheRecordAccount, authority);
         }
         /**
          * Helper function to load account to msal-browser cache
@@ -16174,20 +16234,23 @@
          * @param requestHomeAccountId
          * @returns `AccountEntity`
          */
-        loadAccount(idToken, environment, clientInfo, authorityType, requestHomeAccountId) {
+        loadAccount(idToken, authority, clientInfo, requestHomeAccountId) {
             let homeAccountId;
             if (requestHomeAccountId) {
                 homeAccountId = requestHomeAccountId;
             }
-            else if (authorityType !== undefined && clientInfo) {
-                homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authorityType, this.logger, this.cryptoObj, idToken);
+            else if (authority.authorityType !== undefined && clientInfo) {
+                homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idToken.claims);
             }
             if (!homeAccountId) {
                 throw BrowserAuthError.createUnableToLoadTokenError("Unexpected missing homeAccountId");
             }
-            const accountEntity = clientInfo
-                ? AccountEntity.createAccount(clientInfo, homeAccountId, idToken, undefined, undefined, undefined, environment)
-                : AccountEntity.createGenericAccount(homeAccountId, idToken, undefined, undefined, undefined, environment);
+            const accountEntity = AccountEntity.createAccount({
+                homeAccountId,
+                idTokenClaims: idToken.claims,
+                clientInfo,
+                environment: authority.hostnameAndPort,
+            }, authority);
             if (this.isBrowserEnvironment) {
                 this.logger.verbose("TokenCache - loading account");
                 this.storage.setAccount(accountEntity);
@@ -16281,7 +16344,7 @@
          * @param authority
          * @returns `AuthenticationResult`
          */
-        generateAuthenticationResult(request, idTokenObj, cacheRecord, authority) {
+        generateAuthenticationResult(request, idTokenObj, cacheRecord, accountEntity, authority) {
             let accessToken = Constants.EMPTY_STRING;
             let responseScopes = [];
             let expiresOn = null;
@@ -16303,7 +16366,7 @@
                 uniqueId: uid,
                 tenantId: tid,
                 scopes: responseScopes,
-                account: cacheRecord.account.getAccountInfo(),
+                account: accountEntity.getAccountInfo(),
                 idToken: idTokenObj ? idTokenObj.rawToken : Constants.EMPTY_STRING,
                 idTokenClaims: idTokenObj ? idTokenObj.claims : {},
                 accessToken: accessToken,
@@ -16315,9 +16378,8 @@
                 familyId: Constants.EMPTY_STRING,
                 tokenType: cacheRecord?.accessToken?.tokenType || Constants.EMPTY_STRING,
                 state: Constants.EMPTY_STRING,
-                cloudGraphHostName: cacheRecord?.account?.cloudGraphHostName ||
-                    Constants.EMPTY_STRING,
-                msGraphHost: cacheRecord?.account?.msGraphHost || Constants.EMPTY_STRING,
+                cloudGraphHostName: accountEntity.cloudGraphHostName || Constants.EMPTY_STRING,
+                msGraphHost: accountEntity.msGraphHost || Constants.EMPTY_STRING,
                 code: undefined,
                 fromNativeBroker: false,
             };
@@ -16443,9 +16505,7 @@
             // Initial hybrid spa map
             this.hybridAuthCodeResponses = new Map();
             // Initialize performance client
-            this.performanceClient = this.isBrowserEnvironment
-                ? new BrowserPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application)
-                : new StubPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application);
+            this.performanceClient = this.config.telemetry.client;
             // Initialize the crypto class.
