@azure/msal-browser 3.28.1 → 4.0.1

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.28.1 2025-01-14 */
+/*! @azure/msal-browser v4.0.1 2025-01-15 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -113,12 +113,6 @@
      * Persistent cache keys MSAL which stay while user is logged in.
      */
     const PersistentCacheKeys = {
-        ID_TOKEN: "idtoken",
-        CLIENT_INFO: "client.info",
-        ADAL_ID_TOKEN: "adal.idtoken",
-        ERROR: "error",
-        ERROR_DESC: "error.description",
-        ACTIVE_ACCOUNT: "active-account",
         ACTIVE_ACCOUNT_FILTERS: "active-account-filters", // new cache entry for active_account for a more robust version for browser
     };
     /**
@@ -316,7 +310,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -333,7 +327,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -382,7 +376,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -480,7 +474,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -732,7 +726,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -771,7 +765,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -962,12 +956,12 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "14.16.0";
+    const version$1 = "15.0.1";
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -987,7 +981,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1048,7 +1042,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1085,7 +1079,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1412,7 +1406,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1437,14 +1431,14 @@
     const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
     const invalidAuthenticationHeader = "invalid_authentication_header";
     const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
-    const cannotAllowNativeBroker = "cannot_allow_native_broker";
+    const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
     const authorityMismatch = "authority_mismatch";
 
     var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
         __proto__: null,
         authorityMismatch: authorityMismatch,
         authorityUriInsecure: authorityUriInsecure,
-        cannotAllowNativeBroker: cannotAllowNativeBroker,
+        cannotAllowPlatformBroker: cannotAllowPlatformBroker,
         cannotSetOIDCOptions: cannotSetOIDCOptions,
         claimsRequestParsingError: claimsRequestParsingError,
         emptyInputScopesError: emptyInputScopesError,
@@ -1466,7 +1460,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1493,7 +1487,7 @@
         [missingNonceAuthenticationHeader]: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",
         [invalidAuthenticationHeader]: "Invalid authentication header provided",
         [cannotSetOIDCOptions]: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
-        [cannotAllowNativeBroker]: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
+        [cannotAllowPlatformBroker]: "Cannot set allowPlatformBroker parameter to true when not in AAD protocol mode.",
         [authorityMismatch]: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
     };
     /**
@@ -1581,9 +1575,9 @@
             code: cannotSetOIDCOptions,
             desc: ClientConfigurationErrorMessages[cannotSetOIDCOptions],
         },
-        cannotAllowNativeBroker: {
-            code: cannotAllowNativeBroker,
-            desc: ClientConfigurationErrorMessages[cannotAllowNativeBroker],
+        cannotAllowPlatformBroker: {
+            code: cannotAllowPlatformBroker,
+            desc: ClientConfigurationErrorMessages[cannotAllowPlatformBroker],
         },
         authorityMismatch: {
             code: authorityMismatch,
@@ -1604,7 +1598,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1701,7 +1695,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1901,7 +1895,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1941,7 +1935,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2020,7 +2014,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2035,7 +2029,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2057,7 +2051,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2070,7 +2064,7 @@
         OIDC: "OIDC",
     };
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2313,7 +2307,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2360,7 +2354,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2524,7 +2518,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2664,7 +2658,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2672,7 +2666,7 @@
     const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
     const cacheUnknownErrorCode = "cache_error_unknown";
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2699,7 +2693,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2864,24 +2858,24 @@
          * @param storeInCache {?StoreInCache}
          * @param correlationId {?string} correlation id
          */
-        async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+        async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
             if (!cacheRecord) {
                 throw createClientAuthError(invalidCacheRecord);
             }
             try {
                 if (!!cacheRecord.account) {
-                    this.setAccount(cacheRecord.account);
+                    await this.setAccount(cacheRecord.account, correlationId);
                 }
                 if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                    this.setIdTokenCredential(cacheRecord.idToken);
+                    await this.setIdTokenCredential(cacheRecord.idToken, correlationId);
                 }
                 if (!!cacheRecord.accessToken &&
                     storeInCache?.accessToken !== false) {
-                    await this.saveAccessToken(cacheRecord.accessToken);
+                    await this.saveAccessToken(cacheRecord.accessToken, correlationId);
                 }
                 if (!!cacheRecord.refreshToken &&
                     storeInCache?.refreshToken !== false) {
-                    this.setRefreshTokenCredential(cacheRecord.refreshToken);
+                    await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
                 }
                 if (!!cacheRecord.appMetadata) {
                     this.setAppMetadata(cacheRecord.appMetadata);
@@ -2911,7 +2905,7 @@
          * saves access token credential
          * @param credential
          */
-        async saveAccessToken(credential) {
+        async saveAccessToken(credential, correlationId) {
             const accessTokenFilter = {
                 clientId: credential.clientId,
                 credentialType: credential.credentialType,
@@ -2938,7 +2932,7 @@
                 }
             });
             await Promise.all(removedAccessTokens);
-            this.setAccessTokenCredential(credential);
+            await this.setAccessTokenCredential(credential, correlationId);
         }
         /**
          * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
@@ -3224,61 +3218,6 @@
             });
             await Promise.all(removedCredentials);
         }
-        /**
-         * Migrates a single-tenant account and all it's associated alternate cross-tenant account objects in the
-         * cache into a condensed multi-tenant account object with tenant profiles.
-         * @param accountKey
-         * @param accountEntity
-         * @param logger
-         * @returns
-         */
-        updateOutdatedCachedAccount(accountKey, accountEntity, logger) {
-            // Only update if account entity is defined and has no tenantProfiles object (is outdated)
-            if (accountEntity && accountEntity.isSingleTenant()) {
-                this.commonLogger?.verbose("updateOutdatedCachedAccount: Found a single-tenant (outdated) account entity in the cache, migrating to multi-tenant account entity");
-                // Get keys of all accounts belonging to user
-                const matchingAccountKeys = this.getAccountKeys().filter((key) => {
-                    return key.startsWith(accountEntity.homeAccountId);
-                });
-                // Get all account entities belonging to user
-                const accountsToMerge = [];
-                matchingAccountKeys.forEach((key) => {
-                    const account = this.getCachedAccountEntity(key);
-                    if (account) {
-                        accountsToMerge.push(account);
-                    }
-                });
-                // Set base account to home account if available, any account if not
-                const baseAccount = accountsToMerge.find((account) => {
-                    return tenantIdMatchesHomeTenant(account.realm, account.homeAccountId);
-                }) || accountsToMerge[0];
-                // Populate tenant profiles built from each account entity belonging to the user
-                baseAccount.tenantProfiles = accountsToMerge.map((account) => {
-                    return {
-                        tenantId: account.realm,
-                        localAccountId: account.localAccountId,
-                        name: account.name,
-                        isHomeTenant: tenantIdMatchesHomeTenant(account.realm, account.homeAccountId),
-                    };
-                });
-                const updatedAccount = CacheManager.toObject(new AccountEntity(), {
-                    ...baseAccount,
-                });
-                const newAccountKey = updatedAccount.generateAccountKey();
-                // Clear cache of legacy account objects that have been collpsed into tenant profiles
-                matchingAccountKeys.forEach((key) => {
-                    if (key !== newAccountKey) {
-                        this.removeOutdatedAccount(accountKey);
-                    }
-                });
-                // Cache updated account object
-                this.setAccount(updatedAccount);
-                logger?.verbose("Updated an outdated account entity in the cache");
-                return updatedAccount;
-            }
-            // No update is necessary
-            return accountEntity;
-        }
         /**
          * returns a boolean if the given credential is removed
          * @param credential
@@ -3874,28 +3813,25 @@
     }
     /** @internal */
     class DefaultStorageClass extends CacheManager {
-        setAccount() {
+        async setAccount() {
             throw createClientAuthError(methodNotImplemented);
         }
         getAccount() {
             throw createClientAuthError(methodNotImplemented);
         }
-        getCachedAccountEntity() {
-            throw createClientAuthError(methodNotImplemented);
-        }
-        setIdTokenCredential() {
+        async setIdTokenCredential() {
             throw createClientAuthError(methodNotImplemented);
         }
         getIdTokenCredential() {
             throw createClientAuthError(methodNotImplemented);
         }
-        setAccessTokenCredential() {
+        async setAccessTokenCredential() {
             throw createClientAuthError(methodNotImplemented);
         }
         getAccessTokenCredential() {
             throw createClientAuthError(methodNotImplemented);
         }
-        setRefreshTokenCredential() {
+        async setRefreshTokenCredential() {
             throw createClientAuthError(methodNotImplemented);
         }
         getRefreshTokenCredential() {
@@ -3940,15 +3876,9 @@
         getTokenKeys() {
             throw createClientAuthError(methodNotImplemented);
         }
-        updateCredentialCacheKey() {
-            throw createClientAuthError(methodNotImplemented);
-        }
-        removeOutdatedAccount() {
-            throw createClientAuthError(methodNotImplemented);
-        }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4047,7 +3977,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4057,7 +3987,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4107,7 +4037,7 @@
     const BROKER_CLIENT_ID = "brk_client_id";
     const BROKER_REDIRECT_URI = "brk_redirect_uri";
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4174,7 +4104,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4582,7 +4512,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4594,7 +4524,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4604,7 +4534,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4614,7 +4544,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4772,6 +4702,7 @@
          */
         InitializeSilentRequest: "initializeSilentRequest",
         InitializeClientApplication: "initializeClientApplication",
+        InitializeCache: "initializeCache",
         /**
          * Helper function in SilentIframeClient class (msal-browser).
