@azure/msal-browser 4.11.1 → 4.13.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.11.1 2025-04-29 */
+/*! @azure/msal-browser v4.13.0 2025-05-30 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -256,13 +256,6 @@ const Errors = {
     INVALID_GRANT_ERROR: "invalid_grant",
     CLIENT_MISMATCH_ERROR: "client_mismatch",
 };
-/**
- * Response codes
- */
-const ResponseCodes = {
-    httpSuccess: 200,
-    httpBadRequest: 400,
-};
 /**
  * Region Discovery Sources
  */
@@ -305,7 +298,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -322,7 +315,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -371,7 +364,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -469,7 +462,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -721,7 +714,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -760,7 +753,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -951,12 +944,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.5.2";
+const version$1 = "15.7.0";
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -976,7 +969,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1037,7 +1030,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1092,7 +1085,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1419,7 +1412,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1473,7 +1466,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1611,7 +1604,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1708,7 +1701,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1899,7 +1892,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1939,7 +1932,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2018,7 +2011,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2033,7 +2026,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2055,7 +2048,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2079,7 +2072,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2322,7 +2315,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2387,7 +2380,7 @@ function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParame
     return queryParameterArray.join("&");
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2551,7 +2544,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2691,7 +2684,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2699,7 +2692,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
 const cacheUnknownErrorCode = "cache_error_unknown";
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2726,7 +2719,7 @@ class CacheError extends Error {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3911,7 +3904,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4011,7 +4004,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4021,7 +4014,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4071,7 +4064,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4439,7 +4432,7 @@ function addEARParameters(parameters, jwk) {
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4451,7 +4444,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4461,7 +4454,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4471,7 +4464,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4984,7 +4977,7 @@ const IntFields = new Set([
     "encryptedCacheExpiredCount",
 ]);
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5080,7 +5073,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5107,15 +5100,13 @@ class RegionDiscovery {
             const options = RegionDiscovery.IMDS_OPTIONS;
             try {
                 const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), PerformanceEvents.RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(Constants.IMDS_VERSION, options);
-                if (localIMDSVersionResponse.status ===
-                    ResponseCodes.httpSuccess) {
+                if (localIMDSVersionResponse.status === HttpStatus.SUCCESS) {
                     autodetectedRegionName = localIMDSVersionResponse.body;
                     regionDiscoveryMetadata.region_source =
                         RegionDiscoverySources.IMDS;
                 }
                 // If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
-                if (localIMDSVersionResponse.status ===
-                    ResponseCodes.httpBadRequest) {
+                if (localIMDSVersionResponse.status === HttpStatus.BAD_REQUEST) {
                     const currentIMDSVersion = await invokeAsync(this.getCurrentVersion.bind(this), PerformanceEvents.RegionDiscoveryGetCurrentVersion, this.logger, this.performanceClient, this.correlationId)(options);
                     if (!currentIMDSVersion) {
                         regionDiscoveryMetadata.region_source =
@@ -5123,8 +5114,7 @@ class RegionDiscovery {
                         return null;
                     }
                     const currentIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), PerformanceEvents.RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(currentIMDSVersion, options);
-                    if (currentIMDSVersionResponse.status ===
-                        ResponseCodes.httpSuccess) {
+                    if (currentIMDSVersionResponse.status === HttpStatus.SUCCESS) {
                         autodetectedRegionName =
                             currentIMDSVersionResponse.body;
                         regionDiscoveryMetadata.region_source =
@@ -5169,7 +5159,7 @@ class RegionDiscovery {
         try {
             const response = await this.networkInterface.sendGetRequestAsync(`${Constants.IMDS_ENDPOINT}?format=json`, options);
             // When IMDS endpoint is called without the api version query param, bad request response comes back with latest version.
-            if (response.status === ResponseCodes.httpBadRequest &&
+            if (response.status === HttpStatus.BAD_REQUEST &&
                 response.body &&
                 response.body["newest-versions"] &&
                 response.body["newest-versions"].length > 0) {
@@ -5189,7 +5179,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6028,7 +6018,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6059,7 +6049,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6078,7 +6068,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6099,7 +6089,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6186,7 +6176,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6217,7 +6207,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6365,7 +6355,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6391,7 +6381,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6479,7 +6469,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6551,7 +6541,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6635,7 +6625,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6662,7 +6652,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6993,7 +6983,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7060,7 +7050,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7078,7 +7068,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7311,7 +7301,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7520,7 +7510,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7618,7 +7608,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7633,7 +7623,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7857,7 +7847,7 @@ function extractLoginHint(account) {
     return account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7915,7 +7905,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8178,7 +8168,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8186,7 +8176,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8211,7 +8201,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8251,7 +8241,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8330,7 +8320,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.5.2 2025-04-29 */
+/*! @azure/msal-common v15.7.0 2025-05-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9349,10 +9339,15 @@ const BrowserConstants = {
      */
     MSAL_SKU: "msal.js.browser",
 };
-const NativeConstants = {
+const PlatformAuthConstants = {
     CHANNEL_ID: "53ee284d-920a-4b59-9d30-a60315b26836",
     PREFERRED_EXTENSION_ID: "ppnbnpeolgkicgegkbkbjmhlideopiji",
     MATS_TELEMETRY: "MATS",
+    MICROSOFT_ENTRA_BROKERID: "MicrosoftEntra",
+    DOM_API_NAME: "DOM API",
+    PLATFORM_DOM_APIS: "get-token-and-sign-out",
+    PLATFORM_DOM_PROVIDER: "PlatformAuthDOMHandler",
+    PLATFORM_EXTENSION_PROVIDER: "PlatformAuthExtensionHandler",
 };
 const NativeExtensionMethod = {
     HandshakeRequest: "Handshake",
@@ -9390,6 +9385,7 @@ const TemporaryCacheKeys = {
 const StaticCacheKeys = {
     ACCOUNT_KEYS: "msal.account.keys",
     TOKEN_KEYS: "msal.token.keys",
+    VERSION: "msal.version",
 };
 /**
  * Cache keys stored in-memory
@@ -9518,7 +9514,8 @@ const iFrameRenewalPolicies = [
 ];
 const LOG_LEVEL_CACHE_KEY = "msal.browser.log.level";
 const LOG_PII_CACHE_KEY = "msal.browser.log.pii";
-const BROWSER_PERF_ENABLED_KEY = "msal.browser.performance.enabled";
+const BROWSER_PERF_ENABLED_KEY = "msal.browser.performance.enabled";
+const PLATFORM_AUTH_DOM_SUPPORT = "msal.browser.platform.auth.dom";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10428,7 +10425,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.11.1";
+const version = "4.13.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11780,6 +11777,7 @@ const EventType = {
     LOGOUT_FAILURE: "msal:logoutFailure",
     LOGOUT_END: "msal:logoutEnd",
     RESTORE_FROM_BFCACHE: "msal:restoreFromBFCache",
+    BROKER_CONNECTION_ESTABLISHED: "msal:brokerConnectionEstablished",
 };
 
 /*
@@ -11805,6 +11803,20 @@ class BrowserCacheManager extends CacheManager {
     }
     async initialize(correlationId) {
         await this.browserStorage.initialize(correlationId);
+        this.trackVersionChanges(correlationId);
+    }
+    /**
+     * Tracks upgrades and downgrades for telemetry and debugging purposes
+     */
+    trackVersionChanges(correlationId) {
+        const previousVersion = this.browserStorage.getItem(StaticCacheKeys.VERSION);
+        if (previousVersion) {
+            this.logger.info(`MSAL.js was last initialized by version: ${previousVersion}`);
+            this.performanceClient.addFields({ previousLibraryVersion: previousVersion }, correlationId);
+        }
+        if (previousVersion !== version) {
+            this.browserStorage.setItem(StaticCacheKeys.VERSION, version);
+        }
     }
     /**
      * Parses passed value as JSON object, JSON.parse() will throw an error.
@@ -12525,7 +12537,17 @@ class BrowserCacheManager extends CacheManager {
     getInteractionInProgress() {
         const key = `${Constants.CACHE_PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}`;
         const value = this.getTemporaryCache(key, false);
-        return value ? JSON.parse(value) : null;
+        try {
+            return value ? JSON.parse(value) : null;
+        }
+        catch (e) {
+            // Remove interaction and other temp keys if interaction status can't be parsed
+            this.logger.error(`Cannot parse interaction status. Removing temporary cache items and clearing url hash. Retrying interaction should fix the error`);
+            this.removeTemporaryItem(key);
+            this.resetRequestCache();
+            clearHash(window);
+            return null;
+        }
     }
     setInteractionInProgress(inProgress, type = INTERACTION_TYPE.SIGNIN) {
         // Ensure we don't overwrite interaction in progress for a different clientId
@@ -12874,14 +12896,14 @@ class EventHandler {
  * Licensed under the MIT License.
  */
 class BaseInteractionClient {
-    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) {
+    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, platformAuthProvider, correlationId) {
         this.config = config;
         this.browserStorage = storageImpl;
         this.browserCrypto = browserCrypto;
         this.networkClient = this.config.system.networkClient;
         this.eventHandler = eventHandler;
         this.navigationClient = navigationClient;
-        this.nativeMessageHandler = nativeMessageHandler;
+        this.platformAuthProvider = platformAuthProvider;
         this.correlationId = correlationId || createNewGuid();
         this.logger = logger.clone(BrowserConstants.MSAL_SKU, version, this.correlationId);
         this.performanceClient = performanceClient;
@@ -13237,6 +13259,159 @@ class StandardInteractionClient extends BaseInteractionClient {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Extracts the BrowserStateObject from the state string.
+ * @param browserCrypto
+ * @param state
+ */
+function extractBrowserRequestState(browserCrypto, state) {
+    if (!state) {
+        return null;
+    }
+    try {
+        const requestStateObj = ProtocolUtils.parseRequestState(browserCrypto, state);
+        return requestStateObj.libraryState.meta;
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function deserializeResponse(responseString, responseLocation, logger) {
+    // Deserialize hash fragment response parameters.
