@azure/msal-browser 3.16.0 → 3.18.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.16.0 2024-06-04 */
+/*! @azure/msal-browser v3.18.0 2024-07-01 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -52,6 +52,7 @@
         NOT_DEFINED: "not_defined",
         EMPTY_STRING: "",
         NOT_APPLICABLE: "N/A",
+        NOT_AVAILABLE: "Not Available",
         FORWARD_SLASH: "/",
         IMDS_ENDPOINT: "http://169.254.169.254/metadata/instance/compute/location",
         IMDS_VERSION: "2020-06-01",
@@ -314,7 +315,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -331,7 +332,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -380,7 +381,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -478,7 +479,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -730,7 +731,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -791,7 +792,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -806,7 +807,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -818,7 +819,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -872,7 +873,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1010,7 +1011,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1107,7 +1108,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1154,7 +1155,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1318,7 +1319,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1458,7 +1459,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1471,7 +1472,7 @@
         OIDC: "OIDC",
     };
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1491,7 +1492,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1501,7 +1502,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1511,7 +1512,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1993,7 +1994,7 @@
         "multiMatchedRT",
     ]);
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2089,7 +2090,7 @@
         };
     };
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2198,7 +2199,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2235,7 +2236,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2562,7 +2563,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3401,7 +3402,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3432,7 +3433,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3450,7 +3451,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3497,7 +3498,7 @@
     const LOGIN_HINT = "login_hint";
     const DOMAIN_HINT = "domain_hint";
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3513,6 +3514,12 @@
         base64Encode: () => {
             throw createClientAuthError(methodNotImplemented);
         },
+        base64UrlEncode: () => {
+            throw createClientAuthError(methodNotImplemented);
+        },
+        encodeKid: () => {
+            throw createClientAuthError(methodNotImplemented);
+        },
         async getPublicKeyThumbprint() {
             throw createClientAuthError(methodNotImplemented);
         },
@@ -3530,7 +3537,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3721,12 +3728,12 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "14.11.0";
+    const version$1 = "14.13.0";
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3926,7 +3933,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3966,7 +3973,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4028,7 +4035,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4050,7 +4057,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4173,21 +4180,21 @@
             // How do you account for MSA CID here?
             account.localAccountId =
                 clientInfo?.uid ||
-                    accountDetails.idTokenClaims.oid ||
-                    accountDetails.idTokenClaims.sub ||
+                    accountDetails.idTokenClaims?.oid ||
+                    accountDetails.idTokenClaims?.sub ||
                     "";
             /*
              * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
              * In most cases it will contain a single email. This field should not be relied upon if a custom
              * policy is configured to return more than 1 email.
              */
-            const preferredUsername = accountDetails.idTokenClaims.preferred_username ||
-                accountDetails.idTokenClaims.upn;
-            const email = accountDetails.idTokenClaims.emails
+            const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
+                accountDetails.idTokenClaims?.upn;
+            const email = accountDetails.idTokenClaims?.emails
                 ? accountDetails.idTokenClaims.emails[0]
                 : null;
             account.username = preferredUsername || email || "";
-            account.name = accountDetails.idTokenClaims.name;
+            account.name = accountDetails.idTokenClaims?.name || "";
             account.cloudGraphHostName = accountDetails.cloudGraphHostName;
             account.msGraphHost = accountDetails.msGraphHost;
             if (accountDetails.tenantProfiles) {
@@ -4297,7 +4304,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4305,7 +4312,7 @@
     const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
     const cacheUnknownErrorCode = "cache_error_unknown";
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4332,7 +4339,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5471,7 +5478,7 @@
         /**
          * Returns true if the credential's keyId matches the one in the request, false otherwise
          * @param entity
-         * @param tokenType
+         * @param keyId
          */
         matchKeyId(entity, keyId) {
             return !!(entity.keyId && entity.keyId === keyId);
@@ -5587,7 +5594,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5685,7 +5692,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5695,15 +5702,16 @@
      * Error thrown when there is an error with the server code, for example, unavailability.