          */
@@ -4849,6 +4780,8 @@
          */
         ClearTokensAndKeysWithClaims: "clearTokensAndKeysWithClaims",
         CacheManagerGetRefreshToken: "cacheManagerGetRefreshToken",
+        ImportExistingCache: "importExistingCache",
+        SetUserData: "setUserData",
         /**
          * Crypto Operations
          */
@@ -4857,6 +4790,12 @@
         GenerateCodeChallengeFromVerifier: "generateCodeChallengeFromVerifier",
         Sha256Digest: "sha256Digest",
         GetRandomValues: "getRandomValues",
+        GenerateHKDF: "generateHKDF",
+        GenerateBaseKey: "generateBaseKey",
+        Base64Decode: "base64Decode",
+        UrlEncodeArr: "urlEncodeArr",
+        Encrypt: "encrypt",
+        Decrypt: "decrypt",
     };
     const PerformanceEventAbbreviations = new Map([
         [PerformanceEvents.AcquireTokenByCode, "ATByCode"],
@@ -4941,6 +4880,9 @@
             PerformanceEvents.InitializeClientApplication,
             "InitClientApplication",
         ],
+        [PerformanceEvents.InitializeCache, "InitCache"],
+        [PerformanceEvents.ImportExistingCache, "importCache"],
+        [PerformanceEvents.SetUserData, "setUserData"],
         [PerformanceEvents.SilentIframeClientTokenHelper, "SIClientTHelper"],
         [
             PerformanceEvents.SilentHandlerInitiateAuthRequest,
@@ -5074,6 +5016,12 @@
         ],
         [PerformanceEvents.Sha256Digest, "Sha256Digest"],
         [PerformanceEvents.GetRandomValues, "GetRandomValues"],
+        [PerformanceEvents.GenerateHKDF, "genHKDF"],
+        [PerformanceEvents.GenerateBaseKey, "genBaseKey"],
+        [PerformanceEvents.Base64Decode, "b64Decode"],
+        [PerformanceEvents.UrlEncodeArr, "urlEncArr"],
+        [PerformanceEvents.Encrypt, "encrypt"],
+        [PerformanceEvents.Decrypt, "decrypt"],
     ]);
     /**
      * State of the performance event.
@@ -5099,9 +5047,11 @@
         "multiMatchedAT",
         "multiMatchedID",
         "multiMatchedRT",
+        "unencryptedCacheCount",
+        "encryptedCacheExpiredCount",
     ]);
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5197,7 +5147,7 @@
         };
     };
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5306,7 +5256,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6145,7 +6095,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6176,7 +6126,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6195,7 +6145,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6293,7 +6243,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6323,7 +6273,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6473,7 +6423,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6499,7 +6449,7 @@
         refreshTokenExpired: refreshTokenExpired
     });
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6587,7 +6537,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6659,7 +6609,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6743,7 +6693,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6770,7 +6720,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6930,13 +6880,13 @@
                     !forceCacheRefreshTokenResponse &&
                     cacheRecord.account) {
                     const key = cacheRecord.account.generateAccountKey();
-                    const account = this.cacheStorage.getAccount(key, this.logger);
+                    const account = this.cacheStorage.getAccount(key);
                     if (!account) {
                         this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                         return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                     }
                 }
-                await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache, request.correlationId);
+                await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, request.storeInCache);
             }
             finally {
                 if (this.persistencePlugin &&
@@ -7122,7 +7072,7 @@
         });
         let cachedAccount = null;
         if (baseAccountKey) {
-            cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+            cachedAccount = cacheStorage.getAccount(baseAccountKey);
         }
         const baseAccount = cachedAccount ||
             AccountEntity.createAccount({
@@ -7147,7 +7097,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7165,7 +7115,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7539,7 +7489,7 @@
                 });
             }
             this.addExtraQueryParams(request, parameterBuilder);
-            if (request.nativeBroker) {
+            if (request.platformBroker) {
                 // signal ests that this is a WAM call
                 parameterBuilder.addNativeBroker();
                 // pass the req_cnf for POP
@@ -7607,7 +7557,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7827,7 +7777,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7963,7 +7913,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7978,7 +7928,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8036,7 +7986,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8299,7 +8249,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8307,7 +8257,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8332,7 +8282,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8372,7 +8322,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8451,7 +8401,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2025-01-14 */
+    /*! @azure/msal-common v15.0.1 2025-01-15 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9688,6 +9638,43 @@
         return btoa(binString);
     }
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
+     * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
+     */
+    /**
+     * Returns a URL-safe plaintext decoded string from b64 encoded input.
+     * @param input
+     */
+    function base64Decode(input) {
+        return new TextDecoder().decode(base64DecToArr(input));
+    }
+    /**
+     * Decodes base64 into Uint8Array
+     * @param base64String
+     */
+    function base64DecToArr(base64String) {
+        let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
+        switch (encodedString.length % 4) {
+            case 0:
+                break;
+            case 2:
+                encodedString += "==";
+                break;
+            case 3:
+                encodedString += "=";
+                break;
+            default:
+                throw createBrowserAuthError(invalidBase64String);
+        }
+        const binString = atob(encodedString);
+        return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
+    }
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -9699,8 +9686,10 @@
     /**
      * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
      */
-    // RSA KeyGen Algorithm
+    // Algorithms
     const PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+    const AES_GCM = "AES-GCM";
+    const HKDF = "HKDF";
     // SHA-256 hashing algorithm
     const S256_HASH_ALG = "SHA-256";
     // MOD length for PoP tokens
@@ -9711,6 +9700,13 @@
     const UUID_CHARS = "0123456789abcdef";
     // Array to store UINT32 random value
     const UINT32_ARR = new Uint32Array(1);
+    // Key Format
+    const RAW = "raw";
+    // Key Usages
+    const ENCRYPT = "encrypt";
+    const DECRYPT = "decrypt";
+    const DERIVE_KEY = "deriveKey";
+    // Suberror
     const SUBTLE_SUBERROR = "crypto_subtle_undefined";
     const keygenAlgorithmOptions = {
         name: PKCS1_V15_KEYGEN_ALG,
@@ -9833,6 +9829,76 @@
     async function sign(key, data) {
         return window.crypto.subtle.sign(keygenAlgorithmOptions, key, data);
     }
+    /**
+     * Generates symmetric base encryption key. This may be stored as all encryption/decryption keys will be derived from this one.
+     */
+    async function generateBaseKey() {
+        const key = await window.crypto.subtle.generateKey({
+            name: AES_GCM,
+            length: 256,
+        }, true, [ENCRYPT, DECRYPT]);
+        return window.crypto.subtle.exportKey(RAW, key);
+    }
+    /**
+     * Returns the raw key to be passed into the key derivation function
+     * @param baseKey
+     * @returns
+     */
+    async function generateHKDF(baseKey) {
+        return window.crypto.subtle.importKey(RAW, baseKey, HKDF, false, [
+            DERIVE_KEY,
+        ]);
+    }
+    /**
+     * Given a base key and a nonce generates a derived key to be used in encryption and decryption.
+     * Note: every time we encrypt a new key is derived
+     * @param baseKey
+     * @param nonce
+     * @returns
+     */
+    async function deriveKey(baseKey, nonce, context) {
+        return window.crypto.subtle.deriveKey({
+            name: HKDF,
+            salt: nonce,
+            hash: S256_HASH_ALG,
+            info: new TextEncoder().encode(context),
+        }, baseKey, { name: AES_GCM, length: 256 }, false, [ENCRYPT, DECRYPT]);
+    }
+    /**
+     * Encrypt the given data given a base key. Returns encrypted data and a nonce that must be provided during decryption
+     * @param key
+     * @param rawData
+     */
+    async function encrypt(baseKey, rawData, context) {
+        const encodedData = new TextEncoder().encode(rawData);
+        // The nonce must never be reused with a given key.
+        const nonce = window.crypto.getRandomValues(new Uint8Array(16));
+        const derivedKey = await deriveKey(baseKey, nonce, context);
+        const encryptedData = await window.crypto.subtle.encrypt({
+            name: AES_GCM,
+            iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+        }, derivedKey, encodedData);
+        return {
+            data: urlEncodeArr(new Uint8Array(encryptedData)),
+            nonce: urlEncodeArr(nonce),
+        };
+    }
+    /**
+     * Decrypt data with the given key and nonce
+     * @param key
+     * @param nonce
+     * @param encryptedData
+     * @returns
+     */
+    async function decrypt(baseKey, nonce, context, encryptedData) {
+        const encodedData = base64DecToArr(encryptedData);
+        const derivedKey = await deriveKey(baseKey, base64DecToArr(nonce), context);
+        const decryptedData = await window.crypto.subtle.decrypt({
+            name: AES_GCM,
+            iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+        }, derivedKey, encodedData);
+        return new TextDecoder().decode(decryptedData);
+    }
     /**
      * Returns the SHA-256 hash of an input string
      * @param plainText
@@ -10325,7 +10391,7 @@
             redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS,
             asyncPopups: false,
             allowRedirectInIframe: false,
-            allowNativeBroker: false,
+            allowPlatformBroker: false,
             nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
                 DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
             pollIntervalMilliseconds: BrowserConstants.DEFAULT_POLL_INTERVAL_MS,
@@ -10348,11 +10414,11 @@
             const logger = new Logger(providedSystemOptions.loggerOptions);
             logger.warning(JSON.stringify(createClientConfigurationError(cannotSetOIDCOptions)));
         }
-        // Throw an error if user has set allowNativeBroker to true without being in AAD protocol mode
+        // Throw an error if user has set allowPlatformBroker to true without being in AAD protocol mode
         if (userInputAuth?.protocolMode &&
             userInputAuth.protocolMode !== ProtocolMode.AAD &&
-            providedSystemOptions?.allowNativeBroker) {
-            throw createClientConfigurationError(cannotAllowNativeBroker);
+            providedSystemOptions?.allowPlatformBroker) {
+            throw createClientConfigurationError(cannotAllowPlatformBroker);
         }
         const overlayedConfig = {
             auth: {
@@ -10372,7 +10438,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "3.28.1";
+    const version = "4.0.1";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10748,43 +10814,6 @@
      */
     StandardOperatingContext.ID = "StandardOperatingContext";
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
-     * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
-     */
-    /**
-     * Returns a URL-safe plaintext decoded string from b64 encoded input.
