@azure/msal-browser 3.28.1 → 4.0.1

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.28.1 2025-01-14 */
+/*! @azure/msal-browser v4.0.1 2025-01-15 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -109,12 +109,6 @@ const HeaderNames = {
  * Persistent cache keys MSAL which stay while user is logged in.
  */
 const PersistentCacheKeys = {
-    ID_TOKEN: "idtoken",
-    CLIENT_INFO: "client.info",
-    ADAL_ID_TOKEN: "adal.idtoken",
-    ERROR: "error",
-    ERROR_DESC: "error.description",
-    ACTIVE_ACCOUNT: "active-account",
     ACTIVE_ACCOUNT_FILTERS: "active-account-filters", // new cache entry for active_account for a more robust version for browser
 };
 /**
@@ -312,7 +306,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -329,7 +323,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -378,7 +372,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -476,7 +470,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -728,7 +722,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -767,7 +761,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -958,12 +952,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.16.0";
+const version$1 = "15.0.1";
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -983,7 +977,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1044,7 +1038,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1081,7 +1075,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1408,7 +1402,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1433,14 +1427,14 @@ const missingSshKid = "missing_ssh_kid";
 const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
 const invalidAuthenticationHeader = "invalid_authentication_header";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
-const cannotAllowNativeBroker = "cannot_allow_native_broker";
+const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
 
 var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
     authorityMismatch: authorityMismatch,
     authorityUriInsecure: authorityUriInsecure,
-    cannotAllowNativeBroker: cannotAllowNativeBroker,
+    cannotAllowPlatformBroker: cannotAllowPlatformBroker,
     cannotSetOIDCOptions: cannotSetOIDCOptions,
     claimsRequestParsingError: claimsRequestParsingError,
     emptyInputScopesError: emptyInputScopesError,
@@ -1462,7 +1456,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1489,7 +1483,7 @@ const ClientConfigurationErrorMessages = {
     [missingNonceAuthenticationHeader]: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",
     [invalidAuthenticationHeader]: "Invalid authentication header provided",
     [cannotSetOIDCOptions]: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
-    [cannotAllowNativeBroker]: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
+    [cannotAllowPlatformBroker]: "Cannot set allowPlatformBroker parameter to true when not in AAD protocol mode.",
     [authorityMismatch]: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
 };
 /**
@@ -1577,9 +1571,9 @@ const ClientConfigurationErrorMessage = {
         code: cannotSetOIDCOptions,
         desc: ClientConfigurationErrorMessages[cannotSetOIDCOptions],
     },
-    cannotAllowNativeBroker: {
-        code: cannotAllowNativeBroker,
-        desc: ClientConfigurationErrorMessages[cannotAllowNativeBroker],
+    cannotAllowPlatformBroker: {
+        code: cannotAllowPlatformBroker,
+        desc: ClientConfigurationErrorMessages[cannotAllowPlatformBroker],
     },
     authorityMismatch: {
         code: authorityMismatch,
@@ -1600,7 +1594,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1697,7 +1691,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1897,7 +1891,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1937,7 +1931,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2016,7 +2010,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2031,7 +2025,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2053,7 +2047,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2066,7 +2060,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2309,7 +2303,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2356,7 +2350,7 @@ function getDeserializedResponse(responseString) {
     return null;
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2520,7 +2514,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2660,7 +2654,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2668,7 +2662,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
 const cacheUnknownErrorCode = "cache_error_unknown";
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2695,7 +2689,7 @@ class CacheError extends Error {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2860,24 +2854,24 @@ class CacheManager {
      * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
         if (!cacheRecord) {
             throw createClientAuthError(invalidCacheRecord);
         }
         try {
             if (!!cacheRecord.account) {
-                this.setAccount(cacheRecord.account);
+                await this.setAccount(cacheRecord.account, correlationId);
             }
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                this.setIdTokenCredential(cacheRecord.idToken);
+                await this.setIdTokenCredential(cacheRecord.idToken, correlationId);
             }
             if (!!cacheRecord.accessToken &&
                 storeInCache?.accessToken !== false) {
-                await this.saveAccessToken(cacheRecord.accessToken);
+                await this.saveAccessToken(cacheRecord.accessToken, correlationId);
             }
             if (!!cacheRecord.refreshToken &&
                 storeInCache?.refreshToken !== false) {
-                this.setRefreshTokenCredential(cacheRecord.refreshToken);
+                await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
             }
             if (!!cacheRecord.appMetadata) {
                 this.setAppMetadata(cacheRecord.appMetadata);
@@ -2907,7 +2901,7 @@ class CacheManager {
      * saves access token credential
      * @param credential
      */
-    async saveAccessToken(credential) {
+    async saveAccessToken(credential, correlationId) {
         const accessTokenFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -2934,7 +2928,7 @@ class CacheManager {
             }
         });
         await Promise.all(removedAccessTokens);
-        this.setAccessTokenCredential(credential);
+        await this.setAccessTokenCredential(credential, correlationId);
     }
     /**
      * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
@@ -3220,61 +3214,6 @@ class CacheManager {
         });
         await Promise.all(removedCredentials);
     }
-    /**
-     * Migrates a single-tenant account and all it's associated alternate cross-tenant account objects in the
-     * cache into a condensed multi-tenant account object with tenant profiles.
-     * @param accountKey
-     * @param accountEntity
-     * @param logger
-     * @returns
-     */
-    updateOutdatedCachedAccount(accountKey, accountEntity, logger) {
-        // Only update if account entity is defined and has no tenantProfiles object (is outdated)
-        if (accountEntity && accountEntity.isSingleTenant()) {
-            this.commonLogger?.verbose("updateOutdatedCachedAccount: Found a single-tenant (outdated) account entity in the cache, migrating to multi-tenant account entity");
-            // Get keys of all accounts belonging to user
-            const matchingAccountKeys = this.getAccountKeys().filter((key) => {
-                return key.startsWith(accountEntity.homeAccountId);
-            });
-            // Get all account entities belonging to user
-            const accountsToMerge = [];
-            matchingAccountKeys.forEach((key) => {
-                const account = this.getCachedAccountEntity(key);
-                if (account) {
-                    accountsToMerge.push(account);
-                }
-            });
-            // Set base account to home account if available, any account if not
-            const baseAccount = accountsToMerge.find((account) => {
-                return tenantIdMatchesHomeTenant(account.realm, account.homeAccountId);
-            }) || accountsToMerge[0];
-            // Populate tenant profiles built from each account entity belonging to the user
-            baseAccount.tenantProfiles = accountsToMerge.map((account) => {
-                return {
-                    tenantId: account.realm,
-                    localAccountId: account.localAccountId,
-                    name: account.name,
-                    isHomeTenant: tenantIdMatchesHomeTenant(account.realm, account.homeAccountId),
-                };
-            });
-            const updatedAccount = CacheManager.toObject(new AccountEntity(), {
-                ...baseAccount,
-            });
-            const newAccountKey = updatedAccount.generateAccountKey();
-            // Clear cache of legacy account objects that have been collpsed into tenant profiles
-            matchingAccountKeys.forEach((key) => {
-                if (key !== newAccountKey) {
-                    this.removeOutdatedAccount(accountKey);
-                }
-            });
-            // Cache updated account object
-            this.setAccount(updatedAccount);
-            logger?.verbose("Updated an outdated account entity in the cache");
-            return updatedAccount;
-        }
-        // No update is necessary
-        return accountEntity;
-    }
     /**
      * returns a boolean if the given credential is removed
      * @param credential
@@ -3870,28 +3809,25 @@ class CacheManager {
 }
 /** @internal */
 class DefaultStorageClass extends CacheManager {
-    setAccount() {
+    async setAccount() {
         throw createClientAuthError(methodNotImplemented);
     }
     getAccount() {
         throw createClientAuthError(methodNotImplemented);
     }
-    getCachedAccountEntity() {
-        throw createClientAuthError(methodNotImplemented);
-    }
-    setIdTokenCredential() {
+    async setIdTokenCredential() {
         throw createClientAuthError(methodNotImplemented);
     }
     getIdTokenCredential() {
         throw createClientAuthError(methodNotImplemented);
     }
-    setAccessTokenCredential() {
+    async setAccessTokenCredential() {
         throw createClientAuthError(methodNotImplemented);
     }
     getAccessTokenCredential() {
         throw createClientAuthError(methodNotImplemented);
     }
-    setRefreshTokenCredential() {
+    async setRefreshTokenCredential() {
         throw createClientAuthError(methodNotImplemented);
     }
     getRefreshTokenCredential() {
@@ -3936,15 +3872,9 @@ class DefaultStorageClass extends CacheManager {
     getTokenKeys() {
         throw createClientAuthError(methodNotImplemented);
     }
-    updateCredentialCacheKey() {
-        throw createClientAuthError(methodNotImplemented);
-    }
-    removeOutdatedAccount() {
-        throw createClientAuthError(methodNotImplemented);
-    }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4043,7 +3973,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4053,7 +3983,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4103,7 +4033,7 @@ const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
 const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4170,7 +4100,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4578,7 +4508,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4590,7 +4520,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4600,7 +4530,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4610,7 +4540,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4768,6 +4698,7 @@ const PerformanceEvents = {
      */
     InitializeSilentRequest: "initializeSilentRequest",
     InitializeClientApplication: "initializeClientApplication",
+    InitializeCache: "initializeCache",
     /**
      * Helper function in SilentIframeClient class (msal-browser).