             this.browserCrypto = this.isBrowserEnvironment
                 ? new CryptoOps(this.logger, this.performanceClient)
@@ -16511,7 +16571,7 @@
             }
             this.initialized = true;
             this.eventHandler.emitEvent(EventType.INITIALIZE_END);
-            initMeasurement.endMeasurement({ allowNativeBroker, success: true });
+            initMeasurement.end({ allowNativeBroker, success: true });
         }
         // #region Redirect Flow
         /**
@@ -16523,8 +16583,14 @@
          */
         async handleRedirectPromise(hash) {
             this.logger.verbose("handleRedirectPromise called");
-            // Block token acquisition before initialize has been called if native brokering is enabled
-            BrowserUtils.blockNativeBrokerCalledBeforeInitialized(this.config.system.allowNativeBroker, this.initialized);
+            // Block token acquisition before initialize has been called
+            BrowserUtils.blockAPICallsBeforeInitialize(this.initialized);
+            let foundServerResponse = hash;
+            if (this.config.auth.OIDCOptions?.serverResponseType ===
+                ServerResponseType.QUERY) {
+                const url = window.location.href;
+                foundServerResponse = UrlString.parseQueryServerResponse(url);
+            }
             const loggedInAccounts = this.getAllAccounts();
             if (this.isBrowserEnvironment) {
                 /**
@@ -16532,7 +16598,7 @@
                  * otherwise return the promise from the first invocation. Prevents race conditions when handleRedirectPromise is called
                  * several times concurrently.
                  */
-                const redirectResponseKey = hash || Constants.EMPTY_STRING;
+                const redirectResponseKey = foundServerResponse || Constants.EMPTY_STRING;
                 let response = this.redirectResponse.get(redirectResponseKey);
                 if (typeof response === "undefined") {
                     this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
@@ -16542,7 +16608,7 @@
                     if (request &&
                         NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
                         this.nativeExtensionProvider &&
-                        !hash) {
+                        !foundServerResponse) {
                         this.logger.trace("handleRedirectPromise - acquiring token from native platform");
                         const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, this.nativeInternalStorage, request.correlationId);
                         redirectResponse = nativeClient.handleRedirectPromise();
@@ -16552,7 +16618,7 @@
                         const correlationId = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || Constants.EMPTY_STRING;
                         const redirectClient = this.createRedirectClient(correlationId);
                         redirectResponse =
-                            redirectClient.handleRedirectPromise(hash);
+                            redirectClient.handleRedirectPromise(foundServerResponse);
                     }
                     response = redirectResponse
                         .then((result) => {
@@ -16683,7 +16749,7 @@
                 result = this.acquireTokenNative(request, ApiId.acquireTokenPopup)
                     .then((response) => {
                     this.browserStorage.setInteractionInProgress(false);
-                    atPopupMeasurement.endMeasurement({
+                    atPopupMeasurement.end({
                         success: true,
                         isNativeBroker: true,
                         requestId: response.requestId,
@@ -16721,11 +16787,11 @@
                 else {
                     this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Popup, result);
                 }
-                atPopupMeasurement.addStaticFields({
+                atPopupMeasurement.add({
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
                 });
-                atPopupMeasurement.endMeasurement({
+                atPopupMeasurement.end({
                     success: true,
                     requestId: result.requestId,
                 });
@@ -16738,7 +16804,7 @@
                 else {
                     this.eventHandler.emitEvent(EventType.LOGIN_FAILURE, exports.InteractionType.Popup, null, e);
                 }
-                atPopupMeasurement.endMeasurement({
+                atPopupMeasurement.end({
                     errorCode: e.errorCode,
                     subErrorCode: e.subError,
                     success: false,
@@ -16810,11 +16876,11 @@
             return result
                 .then((response) => {
                 this.eventHandler.emitEvent(EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, response);
-                this.ssoSilentMeasurement?.addStaticFields({
+                this.ssoSilentMeasurement?.add({
                     accessTokenSize: response.accessToken.length,
                     idTokenSize: response.idToken.length,
                 });
-                this.ssoSilentMeasurement?.endMeasurement({