-     * @param input
-     */
-    function base64Decode(input) {
-        return new TextDecoder().decode(base64DecToArr(input));
-    }
-    /**
-     * Decodes base64 into Uint8Array
-     * @param base64String
-     */
-    function base64DecToArr(base64String) {
-        let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
-        switch (encodedString.length % 4) {
-            case 0:
-                break;
-            case 2:
-                encodedString += "==";
-                break;
-            case 3:
-                encodedString += "=";
-                break;
-            default:
-                throw createBrowserAuthError(invalidBase64String);
-        }
-        const binString = atob(encodedString);
-        return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
-    }
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -10994,12 +11023,21 @@
         constructor() {
             this.cache = new Map();
         }
+        async initialize() {
+            // Memory storage does not require initialization
+        }
         getItem(key) {
             return this.cache.get(key) || null;
         }
+        getUserData(key) {
+            return this.getItem(key);
+        }
         setItem(key, value) {
             this.cache.set(key, value);
         }
+        async setUserData(key, value) {
+            this.setItem(key, value);
+        }
         removeItem(key) {
             this.cache.delete(key);
         }
@@ -11331,19 +11369,189 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
+    // Cookie life calculation (hours * minutes * seconds * ms)
+    const COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
+    class CookieStorage {
+        initialize() {
+            return Promise.resolve();
+        }
+        getItem(key) {
+            const name = `${encodeURIComponent(key)}`;
+            const cookieList = document.cookie.split(";");
+            for (let i = 0; i < cookieList.length; i++) {
+                const cookie = cookieList[i];
+                const [key, ...rest] = decodeURIComponent(cookie).trim().split("=");
+                const value = rest.join("=");
+                if (key === name) {
+                    return value;
+                }
+            }
+            return "";
+        }
+        getUserData() {
+            throw createClientAuthError(methodNotImplemented);
+        }
+        setItem(key, value, cookieLifeDays, secure = true) {
+            let cookieStr = `${encodeURIComponent(key)}=${encodeURIComponent(value)};path=/;SameSite=Lax;`;
+            if (cookieLifeDays) {
+                const expireTime = getCookieExpirationTime(cookieLifeDays);
+                cookieStr += `expires=${expireTime};`;
+            }
+            if (secure) {
+                cookieStr += "Secure;";
+            }
+            document.cookie = cookieStr;
+        }
+        async setUserData() {
+            return Promise.reject(createClientAuthError(methodNotImplemented));
+        }
+        removeItem(key) {
+            // Setting expiration to -1 removes it
+            this.setItem(key, "", -1);
+        }
+        getKeys() {
+            const cookieList = document.cookie.split(";");
+            const keys = [];
+            cookieList.forEach((cookie) => {
+                const cookieParts = decodeURIComponent(cookie).trim().split("=");
+                keys.push(cookieParts[0]);
+            });
+            return keys;
+        }
+        containsKey(key) {
+            return this.getKeys().includes(key);
+        }
+    }
+    /**
+     * Get cookie expiration time
+     * @param cookieLifeDays
+     */
+    function getCookieExpirationTime(cookieLifeDays) {
+        const today = new Date();
+        const expr = new Date(today.getTime() + cookieLifeDays * COOKIE_LIFE_MULTIPLIER);
+        return expr.toUTCString();
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Returns a list of cache keys for all known accounts
+     * @param storage
+     * @returns
+     */
+    function getAccountKeys(storage) {
+        const accountKeys = storage.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+        if (accountKeys) {
+            return JSON.parse(accountKeys);
+        }
+        return [];
+    }
+    /**
+     * Returns a list of cache keys for all known tokens
+     * @param clientId
+     * @param storage
+     * @returns
+     */
+    function getTokenKeys(clientId, storage) {
+        const item = storage.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${clientId}`);
+        if (item) {
+            const tokenKeys = JSON.parse(item);
+            if (tokenKeys &&
+                tokenKeys.hasOwnProperty("idToken") &&
+                tokenKeys.hasOwnProperty("accessToken") &&
+                tokenKeys.hasOwnProperty("refreshToken")) {
+                return tokenKeys;
+            }
+        }
+        return {
+            idToken: [],
+            accessToken: [],
+            refreshToken: [],
+        };
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    const ENCRYPTION_KEY = "msal.cache.encryption";
     class LocalStorage {
-        constructor() {
+        constructor(clientId, logger, performanceClient) {
             if (!window.localStorage) {
                 throw createBrowserConfigurationAuthError(storageNotSupported);
             }
+            this.memoryStorage = new MemoryStorage();
+            this.initialized = false;
+            this.clientId = clientId;
+            this.logger = logger;
+            this.performanceClient = performanceClient;
+        }
+        async initialize(correlationId) {
+            this.initialized = true;
+            const cookies = new CookieStorage();
+            const cookieString = cookies.getItem(ENCRYPTION_KEY);
+            let parsedCookie = { key: "", id: "" };
+            if (cookieString) {
+                try {
+                    parsedCookie = JSON.parse(cookieString);
+                }
+                catch (e) { }
+            }
+            if (parsedCookie.key && parsedCookie.id) {
+                // Encryption key already exists, import
+                const baseKey = invoke(base64DecToArr, PerformanceEvents.Base64Decode, this.logger, this.performanceClient, correlationId)(parsedCookie.key);
+                this.encryptionCookie = {
+                    id: parsedCookie.id,
+                    key: await invokeAsync(generateHKDF, PerformanceEvents.GenerateHKDF, this.logger, this.performanceClient, correlationId)(baseKey),
+                };
+                await invokeAsync(this.importExistingCache.bind(this), PerformanceEvents.ImportExistingCache, this.logger, this.performanceClient, correlationId)(correlationId);
+            }
+            else {
+                // Encryption key doesn't exist or is invalid, generate a new one and clear existing cache
+                this.clear();
+                const id = createNewGuid();
+                const baseKey = await invokeAsync(generateBaseKey, PerformanceEvents.GenerateBaseKey, this.logger, this.performanceClient, correlationId)();
+                const keyStr = invoke(urlEncodeArr, PerformanceEvents.UrlEncodeArr, this.logger, this.performanceClient, correlationId)(new Uint8Array(baseKey));
+                this.encryptionCookie = {
+                    id: id,
+                    key: await invokeAsync(generateHKDF, PerformanceEvents.GenerateHKDF, this.logger, this.performanceClient, correlationId)(baseKey),
+                };
+                const cookieData = {
+                    id: id,
+                    key: keyStr,
+                };
+                cookies.setItem(ENCRYPTION_KEY, JSON.stringify(cookieData));
+            }
         }
         getItem(key) {
             return window.localStorage.getItem(key);
         }
+        getUserData(key) {
+            if (!this.initialized) {
+                throw createBrowserAuthError(uninitializedPublicClientApplication);
+            }
+            return this.memoryStorage.getItem(key);
+        }
         setItem(key, value) {
             window.localStorage.setItem(key, value);
         }
+        async setUserData(key, value, correlationId) {
+            if (!this.initialized || !this.encryptionCookie) {
+                throw createBrowserAuthError(uninitializedPublicClientApplication);
+            }
+            const { data, nonce } = await invokeAsync(encrypt, PerformanceEvents.Encrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, value, this.getContext(key));
+            const encryptedData = {
+                id: this.encryptionCookie.id,
+                nonce: nonce,
+                data: data,
+            };
+            this.memoryStorage.setItem(key, value);
+            this.setItem(key, JSON.stringify(encryptedData));
+        }
         removeItem(key) {
+            this.memoryStorage.removeItem(key);
             window.localStorage.removeItem(key);
         }
         getKeys() {
@@ -11352,6 +11560,114 @@
         containsKey(key) {
             return window.localStorage.hasOwnProperty(key);
         }
+        /**
+         * Removes all known MSAL keys from the cache
+         */
+        clear() {
+            // Removes all remaining MSAL cache items
+            this.memoryStorage.clear();
+            const accountKeys = getAccountKeys(this);
+            accountKeys.forEach((key) => this.removeItem(key));
+            const tokenKeys = getTokenKeys(this.clientId, this);
+            tokenKeys.idToken.forEach((key) => this.removeItem(key));
+            tokenKeys.accessToken.forEach((key) => this.removeItem(key));
+            tokenKeys.refreshToken.forEach((key) => this.removeItem(key));
+            // Clean up anything left
+            this.getKeys().forEach((cacheKey) => {
+                if (cacheKey.startsWith(Constants.CACHE_PREFIX) ||
+                    cacheKey.indexOf(this.clientId) !== -1) {
+                    this.removeItem(cacheKey);
+                }
+            });
+        }
+        /**
+         * Helper to decrypt all known MSAL keys in localStorage and save them to inMemory storage
+         * @returns
+         */
+        async importExistingCache(correlationId) {
+            if (!this.encryptionCookie) {
+                return;
+            }
+            let accountKeys = getAccountKeys(this);
+            accountKeys = await this.importArray(accountKeys, correlationId);
+            // Write valid account keys back to map
+            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            const tokenKeys = getTokenKeys(this.clientId, this);
+            tokenKeys.idToken = await this.importArray(tokenKeys.idToken, correlationId);
+            tokenKeys.accessToken = await this.importArray(tokenKeys.accessToken, correlationId);
+            tokenKeys.refreshToken = await this.importArray(tokenKeys.refreshToken, correlationId);
+            // Write valid token keys back to map
+            this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+        }
+        /**
+         * Helper to decrypt and save cache entries
+         * @param key
+         * @returns
+         */
+        async getItemFromEncryptedCache(key, correlationId) {
+            if (!this.encryptionCookie) {
+                return null;
+            }
+            const rawCache = this.getItem(key);
+            if (!rawCache) {
+                return null;
+            }
+            let encObj;
+            try {
+                encObj = JSON.parse(rawCache);
+            }
+            catch (e) {
+                // Not a valid encrypted object, remove
+                return null;
+            }
+            if (!encObj.id || !encObj.nonce || !encObj.data) {
+                // Data is not encrypted, likely from old version of MSAL. It must be removed because we don't know how old it is.
