@azure/msal-browser 3.9.0 → 3.10.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.9.0 2024-02-07 */
+/*! @azure/msal-browser v3.10.0 2024-02-17 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -301,7 +301,7 @@
         Pop: "pop",
     };
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -318,7 +318,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -367,7 +367,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -465,7 +465,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -717,7 +717,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -750,7 +750,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -941,12 +941,12 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "14.7.0";
+    const version$1 = "14.7.1";
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -966,7 +966,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1027,7 +1027,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1064,7 +1064,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1391,7 +1391,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1445,7 +1445,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1583,7 +1583,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1680,7 +1680,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1880,7 +1880,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1920,7 +1920,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1958,7 +1958,7 @@
      * @param idTokenClaims
      * @returns
      */
-    function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims) {
+    function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims, idTokenSecret) {
         let updatedAccountInfo = baseAccountInfo;
         // Tenant Profile overrides passed in account info
         if (tenantProfile) {
@@ -1975,13 +1975,14 @@
                 ...updatedAccountInfo,
                 ...claimsSourcedTenantProfile,
                 idTokenClaims: idTokenClaims,
+                idToken: idTokenSecret,
             };
             return updatedAccountInfo;
         }
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1996,7 +1997,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2018,7 +2019,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2031,7 +2032,7 @@
         OIDC: "OIDC",
     };
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2278,7 +2279,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2325,7 +2326,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2489,7 +2490,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2629,7 +2630,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2720,7 +2721,7 @@
                 }
             }
             // Expand tenant profile into account info based on matching tenant profile and if available matching ID token claims
-            tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims);
+            tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
             return tenantedAccountInfo;
         }
         getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {
@@ -3869,7 +3870,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3969,7 +3970,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3986,7 +3987,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4084,7 +4085,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4121,7 +4122,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4131,7 +4132,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4178,7 +4179,7 @@
     const LOGIN_HINT = "login_hint";
     const DOMAIN_HINT = "domain_hint";
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4262,7 +4263,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4646,7 +4647,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4658,7 +4659,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4668,7 +4669,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4678,7 +4679,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4939,7 +4940,7 @@
         "multiMatchedRT",
     ]);
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5035,7 +5036,7 @@
         };
     };
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5144,7 +5145,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5941,8 +5942,10 @@
          *  AAD Authority - domain/tenantId -> Credentials are cached with realm = tenantId
          *  B2C Authority - domain/{tenantId}?/.../policy -> Credentials are cached with realm = policy
          *  tenantId is downcased because B2C policies can have mixed case but tfp claim is downcased
+         *
+         * Note that we may not have any path segments in certain OIDC scenarios.
          */
-        const tenantId = authorityUrlComponents.PathSegments.slice(-1)[0].toLowerCase();
+        const tenantId = authorityUrlComponents.PathSegments.slice(-1)[0]?.toLowerCase();
         switch (tenantId) {
             case AADAuthorityConstants.COMMON:
             case AADAuthorityConstants.ORGANIZATIONS:
@@ -5977,7 +5980,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6008,7 +6011,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6111,7 +6114,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6137,7 +6140,7 @@
         refreshTokenExpired: refreshTokenExpired
     });
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6224,7 +6227,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6240,7 +6243,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6312,7 +6315,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6397,7 +6400,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6424,7 +6427,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6714,7 +6717,7 @@
             }
             const accountInfo = cacheRecord.account
                 ? updateAccountTenantProfileData(cacheRecord.account.getAccountInfo(), undefined, // tenantProfile optional
-                idTokenClaims)
+                idTokenClaims, cacheRecord.idToken?.secret)
                 : null;
             return {
                 authority: authority.canonicalAuthority,
@@ -6777,7 +6780,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7182,7 +7185,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7389,7 +7392,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7520,7 +7523,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7535,7 +7538,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7543,7 +7546,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7568,7 +7571,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7608,7 +7611,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7666,7 +7669,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7870,7 +7873,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7949,7 +7952,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.7.0 2024-02-07 */
+    /*! @azure/msal-common v14.7.1 2024-02-17 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8935,6 +8938,149 @@
     const LOG_PII_CACHE_KEY = "msal.browser.log.pii";
     const BROWSER_PERF_ENABLED_KEY = "msal.browser.performance.enabled";
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * This file defines functions used by the browser library to perform cryptography operations such as
+     * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
+     */
+    /**
+     * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
+     */
+    // RSA KeyGen Algorithm
+    const PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+    // SHA-256 hashing algorithm
+    const S256_HASH_ALG = "SHA-256";
+    // MOD length for PoP tokens
+    const MODULUS_LENGTH = 2048;
+    // Public Exponent
+    const PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
+    // UUID hex digits
+    const UUID_CHARS = "0123456789abcdef";
+    // Array to store UINT32 random value
+    const UINT32_ARR = new Uint32Array(1);
+    const keygenAlgorithmOptions = {
+        name: PKCS1_V15_KEYGEN_ALG,
+        hash: S256_HASH_ALG,
+        modulusLength: MODULUS_LENGTH,
+        publicExponent: PUBLIC_EXPONENT,
+    };
+    /**
+     * Check whether browser crypto is available.