+                this.ssoSilentMeasurement?.end({
                     success: true,
                     isNativeBroker: response.fromNativeBroker,
                     requestId: response.requestId,
@@ -16823,7 +16889,7 @@
             })
                 .catch((e) => {
                 this.eventHandler.emitEvent(EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e);
-                this.ssoSilentMeasurement?.endMeasurement({
+                this.ssoSilentMeasurement?.end({
                     errorCode: e.errorCode,
                     subErrorCode: e.subError,
                     success: false,
@@ -16867,11 +16933,11 @@
                             .then((result) => {
                             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
                             this.hybridAuthCodeResponses.delete(hybridAuthCode);
-                            atbcMeasurement.addStaticFields({
+                            atbcMeasurement.add({
                                 accessTokenSize: result.accessToken.length,
                                 idTokenSize: result.idToken.length,
                             });
-                            atbcMeasurement.endMeasurement({
+                            atbcMeasurement.end({
                                 success: true,
                                 isNativeBroker: result.fromNativeBroker,
                                 requestId: result.requestId,
@@ -16881,7 +16947,7 @@
                             .catch((error) => {
                             this.hybridAuthCodeResponses.delete(hybridAuthCode);
                             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, error);
-                            atbcMeasurement.endMeasurement({
+                            atbcMeasurement.end({
                                 errorCode: error.errorCode,
                                 subErrorCode: error.subError,
                                 success: false,
@@ -16892,7 +16958,7 @@
                     }
                     else {
                         this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
-                        atbcMeasurement.discardMeasurement();
+                        atbcMeasurement.discard();
                     }
                     return response;
                 }
@@ -16916,7 +16982,7 @@
             }
             catch (e) {
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
-                atbcMeasurement.endMeasurement({
+                atbcMeasurement.end({
                     errorCode: (e instanceof AuthError && e.errorCode) || undefined,
                     subErrorCode: (e instanceof AuthError && e.subError) || undefined,
                     success: false,
@@ -16941,7 +17007,7 @@
             const silentTokenResult = await silentAuthCodeClient
                 .acquireToken(request)
                 .then((response) => {
-                this.acquireTokenByCodeAsyncMeasurement?.endMeasurement({
+                this.acquireTokenByCodeAsyncMeasurement?.end({
                     success: true,
                     fromCache: response.fromCache,
                     isNativeBroker: response.fromNativeBroker,
@@ -16950,7 +17016,7 @@
                 return response;
             })
                 .catch((tokenRenewalError) => {
-                this.acquireTokenByCodeAsyncMeasurement?.endMeasurement({
+                this.acquireTokenByCodeAsyncMeasurement?.end({
                     errorCode: tokenRenewalError.errorCode,
                     subErrorCode: tokenRenewalError.subError,
                     success: false,
@@ -17160,6 +17226,26 @@
             return this.browserStorage.getActiveAccount();
         }
         // #endregion
+        /**
+         * Hydrates the cache with the tokens from an AuthenticationResult
+         * @param result
+         * @param request
+         * @returns
+         */
+        async hydrateCache(result, request) {
+            this.logger.verbose("hydrateCache called");
+            // Account gets saved to browser storage regardless of native or not
+            const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
+            this.browserStorage.setAccount(accountEntity);
+            if (result.fromNativeBroker) {
+                this.logger.verbose("Response was from native broker, storing in-memory");
+                // Tokens from native broker are stored in-memory
+                return this.nativeInternalStorage.hydrateCache(result, request);
+            }
+            else {
+                return this.browserStorage.hydrateCache(result, request);
+            }
+        }
         // #region Helpers
         /**
          * Helper to validate app environment before making an auth request
@@ -17178,13 +17264,8 @@
             BrowserUtils.blockReloadInHiddenIframes();
             // Block redirectUri opened in a popup from calling MSAL APIs
             BrowserUtils.blockAcquireTokenInPopups();
-            /*
-             * Block token acquisition before initialize has been called if native brokering is enabled in top-frame.
-             * Skip check if application is embedded.