      */
@@ -4845,6 +4776,8 @@ const PerformanceEvents = {
      */
     ClearTokensAndKeysWithClaims: "clearTokensAndKeysWithClaims",
     CacheManagerGetRefreshToken: "cacheManagerGetRefreshToken",
+    ImportExistingCache: "importExistingCache",
+    SetUserData: "setUserData",
     /**
      * Crypto Operations
      */
@@ -4853,6 +4786,12 @@ const PerformanceEvents = {
     GenerateCodeChallengeFromVerifier: "generateCodeChallengeFromVerifier",
     Sha256Digest: "sha256Digest",
     GetRandomValues: "getRandomValues",
+    GenerateHKDF: "generateHKDF",
+    GenerateBaseKey: "generateBaseKey",
+    Base64Decode: "base64Decode",
+    UrlEncodeArr: "urlEncodeArr",
+    Encrypt: "encrypt",
+    Decrypt: "decrypt",
 };
 const PerformanceEventAbbreviations = new Map([
     [PerformanceEvents.AcquireTokenByCode, "ATByCode"],
@@ -4937,6 +4876,9 @@ const PerformanceEventAbbreviations = new Map([
         PerformanceEvents.InitializeClientApplication,
         "InitClientApplication",
     ],
+    [PerformanceEvents.InitializeCache, "InitCache"],
+    [PerformanceEvents.ImportExistingCache, "importCache"],
+    [PerformanceEvents.SetUserData, "setUserData"],
     [PerformanceEvents.SilentIframeClientTokenHelper, "SIClientTHelper"],
     [
         PerformanceEvents.SilentHandlerInitiateAuthRequest,
@@ -5070,6 +5012,12 @@ const PerformanceEventAbbreviations = new Map([
     ],
     [PerformanceEvents.Sha256Digest, "Sha256Digest"],
     [PerformanceEvents.GetRandomValues, "GetRandomValues"],
+    [PerformanceEvents.GenerateHKDF, "genHKDF"],
+    [PerformanceEvents.GenerateBaseKey, "genBaseKey"],
+    [PerformanceEvents.Base64Decode, "b64Decode"],
+    [PerformanceEvents.UrlEncodeArr, "urlEncArr"],
+    [PerformanceEvents.Encrypt, "encrypt"],
+    [PerformanceEvents.Decrypt, "decrypt"],
 ]);
 /**
  * State of the performance event.
@@ -5095,9 +5043,11 @@ const IntFields = new Set([
     "multiMatchedAT",
     "multiMatchedID",
     "multiMatchedRT",
+    "unencryptedCacheCount",
+    "encryptedCacheExpiredCount",
 ]);
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5193,7 +5143,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5302,7 +5252,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6141,7 +6091,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6172,7 +6122,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6191,7 +6141,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6289,7 +6239,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6319,7 +6269,7 @@ function createNetworkError(error, httpStatus, responseHeaders) {
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6469,7 +6419,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6495,7 +6445,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6583,7 +6533,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6655,7 +6605,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6739,7 +6689,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6766,7 +6716,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6926,13 +6876,13 @@ class ResponseHandler {
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key, this.logger);
+                const account = this.cacheStorage.getAccount(key);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache, request.correlationId);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, request.storeInCache);
         }
         finally {
             if (this.persistencePlugin &&
@@ -7118,7 +7068,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     });
     let cachedAccount = null;
     if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+        cachedAccount = cacheStorage.getAccount(baseAccountKey);
     }
     const baseAccount = cachedAccount ||
         AccountEntity.createAccount({
@@ -7143,7 +7093,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7161,7 +7111,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7535,7 +7485,7 @@ class AuthorizationCodeClient extends BaseClient {
             });
         }
         this.addExtraQueryParams(request, parameterBuilder);
-        if (request.nativeBroker) {
+        if (request.platformBroker) {
             // signal ests that this is a WAM call
             parameterBuilder.addNativeBroker();
             // pass the req_cnf for POP
@@ -7603,7 +7553,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7823,7 +7773,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7959,7 +7909,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7974,7 +7924,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8032,7 +7982,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8295,7 +8245,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8303,7 +8253,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8328,7 +8278,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8368,7 +8318,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8447,7 +8397,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2025-01-14 */
+/*! @azure/msal-common v15.0.1 2025-01-15 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9684,6 +9634,43 @@ function base64EncArr(aBytes) {
     return btoa(binString);
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
+ * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
+ */
+/**
+ * Returns a URL-safe plaintext decoded string from b64 encoded input.
+ * @param input
+ */
+function base64Decode(input) {
+    return new TextDecoder().decode(base64DecToArr(input));
+}
+/**
+ * Decodes base64 into Uint8Array
+ * @param base64String
+ */
+function base64DecToArr(base64String) {
+    let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
+    switch (encodedString.length % 4) {
+        case 0:
+            break;
+        case 2:
+            encodedString += "==";
+            break;
+        case 3:
+            encodedString += "=";
+            break;
+        default:
+            throw createBrowserAuthError(invalidBase64String);
+    }
+    const binString = atob(encodedString);
+    return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -9695,8 +9682,10 @@ function base64EncArr(aBytes) {
 /**
  * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
  */
-// RSA KeyGen Algorithm
+// Algorithms
 const PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+const AES_GCM = "AES-GCM";
+const HKDF = "HKDF";
 // SHA-256 hashing algorithm
 const S256_HASH_ALG = "SHA-256";
 // MOD length for PoP tokens
@@ -9707,6 +9696,13 @@ const PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
 const UUID_CHARS = "0123456789abcdef";
 // Array to store UINT32 random value
 const UINT32_ARR = new Uint32Array(1);
+// Key Format
+const RAW = "raw";
+// Key Usages
+const ENCRYPT = "encrypt";
+const DECRYPT = "decrypt";
+const DERIVE_KEY = "deriveKey";
+// Suberror
 const SUBTLE_SUBERROR = "crypto_subtle_undefined";
 const keygenAlgorithmOptions = {
     name: PKCS1_V15_KEYGEN_ALG,
@@ -9829,6 +9825,76 @@ async function importJwk(key, extractable, usages) {
 async function sign(key, data) {
     return window.crypto.subtle.sign(keygenAlgorithmOptions, key, data);
 }
+/**
+ * Generates symmetric base encryption key. This may be stored as all encryption/decryption keys will be derived from this one.
+ */
+async function generateBaseKey() {
+    const key = await window.crypto.subtle.generateKey({
+        name: AES_GCM,
+        length: 256,
+    }, true, [ENCRYPT, DECRYPT]);
+    return window.crypto.subtle.exportKey(RAW, key);
+}
+/**
+ * Returns the raw key to be passed into the key derivation function
+ * @param baseKey
+ * @returns
+ */
+async function generateHKDF(baseKey) {
+    return window.crypto.subtle.importKey(RAW, baseKey, HKDF, false, [
+        DERIVE_KEY,
+    ]);
+}
+/**
+ * Given a base key and a nonce generates a derived key to be used in encryption and decryption.
+ * Note: every time we encrypt a new key is derived
+ * @param baseKey
+ * @param nonce
+ * @returns
+ */
+async function deriveKey(baseKey, nonce, context) {
+    return window.crypto.subtle.deriveKey({
+        name: HKDF,
+        salt: nonce,
+        hash: S256_HASH_ALG,
+        info: new TextEncoder().encode(context),
+    }, baseKey, { name: AES_GCM, length: 256 }, false, [ENCRYPT, DECRYPT]);
+}
+/**
+ * Encrypt the given data given a base key. Returns encrypted data and a nonce that must be provided during decryption
+ * @param key
+ * @param rawData
+ */
+async function encrypt(baseKey, rawData, context) {
+    const encodedData = new TextEncoder().encode(rawData);
+    // The nonce must never be reused with a given key.
+    const nonce = window.crypto.getRandomValues(new Uint8Array(16));
+    const derivedKey = await deriveKey(baseKey, nonce, context);
+    const encryptedData = await window.crypto.subtle.encrypt({
+        name: AES_GCM,
+        iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+    }, derivedKey, encodedData);
+    return {
+        data: urlEncodeArr(new Uint8Array(encryptedData)),
+        nonce: urlEncodeArr(nonce),
+    };
+}
+/**
+ * Decrypt data with the given key and nonce
+ * @param key
+ * @param nonce
+ * @param encryptedData
+ * @returns
+ */
+async function decrypt(baseKey, nonce, context, encryptedData) {
+    const encodedData = base64DecToArr(encryptedData);
+    const derivedKey = await deriveKey(baseKey, base64DecToArr(nonce), context);
+    const decryptedData = await window.crypto.subtle.decrypt({
+        name: AES_GCM,
+        iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+    }, derivedKey, encodedData);
+    return new TextDecoder().decode(decryptedData);
+}
 /**
  * Returns the SHA-256 hash of an input string
  * @param plainText
@@ -10321,7 +10387,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS,
         asyncPopups: false,
         allowRedirectInIframe: false,
-        allowNativeBroker: false,
+        allowPlatformBroker: false,
         nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
         pollIntervalMilliseconds: BrowserConstants.DEFAULT_POLL_INTERVAL_MS,
@@ -10344,11 +10410,11 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         const logger = new Logger(providedSystemOptions.loggerOptions);
         logger.warning(JSON.stringify(createClientConfigurationError(cannotSetOIDCOptions)));
     }
-    // Throw an error if user has set allowNativeBroker to true without being in AAD protocol mode
+    // Throw an error if user has set allowPlatformBroker to true without being in AAD protocol mode
     if (userInputAuth?.protocolMode &&
         userInputAuth.protocolMode !== ProtocolMode.AAD &&
-        providedSystemOptions?.allowNativeBroker) {
-        throw createClientConfigurationError(cannotAllowNativeBroker);
+        providedSystemOptions?.allowPlatformBroker) {
+        throw createClientConfigurationError(cannotAllowPlatformBroker);
     }
     const overlayedConfig = {
         auth: {
@@ -10368,7 +10434,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.28.1";
+const version = "4.0.1";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10744,43 +10810,6 @@ StandardOperatingContext.MODULE_NAME = "";
  */
 StandardOperatingContext.ID = "StandardOperatingContext";
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
- * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
- */
-/**
- * Returns a URL-safe plaintext decoded string from b64 encoded input.
