@azure/msal-browser 3.9.0 → 3.11.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.9.0 2024-02-07 */
+/*! @azure/msal-browser v3.11.0 2024-03-22 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -297,7 +297,7 @@ const JsonWebTokenTypes = {
     Pop: "pop",
 };
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -314,7 +314,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -363,7 +363,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -461,7 +461,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -713,7 +713,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -746,7 +746,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -937,12 +937,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.7.0";
+const version$1 = "14.8.0";
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -962,7 +962,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1023,7 +1023,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1060,7 +1060,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1387,7 +1387,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1441,7 +1441,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1579,7 +1579,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1676,7 +1676,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1876,7 +1876,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1916,7 +1916,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1954,7 +1954,7 @@ function buildTenantProfileFromIdTokenClaims(homeAccountId, idTokenClaims) {
  * @param idTokenClaims
  * @returns
  */
-function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims) {
+function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims, idTokenSecret) {
     let updatedAccountInfo = baseAccountInfo;
     // Tenant Profile overrides passed in account info
     if (tenantProfile) {
@@ -1971,13 +1971,14 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
             ...updatedAccountInfo,
             ...claimsSourcedTenantProfile,
             idTokenClaims: idTokenClaims,
+            idToken: idTokenSecret,
         };
         return updatedAccountInfo;
     }
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1992,7 +1993,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2014,7 +2015,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2027,7 +2028,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2274,7 +2275,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2321,7 +2322,7 @@ function getDeserializedResponse(responseString) {
     return null;
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2485,7 +2486,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2625,7 +2626,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2716,7 +2717,7 @@ class CacheManager {
             }
         }
         // Expand tenant profile into account info based on matching tenant profile and if available matching ID token claims
-        tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims);
+        tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
         return tenantedAccountInfo;
     }
     getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {
@@ -3032,14 +3033,6 @@ class CacheManager {
      * @param filter
      */
     getAppMetadataFilteredBy(filter) {
-        return this.getAppMetadataFilteredByInternal(filter.environment, filter.clientId);
-    }
-    /**
-     * Support function to help match appMetadata
-     * @param environment
-     * @param clientId
-     */
-    getAppMetadataFilteredByInternal(environment, clientId) {
         const allCacheKeys = this.getKeys();
         const matchingAppMetadata = {};
         allCacheKeys.forEach((cacheKey) => {
@@ -3052,10 +3045,12 @@ class CacheManager {
             if (!entity) {
                 return;
             }
-            if (!!environment && !this.matchEnvironment(entity, environment)) {
+            if (!!filter.environment &&
+                !this.matchEnvironment(entity, filter.environment)) {
                 return;
             }
-            if (!!clientId && !this.matchClientId(entity, clientId)) {
+            if (!!filter.clientId &&
+                !this.matchClientId(entity, filter.clientId)) {
                 return;
             }
             matchingAppMetadata[cacheKey] = entity;
@@ -3842,9 +3837,6 @@ class DefaultStorageClass extends CacheManager {
     removeItem() {
         throw createClientAuthError(methodNotImplemented);
     }
-    containsKey() {
-        throw createClientAuthError(methodNotImplemented);
-    }
     getKeys() {
         throw createClientAuthError(methodNotImplemented);
     }
@@ -3865,7 +3857,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3965,7 +3957,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3982,7 +3974,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4080,7 +4072,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4117,7 +4109,7 @@ class NetworkManager {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4127,7 +4119,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4174,7 +4166,7 @@ const SID = "sid";
 const LOGIN_HINT = "login_hint";
 const DOMAIN_HINT = "domain_hint";
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4258,7 +4250,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4642,7 +4634,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4654,7 +4646,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4664,7 +4656,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4674,7 +4666,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4909,6 +4901,219 @@ const PerformanceEvents = {
     Sha256Digest: "sha256Digest",
     GetRandomValues: "getRandomValues",
 };
+const PerformanceEventAbbreviations = new Map([
+    [PerformanceEvents.AcquireTokenByCode, "ATByCode"],
+    [PerformanceEvents.AcquireTokenByRefreshToken, "ATByRT"],
+    [PerformanceEvents.AcquireTokenSilent, "ATS"],
+    [PerformanceEvents.AcquireTokenSilentAsync, "ATSAsync"],
+    [PerformanceEvents.AcquireTokenPopup, "ATPopup"],
+    [PerformanceEvents.AcquireTokenRedirect, "ATRedirect"],
+    [
+        PerformanceEvents.CryptoOptsGetPublicKeyThumbprint,
+        "CryptoGetPKThumb",
+    ],
+    [PerformanceEvents.CryptoOptsSignJwt, "CryptoSignJwt"],
+    [PerformanceEvents.SilentCacheClientAcquireToken, "SltCacheClientAT"],
+    [PerformanceEvents.SilentIframeClientAcquireToken, "SltIframeClientAT"],
+    [PerformanceEvents.SilentRefreshClientAcquireToken, "SltRClientAT"],
+    [PerformanceEvents.SsoSilent, "SsoSlt"],
+    [
+        PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+        "StdIntClientGetDiscAuth",
+    ],
+    [
+        PerformanceEvents.FetchAccountIdWithNativeBroker,
+        "FetchAccIdWithNtvBroker",
+    ],
+    [
+        PerformanceEvents.NativeInteractionClientAcquireToken,
+        "NtvIntClientAT",
+    ],
+    [
+        PerformanceEvents.BaseClientCreateTokenRequestHeaders,
+        "BaseClientCreateTReqHead",
+    ],
+    [
+        PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint,
+        "RTClientExecPost",
+    ],
+    [
+        PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint,
+        "AuthCodeClientExecPost",
+    ],
+    [PerformanceEvents.BrokerHandhshake, "BrokerHandshake"],
+    [
+        PerformanceEvents.AcquireTokenByRefreshTokenInBroker,
+        "ATByRTInBroker",
+    ],
+    [PerformanceEvents.AcquireTokenByBroker, "ATByBroker"],
+    [
+        PerformanceEvents.RefreshTokenClientExecuteTokenRequest,
+        "RTClientExecTReq",
+    ],
+    [PerformanceEvents.RefreshTokenClientAcquireToken, "RTClientAT"],
+    [
+        PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken,
+        "RTClientATWithCachedRT",
+    ],
+    [
+        PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken,
+        "RTClientATByRT",
+    ],
+    [
+        PerformanceEvents.RefreshTokenClientCreateTokenRequestBody,
+        "RTClientCreateTReqBody",
+    ],
+    [PerformanceEvents.AcquireTokenFromCache, "ATFromCache"],
+    [
+        PerformanceEvents.SilentFlowClientAcquireCachedToken,
+        "SltFlowClientATCached",
+    ],
+    [
+        PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord,
+        "SltFlowClientGenResFromCache",
+    ],
+    [PerformanceEvents.AcquireTokenBySilentIframe, "ATBySltIframe"],
+    [PerformanceEvents.InitializeBaseRequest, "InitBaseReq"],
+    [PerformanceEvents.InitializeSilentRequest, "InitSltReq"],
+    [
+        PerformanceEvents.InitializeClientApplication,
+        "InitClientApplication",
+    ],
+    [PerformanceEvents.SilentIframeClientTokenHelper, "SIClientTHelper"],
+    [
+        PerformanceEvents.SilentHandlerInitiateAuthRequest,
+        "SHandlerInitAuthReq",
+    ],
+    [
+        PerformanceEvents.SilentHandlerMonitorIframeForHash,
+        "SltHandlerMonitorIframeForHash",
+    ],
+    [PerformanceEvents.SilentHandlerLoadFrame, "SHandlerLoadFrame"],
+    [PerformanceEvents.SilentHandlerLoadFrameSync, "SHandlerLoadFrameSync"],
+    [
+        PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+        "StdIntClientCreateAuthCodeClient",
+    ],
+    [
+        PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+        "StdIntClientGetClientConf",
+    ],
+    [
+        PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
+        "StdIntClientInitAuthReq",
+    ],
+    [
+        PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
+        "StdIntClientInitAuthCodeReq",
+    ],
+    [PerformanceEvents.GetAuthCodeUrl, "GetAuthCodeUrl"],
+    [
+        PerformanceEvents.HandleCodeResponseFromServer,
+        "HandleCodeResFromServer",
+    ],
+    [PerformanceEvents.HandleCodeResponse, "HandleCodeResp"],
+    [PerformanceEvents.UpdateTokenEndpointAuthority, "UpdTEndpointAuth"],
+    [PerformanceEvents.AuthClientAcquireToken, "AuthClientAT"],
+    [PerformanceEvents.AuthClientExecuteTokenRequest, "AuthClientExecTReq"],
+    [
+        PerformanceEvents.AuthClientCreateTokenRequestBody,
+        "AuthClientCreateTReqBody",
+    ],
+    [
+        PerformanceEvents.AuthClientCreateQueryString,
+        "AuthClientCreateQueryStr",
+    ],
+    [PerformanceEvents.PopTokenGenerateCnf, "PopTGenCnf"],
+    [PerformanceEvents.PopTokenGenerateKid, "PopTGenKid"],
+    [PerformanceEvents.HandleServerTokenResponse, "HandleServerTRes"],
+    [PerformanceEvents.DeserializeResponse, "DeserializeRes"],
+    [
+        PerformanceEvents.AuthorityFactoryCreateDiscoveredInstance,
+        "AuthFactCreateDiscInst",
+    ],
+    [
+        PerformanceEvents.AuthorityResolveEndpointsAsync,
+        "AuthResolveEndpointsAsync",
+    ],
+    [
+        PerformanceEvents.AuthorityResolveEndpointsFromLocalSources,
+        "AuthResolveEndpointsFromLocal",
+    ],
+    [
+        PerformanceEvents.AuthorityGetCloudDiscoveryMetadataFromNetwork,
+        "AuthGetCDMetaFromNet",
+    ],
+    [
+        PerformanceEvents.AuthorityUpdateCloudDiscoveryMetadata,
+        "AuthUpdCDMeta",
+    ],
+    [
+        PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork,
+        "AuthUpdCDMetaFromNet",
+    ],
+    [
+        PerformanceEvents.AuthorityUpdateEndpointMetadata,
+        "AuthUpdEndpointMeta",
+    ],
+    [
+        PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation,
+        "AuthUpdMetaWithRegInfo",
+    ],
+    [PerformanceEvents.RegionDiscoveryDetectRegion, "RegDiscDetectReg"],
+    [
+        PerformanceEvents.RegionDiscoveryGetRegionFromIMDS,
+        "RegDiscGetRegFromIMDS",
+    ],
+    [
+        PerformanceEvents.RegionDiscoveryGetCurrentVersion,
+        "RegDiscGetCurrentVer",
+    ],
+    [PerformanceEvents.AcquireTokenByCodeAsync, "ATByCodeAsync"],
+    [
+        PerformanceEvents.GetEndpointMetadataFromNetwork,
+        "GetEndpointMetaFromNet",
+    ],
+    [
+        PerformanceEvents.GetCloudDiscoveryMetadataFromNetworkMeasurement,
+        "GetCDMetaFromNet",
+    ],
+    [
+        PerformanceEvents.HandleRedirectPromiseMeasurement,
+        "HandleRedirectPromise",
+    ],
+    [
+        PerformanceEvents.HandleNativeRedirectPromiseMeasurement,
+        "HandleNtvRedirectPromise",
+    ],
+    [
+        PerformanceEvents.UpdateCloudDiscoveryMetadataMeasurement,
+        "UpdateCDMeta",
+    ],
+    [
+        PerformanceEvents.UsernamePasswordClientAcquireToken,
+        "UserPassClientAT",
+    ],
+    [
+        PerformanceEvents.NativeMessageHandlerHandshake,
+        "NtvMsgHandlerHandshake",
+    ],
+    [PerformanceEvents.NativeGenerateAuthResult, "NtvGenAuthRes"],
+    [PerformanceEvents.RemoveHiddenIframe, "RemoveHiddenIframe"],
+    [
+        PerformanceEvents.ClearTokensAndKeysWithClaims,
+        "ClearTAndKeysWithClaims",
+    ],
+    [PerformanceEvents.CacheManagerGetRefreshToken, "CacheManagerGetRT"],
+    [PerformanceEvents.GeneratePkceCodes, "GenPkceCodes"],
+    [PerformanceEvents.GenerateCodeVerifier, "GenCodeVerifier"],
+    [
+        PerformanceEvents.GenerateCodeChallengeFromVerifier,
+        "GenCodeChallengeFromVerifier",
+    ],
+    [PerformanceEvents.Sha256Digest, "Sha256Digest"],
+    [PerformanceEvents.GetRandomValues, "GetRandomValues"],
+]);
 /**
  * State of the performance event.