-             */
-            if (!isAppEmbedded) {
-                BrowserUtils.blockNativeBrokerCalledBeforeInitialized(this.config.system.allowNativeBroker, this.initialized);
-            }
+            // Block token acquisition before initialize has been called
+            BrowserUtils.blockAPICallsBeforeInitialize(this.initialized);
             // Block redirects if memory storage is enabled but storeAuthStateInCookie is not
             if (interactionType === exports.InteractionType.Redirect &&
                 this.config.cache.cacheLocation ===
@@ -17510,7 +17591,7 @@
         async acquireTokenSilent(request) {
             const correlationId = this.getRequestCorrelationId(request);
             const atsMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenSilent, correlationId);
-            atsMeasurement.addStaticFields({
+            atsMeasurement.add({
                 cacheLookupPolicy: request.cacheLookupPolicy,
             });
             this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
@@ -17542,11 +17623,11 @@
                 }, account)
                     .then((result) => {
                     this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.addStaticFields({
+                    atsMeasurement.add({
                         accessTokenSize: result.accessToken.length,
                         idTokenSize: result.idToken.length,
                     });
-                    atsMeasurement.endMeasurement({
+                    atsMeasurement.end({
                         success: true,
                         fromCache: result.fromCache,
                         isNativeBroker: result.fromNativeBroker,
@@ -17557,7 +17638,7 @@
                 })
                     .catch((error) => {
                     this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.endMeasurement({
+                    atsMeasurement.end({
                         errorCode: error.errorCode,
                         subErrorCode: error.subError,
                         success: false,
@@ -17570,7 +17651,7 @@
             else {
                 this.logger.verbose("acquireTokenSilent has been called previously, returning the result from the first call", correlationId);
                 // Discard measurements for memoized calls, as they are usually only a couple of ms and will artificially deflate metrics
-                atsMeasurement.discardMeasurement();
+                atsMeasurement.discard();
                 return cachedResponse;
             }
         }
@@ -17654,7 +17735,7 @@
             return result
                 .then((response) => {
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
-                this.atsAsyncMeasurement?.endMeasurement({
+                this.atsAsyncMeasurement?.end({
                     success: true,
                     fromCache: response.fromCache,
                     isNativeBroker: response.fromNativeBroker,
@@ -17664,7 +17745,7 @@
             })
                 .catch((tokenRenewalError) => {
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError);
-                this.atsAsyncMeasurement?.endMeasurement({
+                this.atsAsyncMeasurement?.end({
                     errorCode: tokenRenewalError.errorCode,
                     subErrorCode: tokenRenewalError.subError,
                     success: false,
@@ -17988,6 +18069,15 @@
         getConfiguration() {
             return this.controller.getConfiguration();
         }
+        /**
+         * Hydrates cache with the tokens and account in the AuthenticationResult object
+         * @param result
+         * @param request - The request object that was used to obtain the AuthenticationResult
+         * @returns
+         */
+        async hydrateCache(result, request) {
+            return this.controller.hydrateCache(result, request);
+        }
     }
 
     /*
@@ -18085,6 +18175,9 @@
         getConfiguration: () => {
             throw BrowserConfigurationAuthError.createStubPcaInstanceCalledError();
         },
+        hydrateCache: () => {
+            return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
+        },
     };
 
     /*
@@ -18196,6 +18289,227 @@
         }
     }
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    class BrowserPerformanceMeasurement {
+        constructor(name, correlationId) {
+            this.correlationId = correlationId;
+            this.measureName = BrowserPerformanceMeasurement.makeMeasureName(name, correlationId);
+            this.startMark = BrowserPerformanceMeasurement.makeStartMark(name, correlationId);
+            this.endMark = BrowserPerformanceMeasurement.makeEndMark(name, correlationId);
+        }
+        static makeMeasureName(name, correlationId) {
+            return `msal.measure.${name}.${correlationId}`;
+        }
+        static makeStartMark(name, correlationId) {
+            return `msal.start.${name}.${correlationId}`;
+        }
+        static makeEndMark(name, correlationId) {
+            return `msal.end.${name}.${correlationId}`;
+        }
+        static supportsBrowserPerformance() {
+            return (typeof window !== "undefined" &&
+                typeof window.performance !== "undefined" &&
+                typeof window.performance.mark === "function" &&
+                typeof window.performance.measure === "function" &&
+                typeof window.performance.clearMarks === "function" &&
+                typeof window.performance.clearMeasures === "function" &&
+                typeof window.performance.getEntriesByName === "function");
+        }
+        /**
+         * Flush browser marks and measurements.