+     */
+    function validateCryptoAvailable(logger) {
+        if ("crypto" in window) {
+            logger.verbose("BrowserCrypto: modern crypto interface available");
+        }
+        else {
+            logger.error("BrowserCrypto: crypto interface is unavailable");
+            throw createBrowserAuthError(cryptoNonExistent);
+        }
+    }
+    /**
+     * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
+     * @param dataString {string} data string
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string} correlation id
+     */
+    async function sha256Digest(dataString, performanceClient, correlationId) {
+        performanceClient?.addQueueMeasurement(PerformanceEvents.Sha256Digest, correlationId);
+        const encoder = new TextEncoder();
+        const data = encoder.encode(dataString);
+        return window.crypto.subtle.digest(S256_HASH_ALG, data);
+    }
+    /**
+     * Populates buffer with cryptographically random values.
+     * @param dataBuffer
+     */
+    function getRandomValues(dataBuffer) {
+        return window.crypto.getRandomValues(dataBuffer);
+    }
+    /**
+     * Returns random Uint32 value.
+     * @returns {number}
+     */
+    function getRandomUint32() {
+        window.crypto.getRandomValues(UINT32_ARR);
+        return UINT32_ARR[0];
+    }
+    /**
+     * Creates a UUID v7 from the current timestamp.
+     * Implementation relies on the system clock to guarantee increasing order of generated identifiers.
+     * @returns {number}
+     */
+    function createNewGuid() {
+        const currentTimestamp = Date.now();
+        const baseRand = getRandomUint32() * 0x400 + (getRandomUint32() & 0x3ff);
+        // Result byte array
+        const bytes = new Uint8Array(16);
+        // A 12-bit `rand_a` field value
+        const randA = Math.trunc(baseRand / 2 ** 30);
+        // The higher 30 bits of 62-bit `rand_b` field value
+        const randBHi = baseRand & (2 ** 30 - 1);
+        // The lower 32 bits of 62-bit `rand_b` field value
+        const randBLo = getRandomUint32();
+        bytes[0] = currentTimestamp / 2 ** 40;
+        bytes[1] = currentTimestamp / 2 ** 32;
+        bytes[2] = currentTimestamp / 2 ** 24;
+        bytes[3] = currentTimestamp / 2 ** 16;
+        bytes[4] = currentTimestamp / 2 ** 8;
+        bytes[5] = currentTimestamp;
+        bytes[6] = 0x70 | (randA >>> 8);
+        bytes[7] = randA;
+        bytes[8] = 0x80 | (randBHi >>> 24);
+        bytes[9] = randBHi >>> 16;
+        bytes[10] = randBHi >>> 8;
+        bytes[11] = randBHi;
+        bytes[12] = randBLo >>> 24;
+        bytes[13] = randBLo >>> 16;
+        bytes[14] = randBLo >>> 8;
+        bytes[15] = randBLo;
+        let text = "";
+        for (let i = 0; i < bytes.length; i++) {
+            text += UUID_CHARS.charAt(bytes[i] >>> 4);
+            text += UUID_CHARS.charAt(bytes[i] & 0xf);
+            if (i === 3 || i === 5 || i === 7 || i === 9) {
+                text += "-";
+            }
+        }
+        return text;
+    }
+    /**
+     * Generates a keypair based on current keygen algorithm config.
+     * @param extractable
+     * @param usages
+     */
+    async function generateKeyPair(extractable, usages) {
+        return window.crypto.subtle.generateKey(keygenAlgorithmOptions, extractable, usages);
+    }
+    /**
+     * Export key as Json Web Key (JWK)
+     * @param key
+     */
+    async function exportJwk(key) {
+        return window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key);
+    }
+    /**
+     * Imports key as Json Web Key (JWK), can set extractable and usages.
+     * @param key
+     * @param extractable
+     * @param usages
+     */
+    async function importJwk(key, extractable, usages) {
+        return window.crypto.subtle.importKey(KEY_FORMAT_JWK, key, keygenAlgorithmOptions, extractable, usages);
+    }
+    /**
+     * Signs given data with given key
+     * @param key
+     * @param data
+     */
+    async function sign(key, data) {
+        return window.crypto.subtle.sign(keygenAlgorithmOptions, key, data);
+    }
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -9060,6 +9206,13 @@
             catch { }
         }, 10000); // 10s Timeout
     }
+    /**
+     * Wrapper function that creates a UUID v7 from the current timestamp.