  *
@@ -4935,7 +5140,7 @@ const IntFields = new Set([
     "multiMatchedRT",
 ]);
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4979,7 +5184,7 @@ const invoke = (callback, eventName, logger, telemetryClient, correlationId) =>
             }
             inProgressEvent?.end({
                 success: false,
-            });
+            }, e);
             throw e;
         }
     };
@@ -5025,13 +5230,13 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
             }
             inProgressEvent?.end({
                 success: false,
-            });
+            }, e);
             throw e;
         });
     };
 };
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5140,7 +5345,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5937,8 +6142,10 @@ function getTenantFromAuthorityString(authority) {
      *  AAD Authority - domain/tenantId -> Credentials are cached with realm = tenantId
      *  B2C Authority - domain/{tenantId}?/.../policy -> Credentials are cached with realm = policy
      *  tenantId is downcased because B2C policies can have mixed case but tfp claim is downcased
+     *
+     * Note that we may not have any path segments in certain OIDC scenarios.
      */
-    const tenantId = authorityUrlComponents.PathSegments.slice(-1)[0].toLowerCase();
+    const tenantId = authorityUrlComponents.PathSegments.slice(-1)[0]?.toLowerCase();
     switch (tenantId) {
         case AADAuthorityConstants.COMMON:
         case AADAuthorityConstants.ORGANIZATIONS:
@@ -5973,7 +6180,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6004,7 +6211,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6107,7 +6314,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6133,7 +6340,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6220,7 +6427,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6236,7 +6443,7 @@ class CacheRecord {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6308,7 +6515,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6393,7 +6600,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6420,7 +6627,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6710,7 +6917,7 @@ class ResponseHandler {
         }
         const accountInfo = cacheRecord.account
             ? updateAccountTenantProfileData(cacheRecord.account.getAccountInfo(), undefined, // tenantProfile optional
-            idTokenClaims)
+            idTokenClaims, cacheRecord.idToken?.secret)
             : null;
         return {
             authority: authority.canonicalAuthority,
@@ -6773,7 +6980,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClai
     return baseAccount;
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7178,7 +7385,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7385,7 +7592,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7403,7 +7610,12 @@ class SilentFlowClient extends BaseClient {
      */
     async acquireToken(request) {
         try {
-            const [authResponse, cacheOutcome] = await this.acquireCachedToken(request);
+            const [authResponse, cacheOutcome] = await this.acquireCachedToken({
+                ...request,
+                scopes: request.scopes?.length
+                    ? request.scopes
+                    : [...OIDC_DEFAULT_SCOPES],
+            });
             // if the token is not expired but must be refreshed; get a new one in the background
             if (cacheOutcome === CacheOutcome.PROACTIVELY_REFRESHED) {
                 this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.");
@@ -7516,7 +7728,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7531,7 +7743,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7539,7 +7751,7 @@ const StubbedNetworkModule = {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7564,7 +7776,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7604,7 +7816,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7662,7 +7874,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7866,7 +8078,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7945,12 +8157,168 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.7.0 2024-02-07 */
+/*! @azure/msal-common v14.8.0 2024-03-22 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Starts context by adding payload to the stack
+ * @param event {PerformanceEvent}
+ * @param abbreviations {Map<string, string>} event name abbreviations
+ * @param stack {?PerformanceEventStackedContext[]} stack
+ */
+function startContext(event, abbreviations, stack) {
+    if (!stack) {
+        return;
+    }
+    stack.push({
+        name: abbreviations.get(event.name) || event.name,
+    });
+}
+/**
+ * Ends context by removing payload from the stack and returning parent or self, if stack is empty, payload
+ *
+ * @param event {PerformanceEvent}
+ * @param abbreviations {Map<string, string>} event name abbreviations
+ * @param stack {?PerformanceEventStackedContext[]} stack
+ * @param error {?unknown} error
+ */
+function endContext(event, abbreviations, stack, error) {
+    if (!stack?.length) {
+        return;
+    }
+    const peek = (stack) => {
+        return stack.length ? stack[stack.length - 1] : undefined;
+    };
+    const abbrEventName = abbreviations.get(event.name) || event.name;
+    const top = peek(stack);
+    if (top?.name !== abbrEventName) {
+        return;
+    }
+    const current = stack?.pop();
+    if (!current) {
+        return;
+    }
+    const errorCode = error instanceof AuthError
+        ? error.errorCode
+        : error instanceof Error
+            ? error.name
+            : undefined;
+    const subErr = error instanceof AuthError ? error.subError : undefined;
+    if (errorCode && current.childErr !== errorCode) {
+        current.err = errorCode;
+        if (subErr) {
+            current.subErr = subErr;
+        }
+    }
+    delete current.name;
+    delete current.childErr;
+    const context = {
+        ...current,
+        dur: event.durationMs,
+    };
+    if (!event.success) {
+        context.fail = 1;
+    }
+    const parent = peek(stack);
+    if (!parent) {
+        return { [abbrEventName]: context };
+    }
+    if (errorCode) {
+        parent.childErr = errorCode;
+    }
+    let childName;
+    if (!parent[abbrEventName]) {
+        childName = abbrEventName;
+    }
+    else {
+        const siblings = Object.keys(parent).filter((key) => key.startsWith(abbrEventName)).length;
+        childName = `${abbrEventName}_${siblings + 1}`;
+    }
+    parent[childName] = context;
+    return parent;
+}
+/**
+ * Adds error name and stack trace to the telemetry event
+ * @param error {Error}
+ * @param logger {Logger}
+ * @param event {PerformanceEvent}
+ * @param stackMaxSize {number} max error stack size to capture
+ */
+function addError(error, logger, event, stackMaxSize = 5) {
+    if (!(error instanceof Error)) {
+        logger.trace("PerformanceClient.addErrorStack: Input error is not instance of Error", event.correlationId);
+        return;
+    }
+    else if (error instanceof AuthError) {
+        event.errorCode = error.errorCode;
+        event.subErrorCode = error.subError;
+        return;
+    }
+    else if (event.errorStack?.length) {
+        logger.trace("PerformanceClient.addErrorStack: Stack already exist", event.correlationId);
+        return;
+    }
+    else if (!error.stack?.length) {
+        logger.trace("PerformanceClient.addErrorStack: Input stack is empty", event.correlationId);
+        return;
+    }
+    if (error.stack) {
+        event.errorStack = compactStack(error.stack, stackMaxSize);
+    }
+    event.errorName = error.name;
+}
+/**
+ * Compacts error stack into array by fetching N first entries
+ * @param stack {string} error stack
+ * @param stackMaxSize {number} max error stack size to capture
+ * @returns {string[]}
+ */
+function compactStack(stack, stackMaxSize) {
+    if (stackMaxSize < 0) {
+        return [];
+    }
+    const stackArr = stack.split("\n") || [];
+    if (stackArr.length < 2) {
+        return [];
+    }
+    const res = [];
+    // Get top N stack lines
+    for (
+    // Skip first line as it may contain PII data
+    let ix = Math.max(stackArr.length - stackMaxSize - 1, 1); ix < stackArr.length; ix++) {
+        const line = stackArr[ix];
+        if (res.length >= stackMaxSize) {
+            break;
+        }
+        res.push(compactStackLine(line));
+    }
+    return res;
+}
+/**
+ * Compacts error stack line by shortening file path
+ * Example: https://localhost/msal-common/src/authority/Authority.js:100:1 -> Authority.js:100:1
+ * @param line {string} stack line
+ * @returns {string}
+ */
+function compactStackLine(line) {
+    const filePathIx = line.lastIndexOf(" ") + 1;
+    if (filePathIx < 1) {
+        return line;
+    }
+    const filePath = line.substring(filePathIx);
+    let fileNameIx = filePath.lastIndexOf("/");
+    fileNameIx = fileNameIx < 0 ? filePath.lastIndexOf("\\") : fileNameIx;
+    if (fileNameIx >= 0) {
+        return (line.substring(0, filePathIx) +
+            "(" +
+            filePath.substring(fileNameIx + 1) +
+            (filePath.charAt(filePath.length - 1) === ")" ? "" : ")")).trimStart();
+    }
+    return line.trimStart();
+}
 class PerformanceClient {
     /**
      * Creates an instance of PerformanceClient,
@@ -7964,8 +8332,9 @@ class PerformanceClient {
      * @param {string} libraryVersion Version of the library
      * @param {ApplicationTelemetry} applicationTelemetry application name and version
      * @param {Set<String>} intFields integer fields to be truncated
+     * @param {Map<string, string>} abbreviations event name abbreviations
      */
-    constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry, intFields) {
+    constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry, intFields, abbreviations) {
         this.authority = authority;
         this.libraryName = libraryName;
         this.libraryVersion = libraryVersion;
@@ -7974,12 +8343,17 @@ class PerformanceClient {
         this.logger = logger;
         this.callbacks = new Map();
         this.eventsByCorrelationId = new Map();
+        this.eventStack = new Map();
         this.queueMeasurements = new Map();
         this.preQueueTimeByCorrelationId = new Map();
         this.intFields = intFields || new Set();
         for (const item of IntFields) {
             this.intFields.add(item);
         }
+        this.abbreviations = abbreviations || new Map();
+        for (const [key, value] of PerformanceEventAbbreviations) {
+            this.abbreviations.set(key, value);
+        }
     }
     /**
      * Starts and returns an platform-specific implementation of IPerformanceMeasurement.
@@ -8109,15 +8483,16 @@ class PerformanceClient {
         };
         // Store in progress events so they can be discarded if not ended properly
         this.cacheEventByCorrelationId(inProgressEvent);
+        startContext(inProgressEvent, this.abbreviations, this.eventStack.get(eventCorrelationId));
         // Return the event and functions the caller can use to properly end/flush the measurement
         return {
-            end: (event) => {
+            end: (event, error) => {
                 return this.endMeasurement({
                     // Initial set of event properties
                     ...inProgressEvent,
                     // Properties set when event ends
                     ...event,
-                });
+                }, error);
             },
             discard: () => {
                 return this.discardMeasurements(inProgressEvent.correlationId);
@@ -8139,10 +8514,10 @@ class PerformanceClient {
      * otherwise.
      *
      * @param {PerformanceEvent} event
-     * @param {IPerformanceMeasurement} measurement
+     * @param {unknown} error
      * @returns {(PerformanceEvent | null)}
      */
-    endMeasurement(event) {
+    endMeasurement(event, error) {
         const rootEvent = this.eventsByCorrelationId.get(event.correlationId);
         if (!rootEvent) {
             this.logger.trace(`PerformanceClient: Measurement not found for ${event.eventId}`, event.correlationId);
@@ -8154,6 +8529,8 @@ class PerformanceClient {
             totalQueueCount: 0,
             manuallyCompletedCount: 0,
         };
+        event.durationMs = Math.round(event.durationMs || this.getDurationMs(event.startTimeMs));
+        const context = endContext(event, this.abbreviations, this.eventStack.get(rootEvent.correlationId), error);
         if (isRoot) {
             queueInfo = this.getQueueInfo(event.correlationId);
             this.discardCache(rootEvent.correlationId);
@@ -8161,13 +8538,15 @@ class PerformanceClient {
         else {
             rootEvent.incompleteSubMeasurements?.delete(event.eventId);
         }
-        const durationMs = event.durationMs || this.getDurationMs(event.startTimeMs);
-        this.logger.trace(`PerformanceClient: Performance measurement ended for ${event.name}: ${durationMs} ms`, event.correlationId);
+        this.logger.trace(`PerformanceClient: Performance measurement ended for ${event.name}: ${event.durationMs} ms`, event.correlationId);
         // Add sub-measurement attribute to root event.
         if (!isRoot) {
-            rootEvent[event.name + "DurationMs"] = Math.floor(durationMs);
+            rootEvent[event.name + "DurationMs"] = Math.floor(event.durationMs);
             return { ...rootEvent };
         }
+        if (error) {
+            addError(error, this.logger, rootEvent);
+        }
         let finalEvent = { ...rootEvent, ...event };
         let incompleteSubsCount = 0;
         // Incomplete sub-measurements are discarded. They are likely an instrumentation bug that should be fixed.
@@ -8178,12 +8557,12 @@ class PerformanceClient {
         finalEvent.incompleteSubMeasurements = undefined;
         finalEvent = {
             ...finalEvent,
-            durationMs: Math.round(durationMs),
             queuedTimeMs: queueInfo.totalQueueTime,
             queuedCount: queueInfo.totalQueueCount,
             queuedManuallyCompletedCount: queueInfo.manuallyCompletedCount,
             status: PerformanceEventStatus.Completed,
             incompleteSubsCount,
+            context,
         };
         this.truncateIntegralFields(finalEvent);
         this.emitEvents([finalEvent], event.correlationId);
@@ -8253,6 +8632,7 @@ class PerformanceClient {
         else {
             this.logger.trace(`PerformanceClient: Performance measurement for ${event.name} started`, event.correlationId);
             this.eventsByCorrelationId.set(event.correlationId, { ...event });
+            this.eventStack.set(event.correlationId, []);
         }
     }
     getQueueInfo(correlationId) {
@@ -8294,6 +8674,8 @@ class PerformanceClient {
         this.queueMeasurements.delete(correlationId);
         this.logger.trace("PerformanceClient: Pre-queue times discarded", correlationId);
         this.preQueueTimeByCorrelationId.delete(correlationId);
+        this.logger.trace("PerformanceClient: Event stack discarded", correlationId);
+        this.eventStack.delete(correlationId);
     }
     /**
      * Registers a callback function to receive performance events.