- * @param input
- */
-function base64Decode(input) {
-    return new TextDecoder().decode(base64DecToArr(input));
-}
-/**
- * Decodes base64 into Uint8Array
- * @param base64String
- */
-function base64DecToArr(base64String) {
-    let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
-    switch (encodedString.length % 4) {
-        case 0:
-            break;
-        case 2:
-            encodedString += "==";
-            break;
-        case 3:
-            encodedString += "=";
-            break;
-        default:
-            throw createBrowserAuthError(invalidBase64String);
-    }
-    const binString = atob(encodedString);
-    return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -10990,12 +11019,21 @@ class MemoryStorage {
     constructor() {
         this.cache = new Map();
     }
+    async initialize() {
+        // Memory storage does not require initialization
+    }
     getItem(key) {
         return this.cache.get(key) || null;
     }
+    getUserData(key) {
+        return this.getItem(key);
+    }
     setItem(key, value) {
         this.cache.set(key, value);
     }
+    async setUserData(key, value) {
+        this.setItem(key, value);
+    }
     removeItem(key) {
         this.cache.delete(key);
     }
@@ -11327,19 +11365,189 @@ function getSortedObjectString(obj) {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+// Cookie life calculation (hours * minutes * seconds * ms)
+const COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
+class CookieStorage {
+    initialize() {
+        return Promise.resolve();
+    }
+    getItem(key) {
+        const name = `${encodeURIComponent(key)}`;
+        const cookieList = document.cookie.split(";");
+        for (let i = 0; i < cookieList.length; i++) {
+            const cookie = cookieList[i];
+            const [key, ...rest] = decodeURIComponent(cookie).trim().split("=");
+            const value = rest.join("=");
+            if (key === name) {
+                return value;
+            }
+        }
+        return "";
+    }
+    getUserData() {
+        throw createClientAuthError(methodNotImplemented);
+    }
+    setItem(key, value, cookieLifeDays, secure = true) {
+        let cookieStr = `${encodeURIComponent(key)}=${encodeURIComponent(value)};path=/;SameSite=Lax;`;
+        if (cookieLifeDays) {
+            const expireTime = getCookieExpirationTime(cookieLifeDays);
+            cookieStr += `expires=${expireTime};`;
+        }
+        if (secure) {
+            cookieStr += "Secure;";
+        }
+        document.cookie = cookieStr;
+    }
+    async setUserData() {
+        return Promise.reject(createClientAuthError(methodNotImplemented));
+    }
+    removeItem(key) {
+        // Setting expiration to -1 removes it
+        this.setItem(key, "", -1);
+    }
+    getKeys() {
+        const cookieList = document.cookie.split(";");
+        const keys = [];
+        cookieList.forEach((cookie) => {
+            const cookieParts = decodeURIComponent(cookie).trim().split("=");
+            keys.push(cookieParts[0]);
+        });
+        return keys;
+    }
+    containsKey(key) {
+        return this.getKeys().includes(key);
+    }
+}
+/**
+ * Get cookie expiration time
+ * @param cookieLifeDays
+ */
+function getCookieExpirationTime(cookieLifeDays) {
+    const today = new Date();
+    const expr = new Date(today.getTime() + cookieLifeDays * COOKIE_LIFE_MULTIPLIER);
+    return expr.toUTCString();
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns a list of cache keys for all known accounts
+ * @param storage
+ * @returns
+ */
+function getAccountKeys(storage) {
+    const accountKeys = storage.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+    if (accountKeys) {
+        return JSON.parse(accountKeys);
+    }
+    return [];
+}
+/**
+ * Returns a list of cache keys for all known tokens
+ * @param clientId
+ * @param storage
+ * @returns
+ */
+function getTokenKeys(clientId, storage) {
+    const item = storage.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${clientId}`);
+    if (item) {
+        const tokenKeys = JSON.parse(item);
+        if (tokenKeys &&
+            tokenKeys.hasOwnProperty("idToken") &&
+            tokenKeys.hasOwnProperty("accessToken") &&
+            tokenKeys.hasOwnProperty("refreshToken")) {
+            return tokenKeys;
+        }
+    }
+    return {
+        idToken: [],
+        accessToken: [],
+        refreshToken: [],
+    };
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const ENCRYPTION_KEY = "msal.cache.encryption";
 class LocalStorage {
-    constructor() {
+    constructor(clientId, logger, performanceClient) {
         if (!window.localStorage) {
             throw createBrowserConfigurationAuthError(storageNotSupported);
         }
+        this.memoryStorage = new MemoryStorage();
+        this.initialized = false;
+        this.clientId = clientId;
+        this.logger = logger;
+        this.performanceClient = performanceClient;
+    }
+    async initialize(correlationId) {
+        this.initialized = true;
+        const cookies = new CookieStorage();
+        const cookieString = cookies.getItem(ENCRYPTION_KEY);
+        let parsedCookie = { key: "", id: "" };
+        if (cookieString) {
+            try {
+                parsedCookie = JSON.parse(cookieString);
+            }
+            catch (e) { }
+        }
+        if (parsedCookie.key && parsedCookie.id) {
+            // Encryption key already exists, import
+            const baseKey = invoke(base64DecToArr, PerformanceEvents.Base64Decode, this.logger, this.performanceClient, correlationId)(parsedCookie.key);
+            this.encryptionCookie = {
+                id: parsedCookie.id,
+                key: await invokeAsync(generateHKDF, PerformanceEvents.GenerateHKDF, this.logger, this.performanceClient, correlationId)(baseKey),
+            };
+            await invokeAsync(this.importExistingCache.bind(this), PerformanceEvents.ImportExistingCache, this.logger, this.performanceClient, correlationId)(correlationId);
+        }
+        else {
+            // Encryption key doesn't exist or is invalid, generate a new one and clear existing cache
+            this.clear();
+            const id = createNewGuid();
+            const baseKey = await invokeAsync(generateBaseKey, PerformanceEvents.GenerateBaseKey, this.logger, this.performanceClient, correlationId)();
+            const keyStr = invoke(urlEncodeArr, PerformanceEvents.UrlEncodeArr, this.logger, this.performanceClient, correlationId)(new Uint8Array(baseKey));
+            this.encryptionCookie = {
+                id: id,
+                key: await invokeAsync(generateHKDF, PerformanceEvents.GenerateHKDF, this.logger, this.performanceClient, correlationId)(baseKey),
+            };
+            const cookieData = {
+                id: id,
+                key: keyStr,
+            };
+            cookies.setItem(ENCRYPTION_KEY, JSON.stringify(cookieData));
+        }
     }
     getItem(key) {
         return window.localStorage.getItem(key);
     }
+    getUserData(key) {
+        if (!this.initialized) {
+            throw createBrowserAuthError(uninitializedPublicClientApplication);
+        }
+        return this.memoryStorage.getItem(key);
+    }
     setItem(key, value) {
         window.localStorage.setItem(key, value);
     }
+    async setUserData(key, value, correlationId) {
+        if (!this.initialized || !this.encryptionCookie) {
+            throw createBrowserAuthError(uninitializedPublicClientApplication);
+        }
+        const { data, nonce } = await invokeAsync(encrypt, PerformanceEvents.Encrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, value, this.getContext(key));
+        const encryptedData = {
+            id: this.encryptionCookie.id,
+            nonce: nonce,
+            data: data,
+        };
+        this.memoryStorage.setItem(key, value);
+        this.setItem(key, JSON.stringify(encryptedData));
+    }
     removeItem(key) {
+        this.memoryStorage.removeItem(key);
         window.localStorage.removeItem(key);
     }
     getKeys() {
@@ -11348,6 +11556,114 @@ class LocalStorage {
     containsKey(key) {
         return window.localStorage.hasOwnProperty(key);
     }
+    /**
+     * Removes all known MSAL keys from the cache
+     */
+    clear() {
+        // Removes all remaining MSAL cache items
+        this.memoryStorage.clear();
+        const accountKeys = getAccountKeys(this);
+        accountKeys.forEach((key) => this.removeItem(key));
+        const tokenKeys = getTokenKeys(this.clientId, this);
+        tokenKeys.idToken.forEach((key) => this.removeItem(key));
+        tokenKeys.accessToken.forEach((key) => this.removeItem(key));
+        tokenKeys.refreshToken.forEach((key) => this.removeItem(key));
+        // Clean up anything left
+        this.getKeys().forEach((cacheKey) => {
+            if (cacheKey.startsWith(Constants.CACHE_PREFIX) ||
+                cacheKey.indexOf(this.clientId) !== -1) {
+                this.removeItem(cacheKey);
+            }
+        });
+    }
+    /**
+     * Helper to decrypt all known MSAL keys in localStorage and save them to inMemory storage
+     * @returns
+     */
+    async importExistingCache(correlationId) {
+        if (!this.encryptionCookie) {
+            return;
+        }
+        let accountKeys = getAccountKeys(this);
+        accountKeys = await this.importArray(accountKeys, correlationId);
+        // Write valid account keys back to map
+        this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+        const tokenKeys = getTokenKeys(this.clientId, this);
+        tokenKeys.idToken = await this.importArray(tokenKeys.idToken, correlationId);
+        tokenKeys.accessToken = await this.importArray(tokenKeys.accessToken, correlationId);
+        tokenKeys.refreshToken = await this.importArray(tokenKeys.refreshToken, correlationId);
+        // Write valid token keys back to map
+        this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+    }
+    /**
+     * Helper to decrypt and save cache entries
+     * @param key
+     * @returns
+     */
+    async getItemFromEncryptedCache(key, correlationId) {
+        if (!this.encryptionCookie) {
+            return null;
+        }
+        const rawCache = this.getItem(key);
+        if (!rawCache) {
+            return null;
+        }
+        let encObj;
+        try {
+            encObj = JSON.parse(rawCache);
+        }
+        catch (e) {
+            // Not a valid encrypted object, remove
+            return null;
+        }
+        if (!encObj.id || !encObj.nonce || !encObj.data) {
+            // Data is not encrypted, likely from old version of MSAL. It must be removed because we don't know how old it is.
