@azure/msal-browser 3.16.0 → 3.18.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.16.0 2024-06-04 */
+/*! @azure/msal-browser v3.18.0 2024-07-01 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -48,6 +48,7 @@ const Constants = {
     NOT_DEFINED: "not_defined",
     EMPTY_STRING: "",
     NOT_APPLICABLE: "N/A",
+    NOT_AVAILABLE: "Not Available",
     FORWARD_SLASH: "/",
     IMDS_ENDPOINT: "http://169.254.169.254/metadata/instance/compute/location",
     IMDS_VERSION: "2020-06-01",
@@ -310,7 +311,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -327,7 +328,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -376,7 +377,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -474,7 +475,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -726,7 +727,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -787,7 +788,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -802,7 +803,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -814,7 +815,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -868,7 +869,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1006,7 +1007,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1103,7 +1104,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1150,7 +1151,7 @@ function getDeserializedResponse(responseString) {
     return null;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1314,7 +1315,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1454,7 +1455,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1467,7 +1468,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1487,7 +1488,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1497,7 +1498,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1507,7 +1508,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1989,7 +1990,7 @@ const IntFields = new Set([
     "multiMatchedRT",
 ]);
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2085,7 +2086,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2194,7 +2195,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2231,7 +2232,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2558,7 +2559,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3397,7 +3398,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3428,7 +3429,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3446,7 +3447,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3493,7 +3494,7 @@ const SID = "sid";
 const LOGIN_HINT = "login_hint";
 const DOMAIN_HINT = "domain_hint";
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3509,6 +3510,12 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     base64Encode: () => {
         throw createClientAuthError(methodNotImplemented);
     },
+    base64UrlEncode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    encodeKid: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
     async getPublicKeyThumbprint() {
         throw createClientAuthError(methodNotImplemented);
     },
@@ -3526,7 +3533,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3717,12 +3724,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.11.0";
+const version$1 = "14.13.0";
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3922,7 +3929,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3962,7 +3969,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4024,7 +4031,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4046,7 +4053,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4169,21 +4176,21 @@ class AccountEntity {
         // How do you account for MSA CID here?
         account.localAccountId =
             clientInfo?.uid ||
-                accountDetails.idTokenClaims.oid ||
-                accountDetails.idTokenClaims.sub ||
+                accountDetails.idTokenClaims?.oid ||
+                accountDetails.idTokenClaims?.sub ||
                 "";
         /*
          * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
          * In most cases it will contain a single email. This field should not be relied upon if a custom
          * policy is configured to return more than 1 email.
          */
-        const preferredUsername = accountDetails.idTokenClaims.preferred_username ||
-            accountDetails.idTokenClaims.upn;
-        const email = accountDetails.idTokenClaims.emails
+        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
+            accountDetails.idTokenClaims?.upn;
+        const email = accountDetails.idTokenClaims?.emails
             ? accountDetails.idTokenClaims.emails[0]
             : null;
         account.username = preferredUsername || email || "";
-        account.name = accountDetails.idTokenClaims.name;
+        account.name = accountDetails.idTokenClaims?.name || "";
         account.cloudGraphHostName = accountDetails.cloudGraphHostName;
         account.msGraphHost = accountDetails.msGraphHost;
         if (accountDetails.tenantProfiles) {
@@ -4293,7 +4300,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4301,7 +4308,7 @@ class AccountEntity {
 const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
 const cacheUnknownErrorCode = "cache_error_unknown";
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4328,7 +4335,7 @@ class CacheError extends Error {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5467,7 +5474,7 @@ class CacheManager {
     /**
      * Returns true if the credential's keyId matches the one in the request, false otherwise
      * @param entity
-     * @param tokenType
+     * @param keyId
      */
     matchKeyId(entity, keyId) {
         return !!(entity.keyId && entity.keyId === keyId);
@@ -5583,7 +5590,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5681,7 +5688,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5691,15 +5698,16 @@ function isOidcProtocolMode(config) {
  * Error thrown when there is an error with the server code, for example, unavailability.