+     * @returns {string}
+     */
+    function createGuid() {
+        return createNewGuid();
+    }
 
     var BrowserUtils = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -9069,6 +9222,7 @@
         blockRedirectInIframe: blockRedirectInIframe,
         blockReloadInHiddenIframes: blockReloadInHiddenIframes,
         clearHash: clearHash,
+        createGuid: createGuid,
         getCurrentUri: getCurrentUri,
         getHomepage: getHomepage,
         isInIframe: isInIframe,
@@ -9349,7 +9503,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "3.9.0";
+    const version = "3.10.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9856,149 +10010,6 @@
         return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
     }
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * This file defines functions used by the browser library to perform cryptography operations such as
-     * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
-     */
-    /**
-     * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
-     */
-    // RSA KeyGen Algorithm
-    const PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
-    // SHA-256 hashing algorithm
-    const S256_HASH_ALG = "SHA-256";
-    // MOD length for PoP tokens
-    const MODULUS_LENGTH = 2048;
-    // Public Exponent
-    const PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
-    // UUID hex digits
-    const UUID_CHARS = "0123456789abcdef";
-    // Array to store UINT32 random value
-    const UINT32_ARR = new Uint32Array(1);
-    const keygenAlgorithmOptions = {
-        name: PKCS1_V15_KEYGEN_ALG,
-        hash: S256_HASH_ALG,
-        modulusLength: MODULUS_LENGTH,
-        publicExponent: PUBLIC_EXPONENT,
-    };
-    /**
-     * Check whether browser crypto is available.
-     */
-    function validateCryptoAvailable(logger) {
-        if ("crypto" in window) {
-            logger.verbose("BrowserCrypto: modern crypto interface available");
-        }
-        else {
-            logger.error("BrowserCrypto: crypto interface is unavailable");
-            throw createBrowserAuthError(cryptoNonExistent);
-        }
-    }
-    /**
-     * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
-     * @param dataString {string} data string
-     * @param performanceClient {?IPerformanceClient}
-     * @param correlationId {?string} correlation id
-     */
-    async function sha256Digest(dataString, performanceClient, correlationId) {
-        performanceClient?.addQueueMeasurement(PerformanceEvents.Sha256Digest, correlationId);
-        const encoder = new TextEncoder();
-        const data = encoder.encode(dataString);
-        return window.crypto.subtle.digest(S256_HASH_ALG, data);
-    }
-    /**
-     * Populates buffer with cryptographically random values.
-     * @param dataBuffer
-     */
-    function getRandomValues(dataBuffer) {
-        return window.crypto.getRandomValues(dataBuffer);
-    }
-    /**
-     * Returns random Uint32 value.
-     * @returns {number}
-     */
-    function getRandomUint32() {
-        window.crypto.getRandomValues(UINT32_ARR);
-        return UINT32_ARR[0];
-    }
-    /**
-     * Creates a UUID v7 from the current timestamp.
-     * Implementation relies on the system clock to guarantee increasing order of generated identifiers.
-     * @returns {number}
-     */
-    function createNewGuid() {
-        const currentTimestamp = Date.now();
-        const baseRand = getRandomUint32() * 0x400 + (getRandomUint32() & 0x3ff);
-        // Result byte array
-        const bytes = new Uint8Array(16);
-        // A 12-bit `rand_a` field value
-        const randA = Math.trunc(baseRand / 2 ** 30);
-        // The higher 30 bits of 62-bit `rand_b` field value
-        const randBHi = baseRand & (2 ** 30 - 1);
-        // The lower 32 bits of 62-bit `rand_b` field value
-        const randBLo = getRandomUint32();
-        bytes[0] = currentTimestamp / 2 ** 40;
-        bytes[1] = currentTimestamp / 2 ** 32;
-        bytes[2] = currentTimestamp / 2 ** 24;
-        bytes[3] = currentTimestamp / 2 ** 16;
-        bytes[4] = currentTimestamp / 2 ** 8;
-        bytes[5] = currentTimestamp;
-        bytes[6] = 0x70 | (randA >>> 8);
-        bytes[7] = randA;
-        bytes[8] = 0x80 | (randBHi >>> 24);
-        bytes[9] = randBHi >>> 16;
-        bytes[10] = randBHi >>> 8;
-        bytes[11] = randBHi;
-        bytes[12] = randBLo >>> 24;
-        bytes[13] = randBLo >>> 16;
-        bytes[14] = randBLo >>> 8;
-        bytes[15] = randBLo;
-        let text = "";
-        for (let i = 0; i < bytes.length; i++) {
-            text += UUID_CHARS.charAt(bytes[i] >>> 4);
-            text += UUID_CHARS.charAt(bytes[i] & 0xf);
-            if (i === 3 || i === 5 || i === 7 || i === 9) {
-                text += "-";
-            }
-        }
-        return text;
-    }
-    /**
-     * Generates a keypair based on current keygen algorithm config.