      */
     class ServerError extends AuthError {
-        constructor(errorCode, errorMessage, subError, errorNo) {
+        constructor(errorCode, errorMessage, subError, errorNo, status) {
             super(errorCode, errorMessage, subError);
             this.name = "ServerError";
             this.errorNo = errorNo;
+            this.status = status;
             Object.setPrototypeOf(this, ServerError.prototype);
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5801,7 +5809,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5838,7 +5846,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5848,7 +5856,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5913,26 +5921,9 @@
                 throw createClientConfigurationError(invalidCodeChallengeMethod);
             }
         }
-        /**
-         * Removes unnecessary, duplicate, and empty string query parameters from extraQueryParameters
-         * @param request
-         */
-        static sanitizeEQParams(eQParams, queryParams) {
-            if (!eQParams) {
-                return {};
-            }
-            // Remove any query parameters already included in SSO params
-            queryParams.forEach((_value, key) => {
-                if (eQParams[key]) {
-                    delete eQParams[key];
-                }
-            });
-            // remove empty string parameters
-            return Object.fromEntries(Object.entries(eQParams).filter((kv) => kv[1] !== ""));
-        }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6220,9 +6211,10 @@
          * @param eQParams
          */
         addExtraQueryParameters(eQParams) {
-            const sanitizedEQParams = RequestValidator.sanitizeEQParams(eQParams, this.parameters);
-            Object.keys(sanitizedEQParams).forEach((key) => {
-                this.parameters.set(key, eQParams[key]);
+            Object.entries(eQParams).forEach(([key, value]) => {
+                if (!this.parameters.has(key) && value) {
+                    this.parameters.set(key, value);
+                }
             });
         }
         addClientCapabilitiesToClaims(claims, clientCapabilities) {
@@ -6316,7 +6308,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6419,7 +6411,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6445,7 +6437,7 @@
         refreshTokenExpired: refreshTokenExpired
     });
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6533,23 +6525,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /** @internal */
-    class CacheRecord {
-        constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
-            this.account = accountEntity || null;
-            this.idToken = idTokenEntity || null;
-            this.accessToken = accessTokenEntity || null;
-            this.refreshToken = refreshTokenEntity || null;
-            this.appMetadata = appMetadataEntity || null;
-        }
-    }
-
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6621,7 +6597,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6646,11 +6622,10 @@
         async generateCnf(request, logger) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
             const reqCnf = await invokeAsync(this.generateKid.bind(this), PerformanceEvents.PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
-            const reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+            const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
             return {
                 kid: reqCnf.kid,
                 reqCnfString,
-                reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
             };
         }
         /**
@@ -6706,7 +6681,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6733,7 +6708,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6810,11 +6785,11 @@
             if (serverResponse.error ||
                 serverResponse.error_description ||
                 serverResponse.suberror) {
-                const errString = `${serverResponse.error_codes} - [${serverResponse.timestamp}]: ${serverResponse.error_description} - Correlation ID: ${serverResponse.correlation_id} - Trace ID: ${serverResponse.trace_id}`;
+                const errString = `Error(s): ${serverResponse.error_codes || Constants.NOT_AVAILABLE} - Timestamp: ${serverResponse.timestamp || Constants.NOT_AVAILABLE} - Description: ${serverResponse.error_description || Constants.NOT_AVAILABLE} - Correlation ID: ${serverResponse.correlation_id || Constants.NOT_AVAILABLE} - Trace ID: ${serverResponse.trace_id || Constants.NOT_AVAILABLE}`;
                 const serverErrorNo = serverResponse.error_codes?.length
                     ? serverResponse.error_codes[0]
                     : undefined;
-                const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo);
+                const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
                 // check if 500 error
                 if (refreshAccessToken &&
                     serverResponse.status &&
@@ -6928,7 +6903,7 @@
             let cachedAccount;
             if (serverTokenResponse.id_token && !!idTokenClaims) {
                 cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
-                cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, idTokenClaims, this.cryptoObj.base64Decode, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+                cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
                 this.logger);
             }
             // AccessToken
@@ -6981,7 +6956,13 @@
                     familyId: serverTokenResponse.foci,
                 };
             }
-            return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
+            return {
+                account: cachedAccount,
+                idToken: cachedIdToken,
+                accessToken: cachedAccessToken,
+                refreshToken: cachedRefreshToken,
+                appMetadata: cachedAppMetadata,
+            };
         }
         /**
          * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -7001,7 +6982,13 @@
             let refreshOn;
             let familyId = Constants.EMPTY_STRING;
             if (cacheRecord.accessToken) {
-                if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP) {
+                /*