+    const serverParams = getDeserializedResponse(responseString);
+    if (!serverParams) {
+        if (!stripLeadingHashOrQuery(responseString)) {
+            // Hash or Query string is empty
+            logger.error(`The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`);
+            throw createBrowserAuthError(hashEmptyError);
+        }
+        else {
+            logger.error(`A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`);
+            logger.errorPii(`The ${responseLocation} detected is: ${responseString}`);
+            throw createBrowserAuthError(hashDoesNotContainKnownProperties);
+        }
+    }
+    return serverParams;
+}
+/**
+ * Returns the interaction type that the response object belongs to
+ */
+function validateInteractionType(response, browserCrypto, interactionType) {
+    if (!response.state) {
+        throw createBrowserAuthError(noStateInHash);
+    }
+    const platformStateObj = extractBrowserRequestState(browserCrypto, response.state);
+    if (!platformStateObj) {
+        throw createBrowserAuthError(unableToParseState);
+    }
+    if (platformStateObj.interactionType !== interactionType) {
+        throw createBrowserAuthError(stateInteractionTypeMismatch);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Abstract class which defines operations for a browser interaction handling class.
+ */
+class InteractionHandler {
+    constructor(authCodeModule, storageImpl, authCodeRequest, logger, performanceClient) {
+        this.authModule = authCodeModule;
+        this.browserStorage = storageImpl;
+        this.authCodeRequest = authCodeRequest;
+        this.logger = logger;
+        this.performanceClient = performanceClient;
+    }
+    /**
+     * Function to handle response parameters from hash.
+     * @param locationHash
+     */
+    async handleCodeResponse(response, request) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
+        let authCodeResponse;
+        try {
+            authCodeResponse = getAuthorizationCodePayload(response, request.state);
+        }
+        catch (e) {
+            if (e instanceof ServerError &&
+                e.subError === userCancelled) {
+                // Translate server error caused by user closing native prompt to corresponding first class MSAL error
+                throw createBrowserAuthError(userCancelled);
+            }
+            else {
+                throw e;
+            }
+        }
+        return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request);
+    }
+    /**
+     * Process auth code response from AAD
+     * @param authCodeResponse
+     * @param state
+     * @param authority
+     * @param networkModule
+     * @returns
+     */
+    async handleCodeResponseFromServer(authCodeResponse, request, validateNonce = true) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromServer, request.correlationId);
+        this.logger.trace("InteractionHandler.handleCodeResponseFromServer called");
+        // Assign code to request
+        this.authCodeRequest.code = authCodeResponse.code;
+        // Check for new cloud instance
+        if (authCodeResponse.cloud_instance_host_name) {
+            await invokeAsync(this.authModule.updateAuthority.bind(this.authModule), PerformanceEvents.UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodeResponse.cloud_instance_host_name, request.correlationId);
+        }
+        // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
+        if (validateNonce) {
+            // TODO: Assigning "response nonce" to "request nonce" is confusing. Refactor the function doing validation to accept request nonce directly
+            authCodeResponse.nonce = request.nonce || undefined;
+        }
+        authCodeResponse.state = request.state;
+        // Add CCS parameters if available
+        if (authCodeResponse.client_info) {
+            this.authCodeRequest.clientInfo = authCodeResponse.client_info;
+        }
+        else {
+            const ccsCred = this.createCcsCredentials(request);
+            if (ccsCred) {
+                this.authCodeRequest.ccsCredential = ccsCred;
+            }
+        }
+        // Acquire token with retrieved code.
+        const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, authCodeResponse));
+        return tokenResponse;
+    }
+    /**
+     * Build ccs creds if available
+     */
+    createCcsCredentials(request) {
+        if (request.account) {
+            return {
+                credential: request.account.homeAccountId,
+                type: CcsCredentialType.HOME_ACCOUNT_ID,
+            };
+        }
+        else if (request.loginHint) {
+            return {
+                credential: request.loginHint,
+                type: CcsCredentialType.UPN,
+            };
+        }
+        return null;
+    }
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -13321,930 +13496,1153 @@ function createNativeAuthError(code, description, ext) {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-class NativeMessageHandler {
-    constructor(logger, handshakeTimeoutMs, performanceClient, extensionId) {
-        this.logger = logger;
-        this.handshakeTimeoutMs = handshakeTimeoutMs;
-        this.extensionId = extensionId;
-        this.resolvers = new Map(); // Used for non-handshake messages
-        this.handshakeResolvers = new Map(); // Used for handshake messages
-        this.messageChannel = new MessageChannel();
-        this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
-        this.performanceClient = performanceClient;
-        this.handshakeEvent = performanceClient.startMeasurement(PerformanceEvents.NativeMessageHandlerHandshake);
-    }
+class SilentCacheClient extends StandardInteractionClient {
     /**
-     * Sends a given message to the extension and resolves with the extension response
-     * @param body
+     * Returns unexpired tokens from the cache, if available
+     * @param silentRequest
      */
-    async sendMessage(body) {
-        this.logger.trace("NativeMessageHandler - sendMessage called.");
-        const req = {
-            channel: NativeConstants.CHANNEL_ID,
-            extensionId: this.extensionId,
-            responseId: createNewGuid(),
-            body: body,
-        };
-        this.logger.trace("NativeMessageHandler - Sending request to browser extension");
-        this.logger.tracePii(`NativeMessageHandler - Sending request to browser extension: ${JSON.stringify(req)}`);
-        this.messageChannel.port1.postMessage(req);
-        return new Promise((resolve, reject) => {
-            this.resolvers.set(req.responseId, { resolve, reject });
+    async acquireToken(silentRequest) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
+        // Telemetry manager only used to increment cacheHits here
+        const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow);
+        const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), PerformanceEvents.StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
+            serverTelemetryManager,
+            requestAuthority: silentRequest.authority,
+            requestAzureCloudOptions: silentRequest.azureCloudOptions,
+            account: silentRequest.account,
         });
-    }
-    /**
-     * Returns an instance of the MessageHandler that has successfully established a connection with an extension
-     * @param {Logger} logger
-     * @param {number} handshakeTimeoutMs
-     * @param {IPerformanceClient} performanceClient
-     * @param {ICrypto} crypto
-     */
-    static async createProvider(logger, handshakeTimeoutMs, performanceClient) {
-        logger.trace("NativeMessageHandler - createProvider called.");
+        const silentAuthClient = new SilentFlowClient(clientConfig, this.performanceClient);
+        this.logger.verbose("Silent auth client created");
         try {
-            const preferredProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, performanceClient, NativeConstants.PREFERRED_EXTENSION_ID);
-            await preferredProvider.sendHandshakeRequest();
-            return preferredProvider;
+            const response = await invokeAsync(silentAuthClient.acquireCachedToken.bind(silentAuthClient), PerformanceEvents.SilentFlowClientAcquireCachedToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest);
+            const authResponse = response[0];
+            this.performanceClient.addFields({
+                fromCache: true,
+            }, silentRequest.correlationId);
+            return authResponse;
         }
-        catch (e) {
-            // If preferred extension fails for whatever reason, fallback to using any installed extension
-            const backupProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, performanceClient);
-            await backupProvider.sendHandshakeRequest();
-            return backupProvider;
+        catch (error) {
+            if (error instanceof BrowserAuthError &&
+                error.errorCode === cryptoKeyNotFound) {
+                this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
+            }
+            throw error;
         }
     }
     /**
-     * Send handshake request helper.
+     * API to silenty clear the browser cache.
+     * @param logoutRequest
      */
-    async sendHandshakeRequest() {
-        this.logger.trace("NativeMessageHandler - sendHandshakeRequest called.");
-        // Register this event listener before sending handshake
-        window.addEventListener("message", this.windowListener, false); // false is important, because content script message processing should work first
-        const req = {
-            channel: NativeConstants.CHANNEL_ID,
-            extensionId: this.extensionId,
-            responseId: createNewGuid(),
-            body: {
-                method: NativeExtensionMethod.HandshakeRequest,
-            },
-        };
-        this.handshakeEvent.add({
-            extensionId: this.extensionId,
-            extensionHandshakeTimeoutMs: this.handshakeTimeoutMs,
-        });
-        this.messageChannel.port1.onmessage = (event) => {
-            this.onChannelMessage(event);
-        };
-        window.postMessage(req, window.origin, [this.messageChannel.port2]);
-        return new Promise((resolve, reject) => {
-            this.handshakeResolvers.set(req.responseId, { resolve, reject });
-            this.timeoutId = window.setTimeout(() => {
-                /*
-                 * Throw an error if neither HandshakeResponse nor original Handshake request are received in a reasonable timeframe.
-                 * This typically suggests an event handler stopped propagation of the Handshake request but did not respond to it on the MessageChannel port
-                 */
-                window.removeEventListener("message", this.windowListener, false);
-                this.messageChannel.port1.close();
-                this.messageChannel.port2.close();
-                this.handshakeEvent.end({
-                    extensionHandshakeTimedOut: true,
-                    success: false,
-                });
-                reject(createBrowserAuthError(nativeHandshakeTimeout));
-                this.handshakeResolvers.delete(req.responseId);
-            }, this.handshakeTimeoutMs); // Use a reasonable timeout in milliseconds here
+    logout(logoutRequest) {
+        this.logger.verbose("logoutRedirect called");
+        const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
+        return this.clearCacheOnLogout(validLogoutRequest?.account);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+class PlatformAuthInteractionClient extends BaseInteractionClient {
+    constructor(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, nativeStorageImpl, correlationId) {
+        super(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
+        this.apiId = apiId;
+        this.accountId = accountId;
+        this.platformAuthProvider = provider;
+        this.nativeStorageManager = nativeStorageImpl;
+        this.silentCacheClient = new SilentCacheClient(config, this.nativeStorageManager, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
+        const extensionName = this.platformAuthProvider.getExtensionName();
+        this.skus = ServerTelemetryManager.makeExtraSkuString({
+            libraryName: BrowserConstants.MSAL_SKU,
+            libraryVersion: version,
+            extensionName: extensionName,
+            extensionVersion: this.platformAuthProvider.getExtensionVersion(),
         });
     }
     /**
-     * Invoked when a message is posted to the window. If a handshake request is received it means the extension is not installed.