+                this.performanceClient.incrementFields({ unencryptedCacheCount: 1 }, correlationId);
+                return null;
+            }
+            if (encObj.id !== this.encryptionCookie.id) {
+                // Data was encrypted with a different key. It must be removed because it is from a previous session.
+                this.performanceClient.incrementFields({ encryptedCacheExpiredCount: 1 }, correlationId);
+                return null;
+            }
+            return invokeAsync(decrypt, PerformanceEvents.Decrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, encObj.nonce, this.getContext(key), encObj.data);
+        }
+        /**
+         * Helper to decrypt and save an array of cache keys
+         * @param arr
+         * @returns Array of keys successfully imported
+         */
+        async importArray(arr, correlationId) {
+            const importedArr = [];
+            const promiseArr = [];
+            arr.forEach((key) => {
+                const promise = this.getItemFromEncryptedCache(key, correlationId).then((value) => {
+                    if (value) {
+                        this.memoryStorage.setItem(key, value);
+                        importedArr.push(key);
+                    }
+                    else {
+                        // If value is empty, unencrypted or expired remove
+                        this.removeItem(key);
+                    }
+                });
+                promiseArr.push(promise);
+            });
+            await Promise.all(promiseArr);
+            return importedArr;
+        }
+        /**
+         * Gets encryption context for a given cache entry. This is clientId for app specific entries, empty string for shared entries
+         * @param key
+         * @returns
+         */
+        getContext(key) {
+            let context = "";
+            if (key.includes(this.clientId)) {
+                context = this.clientId; // Used to bind encryption key to this appId
+            }
+            return context;
+        }
     }
 
     /*
@@ -11364,12 +11680,21 @@
                 throw createBrowserConfigurationAuthError(storageNotSupported);
             }
         }
+        async initialize() {
+            // Session storage does not require initialization
+        }
         getItem(key) {
             return window.sessionStorage.getItem(key);
         }
+        getUserData(key) {
+            return this.getItem(key);
+        }
         setItem(key, value) {
             window.sessionStorage.setItem(key, value);
         }
+        async setUserData(key, value) {
+            this.setItem(key, value);
+        }
         removeItem(key) {
             window.sessionStorage.removeItem(key);
         }
@@ -11403,64 +11728,6 @@
         }
     }
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    // Cookie life calculation (hours * minutes * seconds * ms)
-    const COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
-    class CookieStorage {
-        getItem(key) {
-            const name = `${encodeURIComponent(key)}`;
-            const cookieList = document.cookie.split(";");
-            for (let i = 0; i < cookieList.length; i++) {
-                const cookie = cookieList[i];
-                const [key, ...rest] = decodeURIComponent(cookie).trim().split("=");
-                const value = rest.join("=");
-                if (key === name) {
-                    return value;
-                }
-            }
-            return "";
-        }
-        setItem(key, value, cookieLifeDays, secure = true) {
-            let cookieStr = `${encodeURIComponent(key)}=${encodeURIComponent(value)};path=/;SameSite=Lax;`;
-            if (cookieLifeDays) {
-                const expireTime = getCookieExpirationTime(cookieLifeDays);
-                cookieStr += `expires=${expireTime};`;
-            }
-            if (secure) {
-                cookieStr += "Secure;";
-            }
-            document.cookie = cookieStr;
-        }
-        removeItem(key) {
-            // Setting expiration to -1 removes it
-            this.setItem(key, "", -1);
-        }
-        getKeys() {
-            const cookieList = document.cookie.split(";");
-            const keys = [];
-            cookieList.forEach((cookie) => {
-                const cookieParts = decodeURIComponent(cookie).trim().split("=");
-                keys.push(cookieParts[0]);
-            });
-            return keys;
-        }
-        containsKey(key) {
-            return this.getKeys().includes(key);
-        }
-    }
-    /**
-     * Get cookie expiration time
-     * @param cookieLifeDays
-     */
-    function getCookieExpirationTime(cookieLifeDays) {
-        const today = new Date();
-        const expr = new Date(today.getTime() + cookieLifeDays * COOKIE_LIFE_MULTIPLIER);
-        return expr.toUTCString();
-    }
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -11471,7 +11738,7 @@
      * parameters such as state and nonce, generally.
      */
     class BrowserCacheManager extends CacheManager {
-        constructor(clientId, cacheConfig, cryptoImpl, logger, staticAuthorityOptions, performanceClient) {
+        constructor(clientId, cacheConfig, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
             super(clientId, cryptoImpl, logger, staticAuthorityOptions);
             this.cacheConfig = cacheConfig;
             this.logger = logger;
@@ -11479,13 +11746,11 @@
             this.browserStorage = this.setupBrowserStorage(this.cacheConfig.cacheLocation);
             this.temporaryCacheStorage = this.setupBrowserStorage(this.cacheConfig.temporaryCacheLocation);
             this.cookieStorage = new CookieStorage();
-            // Migrate cache entries from older versions of MSAL.
-            if (cacheConfig.cacheMigrationEnabled) {
-                this.migrateCacheEntries();
-                this.createKeyMaps();
-            }
             this.performanceClient = performanceClient;
         }
+        async initialize(correlationId) {
+            await this.browserStorage.initialize(correlationId);
+        }
         /**
          * Returns a window storage class implementing the IWindowStorage interface that corresponds to the configured cacheLocation.
          * @param cacheLocation
@@ -11494,7 +11759,7 @@
             try {
                 switch (cacheLocation) {
                     case BrowserCacheLocation.LocalStorage:
-                        return new LocalStorage();
+                        return new LocalStorage(this.clientId, this.logger, this.performanceClient);
                     case BrowserCacheLocation.SessionStorage:
                         return new SessionStorage();
                     case BrowserCacheLocation.MemoryStorage:
@@ -11508,123 +11773,6 @@
             this.cacheConfig.cacheLocation = BrowserCacheLocation.MemoryStorage;
             return new MemoryStorage();
         }
-        /**
-         * Migrate all old cache entries to new schema. No rollback supported.
-         * @param storeAuthStateInCookie
-         */
-        migrateCacheEntries() {
-            const idTokenKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ID_TOKEN}`;
-            const clientInfoKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.CLIENT_INFO}`;
-            const errorKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ERROR}`;
-            const errorDescKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ERROR_DESC}`;
-            const idTokenValue = this.browserStorage.getItem(idTokenKey);
-            const clientInfoValue = this.browserStorage.getItem(clientInfoKey);
-            const errorValue = this.browserStorage.getItem(errorKey);
-            const errorDescValue = this.browserStorage.getItem(errorDescKey);
-            const values = [
-                idTokenValue,
-                clientInfoValue,
-                errorValue,
-                errorDescValue,
-            ];
-            const keysToMigrate = [
-                PersistentCacheKeys.ID_TOKEN,
-                PersistentCacheKeys.CLIENT_INFO,
-                PersistentCacheKeys.ERROR,
-                PersistentCacheKeys.ERROR_DESC,
-            ];
-            keysToMigrate.forEach((cacheKey, index) => {
-                const value = values[index];
-                if (value) {
-                    this.setTemporaryCache(cacheKey, value, true);
-                }
-            });
-        }
-        /**
-         * Searches all cache entries for MSAL accounts and creates the account key map
-         * This is used to migrate users from older versions of MSAL which did not create the map.