+                 * if the request object has `popKid` property, `signPopToken` will be set to false and
+                 * the token will be returned unsigned
+                 */
+                if (cacheRecord.accessToken.tokenType ===
+                    AuthenticationScheme.POP &&
+                    !request.popKid) {
                     const popTokenGenerator = new PopTokenGenerator(cryptoObj);
                     const { secret, keyId } = cacheRecord.accessToken;
                     if (!keyId) {
@@ -7064,7 +7051,7 @@
             };
         }
     }
-    function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClaims, base64Decode, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+    function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
         logger?.verbose("setCachedAccount called");
         // Check if base account is already cached
         const accountKeys = cacheStorage.getAccountKeys();
@@ -7087,6 +7074,7 @@
             }, authority, base64Decode);
         const tenantProfiles = baseAccount.tenantProfiles || [];
         if (claimsTenantId &&
+            idTokenClaims &&
             !tenantProfiles.find((tenantProfile) => {
                 return tenantProfile.tenantId === claimsTenantId;
             })) {
@@ -7097,7 +7085,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7265,9 +7253,16 @@
             parameterBuilder.addClientInfo();
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                }
+                else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
                 // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-                parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+                parameterBuilder.addPopToken(reqCnfData);
             }
             else if (request.authenticationScheme === AuthenticationScheme.SSH) {
                 if (request.sshJwk) {
@@ -7461,9 +7456,16 @@
                 // pass the req_cnf for POP
                 if (request.authenticationScheme === AuthenticationScheme.POP) {
                     const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                    // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                    const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                    parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                    // req_cnf is always sent as a string for SPAs
+                    let reqCnfData;
+                    if (!request.popKid) {
+                        const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                        reqCnfData = generatedReqCnfData.reqCnfString;
+                    }
+                    else {
+                        reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                    }
+                    parameterBuilder.addPopToken(reqCnfData);
                 }
             }
             return parameterBuilder.createQueryString();
@@ -7506,7 +7508,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7671,9 +7673,16 @@
             }
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                }
+                else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
                 // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-                parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+                parameterBuilder.addPopToken(reqCnfData);
             }
             else if (request.authenticationScheme === AuthenticationScheme.SSH) {
                 if (request.sshJwk) {
@@ -7713,7 +7722,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7849,7 +7858,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7864,7 +7873,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7872,7 +7881,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7897,7 +7906,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7937,7 +7946,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7995,7 +8004,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8199,7 +8208,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8278,7 +8287,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.11.0 2024-06-04 */
+    /*! @azure/msal-common v14.13.0 2024-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8917,6 +8926,7 @@
     const uninitializedPublicClientApplication = "uninitialized_public_client_application";
     const nativePromptNotSupported = "native_prompt_not_supported";
     const invalidBase64String = "invalid_base64_string";
+    const invalidPopTokenRequest = "invalid_pop_token_request";
 
     var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -8939,6 +8949,7 @@
         interactionInProgress: interactionInProgress,
         invalidBase64String: invalidBase64String,
         invalidCacheType: invalidCacheType,
+        invalidPopTokenRequest: invalidPopTokenRequest,
         monitorPopupTimeout: monitorPopupTimeout,
         monitorWindowTimeout: monitorWindowTimeout,
         nativeConnectionNotEstablished: nativeConnectionNotEstablished,
@@ -9021,6 +9032,7 @@
         [uninitializedPublicClientApplication]: `You must call and await the initialize function before attempting to call any other MSAL API.  ${ErrorLink}`,
         [nativePromptNotSupported]: "The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",
         [invalidBase64String]: "Invalid base64 encoded string.",
+        [invalidPopTokenRequest]: "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
     };
     /**
      * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9211,6 +9223,10 @@
             code: invalidBase64String,
             desc: BrowserAuthErrorMessages[invalidBase64String],
         },
+        invalidPopTokenRequest: {
+            code: invalidPopTokenRequest,
+            desc: BrowserAuthErrorMessages[invalidPopTokenRequest],
+        },
     };
     /**
      * Browser library error class thrown by the MSAL.js library for SPAs
@@ -10142,7 +10158,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "3.16.0";
+    const version = "3.18.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10958,6 +10974,21 @@
         base64Decode(input) {
             return base64Decode(input);
         }
+        /**
+         * Encodes input string to base64 URL safe string.