+         * @param {string} correlationId
+         * @param {SubMeasurement} measurements
+         */
+        static flushMeasurements(correlationId, measurements) {
+            if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
+                try {
+                    measurements.forEach((measurement) => {
+                        const measureName = BrowserPerformanceMeasurement.makeMeasureName(measurement.name, correlationId);
+                        const entriesForMeasurement = window.performance.getEntriesByName(measureName, "measure");
+                        if (entriesForMeasurement.length > 0) {
+                            window.performance.clearMeasures(measureName);
+                            window.performance.clearMarks(BrowserPerformanceMeasurement.makeStartMark(measureName, correlationId));
+                            window.performance.clearMarks(BrowserPerformanceMeasurement.makeEndMark(measureName, correlationId));
+                        }
+                    });
+                }
+                catch (e) {
+                    // Silently catch and return null
+                }
+            }
+        }
+        startMeasurement() {
+            if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
+                try {
+                    window.performance.mark(this.startMark);
+                }
+                catch (e) {
+                    // Silently catch
+                }
+            }
+        }
+        endMeasurement() {
+            if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
+                try {
+                    window.performance.mark(this.endMark);
+                    window.performance.measure(this.measureName, this.startMark, this.endMark);
+                }
+                catch (e) {
+                    // Silently catch
+                }
+            }
+        }
+        flushMeasurement() {
+            if (BrowserPerformanceMeasurement.supportsBrowserPerformance()) {
+                try {
+                    const entriesForMeasurement = window.performance.getEntriesByName(this.measureName, "measure");
+                    if (entriesForMeasurement.length > 0) {
+                        const durationMs = entriesForMeasurement[0].duration;
+                        window.performance.clearMeasures(this.measureName);
+                        window.performance.clearMarks(this.startMark);
+                        window.performance.clearMarks(this.endMark);
+                        return durationMs;
+                    }
+                }
+                catch (e) {
+                    // Silently catch and return null
+                }
+            }
+            return null;
+        }
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    class BrowserPerformanceClient extends PerformanceClient {
+        constructor(configuration, intFields) {
+            super(configuration.auth.clientId, configuration.auth.authority || `${Constants.DEFAULT_AUTHORITY}`, new Logger(configuration.system?.loggerOptions || {}, name, version), name, version, configuration.telemetry?.application || {
+                appName: "",
+                appVersion: "",
+            }, intFields);
+            this.browserCrypto = new BrowserCrypto(this.logger);
+            this.guidGenerator = new GuidGenerator(this.browserCrypto);
+        }
+        startPerformanceMeasurement(measureName, correlationId) {
+            return new BrowserPerformanceMeasurement(measureName, correlationId);
+        }
+        generateId() {
+            return this.guidGenerator.generateGuid();
+        }
+        getPageVisibility() {
+            return document.visibilityState?.toString() || null;
+        }
+        deleteIncompleteSubMeasurements(inProgressEvent) {
+            const rootEvent = this.eventsByCorrelationId.get(inProgressEvent.event.correlationId);
+            const isRootEvent = rootEvent && rootEvent.eventId === inProgressEvent.event.eventId;
+            const incompleteMeasurements = [];
+            if (isRootEvent && rootEvent?.incompleteSubMeasurements) {
+                rootEvent.incompleteSubMeasurements.forEach((subMeasurement) => {
+                    incompleteMeasurements.push({ ...subMeasurement });
+                });
+            }
+            // Clean up remaining marks for incomplete sub-measurements
+            if (incompleteMeasurements.length > 0) {
+                BrowserPerformanceMeasurement.flushMeasurements(inProgressEvent.event.correlationId, incompleteMeasurements);
+            }
+        }
+        supportsBrowserPerformanceNow() {
+            return (typeof window !== "undefined" &&
+                typeof window.performance !== "undefined" &&
+                typeof window.performance.now === "function");
+        }
+        /**
+         * Starts measuring performance for a given operation. Returns a function that should be used to end the measurement.
+         * Also captures browser page visibilityState.