  */
 class ServerError extends AuthError {
-    constructor(errorCode, errorMessage, subError, errorNo) {
+    constructor(errorCode, errorMessage, subError, errorNo, status) {
         super(errorCode, errorMessage, subError);
         this.name = "ServerError";
         this.errorNo = errorNo;
+        this.status = status;
         Object.setPrototypeOf(this, ServerError.prototype);
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5797,7 +5805,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5834,7 +5842,7 @@ class NetworkManager {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5844,7 +5852,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5909,26 +5917,9 @@ class RequestValidator {
             throw createClientConfigurationError(invalidCodeChallengeMethod);
         }
     }
-    /**
-     * Removes unnecessary, duplicate, and empty string query parameters from extraQueryParameters
-     * @param request
-     */
-    static sanitizeEQParams(eQParams, queryParams) {
-        if (!eQParams) {
-            return {};
-        }
-        // Remove any query parameters already included in SSO params
-        queryParams.forEach((_value, key) => {
-            if (eQParams[key]) {
-                delete eQParams[key];
-            }
-        });
-        // remove empty string parameters
-        return Object.fromEntries(Object.entries(eQParams).filter((kv) => kv[1] !== ""));
-    }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6216,9 +6207,10 @@ class RequestParameterBuilder {
      * @param eQParams
      */
     addExtraQueryParameters(eQParams) {
-        const sanitizedEQParams = RequestValidator.sanitizeEQParams(eQParams, this.parameters);
-        Object.keys(sanitizedEQParams).forEach((key) => {
-            this.parameters.set(key, eQParams[key]);
+        Object.entries(eQParams).forEach(([key, value]) => {
+            if (!this.parameters.has(key) && value) {
+                this.parameters.set(key, value);
+            }
         });
     }
     addClientCapabilitiesToClaims(claims, clientCapabilities) {
@@ -6312,7 +6304,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6415,7 +6407,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6441,7 +6433,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6529,23 +6521,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class CacheRecord {
-    constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
-        this.account = accountEntity || null;
-        this.idToken = idTokenEntity || null;
-        this.accessToken = accessTokenEntity || null;
-        this.refreshToken = refreshTokenEntity || null;
-        this.appMetadata = appMetadataEntity || null;
-    }
-}
-
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6617,7 +6593,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6642,11 +6618,10 @@ class PopTokenGenerator {
     async generateCnf(request, logger) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
         const reqCnf = await invokeAsync(this.generateKid.bind(this), PerformanceEvents.PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
-        const reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+        const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
         return {
             kid: reqCnf.kid,
             reqCnfString,
-            reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
         };
     }
     /**
@@ -6702,7 +6677,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6729,7 +6704,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6806,11 +6781,11 @@ class ResponseHandler {
         if (serverResponse.error ||
             serverResponse.error_description ||
             serverResponse.suberror) {
-            const errString = `${serverResponse.error_codes} - [${serverResponse.timestamp}]: ${serverResponse.error_description} - Correlation ID: ${serverResponse.correlation_id} - Trace ID: ${serverResponse.trace_id}`;
+            const errString = `Error(s): ${serverResponse.error_codes || Constants.NOT_AVAILABLE} - Timestamp: ${serverResponse.timestamp || Constants.NOT_AVAILABLE} - Description: ${serverResponse.error_description || Constants.NOT_AVAILABLE} - Correlation ID: ${serverResponse.correlation_id || Constants.NOT_AVAILABLE} - Trace ID: ${serverResponse.trace_id || Constants.NOT_AVAILABLE}`;
             const serverErrorNo = serverResponse.error_codes?.length
                 ? serverResponse.error_codes[0]
                 : undefined;
-            const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo);
+            const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
             // check if 500 error
             if (refreshAccessToken &&
                 serverResponse.status &&
@@ -6924,7 +6899,7 @@ class ResponseHandler {
         let cachedAccount;
         if (serverTokenResponse.id_token && !!idTokenClaims) {
             cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
-            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, idTokenClaims, this.cryptoObj.base64Decode, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
             this.logger);
         }
         // AccessToken
@@ -6977,7 +6952,13 @@ class ResponseHandler {
                 familyId: serverTokenResponse.foci,
             };
         }
-        return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
+        return {
+            account: cachedAccount,