@@ -8339,7 +8721,6 @@ class PerformanceClient {
     /**
      * Enforce truncation of integral fields in performance event.
      * @param {PerformanceEvent} event performance event to update.
-     * @param {Set<string>} intFields integral fields.
      */
     truncateIntegralFields(event) {
         this.intFields.forEach((key) => {
@@ -8936,114 +9317,391 @@ const BROWSER_PERF_ENABLED_KEY = "msal.browser.performance.enabled";
  * Licensed under the MIT License.
  */
 /**
- * Clears hash from window url.
+ * Class which exposes APIs to encode plaintext to base64 encoded string. See here for implementation details:
+ * https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding#Solution_2_%E2%80%93_JavaScript's_UTF-16_%3E_UTF-8_%3E_base64
  */
-function clearHash(contentWindow) {
-    // Office.js sets history.replaceState to null
-    contentWindow.location.hash = "";
-    if (typeof contentWindow.history.replaceState === "function") {
-        // Full removes "#" from url
-        contentWindow.history.replaceState(null, "", `${contentWindow.location.origin}${contentWindow.location.pathname}${contentWindow.location.search}`);
-    }
-}
 /**
- * Replaces current hash with hash from provided url
+ * Returns URL Safe b64 encoded string from a plaintext string.
+ * @param input
  */
-function replaceHash(url) {
-    const urlParts = url.split("#");
-    urlParts.shift(); // Remove part before the hash
-    window.location.hash = urlParts.length > 0 ? urlParts.join("#") : "";
+function urlEncode(input) {
+    return encodeURIComponent(base64Encode(input)
+        .replace(/=/g, "")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_"));
 }
 /**
- * Returns boolean of whether the current window is in an iframe or not.
+ * Returns URL Safe b64 encoded string from an int8Array.
+ * @param inputArr
  */
-function isInIframe() {
-    return window.parent !== window;
+function urlEncodeArr(inputArr) {
+    return base64EncArr(inputArr)
+        .replace(/=/g, "")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_");
 }
 /**
- * Returns boolean of whether or not the current window is a popup opened by msal
+ * Returns b64 encoded string from plaintext string.
+ * @param input
  */
-function isInPopup() {
-    return (typeof window !== "undefined" &&
-        !!window.opener &&
-        window.opener !== window &&
-        typeof window.name === "string" &&
-        window.name.indexOf(`${BrowserConstants.POPUP_NAME_PREFIX}.`) === 0);
+function base64Encode(input) {
+    return base64EncArr(new TextEncoder().encode(input));
 }
-// #endregion
 /**
- * Returns current window URL as redirect uri
+ * Base64 encode byte array
+ * @param aBytes
  */
-function getCurrentUri() {
-    return window.location.href.split("?")[0].split("#")[0];
+function base64EncArr(aBytes) {
+    const binString = Array.from(aBytes, (x) => String.fromCodePoint(x)).join("");
+    return btoa(binString);
 }
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
 /**
- * Gets the homepage url for the current window location.
+ * This file defines functions used by the browser library to perform cryptography operations such as
+ * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
  */
-function getHomepage() {
-    const currentUrl = new UrlString(window.location.href);
-    const urlComponents = currentUrl.getUrlComponents();
-    return `${urlComponents.Protocol}//${urlComponents.HostNameAndPort}/`;
-}
 /**
- * Throws error if we have completed an auth and are
- * attempting another auth request inside an iframe.
+ * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
  */
-function blockReloadInHiddenIframes() {
-    const isResponseHash = UrlString.hashContainsKnownProperties(window.location.hash);
-    // return an error if called from the hidden iframe created by the msal js silent calls
-    if (isResponseHash && isInIframe()) {
-        throw createBrowserAuthError(blockIframeReload);
-    }
-}
+// RSA KeyGen Algorithm
+const PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+// SHA-256 hashing algorithm
+const S256_HASH_ALG = "SHA-256";
+// MOD length for PoP tokens
+const MODULUS_LENGTH = 2048;
+// Public Exponent
+const PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
+// UUID hex digits
+const UUID_CHARS = "0123456789abcdef";
+// Array to store UINT32 random value
+const UINT32_ARR = new Uint32Array(1);
+const keygenAlgorithmOptions = {
+    name: PKCS1_V15_KEYGEN_ALG,
+    hash: S256_HASH_ALG,
+    modulusLength: MODULUS_LENGTH,
+    publicExponent: PUBLIC_EXPONENT,
+};
 /**
- * Block redirect operations in iframes unless explicitly allowed
- * @param interactionType Interaction type for the request
- * @param allowRedirectInIframe Config value to allow redirects when app is inside an iframe
+ * Check whether browser crypto is available.
  */
-function blockRedirectInIframe(interactionType, allowRedirectInIframe) {
-    const isIframedApp = isInIframe();
-    if (interactionType === exports.InteractionType.Redirect &&
-        isIframedApp &&
-        !allowRedirectInIframe) {
-        // If we are not in top frame, we shouldn't redirect. This is also handled by the service.
-        throw createBrowserAuthError(redirectInIframe);
+function validateCryptoAvailable(logger) {
+    if ("crypto" in window) {
+        logger.verbose("BrowserCrypto: modern crypto interface available");
+    }
+    else {
+        logger.error("BrowserCrypto: crypto interface is unavailable");
+        throw createBrowserAuthError(cryptoNonExistent);
     }
 }
 /**
- * Block redirectUri loaded in popup from calling AcquireToken APIs
+ * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
+ * @param dataString {string} data string
+ * @param performanceClient {?IPerformanceClient}
+ * @param correlationId {?string} correlation id
  */
-function blockAcquireTokenInPopups() {
-    // Popups opened by msal popup APIs are given a name that starts with "msal."
-    if (isInPopup()) {
-        throw createBrowserAuthError(blockNestedPopups);
-    }
+async function sha256Digest(dataString, performanceClient, correlationId) {
+    performanceClient?.addQueueMeasurement(PerformanceEvents.Sha256Digest, correlationId);
+    const encoder = new TextEncoder();
+    const data = encoder.encode(dataString);
+    return window.crypto.subtle.digest(S256_HASH_ALG, data);
 }
 /**
- * Throws error if token requests are made in non-browser environment
- * @param isBrowserEnvironment Flag indicating if environment is a browser.
+ * Populates buffer with cryptographically random values.
+ * @param dataBuffer
  */
-function blockNonBrowserEnvironment(isBrowserEnvironment) {
-    if (!isBrowserEnvironment) {
-        throw createBrowserAuthError(nonBrowserEnvironment);
-    }
+function getRandomValues(dataBuffer) {
+    return window.crypto.getRandomValues(dataBuffer);
 }
 /**
- * Throws error if initialize hasn't been called
- * @param initialized
+ * Returns random Uint32 value.
+ * @returns {number}
  */
-function blockAPICallsBeforeInitialize(initialized) {
-    if (!initialized) {
-        throw createBrowserAuthError(uninitializedPublicClientApplication);
-    }
+function getRandomUint32() {
+    window.crypto.getRandomValues(UINT32_ARR);
+    return UINT32_ARR[0];
 }
 /**
- * Adds a preconnect link element to the header which begins DNS resolution and SSL connection in anticipation of the /token request
- * @param loginDomain Authority domain, including https protocol e.g. https://login.microsoftonline.com
- * @returns
+ * Creates a UUID v7 from the current timestamp.
+ * Implementation relies on the system clock to guarantee increasing order of generated identifiers.
+ * @returns {number}
  */
-function preconnect(authority) {
-    const link = document.createElement("link");
+function createNewGuid() {
+    const currentTimestamp = Date.now();
+    const baseRand = getRandomUint32() * 0x400 + (getRandomUint32() & 0x3ff);
+    // Result byte array
+    const bytes = new Uint8Array(16);
+    // A 12-bit `rand_a` field value
+    const randA = Math.trunc(baseRand / 2 ** 30);
+    // The higher 30 bits of 62-bit `rand_b` field value
+    const randBHi = baseRand & (2 ** 30 - 1);
+    // The lower 32 bits of 62-bit `rand_b` field value
+    const randBLo = getRandomUint32();
+    bytes[0] = currentTimestamp / 2 ** 40;
+    bytes[1] = currentTimestamp / 2 ** 32;
+    bytes[2] = currentTimestamp / 2 ** 24;
+    bytes[3] = currentTimestamp / 2 ** 16;
+    bytes[4] = currentTimestamp / 2 ** 8;
+    bytes[5] = currentTimestamp;
+    bytes[6] = 0x70 | (randA >>> 8);
+    bytes[7] = randA;
+    bytes[8] = 0x80 | (randBHi >>> 24);
+    bytes[9] = randBHi >>> 16;
+    bytes[10] = randBHi >>> 8;
+    bytes[11] = randBHi;
+    bytes[12] = randBLo >>> 24;
+    bytes[13] = randBLo >>> 16;
+    bytes[14] = randBLo >>> 8;
+    bytes[15] = randBLo;
+    let text = "";
+    for (let i = 0; i < bytes.length; i++) {
+        text += UUID_CHARS.charAt(bytes[i] >>> 4);
+        text += UUID_CHARS.charAt(bytes[i] & 0xf);
+        if (i === 3 || i === 5 || i === 7 || i === 9) {
+            text += "-";
+        }
+    }
+    return text;
+}
+/**
+ * Generates a keypair based on current keygen algorithm config.
+ * @param extractable
+ * @param usages
+ */
+async function generateKeyPair(extractable, usages) {
+    return window.crypto.subtle.generateKey(keygenAlgorithmOptions, extractable, usages);
+}
+/**
+ * Export key as Json Web Key (JWK)
+ * @param key
+ */
+async function exportJwk(key) {
+    return window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key);
+}
+/**
+ * Imports key as Json Web Key (JWK), can set extractable and usages.
+ * @param key
+ * @param extractable
+ * @param usages
+ */
+async function importJwk(key, extractable, usages) {
+    return window.crypto.subtle.importKey(KEY_FORMAT_JWK, key, keygenAlgorithmOptions, extractable, usages);
+}
+/**
+ * Signs given data with given key
+ * @param key
+ * @param data
+ */
+async function sign(key, data) {
+    return window.crypto.subtle.sign(keygenAlgorithmOptions, key, data);
+}
+/**
+ * Returns the SHA-256 hash of an input string
+ * @param plainText
+ */
+async function hashString(plainText) {
+    const hashBuffer = await sha256Digest(plainText);
+    const hashBytes = new Uint8Array(hashBuffer);
+    return urlEncodeArr(hashBytes);
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const storageNotSupported = "storage_not_supported";
+const stubbedPublicClientApplicationCalled = "stubbed_public_client_application_called";
+const inMemRedirectUnavailable = "in_mem_redirect_unavailable";
+
+var BrowserConfigurationAuthErrorCodes = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    inMemRedirectUnavailable: inMemRedirectUnavailable,
+    storageNotSupported: storageNotSupported,
+    stubbedPublicClientApplicationCalled: stubbedPublicClientApplicationCalled
+});
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const BrowserConfigurationAuthErrorMessages = {
+    [storageNotSupported]: "Given storage configuration option was not supported.",
+    [stubbedPublicClientApplicationCalled]: "Stub instance of Public Client Application was called. If using msal-react, please ensure context is not used without a provider. For more visit: aka.ms/msaljs/browser-errors",
+    [inMemRedirectUnavailable]: "Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true.",
+};
+/**
+ * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
+ * @deprecated Use BrowserAuthErrorCodes instead
+ */
+const BrowserConfigurationAuthErrorMessage = {
+    storageNotSupportedError: {
+        code: storageNotSupported,
+        desc: BrowserConfigurationAuthErrorMessages[storageNotSupported],
+    },
+    stubPcaInstanceCalled: {
+        code: stubbedPublicClientApplicationCalled,
+        desc: BrowserConfigurationAuthErrorMessages[stubbedPublicClientApplicationCalled],
+    },
+    inMemRedirectUnavailable: {
+        code: inMemRedirectUnavailable,
+        desc: BrowserConfigurationAuthErrorMessages[inMemRedirectUnavailable],
+    },
+};
+/**
+ * Browser library error class thrown by the MSAL.js library for SPAs
+ */
+class BrowserConfigurationAuthError extends AuthError {
+    constructor(errorCode, errorMessage) {
+        super(errorCode, errorMessage);
+        this.name = "BrowserConfigurationAuthError";
+        Object.setPrototypeOf(this, BrowserConfigurationAuthError.prototype);
+    }
+}
+function createBrowserConfigurationAuthError(errorCode) {
+    return new BrowserConfigurationAuthError(errorCode, BrowserConfigurationAuthErrorMessages[errorCode]);
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Clears hash from window url.