+         * @param input
+         */
+        base64UrlEncode(input) {
+            return urlEncode(input);
+        }
+        /**
+         * Stringifies and base64Url encodes input public key
+         * @param inputKid
+         * @returns Base64Url encoded public key
+         */
+        encodeKid(inputKid) {
+            return this.base64UrlEncode(JSON.stringify({ kid: inputKid }));
+        }
         /**
          * Generates a keypair, stores it and returns a thumbprint
          * @param request
@@ -12387,7 +12418,10 @@
             const accessTokenEntity = createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn ? result.expiresOn.getTime() / 1000 : 0, result.extExpiresOn ? result.extExpiresOn.getTime() / 1000 : 0, base64Decode, undefined, // refreshOn
             result.tokenType, undefined, // userAssertionHash
             request.sshKid, request.claims, claimsHash);
-            const cacheRecord = new CacheRecord(undefined, idTokenEntity, accessTokenEntity);
+            const cacheRecord = {
+                idToken: idTokenEntity,
+                accessToken: accessTokenEntity,
+            };
             return this.saveCacheRecord(cacheRecord);
         }
         /**
@@ -13298,10 +13332,11 @@
                 // continue with a native call for any and all errors
                 this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
             }
+            const { ...nativeTokenRequest } = nativeRequest;
             // fall back to native calls
             const messageBody = {
                 method: NativeExtensionMethod.GetToken,
-                request: nativeRequest,
+                request: nativeTokenRequest,
             };
             const response = await this.nativeMessageHandler.sendMessage(messageBody);
             const validatedResponse = this.validateNativeResponse(response);
@@ -13383,9 +13418,10 @@
         async acquireTokenRedirect(request, rootMeasurement) {
             this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
             const nativeRequest = await this.initializeNativeRequest(request);
+            const { ...nativeTokenRequest } = nativeRequest;
             const messageBody = {
                 method: NativeExtensionMethod.GetToken,
-                request: nativeRequest,
+                request: nativeTokenRequest,
             };
             try {
                 const response = await this.nativeMessageHandler.sendMessage(messageBody);
@@ -13481,14 +13517,14 @@
             }
             // Get the preferred_cache domain for the given authority
             const authority = await this.getDiscoveredAuthority(request.authority);
-            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, idTokenClaims, base64Decode, response.client_info, undefined, // environment
+            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
             idTokenClaims.tid, undefined, // auth code payload
             response.account.id, this.logger);
             // generate authenticationResult
             const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
             // cache accounts and tokens in the appropriate storage
             this.cacheAccount(baseAccount);
-            this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.accessToken, result.tenantId, reqTimestamp);
+            this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
             return result;
         }
         /**
@@ -13519,7 +13555,8 @@
          * @param response
          */
         async generatePopAccessToken(response, request) {
-            if (request.tokenType === AuthenticationScheme.POP) {
+            if (request.tokenType === AuthenticationScheme.POP &&
+                request.signPopToken) {
                 /**
                  * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
                  * is still received, SHR is calculated locally
@@ -13639,8 +13676,11 @@
                     : response.expires_in) || 0;
             const tokenExpirationSeconds = reqTimestamp + expiresIn;
             const responseScopes = this.generateScopes(response, request);
-            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode);
-            const nativeCacheRecord = new CacheRecord(undefined, cachedIdToken, cachedAccessToken);
+            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+            const nativeCacheRecord = {
+                idToken: cachedIdToken,
+                accessToken: cachedAccessToken,
+            };
             void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
         }
         addTelemetryFromNativeResponse(response) {
@@ -13769,8 +13809,13 @@
                     ...request.extraQueryParameters,
                     ...request.tokenQueryParameters,
                 },
-                extendedExpiryToken: false, // Make this configurable?
+                extendedExpiryToken: false,
+                keyId: request.popKid,
             };
+            // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
+            if (validatedRequest.signPopToken && !!request.popKid) {
+                throw createBrowserAuthError(invalidPopTokenRequest);
+            }
             this.handleExtraBrokerParams(validatedRequest);
             validatedRequest.extraParameters =
                 validatedRequest.extraParameters || {};
@@ -13785,10 +13830,20 @@
                     shrNonce: request.shrNonce,
                 };
                 const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, this.correlationId)(shrParameters, this.logger);
-                // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                validatedRequest.reqCnf = reqCnfData.reqCnfHash;
-                validatedRequest.keyId = reqCnfData.kid;
+                // generate reqCnf if not provided in the request
+                let reqCnfData;
+                if (!validatedRequest.keyId) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                    validatedRequest.keyId = generatedReqCnfData.kid;
+                    validatedRequest.signPopToken = true;
+                }
+                else {
+                    reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
+                    validatedRequest.signPopToken = false;
+                }
+                // SPAs require whole string to be passed to broker
+                validatedRequest.reqCnf = reqCnfData;
             }
             return validatedRequest;
         }
@@ -15393,47 +15448,32 @@
          * @returns `AuthenticationResult` for the response that was loaded.