+            idToken: cachedIdToken,
+            accessToken: cachedAccessToken,
+            refreshToken: cachedRefreshToken,
+            appMetadata: cachedAppMetadata,
+        };
     }
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -6997,7 +6978,13 @@ class ResponseHandler {
         let refreshOn;
         let familyId = Constants.EMPTY_STRING;
         if (cacheRecord.accessToken) {
-            if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP) {
+            /*
+             * if the request object has `popKid` property, `signPopToken` will be set to false and
+             * the token will be returned unsigned
+             */
+            if (cacheRecord.accessToken.tokenType ===
+                AuthenticationScheme.POP &&
+                !request.popKid) {
                 const popTokenGenerator = new PopTokenGenerator(cryptoObj);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
@@ -7060,7 +7047,7 @@ class ResponseHandler {
         };
     }
 }
-function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClaims, base64Decode, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
     logger?.verbose("setCachedAccount called");
     // Check if base account is already cached
     const accountKeys = cacheStorage.getAccountKeys();
@@ -7083,6 +7070,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClai
         }, authority, base64Decode);
     const tenantProfiles = baseAccount.tenantProfiles || [];
     if (claimsTenantId &&
+        idTokenClaims &&
         !tenantProfiles.find((tenantProfile) => {
             return tenantProfile.tenantId === claimsTenantId;
         })) {
@@ -7093,7 +7081,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClai
     return baseAccount;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7261,9 +7249,16 @@ class AuthorizationCodeClient extends BaseClient {
         parameterBuilder.addClientInfo();
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
@@ -7457,9 +7452,16 @@ class AuthorizationCodeClient extends BaseClient {
             // pass the req_cnf for POP
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                // req_cnf is always sent as a string for SPAs
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                }
+                else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
+                parameterBuilder.addPopToken(reqCnfData);
             }
         }
         return parameterBuilder.createQueryString();
@@ -7502,7 +7504,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7667,9 +7669,16 @@ class RefreshTokenClient extends BaseClient {
         }
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
@@ -7709,7 +7718,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7845,7 +7854,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7860,7 +7869,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7868,7 +7877,7 @@ const StubbedNetworkModule = {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7893,7 +7902,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7933,7 +7942,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7991,7 +8000,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8195,7 +8204,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8274,7 +8283,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.13.0 2024-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8913,6 +8922,7 @@ const nativeConnectionNotEstablished = "native_connection_not_established";
 const uninitializedPublicClientApplication = "uninitialized_public_client_application";
 const nativePromptNotSupported = "native_prompt_not_supported";
 const invalidBase64String = "invalid_base64_string";
+const invalidPopTokenRequest = "invalid_pop_token_request";
 
 var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -8935,6 +8945,7 @@ var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     interactionInProgress: interactionInProgress,
     invalidBase64String: invalidBase64String,
     invalidCacheType: invalidCacheType,
+    invalidPopTokenRequest: invalidPopTokenRequest,
     monitorPopupTimeout: monitorPopupTimeout,
     monitorWindowTimeout: monitorWindowTimeout,
     nativeConnectionNotEstablished: nativeConnectionNotEstablished,
@@ -9017,6 +9028,7 @@ const BrowserAuthErrorMessages = {
     [uninitializedPublicClientApplication]: `You must call and await the initialize function before attempting to call any other MSAL API.  ${ErrorLink}`,
     [nativePromptNotSupported]: "The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",
     [invalidBase64String]: "Invalid base64 encoded string.",
+    [invalidPopTokenRequest]: "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
 };
 /**
  * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9207,6 +9219,10 @@ const BrowserAuthErrorMessage = {
         code: invalidBase64String,
         desc: BrowserAuthErrorMessages[invalidBase64String],
     },
+    invalidPopTokenRequest: {
+        code: invalidPopTokenRequest,
+        desc: BrowserAuthErrorMessages[invalidPopTokenRequest],
+    },
 };
 /**
  * Browser library error class thrown by the MSAL.js library for SPAs
@@ -10138,7 +10154,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.16.0";
+const version = "3.18.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10954,6 +10970,21 @@ class CryptoOps {
     base64Decode(input) {
         return base64Decode(input);
     }
+    /**
+     * Encodes input string to base64 URL safe string.