-     * @param event
+     * Adds SKUs to request extra query parameters
+     * @param request {PlatformAuthRequest}
+     * @private
      */
-    onWindowMessage(event) {
-        this.logger.trace("NativeMessageHandler - onWindowMessage called");
-        // We only accept messages from ourselves
-        if (event.source !== window) {
-            return;
-        }
-        const request = event.data;
-        if (!request.channel ||
-            request.channel !== NativeConstants.CHANNEL_ID) {
-            return;
-        }
-        if (request.extensionId && request.extensionId !== this.extensionId) {
-            return;
-        }
-        if (request.body.method === NativeExtensionMethod.HandshakeRequest) {
-            const handshakeResolver = this.handshakeResolvers.get(request.responseId);
-            /*
-             * Filter out responses with no matched resolvers sooner to keep channel ports open while waiting for
-             * the proper response.
-             */
-            if (!handshakeResolver) {
-                this.logger.trace(`NativeMessageHandler.onWindowMessage - resolver can't be found for request ${request.responseId}`);
-                return;
-            }
-            // If we receive this message back it means no extension intercepted the request, meaning no extension supporting handshake protocol is installed
-            this.logger.verbose(request.extensionId
-                ? `Extension with id: ${request.extensionId} not installed`
-                : "No extension installed");
-            clearTimeout(this.timeoutId);
-            this.messageChannel.port1.close();
-            this.messageChannel.port2.close();
-            window.removeEventListener("message", this.windowListener, false);
-            this.handshakeEvent.end({
-                success: false,
-                extensionInstalled: false,
-            });
-            handshakeResolver.reject(createBrowserAuthError(nativeExtensionNotInstalled));
-        }
+    addRequestSKUs(request) {
+        request.extraParameters = {
+            ...request.extraParameters,
+            [X_CLIENT_EXTRA_SKU]: this.skus,
+        };
     }
     /**
-     * Invoked when a message is received from the extension on the MessageChannel port
-     * @param event
+     * Acquire token from native platform via browser extension
+     * @param request
      */
-    onChannelMessage(event) {
-        this.logger.trace("NativeMessageHandler - onChannelMessage called.");
-        const request = event.data;
-        const resolver = this.resolvers.get(request.responseId);
-        const handshakeResolver = this.handshakeResolvers.get(request.responseId);
+    async acquireToken(request, cacheLookupPolicy) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+        this.logger.trace("NativeInteractionClient - acquireToken called.");
+        // start the perf measurement
+        const nativeATMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+        const reqTimestamp = nowSeconds();
+        const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
         try {
-            const method = request.body.method;
-            if (method === NativeExtensionMethod.Response) {
-                if (!resolver) {
-                    return;
-                }
-                const response = request.body.response;
-                this.logger.trace("NativeMessageHandler - Received response from browser extension");
-                this.logger.tracePii(`NativeMessageHandler - Received response from browser extension: ${JSON.stringify(response)}`);
-                if (response.status !== "Success") {
-                    resolver.reject(createNativeAuthError(response.code, response.description, response.ext));
-                }
-                else if (response.result) {
-                    if (response.result["code"] &&
-                        response.result["description"]) {
-                        resolver.reject(createNativeAuthError(response.result["code"], response.result["description"], response.result["ext"]));
-                    }
-                    else {
-                        resolver.resolve(response.result);
-                    }
-                }
-                else {
-                    throw createAuthError(unexpectedError, "Event does not contain result.");
-                }
-                this.resolvers.delete(request.responseId);
+            // initialize native request
+            const nativeRequest = await this.initializeNativeRequest(request);
+            // check if the tokens can be retrieved from internal cache
+            try {
+                const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
+                nativeATMeasurement.end({
+                    success: true,
+                    isNativeBroker: false,
+                    fromCache: true,
+                });
+                return result;
             }
-            else if (method === NativeExtensionMethod.HandshakeResponse) {
-                if (!handshakeResolver) {
-                    this.logger.trace(`NativeMessageHandler.onChannelMessage - resolver can't be found for request ${request.responseId}`);
-                    return;
+            catch (e) {
+                if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
+                    this.logger.info("MSAL internal Cache does not contain tokens, return error as per cache policy");
+                    throw e;
                 }
-                clearTimeout(this.timeoutId); // Clear setTimeout
-                window.removeEventListener("message", this.windowListener, false); // Remove 'No extension' listener
-                this.extensionId = request.extensionId;
-                this.extensionVersion = request.body.version;
-                this.logger.verbose(`NativeMessageHandler - Received HandshakeResponse from extension: ${this.extensionId}`);
-                this.handshakeEvent.end({
-                    extensionInstalled: true,
+                // continue with a native call for any and all errors
+                this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
+            }
+            const validatedResponse = await this.platformAuthProvider.sendMessage(nativeRequest);
+            return await this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
+                .then((result) => {
+                nativeATMeasurement.end({
                     success: true,
+                    isNativeBroker: true,
+                    requestId: result.requestId,
                 });
-                handshakeResolver.resolve();
-                this.handshakeResolvers.delete(request.responseId);
-            }
-            // Do nothing if method is not Response or HandshakeResponse
+                serverTelemetryManager.clearNativeBrokerErrorCode();
+                return result;
+            })
+                .catch((error) => {
+                nativeATMeasurement.end({
+                    success: false,
+                    errorCode: error.errorCode,
+                    subErrorCode: error.subError,
+                    isNativeBroker: true,
+                });
+                throw error;
+            });
         }
-        catch (err) {
-            this.logger.error("Error parsing response from WAM Extension");
-            this.logger.errorPii(`Error parsing response from WAM Extension: ${err}`);
-            this.logger.errorPii(`Unable to parse ${event}`);
-            if (resolver) {
-                resolver.reject(err);
-            }
-            else if (handshakeResolver) {
-                handshakeResolver.reject(err);
+        catch (e) {
+            if (e instanceof NativeAuthError) {
+                serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
             }
+            throw e;
         }
     }
     /**
-     * Returns the Id for the browser extension this handler is communicating with
-     * @returns
+     * Creates silent flow request
+     * @param request
+     * @param cachedAccount
+     * @returns CommonSilentFlowRequest
      */
-    getExtensionId() {
-        return this.extensionId;
+    createSilentCacheRequest(request, cachedAccount) {
+        return {
+            authority: request.authority,
+            correlationId: this.correlationId,
+            scopes: ScopeSet.fromString(request.scope).asArray(),
+            account: cachedAccount,
+            forceRefresh: false,
+        };
     }
     /**
-     * Returns the version for the browser extension this handler is communicating with
-     * @returns
+     * Fetches the tokens from the cache if un-expired
+     * @param nativeAccountId
+     * @param request
+     * @returns authenticationResult
      */
-    getExtensionVersion() {
-        return this.extensionVersion;
+    async acquireTokensFromCache(nativeAccountId, request) {
+        if (!nativeAccountId) {
+            this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided");
+            throw createClientAuthError(noAccountFound);
+        }
+        // fetch the account from browser cache
+        const account = this.browserStorage.getBaseAccountInfo({
+            nativeAccountId,
+        });
+        if (!account) {
+            throw createClientAuthError(noAccountFound);
+        }
+        // leverage silent flow for cached tokens retrieval
+        try {
+            const silentRequest = this.createSilentCacheRequest(request, account);
+            const result = await this.silentCacheClient.acquireToken(silentRequest);
+            const fullAccount = {
+                ...account,
+                idTokenClaims: result?.idTokenClaims,
+                idToken: result?.idToken,
+            };
+            return {
+                ...result,
+                account: fullAccount,
+            };
+        }
+        catch (e) {
+            throw e;
+        }
     }
     /**
-     * Returns boolean indicating whether or not the request should attempt to use native broker
-     * @param logger
-     * @param config
-     * @param nativeExtensionProvider
-     * @param authenticationScheme
+     * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
+     * @param {RedirectRequest} request
+     * @param {InProgressPerformanceEvent} rootMeasurement
      */
-    static isPlatformBrokerAvailable(config, logger, nativeExtensionProvider, authenticationScheme) {
-        logger.trace("isPlatformBrokerAvailable called");
-        if (!config.system.allowPlatformBroker) {
-            logger.trace("isPlatformBrokerAvailable: allowPlatformBroker is not enabled, returning false");
-            // Developer disabled WAM
-            return false;
-        }
-        if (!nativeExtensionProvider) {
-            logger.trace("isPlatformBrokerAvailable: Platform extension provider is not initialized, returning false");
-            // Extension is not available
-            return false;
+    async acquireTokenRedirect(request, rootMeasurement) {
+        this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
+        const { ...remainingParameters } = request;
+        delete remainingParameters.onRedirectNavigate;
+        const nativeRequest = await this.initializeNativeRequest(remainingParameters);
+        try {
+            await this.platformAuthProvider.sendMessage(nativeRequest);
         }
-        if (authenticationScheme) {
-            switch (authenticationScheme) {
-                case AuthenticationScheme.BEARER:
-                case AuthenticationScheme.POP:
-                    logger.trace("isPlatformBrokerAvailable: authenticationScheme is supported, returning true");
-                    return true;
-                default:
-                    logger.trace("isPlatformBrokerAvailable: authenticationScheme is not supported, returning false");
-                    return false;
+        catch (e) {
+            // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
+            if (e instanceof NativeAuthError) {
+                const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
+                if (isFatalNativeAuthError(e)) {
+                    throw e;
+                }
             }
         }
-        return true;
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Extracts the BrowserStateObject from the state string.
- * @param browserCrypto
- * @param state
- */
-function extractBrowserRequestState(browserCrypto, state) {
-    if (!state) {
-        return null;
-    }
-    try {
-        const requestStateObj = ProtocolUtils.parseRequestState(browserCrypto, state);
-        return requestStateObj.libraryState.meta;
-    }
-    catch (e) {
-        throw createClientAuthError(invalidState);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-function deserializeResponse(responseString, responseLocation, logger) {
-    // Deserialize hash fragment response parameters.