          */
         loadExternalTokens(request, response, options) {
-            this.logger.info("TokenCache - loadExternalTokens called");
-            if (!response.id_token) {
-                throw createBrowserAuthError(unableToLoadToken);
+            if (!this.isBrowserEnvironment) {
+                throw createBrowserAuthError(nonBrowserEnvironment);
             }
-            const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
-            let cacheRecord;
-            let authority;
-            let cacheRecordAccount;
-            if (request.account) {
-                cacheRecordAccount = AccountEntity.createFromAccountInfo(request.account);
-                cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(response.id_token, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment));
-            }
-            else if (request.authority) {
-                const authorityUrl = Authority.generateAuthority(request.authority, request.azureCloudOptions);
-                const authorityOptions = {
-                    protocolMode: this.config.auth.protocolMode,
-                    knownAuthorities: this.config.auth.knownAuthorities,
-                    cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-                    authorityMetadata: this.config.auth.authorityMetadata,
-                    skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
-                };
-                authority = new Authority(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid());
-                // "clientInfo" from options takes precedence over "clientInfo" in response
-                if (options.clientInfo) {
-                    this.logger.trace("TokenCache - homeAccountId from options");
-                    cacheRecordAccount = this.loadAccount(idTokenClaims, authority, options.clientInfo);
-                    cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(response.id_token, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
-                }
-                else if (response.client_info) {
-                    this.logger.trace("TokenCache - homeAccountId from response");
-                    cacheRecordAccount = this.loadAccount(idTokenClaims, authority, response.client_info);
-                    cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(response.id_token, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
-                }
-                else {
-                    throw createBrowserAuthError(unableToLoadToken);
-                }
-            }
-            else {
-                throw createBrowserAuthError(unableToLoadToken);
-            }
-            return this.generateAuthenticationResult(request, idTokenClaims, cacheRecord, cacheRecordAccount, authority);
+            const idTokenClaims = response.id_token
+                ? extractTokenClaims(response.id_token, base64Decode)
+                : undefined;
+            const authorityOptions = {
+                protocolMode: this.config.auth.protocolMode,
+                knownAuthorities: this.config.auth.knownAuthorities,
+                cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
+                authorityMetadata: this.config.auth.authorityMetadata,
+                skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
+            };
+            const authority = request.authority
+                ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
+                : undefined;
+            const cacheRecordAccount = this.loadAccount(request, options.clientInfo || response.client_info || "", idTokenClaims, authority);
+            const idToken = this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm);
+            const accessToken = this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options);
+            const refreshToken = this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment);
+            return this.generateAuthenticationResult(request, {
+                account: cacheRecordAccount,
+                idToken,
+                accessToken,
+                refreshToken,
+            }, idTokenClaims, authority);
         }
         /**
          * Helper function to load account to msal-browser cache
@@ -15444,29 +15484,24 @@
          * @param requestHomeAccountId
          * @returns `AccountEntity`
          */
-        loadAccount(idTokenClaims, authority, clientInfo, requestHomeAccountId) {
-            if (this.isBrowserEnvironment) {
-                this.logger.verbose("TokenCache - loading account");
-                let homeAccountId;
-                if (requestHomeAccountId) {
-                    homeAccountId = requestHomeAccountId;
-                }
-                else if (authority.authorityType !== undefined && clientInfo) {
-                    homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
-                }
-                if (!homeAccountId) {
-                    throw createBrowserAuthError(unableToLoadToken);
-                }
-                const claimsTenantId = idTokenClaims.tid;
-                const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, idTokenClaims, base64Decode, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
-                undefined, // nativeAccountId
-                this.logger);
-                this.storage.setAccount(cachedAccount);
-                return cachedAccount;
+        loadAccount(request, clientInfo, idTokenClaims, authority) {
+            this.logger.verbose("TokenCache - loading account");
+            if (request.account) {
+                const accountEntity = AccountEntity.createFromAccountInfo(request.account);
+                this.storage.setAccount(accountEntity);
+                return accountEntity;
             }
-            else {
+            else if (!authority || (!clientInfo && !idTokenClaims)) {