+     * @param input
+     */
+    base64UrlEncode(input) {
+        return urlEncode(input);
+    }
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid) {
+        return this.base64UrlEncode(JSON.stringify({ kid: inputKid }));
+    }
     /**
      * Generates a keypair, stores it and returns a thumbprint
      * @param request
@@ -12383,7 +12414,10 @@ class BrowserCacheManager extends CacheManager {
         const accessTokenEntity = createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn ? result.expiresOn.getTime() / 1000 : 0, result.extExpiresOn ? result.extExpiresOn.getTime() / 1000 : 0, base64Decode, undefined, // refreshOn
         result.tokenType, undefined, // userAssertionHash
         request.sshKid, request.claims, claimsHash);
-        const cacheRecord = new CacheRecord(undefined, idTokenEntity, accessTokenEntity);
+        const cacheRecord = {
+            idToken: idTokenEntity,
+            accessToken: accessTokenEntity,
+        };
         return this.saveCacheRecord(cacheRecord);
     }
     /**
@@ -13294,10 +13328,11 @@ class NativeInteractionClient extends BaseInteractionClient {
             // continue with a native call for any and all errors
             this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
         }
+        const { ...nativeTokenRequest } = nativeRequest;
         // fall back to native calls
         const messageBody = {
             method: NativeExtensionMethod.GetToken,
-            request: nativeRequest,
+            request: nativeTokenRequest,
         };
         const response = await this.nativeMessageHandler.sendMessage(messageBody);
         const validatedResponse = this.validateNativeResponse(response);
@@ -13379,9 +13414,10 @@ class NativeInteractionClient extends BaseInteractionClient {
     async acquireTokenRedirect(request, rootMeasurement) {
         this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
         const nativeRequest = await this.initializeNativeRequest(request);
+        const { ...nativeTokenRequest } = nativeRequest;
         const messageBody = {
             method: NativeExtensionMethod.GetToken,
-            request: nativeRequest,
+            request: nativeTokenRequest,
         };
         try {
             const response = await this.nativeMessageHandler.sendMessage(messageBody);
@@ -13477,14 +13513,14 @@ class NativeInteractionClient extends BaseInteractionClient {
         }
         // Get the preferred_cache domain for the given authority
         const authority = await this.getDiscoveredAuthority(request.authority);
-        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, idTokenClaims, base64Decode, response.client_info, undefined, // environment
+        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
         idTokenClaims.tid, undefined, // auth code payload
         response.account.id, this.logger);
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
         this.cacheAccount(baseAccount);
-        this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.accessToken, result.tenantId, reqTimestamp);
+        this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
         return result;
     }
     /**
@@ -13515,7 +13551,8 @@ class NativeInteractionClient extends BaseInteractionClient {
      * @param response
      */
     async generatePopAccessToken(response, request) {
-        if (request.tokenType === AuthenticationScheme.POP) {
+        if (request.tokenType === AuthenticationScheme.POP &&
+            request.signPopToken) {
             /**
              * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
              * is still received, SHR is calculated locally
@@ -13635,8 +13672,11 @@ class NativeInteractionClient extends BaseInteractionClient {
                 : response.expires_in) || 0;
         const tokenExpirationSeconds = reqTimestamp + expiresIn;
         const responseScopes = this.generateScopes(response, request);
-        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode);
-        const nativeCacheRecord = new CacheRecord(undefined, cachedIdToken, cachedAccessToken);
+        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+        const nativeCacheRecord = {
+            idToken: cachedIdToken,
+            accessToken: cachedAccessToken,
+        };
         void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
     }
     addTelemetryFromNativeResponse(response) {
@@ -13765,8 +13805,13 @@ class NativeInteractionClient extends BaseInteractionClient {
                 ...request.extraQueryParameters,
                 ...request.tokenQueryParameters,
             },
-            extendedExpiryToken: false, // Make this configurable?
+            extendedExpiryToken: false,
+            keyId: request.popKid,
         };
+        // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
+        if (validatedRequest.signPopToken && !!request.popKid) {
+            throw createBrowserAuthError(invalidPopTokenRequest);
+        }
         this.handleExtraBrokerParams(validatedRequest);
         validatedRequest.extraParameters =
             validatedRequest.extraParameters || {};
@@ -13781,10 +13826,20 @@ class NativeInteractionClient extends BaseInteractionClient {
                 shrNonce: request.shrNonce,
             };
             const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, this.correlationId)(shrParameters, this.logger);
-            // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-            validatedRequest.reqCnf = reqCnfData.reqCnfHash;
-            validatedRequest.keyId = reqCnfData.kid;
+            // generate reqCnf if not provided in the request
+            let reqCnfData;
+            if (!validatedRequest.keyId) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+                validatedRequest.keyId = generatedReqCnfData.kid;
+                validatedRequest.signPopToken = true;
+            }
+            else {
+                reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
+                validatedRequest.signPopToken = false;
+            }
+            // SPAs require whole string to be passed to broker
+            validatedRequest.reqCnf = reqCnfData;
         }
         return validatedRequest;
     }
@@ -15389,47 +15444,32 @@ class TokenCache {
      * @returns `AuthenticationResult` for the response that was loaded.