-    const serverParams = getDeserializedResponse(responseString);
-    if (!serverParams) {
-        if (!stripLeadingHashOrQuery(responseString)) {
-            // Hash or Query string is empty
-            logger.error(`The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`);
-            throw createBrowserAuthError(hashEmptyError);
-        }
-        else {
-            logger.error(`A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`);
-            logger.errorPii(`The ${responseLocation} detected is: ${responseString}`);
-            throw createBrowserAuthError(hashDoesNotContainKnownProperties);
-        }
-    }
-    return serverParams;
-}
-/**
- * Returns the interaction type that the response object belongs to
- */
-function validateInteractionType(response, browserCrypto, interactionType) {
-    if (!response.state) {
-        throw createBrowserAuthError(noStateInHash);
-    }
-    const platformStateObj = extractBrowserRequestState(browserCrypto, response.state);
-    if (!platformStateObj) {
-        throw createBrowserAuthError(unableToParseState);
-    }
-    if (platformStateObj.interactionType !== interactionType) {
-        throw createBrowserAuthError(stateInteractionTypeMismatch);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Abstract class which defines operations for a browser interaction handling class.
- */
-class InteractionHandler {
-    constructor(authCodeModule, storageImpl, authCodeRequest, logger, performanceClient) {
-        this.authModule = authCodeModule;
-        this.browserStorage = storageImpl;
-        this.authCodeRequest = authCodeRequest;
-        this.logger = logger;
-        this.performanceClient = performanceClient;
+        this.browserStorage.setTemporaryCache(TemporaryCacheKeys.NATIVE_REQUEST, JSON.stringify(nativeRequest), true);
+        const navigationOptions = {
+            apiId: ApiId.acquireTokenRedirect,
+            timeout: this.config.system.redirectNavigationTimeout,
+            noHistory: false,
+        };
+        const redirectUri = this.config.auth.navigateToLoginRequestUrl
+            ? window.location.href
+            : this.getRedirectUri(request.redirectUri);
+        rootMeasurement.end({ success: true });
+        await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
     }
     /**
-     * Function to handle response parameters from hash.
-     * @param locationHash
+     * If the previous page called native platform for a token using redirect APIs, send the same request again and return the response
+     * @param performanceClient {IPerformanceClient?}
+     * @param correlationId {string?} correlation identifier
      */
-    async handleCodeResponse(response, request) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
-        let authCodeResponse;
-        try {
-            authCodeResponse = getAuthorizationCodePayload(response, request.state);
+    async handleRedirectPromise(performanceClient, correlationId) {
+        this.logger.trace("NativeInteractionClient - handleRedirectPromise called.");
+        if (!this.browserStorage.isInteractionInProgress(true)) {
+            this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
+            return null;
         }
-        catch (e) {
-            if (e instanceof ServerError &&
-                e.subError === userCancelled) {
-                // Translate server error caused by user closing native prompt to corresponding first class MSAL error
-                throw createBrowserAuthError(userCancelled);
-            }
-            else {
-                throw e;
+        // remove prompt from the request to prevent WAM from prompting twice
+        const cachedRequest = this.browserStorage.getCachedNativeRequest();
+        if (!cachedRequest) {
+            this.logger.verbose("NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null.");
+            if (performanceClient && correlationId) {
+                performanceClient?.addFields({ errorCode: "no_cached_request" }, correlationId);
             }
+            return null;
         }
-        return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request);
-    }
-    /**
-     * Process auth code response from AAD
-     * @param authCodeResponse
-     * @param state
-     * @param authority
-     * @param networkModule
-     * @returns
-     */
-    async handleCodeResponseFromServer(authCodeResponse, request, validateNonce = true) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromServer, request.correlationId);
-        this.logger.trace("InteractionHandler.handleCodeResponseFromServer called");
-        // Assign code to request
-        this.authCodeRequest.code = authCodeResponse.code;
-        // Check for new cloud instance
-        if (authCodeResponse.cloud_instance_host_name) {
-            await invokeAsync(this.authModule.updateAuthority.bind(this.authModule), PerformanceEvents.UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodeResponse.cloud_instance_host_name, request.correlationId);
-        }
-        // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
-        if (validateNonce) {
-            // TODO: Assigning "response nonce" to "request nonce" is confusing. Refactor the function doing validation to accept request nonce directly
-            authCodeResponse.nonce = request.nonce || undefined;
+        const { prompt, ...request } = cachedRequest;
+        if (prompt) {
+            this.logger.verbose("NativeInteractionClient - handleRedirectPromise called and prompt was included in the original request, removing prompt from cached request to prevent second interaction with native broker window.");
         }
-        authCodeResponse.state = request.state;
-        // Add CCS parameters if available
-        if (authCodeResponse.client_info) {
-            this.authCodeRequest.clientInfo = authCodeResponse.client_info;
+        this.browserStorage.removeItem(this.browserStorage.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST));
+        const reqTimestamp = nowSeconds();
+        try {
+            this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.");
+            const response = await this.platformAuthProvider.sendMessage(request);
+            const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
+            const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+            serverTelemetryManager.clearNativeBrokerErrorCode();
+            return authResult;
         }
-        else {
-            const ccsCred = this.createCcsCredentials(request);
-            if (ccsCred) {
-                this.authCodeRequest.ccsCredential = ccsCred;
-            }
+        catch (e) {
+            throw e;
         }
-        // Acquire token with retrieved code.
-        const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, authCodeResponse));
-        return tokenResponse;
     }
     /**
-     * Build ccs creds if available
+     * Logout from native platform via browser extension
+     * @param request
      */
-    createCcsCredentials(request) {
-        if (request.account) {
-            return {
-                credential: request.account.homeAccountId,
-                type: CcsCredentialType.HOME_ACCOUNT_ID,
-            };
-        }
-        else if (request.loginHint) {
-            return {
-                credential: request.loginHint,
-                type: CcsCredentialType.UPN,
-            };
-        }
-        return null;
+    logout() {
+        this.logger.trace("NativeInteractionClient - logout called.");
+        return Promise.reject("Logout not implemented yet");
     }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class SilentCacheClient extends StandardInteractionClient {
     /**
-     * Returns unexpired tokens from the cache, if available
-     * @param silentRequest
+     * Transform response from native platform into AuthenticationResult object which will be returned to the end user
+     * @param response
+     * @param request
+     * @param reqTimestamp
      */
-    async acquireToken(silentRequest) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
-        // Telemetry manager only used to increment cacheHits here
-        const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow);
-        const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), PerformanceEvents.StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
-            serverTelemetryManager,
-            requestAuthority: silentRequest.authority,
-            requestAzureCloudOptions: silentRequest.azureCloudOptions,
-            account: silentRequest.account,
-        });
-        const silentAuthClient = new SilentFlowClient(clientConfig, this.performanceClient);
-        this.logger.verbose("Silent auth client created");
-        try {
-            const response = await invokeAsync(silentAuthClient.acquireCachedToken.bind(silentAuthClient), PerformanceEvents.SilentFlowClientAcquireCachedToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest);
-            const authResponse = response[0];
-            this.performanceClient.addFields({
-                fromCache: true,
-            }, silentRequest.correlationId);
-            return authResponse;
+    async handleNativeResponse(response, request, reqTimestamp) {
+        this.logger.trace("NativeInteractionClient - handleNativeResponse called.");
+        // generate identifiers
+        const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
+        const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
+        const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
+            nativeAccountId: request.accountId,
+        })?.homeAccountId;
+        // add exception for double brokering, please note this is temporary and will be fortified in future
+        if (request.extraParameters?.child_client_id &&
+            response.account.id !== request.accountId) {
+            this.logger.info("handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch");
         }
-        catch (error) {
-            if (error instanceof BrowserAuthError &&
-                error.errorCode === cryptoKeyNotFound) {
-                this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
-            }
-            throw error;
+        else if (homeAccountIdentifier !== cachedhomeAccountId &&
+            response.account.id !== request.accountId) {
+            // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
+            throw createNativeAuthError(userSwitch);
         }
+        // Get the preferred_cache domain for the given authority
+        const authority = await this.getDiscoveredAuthority({
+            requestAuthority: request.authority,
+        });
+        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
+        idTokenClaims.tid, undefined, // auth code payload
+        response.account.id, this.logger);
+        // Ensure expires_in is in number format
+        response.expires_in = Number(response.expires_in);
+        // generate authenticationResult
+        const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
+        // cache accounts and tokens in the appropriate storage
+        await this.cacheAccount(baseAccount);
+        await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
+        return result;
     }
     /**
-     * API to silenty clear the browser cache.