+                this.logger.error("TokenCache - if an account is not provided on the request, authority and either clientInfo or idToken must be provided instead.");
                 throw createBrowserAuthError(unableToLoadToken);
             }
+            const homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
+            const claimsTenantId = idTokenClaims?.tid;
+            const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
+            undefined, // nativeAccountId
+            this.logger);
+            this.storage.setAccount(cachedAccount);
+            return cachedAccount;
         }
         /**
          * Helper function to load id tokens to msal-browser cache
@@ -15476,16 +15511,15 @@
          * @param tenantId
          * @returns `IdTokenEntity`
          */
-        loadIdToken(idToken, homeAccountId, environment, tenantId) {
-            const idTokenEntity = createIdTokenEntity(homeAccountId, environment, idToken, this.config.auth.clientId, tenantId);
-            if (this.isBrowserEnvironment) {
-                this.logger.verbose("TokenCache - loading id token");
-                this.storage.setIdTokenCredential(idTokenEntity);
-                return idTokenEntity;
-            }
-            else {
-                throw createBrowserAuthError(unableToLoadToken);
+        loadIdToken(response, homeAccountId, environment, tenantId) {
+            if (!response.id_token) {
+                this.logger.verbose("TokenCache - no id token found in response");
+                return null;
             }
+            this.logger.verbose("TokenCache - loading id token");
+            const idTokenEntity = createIdTokenEntity(homeAccountId, environment, response.id_token, this.config.auth.clientId, tenantId);
+            this.storage.setIdTokenCredential(idTokenEntity);
+            return idTokenEntity;
         }
         /**
          * Helper function to load access tokens to msal-browser cache
@@ -15498,28 +15532,30 @@
          */
         loadAccessToken(request, response, homeAccountId, environment, tenantId, options) {
             if (!response.access_token) {
-                this.logger.verbose("TokenCache - No access token provided for caching");
+                this.logger.verbose("TokenCache - no access token found in response");
                 return null;
             }
-            if (!response.expires_in) {
-                throw createBrowserAuthError(unableToLoadToken);
+            else if (!response.expires_in) {
+                this.logger.error("TokenCache - no expiration set on the access token. Cannot add it to the cache.");
+                return null;
             }
-            if (!options.extendedExpiresOn) {
-                throw createBrowserAuthError(unableToLoadToken);
+            else if (!response.scope &&
+                (!request.scopes || !request.scopes.length)) {
+                this.logger.error("TokenCache - scopes not specified in the request or response. Cannot add token to the cache.");
+                return null;
             }
-            const scopes = new ScopeSet(request.scopes).printScopes();
+            this.logger.verbose("TokenCache - loading access token");
+            const scopes = response.scope
+                ? ScopeSet.fromString(response.scope)
+                : new ScopeSet(request.scopes);
             const expiresOn = options.expiresOn ||
                 response.expires_in + new Date().getTime() / 1000;
-            const extendedExpiresOn = options.extendedExpiresOn;
-            const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes, expiresOn, extendedExpiresOn, base64Decode);
-            if (this.isBrowserEnvironment) {
-                this.logger.verbose("TokenCache - loading access token");
-                this.storage.setAccessTokenCredential(accessTokenEntity);
-                return accessTokenEntity;
-            }
-            else {
-                throw createBrowserAuthError(unableToLoadToken);
-            }
+            const extendedExpiresOn = options.extendedExpiresOn ||
+                (response.ext_expires_in || response.expires_in) +
+                    new Date().getTime() / 1000;
+            const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
+            this.storage.setAccessTokenCredential(accessTokenEntity);
+            return accessTokenEntity;
         }
         /**
          * Helper function to load refresh tokens to msal-browser cache
@@ -15529,20 +15565,16 @@
          * @param environment
          * @returns `RefreshTokenEntity`
          */
-        loadRefreshToken(request, response, homeAccountId, environment) {
+        loadRefreshToken(response, homeAccountId, environment) {
             if (!response.refresh_token) {
-                this.logger.verbose("TokenCache - No refresh token provided for caching");
+                this.logger.verbose("TokenCache - no refresh token found in response");
                 return null;
             }
-            const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId);
-            if (this.isBrowserEnvironment) {
-                this.logger.verbose("TokenCache - loading refresh token");
-                this.storage.setRefreshTokenCredential(refreshTokenEntity);
-                return refreshTokenEntity;
-            }
-            else {
-                throw createBrowserAuthError(unableToLoadToken);
-            }
+            this.logger.verbose("TokenCache - loading refresh token");
+            const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
+            response.refresh_token_expires_in);
+            this.storage.setRefreshTokenCredential(refreshTokenEntity);
+            return refreshTokenEntity;
         }
         /**
          * Helper function to generate an `AuthenticationResult` for the result.