-         * @returns
-         */
-        createKeyMaps() {
-            this.logger.trace("BrowserCacheManager - createKeyMaps called.");
-            const accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
-            const tokenKeys = this.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
-            if (accountKeys && tokenKeys) {
-                this.logger.verbose("BrowserCacheManager:createKeyMaps - account and token key maps already exist, skipping migration.");
-                // Key maps already exist, no need to iterate through cache
-                return;
-            }
-            const allKeys = this.browserStorage.getKeys();
-            allKeys.forEach((key) => {
-                if (this.isCredentialKey(key)) {
-                    // Get item, parse, validate and write key to map
-                    const value = this.getItem(key);
-                    if (value) {
-                        const credObj = this.validateAndParseJson(value);
-                        if (credObj && credObj.hasOwnProperty("credentialType")) {
-                            switch (credObj["credentialType"]) {
-                                case CredentialType.ID_TOKEN:
-                                    if (isIdTokenEntity(credObj)) {
-                                        this.logger.trace("BrowserCacheManager:createKeyMaps - idToken found, saving key to token key map");
-                                        this.logger.tracePii(`BrowserCacheManager:createKeyMaps - idToken with key: ${key} found, saving key to token key map`);
-                                        const idTokenEntity = credObj;
-                                        const newKey = this.updateCredentialCacheKey(key, idTokenEntity);
-                                        this.addTokenKey(newKey, CredentialType.ID_TOKEN);
-                                        return;
-                                    }
-                                    else {
-                                        this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching idToken schema with value containing idToken credentialType field but value failed IdTokenEntity validation, skipping.");
-                                        this.logger.tracePii(`BrowserCacheManager:createKeyMaps - failed idToken validation on key: ${key}`);
-                                    }
-                                    break;
-                                case CredentialType.ACCESS_TOKEN:
-                                case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                                    if (isAccessTokenEntity(credObj)) {
-                                        this.logger.trace("BrowserCacheManager:createKeyMaps - accessToken found, saving key to token key map");
-                                        this.logger.tracePii(`BrowserCacheManager:createKeyMaps - accessToken with key: ${key} found, saving key to token key map`);
-                                        const accessTokenEntity = credObj;
-                                        const newKey = this.updateCredentialCacheKey(key, accessTokenEntity);
-                                        this.addTokenKey(newKey, CredentialType.ACCESS_TOKEN);
-                                        return;
-                                    }
-                                    else {
-                                        this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching accessToken schema with value containing accessToken credentialType field but value failed AccessTokenEntity validation, skipping.");
-                                        this.logger.tracePii(`BrowserCacheManager:createKeyMaps - failed accessToken validation on key: ${key}`);
-                                    }
-                                    break;
-                                case CredentialType.REFRESH_TOKEN:
-                                    if (isRefreshTokenEntity(credObj)) {
-                                        this.logger.trace("BrowserCacheManager:createKeyMaps - refreshToken found, saving key to token key map");
-                                        this.logger.tracePii(`BrowserCacheManager:createKeyMaps - refreshToken with key: ${key} found, saving key to token key map`);
-                                        const refreshTokenEntity = credObj;
-                                        const newKey = this.updateCredentialCacheKey(key, refreshTokenEntity);
-                                        this.addTokenKey(newKey, CredentialType.REFRESH_TOKEN);
-                                        return;
-                                    }
-                                    else {
-                                        this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching refreshToken schema with value containing refreshToken credentialType field but value failed RefreshTokenEntity validation, skipping.");
-                                        this.logger.tracePii(`BrowserCacheManager:createKeyMaps - failed refreshToken validation on key: ${key}`);
-                                    }
-                                    break;
-                                // If credentialType isn't one of our predefined ones, it may not be an MSAL cache value. Ignore.
-                            }
-                        }
-                    }
-                }
-                if (this.isAccountKey(key)) {
-                    const value = this.getItem(key);
-                    if (value) {
-                        const accountObj = this.validateAndParseJson(value);
-                        if (accountObj &&
-                            AccountEntity.isAccountEntity(accountObj)) {
-                            this.logger.trace("BrowserCacheManager:createKeyMaps - account found, saving key to account key map");
-                            this.logger.tracePii(`BrowserCacheManager:createKeyMaps - account with key: ${key} found, saving key to account key map`);
-                            this.addAccountKeyToMap(key);
-                        }
-                    }
-                }
-            });
-        }
         /**
          * Parses passed value as JSON object, JSON.parse() will throw an error.
          * @param input
@@ -11646,38 +11794,15 @@
                 return null;
             }
         }
-        /**
-         * fetches the entry from the browser storage based off the key
-         * @param key
-         */
-        getItem(key) {
-            return this.browserStorage.getItem(key);
-        }
-        /**
-         * sets the entry in the browser storage
-         * @param key
-         * @param value
-         */
-        setItem(key, value) {
-            this.browserStorage.setItem(key, value);
-        }
-        /**
-         * fetch the account entity from the platform cache
-         * @param accountKey
-         */
-        getAccount(accountKey, logger) {
-            this.logger.trace("BrowserCacheManager.getAccount called");
-            const accountEntity = this.getCachedAccountEntity(accountKey);
-            return this.updateOutdatedCachedAccount(accountKey, accountEntity, logger);
-        }
         /**
          * Reads account from cache, deserializes it into an account entity and returns it.
          * If account is not found from the key, returns null and removes key from map.
          * @param accountKey
          * @returns
          */
-        getCachedAccountEntity(accountKey) {
-            const serializedAccount = this.getItem(accountKey);
+        getAccount(accountKey) {
+            this.logger.trace("BrowserCacheManager.getAccount called");
+            const serializedAccount = this.browserStorage.getUserData(accountKey);
             if (!serializedAccount) {
                 this.removeAccountKeyFromMap(accountKey);
                 return null;
@@ -11693,10 +11818,10 @@
          * set account entity in the platform cache
          * @param account
          */
-        setAccount(account) {
+        async setAccount(account, correlationId) {
             this.logger.trace("BrowserCacheManager.setAccount called");
             const key = account.generateAccountKey();
-            this.setItem(key, JSON.stringify(account));
+            await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, JSON.stringify(account), correlationId);
             this.addAccountKeyToMap(key);
         }
         /**
@@ -11704,13 +11829,7 @@
          * @returns
          */
         getAccountKeys() {
-            this.logger.trace("BrowserCacheManager.getAccountKeys called");
-            const accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
-            if (accountKeys) {
-                return JSON.parse(accountKeys);
-            }
-            this.logger.verbose("BrowserCacheManager.getAccountKeys - No account keys found");
-            return [];
+            return getAccountKeys(this.browserStorage);
         }
         /**
          * Add a new account to the key map
@@ -11723,7 +11842,7 @@
             if (accountKeys.indexOf(key) === -1) {
                 // Only add key if it does not already exist in the map
                 accountKeys.push(key);
-                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+                this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
                 this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
             }
             else {
@@ -11741,7 +11860,7 @@
             const removalIndex = accountKeys.indexOf(key);
             if (removalIndex > -1) {
                 accountKeys.splice(removalIndex, 1);
-                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+                this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
                 this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
             }
             else {
@@ -11756,14 +11875,6 @@
             void super.removeAccount(key);
             this.removeAccountKeyFromMap(key);
         }
-        /**
-         * Remove account entity from the platform cache if it's outdated
-         * @param accountKey
-         */
-        removeOutdatedAccount(accountKey) {
-            this.removeItem(accountKey);
-            this.removeAccountKeyFromMap(accountKey);
-        }
         /**
          * Removes given idToken from the cache and from the key map
          * @param key
@@ -11793,28 +11904,7 @@
          * @returns
          */
         getTokenKeys() {
-            this.logger.trace("BrowserCacheManager.getTokenKeys called");
-            const item = this.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
-            if (item) {
-                const tokenKeys = this.validateAndParseJson(item);
-                if (tokenKeys &&
-                    tokenKeys.hasOwnProperty("idToken") &&
-                    tokenKeys.hasOwnProperty("accessToken") &&
-                    tokenKeys.hasOwnProperty("refreshToken")) {
-                    return tokenKeys;
-                }
-                else {
-                    this.logger.error("BrowserCacheManager.getTokenKeys - Token keys found but in an unknown format. Returning empty key map.");
-                }
-            }
-            else {
-                this.logger.verbose("BrowserCacheManager.getTokenKeys - No token keys found");
-            }
-            return {
-                idToken: [],
-                accessToken: [],
-                refreshToken: [],
-            };
+            return getTokenKeys(this.clientId, this.browserStorage);
         }
         /**
          * Adds the given key to the token key map
@@ -11847,7 +11937,7 @@
                     this.logger.error(`BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
                     throw createClientAuthError(unexpectedCredentialType);
             }
-            this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+            this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
         }
         /**
          * Removes the given key from the token key map
@@ -11895,14 +11985,14 @@
                     this.logger.error(`BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
                     throw createClientAuthError(unexpectedCredentialType);
             }
-            this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+            this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
         }
         /**
          * generates idToken entity from a string
          * @param idTokenKey
          */
         getIdTokenCredential(idTokenKey) {