-     * @param logoutRequest
+     * creates an homeAccountIdentifier for the account
+     * @param response
+     * @param idTokenObj
+     * @returns
      */
-    logout(logoutRequest) {
-        this.logger.verbose("logoutRedirect called");
-        const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-        return this.clearCacheOnLogout(validLogoutRequest?.account);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class NativeInteractionClient extends BaseInteractionClient {
-    constructor(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, nativeStorageImpl, correlationId) {
-        super(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
-        this.apiId = apiId;
-        this.accountId = accountId;
-        this.nativeMessageHandler = provider;
-        this.nativeStorageManager = nativeStorageImpl;
-        this.silentCacheClient = new SilentCacheClient(config, this.nativeStorageManager, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
-        const extensionName = this.nativeMessageHandler.getExtensionId() ===
-            NativeConstants.PREFERRED_EXTENSION_ID
-            ? "chrome"
-            : this.nativeMessageHandler.getExtensionId()?.length
-                ? "unknown"
-                : undefined;
-        this.skus = ServerTelemetryManager.makeExtraSkuString({
-            libraryName: BrowserConstants.MSAL_SKU,
-            libraryVersion: version,
-            extensionName: extensionName,
-            extensionVersion: this.nativeMessageHandler.getExtensionVersion(),
-        });
+    createHomeAccountIdentifier(response, idTokenClaims) {
+        // Save account in browser storage
+        const homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenClaims);
+        return homeAccountIdentifier;
     }
     /**
-     * Adds SKUs to request extra query parameters
-     * @param request {NativeTokenRequest}
-     * @private
+     * Helper to generate scopes
+     * @param response
+     * @param request
+     * @returns
      */
-    addRequestSKUs(request) {
-        request.extraParameters = {
-            ...request.extraParameters,
-            [X_CLIENT_EXTRA_SKU]: this.skus,
-        };
+    generateScopes(requestScopes, responseScopes) {
+        return responseScopes
+            ? ScopeSet.fromString(responseScopes)
+            : ScopeSet.fromString(requestScopes);
     }
     /**
-     * Acquire token from native platform via browser extension
+     * If PoP token is requesred, records the PoP token if returned from the WAM, else generates one in the browser
      * @param request
+     * @param response
      */
-    async acquireToken(request, cacheLookupPolicy) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
-        this.logger.trace("NativeInteractionClient - acquireToken called.");
-        // start the perf measurement
-        const nativeATMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
-        const reqTimestamp = nowSeconds();
-        const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-        try {
-            // initialize native request
-            const nativeRequest = await this.initializeNativeRequest(request);
-            // check if the tokens can be retrieved from internal cache
-            try {
-                const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
-                nativeATMeasurement.end({
-                    success: true,
-                    isNativeBroker: false,
-                    fromCache: true,
-                });
-                return result;
-            }
-            catch (e) {
-                if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
-                    this.logger.info("MSAL internal Cache does not contain tokens, return error as per cache policy");
-                    throw e;
-                }
-                // continue with a native call for any and all errors
-                this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
+    async generatePopAccessToken(response, request) {
+        if (request.tokenType === AuthenticationScheme.POP &&
+            request.signPopToken) {
+            /**
+             * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
+             * is still received, SHR is calculated locally
+             */
+            // Check if native layer returned an SHR token
+            if (response.shr) {
+                this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer");
+                return response.shr;
             }
-            const { ...nativeTokenRequest } = nativeRequest;
-            // fall back to native calls
-            const messageBody = {
-                method: NativeExtensionMethod.GetToken,
-                request: nativeTokenRequest,
+            // Generate SHR in msal js if WAM does not compute it when POP is enabled
+            const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+            const shrParameters = {
+                resourceRequestMethod: request.resourceRequestMethod,
+                resourceRequestUri: request.resourceRequestUri,
+                shrClaims: request.shrClaims,
+                shrNonce: request.shrNonce,
             };
-            const response = await this.nativeMessageHandler.sendMessage(messageBody);
-            const validatedResponse = this.validateNativeResponse(response);
-            return await this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
-                .then((result) => {
-                nativeATMeasurement.end({
-                    success: true,
-                    isNativeBroker: true,
-                    requestId: result.requestId,
-                });
-                serverTelemetryManager.clearNativeBrokerErrorCode();
-                return result;
-            })
-                .catch((error) => {
-                nativeATMeasurement.end({
-                    success: false,
-                    errorCode: error.errorCode,
-                    subErrorCode: error.subError,
-                    isNativeBroker: true,
-                });
-                throw error;
-            });
-        }
-        catch (e) {
-            if (e instanceof NativeAuthError) {
-                serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
+            /**
+             * KeyID must be present in the native request from when the PoP key was generated in order for
+             * PopTokenGenerator to query the full key for signing
+             */
+            if (!request.keyId) {
+                throw createClientAuthError(keyIdMissing);
             }
-            throw e;
+            return popTokenGenerator.signPopToken(response.access_token, request.keyId, shrParameters);
+        }
+        else {
+            return response.access_token;
         }
     }
     /**
-     * Creates silent flow request
+     * Generates authentication result
+     * @param response
      * @param request
-     * @param cachedAccount
-     * @returns CommonSilentFlowRequest
+     * @param idTokenObj
+     * @param accountEntity
+     * @param authority
+     * @param reqTimestamp
+     * @returns
      */
-    createSilentCacheRequest(request, cachedAccount) {
-        return {
-            authority: request.authority,
+    async generateAuthenticationResult(response, request, idTokenClaims, accountEntity, authority, reqTimestamp) {
+        // Add Native Broker fields to Telemetry
+        const mats = this.addTelemetryFromNativeResponse(response.properties.MATS);
+        // If scopes not returned in server response, use request scopes
+        const responseScopes = this.generateScopes(request.scope, response.scope);
+        const accountProperties = response.account.properties || {};
+        const uid = accountProperties["UID"] ||
+            idTokenClaims.oid ||
+            idTokenClaims.sub ||
+            Constants.EMPTY_STRING;
+        const tid = accountProperties["TenantId"] ||
+            idTokenClaims.tid ||
+            Constants.EMPTY_STRING;
+        const accountInfo = updateAccountTenantProfileData(accountEntity.getAccountInfo(), undefined, // tenantProfile optional
+        idTokenClaims, response.id_token);
+        /**
+         * In pairwise broker flows, this check prevents the broker's native account id
+         * from being returned over the embedded app's account id.
+         */
+        if (accountInfo.nativeAccountId !== response.account.id) {
+            accountInfo.nativeAccountId = response.account.id;
+        }
+        // generate PoP token as needed
+        const responseAccessToken = await this.generatePopAccessToken(response, request);
+        const tokenType = request.tokenType === AuthenticationScheme.POP
+            ? AuthenticationScheme.POP
+            : AuthenticationScheme.BEARER;
+        const result = {
+            authority: authority,
+            uniqueId: uid,
+            tenantId: tid,
+            scopes: responseScopes.asArray(),
+            account: accountInfo,
+            idToken: response.id_token,
+            idTokenClaims: idTokenClaims,
+            accessToken: responseAccessToken,
+            fromCache: mats ? this.isResponseFromCache(mats) : false,
+            // Request timestamp and NativeResponse expires_in are in seconds, converting to Date for AuthenticationResult
+            expiresOn: toDateFromSeconds(reqTimestamp + response.expires_in),
+            tokenType: tokenType,
             correlationId: this.correlationId,
-            scopes: ScopeSet.fromString(request.scope).asArray(),
-            account: cachedAccount,
-            forceRefresh: false,
+            state: response.state,
+            fromNativeBroker: true,
         };
+        return result;
     }
     /**
-     * Fetches the tokens from the cache if un-expired
-     * @param nativeAccountId
-     * @param request
-     * @returns authenticationResult
+     * cache the account entity in browser storage
+     * @param accountEntity
      */
-    async acquireTokensFromCache(nativeAccountId, request) {
-        if (!nativeAccountId) {
-            this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided");
-            throw createClientAuthError(noAccountFound);
-        }
-        // fetch the account from browser cache
-        const account = this.browserStorage.getBaseAccountInfo({
-            nativeAccountId,
+    async cacheAccount(accountEntity) {
+        // Store the account info and hence `nativeAccountId` in browser cache
+        await this.browserStorage.setAccount(accountEntity, this.correlationId);
+        // Remove any existing cached tokens for this account in browser storage
+        this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
+            this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
         });
-        if (!account) {
-            throw createClientAuthError(noAccountFound);
-        }
-        // leverage silent flow for cached tokens retrieval
-        try {
-            const silentRequest = this.createSilentCacheRequest(request, account);
-            const result = await this.silentCacheClient.acquireToken(silentRequest);
-            const fullAccount = {
-                ...account,
-                idTokenClaims: result?.idTokenClaims,
-                idToken: result?.idToken,
-            };
-            return {
-                ...result,
-                account: fullAccount,
-            };
-        }
-        catch (e) {
-            throw e;
-        }
     }
     /**
-     * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
-     * @param {RedirectRequest} request
-     * @param {InProgressPerformanceEvent} rootMeasurement
+     * Stores the access_token and id_token in inmemory storage
+     * @param response
+     * @param request
+     * @param homeAccountIdentifier
+     * @param idTokenObj
+     * @param responseAccessToken
+     * @param tenantId
+     * @param reqTimestamp
      */
-    async acquireTokenRedirect(request, rootMeasurement) {
-        this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
-        const { ...remainingParameters } = request;
-        delete remainingParameters.onRedirectNavigate;
-        const nativeRequest = await this.initializeNativeRequest(remainingParameters);
-        const messageBody = {
-            method: NativeExtensionMethod.GetToken,
-            request: nativeRequest,
+    cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, responseAccessToken, tenantId, reqTimestamp) {
+        const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || "", request.clientId, idTokenClaims.tid || "");
+        // cache accessToken in inmemory storage
+        const expiresIn = request.tokenType === AuthenticationScheme.POP
+            ? Constants.SHR_NONCE_VALIDITY
+            : (typeof response.expires_in === "string"
+                ? parseInt(response.expires_in, 10)
+                : response.expires_in) || 0;
+        const tokenExpirationSeconds = reqTimestamp + expiresIn;
+        const responseScopes = this.generateScopes(response.scope, request.scope);
+        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+        const nativeCacheRecord = {
+            idToken: cachedIdToken,
+            accessToken: cachedAccessToken,
         };
-        try {
-            const response = await this.nativeMessageHandler.sendMessage(messageBody);
-            this.validateNativeResponse(response);
+        return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, request.storeInCache);
+    }
+    getExpiresInValue(tokenType, expiresIn) {
+        return tokenType === AuthenticationScheme.POP
+            ? Constants.SHR_NONCE_VALIDITY
+            : (typeof expiresIn === "string"
+                ? parseInt(expiresIn, 10)
+                : expiresIn) || 0;
+    }
+    addTelemetryFromNativeResponse(matsResponse) {
+        const mats = this.getMATSFromResponse(matsResponse);
+        if (!mats) {
+            return null;
         }
-        catch (e) {
-            // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
-            if (e instanceof NativeAuthError) {
-                const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
-                if (isFatalNativeAuthError(e)) {
-                    throw e;
-                }
-            }
-        }
-        this.browserStorage.setTemporaryCache(TemporaryCacheKeys.NATIVE_REQUEST, JSON.stringify(nativeRequest), true);
-        const navigationOptions = {
-            apiId: ApiId.acquireTokenRedirect,
-            timeout: this.config.system.redirectNavigationTimeout,
-            noHistory: false,
-        };
-        const redirectUri = this.config.auth.navigateToLoginRequestUrl