+ */
+function clearHash(contentWindow) {
+    // Office.js sets history.replaceState to null
+    contentWindow.location.hash = "";
+    if (typeof contentWindow.history.replaceState === "function") {
+        // Full removes "#" from url
+        contentWindow.history.replaceState(null, "", `${contentWindow.location.origin}${contentWindow.location.pathname}${contentWindow.location.search}`);
+    }
+}
+/**
+ * Replaces current hash with hash from provided url
+ */
+function replaceHash(url) {
+    const urlParts = url.split("#");
+    urlParts.shift(); // Remove part before the hash
+    window.location.hash = urlParts.length > 0 ? urlParts.join("#") : "";
+}
+/**
+ * Returns boolean of whether the current window is in an iframe or not.
+ */
+function isInIframe() {
+    return window.parent !== window;
+}
+/**
+ * Returns boolean of whether or not the current window is a popup opened by msal
+ */
+function isInPopup() {
+    return (typeof window !== "undefined" &&
+        !!window.opener &&
+        window.opener !== window &&
+        typeof window.name === "string" &&
+        window.name.indexOf(`${BrowserConstants.POPUP_NAME_PREFIX}.`) === 0);
+}
+// #endregion
+/**
+ * Returns current window URL as redirect uri
+ */
+function getCurrentUri() {
+    return window.location.href.split("?")[0].split("#")[0];
+}
+/**
+ * Gets the homepage url for the current window location.
+ */
+function getHomepage() {
+    const currentUrl = new UrlString(window.location.href);
+    const urlComponents = currentUrl.getUrlComponents();
+    return `${urlComponents.Protocol}//${urlComponents.HostNameAndPort}/`;
+}
+/**
+ * Throws error if we have completed an auth and are
+ * attempting another auth request inside an iframe.
+ */
+function blockReloadInHiddenIframes() {
+    const isResponseHash = UrlString.hashContainsKnownProperties(window.location.hash);
+    // return an error if called from the hidden iframe created by the msal js silent calls
+    if (isResponseHash && isInIframe()) {
+        throw createBrowserAuthError(blockIframeReload);
+    }
+}
+/**
+ * Block redirect operations in iframes unless explicitly allowed
+ * @param interactionType Interaction type for the request
+ * @param allowRedirectInIframe Config value to allow redirects when app is inside an iframe
+ */
+function blockRedirectInIframe(allowRedirectInIframe) {
+    if (isInIframe() && !allowRedirectInIframe) {
+        // If we are not in top frame, we shouldn't redirect. This is also handled by the service.
+        throw createBrowserAuthError(redirectInIframe);
+    }
+}
+/**
+ * Block redirectUri loaded in popup from calling AcquireToken APIs
+ */
+function blockAcquireTokenInPopups() {
+    // Popups opened by msal popup APIs are given a name that starts with "msal."
+    if (isInPopup()) {
+        throw createBrowserAuthError(blockNestedPopups);
+    }
+}
+/**
+ * Throws error if token requests are made in non-browser environment
+ * @param isBrowserEnvironment Flag indicating if environment is a browser.
+ */
+function blockNonBrowserEnvironment() {
+    if (typeof window === "undefined") {
+        throw createBrowserAuthError(nonBrowserEnvironment);
+    }
+}
+/**
+ * Throws error if initialize hasn't been called
+ * @param initialized
+ */
+function blockAPICallsBeforeInitialize(initialized) {
+    if (!initialized) {
+        throw createBrowserAuthError(uninitializedPublicClientApplication);
+    }
+}
+/**
+ * Helper to validate app environment before making an auth request
+ * @param initialized
+ */
+function preflightCheck(initialized) {
+    // Block request if not in browser environment
+    blockNonBrowserEnvironment();
+    // Block auth requests inside a hidden iframe
+    blockReloadInHiddenIframes();
+    // Block redirectUri opened in a popup from calling MSAL APIs
+    blockAcquireTokenInPopups();
+    // Block token acquisition before initialize has been called
+    blockAPICallsBeforeInitialize(initialized);
+}
+/**
+ * Helper to validate app enviornment before making redirect request
+ * @param initialized
+ * @param config
+ */
+function redirectPreflightCheck(initialized, config) {
+    preflightCheck(initialized);
+    blockRedirectInIframe(config.system.allowRedirectInIframe);
+    // Block redirects if memory storage is enabled but storeAuthStateInCookie is not
+    if (config.cache.cacheLocation === BrowserCacheLocation.MemoryStorage &&
+        !config.cache.storeAuthStateInCookie) {
+        throw createBrowserConfigurationAuthError(inMemRedirectUnavailable);
+    }
+}
+/**
+ * Adds a preconnect link element to the header which begins DNS resolution and SSL connection in anticipation of the /token request
+ * @param loginDomain Authority domain, including https protocol e.g. https://login.microsoftonline.com
+ * @returns
+ */
+function preconnect(authority) {
+    const link = document.createElement("link");
     link.rel = "preconnect";
     link.href = new URL(authority).origin;
     link.crossOrigin = "anonymous";
@@ -9056,6 +9714,13 @@ function preconnect(authority) {
         catch { }
     }, 10000); // 10s Timeout
 }
+/**
+ * Wrapper function that creates a UUID v7 from the current timestamp.
+ * @returns {string}
+ */
+function createGuid() {
+    return createNewGuid();
+}
 
 var BrowserUtils = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -9065,11 +9730,14 @@ var BrowserUtils = /*#__PURE__*/Object.freeze({
     blockRedirectInIframe: blockRedirectInIframe,
     blockReloadInHiddenIframes: blockReloadInHiddenIframes,
     clearHash: clearHash,
+    createGuid: createGuid,
     getCurrentUri: getCurrentUri,
     getHomepage: getHomepage,
     isInIframe: isInIframe,
     isInPopup: isInPopup,
     preconnect: preconnect,
+    preflightCheck: preflightCheck,
+    redirectPreflightCheck: redirectPreflightCheck,
     replaceHash: replaceHash
 });
 
@@ -9345,7 +10013,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.9.0";
+const version = "3.11.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9771,50 +10439,6 @@ async function createController(config) {
     }
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Class which exposes APIs to encode plaintext to base64 encoded string. See here for implementation details:
- * https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding#Solution_2_%E2%80%93_JavaScript's_UTF-16_%3E_UTF-8_%3E_base64
- */
-/**
- * Returns URL Safe b64 encoded string from a plaintext string.
- * @param input
- */
-function urlEncode(input) {
-    return encodeURIComponent(base64Encode(input)
-        .replace(/=/g, "")
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_"));
-}
-/**
- * Returns URL Safe b64 encoded string from an int8Array.
- * @param inputArr
- */
-function urlEncodeArr(inputArr) {
-    return base64EncArr(inputArr)
-        .replace(/=/g, "")
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_");
-}
-/**
- * Returns b64 encoded string from plaintext string.
- * @param input
- */
-function base64Encode(input) {
-    return base64EncArr(new TextEncoder().encode(input));
-}
-/**
- * Base64 encode byte array
- * @param aBytes
- */
-function base64EncArr(aBytes) {
-    const binString = Array.from(aBytes, (x) => String.fromCodePoint(x)).join("");
-    return btoa(binString);
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -9852,149 +10476,6 @@ function base64DecToArr(base64String) {
     return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * This file defines functions used by the browser library to perform cryptography operations such as
- * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
- */
-/**
- * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
- */
-// RSA KeyGen Algorithm
-const PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
-// SHA-256 hashing algorithm
-const S256_HASH_ALG = "SHA-256";
-// MOD length for PoP tokens
-const MODULUS_LENGTH = 2048;
-// Public Exponent
-const PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
-// UUID hex digits
-const UUID_CHARS = "0123456789abcdef";
-// Array to store UINT32 random value
-const UINT32_ARR = new Uint32Array(1);
-const keygenAlgorithmOptions = {
-    name: PKCS1_V15_KEYGEN_ALG,
-    hash: S256_HASH_ALG,
-    modulusLength: MODULUS_LENGTH,
-    publicExponent: PUBLIC_EXPONENT,
-};
-/**
- * Check whether browser crypto is available.
- */
-function validateCryptoAvailable(logger) {
-    if ("crypto" in window) {
-        logger.verbose("BrowserCrypto: modern crypto interface available");
-    }
-    else {
-        logger.error("BrowserCrypto: crypto interface is unavailable");
-        throw createBrowserAuthError(cryptoNonExistent);
-    }
-}
-/**
- * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
- * @param dataString {string} data string
- * @param performanceClient {?IPerformanceClient}
- * @param correlationId {?string} correlation id
- */
-async function sha256Digest(dataString, performanceClient, correlationId) {
-    performanceClient?.addQueueMeasurement(PerformanceEvents.Sha256Digest, correlationId);
-    const encoder = new TextEncoder();
-    const data = encoder.encode(dataString);
-    return window.crypto.subtle.digest(S256_HASH_ALG, data);
-}
-/**
- * Populates buffer with cryptographically random values.
- * @param dataBuffer
- */
-function getRandomValues(dataBuffer) {
-    return window.crypto.getRandomValues(dataBuffer);
-}
-/**
- * Returns random Uint32 value.
- * @returns {number}
- */
-function getRandomUint32() {
-    window.crypto.getRandomValues(UINT32_ARR);
-    return UINT32_ARR[0];
-}
-/**
- * Creates a UUID v7 from the current timestamp.
- * Implementation relies on the system clock to guarantee increasing order of generated identifiers.
- * @returns {number}
- */
-function createNewGuid() {
-    const currentTimestamp = Date.now();
-    const baseRand = getRandomUint32() * 0x400 + (getRandomUint32() & 0x3ff);
-    // Result byte array
-    const bytes = new Uint8Array(16);
-    // A 12-bit `rand_a` field value
-    const randA = Math.trunc(baseRand / 2 ** 30);
-    // The higher 30 bits of 62-bit `rand_b` field value
-    const randBHi = baseRand & (2 ** 30 - 1);
-    // The lower 32 bits of 62-bit `rand_b` field value
-    const randBLo = getRandomUint32();
-    bytes[0] = currentTimestamp / 2 ** 40;
-    bytes[1] = currentTimestamp / 2 ** 32;
-    bytes[2] = currentTimestamp / 2 ** 24;
-    bytes[3] = currentTimestamp / 2 ** 16;
-    bytes[4] = currentTimestamp / 2 ** 8;
-    bytes[5] = currentTimestamp;
-    bytes[6] = 0x70 | (randA >>> 8);
-    bytes[7] = randA;
-    bytes[8] = 0x80 | (randBHi >>> 24);
-    bytes[9] = randBHi >>> 16;
-    bytes[10] = randBHi >>> 8;
-    bytes[11] = randBHi;
-    bytes[12] = randBLo >>> 24;
-    bytes[13] = randBLo >>> 16;
-    bytes[14] = randBLo >>> 8;
-    bytes[15] = randBLo;
-    let text = "";
-    for (let i = 0; i < bytes.length; i++) {
-        text += UUID_CHARS.charAt(bytes[i] >>> 4);
-        text += UUID_CHARS.charAt(bytes[i] & 0xf);
-        if (i === 3 || i === 5 || i === 7 || i === 9) {
-            text += "-";
-        }
-    }
-    return text;
-}
-/**
- * Generates a keypair based on current keygen algorithm config.
- * @param extractable
- * @param usages
- */
-async function generateKeyPair(extractable, usages) {
-    return window.crypto.subtle.generateKey(keygenAlgorithmOptions, extractable, usages);
-}
-/**
- * Export key as Json Web Key (JWK)
- * @param key
- */
-async function exportJwk(key) {
-    return window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key);
-}
-/**
- * Imports key as Json Web Key (JWK), can set extractable and usages.
- * @param key
- * @param extractable
- * @param usages
- */
-async function importJwk(key, extractable, usages) {
-    return window.crypto.subtle.importKey(KEY_FORMAT_JWK, key, keygenAlgorithmOptions, extractable, usages);
-}
-/**
- * Signs given data with given key
- * @param key
- * @param data
- */
-async function sign(key, data) {
-    return window.crypto.subtle.sign(keygenAlgorithmOptions, key, data);
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -10179,9 +10660,19 @@ class DatabaseStorage {
         }
         return new Promise((resolve, reject) => {
             const deleteDbRequest = window.indexedDB.deleteDatabase(DB_NAME);
-            deleteDbRequest.addEventListener("success", () => resolve(true));
-            deleteDbRequest.addEventListener("blocked", () => resolve(true));
-            deleteDbRequest.addEventListener("error", () => reject(false));
+            const id = setTimeout(() => reject(false), 200); // Reject if events aren't raised within 200ms
+            deleteDbRequest.addEventListener("success", () => {
+                clearTimeout(id);
+                return resolve(true);
+            });
+            deleteDbRequest.addEventListener("blocked", () => {
+                clearTimeout(id);
+                return resolve(true);
+            });
+            deleteDbRequest.addEventListener("error", () => {
+                clearTimeout(id);
+                return reject(false);
+            });
         });
     }
 }
@@ -10227,11 +10718,10 @@ class MemoryStorage {
  * backed up with the more volatile MemoryStorage object for cases in which IndexedDB may be unavailable.