-            const value = this.getItem(idTokenKey);
+            const value = this.browserStorage.getUserData(idTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
                 this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
@@ -11921,10 +12011,10 @@
          * set IdToken credential to the platform cache
          * @param idToken
          */
-        setIdTokenCredential(idToken) {
+        async setIdTokenCredential(idToken, correlationId) {
             this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
             const idTokenKey = generateCredentialKey(idToken);
-            this.setItem(idTokenKey, JSON.stringify(idToken));
+            await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(idTokenKey, JSON.stringify(idToken), correlationId);
             this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
         }
         /**
@@ -11932,7 +12022,7 @@
          * @param key
          */
         getAccessTokenCredential(accessTokenKey) {
-            const value = this.getItem(accessTokenKey);
+            const value = this.browserStorage.getUserData(accessTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
                 this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
@@ -11952,10 +12042,10 @@
          * set accessToken credential to the platform cache
          * @param accessToken
          */
-        setAccessTokenCredential(accessToken) {
+        async setAccessTokenCredential(accessToken, correlationId) {
             this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
             const accessTokenKey = generateCredentialKey(accessToken);
-            this.setItem(accessTokenKey, JSON.stringify(accessToken));
+            await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(accessTokenKey, JSON.stringify(accessToken), correlationId);
             this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
         }
         /**
@@ -11963,7 +12053,7 @@
          * @param refreshTokenKey
          */
         getRefreshTokenCredential(refreshTokenKey) {
-            const value = this.getItem(refreshTokenKey);
+            const value = this.browserStorage.getUserData(refreshTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
                 this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
@@ -11983,10 +12073,10 @@
          * set refreshToken credential to the platform cache
          * @param refreshToken
          */
-        setRefreshTokenCredential(refreshToken) {
+        async setRefreshTokenCredential(refreshToken, correlationId) {
             this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
             const refreshTokenKey = generateCredentialKey(refreshToken);
-            this.setItem(refreshTokenKey, JSON.stringify(refreshToken));
+            await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(refreshTokenKey, JSON.stringify(refreshToken), correlationId);
             this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
         }
         /**
@@ -11994,7 +12084,7 @@
          * @param appMetadataKey
          */
         getAppMetadata(appMetadataKey) {
-            const value = this.getItem(appMetadataKey);
+            const value = this.browserStorage.getItem(appMetadataKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit");
                 return null;
@@ -12015,14 +12105,14 @@
         setAppMetadata(appMetadata) {
             this.logger.trace("BrowserCacheManager.setAppMetadata called");
             const appMetadataKey = generateAppMetadataKey(appMetadata);
-            this.setItem(appMetadataKey, JSON.stringify(appMetadata));
+            this.browserStorage.setItem(appMetadataKey, JSON.stringify(appMetadata));
         }
         /**
          * fetch server telemetry entity from the platform cache
          * @param serverTelemetryKey
          */
         getServerTelemetry(serverTelemetryKey) {
-            const value = this.getItem(serverTelemetryKey);
+            const value = this.browserStorage.getItem(serverTelemetryKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit");
                 return null;
@@ -12043,7 +12133,7 @@
          */
         setServerTelemetry(serverTelemetryKey, serverTelemetry) {
             this.logger.trace("BrowserCacheManager.setServerTelemetry called");
-            this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry));
+            this.browserStorage.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry));
         }
         /**
          *
@@ -12103,25 +12193,9 @@
          */
         getActiveAccount() {
             const activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
-            const activeAccountValueFilters = this.getItem(activeAccountKeyFilters);
+            const activeAccountValueFilters = this.browserStorage.getItem(activeAccountKeyFilters);
             if (!activeAccountValueFilters) {
-                // if new active account cache type isn't found, it's an old version, so look for that instead
-                this.logger.trace("BrowserCacheManager.getActiveAccount: No active account filters cache schema found, looking for legacy schema");
-                const activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
-                const activeAccountValueLocal = this.getItem(activeAccountKeyLocal);
-                if (!activeAccountValueLocal) {
-                    this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found");
-                    return null;
-                }
-                const activeAccount = this.getAccountInfoFilteredBy({
-                    localAccountId: activeAccountValueLocal,
-                });
-                if (activeAccount) {
-                    this.logger.trace("BrowserCacheManager.getActiveAccount: Legacy active account cache schema found");
-                    this.logger.trace("BrowserCacheManager.getActiveAccount: Adding active account filters cache schema");
-                    this.setActiveAccount(activeAccount);
-                    return activeAccount;
-                }
+                this.logger.trace("BrowserCacheManager.getActiveAccount: No active account filters found");
                 return null;
             }
             const activeAccountValueObj = this.validateAndParseJson(activeAccountValueFilters);
@@ -12142,7 +12216,6 @@
          */
         setActiveAccount(account) {
             const activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
-            const activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
             if (account) {
                 this.logger.verbose("setActiveAccount: Active account set");
                 const activeAccountValue = {
@@ -12151,12 +12224,10 @@
                     tenantId: account.tenantId,
                 };
                 this.browserStorage.setItem(activeAccountKey, JSON.stringify(activeAccountValue));
-                this.browserStorage.setItem(activeAccountKeyLocal, account.localAccountId);
             }
             else {
                 this.logger.verbose("setActiveAccount: No account passed, active account not set");
                 this.browserStorage.removeItem(activeAccountKey);
-                this.browserStorage.removeItem(activeAccountKeyLocal);
             }
         }
         /**
@@ -12164,7 +12235,7 @@
          * @param throttlingCacheKey
          */
         getThrottlingCache(throttlingCacheKey) {
-            const value = this.getItem(throttlingCacheKey);
+            const value = this.browserStorage.getItem(throttlingCacheKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit");
                 return null;
@@ -12185,7 +12256,7 @@
          */
         setThrottlingCache(throttlingCacheKey, throttlingCache) {
             this.logger.trace("BrowserCacheManager.setThrottlingCache called");
-            this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache));
+            this.browserStorage.setItem(throttlingCacheKey, JSON.stringify(throttlingCache));
         }
         /**
          * Gets cache item with given key.
@@ -12313,8 +12384,7 @@
         generateCacheKey(key) {
             const generatedKey = this.validateAndParseJson(key);
             if (!generatedKey) {
-                if (StringUtils.startsWith(key, Constants.CACHE_PREFIX) ||
-                    StringUtils.startsWith(key, PersistentCacheKeys.ADAL_ID_TOKEN)) {
+                if (StringUtils.startsWith(key, Constants.CACHE_PREFIX)) {
                     return key;
                 }
                 return `${Constants.CACHE_PREFIX}.${this.clientId}.${key}`;
@@ -12540,59 +12610,6 @@
                 this.removeTemporaryItem(key);
             }
         }
-        /**
-         * Returns username retrieved from ADAL or MSAL v1 idToken
-         * @deprecated
-         */
-        getLegacyLoginHint() {
-            // Only check for adal/msal token if no SSO params are being used
-            const adalIdTokenString = this.getTemporaryCache(PersistentCacheKeys.ADAL_ID_TOKEN);
-            if (adalIdTokenString) {
-                this.browserStorage.removeItem(PersistentCacheKeys.ADAL_ID_TOKEN);
-                this.logger.verbose("Cached ADAL id token retrieved.");
-            }
-            // Check for cached MSAL v1 id token
-            const msalIdTokenString = this.getTemporaryCache(PersistentCacheKeys.ID_TOKEN, true);
-            if (msalIdTokenString) {
-                this.browserStorage.removeItem(this.generateCacheKey(PersistentCacheKeys.ID_TOKEN));
-                this.logger.verbose("Cached MSAL.js v1 id token retrieved");
-            }
-            const cachedIdTokenString = msalIdTokenString || adalIdTokenString;
-            if (cachedIdTokenString) {
-                const idTokenClaims = extractTokenClaims(cachedIdTokenString, base64Decode);
-                if (idTokenClaims.preferred_username) {
-                    this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 preferred_username as loginHint");
-                    return idTokenClaims.preferred_username;
-                }
-                else if (idTokenClaims.upn) {
-                    this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 upn as loginHint");
-                    return idTokenClaims.upn;
-                }
-                else {
-                    this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, however, no account hint claim found. Enable preferred_username or upn id token claim to get SSO.");
-                }
-            }
-            return null;
-        }
-        /**
-         * Updates a credential's cache key if the current cache key is outdated
-         */
-        updateCredentialCacheKey(currentCacheKey, credential) {
-            const updatedCacheKey = generateCredentialKey(credential);
-            if (currentCacheKey !== updatedCacheKey) {
-                const cacheItem = this.getItem(currentCacheKey);
-                if (cacheItem) {
-                    this.browserStorage.removeItem(currentCacheKey);
-                    this.setItem(updatedCacheKey, cacheItem);
-                    this.logger.verbose(`Updated an outdated ${credential.credentialType} cache key`);
-                    return updatedCacheKey;
-                }
-                else {
-                    this.logger.error(`Attempted to update an outdated ${credential.credentialType} cache key but no item matching the outdated key was found in storage`);
-                }
-            }
-            return currentCacheKey;
-        }
         /**
          * Builds credential entities from AuthenticationResult object and saves the resulting credentials to the cache
          * @param result
@@ -12618,7 +12635,7 @@
                 idToken: idTokenEntity,
                 accessToken: accessTokenEntity,
             };
-            return this.saveCacheRecord(cacheRecord);
+            return this.saveCacheRecord(cacheRecord, result.correlationId);
         }
         /**
          * saves a cache record
@@ -12626,9 +12643,9 @@
          * @param storeInCache {?StoreInCache}
          * @param correlationId {?string} correlation id
          */
-        async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+        async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
             try {
-                await super.saveCacheRecord(cacheRecord, storeInCache, correlationId);
+                await super.saveCacheRecord(cacheRecord, correlationId, storeInCache);
             }
             catch (e) {
                 if (e instanceof CacheError &&
@@ -12648,7 +12665,7 @@
             }