-            ? window.location.href
-            : this.getRedirectUri(request.redirectUri);
-        rootMeasurement.end({ success: true });
-        await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
-    }
-    /**
-     * If the previous page called native platform for a token using redirect APIs, send the same request again and return the response
-     * @param performanceClient {IPerformanceClient?}
-     * @param correlationId {string?} correlation identifier
-     */
-    async handleRedirectPromise(performanceClient, correlationId) {
-        this.logger.trace("NativeInteractionClient - handleRedirectPromise called.");
-        if (!this.browserStorage.isInteractionInProgress(true)) {
-            this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
-            return null;
-        }
-        // remove prompt from the request to prevent WAM from prompting twice
-        const cachedRequest = this.browserStorage.getCachedNativeRequest();
-        if (!cachedRequest) {
-            this.logger.verbose("NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null.");
-            if (performanceClient && correlationId) {
-                performanceClient?.addFields({ errorCode: "no_cached_request" }, correlationId);
-            }
-            return null;
-        }
-        const { prompt, ...request } = cachedRequest;
-        if (prompt) {
-            this.logger.verbose("NativeInteractionClient - handleRedirectPromise called and prompt was included in the original request, removing prompt from cached request to prevent second interaction with native broker window.");
-        }
-        this.browserStorage.removeItem(this.browserStorage.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST));
-        const messageBody = {
-            method: NativeExtensionMethod.GetToken,
-            request: request,
-        };
-        const reqTimestamp = nowSeconds();
-        try {
-            this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.");
-            const response = await this.nativeMessageHandler.sendMessage(messageBody);
-            this.validateNativeResponse(response);
-            const result = this.handleNativeResponse(response, request, reqTimestamp);
-            const res = await result;
-            const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-            serverTelemetryManager.clearNativeBrokerErrorCode();
-            return res;
-        }
-        catch (e) {
-            throw e;
-        }
-    }
-    /**
-     * Logout from native platform via browser extension
-     * @param request
-     */
-    logout() {
-        this.logger.trace("NativeInteractionClient - logout called.");
-        return Promise.reject("Logout not implemented yet");
-    }
-    /**
-     * Transform response from native platform into AuthenticationResult object which will be returned to the end user
-     * @param response
-     * @param request
-     * @param reqTimestamp
-     */
-    async handleNativeResponse(response, request, reqTimestamp) {
-        this.logger.trace("NativeInteractionClient - handleNativeResponse called.");
-        // generate identifiers
-        const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
-        const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
-        const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
-            nativeAccountId: request.accountId,
-        })?.homeAccountId;
-        // add exception for double brokering, please note this is temporary and will be fortified in future
-        if (request.extraParameters?.child_client_id &&
-            response.account.id !== request.accountId) {
-            this.logger.info("handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch");
-        }
-        else if (homeAccountIdentifier !== cachedhomeAccountId &&
-            response.account.id !== request.accountId) {
-            // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
-            throw createNativeAuthError(userSwitch);
-        }
-        // Get the preferred_cache domain for the given authority
-        const authority = await this.getDiscoveredAuthority({
-            requestAuthority: request.authority,
-        });
-        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
-        idTokenClaims.tid, undefined, // auth code payload
-        response.account.id, this.logger);
-        // Ensure expires_in is in number format
-        response.expires_in = Number(response.expires_in);
-        // generate authenticationResult
-        const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
-        // cache accounts and tokens in the appropriate storage
-        await this.cacheAccount(baseAccount);
-        await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
-        return result;
+        this.performanceClient.addFields({
+            extensionId: this.platformAuthProvider.getExtensionId(),
+            extensionVersion: this.platformAuthProvider.getExtensionVersion(),
+            matsBrokerVersion: mats.broker_version,
+            matsAccountJoinOnStart: mats.account_join_on_start,
+            matsAccountJoinOnEnd: mats.account_join_on_end,
+            matsDeviceJoin: mats.device_join,
+            matsPromptBehavior: mats.prompt_behavior,
+            matsApiErrorCode: mats.api_error_code,
+            matsUiVisible: mats.ui_visible,
+            matsSilentCode: mats.silent_code,
+            matsSilentBiSubCode: mats.silent_bi_sub_code,
+            matsSilentMessage: mats.silent_message,
+            matsSilentStatus: mats.silent_status,
+            matsHttpStatus: mats.http_status,
+            matsHttpEventCount: mats.http_event_count,
+        }, this.correlationId);
+        return mats;
     }
     /**
-     * creates an homeAccountIdentifier for the account
+     * Gets MATS telemetry from native response
      * @param response
-     * @param idTokenObj
      * @returns
      */
-    createHomeAccountIdentifier(response, idTokenClaims) {
-        // Save account in browser storage
-        const homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenClaims);
-        return homeAccountIdentifier;
+    getMATSFromResponse(matsResponse) {
+        if (matsResponse) {
+            try {
+                return JSON.parse(matsResponse);
+            }
+            catch (e) {
+                this.logger.error("NativeInteractionClient - Error parsing MATS telemetry, returning null instead");
+            }
+        }
+        return null;
     }
     /**
-     * Helper to generate scopes
+     * Returns whether or not response came from native cache
      * @param response
-     * @param request
      * @returns
      */
-    generateScopes(response, request) {
-        return response.scope
-            ? ScopeSet.fromString(response.scope)
-            : ScopeSet.fromString(request.scope);
+    isResponseFromCache(mats) {
+        if (typeof mats.is_cached === "undefined") {
+            this.logger.verbose("NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false.");
+            return false;
+        }
+        return !!mats.is_cached;
     }
     /**
-     * If PoP token is requesred, records the PoP token if returned from the WAM, else generates one in the browser
+     * Translates developer provided request object into NativeRequest object
      * @param request
-     * @param response
      */
-    async generatePopAccessToken(response, request) {
-        if (request.tokenType === AuthenticationScheme.POP &&
-            request.signPopToken) {
-            /**
-             * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
-             * is still received, SHR is calculated locally
-             */
-            // Check if native layer returned an SHR token
-            if (response.shr) {
-                this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer");
-                return response.shr;
-            }
-            // Generate SHR in msal js if WAM does not compute it when POP is enabled
-            const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+    async initializeNativeRequest(request) {
+        this.logger.trace("NativeInteractionClient - initializeNativeRequest called");
+        const canonicalAuthority = await this.getCanonicalAuthority(request);
+        // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
+        const { scopes, ...remainingProperties } = request;
+        const scopeSet = new ScopeSet(scopes || []);
+        scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
+        const validatedRequest = {
+            ...remainingProperties,
+            accountId: this.accountId,
+            clientId: this.config.auth.clientId,
+            authority: canonicalAuthority.urlString,
+            scope: scopeSet.printScopes(),
+            redirectUri: this.getRedirectUri(request.redirectUri),
+            prompt: this.getPrompt(request.prompt),
+            correlationId: this.correlationId,
+            tokenType: request.authenticationScheme,
+            windowTitleSubstring: document.title,
+            extraParameters: {
+                ...request.extraQueryParameters,
+                ...request.tokenQueryParameters,
+            },
+            extendedExpiryToken: false,
+            keyId: request.popKid,
+        };
+        // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
+        if (validatedRequest.signPopToken && !!request.popKid) {
+            throw createBrowserAuthError(invalidPopTokenRequest);
+        }
+        this.handleExtraBrokerParams(validatedRequest);
+        validatedRequest.extraParameters =
+            validatedRequest.extraParameters || {};
+        validatedRequest.extraParameters.telemetry =
+            PlatformAuthConstants.MATS_TELEMETRY;
+        if (request.authenticationScheme === AuthenticationScheme.POP) {
+            // add POP request type
             const shrParameters = {
-                resourceRequestMethod: request.resourceRequestMethod,
                 resourceRequestUri: request.resourceRequestUri,
+                resourceRequestMethod: request.resourceRequestMethod,
                 shrClaims: request.shrClaims,
                 shrNonce: request.shrNonce,
             };
-            /**
-             * KeyID must be present in the native request from when the PoP key was generated in order for
-             * PopTokenGenerator to query the full key for signing
-             */
-            if (!request.keyId) {
-                throw createClientAuthError(keyIdMissing);
+            const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+            // generate reqCnf if not provided in the request
+            let reqCnfData;
+            if (!validatedRequest.keyId) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+                validatedRequest.keyId = generatedReqCnfData.kid;
+                validatedRequest.signPopToken = true;
             }
-            return popTokenGenerator.signPopToken(response.access_token, request.keyId, shrParameters);
+            else {
+                reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
+                validatedRequest.signPopToken = false;
+            }
+            // SPAs require whole string to be passed to broker
+            validatedRequest.reqCnf = reqCnfData;
         }
-        else {
-            return response.access_token;
+        this.addRequestSKUs(validatedRequest);
+        return validatedRequest;
+    }
+    async getCanonicalAuthority(request) {
+        const requestAuthority = request.authority || this.config.auth.authority;
+        if (request.account) {
+            // validate authority
+            await this.getDiscoveredAuthority({
+                requestAuthority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                account: request.account,
+            });
+        }
+        const canonicalAuthority = new UrlString(requestAuthority);
+        canonicalAuthority.validateAsUri();
+        return canonicalAuthority;
+    }
+    getPrompt(prompt) {
+        // If request is silent, prompt is always none
+        switch (this.apiId) {
+            case ApiId.ssoSilent:
+            case ApiId.acquireTokenSilent_silentFlow:
+                this.logger.trace("initializeNativeRequest: silent request sets prompt to none");
+                return PromptValue.NONE;
+        }
+        // Prompt not provided, request may proceed and native broker decides if it needs to prompt
+        if (!prompt) {
+            this.logger.trace("initializeNativeRequest: prompt was not provided");
+            return undefined;
+        }
+        // If request is interactive, check if prompt provided is allowed to go directly to native broker
+        switch (prompt) {
+            case PromptValue.NONE:
+            case PromptValue.CONSENT:
+            case PromptValue.LOGIN:
+                this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
+                return prompt;
+            default:
+                this.logger.trace(`initializeNativeRequest: prompt = ${prompt} is not compatible with native flow`);
+                throw createBrowserAuthError(nativePromptNotSupported);
         }
     }
     /**
-     * Generates authentication result
-     * @param response
-     * @param request
-     * @param idTokenObj
-     * @param accountEntity
-     * @param authority
-     * @param reqTimestamp
-     * @returns
+     * Handles extra broker request parameters
+     * @param request {PlatformAuthRequest}
+     * @private
      */
-    async generateAuthenticationResult(response, request, idTokenClaims, accountEntity, authority, reqTimestamp) {
-        // Add Native Broker fields to Telemetry
-        const mats = this.addTelemetryFromNativeResponse(response);
-        // If scopes not returned in server response, use request scopes
-        const responseScopes = response.scope
-            ? ScopeSet.fromString(response.scope)
-            : ScopeSet.fromString(request.scope);
-        const accountProperties = response.account.properties || {};
-        const uid = accountProperties["UID"] ||
-            idTokenClaims.oid ||
-            idTokenClaims.sub ||
-            Constants.EMPTY_STRING;
-        const tid = accountProperties["TenantId"] ||
-            idTokenClaims.tid ||
-            Constants.EMPTY_STRING;
-        const accountInfo = updateAccountTenantProfileData(accountEntity.getAccountInfo(), undefined, // tenantProfile optional
-        idTokenClaims, response.id_token);
-        /**
-         * In pairwise broker flows, this check prevents the broker's native account id
-         * from being returned over the embedded app's account id.