  */
 class AsyncMemoryStorage {
-    constructor(logger, storeName) {
+    constructor(logger) {
         this.inMemoryCache = new MemoryStorage();
         this.indexedDBCache = new DatabaseStorage();
         this.logger = logger;
-        this.storeName = storeName;
     }
     handleDatabaseAccessError(error) {
         if (error instanceof BrowserAuthError &&
@@ -10327,9 +10817,9 @@ class AsyncMemoryStorage {
      */
     clearInMemory() {
         // InMemory cache is a Map instance, clear is straightforward
-        this.logger.verbose(`Deleting in-memory keystore ${this.storeName}`);
+        this.logger.verbose(`Deleting in-memory keystore`);
         this.inMemoryCache.clear();
-        this.logger.verbose(`In-memory keystore ${this.storeName} deleted`);
+        this.logger.verbose(`In-memory keystore deleted`);
     }
     /**
      * Tries to delete the IndexedDB database
@@ -10339,54 +10829,13 @@ class AsyncMemoryStorage {
         try {
             this.logger.verbose("Deleting persistent keystore");
             const dbDeleted = await this.indexedDBCache.deleteDatabase();
-            if (dbDeleted) {
-                this.logger.verbose("Persistent keystore deleted");
-            }
-            return dbDeleted;
-        }
-        catch (e) {
-            this.handleDatabaseAccessError(e);
-            return false;
-        }
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CryptoKeyStoreNames = {
-    asymmetricKeys: "asymmetricKeys",
-    symmetricKeys: "symmetricKeys",
-};
-/**
- * MSAL CryptoKeyStore DB Version 2
- */
-class CryptoKeyStore {
-    constructor(logger) {
-        this.logger = logger;
-        this.asymmetricKeys = new AsyncMemoryStorage(this.logger, CryptoKeyStoreNames.asymmetricKeys);
-        this.symmetricKeys = new AsyncMemoryStorage(this.logger, CryptoKeyStoreNames.symmetricKeys);
-    }
-    async clear() {
-        // Delete in-memory keystores
-        this.asymmetricKeys.clearInMemory();
-        this.symmetricKeys.clearInMemory();
-        /**
-         * There is only one database, so calling clearPersistent on asymmetric keystore takes care of
-         * every persistent keystore
-         */
-        try {
-            await this.asymmetricKeys.clearPersistent();
-            return true;
-        }
-        catch (e) {
-            if (e instanceof Error) {
-                this.logger.error(`Clearing keystore failed with error: ${e.message}`);
-            }
-            else {
-                this.logger.error("Clearing keystore failed with unknown error");
+            if (dbDeleted) {
+                this.logger.verbose("Persistent keystore deleted");
             }
+            return dbDeleted;
+        }
+        catch (e) {
+            this.handleDatabaseAccessError(e);
             return false;
         }
     }
@@ -10405,7 +10854,7 @@ class CryptoOps {
         this.logger = logger;
         // Browser crypto needs to be validated first before any other classes can be set.
         validateCryptoAvailable(logger);
-        this.cache = new CryptoKeyStore(this.logger);
+        this.cache = new AsyncMemoryStorage(this.logger);
         this.performanceClient = performanceClient;
     }
     /**
@@ -10451,7 +10900,7 @@ class CryptoOps {
         // Re-import private key to make it unextractable
         const unextractablePrivateKey = await importJwk(privateKeyJwk, false, ["sign"]);
         // Store Keypair data in keystore
-        await this.cache.asymmetricKeys.setItem(publicJwkHash, {
+        await this.cache.setItem(publicJwkHash, {
             privateKey: unextractablePrivateKey,
             publicKey: keyPair.publicKey,
             requestMethod: request.resourceRequestMethod,
@@ -10469,15 +10918,33 @@ class CryptoOps {
      * @param kid
      */
     async removeTokenBindingKey(kid) {
-        await this.cache.asymmetricKeys.removeItem(kid);
-        const keyFound = await this.cache.asymmetricKeys.containsKey(kid);
+        await this.cache.removeItem(kid);
+        const keyFound = await this.cache.containsKey(kid);
         return !keyFound;
     }
     /**
      * Removes all cryptographic keys from IndexedDB storage
      */
     async clearKeystore() {
-        return this.cache.clear();
+        // Delete in-memory keystores
+        this.cache.clearInMemory();
+        /**
+         * There is only one database, so calling clearPersistent on asymmetric keystore takes care of
+         * every persistent keystore
+         */
+        try {
+            await this.cache.clearPersistent();
+            return true;
+        }
+        catch (e) {
+            if (e instanceof Error) {
+                this.logger.error(`Clearing keystore failed with error: ${e.message}`);
+            }
+            else {
+                this.logger.error("Clearing keystore failed with unknown error");
+            }
+            return false;
+        }
     }
     /**
      * Signs the given object as a jwt payload with private key retrieved by given kid.
@@ -10486,7 +10953,7 @@ class CryptoOps {
      */
     async signJwt(payload, kid, shrOptions, correlationId) {
         const signJwtMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.CryptoOptsSignJwt, correlationId);
-        const cachedKeyPair = await this.cache.asymmetricKeys.getItem(kid);
+        const cachedKeyPair = await this.cache.getItem(kid);
         if (!cachedKeyPair) {
             throw createBrowserAuthError(cryptoKeyNotFound);
         }
@@ -10527,9 +10994,7 @@ class CryptoOps {
      * @param plainText
      */
     async hashString(plainText) {
-        const hashBuffer = await sha256Digest(plainText);
-        const hashBytes = new Uint8Array(hashBuffer);
-        return urlEncodeArr(hashBytes);
+        return hashString(plainText);
     }
 }
 CryptoOps.POP_KEY_USAGES = ["sign", "verify"];
@@ -10538,62 +11003,6 @@ function getSortedObjectString(obj) {
     return JSON.stringify(obj, Object.keys(obj).sort());
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const storageNotSupported = "storage_not_supported";
-const stubbedPublicClientApplicationCalled = "stubbed_public_client_application_called";
-const inMemRedirectUnavailable = "in_mem_redirect_unavailable";
-
-var BrowserConfigurationAuthErrorCodes = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    inMemRedirectUnavailable: inMemRedirectUnavailable,
-    storageNotSupported: storageNotSupported,
-    stubbedPublicClientApplicationCalled: stubbedPublicClientApplicationCalled
-});
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const BrowserConfigurationAuthErrorMessages = {
-    [storageNotSupported]: "Given storage configuration option was not supported.",
-    [stubbedPublicClientApplicationCalled]: "Stub instance of Public Client Application was called. If using msal-react, please ensure context is not used without a provider. For more visit: aka.ms/msaljs/browser-errors",
-    [inMemRedirectUnavailable]: "Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true.",
-};
-/**
- * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
- * @deprecated Use BrowserAuthErrorCodes instead
- */
-const BrowserConfigurationAuthErrorMessage = {
-    storageNotSupportedError: {
-        code: storageNotSupported,
-        desc: BrowserConfigurationAuthErrorMessages[storageNotSupported],
-    },
-    stubPcaInstanceCalled: {
-        code: stubbedPublicClientApplicationCalled,
-        desc: BrowserConfigurationAuthErrorMessages[stubbedPublicClientApplicationCalled],
-    },
-    inMemRedirectUnavailable: {
-        code: inMemRedirectUnavailable,
-        desc: BrowserConfigurationAuthErrorMessages[inMemRedirectUnavailable],
-    },
-};
-/**
- * Browser library error class thrown by the MSAL.js library for SPAs
- */
-class BrowserConfigurationAuthError extends AuthError {
-    constructor(errorCode, errorMessage) {
-        super(errorCode, errorMessage);
-        this.name = "BrowserConfigurationAuthError";
-        Object.setPrototypeOf(this, BrowserConfigurationAuthError.prototype);
-    }
-}
-function createBrowserConfigurationAuthError(errorCode) {
-    return new BrowserConfigurationAuthError(errorCode, BrowserConfigurationAuthErrorMessages[errorCode]);
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -10742,18 +11151,12 @@ class BrowserCacheManager extends CacheManager {
             PersistentCacheKeys.ERROR,
             PersistentCacheKeys.ERROR_DESC,
         ];
-        keysToMigrate.forEach((cacheKey, index) => this.migrateCacheEntry(cacheKey, values[index]));
-    }
-    /**
-     * Utility function to help with migration.
-     * @param newKey
-     * @param value
-     * @param storeAuthStateInCookie
-     */
-    migrateCacheEntry(newKey, value) {
-        if (value) {
-            this.setTemporaryCache(newKey, value, true);
-        }
+        keysToMigrate.forEach((cacheKey, index) => {
+            const value = values[index];
+            if (value) {
+                this.setTemporaryCache(cacheKey, value, true);
+            }
+        });
     }
     /**
      * Searches all cache entries for MSAL accounts and creates the account key map
@@ -11450,33 +11853,28 @@ class BrowserCacheManager extends CacheManager {
     }
     /**
      * Removes the cache item with the given key.
-     * Will also clear the cookie item if storeAuthStateInCookie is set to true.
      * @param key
      */
     removeItem(key) {
         this.browserStorage.removeItem(key);
+    }
+    /**
+     * Removes the temporary cache item with the given key.
+     * Will also clear the cookie item if storeAuthStateInCookie is set to true.
+     * @param key
+     */
+    removeTemporaryItem(key) {
         this.temporaryCacheStorage.removeItem(key);
         if (this.cacheConfig.storeAuthStateInCookie) {
             this.logger.trace("BrowserCacheManager.removeItem: storeAuthStateInCookie is true, clearing item cookie");
             this.clearItemCookie(key);
         }
     }
-    /**
-     * Checks whether key is in cache.
-     * @param key
-     */
-    containsKey(key) {
-        return (this.browserStorage.containsKey(key) ||
-            this.temporaryCacheStorage.containsKey(key));
-    }
     /**
      * Gets all keys in window.
      */
     getKeys() {
-        return [
-            ...this.browserStorage.getKeys(),
-            ...this.temporaryCacheStorage.getKeys(),
-        ];
+        return this.browserStorage.getKeys();
     }
     /**
      * Clears all cache entries created by MSAL.
@@ -11485,14 +11883,18 @@ class BrowserCacheManager extends CacheManager {
         // Removes all accounts and their credentials
         await this.removeAllAccounts();
         this.removeAppMetadata();
+        // Remove temp storage first to make sure any cookies are cleared
+        this.temporaryCacheStorage.getKeys().forEach((cacheKey) => {
+            if (cacheKey.indexOf(Constants.CACHE_PREFIX) !== -1 ||
+                cacheKey.indexOf(this.clientId) !== -1) {
+                this.removeTemporaryItem(cacheKey);
+            }
+        });
         // Removes all remaining MSAL cache items
-        this.getKeys().forEach((cacheKey) => {
-            // Check if key contains msal prefix; For now, we are clearing all the cache items created by MSAL.js
-            if ((this.browserStorage.containsKey(cacheKey) ||
-                this.temporaryCacheStorage.containsKey(cacheKey)) &&
-                (cacheKey.indexOf(Constants.CACHE_PREFIX) !== -1 ||
-                    cacheKey.indexOf(this.clientId) !== -1)) {
-                this.removeItem(cacheKey);
+        this.browserStorage.getKeys().forEach((cacheKey) => {
+            if (cacheKey.indexOf(Constants.CACHE_PREFIX) !== -1 ||
+                cacheKey.indexOf(this.clientId) !== -1) {
+                this.browserStorage.removeItem(cacheKey);
             }
         });
         this.internalStorage.clear();
@@ -11525,6 +11927,7 @@ class BrowserCacheManager extends CacheManager {
      * @param cookieName
      * @param cookieValue
      * @param expires
+     * @deprecated
      */
     setItemCookie(cookieName, cookieValue, expires) {
         let cookieStr = `${encodeURIComponent(cookieName)}=${encodeURIComponent(cookieValue)};path=/;SameSite=Lax;`;
@@ -11540,6 +11943,7 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Get one item by key from cookies
      * @param cookieName
+     * @deprecated
      */
     getItemCookie(cookieName) {
         const name = `${encodeURIComponent(cookieName)}=`;
@@ -11557,6 +11961,7 @@ class BrowserCacheManager extends CacheManager {
     }
     /**
      * Clear all msal-related cookies currently set in the browser. Should only be used to clear temporary cache items.