@@ -15552,8 +15584,8 @@
          * @param authority
          * @returns `AuthenticationResult`
          */
-        generateAuthenticationResult(request, idTokenClaims, cacheRecord, accountEntity, authority) {
-            let accessToken = Constants.EMPTY_STRING;
+        generateAuthenticationResult(request, cacheRecord, idTokenClaims, authority) {
+            let accessToken = "";
             let responseScopes = [];
             let expiresOn = null;
             let extExpiresOn;
@@ -15563,14 +15595,11 @@
                 expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
                 extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
             }
-            const uid = idTokenClaims.oid || idTokenClaims.sub || Constants.EMPTY_STRING;
-            const tid = idTokenClaims.tid || Constants.EMPTY_STRING;
+            const accountEntity = cacheRecord.account;
             return {
-                authority: authority
-                    ? authority.canonicalAuthority
-                    : Constants.EMPTY_STRING,
-                uniqueId: uid,
-                tenantId: tid,
+                authority: authority ? authority.canonicalAuthority : "",
+                uniqueId: cacheRecord.account.localAccountId,
+                tenantId: cacheRecord.account.realm,
                 scopes: responseScopes,
                 account: accountEntity.getAccountInfo(),
                 idToken: cacheRecord.idToken?.secret || "",
@@ -15578,15 +15607,14 @@
                 accessToken: accessToken,
                 fromCache: true,
                 expiresOn: expiresOn,
-                correlationId: request.correlationId || Constants.EMPTY_STRING,
-                requestId: Constants.EMPTY_STRING,
+                correlationId: request.correlationId || "",
+                requestId: "",
                 extExpiresOn: extExpiresOn,
-                familyId: Constants.EMPTY_STRING,
-                tokenType: cacheRecord?.accessToken?.tokenType || Constants.EMPTY_STRING,
-                state: Constants.EMPTY_STRING,
-                cloudGraphHostName: accountEntity.cloudGraphHostName || Constants.EMPTY_STRING,
-                msGraphHost: accountEntity.msGraphHost || Constants.EMPTY_STRING,
-                code: undefined,
+                familyId: cacheRecord.refreshToken?.familyId || "",
+                tokenType: cacheRecord?.accessToken?.tokenType || "",
+                state: request.state || "",
+                cloudGraphHostName: accountEntity.cloudGraphHostName || "",
+                msGraphHost: accountEntity.msGraphHost || "",
                 fromNativeBroker: false,
             };
         }
@@ -16828,12 +16856,13 @@
          * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
          */
         async acquireTokenSilentAsync(request, account) {
+            const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
             this.performanceClient.addQueueMeasurement(PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
             if (request.correlationId) {
                 this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
             }
-            document.addEventListener("visibilitychange", () => this.trackPageVisibility(request.correlationId));
+            document.addEventListener("visibilitychange", trackPageVisibility);
             const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
             const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
             const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
@@ -16912,7 +16941,7 @@
                 throw tokenRenewalError;
             })
                 .finally(() => {
-                document.removeEventListener("visibilitychange", () => this.trackPageVisibility(request.correlationId));
+                document.removeEventListener("visibilitychange", trackPageVisibility);
             });
         }
         /**
@@ -17173,7 +17202,7 @@
     const NestedAppAuthErrorMessage = {
         unsupportedMethod: {
             code: "unsupported_method",
-            desc: "The PKCE code challenge and verifier could not be generated.",
+            desc: "This method is not supported in nested app environment.",
         },
     };
     class NestedAppAuthError extends AuthError {