+            this.performanceClient.incrementFields({ unencryptedCacheCount: 1 }, correlationId);
+            return null;
+        }
+        if (encObj.id !== this.encryptionCookie.id) {
+            // Data was encrypted with a different key. It must be removed because it is from a previous session.
+            this.performanceClient.incrementFields({ encryptedCacheExpiredCount: 1 }, correlationId);
+            return null;
+        }
+        return invokeAsync(decrypt, PerformanceEvents.Decrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, encObj.nonce, this.getContext(key), encObj.data);
+    }
+    /**
+     * Helper to decrypt and save an array of cache keys
+     * @param arr
+     * @returns Array of keys successfully imported
+     */
+    async importArray(arr, correlationId) {
+        const importedArr = [];
+        const promiseArr = [];
+        arr.forEach((key) => {
+            const promise = this.getItemFromEncryptedCache(key, correlationId).then((value) => {
+                if (value) {
+                    this.memoryStorage.setItem(key, value);
+                    importedArr.push(key);
+                }
+                else {
+                    // If value is empty, unencrypted or expired remove
+                    this.removeItem(key);
+                }
+            });
+            promiseArr.push(promise);
+        });
+        await Promise.all(promiseArr);
+        return importedArr;
+    }
+    /**
+     * Gets encryption context for a given cache entry. This is clientId for app specific entries, empty string for shared entries
+     * @param key
+     * @returns
+     */
+    getContext(key) {
+        let context = "";
+        if (key.includes(this.clientId)) {
+            context = this.clientId; // Used to bind encryption key to this appId
+        }
+        return context;
+    }
 }
 
 /*
@@ -11360,12 +11676,21 @@ class SessionStorage {
             throw createBrowserConfigurationAuthError(storageNotSupported);
         }
     }
+    async initialize() {
+        // Session storage does not require initialization
+    }
     getItem(key) {
         return window.sessionStorage.getItem(key);
     }
+    getUserData(key) {
+        return this.getItem(key);
+    }
     setItem(key, value) {
         window.sessionStorage.setItem(key, value);
     }
+    async setUserData(key, value) {
+        this.setItem(key, value);
+    }
     removeItem(key) {
         window.sessionStorage.removeItem(key);
     }
@@ -11399,64 +11724,6 @@ function extractBrowserRequestState(browserCrypto, state) {
     }
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-// Cookie life calculation (hours * minutes * seconds * ms)
-const COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
-class CookieStorage {
-    getItem(key) {
-        const name = `${encodeURIComponent(key)}`;
-        const cookieList = document.cookie.split(";");
-        for (let i = 0; i < cookieList.length; i++) {
-            const cookie = cookieList[i];
-            const [key, ...rest] = decodeURIComponent(cookie).trim().split("=");
-            const value = rest.join("=");
-            if (key === name) {
-                return value;
-            }
-        }
-        return "";
-    }
-    setItem(key, value, cookieLifeDays, secure = true) {
-        let cookieStr = `${encodeURIComponent(key)}=${encodeURIComponent(value)};path=/;SameSite=Lax;`;
-        if (cookieLifeDays) {
-            const expireTime = getCookieExpirationTime(cookieLifeDays);
-            cookieStr += `expires=${expireTime};`;
-        }
-        if (secure) {
-            cookieStr += "Secure;";
-        }
-        document.cookie = cookieStr;
-    }
-    removeItem(key) {
-        // Setting expiration to -1 removes it
-        this.setItem(key, "", -1);
-    }
-    getKeys() {
-        const cookieList = document.cookie.split(";");
-        const keys = [];
-        cookieList.forEach((cookie) => {
-            const cookieParts = decodeURIComponent(cookie).trim().split("=");
-            keys.push(cookieParts[0]);
-        });
-        return keys;
-    }
-    containsKey(key) {
-        return this.getKeys().includes(key);
-    }
-}
-/**
- * Get cookie expiration time
- * @param cookieLifeDays
- */
-function getCookieExpirationTime(cookieLifeDays) {
-    const today = new Date();
-    const expr = new Date(today.getTime() + cookieLifeDays * COOKIE_LIFE_MULTIPLIER);
-    return expr.toUTCString();
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11467,7 +11734,7 @@ function getCookieExpirationTime(cookieLifeDays) {
  * parameters such as state and nonce, generally.
  */
 class BrowserCacheManager extends CacheManager {
-    constructor(clientId, cacheConfig, cryptoImpl, logger, staticAuthorityOptions, performanceClient) {
+    constructor(clientId, cacheConfig, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
         super(clientId, cryptoImpl, logger, staticAuthorityOptions);
         this.cacheConfig = cacheConfig;
         this.logger = logger;
@@ -11475,13 +11742,11 @@ class BrowserCacheManager extends CacheManager {
         this.browserStorage = this.setupBrowserStorage(this.cacheConfig.cacheLocation);
         this.temporaryCacheStorage = this.setupBrowserStorage(this.cacheConfig.temporaryCacheLocation);
         this.cookieStorage = new CookieStorage();
-        // Migrate cache entries from older versions of MSAL.
-        if (cacheConfig.cacheMigrationEnabled) {
-            this.migrateCacheEntries();
-            this.createKeyMaps();
-        }
         this.performanceClient = performanceClient;
     }
+    async initialize(correlationId) {
+        await this.browserStorage.initialize(correlationId);
+    }
     /**
      * Returns a window storage class implementing the IWindowStorage interface that corresponds to the configured cacheLocation.
      * @param cacheLocation
@@ -11490,7 +11755,7 @@ class BrowserCacheManager extends CacheManager {
         try {
             switch (cacheLocation) {
                 case BrowserCacheLocation.LocalStorage:
-                    return new LocalStorage();
+                    return new LocalStorage(this.clientId, this.logger, this.performanceClient);
                 case BrowserCacheLocation.SessionStorage:
                     return new SessionStorage();
                 case BrowserCacheLocation.MemoryStorage:
@@ -11504,123 +11769,6 @@ class BrowserCacheManager extends CacheManager {
         this.cacheConfig.cacheLocation = BrowserCacheLocation.MemoryStorage;
         return new MemoryStorage();
     }
-    /**
-     * Migrate all old cache entries to new schema. No rollback supported.
-     * @param storeAuthStateInCookie
-     */
-    migrateCacheEntries() {
-        const idTokenKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ID_TOKEN}`;
-        const clientInfoKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.CLIENT_INFO}`;
-        const errorKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ERROR}`;
-        const errorDescKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ERROR_DESC}`;
-        const idTokenValue = this.browserStorage.getItem(idTokenKey);
-        const clientInfoValue = this.browserStorage.getItem(clientInfoKey);
-        const errorValue = this.browserStorage.getItem(errorKey);
-        const errorDescValue = this.browserStorage.getItem(errorDescKey);
-        const values = [
-            idTokenValue,
-            clientInfoValue,
-            errorValue,
-            errorDescValue,
-        ];
-        const keysToMigrate = [
-            PersistentCacheKeys.ID_TOKEN,
-            PersistentCacheKeys.CLIENT_INFO,
-            PersistentCacheKeys.ERROR,
-            PersistentCacheKeys.ERROR_DESC,
-        ];
-        keysToMigrate.forEach((cacheKey, index) => {
-            const value = values[index];
-            if (value) {
-                this.setTemporaryCache(cacheKey, value, true);
-            }
-        });
-    }
-    /**
-     * Searches all cache entries for MSAL accounts and creates the account key map
-     * This is used to migrate users from older versions of MSAL which did not create the map.