         }
     }
-    const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger) => {
+    const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient) => {
         const cacheOptions = {
             cacheLocation: BrowserCacheLocation.MemoryStorage,
             temporaryCacheLocation: BrowserCacheLocation.MemoryStorage,
@@ -12657,7 +12674,7 @@
             cacheMigrationEnabled: false,
             claimsBasedCachingEnabled: false,
         };
-        return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger);
+        return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger, performanceClient);
     };
 
     /*
@@ -13319,13 +13336,6 @@
                 this.logger.verbosePii(`Setting validated request account: ${account.homeAccountId}`, this.correlationId);
                 validatedRequest.account = account;
             }
-            // Check for ADAL/MSAL v1 SSO
-            if (!validatedRequest.loginHint && !account) {
-                const legacyLoginHint = this.browserStorage.getLegacyLoginHint();
-                if (legacyLoginHint) {
-                    validatedRequest.loginHint = legacyLoginHint;
-                }
-            }
             return validatedRequest;
         }
     }
@@ -13729,8 +13739,8 @@
             // generate authenticationResult
             const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
             // cache accounts and tokens in the appropriate storage
-            this.cacheAccount(baseAccount);
-            this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
+            await this.cacheAccount(baseAccount);
+            await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
             return result;
         }
         /**
@@ -13854,9 +13864,9 @@
          * cache the account entity in browser storage
          * @param accountEntity
          */
-        cacheAccount(accountEntity) {
+        async cacheAccount(accountEntity) {
             // Store the account info and hence `nativeAccountId` in browser cache
-            this.browserStorage.setAccount(accountEntity);
+            await this.browserStorage.setAccount(accountEntity, this.correlationId);
             // Remove any existing cached tokens for this account in browser storage
             this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
                 this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
@@ -13887,7 +13897,7 @@
                 idToken: cachedIdToken,
                 accessToken: cachedAccessToken,
             };
-            void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
+            return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, request.storeInCache);
         }
         addTelemetryFromNativeResponse(response) {
             const mats = this.getMATSFromResponse(response);
@@ -14322,15 +14332,15 @@
          * @param nativeExtensionProvider
          * @param authenticationScheme
          */
-        static isNativeAvailable(config, logger, nativeExtensionProvider, authenticationScheme) {
-            logger.trace("isNativeAvailable called");
-            if (!config.system.allowNativeBroker) {
-                logger.trace("isNativeAvailable: allowNativeBroker is not enabled, returning false");
+        static isPlatformBrokerAvailable(config, logger, nativeExtensionProvider, authenticationScheme) {
+            logger.trace("isPlatformBrokerAvailable called");
+            if (!config.system.allowPlatformBroker) {
+                logger.trace("isPlatformBrokerAvailable: allowPlatformBroker is not enabled, returning false");
                 // Developer disabled WAM
                 return false;
             }
             if (!nativeExtensionProvider) {
-                logger.trace("isNativeAvailable: WAM extension provider is not initialized, returning false");
+                logger.trace("isPlatformBrokerAvailable: Platform extension provider is not initialized, returning false");
                 // Extension is not available
                 return false;
             }
@@ -14338,10 +14348,10 @@
                 switch (authenticationScheme) {
                     case AuthenticationScheme.BEARER:
                     case AuthenticationScheme.POP:
-                        logger.trace("isNativeAvailable: authenticationScheme is supported, returning true");
+                        logger.trace("isPlatformBrokerAvailable: authenticationScheme is supported, returning true");
                         return true;
                     default:
-                        logger.trace("isNativeAvailable: authenticationScheme is not supported, returning false");
+                        logger.trace("isPlatformBrokerAvailable: authenticationScheme is not supported, returning false");
                         return false;
                 }
             }
@@ -14578,17 +14588,17 @@
                     requestExtraQueryParameters: validRequest.extraQueryParameters,
                     account: validRequest.account,
                 });
-                const isNativeBroker = NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
+                const isPlatformBroker = NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
                 // Start measurement for server calls with native brokering enabled
                 let fetchNativeAccountIdMeasurement;
-                if (isNativeBroker) {
+                if (isPlatformBroker) {
                     fetchNativeAccountIdMeasurement =
                         this.performanceClient.startMeasurement(PerformanceEvents.FetchAccountIdWithNativeBroker, request.correlationId);
                 }
                 // Create acquire token url.
                 const navigateUrl = await authClient.getAuthCodeUrl({
                     ...validRequest,
-                    nativeBroker: isNativeBroker,
+                    platformBroker: isPlatformBroker,
                 });
                 // Create popup interaction handler.
                 const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
@@ -15105,7 +15115,7 @@
                 // Create acquire token url.
                 const navigateUrl = await authClient.getAuthCodeUrl({
                     ...validRequest,
-                    nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme),
+                    platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme),
                 });
                 const redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
                 this.logger.verbosePii(`Redirect start page: ${redirectStartPage}`);
@@ -15619,7 +15629,7 @@
             // Create authorize request url
             const navigateUrl = await invokeAsync(authClient.getAuthCodeUrl.bind(authClient), PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)({
                 ...silentRequest,
-                nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme),
+                platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme),
             });
             // Create silent handler
             const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
@@ -15734,10 +15744,11 @@
          * @param options
          * @returns `AuthenticationResult` for the response that was loaded.
          */
-        loadExternalTokens(request, response, options) {
+        async loadExternalTokens(request, response, options) {
             if (!this.isBrowserEnvironment) {
                 throw createBrowserAuthError(nonBrowserEnvironment);
             }
+            const correlationId = request.correlationId || createNewGuid();
             const idTokenClaims = response.id_token
                 ? extractTokenClaims(response.id_token, base64Decode)
                 : undefined;
@@ -15751,10 +15762,10 @@
             const authority = request.authority
                 ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
                 : undefined;
-            const cacheRecordAccount = this.loadAccount(request, options.clientInfo || response.client_info || "", idTokenClaims, authority);
-            const idToken = this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm);
-            const accessToken = this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options);
-            const refreshToken = this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment);
+            const cacheRecordAccount = await this.loadAccount(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
+            const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId);
+            const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId);
+            const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId);
             return this.generateAuthenticationResult(request, {
                 account: cacheRecordAccount,
                 idToken,
@@ -15771,11 +15782,11 @@
          * @param requestHomeAccountId
          * @returns `AccountEntity`
          */
-        loadAccount(request, clientInfo, idTokenClaims, authority) {
+        async loadAccount(request, clientInfo, correlationId, idTokenClaims, authority) {
             this.logger.verbose("TokenCache - loading account");
             if (request.account) {
                 const accountEntity = AccountEntity.createFromAccountInfo(request.account);
-                this.storage.setAccount(accountEntity);
+                await this.storage.setAccount(accountEntity, correlationId);
                 return accountEntity;
             }
             else if (!authority || (!clientInfo && !idTokenClaims)) {
@@ -15787,7 +15798,7 @@
             const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
             undefined, // nativeAccountId
             this.logger);
-            this.storage.setAccount(cachedAccount);
+            await this.storage.setAccount(cachedAccount, correlationId);
             return cachedAccount;
         }
         /**
@@ -15798,14 +15809,14 @@
          * @param tenantId
          * @returns `IdTokenEntity`
          */
-        loadIdToken(response, homeAccountId, environment, tenantId) {
+        async loadIdToken(response, homeAccountId, environment, tenantId, correlationId) {
             if (!response.id_token) {
                 this.logger.verbose("TokenCache - no id token found in response");
                 return null;
             }
             this.logger.verbose("TokenCache - loading id token");
             const idTokenEntity = createIdTokenEntity(homeAccountId, environment, response.id_token, this.config.auth.clientId, tenantId);
-            this.storage.setIdTokenCredential(idTokenEntity);
+            await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
             return idTokenEntity;
         }
         /**
@@ -15817,7 +15828,7 @@
          * @param tenantId
          * @returns `AccessTokenEntity`
          */
-        loadAccessToken(request, response, homeAccountId, environment, tenantId, options) {
+        async loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId) {
             if (!response.access_token) {
                 this.logger.verbose("TokenCache - no access token found in response");
                 return null;
@@ -15841,7 +15852,7 @@
                 (response.ext_expires_in || response.expires_in) +
                     new Date().getTime() / 1000;
             const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
-            this.storage.setAccessTokenCredential(accessTokenEntity);
+            await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
             return accessTokenEntity;
         }
         /**
@@ -15852,7 +15863,7 @@
          * @param environment
          * @returns `RefreshTokenEntity`
          */
-        loadRefreshToken(response, homeAccountId, environment) {
+        async loadRefreshToken(response, homeAccountId, environment, correlationId) {
             if (!response.refresh_token) {
                 this.logger.verbose("TokenCache - no refresh token found in response");
                 return null;
@@ -15860,7 +15871,7 @@
             this.logger.verbose("TokenCache - loading refresh token");
             const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
             response.refresh_token_expires_in);
-            this.storage.setRefreshTokenCredential(refreshTokenEntity);
+            await this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId);
             return refreshTokenEntity;
         }
         /**
@@ -16056,8 +16067,8 @@
             this.eventHandler = new EventHandler(this.logger);
             // Initialize the browser storage class.