+         *
+         * @param {PerformanceEvents} measureName
+         * @param {?string} [correlationId]
+         * @returns {((event?: Partial<PerformanceEvent>) => PerformanceEvent| null)}
+         */
+        startMeasurement(measureName, correlationId) {
+            // Capture page visibilityState and then invoke start/end measurement
+            const startPageVisibility = this.getPageVisibility();
+            const inProgressEvent = super.startMeasurement(measureName, correlationId);
+            return {
+                ...inProgressEvent,
+                end: (event) => {
+                    const res = inProgressEvent.end({
+                        startPageVisibility,
+                        endPageVisibility: this.getPageVisibility(),
+                        ...event,
+                    });
+                    this.deleteIncompleteSubMeasurements(inProgressEvent);
+                    return res;
+                },
+                discard: () => {
+                    inProgressEvent.discard();
+                    this.deleteIncompleteSubMeasurements(inProgressEvent);
+                    inProgressEvent.measurement.flushMeasurement();
+                },
+            };
+        }
+        /**
+         * Adds pre-queue time to preQueueTimeByCorrelationId map.
+         * @param {PerformanceEvents} eventName
+         * @param {?string} correlationId
+         * @returns
+         */
+        setPreQueueTime(eventName, correlationId) {
+            if (!this.supportsBrowserPerformanceNow()) {
+                this.logger.trace(`BrowserPerformanceClient: window performance API not available, unable to set telemetry queue time for ${eventName}`);
+                return;
+            }
+            if (!correlationId) {
+                this.logger.trace(`BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to set telemetry queue time`);
+                return;
+            }
+            const preQueueEvent = this.preQueueTimeByCorrelationId.get(correlationId);
+            /**
+             * Manually complete queue measurement if there is an incomplete pre-queue event.
+             * Incomplete pre-queue events are instrumentation bugs that should be fixed.
+             */
+            if (preQueueEvent) {
+                this.logger.trace(`BrowserPerformanceClient: Incomplete pre-queue ${preQueueEvent.name} found`, correlationId);
+                this.addQueueMeasurement(preQueueEvent.name, correlationId, undefined, true);
+            }
+            this.preQueueTimeByCorrelationId.set(correlationId, {
+                name: eventName,
+                time: window.performance.now(),
+            });
+        }
+        /**
+         * Calculates and adds queue time measurement for given performance event.
+         *
+         * @param {PerformanceEvents} eventName
+         * @param {?string} correlationId
+         * @param {?number} queueTime
+         * @param {?boolean} manuallyCompleted - indicator for manually completed queue measurements
+         * @returns
+         */
+        addQueueMeasurement(eventName, correlationId, queueTime, manuallyCompleted) {
+            if (!this.supportsBrowserPerformanceNow()) {
+                this.logger.trace(`BrowserPerformanceClient: window performance API not available, unable to add queue measurement for ${eventName}`);
+                return;
+            }
+            if (!correlationId) {
+                this.logger.trace(`BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to add queue measurement`);
+                return;
+            }
+            const preQueueTime = super.getPreQueueTime(eventName, correlationId);
+            if (!preQueueTime) {
+                return;
+            }
+            const currentTime = window.performance.now();
+            const resQueueTime = queueTime || super.calculateQueuedTime(preQueueTime, currentTime);
+            return super.addQueueMeasurement(eventName, correlationId, resQueueTime, manuallyCompleted);
+        }
+    }
+
     exports.AccountEntity = AccountEntity;
     exports.ApiId = ApiId;
     exports.AuthError = AuthError;
@@ -18208,6 +18522,8 @@
     exports.BrowserCacheLocation = BrowserCacheLocation;
     exports.BrowserConfigurationAuthError = BrowserConfigurationAuthError;
     exports.BrowserConfigurationAuthErrorMessage = BrowserConfigurationAuthErrorMessage;
+    exports.BrowserPerformanceClient = BrowserPerformanceClient;
+    exports.BrowserPerformanceMeasurement = BrowserPerformanceMeasurement;
     exports.BrowserUtils = BrowserUtils;
     exports.CacheLookupPolicy = CacheLookupPolicy;
     exports.ClientAuthError = ClientAuthError;
@@ -18228,6 +18544,7 @@
     exports.ProtocolMode = ProtocolMode;
     exports.PublicClientApplication = PublicClientApplication;
     exports.ServerError = ServerError;
+    exports.ServerResponseType = ServerResponseType;
     exports.SignedHttpRequest = SignedHttpRequest;
     exports.StringUtils = StringUtils;
     exports.UrlString = UrlString;