+     * @deprecated
      */
     clearMsalCookies() {
         const cookiePrefix = `${Constants.CACHE_PREFIX}.${this.clientId}`;
@@ -11575,6 +11980,7 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Clear an item in the cookies by key
      * @param cookieName
+     * @deprecated
      */
     clearItemCookie(cookieName) {
         this.setItemCookie(cookieName, Constants.EMPTY_STRING, -1);
@@ -11582,24 +11988,13 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Get cookie expiration time
      * @param cookieLifeDays
+     * @deprecated
      */
     getCookieExpirationTime(cookieLifeDays) {
         const today = new Date();
         const expr = new Date(today.getTime() + cookieLifeDays * this.COOKIE_LIFE_MULTIPLIER);
         return expr.toUTCString();
     }
-    /**
-     * Gets the cache object referenced by the browser
-     */
-    getCache() {
-        return this.browserStorage;
-    }
-    /**
-     * interface compat, we cannot overwrite browser cache; Functionality is supported by individual entities in browser
-     */
-    setCache() {
-        // sets nothing
-    }
     /**
      * Prepend msal.<client-id> to each key; Skip for any JSON object as Key (defined schemas do not need the key appended: AccessToken Keys or the upcoming schema)
      * @param key
@@ -11692,22 +12087,22 @@ class BrowserCacheManager extends CacheManager {
         this.logger.trace("BrowserCacheManager.resetRequestCache called");
         // check state and remove associated cache items
         if (state) {
-            this.getKeys().forEach((key) => {
+            this.temporaryCacheStorage.getKeys().forEach((key) => {
                 if (key.indexOf(state) !== -1) {
-                    this.removeItem(key);
+                    this.removeTemporaryItem(key);
                 }
             });
             // delete generic interactive request parameters
-            this.removeItem(this.generateStateKey(state));
-            this.removeItem(this.generateNonceKey(state));
-            this.removeItem(this.generateAuthorityKey(state));
-        }
-        this.removeItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
-        this.removeItem(this.generateCacheKey(TemporaryCacheKeys.ORIGIN_URI));
-        this.removeItem(this.generateCacheKey(TemporaryCacheKeys.URL_HASH));
-        this.removeItem(this.generateCacheKey(TemporaryCacheKeys.CORRELATION_ID));
-        this.removeItem(this.generateCacheKey(TemporaryCacheKeys.CCS_CREDENTIAL));
-        this.removeItem(this.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST));
+            this.removeTemporaryItem(this.generateStateKey(state));
+            this.removeTemporaryItem(this.generateNonceKey(state));
+            this.removeTemporaryItem(this.generateAuthorityKey(state));
+        }
+        this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
+        this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.ORIGIN_URI));
+        this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.URL_HASH));
+        this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.CORRELATION_ID));
+        this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.CCS_CREDENTIAL));
+        this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST));
         this.setInteractionInProgress(false);
     }
     /**
@@ -11733,7 +12128,7 @@ class BrowserCacheManager extends CacheManager {
     cleanRequestByInteractionType(interactionType) {
         this.logger.trace("BrowserCacheManager.cleanRequestByInteractionType called");
         // Loop through all keys to find state key
-        this.getKeys().forEach((key) => {
+        this.temporaryCacheStorage.getKeys().forEach((key) => {
             // If this key is not the state key, move on
             if (key.indexOf(TemporaryCacheKeys.REQUEST_STATE) === -1) {
                 return;
@@ -11778,7 +12173,7 @@ class BrowserCacheManager extends CacheManager {
             this.logger.error(`Parsing cached token request threw with error: ${e}`);
             throw createBrowserAuthError(unableToParseTokenRequestCacheError);
         }
-        this.removeItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
+        this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
         // Get cached authority and use if no authority is cached with request.
         if (!parsedRequest.authority) {
             const authorityCacheKey = this.generateAuthorityKey(state);
@@ -11834,7 +12229,7 @@ class BrowserCacheManager extends CacheManager {
         }
         else if (!inProgress &&
             this.getInteractionInProgress() === this.clientId) {
-            this.removeItem(key);
+            this.removeTemporaryItem(key);
         }
     }
     /**
@@ -11851,7 +12246,7 @@ class BrowserCacheManager extends CacheManager {
         // Check for cached MSAL v1 id token
         const msalIdTokenString = this.getTemporaryCache(PersistentCacheKeys.ID_TOKEN, true);
         if (msalIdTokenString) {
-            this.removeItem(this.generateCacheKey(PersistentCacheKeys.ID_TOKEN));
+            this.browserStorage.removeItem(this.generateCacheKey(PersistentCacheKeys.ID_TOKEN));
             this.logger.verbose("Cached MSAL.js v1 id token retrieved");
         }
         const cachedIdTokenString = msalIdTokenString || adalIdTokenString;
@@ -11879,7 +12274,7 @@ class BrowserCacheManager extends CacheManager {
         if (currentCacheKey !== updatedCacheKey) {
             const cacheItem = this.getItem(currentCacheKey);
             if (cacheItem) {
-                this.removeItem(currentCacheKey);
+                this.browserStorage.removeItem(currentCacheKey);
                 this.setItem(updatedCacheKey, cacheItem);
                 this.logger.verbose(`Updated an outdated ${credential.credentialType} cache key`);
                 return updatedCacheKey;
@@ -11890,19 +12285,6 @@ class BrowserCacheManager extends CacheManager {
         }
         return currentCacheKey;
     }
-    /**
-     * Returns application id as redirect context during AcquireTokenRedirect flow.
-     */
-    getRedirectRequestContext() {
-        return this.getTemporaryCache(TemporaryCacheKeys.REDIRECT_CONTEXT, true);
-    }
-    /**
-     * Sets application id as the redirect context during AcquireTokenRedirect flow.
-     * @param value
-     */
-    setRedirectRequestContext(value) {
-        this.setTemporaryCache(TemporaryCacheKeys.REDIRECT_CONTEXT, value, true);
-    }
     /**
      * Builds credential entities from AuthenticationResult object and saves the resulting credentials to the cache
      * @param result
@@ -12137,47 +12519,6 @@ class BaseInteractionClient {
             }
         }
     }
-    /**
-     * Initializer function for all request APIs
-     * @param request
-     */
-    async initializeBaseRequest(request) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.InitializeBaseRequest, this.correlationId);
-        const authority = request.authority || this.config.auth.authority;
-        const scopes = [...((request && request.scopes) || [])];
-        const validatedRequest = {
-            ...request,
-            correlationId: this.correlationId,
-            authority,
-            scopes,
-        };
-        // Set authenticationScheme to BEARER if not explicitly set in the request
-        if (!validatedRequest.authenticationScheme) {
-            validatedRequest.authenticationScheme = AuthenticationScheme.BEARER;
-            this.logger.verbose('Authentication Scheme wasn\'t explicitly set in request, defaulting to "Bearer" request');
-        }
-        else {
-            if (validatedRequest.authenticationScheme ===
-                AuthenticationScheme.SSH) {
-                if (!request.sshJwk) {
-                    throw createClientConfigurationError(missingSshJwk);
-                }
-                if (!request.sshKid) {
-                    throw createClientConfigurationError(missingSshKid);
-                }
-            }
-            this.logger.verbose(`Authentication Scheme set to "${validatedRequest.authenticationScheme}" as configured in Auth request`);
-        }
-        // Set requested claims hash if claims-based caching is enabled and claims were requested
-        if (this.config.cache.claimsBasedCachingEnabled &&
-            request.claims &&
-            // Checks for empty stringified object "{}" which doesn't qualify as requested claims
-            !StringUtils.isEmptyObj(request.claims)) {
-            validatedRequest.requestedClaimsHash =
-                await this.browserCrypto.hashString(request.claims);
-        }
-        return validatedRequest;
-    }
     /**
      *
      * Use to get the redirect uri configured in MSAL or null.
@@ -12295,6 +12636,60 @@ async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceCl
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Initializer function for all request APIs
+ * @param request
+ */
+async function initializeBaseRequest(request, config, performanceClient, logger) {
+    performanceClient.addQueueMeasurement(PerformanceEvents.InitializeBaseRequest, request.correlationId);
+    const authority = request.authority || config.auth.authority;
+    const scopes = [...((request && request.scopes) || [])];
+    const validatedRequest = {
+        ...request,
+        correlationId: request.correlationId,
+        authority,
+        scopes,
+    };
+    // Set authenticationScheme to BEARER if not explicitly set in the request
+    if (!validatedRequest.authenticationScheme) {
+        validatedRequest.authenticationScheme = AuthenticationScheme.BEARER;
+        logger.verbose('Authentication Scheme wasn\'t explicitly set in request, defaulting to "Bearer" request');
+    }
+    else {
+        if (validatedRequest.authenticationScheme === AuthenticationScheme.SSH) {
+            if (!request.sshJwk) {
+                throw createClientConfigurationError(missingSshJwk);
+            }
+            if (!request.sshKid) {
+                throw createClientConfigurationError(missingSshKid);
+            }
+        }
+        logger.verbose(`Authentication Scheme set to "${validatedRequest.authenticationScheme}" as configured in Auth request`);
+    }
+    // Set requested claims hash if claims-based caching is enabled and claims were requested
+    if (config.cache.claimsBasedCachingEnabled &&
+        request.claims &&
+        // Checks for empty stringified object "{}" which doesn't qualify as requested claims
+        !StringUtils.isEmptyObj(request.claims)) {
+        validatedRequest.requestedClaimsHash = await hashString(request.claims);
+    }
+    return validatedRequest;
+}
+async function initializeSilentRequest(request, account, config, performanceClient, logger) {
+    performanceClient.addQueueMeasurement(PerformanceEvents.InitializeSilentRequest, request.correlationId);
+    const baseRequest = await invokeAsync(initializeBaseRequest, PerformanceEvents.InitializeBaseRequest, logger, performanceClient, request.correlationId)(request, config, performanceClient, logger);
+    return {
+        ...request,
+        ...baseRequest,
+        account: account,
+        forceRefresh: request.forceRefresh || false,
+    };
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12469,7 +12864,7 @@ class StandardInteractionClient extends BaseInteractionClient {
             interactionType: interactionType,
         };
         const state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || Constants.EMPTY_STRING, browserState);
-        const baseRequest = await invokeAsync(this.initializeBaseRequest.bind(this), PerformanceEvents.InitializeBaseRequest, this.logger, this.performanceClient, this.correlationId)(request);
+        const baseRequest = await invokeAsync(initializeBaseRequest, PerformanceEvents.InitializeBaseRequest, this.logger, this.performanceClient, this.correlationId)({ ...request, correlationId: this.correlationId }, this.config, this.performanceClient, this.logger);
         const validatedRequest = {
             ...baseRequest,
             redirectUri: redirectUri,
@@ -12588,7 +12983,8 @@ class SilentCacheClient extends StandardInteractionClient {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
         // Telemetry manager only used to increment cacheHits here
         const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow);
-        const silentAuthClient = await this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions, silentRequest.account);
+        const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), PerformanceEvents.StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions, silentRequest.account);
+        const silentAuthClient = new SilentFlowClient(clientConfig, this.performanceClient);
         this.logger.verbose("Silent auth client created");
         try {
             const response = await invokeAsync(silentAuthClient.acquireCachedToken.bind(silentAuthClient), PerformanceEvents.SilentFlowClientAcquireCachedToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest);
@@ -12615,26 +13011,6 @@ class SilentCacheClient extends StandardInteractionClient {
         const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
         return this.clearCacheOnLogout(validLogoutRequest?.account);
     }
-    /**
-     * Creates an Silent Flow Client with the given authority, or the default authority.
-     * @param serverTelemetryManager
-     * @param authorityUrl
-     */
-    async createSilentFlowClient(serverTelemetryManager, authorityUrl, azureCloudOptions, account) {
-        // Create auth module.