-     * @returns
-     */
-    createKeyMaps() {
-        this.logger.trace("BrowserCacheManager - createKeyMaps called.");
-        const accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
-        const tokenKeys = this.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
-        if (accountKeys && tokenKeys) {
-            this.logger.verbose("BrowserCacheManager:createKeyMaps - account and token key maps already exist, skipping migration.");
-            // Key maps already exist, no need to iterate through cache
-            return;
-        }
-        const allKeys = this.browserStorage.getKeys();
-        allKeys.forEach((key) => {
-            if (this.isCredentialKey(key)) {
-                // Get item, parse, validate and write key to map
-                const value = this.getItem(key);
-                if (value) {
-                    const credObj = this.validateAndParseJson(value);
-                    if (credObj && credObj.hasOwnProperty("credentialType")) {
-                        switch (credObj["credentialType"]) {
-                            case CredentialType.ID_TOKEN:
-                                if (isIdTokenEntity(credObj)) {
-                                    this.logger.trace("BrowserCacheManager:createKeyMaps - idToken found, saving key to token key map");
-                                    this.logger.tracePii(`BrowserCacheManager:createKeyMaps - idToken with key: ${key} found, saving key to token key map`);
-                                    const idTokenEntity = credObj;
-                                    const newKey = this.updateCredentialCacheKey(key, idTokenEntity);
-                                    this.addTokenKey(newKey, CredentialType.ID_TOKEN);
-                                    return;
-                                }
-                                else {
-                                    this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching idToken schema with value containing idToken credentialType field but value failed IdTokenEntity validation, skipping.");
-                                    this.logger.tracePii(`BrowserCacheManager:createKeyMaps - failed idToken validation on key: ${key}`);
-                                }
-                                break;
-                            case CredentialType.ACCESS_TOKEN:
-                            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                                if (isAccessTokenEntity(credObj)) {
-                                    this.logger.trace("BrowserCacheManager:createKeyMaps - accessToken found, saving key to token key map");
-                                    this.logger.tracePii(`BrowserCacheManager:createKeyMaps - accessToken with key: ${key} found, saving key to token key map`);
-                                    const accessTokenEntity = credObj;
-                                    const newKey = this.updateCredentialCacheKey(key, accessTokenEntity);
-                                    this.addTokenKey(newKey, CredentialType.ACCESS_TOKEN);
-                                    return;
-                                }
-                                else {
-                                    this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching accessToken schema with value containing accessToken credentialType field but value failed AccessTokenEntity validation, skipping.");
-                                    this.logger.tracePii(`BrowserCacheManager:createKeyMaps - failed accessToken validation on key: ${key}`);
-                                }
-                                break;
-                            case CredentialType.REFRESH_TOKEN:
-                                if (isRefreshTokenEntity(credObj)) {
-                                    this.logger.trace("BrowserCacheManager:createKeyMaps - refreshToken found, saving key to token key map");
-                                    this.logger.tracePii(`BrowserCacheManager:createKeyMaps - refreshToken with key: ${key} found, saving key to token key map`);
-                                    const refreshTokenEntity = credObj;
-                                    const newKey = this.updateCredentialCacheKey(key, refreshTokenEntity);
-                                    this.addTokenKey(newKey, CredentialType.REFRESH_TOKEN);
-                                    return;
-                                }
-                                else {
-                                    this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching refreshToken schema with value containing refreshToken credentialType field but value failed RefreshTokenEntity validation, skipping.");
-                                    this.logger.tracePii(`BrowserCacheManager:createKeyMaps - failed refreshToken validation on key: ${key}`);
-                                }
-                                break;
-                            // If credentialType isn't one of our predefined ones, it may not be an MSAL cache value. Ignore.
-                        }
-                    }
-                }
-            }
-            if (this.isAccountKey(key)) {
-                const value = this.getItem(key);
-                if (value) {
-                    const accountObj = this.validateAndParseJson(value);
-                    if (accountObj &&
-                        AccountEntity.isAccountEntity(accountObj)) {
-                        this.logger.trace("BrowserCacheManager:createKeyMaps - account found, saving key to account key map");
-                        this.logger.tracePii(`BrowserCacheManager:createKeyMaps - account with key: ${key} found, saving key to account key map`);
-                        this.addAccountKeyToMap(key);
-                    }
-                }
-            }
-        });
-    }
     /**
      * Parses passed value as JSON object, JSON.parse() will throw an error.
      * @param input
@@ -11642,38 +11790,15 @@ class BrowserCacheManager extends CacheManager {
             return null;
         }
     }
-    /**
-     * fetches the entry from the browser storage based off the key
-     * @param key
-     */
-    getItem(key) {
-        return this.browserStorage.getItem(key);
-    }
-    /**
-     * sets the entry in the browser storage
-     * @param key
-     * @param value
-     */
-    setItem(key, value) {
-        this.browserStorage.setItem(key, value);
-    }
-    /**
-     * fetch the account entity from the platform cache
-     * @param accountKey
-     */
-    getAccount(accountKey, logger) {
-        this.logger.trace("BrowserCacheManager.getAccount called");
-        const accountEntity = this.getCachedAccountEntity(accountKey);
-        return this.updateOutdatedCachedAccount(accountKey, accountEntity, logger);
-    }
     /**
      * Reads account from cache, deserializes it into an account entity and returns it.
      * If account is not found from the key, returns null and removes key from map.
      * @param accountKey
      * @returns
      */
-    getCachedAccountEntity(accountKey) {
-        const serializedAccount = this.getItem(accountKey);
+    getAccount(accountKey) {
+        this.logger.trace("BrowserCacheManager.getAccount called");
+        const serializedAccount = this.browserStorage.getUserData(accountKey);
         if (!serializedAccount) {
             this.removeAccountKeyFromMap(accountKey);
             return null;
@@ -11689,10 +11814,10 @@ class BrowserCacheManager extends CacheManager {
      * set account entity in the platform cache
      * @param account
      */
-    setAccount(account) {
+    async setAccount(account, correlationId) {
         this.logger.trace("BrowserCacheManager.setAccount called");
         const key = account.generateAccountKey();
-        this.setItem(key, JSON.stringify(account));
+        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, JSON.stringify(account), correlationId);
         this.addAccountKeyToMap(key);
     }
     /**
@@ -11700,13 +11825,7 @@ class BrowserCacheManager extends CacheManager {
      * @returns
      */
     getAccountKeys() {
-        this.logger.trace("BrowserCacheManager.getAccountKeys called");
-        const accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
-        if (accountKeys) {
-            return JSON.parse(accountKeys);
-        }
-        this.logger.verbose("BrowserCacheManager.getAccountKeys - No account keys found");
-        return [];
+        return getAccountKeys(this.browserStorage);
     }
     /**
      * Add a new account to the key map
@@ -11719,7 +11838,7 @@ class BrowserCacheManager extends CacheManager {
         if (accountKeys.indexOf(key) === -1) {
             // Only add key if it does not already exist in the map
             accountKeys.push(key);
-            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
             this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
         }
         else {
@@ -11737,7 +11856,7 @@ class BrowserCacheManager extends CacheManager {
         const removalIndex = accountKeys.indexOf(key);
         if (removalIndex > -1) {
             accountKeys.splice(removalIndex, 1);
-            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
             this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
         }
         else {
@@ -11752,14 +11871,6 @@ class BrowserCacheManager extends CacheManager {
         void super.removeAccount(key);
         this.removeAccountKeyFromMap(key);
     }
-    /**
-     * Remove account entity from the platform cache if it's outdated
-     * @param accountKey
-     */
-    removeOutdatedAccount(accountKey) {
-        this.removeItem(accountKey);
-        this.removeAccountKeyFromMap(accountKey);
-    }
     /**
      * Removes given idToken from the cache and from the key map
      * @param key
@@ -11789,28 +11900,7 @@ class BrowserCacheManager extends CacheManager {
      * @returns
      */
     getTokenKeys() {
-        this.logger.trace("BrowserCacheManager.getTokenKeys called");
-        const item = this.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
-        if (item) {
-            const tokenKeys = this.validateAndParseJson(item);
-            if (tokenKeys &&
-                tokenKeys.hasOwnProperty("idToken") &&
-                tokenKeys.hasOwnProperty("accessToken") &&
-                tokenKeys.hasOwnProperty("refreshToken")) {
-                return tokenKeys;
-            }
-            else {
-                this.logger.error("BrowserCacheManager.getTokenKeys - Token keys found but in an unknown format. Returning empty key map.");
-            }
-        }
-        else {
-            this.logger.verbose("BrowserCacheManager.getTokenKeys - No token keys found");
-        }
-        return {
-            idToken: [],
-            accessToken: [],
-            refreshToken: [],
-        };
+        return getTokenKeys(this.clientId, this.browserStorage);
     }
     /**
      * Adds the given key to the token key map
@@ -11843,7 +11933,7 @@ class BrowserCacheManager extends CacheManager {
                 this.logger.error(`BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
                 throw createClientAuthError(unexpectedCredentialType);
         }
-        this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+        this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
     }
     /**
      * Removes the given key from the token key map
@@ -11891,14 +11981,14 @@ class BrowserCacheManager extends CacheManager {
                 this.logger.error(`BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
                 throw createClientAuthError(unexpectedCredentialType);
         }
-        this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+        this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
     }
     /**
      * generates idToken entity from a string
      * @param idTokenKey
      */
     getIdTokenCredential(idTokenKey) {
-        const value = this.getItem(idTokenKey);
+        const value = this.browserStorage.getUserData(idTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