-         */
-        if (accountInfo.nativeAccountId !== response.account.id) {
-            accountInfo.nativeAccountId = response.account.id;
+    handleExtraBrokerParams(request) {
+        const hasExtraBrokerParams = request.extraParameters &&
+            request.extraParameters.hasOwnProperty(BROKER_CLIENT_ID) &&
+            request.extraParameters.hasOwnProperty(BROKER_REDIRECT_URI) &&
+            request.extraParameters.hasOwnProperty(CLIENT_ID);
+        if (!request.embeddedClientId && !hasExtraBrokerParams) {
+            return;
         }
-        // generate PoP token as needed
-        const responseAccessToken = await this.generatePopAccessToken(response, request);
-        const tokenType = request.tokenType === AuthenticationScheme.POP
-            ? AuthenticationScheme.POP
-            : AuthenticationScheme.BEARER;
-        const result = {
-            authority: authority,
-            uniqueId: uid,
-            tenantId: tid,
-            scopes: responseScopes.asArray(),
-            account: accountInfo,
-            idToken: response.id_token,
-            idTokenClaims: idTokenClaims,
-            accessToken: responseAccessToken,
-            fromCache: mats ? this.isResponseFromCache(mats) : false,
-            // Request timestamp and NativeResponse expires_in are in seconds, converting to Date for AuthenticationResult
-            expiresOn: toDateFromSeconds(reqTimestamp + response.expires_in),
-            tokenType: tokenType,
-            correlationId: this.correlationId,
-            state: response.state,
-            fromNativeBroker: true,
+        let child_client_id = "";
+        const child_redirect_uri = request.redirectUri;
+        if (request.embeddedClientId) {
+            request.redirectUri = this.config.auth.redirectUri;
+            child_client_id = request.embeddedClientId;
+        }
+        else if (request.extraParameters) {
+            request.redirectUri =
+                request.extraParameters[BROKER_REDIRECT_URI];
+            child_client_id =
+                request.extraParameters[CLIENT_ID];
+        }
+        request.extraParameters = {
+            child_client_id,
+            child_redirect_uri,
         };
-        return result;
+        this.performanceClient?.addFields({
+            embeddedClientId: child_client_id,
+            embeddedRedirectUri: child_redirect_uri,
+        }, request.correlationId);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+ * @param config
+ * @param authority
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+async function getStandardParameters(config, authority, request, logger, performanceClient) {
+    const parameters = getStandardAuthorizeRequestParameters({ ...config.auth, authority: authority }, request, logger, performanceClient);
+    addLibraryInfo(parameters, {
+        sku: BrowserConstants.MSAL_SKU,
+        version: version,
+        os: "",
+        cpu: "",
+    });
+    if (config.auth.protocolMode !== ProtocolMode.OIDC) {
+        addApplicationTelemetry(parameters, config.telemetry.application);
+    }
+    if (request.platformBroker) {
+        // signal ests that this is a WAM call
+        addNativeBroker(parameters);
+        // pass the req_cnf for POP
+        if (request.authenticationScheme === AuthenticationScheme.POP) {
+            const cryptoOps = new CryptoOps(logger, performanceClient);
+            const popTokenGenerator = new PopTokenGenerator(cryptoOps);
+            // req_cnf is always sent as a string for SPAs
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, logger, performanceClient, request.correlationId)(request, logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = cryptoOps.encodeKid(request.popKid);
+            }
+            addPopToken(parameters, reqCnfData);
+        }
+    }
+    instrumentBrokerParams(parameters, request.correlationId, performanceClient);
+    return parameters;
+}
+/**
+ * Gets the full /authorize URL with request parameters when using Auth Code + PKCE
+ * @param config
+ * @param authority
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+async function getAuthCodeRequestUrl(config, authority, request, logger, performanceClient) {
+    if (!request.codeChallenge) {
+        throw createClientConfigurationError(pkceParamsMissing);
+    }
+    const parameters = await invokeAsync(getStandardParameters, PerformanceEvents.GetStandardParams, logger, performanceClient, request.correlationId)(config, authority, request, logger, performanceClient);
+    addResponseType(parameters, OAuthResponseType.CODE);
+    addCodeChallengeParams(parameters, request.codeChallenge, Constants.S256_CODE_CHALLENGE_METHOD);
+    addExtraQueryParameters(parameters, request.extraQueryParameters || {});
+    return getAuthorizeUrl(authority, parameters, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
+}
+/**
+ * Gets the form that will be posted to /authorize with request parameters when using EAR
+ */
+async function getEARForm(frame, config, authority, request, logger, performanceClient) {
+    if (!request.earJwk) {
+        throw createBrowserAuthError(earJwkEmpty);
+    }
+    const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
+    addResponseType(parameters, OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN);
+    addEARParameters(parameters, request.earJwk);
+    const queryParams = new Map();
+    addExtraQueryParameters(queryParams, request.extraQueryParameters || {});
+    const url = getAuthorizeUrl(authority, queryParams, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
+    return createForm(frame, url, parameters);
+}
+/**
+ * Creates form element in the provided document with auth parameters in the post body
+ * @param frame
+ * @param authorizeUrl
+ * @param parameters
+ * @returns
+ */
+function createForm(frame, authorizeUrl, parameters) {
+    const form = frame.createElement("form");
+    form.method = "post";
+    form.action = authorizeUrl;
+    parameters.forEach((value, key) => {
+        const param = frame.createElement("input");
+        param.hidden = true;
+        param.name = key;
+        param.value = value;
+        form.appendChild(param);
+    });
+    frame.body.appendChild(form);
+    return form;
+}
+/**
+ * Response handler when server returns accountId on the /authorize request
+ * @param request
+ * @param accountId
+ * @param apiId
+ * @param config
+ * @param browserStorage
+ * @param nativeStorage
+ * @param eventHandler
+ * @param logger
+ * @param performanceClient
+ * @param nativeMessageHandler
+ * @returns
+ */
+async function handleResponsePlatformBroker(request, accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider) {
+    logger.verbose("Account id found, calling WAM for token");
+    if (!platformAuthProvider) {
+        throw createBrowserAuthError(nativeConnectionNotEstablished);
+    }
+    const browserCrypto = new CryptoOps(logger, performanceClient);
+    const nativeInteractionClient = new PlatformAuthInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, config.system.navigationClient, apiId, performanceClient, platformAuthProvider, accountId, nativeStorage, request.correlationId);
+    const { userRequestState } = ProtocolUtils.parseRequestState(browserCrypto, request.state);
+    return invokeAsync(nativeInteractionClient.acquireToken.bind(nativeInteractionClient), PerformanceEvents.NativeInteractionClientAcquireToken, logger, performanceClient, request.correlationId)({
+        ...request,
+        state: userRequestState,
+        prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
+    });
+}
+/**
+ * Response handler when server returns code on the /authorize request
+ * @param request
+ * @param response
+ * @param codeVerifier
+ * @param authClient
+ * @param browserStorage
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+async function handleResponseCode(request, response, codeVerifier, apiId, config, authClient, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider) {
+    // Remove throttle if it exists
+    ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
+    if (response.accountId) {
+        return invokeAsync(handleResponsePlatformBroker, PerformanceEvents.HandleResponsePlatformBroker, logger, performanceClient, request.correlationId)(request, response.accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider);
+    }
+    const authCodeRequest = {
+        ...request,
+        code: response.code || "",
+        codeVerifier: codeVerifier,
+    };
+    // Create popup interaction handler.
+    const interactionHandler = new InteractionHandler(authClient, browserStorage, authCodeRequest, logger, performanceClient);
+    // Handle response from hash string.
+    const result = await invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, logger, performanceClient, request.correlationId)(response, request);
+    return result;
+}
+/**
+ * Response handler when server returns ear_jwe on the /authorize request
+ * @param request
+ * @param response
+ * @param apiId
+ * @param config
+ * @param authority
+ * @param browserStorage
+ * @param nativeStorage
+ * @param eventHandler
+ * @param logger
+ * @param performanceClient
+ * @param nativeMessageHandler
+ * @returns
+ */
+async function handleResponseEAR(request, response, apiId, config, authority, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider) {
+    // Remove throttle if it exists
+    ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
+    // Validate state & check response for errors
+    validateAuthorizationResponse(response, request.state);
+    if (!response.ear_jwe) {
+        throw createBrowserAuthError(earJweEmpty);
+    }
+    if (!request.earJwk) {
+        throw createBrowserAuthError(earJwkEmpty);
+    }
+    const decryptedData = JSON.parse(await invokeAsync(decryptEarResponse, PerformanceEvents.DecryptEarResponse, logger, performanceClient, request.correlationId)(request.earJwk, response.ear_jwe));
+    if (decryptedData.accountId) {
+        return invokeAsync(handleResponsePlatformBroker, PerformanceEvents.HandleResponsePlatformBroker, logger, performanceClient, request.correlationId)(request, decryptedData.accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider);
+    }
+    const responseHandler = new ResponseHandler(config.auth.clientId, browserStorage, new CryptoOps(logger, performanceClient), logger, null, null, performanceClient);
+    // Validate response. This function throws a server error if an error is returned by the server.