-        const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), PerformanceEvents.StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)(serverTelemetryManager, authorityUrl, azureCloudOptions, account);
-        return new SilentFlowClient(clientConfig, this.performanceClient);
-    }
-    async initializeSilentRequest(request, account) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.InitializeSilentRequest, this.correlationId);
-        const baseRequest = await invokeAsync(this.initializeBaseRequest.bind(this), PerformanceEvents.InitializeBaseRequest, this.logger, this.performanceClient, this.correlationId)(request);
-        return {
-            ...request,
-            ...baseRequest,
-            account: account,
-            forceRefresh: request.forceRefresh || false,
-        };
-    }
 }
 
 /*
@@ -12746,6 +13122,7 @@ class NativeInteractionClient extends BaseInteractionClient {
             const fullAccount = {
                 ...account,
                 idTokenClaims: result?.idTokenClaims,
+                idToken: result?.idToken,
             };
             return {
                 ...result,
@@ -12847,15 +13224,19 @@ class NativeInteractionClient extends BaseInteractionClient {
      */
     async handleNativeResponse(response, request, reqTimestamp) {
         this.logger.trace("NativeInteractionClient - handleNativeResponse called.");
-        if (response.account.id !== request.accountId) {
+        // generate identifiers
+        const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
+        const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
+        const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
+            nativeAccountId: request.accountId,
+        })?.homeAccountId;
+        if (homeAccountIdentifier !== cachedhomeAccountId &&
+            response.account.id !== request.accountId) {
             // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
             throw createNativeAuthError(userSwitch);
         }
         // Get the preferred_cache domain for the given authority
         const authority = await this.getDiscoveredAuthority(request.authority);
-        // generate identifiers
-        const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
-        const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
         const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, idTokenClaims, base64Decode, response.client_info, undefined, // environment
         idTokenClaims.tid, undefined, // auth code payload
         response.account.id, this.logger);
@@ -12951,7 +13332,14 @@ class NativeInteractionClient extends BaseInteractionClient {
             idTokenClaims.tid ||
             Constants.EMPTY_STRING;
         const accountInfo = updateAccountTenantProfileData(accountEntity.getAccountInfo(), undefined, // tenantProfile optional
-        idTokenClaims);
+        idTokenClaims, response.id_token);
+        /**
+         * In pairwise broker flows, this check prevents the broker's native account id
+         * from being returned over the embedded app's account id.
+         */
+        if (accountInfo.nativeAccountId !== response.account.id) {
+            accountInfo.nativeAccountId = response.account.id;
+        }
         // generate PoP token as needed
         const responseAccessToken = await this.generatePopAccessToken(response, request);
         const tokenType = request.tokenType === AuthenticationScheme.POP
@@ -14613,17 +15001,20 @@ class SilentIframeClient extends StandardInteractionClient {
             (!request.account || !request.account.username)) {
             this.logger.warning("No user hint provided. The authorization server may need more information to complete this request.");
         }
-        // Check that prompt is set to none or no_session, throw error if it is set to anything else.
-        if (request.prompt &&
-            request.prompt !== PromptValue.NONE &&
-            request.prompt !== PromptValue.NO_SESSION) {
-            throw createBrowserAuthError(silentPromptValueError);
+        // Check the prompt value
+        const inputRequest = { ...request };
+        if (inputRequest.prompt) {
+            if (inputRequest.prompt !== PromptValue.NONE &&
+                inputRequest.prompt !== PromptValue.NO_SESSION) {
+                this.logger.warning(`SilentIframeClient. Replacing invalid prompt ${inputRequest.prompt} with ${PromptValue.NONE}`);
+                inputRequest.prompt = PromptValue.NONE;
+            }
+        }
+        else {
+            inputRequest.prompt = PromptValue.NONE;
         }
         // Create silent request
-        const silentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)({
-            ...request,
-            prompt: request.prompt || PromptValue.NONE,
-        }, exports.InteractionType.Silent);
+        const silentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)(inputRequest, exports.InteractionType.Silent);
         preconnect(silentRequest.authority);
         const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
         try {
@@ -14699,7 +15090,7 @@ class SilentRefreshClient extends StandardInteractionClient {
      */
     async acquireToken(request) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentRefreshClientAcquireToken, request.correlationId);
-        const baseRequest = await invokeAsync(this.initializeBaseRequest.bind(this), PerformanceEvents.InitializeBaseRequest, this.logger, this.performanceClient, request.correlationId)(request);
+        const baseRequest = await invokeAsync(initializeBaseRequest, PerformanceEvents.InitializeBaseRequest, this.logger, this.performanceClient, request.correlationId)(request, this.config, this.performanceClient, this.logger);
         const silentRequest = {
             ...request,
             ...baseRequest,
@@ -15055,7 +15446,6 @@ class StandardController {
      * @param configuration Object for the MSAL PublicClientApplication instance
      */
     constructor(operatingContext) {
-        this.atsAsyncMeasurement = undefined;
         this.operatingContext = operatingContext;
         this.isBrowserEnvironment =
             this.operatingContext.isBrowserEnvironment();
@@ -15107,14 +15497,12 @@ class StandardController {
         await controller.initialize();
         return controller;
     }
-    trackPageVisibility() {
-        if (!this.atsAsyncMeasurement) {
+    trackPageVisibility(correlationId) {
+        if (!correlationId) {
             return;
         }
         this.logger.info("Perf: Visibility change detected");
-        this.atsAsyncMeasurement.increment({
-            visibilityChangeCount: 1,
-        });
+        this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -15219,18 +15607,9 @@ class StandardController {
                         this.eventHandler.emitEvent(EventType.LOGIN_FAILURE, exports.InteractionType.Redirect, null, eventError);
                     }
                     this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_END, exports.InteractionType.Redirect);
-                    if (eventError instanceof AuthError) {
-                        rootMeasurement.end({
-                            success: false,
-                            errorCode: eventError.errorCode,
-                            subErrorCode: eventError.subError,
-                        });
-                    }
-                    else {
-                        rootMeasurement.end({
-                            success: false,
-                        });
-                    }
+                    rootMeasurement.end({
+                        success: false,
+                    }, eventError);
                     throw e;
                 });
                 this.redirectResponse.set(redirectResponseKey, response);
@@ -15256,7 +15635,8 @@ class StandardController {
         // Preflight request
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.verbose("acquireTokenRedirect called", correlationId);
-        this.preflightBrowserEnvironmentCheck(exports.InteractionType.Redirect);
+        redirectPreflightCheck(this.initialized, this.config);
+        this.browserStorage.setInteractionInProgress(true);
         // If logged in, emit acquire token events
         const isLoggedIn = this.getAllAccounts().length > 0;
         if (isLoggedIn) {
@@ -15282,7 +15662,7 @@ class StandardController {
                     const redirectClient = this.createRedirectClient(correlationId);
                     return redirectClient.acquireToken(request);
                 }
-                this.getBrowserStorage().setInteractionInProgress(false);
+                this.browserStorage.setInteractionInProgress(false);
                 throw e;
             });
         }
@@ -15315,7 +15695,8 @@ class StandardController {
         const atPopupMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenPopup, correlationId);
         try {
             this.logger.verbose("acquireTokenPopup called", correlationId);
-            this.preflightBrowserEnvironmentCheck(exports.InteractionType.Popup);
+            preflightCheck(this.initialized);
+            this.browserStorage.setInteractionInProgress(true);
         }
         catch (e) {
             // Since this function is syncronous we need to reject
@@ -15336,7 +15717,7 @@ class StandardController {
                 correlationId,
             }, ApiId.acquireTokenPopup)
                 .then((response) => {
-                this.getBrowserStorage().setInteractionInProgress(false);
+                this.browserStorage.setInteractionInProgress(false);
                 atPopupMeasurement.end({
                     success: true,
                     isNativeBroker: true,
@@ -15356,7 +15737,7 @@ class StandardController {
                     const popupClient = this.createPopupClient(correlationId);
                     return popupClient.acquireToken(request);
                 }
-                this.getBrowserStorage().setInteractionInProgress(false);
+                this.browserStorage.setInteractionInProgress(false);
                 throw e;
             });
         }
@@ -15394,10 +15775,8 @@ class StandardController {
                 this.eventHandler.emitEvent(EventType.LOGIN_FAILURE, exports.InteractionType.Popup, null, e);
             }
             atPopupMeasurement.end({
-                errorCode: e.errorCode,
-                subErrorCode: e.subError,
                 success: false,
-            });
+            }, e);
             // Since this function is syncronous we need to reject
             return Promise.reject(e);
         });
@@ -15438,7 +15817,7 @@ class StandardController {
             prompt: request.prompt,
             correlationId: correlationId,
         };
-        this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
+        preflightCheck(this.initialized);
         this.ssoSilentMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.SsoSilent, correlationId);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
@@ -15479,10 +15858,8 @@ class StandardController {
             .catch((e) => {
             this.eventHandler.emitEvent(EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e);
             this.ssoSilentMeasurement?.end({
-                errorCode: e.errorCode,
-                subErrorCode: e.subError,
                 success: false,
-            });
+            }, e);
             throw e;
         })
             .finally(() => {
@@ -15501,8 +15878,8 @@ class StandardController {
      */
     async acquireTokenByCode(request) {
         const correlationId = this.getRequestCorrelationId(request);
-        this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
         this.logger.trace("acquireTokenByCode called", correlationId);
+        preflightCheck(this.initialized);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_START, exports.InteractionType.Silent, request);
         const atbcMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCode, correlationId);
         try {
@@ -15537,10 +15914,8 @@ class StandardController {
                         this.hybridAuthCodeResponses.delete(hybridAuthCode);
                         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, error);
                         atbcMeasurement.end({
-                            errorCode: error.errorCode,
-                            subErrorCode: error.subError,
                             success: false,
-                        });
+                        }, error);
                         throw error;
                     });
                     this.hybridAuthCodeResponses.set(hybridAuthCode, response);
@@ -15576,10 +15951,8 @@ class StandardController {
         catch (e) {
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
             atbcMeasurement.end({
-                errorCode: (e instanceof AuthError && e.errorCode) || undefined,
-                subErrorCode: (e instanceof AuthError && e.subError) || undefined,
                 success: false,
-            });
+            }, e);
             throw e;
         }
     }
@@ -15610,10 +15983,8 @@ class StandardController {
         })
             .catch((tokenRenewalError) => {
             this.acquireTokenByCodeAsyncMeasurement?.end({
-                errorCode: tokenRenewalError.errorCode,
-                subErrorCode: tokenRenewalError.subError,
                 success: false,
-            });
+            }, tokenRenewalError);
             throw tokenRenewalError;
         })
             .finally(() => {
@@ -15628,12 +15999,13 @@ class StandardController {
      * @param silentRequest SilentRequest
      * @returns A promise that, when resolved, returns the access token
      */
-    async acquireTokenFromCache(silentCacheClient, commonRequest, cacheLookupPolicy) {
+    async acquireTokenFromCache(commonRequest, cacheLookupPolicy) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.AcquireTokenFromCache, commonRequest.correlationId);
         switch (cacheLookupPolicy) {
             case CacheLookupPolicy.Default:
             case CacheLookupPolicy.AccessToken:
             case CacheLookupPolicy.AccessTokenAndRefreshToken:
+                const silentCacheClient = this.createSilentCacheClient(commonRequest.correlationId);
                 return invokeAsync(silentCacheClient.acquireToken.bind(silentCacheClient), PerformanceEvents.SilentCacheClientAcquireToken, this.logger, this.performanceClient, commonRequest.correlationId)(commonRequest);
             default:
                 throw createClientAuthError(tokenRefreshRequired);
@@ -15690,7 +16062,8 @@ class StandardController {
      */
     async logoutRedirect(logoutRequest) {
         const correlationId = this.getRequestCorrelationId(logoutRequest);
-        this.preflightBrowserEnvironmentCheck(exports.InteractionType.Redirect);
+        redirectPreflightCheck(this.initialized, this.config);
+        this.browserStorage.setInteractionInProgress(true);
         const redirectClient = this.createRedirectClient(correlationId);
         return redirectClient.logout(logoutRequest);
     }
@@ -15701,7 +16074,8 @@ class StandardController {
     logoutPopup(logoutRequest) {
         try {
             const correlationId = this.getRequestCorrelationId(logoutRequest);
-            this.preflightBrowserEnvironmentCheck(exports.InteractionType.Popup);
+            preflightCheck(this.initialized);
+            this.browserStorage.setInteractionInProgress(true);
             const popupClient = this.createPopupClient(correlationId);
             return popupClient.logout(logoutRequest);
         }
@@ -15867,52 +16241,6 @@ class StandardController {
         }
     }
     // #region Helpers
-    /**
-     * Helper to validate app environment before making an auth request
-     *
-     * @protected
-     * @param {InteractionType} interactionType What kind of interaction is being used
-     * @param {boolean} [isAppEmbedded=false] Whether to set interaction in progress temp cache flag
-     */
-    preflightBrowserEnvironmentCheck(interactionType, isAppEmbedded = false) {
-        this.logger.verbose("preflightBrowserEnvironmentCheck started");
-        // Block request if not in browser environment
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
-        // Block redirects if in an iframe
-        blockRedirectInIframe(interactionType, this.config.system.allowRedirectInIframe);
-        // Block auth requests inside a hidden iframe
-        blockReloadInHiddenIframes();
-        // Block redirectUri opened in a popup from calling MSAL APIs
-        blockAcquireTokenInPopups();
-        // Block token acquisition before initialize has been called
-        blockAPICallsBeforeInitialize(this.initialized);
-        // Block redirects if memory storage is enabled but storeAuthStateInCookie is not
-        if (interactionType === exports.InteractionType.Redirect &&
-            this.config.cache.cacheLocation ===
-                BrowserCacheLocation.MemoryStorage &&
-            !this.config.cache.storeAuthStateInCookie) {
-            throw createBrowserConfigurationAuthError(inMemRedirectUnavailable);
-        }
-        if (interactionType === exports.InteractionType.Redirect ||
-            interactionType === exports.InteractionType.Popup) {
-            this.preflightInteractiveRequest(!isAppEmbedded);
-        }
-    }
-    /**
-     * Preflight check for interactive requests
-     *
-     * @protected
-     * @param {boolean} setInteractionInProgress Whether to set interaction in progress temp cache flag
-     */
-    preflightInteractiveRequest(setInteractionInProgress) {
-        this.logger.verbose("preflightInteractiveRequest called, validating app environment");
-        // block the reload if it occurred inside a hidden iframe
-        blockReloadInHiddenIframes();
-        // Set interaction in progress temporary cache or throw if alread set.