             this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
@@ -11917,10 +12007,10 @@ class BrowserCacheManager extends CacheManager {
      * set IdToken credential to the platform cache
      * @param idToken
      */
-    setIdTokenCredential(idToken) {
+    async setIdTokenCredential(idToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
         const idTokenKey = generateCredentialKey(idToken);
-        this.setItem(idTokenKey, JSON.stringify(idToken));
+        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(idTokenKey, JSON.stringify(idToken), correlationId);
         this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
     }
     /**
@@ -11928,7 +12018,7 @@ class BrowserCacheManager extends CacheManager {
      * @param key
      */
     getAccessTokenCredential(accessTokenKey) {
-        const value = this.getItem(accessTokenKey);
+        const value = this.browserStorage.getUserData(accessTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
             this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
@@ -11948,10 +12038,10 @@ class BrowserCacheManager extends CacheManager {
      * set accessToken credential to the platform cache
      * @param accessToken
      */
-    setAccessTokenCredential(accessToken) {
+    async setAccessTokenCredential(accessToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
         const accessTokenKey = generateCredentialKey(accessToken);
-        this.setItem(accessTokenKey, JSON.stringify(accessToken));
+        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(accessTokenKey, JSON.stringify(accessToken), correlationId);
         this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
     }
     /**
@@ -11959,7 +12049,7 @@ class BrowserCacheManager extends CacheManager {
      * @param refreshTokenKey
      */
     getRefreshTokenCredential(refreshTokenKey) {
-        const value = this.getItem(refreshTokenKey);
+        const value = this.browserStorage.getUserData(refreshTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
             this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
@@ -11979,10 +12069,10 @@ class BrowserCacheManager extends CacheManager {
      * set refreshToken credential to the platform cache
      * @param refreshToken
      */
-    setRefreshTokenCredential(refreshToken) {
+    async setRefreshTokenCredential(refreshToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
         const refreshTokenKey = generateCredentialKey(refreshToken);
-        this.setItem(refreshTokenKey, JSON.stringify(refreshToken));
+        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(refreshTokenKey, JSON.stringify(refreshToken), correlationId);
         this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
     }
     /**
@@ -11990,7 +12080,7 @@ class BrowserCacheManager extends CacheManager {
      * @param appMetadataKey
      */
     getAppMetadata(appMetadataKey) {
-        const value = this.getItem(appMetadataKey);
+        const value = this.browserStorage.getItem(appMetadataKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit");
             return null;
@@ -12011,14 +12101,14 @@ class BrowserCacheManager extends CacheManager {
     setAppMetadata(appMetadata) {
         this.logger.trace("BrowserCacheManager.setAppMetadata called");
         const appMetadataKey = generateAppMetadataKey(appMetadata);
-        this.setItem(appMetadataKey, JSON.stringify(appMetadata));
+        this.browserStorage.setItem(appMetadataKey, JSON.stringify(appMetadata));
     }
     /**
      * fetch server telemetry entity from the platform cache
      * @param serverTelemetryKey
      */
     getServerTelemetry(serverTelemetryKey) {
-        const value = this.getItem(serverTelemetryKey);
+        const value = this.browserStorage.getItem(serverTelemetryKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit");
             return null;
@@ -12039,7 +12129,7 @@ class BrowserCacheManager extends CacheManager {
      */
     setServerTelemetry(serverTelemetryKey, serverTelemetry) {
         this.logger.trace("BrowserCacheManager.setServerTelemetry called");
-        this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry));
+        this.browserStorage.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry));
     }
     /**
      *
@@ -12099,25 +12189,9 @@ class BrowserCacheManager extends CacheManager {
      */
     getActiveAccount() {
         const activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
-        const activeAccountValueFilters = this.getItem(activeAccountKeyFilters);
+        const activeAccountValueFilters = this.browserStorage.getItem(activeAccountKeyFilters);
         if (!activeAccountValueFilters) {
-            // if new active account cache type isn't found, it's an old version, so look for that instead
-            this.logger.trace("BrowserCacheManager.getActiveAccount: No active account filters cache schema found, looking for legacy schema");
-            const activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
-            const activeAccountValueLocal = this.getItem(activeAccountKeyLocal);
-            if (!activeAccountValueLocal) {
-                this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found");
-                return null;
-            }
-            const activeAccount = this.getAccountInfoFilteredBy({
-                localAccountId: activeAccountValueLocal,
-            });
-            if (activeAccount) {
-                this.logger.trace("BrowserCacheManager.getActiveAccount: Legacy active account cache schema found");
-                this.logger.trace("BrowserCacheManager.getActiveAccount: Adding active account filters cache schema");
-                this.setActiveAccount(activeAccount);
-                return activeAccount;
-            }
+            this.logger.trace("BrowserCacheManager.getActiveAccount: No active account filters found");
             return null;
         }
         const activeAccountValueObj = this.validateAndParseJson(activeAccountValueFilters);
@@ -12138,7 +12212,6 @@ class BrowserCacheManager extends CacheManager {
      */
     setActiveAccount(account) {
         const activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
-        const activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
         if (account) {
             this.logger.verbose("setActiveAccount: Active account set");
             const activeAccountValue = {
@@ -12147,12 +12220,10 @@ class BrowserCacheManager extends CacheManager {
                 tenantId: account.tenantId,
             };
             this.browserStorage.setItem(activeAccountKey, JSON.stringify(activeAccountValue));
-            this.browserStorage.setItem(activeAccountKeyLocal, account.localAccountId);
         }
         else {
             this.logger.verbose("setActiveAccount: No account passed, active account not set");
             this.browserStorage.removeItem(activeAccountKey);
-            this.browserStorage.removeItem(activeAccountKeyLocal);
         }
     }
     /**
@@ -12160,7 +12231,7 @@ class BrowserCacheManager extends CacheManager {
      * @param throttlingCacheKey
      */
     getThrottlingCache(throttlingCacheKey) {
-        const value = this.getItem(throttlingCacheKey);
+        const value = this.browserStorage.getItem(throttlingCacheKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit");
             return null;
@@ -12181,7 +12252,7 @@ class BrowserCacheManager extends CacheManager {
      */
     setThrottlingCache(throttlingCacheKey, throttlingCache) {
         this.logger.trace("BrowserCacheManager.setThrottlingCache called");
-        this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache));
+        this.browserStorage.setItem(throttlingCacheKey, JSON.stringify(throttlingCache));
     }
     /**
      * Gets cache item with given key.
@@ -12309,8 +12380,7 @@ class BrowserCacheManager extends CacheManager {
     generateCacheKey(key) {
         const generatedKey = this.validateAndParseJson(key);
         if (!generatedKey) {
-            if (StringUtils.startsWith(key, Constants.CACHE_PREFIX) ||
-                StringUtils.startsWith(key, PersistentCacheKeys.ADAL_ID_TOKEN)) {
+            if (StringUtils.startsWith(key, Constants.CACHE_PREFIX)) {
                 return key;
             }
             return `${Constants.CACHE_PREFIX}.${this.clientId}.${key}`;
@@ -12536,59 +12606,6 @@ class BrowserCacheManager extends CacheManager {
             this.removeTemporaryItem(key);
         }
     }
-    /**
-     * Returns username retrieved from ADAL or MSAL v1 idToken
-     * @deprecated
-     */
-    getLegacyLoginHint() {
-        // Only check for adal/msal token if no SSO params are being used
-        const adalIdTokenString = this.getTemporaryCache(PersistentCacheKeys.ADAL_ID_TOKEN);
-        if (adalIdTokenString) {
-            this.browserStorage.removeItem(PersistentCacheKeys.ADAL_ID_TOKEN);
-            this.logger.verbose("Cached ADAL id token retrieved.");
-        }
-        // Check for cached MSAL v1 id token
-        const msalIdTokenString = this.getTemporaryCache(PersistentCacheKeys.ID_TOKEN, true);
-        if (msalIdTokenString) {
-            this.browserStorage.removeItem(this.generateCacheKey(PersistentCacheKeys.ID_TOKEN));
-            this.logger.verbose("Cached MSAL.js v1 id token retrieved");
-        }
-        const cachedIdTokenString = msalIdTokenString || adalIdTokenString;
-        if (cachedIdTokenString) {
-            const idTokenClaims = extractTokenClaims(cachedIdTokenString, base64Decode);
-            if (idTokenClaims.preferred_username) {
-                this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 preferred_username as loginHint");
-                return idTokenClaims.preferred_username;
-            }
-            else if (idTokenClaims.upn) {
-                this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 upn as loginHint");
-                return idTokenClaims.upn;
-            }
-            else {
-                this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, however, no account hint claim found. Enable preferred_username or upn id token claim to get SSO.");
-            }
-        }
-        return null;
-    }
-    /**
-     * Updates a credential's cache key if the current cache key is outdated
-     */
-    updateCredentialCacheKey(currentCacheKey, credential) {
-        const updatedCacheKey = generateCredentialKey(credential);
-        if (currentCacheKey !== updatedCacheKey) {
-            const cacheItem = this.getItem(currentCacheKey);
-            if (cacheItem) {
-                this.browserStorage.removeItem(currentCacheKey);
-                this.setItem(updatedCacheKey, cacheItem);
-                this.logger.verbose(`Updated an outdated ${credential.credentialType} cache key`);
-                return updatedCacheKey;
-            }
-            else {
-                this.logger.error(`Attempted to update an outdated ${credential.credentialType} cache key but no item matching the outdated key was found in storage`);
-            }
-        }
-        return currentCacheKey;
-    }
     /**
      * Builds credential entities from AuthenticationResult object and saves the resulting credentials to the cache
      * @param result
@@ -12614,7 +12631,7 @@ class BrowserCacheManager extends CacheManager {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
         };
-        return this.saveCacheRecord(cacheRecord);
+        return this.saveCacheRecord(cacheRecord, result.correlationId);
     }
     /**
      * saves a cache record
@@ -12622,9 +12639,9 @@ class BrowserCacheManager extends CacheManager {
      * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
         try {
-            await super.saveCacheRecord(cacheRecord, storeInCache, correlationId);
+            await super.saveCacheRecord(cacheRecord, correlationId, storeInCache);
         }
         catch (e) {
             if (e instanceof CacheError &&
@@ -12644,7 +12661,7 @@ class BrowserCacheManager extends CacheManager {
         }
     }
 }
-const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger) => {