             this.browserStorage = this.isBrowserEnvironment
-                ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, buildStaticAuthorityOptions(this.config.auth), this.performanceClient)
-                : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
+                ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, this.performanceClient, buildStaticAuthorityOptions(this.config.auth))
+                : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger, this.performanceClient);
             // initialize in memory storage for native flows
             const nativeCacheOptions = {
                 cacheLocation: BrowserCacheLocation.MemoryStorage,
@@ -16067,7 +16078,7 @@
                 cacheMigrationEnabled: false,
                 claimsBasedCachingEnabled: false,
             };
-            this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, undefined, this.performanceClient);
+            this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient);
             // Initialize the token cache
             this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto);
             this.activeSilentTokenRequests = new Map();
@@ -16110,10 +16121,11 @@
                 return;
             }
             const initCorrelationId = request?.correlationId || this.getRequestCorrelationId();
-            const allowNativeBroker = this.config.system.allowNativeBroker;
+            const allowPlatformBroker = this.config.system.allowPlatformBroker;
             const initMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.InitializeClientApplication, initCorrelationId);
             this.eventHandler.emitEvent(EventType.INITIALIZE_START);
-            if (allowNativeBroker) {
+            await invokeAsync(this.browserStorage.initialize.bind(this.browserStorage), PerformanceEvents.InitializeCache, this.logger, this.performanceClient, initCorrelationId)(initCorrelationId);
+            if (allowPlatformBroker) {
                 try {
                     this.nativeExtensionProvider =
                         await NativeMessageHandler.createProvider(this.logger, this.config.system.nativeBrokerHandshakeTimeout, this.performanceClient);
@@ -16128,7 +16140,10 @@
             }
             this.initialized = true;
             this.eventHandler.emitEvent(EventType.INITIALIZE_END);
-            initMeasurement.end({ allowNativeBroker, success: true });
+            initMeasurement.end({
+                allowPlatformBroker: allowPlatformBroker,
+                success: true,
+            });
         }
         // #region Redirect Flow
         /**
@@ -16172,7 +16187,7 @@
             const loggedInAccounts = this.getAllAccounts();
             const request = this.browserStorage.getCachedNativeRequest();
             const useNative = request &&
-                NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
+                NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
                 this.nativeExtensionProvider &&
                 !hash;
             const correlationId = useNative
@@ -16301,7 +16316,8 @@
                     this.eventHandler.emitEvent(EventType.LOGIN_START, exports.InteractionType.Redirect, request);
                 }
                 let result;
-                if (this.nativeExtensionProvider && this.canUseNative(request)) {
+                if (this.nativeExtensionProvider &&
+                    this.canUsePlatformBroker(request)) {
                     const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
                     result = nativeClient
                         .acquireTokenRedirect(request, atrMeasurement)
@@ -16372,7 +16388,7 @@
                 this.eventHandler.emitEvent(EventType.LOGIN_START, exports.InteractionType.Popup, request);
             }
             let result;
-            if (this.canUseNative(request)) {
+            if (this.canUsePlatformBroker(request)) {
                 result = this.acquireTokenNative({
                     ...request,
                     correlationId,
@@ -16489,7 +16505,7 @@
             this.logger.verbose("ssoSilent called", correlationId);
             this.eventHandler.emitEvent(EventType.SSO_SILENT_START, exports.InteractionType.Silent, validRequest);
             let result;
-            if (this.canUseNative(validRequest)) {
+            if (this.canUsePlatformBroker(validRequest)) {
                 result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
                     // If native token acquisition fails for availability reasons fallback to standard flow
                     if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
@@ -16587,7 +16603,7 @@
                     return await response;
                 }
                 else if (request.nativeAccountId) {
-                    if (this.canUseNative(request, request.nativeAccountId)) {
+                    if (this.canUsePlatformBroker(request, request.nativeAccountId)) {
                         const result = await this.acquireTokenNative({
                             ...request,
                             correlationId,
@@ -16834,7 +16850,7 @@
             this.logger.verbose("hydrateCache called");
             // Account gets saved to browser storage regardless of native or not
             const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-            this.browserStorage.setAccount(accountEntity);
+            await this.browserStorage.setAccount(accountEntity, result.correlationId);
             if (result.fromNativeBroker) {
                 this.logger.verbose("Response was from native broker, storing in-memory");
                 // Tokens from native broker are stored in-memory
@@ -16858,13 +16874,13 @@
             return nativeClient.acquireToken(request);
         }
         /**
-         * Returns boolean indicating if this request can use the native broker
+         * Returns boolean indicating if this request can use the platform broker
          * @param request
          */
-        canUseNative(request, accountId) {
-            this.logger.trace("canUseNative called");
-            if (!NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme)) {
-                this.logger.trace("canUseNative: isNativeAvailable returned false, returning false");
+        canUsePlatformBroker(request, accountId) {
+            this.logger.trace("canUsePlatformBroker called");
+            if (!NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme)) {
+                this.logger.trace("canUsePlatformBroker: isPlatformBrokerAvailable returned false, returning false");
                 return false;
             }
             if (request.prompt) {
@@ -16872,15 +16888,15 @@
                     case PromptValue.NONE:
                     case PromptValue.CONSENT:
                     case PromptValue.LOGIN:
-                        this.logger.trace("canUseNative: prompt is compatible with native flow");
+                        this.logger.trace("canUsePlatformBroker: prompt is compatible with platform broker flow");
                         break;
                     default:
-                        this.logger.trace(`canUseNative: prompt = ${request.prompt} is not compatible with native flow, returning false`);
+                        this.logger.trace(`canUsePlatformBroker: prompt = ${request.prompt} is not compatible with platform broker flow, returning false`);
                         return false;
                 }
             }
             if (!accountId && !this.getNativeAccountId(request)) {
-                this.logger.trace("canUseNative: nativeAccountId is not available, returning false");
+                this.logger.trace("canUsePlatformBroker: nativeAccountId is not available, returning false");
                 return false;
             }
             return true;
@@ -17321,7 +17337,7 @@
          * @returns
          */
         async acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy) {
-            if (NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, silentRequest.authenticationScheme) &&
+            if (NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider, silentRequest.authenticationScheme) &&
                 silentRequest.account.nativeAccountId) {
                 this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
                 return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(async (e) => {
@@ -17611,8 +17627,8 @@
                 : DEFAULT_CRYPTO_IMPLEMENTATION;
             // Initialize the browser storage class.
             this.browserStorage = this.operatingContext.isBrowserEnvironment()
-                ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, buildStaticAuthorityOptions(this.config.auth))
-                : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
+                ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, this.performanceClient, buildStaticAuthorityOptions(this.config.auth))
+                : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger, this.performanceClient);
             this.eventHandler = new EventHandler(this.logger);
             this.nestedAppAuthAdapter = new NestedAppAuthAdapter(this.config.auth.clientId, this.config.auth.clientCapabilities, this.browserCrypto, this.logger);
             // Set the active account if available
@@ -17635,8 +17651,9 @@
          * Specific implementation of initialize function for NestedAppAuthController
          * @returns
          */
-        initialize() {
-            // do nothing not required by this controller
+        async initialize(request) {
+            const initCorrelationId = request?.correlationId || createNewGuid();
+            await this.browserStorage.initialize(initCorrelationId);
             return Promise.resolve();
         }
         /**
@@ -18062,7 +18079,7 @@
         async hydrateCache(result, request) {
             this.logger.verbose("hydrateCache called");
             const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-            this.browserStorage.setAccount(accountEntity);
+            await this.browserStorage.setAccount(accountEntity, result.correlationId);
             return this.browserStorage.hydrateCache(result, request);
         }
     }
@@ -18494,8 +18511,8 @@
                 : DEFAULT_CRYPTO_IMPLEMENTATION;
             // Initialize the browser storage class.
             this.browserStorage = this.isBrowserEnvironment
-                ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, undefined, this.performanceClient)
-                : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
+                ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, this.performanceClient, undefined)
+                : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger, this.performanceClient);
         }
         getBrowserStorage() {
             return this.browserStorage;
@@ -19220,42 +19237,6 @@
         },
     };
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * @deprecated This class will be removed in a future major version
-     */
-    class BrowserStorage {
-        constructor(cacheLocation) {
-            if (cacheLocation === BrowserCacheLocation.LocalStorage) {
-                this.windowStorage = new LocalStorage();
-            }
-            else if (cacheLocation === BrowserCacheLocation.SessionStorage) {
-                this.windowStorage = new SessionStorage();
-            }
-            else {
-                throw createBrowserConfigurationAuthError(storageNotSupported);
-            }
-        }
-        getItem(key) {
-            return this.windowStorage.getItem(key);
-        }
-        setItem(key, value) {
-            this.windowStorage.setItem(key, value);
-        }
-        removeItem(key) {
-            this.windowStorage.removeItem(key);
-        }
-        getKeys() {
-            return Object.keys(this.windowStorage);
-        }
-        containsKey(key) {
-            return this.windowStorage.hasOwnProperty(key);
-        }
-    }
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -19643,7 +19624,6 @@
     exports.BrowserConfigurationAuthErrorMessage = BrowserConfigurationAuthErrorMessage;
     exports.BrowserPerformanceClient = BrowserPerformanceClient;
     exports.BrowserPerformanceMeasurement = BrowserPerformanceMeasurement;
-    exports.BrowserStorage = BrowserStorage;
     exports.BrowserUtils = BrowserUtils;
     exports.CacheLookupPolicy = CacheLookupPolicy;
     exports.ClientAuthError = ClientAuthError;