-        if (setInteractionInProgress) {
-            this.getBrowserStorage().setInteractionInProgress(true);
-        }
-    }
     /**
      * Acquire a token from native device (e.g. WAM)
      * @param request
@@ -16097,12 +16425,6 @@ class StandardController {
     getPerformanceClient() {
         return this.performanceClient;
     }
-    /**
-     * Returns the browser storage
-     */
-    getBrowserStorage() {
-        return this.browserStorage;
-    }
     /**
      * Returns the browser env indicator
      */
@@ -16180,7 +16502,7 @@ class StandardController {
         atsMeasurement.add({
             cacheLookupPolicy: request.cacheLookupPolicy,
         });
-        this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
+        preflightCheck(this.initialized);
         this.logger.verbose("acquireTokenSilent called", correlationId);
         const account = request.account || this.getActiveAccount();
         if (!account) {
@@ -16225,10 +16547,8 @@ class StandardController {
                 .catch((error) => {
                 this.activeSilentTokenRequests.delete(silentRequestKey);
                 atsMeasurement.end({
-                    errorCode: error.errorCode,
-                    subErrorCode: error.subError,
                     success: false,
-                });
+                }, error);
                 throw error;
             });
             this.activeSilentTokenRequests.set(silentRequestKey, response);
@@ -16256,11 +16576,10 @@ class StandardController {
     async acquireTokenSilentAsync(request, account) {
         this.performanceClient.addQueueMeasurement(PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
-        this.atsAsyncMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
-        this.atsAsyncMeasurement?.increment({
-            visibilityChangeCount: 0,
-        });
-        document.addEventListener("visibilitychange", this.trackPageVisibility);
+        if (request.correlationId) {
+            this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+        }
+        document.addEventListener("visibilitychange", () => this.trackPageVisibility(request.correlationId));
         let result;
         if (NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme) &&
             account.nativeAccountId) {
@@ -16283,16 +16602,13 @@ class StandardController {
         }
         else {
             this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow");
-            const silentCacheClient = this.createSilentCacheClient(request.correlationId);
-            const silentRequest = await invokeAsync(silentCacheClient.initializeSilentRequest.bind(silentCacheClient), PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account);
+            const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
             const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
-            result = invokeAsync(this.acquireTokenFromCache.bind(this), PerformanceEvents.AcquireTokenFromCache, this.logger, this.performanceClient, silentRequest.correlationId)(silentCacheClient, silentRequest, cacheLookupPolicy).catch((cacheError) => {
+            result = invokeAsync(this.acquireTokenFromCache.bind(this), PerformanceEvents.AcquireTokenFromCache, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy).catch((cacheError) => {
                 if (request.cacheLookupPolicy ===
                     CacheLookupPolicy.AccessToken) {
                     throw cacheError;
                 }
-                // block the reload if it occurred inside a hidden iframe
-                blockReloadInHiddenIframes();
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, silentRequest);
                 return invokeAsync(this.acquireTokenByRefreshToken.bind(this), PerformanceEvents.AcquireTokenByRefreshToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy).catch((refreshTokenError) => {
                     const shouldTryToResolveSilently = checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, silentRequest, cacheLookupPolicy);
@@ -16310,25 +16626,21 @@ class StandardController {
         return result
             .then((response) => {
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
-            this.atsAsyncMeasurement?.end({
-                success: true,
-                fromCache: response.fromCache,
-                isNativeBroker: response.fromNativeBroker,
-                requestId: response.requestId,
-            });
+            if (request.correlationId) {
+                this.performanceClient.addFields({
+                    fromCache: response.fromCache,
+                    isNativeBroker: response.fromNativeBroker,
+                    requestId: response.requestId,
+                }, request.correlationId);
+            }
             return response;
         })
             .catch((tokenRenewalError) => {
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError);
-            this.atsAsyncMeasurement?.end({
-                errorCode: tokenRenewalError.errorCode,
-                subErrorCode: tokenRenewalError.subError,
-                success: false,
-            });
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibility);
+            document.removeEventListener("visibilitychange", () => this.trackPageVisibility(request.correlationId));
         });
     }
 }
@@ -16769,27 +17081,27 @@ class UnknownOperatingContextController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     acquireTokenPopup(request) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     acquireTokenRedirect(request) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return Promise.resolve();
     }
     acquireTokenSilent(
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     silentRequest) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     acquireTokenByCode(
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     request) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     acquireTokenNative(
@@ -16800,7 +17112,7 @@ class UnknownOperatingContextController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     accountId) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     acquireTokenByRefreshToken(
@@ -16809,7 +17121,7 @@ class UnknownOperatingContextController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     silentRequest) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     addEventCallback(callback) {
@@ -16821,22 +17133,22 @@ class UnknownOperatingContextController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     addPerformanceCallback(callback) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return "";
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     removePerformanceCallback(callbackId) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return true;
     }
     enableAccountStorageEvents() {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     disableAccountStorageEvents() {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     handleRedirectPromise(
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -16848,45 +17160,45 @@ class UnknownOperatingContextController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     request) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     loginRedirect(request) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     logout(logoutRequest) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     logoutRedirect(
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     logoutRequest) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     logoutPopup(
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     logoutRequest) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     ssoSilent(
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     request) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     getTokenCache() {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     getLogger() {
@@ -16895,16 +17207,16 @@ class UnknownOperatingContextController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setLogger(logger) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setActiveAccount(account) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     getActiveAccount() {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return null;
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -16914,43 +17226,35 @@ class UnknownOperatingContextController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setNavigationClient(navigationClient) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     getConfiguration() {
         return this.config;
     }
     isBrowserEnv() {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return true;
     }
     getBrowserCrypto() {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     getPerformanceClient() {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
     getRedirectResponse() {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {};
     }
-    preflightBrowserEnvironmentCheck(
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    interactionType, 
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    isAppEmbedded) {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
-    }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     async clearCache(logoutRequest) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     async hydrateCache(
@@ -16959,7 +17263,7 @@ class UnknownOperatingContextController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     request) {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
 }
 
@@ -17610,14 +17914,14 @@ function getPerfDurationMs(startTime) {
     return Math.round(window.performance.now() - startTime);
 }
 class BrowserPerformanceClient extends PerformanceClient {
-    constructor(configuration, intFields) {
+    constructor(configuration, intFields, abbreviations) {
         super(configuration.auth.clientId, configuration.auth.authority || `${Constants.DEFAULT_AUTHORITY}`, new Logger(configuration.system?.loggerOptions || {}, name, version), name, version, configuration.telemetry?.application || {
             appName: "",
             appVersion: "",
-        }, intFields);
+        }, intFields, abbreviations);
     }
     generateId() {
-        return window.crypto.randomUUID();
+        return createNewGuid();
     }
     getPageVisibility() {
         return document.visibilityState?.toString() || null;
@@ -17658,13 +17962,13 @@ class BrowserPerformanceClient extends PerformanceClient {
         void browserMeasurement?.then((measurement) => measurement.startMeasurement());
         return {
             ...inProgressEvent,
-            end: (event) => {
+            end: (event, error) => {
                 const res = inProgressEvent.end({
                     ...event,
                     startPageVisibility,
                     endPageVisibility: this.getPageVisibility(),
                     durationMs: getPerfDurationMs(startTime),
-                });
+                }, error);
                 void browserMeasurement?.then((measurement) => measurement.endMeasurement());
                 this.deleteIncompleteSubMeasurements(inProgressEvent);
                 return res;
@@ -17860,11 +18164,12 @@ class NestedAppAuthAdapter {
         }
         const requestBuilder = new RequestParameterBuilder();
         const claims = requestBuilder.addClientCapabilitiesToClaims(request.claims, this.clientCapabilities);
+        const scopes = request.scopes || OIDC_DEFAULT_SCOPES;
         const tokenRequest = {
             platformBrokerId: request.account?.homeAccountId,
             clientId: this.clientId,
             authority: request.authority,
-            scope: request.scopes.join(" "),
+            scope: scopes.join(" "),
             correlationId: request.correlationId !== undefined
                 ? request.correlationId
                 : this.crypto.createNewGuid(),
@@ -18046,12 +18351,22 @@ class NestedAppAuthController {
         // do nothing not required by this controller
         return Promise.resolve();
     }
+    ensureValidRequest(request) {
+        if (request?.correlationId) {
+            return request;
+        }
+        return {
+            ...request,
+            correlationId: this.browserCrypto.createNewGuid(),
+        };
+    }
     async acquireTokenInteractive(request) {
-        this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Popup, request);
-        const atPopupMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenPopup, request.correlationId);
+        const validRequest = this.ensureValidRequest(request);
+        this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Popup, validRequest);
+        const atPopupMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenPopup, validRequest.correlationId);
         atPopupMeasurement?.add({ nestedAppAuthRequest: true });
         try {
-            const naaRequest = this.nestedAppAuthAdapter.toNaaTokenRequest(request);
+            const naaRequest = this.nestedAppAuthAdapter.toNaaTokenRequest(validRequest);
             const reqTimestamp = nowSeconds();
             const response = await this.bridgeProxy.getTokenInteractive(naaRequest);
             const result = this.nestedAppAuthAdapter.fromNaaTokenResponse(naaRequest, response, reqTimestamp);
@@ -18071,16 +18386,15 @@ class NestedAppAuthController {
             const error = this.nestedAppAuthAdapter.fromBridgeError(e);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Popup, null, e);
             atPopupMeasurement.end({
-                errorCode: error.errorCode,
-                subErrorCode: error.subError,
                 success: false,
-            });
+            }, e);
             throw error;
         }
     }
     async acquireTokenSilentInternal(request) {
-        this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
-        const ssoSilentMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.SsoSilent, request.correlationId);
+        const validRequest = this.ensureValidRequest(request);
+        this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, validRequest);
+        const ssoSilentMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.SsoSilent, validRequest.correlationId);
         ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
         });
@@ -18088,7 +18402,7 @@ class NestedAppAuthController {
             nestedAppAuthRequest: true,
         });
         try {
-            const naaRequest = this.nestedAppAuthAdapter.toNaaTokenRequest(request);
+            const naaRequest = this.nestedAppAuthAdapter.toNaaTokenRequest(validRequest);
             const reqTimestamp = nowSeconds();
             const response = await this.bridgeProxy.getTokenSilent(naaRequest);
             const result = this.nestedAppAuthAdapter.fromNaaTokenResponse(naaRequest, response, reqTimestamp);
@@ -18108,10 +18422,8 @@ class NestedAppAuthController {
             const error = this.nestedAppAuthAdapter.fromBridgeError(e);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, e);
             ssoSilentMeasurement?.end({
-                errorCode: error.errorCode,
-                subErrorCode: error.subError,
                 success: false,
-            });
+            }, e);
             throw error;
         }
     }
@@ -18228,7 +18540,7 @@ class NestedAppAuthController {
     }
     handleRedirectPromise(hash // eslint-disable-line @typescript-eslint/no-unused-vars
     ) {
-        throw NestedAppAuthError.createUnsupportedError();
+        return Promise.resolve(null);
     }
     loginPopup(request // eslint-disable-line @typescript-eslint/no-unused-vars
     ) {
@@ -18321,11 +18633,6 @@ class NestedAppAuthController {
     getRedirectResponse() {
         throw NestedAppAuthError.createUnsupportedError();
     }
-    preflightBrowserEnvironmentCheck(interactionType, // eslint-disable-line @typescript-eslint/no-unused-vars
-    setInteractionInProgress // eslint-disable-line @typescript-eslint/no-unused-vars
-    ) {
-        throw NestedAppAuthError.createUnsupportedError();
-    }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     async clearCache(logoutRequest) {
         throw NestedAppAuthError.createUnsupportedError();
@@ -18392,6 +18699,7 @@ exports.ServerError = ServerError;
 exports.ServerResponseType = ServerResponseType;
 exports.SignedHttpRequest = SignedHttpRequest;
 exports.StringUtils = StringUtils;
+exports.StubPerformanceClient = StubPerformanceClient;
 exports.UrlString = UrlString;
 exports.WrapperSKU = WrapperSKU;
 exports.stubbedPublicClientApplication = stubbedPublicClientApplication;