      */
     loadExternalTokens(request, response, options) {
-        this.logger.info("TokenCache - loadExternalTokens called");
-        if (!response.id_token) {
-            throw createBrowserAuthError(unableToLoadToken);
+        if (!this.isBrowserEnvironment) {
+            throw createBrowserAuthError(nonBrowserEnvironment);
         }
-        const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
-        let cacheRecord;
-        let authority;
-        let cacheRecordAccount;
-        if (request.account) {
-            cacheRecordAccount = AccountEntity.createFromAccountInfo(request.account);
-            cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(response.id_token, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment));
-        }
-        else if (request.authority) {
-            const authorityUrl = Authority.generateAuthority(request.authority, request.azureCloudOptions);
-            const authorityOptions = {
-                protocolMode: this.config.auth.protocolMode,
-                knownAuthorities: this.config.auth.knownAuthorities,
-                cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-                authorityMetadata: this.config.auth.authorityMetadata,
-                skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
-            };
-            authority = new Authority(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid());
-            // "clientInfo" from options takes precedence over "clientInfo" in response
-            if (options.clientInfo) {
-                this.logger.trace("TokenCache - homeAccountId from options");
-                cacheRecordAccount = this.loadAccount(idTokenClaims, authority, options.clientInfo);
-                cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(response.id_token, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
-            }
-            else if (response.client_info) {
-                this.logger.trace("TokenCache - homeAccountId from response");
-                cacheRecordAccount = this.loadAccount(idTokenClaims, authority, response.client_info);
-                cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(response.id_token, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
-            }
-            else {
-                throw createBrowserAuthError(unableToLoadToken);
-            }
-        }
-        else {
-            throw createBrowserAuthError(unableToLoadToken);
-        }
-        return this.generateAuthenticationResult(request, idTokenClaims, cacheRecord, cacheRecordAccount, authority);
+        const idTokenClaims = response.id_token
+            ? extractTokenClaims(response.id_token, base64Decode)
+            : undefined;
+        const authorityOptions = {
+            protocolMode: this.config.auth.protocolMode,
+            knownAuthorities: this.config.auth.knownAuthorities,
+            cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
+            authorityMetadata: this.config.auth.authorityMetadata,
+            skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
+        };
+        const authority = request.authority
+            ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
+            : undefined;
+        const cacheRecordAccount = this.loadAccount(request, options.clientInfo || response.client_info || "", idTokenClaims, authority);
+        const idToken = this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm);
+        const accessToken = this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options);
+        const refreshToken = this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment);
+        return this.generateAuthenticationResult(request, {
+            account: cacheRecordAccount,
+            idToken,
+            accessToken,
+            refreshToken,
+        }, idTokenClaims, authority);
     }
     /**
      * Helper function to load account to msal-browser cache
@@ -15440,29 +15480,24 @@ class TokenCache {
      * @param requestHomeAccountId
      * @returns `AccountEntity`
      */
-    loadAccount(idTokenClaims, authority, clientInfo, requestHomeAccountId) {
-        if (this.isBrowserEnvironment) {
-            this.logger.verbose("TokenCache - loading account");
-            let homeAccountId;
-            if (requestHomeAccountId) {
-                homeAccountId = requestHomeAccountId;
-            }
-            else if (authority.authorityType !== undefined && clientInfo) {
-                homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
-            }
-            if (!homeAccountId) {
-                throw createBrowserAuthError(unableToLoadToken);
-            }
-            const claimsTenantId = idTokenClaims.tid;
-            const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, idTokenClaims, base64Decode, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
-            undefined, // nativeAccountId
-            this.logger);
-            this.storage.setAccount(cachedAccount);
-            return cachedAccount;
+    loadAccount(request, clientInfo, idTokenClaims, authority) {
+        this.logger.verbose("TokenCache - loading account");
+        if (request.account) {
+            const accountEntity = AccountEntity.createFromAccountInfo(request.account);
+            this.storage.setAccount(accountEntity);
+            return accountEntity;
         }
-        else {
+        else if (!authority || (!clientInfo && !idTokenClaims)) {