+const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient) => {
     const cacheOptions = {
         cacheLocation: BrowserCacheLocation.MemoryStorage,
         temporaryCacheLocation: BrowserCacheLocation.MemoryStorage,
@@ -12653,7 +12670,7 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger) => {
         cacheMigrationEnabled: false,
         claimsBasedCachingEnabled: false,
     };
-    return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger);
+    return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger, performanceClient);
 };
 
 /*
@@ -13315,13 +13332,6 @@ class StandardInteractionClient extends BaseInteractionClient {
             this.logger.verbosePii(`Setting validated request account: ${account.homeAccountId}`, this.correlationId);
             validatedRequest.account = account;
         }
-        // Check for ADAL/MSAL v1 SSO
-        if (!validatedRequest.loginHint && !account) {
-            const legacyLoginHint = this.browserStorage.getLegacyLoginHint();
-            if (legacyLoginHint) {
-                validatedRequest.loginHint = legacyLoginHint;
-            }
-        }
         return validatedRequest;
     }
 }
@@ -13725,8 +13735,8 @@ class NativeInteractionClient extends BaseInteractionClient {
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
-        this.cacheAccount(baseAccount);
-        this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
+        await this.cacheAccount(baseAccount);
+        await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
         return result;
     }
     /**
@@ -13850,9 +13860,9 @@ class NativeInteractionClient extends BaseInteractionClient {
      * cache the account entity in browser storage
      * @param accountEntity
      */
-    cacheAccount(accountEntity) {
+    async cacheAccount(accountEntity) {
         // Store the account info and hence `nativeAccountId` in browser cache
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(accountEntity, this.correlationId);
         // Remove any existing cached tokens for this account in browser storage
         this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
             this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
@@ -13883,7 +13893,7 @@ class NativeInteractionClient extends BaseInteractionClient {
             idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
-        void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
+        return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, request.storeInCache);
     }
     addTelemetryFromNativeResponse(response) {
         const mats = this.getMATSFromResponse(response);
@@ -14318,15 +14328,15 @@ class NativeMessageHandler {
      * @param nativeExtensionProvider
      * @param authenticationScheme
      */
-    static isNativeAvailable(config, logger, nativeExtensionProvider, authenticationScheme) {
-        logger.trace("isNativeAvailable called");
-        if (!config.system.allowNativeBroker) {
-            logger.trace("isNativeAvailable: allowNativeBroker is not enabled, returning false");
+    static isPlatformBrokerAvailable(config, logger, nativeExtensionProvider, authenticationScheme) {
+        logger.trace("isPlatformBrokerAvailable called");
+        if (!config.system.allowPlatformBroker) {
+            logger.trace("isPlatformBrokerAvailable: allowPlatformBroker is not enabled, returning false");
             // Developer disabled WAM
             return false;
         }
         if (!nativeExtensionProvider) {
-            logger.trace("isNativeAvailable: WAM extension provider is not initialized, returning false");
+            logger.trace("isPlatformBrokerAvailable: Platform extension provider is not initialized, returning false");
             // Extension is not available
             return false;
         }
@@ -14334,10 +14344,10 @@ class NativeMessageHandler {
             switch (authenticationScheme) {
                 case AuthenticationScheme.BEARER:
                 case AuthenticationScheme.POP:
-                    logger.trace("isNativeAvailable: authenticationScheme is supported, returning true");
+                    logger.trace("isPlatformBrokerAvailable: authenticationScheme is supported, returning true");
                     return true;
                 default:
-                    logger.trace("isNativeAvailable: authenticationScheme is not supported, returning false");
+                    logger.trace("isPlatformBrokerAvailable: authenticationScheme is not supported, returning false");
                     return false;
             }
         }
@@ -14574,17 +14584,17 @@ class PopupClient extends StandardInteractionClient {
                 requestExtraQueryParameters: validRequest.extraQueryParameters,
                 account: validRequest.account,
             });
-            const isNativeBroker = NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
+            const isPlatformBroker = NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
             // Start measurement for server calls with native brokering enabled
             let fetchNativeAccountIdMeasurement;
-            if (isNativeBroker) {
+            if (isPlatformBroker) {
                 fetchNativeAccountIdMeasurement =
                     this.performanceClient.startMeasurement(PerformanceEvents.FetchAccountIdWithNativeBroker, request.correlationId);
             }
             // Create acquire token url.
             const navigateUrl = await authClient.getAuthCodeUrl({
                 ...validRequest,
-                nativeBroker: isNativeBroker,
+                platformBroker: isPlatformBroker,
             });
             // Create popup interaction handler.
             const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
@@ -15101,7 +15111,7 @@ class RedirectClient extends StandardInteractionClient {
             // Create acquire token url.
             const navigateUrl = await authClient.getAuthCodeUrl({
                 ...validRequest,
-                nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme),
+                platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme),
             });
             const redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
             this.logger.verbosePii(`Redirect start page: ${redirectStartPage}`);
@@ -15615,7 +15625,7 @@ class SilentIframeClient extends StandardInteractionClient {
         // Create authorize request url
         const navigateUrl = await invokeAsync(authClient.getAuthCodeUrl.bind(authClient), PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)({
             ...silentRequest,
-            nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme),
+            platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme),
         });
         // Create silent handler
         const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
@@ -15730,10 +15740,11 @@ class TokenCache {
      * @param options
      * @returns `AuthenticationResult` for the response that was loaded.
      */
-    loadExternalTokens(request, response, options) {
+    async loadExternalTokens(request, response, options) {
         if (!this.isBrowserEnvironment) {
             throw createBrowserAuthError(nonBrowserEnvironment);
         }
+        const correlationId = request.correlationId || createNewGuid();
         const idTokenClaims = response.id_token
             ? extractTokenClaims(response.id_token, base64Decode)
             : undefined;
@@ -15747,10 +15758,10 @@ class TokenCache {
         const authority = request.authority
             ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
             : undefined;
-        const cacheRecordAccount = this.loadAccount(request, options.clientInfo || response.client_info || "", idTokenClaims, authority);
-        const idToken = this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm);
-        const accessToken = this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options);
-        const refreshToken = this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment);
+        const cacheRecordAccount = await this.loadAccount(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
+        const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId);
+        const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId);
+        const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId);
         return this.generateAuthenticationResult(request, {
             account: cacheRecordAccount,
             idToken,
@@ -15767,11 +15778,11 @@ class TokenCache {
      * @param requestHomeAccountId
      * @returns `AccountEntity`
      */
-    loadAccount(request, clientInfo, idTokenClaims, authority) {
+    async loadAccount(request, clientInfo, correlationId, idTokenClaims, authority) {
         this.logger.verbose("TokenCache - loading account");
         if (request.account) {
             const accountEntity = AccountEntity.createFromAccountInfo(request.account);
-            this.storage.setAccount(accountEntity);
+            await this.storage.setAccount(accountEntity, correlationId);
             return accountEntity;
         }
         else if (!authority || (!clientInfo && !idTokenClaims)) {
@@ -15783,7 +15794,7 @@ class TokenCache {
         const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
         undefined, // nativeAccountId
         this.logger);
-        this.storage.setAccount(cachedAccount);
+        await this.storage.setAccount(cachedAccount, correlationId);
         return cachedAccount;
     }
     /**
@@ -15794,14 +15805,14 @@ class TokenCache {
      * @param tenantId
      * @returns `IdTokenEntity`
      */
-    loadIdToken(response, homeAccountId, environment, tenantId) {
+    async loadIdToken(response, homeAccountId, environment, tenantId, correlationId) {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
             return null;
         }
         this.logger.verbose("TokenCache - loading id token");
         const idTokenEntity = createIdTokenEntity(homeAccountId, environment, response.id_token, this.config.auth.clientId, tenantId);
-        this.storage.setIdTokenCredential(idTokenEntity);
+        await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
         return idTokenEntity;
     }
     /**
@@ -15813,7 +15824,7 @@ class TokenCache {
      * @param tenantId
      * @returns `AccessTokenEntity`
      */
-    loadAccessToken(request, response, homeAccountId, environment, tenantId, options) {
+    async loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId) {
         if (!response.access_token) {
             this.logger.verbose("TokenCache - no access token found in response");
             return null;
@@ -15837,7 +15848,7 @@ class TokenCache {
             (response.ext_expires_in || response.expires_in) +
                 new Date().getTime() / 1000;
         const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
-        this.storage.setAccessTokenCredential(accessTokenEntity);
+        await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
         return accessTokenEntity;
     }
     /**
@@ -15848,7 +15859,7 @@ class TokenCache {
      * @param environment
      * @returns `RefreshTokenEntity`
      */
-    loadRefreshToken(response, homeAccountId, environment) {
+    async loadRefreshToken(response, homeAccountId, environment, correlationId) {
         if (!response.refresh_token) {
             this.logger.verbose("TokenCache - no refresh token found in response");
             return null;
@@ -15856,7 +15867,7 @@ class TokenCache {
         this.logger.verbose("TokenCache - loading refresh token");
         const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
         response.refresh_token_expires_in);
-        this.storage.setRefreshTokenCredential(refreshTokenEntity);
+        await this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId);
         return refreshTokenEntity;
     }
     /**
@@ -16052,8 +16063,8 @@ class StandardController {
         this.eventHandler = new EventHandler(this.logger);
         // Initialize the browser storage class.