-     * @param extractable
-     * @param usages
-     */
-    async function generateKeyPair(extractable, usages) {
-        return window.crypto.subtle.generateKey(keygenAlgorithmOptions, extractable, usages);
-    }
-    /**
-     * Export key as Json Web Key (JWK)
-     * @param key
-     */
-    async function exportJwk(key) {
-        return window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key);
-    }
-    /**
-     * Imports key as Json Web Key (JWK), can set extractable and usages.
-     * @param key
-     * @param extractable
-     * @param usages
-     */
-    async function importJwk(key, extractable, usages) {
-        return window.crypto.subtle.importKey(KEY_FORMAT_JWK, key, keygenAlgorithmOptions, extractable, usages);
-    }
-    /**
-     * Signs given data with given key
-     * @param key
-     * @param data
-     */
-    async function sign(key, data) {
-        return window.crypto.subtle.sign(keygenAlgorithmOptions, key, data);
-    }
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -12750,6 +12761,7 @@
                 const fullAccount = {
                     ...account,
                     idTokenClaims: result?.idTokenClaims,
+                    idToken: result?.idToken,
                 };
                 return {
                     ...result,
@@ -12851,15 +12863,19 @@
          */
         async handleNativeResponse(response, request, reqTimestamp) {
             this.logger.trace("NativeInteractionClient - handleNativeResponse called.");
-            if (response.account.id !== request.accountId) {
+            // generate identifiers
+            const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
+            const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
+            const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
+                nativeAccountId: request.accountId,
+            })?.homeAccountId;
+            if (homeAccountIdentifier !== cachedhomeAccountId &&
+                response.account.id !== request.accountId) {
                 // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
                 throw createNativeAuthError(userSwitch);
             }
             // Get the preferred_cache domain for the given authority
             const authority = await this.getDiscoveredAuthority(request.authority);
-            // generate identifiers
-            const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
-            const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
             const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, idTokenClaims, base64Decode, response.client_info, undefined, // environment
             idTokenClaims.tid, undefined, // auth code payload
             response.account.id, this.logger);
@@ -12955,7 +12971,14 @@
                 idTokenClaims.tid ||
                 Constants.EMPTY_STRING;
             const accountInfo = updateAccountTenantProfileData(accountEntity.getAccountInfo(), undefined, // tenantProfile optional
-            idTokenClaims);
+            idTokenClaims, response.id_token);
+            /**
+             * In pairwise broker flows, this check prevents the broker's native account id
+             * from being returned over the embedded app's account id.
+             */
+            if (accountInfo.nativeAccountId !== response.account.id) {
+                accountInfo.nativeAccountId = response.account.id;
+            }
             // generate PoP token as needed
             const responseAccessToken = await this.generatePopAccessToken(response, request);
             const tokenType = request.tokenType === AuthenticationScheme.POP
@@ -14617,17 +14640,20 @@
                 (!request.account || !request.account.username)) {
                 this.logger.warning("No user hint provided. The authorization server may need more information to complete this request.");
             }
-            // Check that prompt is set to none or no_session, throw error if it is set to anything else.
-            if (request.prompt &&
-                request.prompt !== PromptValue.NONE &&
-                request.prompt !== PromptValue.NO_SESSION) {
-                throw createBrowserAuthError(silentPromptValueError);
+            // Check the prompt value
+            const inputRequest = { ...request };
+            if (inputRequest.prompt) {
+                if (inputRequest.prompt !== PromptValue.NONE &&
+                    inputRequest.prompt !== PromptValue.NO_SESSION) {
+                    this.logger.warning(`SilentIframeClient. Replacing invalid prompt ${inputRequest.prompt} with ${PromptValue.NONE}`);
+                    inputRequest.prompt = PromptValue.NONE;
+                }
+            }
+            else {
+                inputRequest.prompt = PromptValue.NONE;
             }
             // Create silent request
-            const silentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)({
-                ...request,
-                prompt: request.prompt || PromptValue.NONE,
-            }, exports.InteractionType.Silent);
+            const silentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)(inputRequest, exports.InteractionType.Silent);
             preconnect(silentRequest.authority);
             const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
             try {
@@ -17621,7 +17647,7 @@
             }, intFields);
         }
         generateId() {
-            return window.crypto.randomUUID();
+            return createNewGuid();
         }
         getPageVisibility() {
             return document.visibilityState?.toString() || null;