+            this.logger.error("TokenCache - if an account is not provided on the request, authority and either clientInfo or idToken must be provided instead.");
             throw createBrowserAuthError(unableToLoadToken);
         }
+        const homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
+        const claimsTenantId = idTokenClaims?.tid;
+        const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
+        undefined, // nativeAccountId
+        this.logger);
+        this.storage.setAccount(cachedAccount);
+        return cachedAccount;
     }
     /**
      * Helper function to load id tokens to msal-browser cache
@@ -15472,16 +15507,15 @@ class TokenCache {
      * @param tenantId
      * @returns `IdTokenEntity`
      */
-    loadIdToken(idToken, homeAccountId, environment, tenantId) {
-        const idTokenEntity = createIdTokenEntity(homeAccountId, environment, idToken, this.config.auth.clientId, tenantId);
-        if (this.isBrowserEnvironment) {
-            this.logger.verbose("TokenCache - loading id token");
-            this.storage.setIdTokenCredential(idTokenEntity);
-            return idTokenEntity;
-        }
-        else {
-            throw createBrowserAuthError(unableToLoadToken);
+    loadIdToken(response, homeAccountId, environment, tenantId) {
+        if (!response.id_token) {
+            this.logger.verbose("TokenCache - no id token found in response");
+            return null;
         }
+        this.logger.verbose("TokenCache - loading id token");
+        const idTokenEntity = createIdTokenEntity(homeAccountId, environment, response.id_token, this.config.auth.clientId, tenantId);
+        this.storage.setIdTokenCredential(idTokenEntity);
+        return idTokenEntity;
     }
     /**
      * Helper function to load access tokens to msal-browser cache
@@ -15494,28 +15528,30 @@ class TokenCache {
      */
     loadAccessToken(request, response, homeAccountId, environment, tenantId, options) {
         if (!response.access_token) {
-            this.logger.verbose("TokenCache - No access token provided for caching");
+            this.logger.verbose("TokenCache - no access token found in response");
             return null;
         }
-        if (!response.expires_in) {
-            throw createBrowserAuthError(unableToLoadToken);
+        else if (!response.expires_in) {
+            this.logger.error("TokenCache - no expiration set on the access token. Cannot add it to the cache.");
+            return null;
         }
-        if (!options.extendedExpiresOn) {
-            throw createBrowserAuthError(unableToLoadToken);
+        else if (!response.scope &&
+            (!request.scopes || !request.scopes.length)) {
+            this.logger.error("TokenCache - scopes not specified in the request or response. Cannot add token to the cache.");
+            return null;
         }
-        const scopes = new ScopeSet(request.scopes).printScopes();
+        this.logger.verbose("TokenCache - loading access token");
+        const scopes = response.scope
+            ? ScopeSet.fromString(response.scope)
+            : new ScopeSet(request.scopes);
         const expiresOn = options.expiresOn ||
             response.expires_in + new Date().getTime() / 1000;
-        const extendedExpiresOn = options.extendedExpiresOn;
-        const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes, expiresOn, extendedExpiresOn, base64Decode);
-        if (this.isBrowserEnvironment) {
-            this.logger.verbose("TokenCache - loading access token");
-            this.storage.setAccessTokenCredential(accessTokenEntity);
-            return accessTokenEntity;
-        }
-        else {
-            throw createBrowserAuthError(unableToLoadToken);
-        }
+        const extendedExpiresOn = options.extendedExpiresOn ||
+            (response.ext_expires_in || response.expires_in) +
+                new Date().getTime() / 1000;
+        const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
+        this.storage.setAccessTokenCredential(accessTokenEntity);
+        return accessTokenEntity;
     }
     /**
      * Helper function to load refresh tokens to msal-browser cache
@@ -15525,20 +15561,16 @@ class TokenCache {
      * @param environment
      * @returns `RefreshTokenEntity`
      */
-    loadRefreshToken(request, response, homeAccountId, environment) {
+    loadRefreshToken(response, homeAccountId, environment) {
         if (!response.refresh_token) {
-            this.logger.verbose("TokenCache - No refresh token provided for caching");
+            this.logger.verbose("TokenCache - no refresh token found in response");
             return null;
         }
-        const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId);
-        if (this.isBrowserEnvironment) {
-            this.logger.verbose("TokenCache - loading refresh token");
-            this.storage.setRefreshTokenCredential(refreshTokenEntity);
-            return refreshTokenEntity;
-        }
-        else {
-            throw createBrowserAuthError(unableToLoadToken);
-        }
+        this.logger.verbose("TokenCache - loading refresh token");
+        const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
+        response.refresh_token_expires_in);
+        this.storage.setRefreshTokenCredential(refreshTokenEntity);
+        return refreshTokenEntity;
     }
     /**
      * Helper function to generate an `AuthenticationResult` for the result.