         this.browserStorage = this.isBrowserEnvironment
-            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, buildStaticAuthorityOptions(this.config.auth), this.performanceClient)
-            : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
+            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, this.performanceClient, buildStaticAuthorityOptions(this.config.auth))
+            : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger, this.performanceClient);
         // initialize in memory storage for native flows
         const nativeCacheOptions = {
             cacheLocation: BrowserCacheLocation.MemoryStorage,
@@ -16063,7 +16074,7 @@ class StandardController {
             cacheMigrationEnabled: false,
             claimsBasedCachingEnabled: false,
         };
-        this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, undefined, this.performanceClient);
+        this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient);
         // Initialize the token cache
         this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto);
         this.activeSilentTokenRequests = new Map();
@@ -16106,10 +16117,11 @@ class StandardController {
             return;
         }
         const initCorrelationId = request?.correlationId || this.getRequestCorrelationId();
-        const allowNativeBroker = this.config.system.allowNativeBroker;
+        const allowPlatformBroker = this.config.system.allowPlatformBroker;
         const initMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.InitializeClientApplication, initCorrelationId);
         this.eventHandler.emitEvent(EventType.INITIALIZE_START);
-        if (allowNativeBroker) {
+        await invokeAsync(this.browserStorage.initialize.bind(this.browserStorage), PerformanceEvents.InitializeCache, this.logger, this.performanceClient, initCorrelationId)(initCorrelationId);
+        if (allowPlatformBroker) {
             try {
                 this.nativeExtensionProvider =
                     await NativeMessageHandler.createProvider(this.logger, this.config.system.nativeBrokerHandshakeTimeout, this.performanceClient);
@@ -16124,7 +16136,10 @@ class StandardController {
         }
         this.initialized = true;
         this.eventHandler.emitEvent(EventType.INITIALIZE_END);
-        initMeasurement.end({ allowNativeBroker, success: true });
+        initMeasurement.end({
+            allowPlatformBroker: allowPlatformBroker,
+            success: true,
+        });
     }
     // #region Redirect Flow
     /**
@@ -16168,7 +16183,7 @@ class StandardController {
         const loggedInAccounts = this.getAllAccounts();
         const request = this.browserStorage.getCachedNativeRequest();
         const useNative = request &&
-            NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
+            NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
             this.nativeExtensionProvider &&
             !hash;
         const correlationId = useNative
@@ -16297,7 +16312,8 @@ class StandardController {
                 this.eventHandler.emitEvent(EventType.LOGIN_START, exports.InteractionType.Redirect, request);
             }
             let result;
-            if (this.nativeExtensionProvider && this.canUseNative(request)) {
+            if (this.nativeExtensionProvider &&
+                this.canUsePlatformBroker(request)) {
                 const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
                 result = nativeClient
                     .acquireTokenRedirect(request, atrMeasurement)
@@ -16368,7 +16384,7 @@ class StandardController {
             this.eventHandler.emitEvent(EventType.LOGIN_START, exports.InteractionType.Popup, request);
         }
         let result;
-        if (this.canUseNative(request)) {
+        if (this.canUsePlatformBroker(request)) {
             result = this.acquireTokenNative({
                 ...request,
                 correlationId,
@@ -16485,7 +16501,7 @@ class StandardController {
         this.logger.verbose("ssoSilent called", correlationId);
         this.eventHandler.emitEvent(EventType.SSO_SILENT_START, exports.InteractionType.Silent, validRequest);
         let result;
-        if (this.canUseNative(validRequest)) {
+        if (this.canUsePlatformBroker(validRequest)) {
             result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
                 // If native token acquisition fails for availability reasons fallback to standard flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
@@ -16583,7 +16599,7 @@ class StandardController {
                 return await response;
             }
             else if (request.nativeAccountId) {
-                if (this.canUseNative(request, request.nativeAccountId)) {
+                if (this.canUsePlatformBroker(request, request.nativeAccountId)) {
                     const result = await this.acquireTokenNative({
                         ...request,
                         correlationId,
@@ -16830,7 +16846,7 @@ class StandardController {
         this.logger.verbose("hydrateCache called");
         // Account gets saved to browser storage regardless of native or not
         const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(accountEntity, result.correlationId);
         if (result.fromNativeBroker) {
             this.logger.verbose("Response was from native broker, storing in-memory");
             // Tokens from native broker are stored in-memory
@@ -16854,13 +16870,13 @@ class StandardController {
         return nativeClient.acquireToken(request);
     }
     /**
-     * Returns boolean indicating if this request can use the native broker
+     * Returns boolean indicating if this request can use the platform broker
      * @param request
      */
-    canUseNative(request, accountId) {
-        this.logger.trace("canUseNative called");
-        if (!NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme)) {
-            this.logger.trace("canUseNative: isNativeAvailable returned false, returning false");
+    canUsePlatformBroker(request, accountId) {
+        this.logger.trace("canUsePlatformBroker called");
+        if (!NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme)) {
+            this.logger.trace("canUsePlatformBroker: isPlatformBrokerAvailable returned false, returning false");
             return false;
         }
         if (request.prompt) {
@@ -16868,15 +16884,15 @@ class StandardController {
                 case PromptValue.NONE:
                 case PromptValue.CONSENT:
                 case PromptValue.LOGIN:
-                    this.logger.trace("canUseNative: prompt is compatible with native flow");
+                    this.logger.trace("canUsePlatformBroker: prompt is compatible with platform broker flow");
                     break;
                 default:
-                    this.logger.trace(`canUseNative: prompt = ${request.prompt} is not compatible with native flow, returning false`);
+                    this.logger.trace(`canUsePlatformBroker: prompt = ${request.prompt} is not compatible with platform broker flow, returning false`);
                     return false;
             }
         }
         if (!accountId && !this.getNativeAccountId(request)) {
-            this.logger.trace("canUseNative: nativeAccountId is not available, returning false");
+            this.logger.trace("canUsePlatformBroker: nativeAccountId is not available, returning false");
             return false;
         }
         return true;
@@ -17317,7 +17333,7 @@ class StandardController {
      * @returns
      */
     async acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy) {
-        if (NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, silentRequest.authenticationScheme) &&
+        if (NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider, silentRequest.authenticationScheme) &&
             silentRequest.account.nativeAccountId) {
             this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
             return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(async (e) => {
@@ -17607,8 +17623,8 @@ class NestedAppAuthController {
             : DEFAULT_CRYPTO_IMPLEMENTATION;
         // Initialize the browser storage class.
         this.browserStorage = this.operatingContext.isBrowserEnvironment()
-            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, buildStaticAuthorityOptions(this.config.auth))
-            : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
+            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, this.performanceClient, buildStaticAuthorityOptions(this.config.auth))
+            : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger, this.performanceClient);
         this.eventHandler = new EventHandler(this.logger);
         this.nestedAppAuthAdapter = new NestedAppAuthAdapter(this.config.auth.clientId, this.config.auth.clientCapabilities, this.browserCrypto, this.logger);
         // Set the active account if available
@@ -17631,8 +17647,9 @@ class NestedAppAuthController {
      * Specific implementation of initialize function for NestedAppAuthController
      * @returns
      */
-    initialize() {
-        // do nothing not required by this controller
+    async initialize(request) {
+        const initCorrelationId = request?.correlationId || createNewGuid();
+        await this.browserStorage.initialize(initCorrelationId);
         return Promise.resolve();
     }
     /**
@@ -18058,7 +18075,7 @@ class NestedAppAuthController {
     async hydrateCache(result, request) {
         this.logger.verbose("hydrateCache called");
         const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(accountEntity, result.correlationId);
         return this.browserStorage.hydrateCache(result, request);
     }
 }
@@ -18490,8 +18507,8 @@ class UnknownOperatingContextController {
             : DEFAULT_CRYPTO_IMPLEMENTATION;
         // Initialize the browser storage class.
         this.browserStorage = this.isBrowserEnvironment
-            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, undefined, this.performanceClient)
-            : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
+            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, this.performanceClient, undefined)
+            : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger, this.performanceClient);
     }
     getBrowserStorage() {
         return this.browserStorage;
@@ -19216,42 +19233,6 @@ const stubbedPublicClientApplication = {
     },
 };
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * @deprecated This class will be removed in a future major version
- */
-class BrowserStorage {
-    constructor(cacheLocation) {
-        if (cacheLocation === BrowserCacheLocation.LocalStorage) {
-            this.windowStorage = new LocalStorage();
-        }
-        else if (cacheLocation === BrowserCacheLocation.SessionStorage) {
-            this.windowStorage = new SessionStorage();
-        }
-        else {
-            throw createBrowserConfigurationAuthError(storageNotSupported);
-        }
-    }
-    getItem(key) {
-        return this.windowStorage.getItem(key);
-    }
-    setItem(key, value) {
-        this.windowStorage.setItem(key, value);
-    }
-    removeItem(key) {
-        this.windowStorage.removeItem(key);
-    }
-    getKeys() {
-        return Object.keys(this.windowStorage);
-    }
-    containsKey(key) {
-        return this.windowStorage.hasOwnProperty(key);
-    }
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -19639,7 +19620,6 @@ exports.BrowserConfigurationAuthErrorCodes = BrowserConfigurationAuthErrorCodes;
 exports.BrowserConfigurationAuthErrorMessage = BrowserConfigurationAuthErrorMessage;
 exports.BrowserPerformanceClient = BrowserPerformanceClient;
 exports.BrowserPerformanceMeasurement = BrowserPerformanceMeasurement;
-exports.BrowserStorage = BrowserStorage;
 exports.BrowserUtils = BrowserUtils;
 exports.CacheLookupPolicy = CacheLookupPolicy;
 exports.ClientAuthError = ClientAuthError;