@@ -15548,8 +15580,8 @@ class TokenCache {
      * @param authority
      * @returns `AuthenticationResult`
      */
-    generateAuthenticationResult(request, idTokenClaims, cacheRecord, accountEntity, authority) {
-        let accessToken = Constants.EMPTY_STRING;
+    generateAuthenticationResult(request, cacheRecord, idTokenClaims, authority) {
+        let accessToken = "";
         let responseScopes = [];
         let expiresOn = null;
         let extExpiresOn;
@@ -15559,14 +15591,11 @@ class TokenCache {
             expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
             extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
         }
-        const uid = idTokenClaims.oid || idTokenClaims.sub || Constants.EMPTY_STRING;
-        const tid = idTokenClaims.tid || Constants.EMPTY_STRING;
+        const accountEntity = cacheRecord.account;
         return {
-            authority: authority
-                ? authority.canonicalAuthority
-                : Constants.EMPTY_STRING,
-            uniqueId: uid,
-            tenantId: tid,
+            authority: authority ? authority.canonicalAuthority : "",
+            uniqueId: cacheRecord.account.localAccountId,
+            tenantId: cacheRecord.account.realm,
             scopes: responseScopes,
             account: accountEntity.getAccountInfo(),
             idToken: cacheRecord.idToken?.secret || "",
@@ -15574,15 +15603,14 @@ class TokenCache {
             accessToken: accessToken,
             fromCache: true,
             expiresOn: expiresOn,
-            correlationId: request.correlationId || Constants.EMPTY_STRING,
-            requestId: Constants.EMPTY_STRING,
+            correlationId: request.correlationId || "",
+            requestId: "",
             extExpiresOn: extExpiresOn,
-            familyId: Constants.EMPTY_STRING,
-            tokenType: cacheRecord?.accessToken?.tokenType || Constants.EMPTY_STRING,
-            state: Constants.EMPTY_STRING,
-            cloudGraphHostName: accountEntity.cloudGraphHostName || Constants.EMPTY_STRING,
-            msGraphHost: accountEntity.msGraphHost || Constants.EMPTY_STRING,
-            code: undefined,
+            familyId: cacheRecord.refreshToken?.familyId || "",
+            tokenType: cacheRecord?.accessToken?.tokenType || "",
+            state: request.state || "",
+            cloudGraphHostName: accountEntity.cloudGraphHostName || "",
+            msGraphHost: accountEntity.msGraphHost || "",
             fromNativeBroker: false,
         };
     }
@@ -16824,12 +16852,13 @@ class StandardController {
      * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
      */
     async acquireTokenSilentAsync(request, account) {
+        const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
         this.performanceClient.addQueueMeasurement(PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
         if (request.correlationId) {
             this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
         }
-        document.addEventListener("visibilitychange", () => this.trackPageVisibility(request.correlationId));
+        document.addEventListener("visibilitychange", trackPageVisibility);
         const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
         const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
         const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
@@ -16908,7 +16937,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", () => this.trackPageVisibility(request.correlationId));
+            document.removeEventListener("visibilitychange", trackPageVisibility);
         });
     }
     /**
@@ -17169,7 +17198,7 @@ class NestedAppAuthAdapter {
 const NestedAppAuthErrorMessage = {
     unsupportedMethod: {
         code: "unsupported_method",
-        desc: "The PKCE code challenge and verifier could not be generated.",
+        desc: "This method is not supported in nested app environment.",
     },
 };
 class NestedAppAuthError extends AuthError {