+    responseHandler.validateTokenResponse(decryptedData);
+    // Temporary until response handler is refactored to be more flow agnostic.
+    const additionalData = {
+        code: "",
+        state: request.state,
+        nonce: request.nonce,
+        client_info: decryptedData.client_info,
+        cloud_graph_host_name: decryptedData.cloud_graph_host_name,
+        cloud_instance_host_name: decryptedData.cloud_instance_host_name,
+        cloud_instance_name: decryptedData.cloud_instance_name,
+        msgraph_host: decryptedData.msgraph_host,
+    };
+    return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, additionalData, undefined, undefined, undefined, undefined));
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+// Constant byte array length
+const RANDOM_BYTE_ARR_LENGTH = 32;
+/**
+ * This file defines APIs to generate PKCE codes and code verifiers.
+ */
+/**
+ * Generates PKCE Codes. See the RFC for more information: https://tools.ietf.org/html/rfc7636
+ */
+async function generatePkceCodes(performanceClient, logger, correlationId) {
+    performanceClient.addQueueMeasurement(PerformanceEvents.GeneratePkceCodes, correlationId);
+    const codeVerifier = invoke(generateCodeVerifier, PerformanceEvents.GenerateCodeVerifier, logger, performanceClient, correlationId)(performanceClient, logger, correlationId);
+    const codeChallenge = await invokeAsync(generateCodeChallengeFromVerifier, PerformanceEvents.GenerateCodeChallengeFromVerifier, logger, performanceClient, correlationId)(codeVerifier, performanceClient, logger, correlationId);
+    return {
+        verifier: codeVerifier,
+        challenge: codeChallenge,
+    };
+}
+/**
+ * Generates a random 32 byte buffer and returns the base64
+ * encoded string to be used as a PKCE Code Verifier
+ */
+function generateCodeVerifier(performanceClient, logger, correlationId) {
+    try {
+        // Generate random values as utf-8
+        const buffer = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
+        invoke(getRandomValues, PerformanceEvents.GetRandomValues, logger, performanceClient, correlationId)(buffer);
+        // encode verifier as base64
+        const pkceCodeVerifierB64 = urlEncodeArr(buffer);
+        return pkceCodeVerifierB64;
+    }
+    catch (e) {
+        throw createBrowserAuthError(pkceNotCreated);
+    }
+}
+/**
+ * Creates a base64 encoded PKCE Code Challenge string from the
+ * hash created from the PKCE Code Verifier supplied
+ */
+async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceClient, logger, correlationId) {
+    performanceClient.addQueueMeasurement(PerformanceEvents.GenerateCodeChallengeFromVerifier, correlationId);
+    try {
+        // hashed verifier
+        const pkceHashedCodeVerifier = await invokeAsync(sha256Digest, PerformanceEvents.Sha256Digest, logger, performanceClient, correlationId)(pkceCodeVerifier, performanceClient, correlationId);
+        // encode hash as base64
+        return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
+    }
+    catch (e) {
+        throw createBrowserAuthError(pkceNotCreated);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+class PlatformAuthExtensionHandler {
+    constructor(logger, handshakeTimeoutMs, performanceClient, extensionId) {
+        this.logger = logger;
+        this.handshakeTimeoutMs = handshakeTimeoutMs;
+        this.extensionId = extensionId;
+        this.resolvers = new Map(); // Used for non-handshake messages
+        this.handshakeResolvers = new Map(); // Used for handshake messages
+        this.messageChannel = new MessageChannel();
+        this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
+        this.performanceClient = performanceClient;
+        this.handshakeEvent = performanceClient.startMeasurement(PerformanceEvents.NativeMessageHandlerHandshake);
+        this.platformAuthType =
+            PlatformAuthConstants.PLATFORM_EXTENSION_PROVIDER;
     }
     /**
-     * cache the account entity in browser storage
-     * @param accountEntity
+     * Sends a given message to the extension and resolves with the extension response
+     * @param request
      */
-    async cacheAccount(accountEntity) {
-        // Store the account info and hence `nativeAccountId` in browser cache
-        await this.browserStorage.setAccount(accountEntity, this.correlationId);
-        // Remove any existing cached tokens for this account in browser storage
-        this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
-            this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
+    async sendMessage(request) {
+        this.logger.trace(this.platformAuthType + " - sendMessage called.");
+        // fall back to native calls
+        const messageBody = {
+            method: NativeExtensionMethod.GetToken,
+            request: request,
+        };
+        const req = {
+            channel: PlatformAuthConstants.CHANNEL_ID,
+            extensionId: this.extensionId,
+            responseId: createNewGuid(),
+            body: messageBody,
+        };
+        this.logger.trace(this.platformAuthType + " - Sending request to browser extension");
+        this.logger.tracePii(this.platformAuthType +
+            ` - Sending request to browser extension: ${JSON.stringify(req)}`);
+        this.messageChannel.port1.postMessage(req);
+        const response = await new Promise((resolve, reject) => {
+            this.resolvers.set(req.responseId, { resolve, reject });
         });
+        const validatedResponse = this.validatePlatformBrokerResponse(response);
+        return validatedResponse;
     }
     /**
-     * Stores the access_token and id_token in inmemory storage
-     * @param response
-     * @param request
-     * @param homeAccountIdentifier
-     * @param idTokenObj
-     * @param responseAccessToken
-     * @param tenantId
-     * @param reqTimestamp
+     * Returns an instance of the MessageHandler that has successfully established a connection with an extension
+     * @param {Logger} logger
+     * @param {number} handshakeTimeoutMs
+     * @param {IPerformanceClient} performanceClient
+     * @param {ICrypto} crypto
      */
-    cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, responseAccessToken, tenantId, reqTimestamp) {
-        const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || "", request.clientId, idTokenClaims.tid || "");
-        // cache accessToken in inmemory storage
-        const expiresIn = request.tokenType === AuthenticationScheme.POP
-            ? Constants.SHR_NONCE_VALIDITY
-            : (typeof response.expires_in === "string"
-                ? parseInt(response.expires_in, 10)
-                : response.expires_in) || 0;
-        const tokenExpirationSeconds = reqTimestamp + expiresIn;
-        const responseScopes = this.generateScopes(response, request);
-        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
-        const nativeCacheRecord = {
-            idToken: cachedIdToken,
-            accessToken: cachedAccessToken,
+    static async createProvider(logger, handshakeTimeoutMs, performanceClient) {
+        logger.trace("PlatformAuthExtensionHandler - createProvider called.");
+        try {
+            const preferredProvider = new PlatformAuthExtensionHandler(logger, handshakeTimeoutMs, performanceClient, PlatformAuthConstants.PREFERRED_EXTENSION_ID);
+            await preferredProvider.sendHandshakeRequest();
+            return preferredProvider;
+        }
+        catch (e) {
+            // If preferred extension fails for whatever reason, fallback to using any installed extension
+            const backupProvider = new PlatformAuthExtensionHandler(logger, handshakeTimeoutMs, performanceClient);
+            await backupProvider.sendHandshakeRequest();
+            return backupProvider;
+        }
+    }
+    /**
+     * Send handshake request helper.
+     */
+    async sendHandshakeRequest() {
+        this.logger.trace(this.platformAuthType + " - sendHandshakeRequest called.");
+        // Register this event listener before sending handshake
+        window.addEventListener("message", this.windowListener, false); // false is important, because content script message processing should work first
+        const req = {
+            channel: PlatformAuthConstants.CHANNEL_ID,
+            extensionId: this.extensionId,
+            responseId: createNewGuid(),
+            body: {
+                method: NativeExtensionMethod.HandshakeRequest,
+            },
         };
-        return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, request.storeInCache);
+        this.handshakeEvent.add({
+            extensionId: this.extensionId,
+            extensionHandshakeTimeoutMs: this.handshakeTimeoutMs,
+        });
+        this.messageChannel.port1.onmessage = (event) => {
+            this.onChannelMessage(event);
+        };
+        window.postMessage(req, window.origin, [this.messageChannel.port2]);
+        return new Promise((resolve, reject) => {
+            this.handshakeResolvers.set(req.responseId, { resolve, reject });
+            this.timeoutId = window.setTimeout(() => {
+                /*
+                 * Throw an error if neither HandshakeResponse nor original Handshake request are received in a reasonable timeframe.
+                 * This typically suggests an event handler stopped propagation of the Handshake request but did not respond to it on the MessageChannel port
+                 */
+                window.removeEventListener("message", this.windowListener, false);
+                this.messageChannel.port1.close();
+                this.messageChannel.port2.close();
+                this.handshakeEvent.end({
+                    extensionHandshakeTimedOut: true,
+                    success: false,
+                });
+                reject(createBrowserAuthError(nativeHandshakeTimeout));
+                this.handshakeResolvers.delete(req.responseId);
+            }, this.handshakeTimeoutMs); // Use a reasonable timeout in milliseconds here
+        });
     }
-    addTelemetryFromNativeResponse(response) {
-        const mats = this.getMATSFromResponse(response);
-        if (!mats) {
-            return null;
+    /**
+     * Invoked when a message is posted to the window. If a handshake request is received it means the extension is not installed.
+     * @param event
+     */
+    onWindowMessage(event) {
+        this.logger.trace(this.platformAuthType + " - onWindowMessage called");
+        // We only accept messages from ourselves
+        if (event.source !== window) {
+            return;
+        }
+        const request = event.data;
+        if (!request.channel ||
+            request.channel !== PlatformAuthConstants.CHANNEL_ID) {
+            return;
+        }
+        if (request.extensionId && request.extensionId !== this.extensionId) {
+            return;
+        }
+        if (request.body.method === NativeExtensionMethod.HandshakeRequest) {
+            const handshakeResolver = this.handshakeResolvers.get(request.responseId);
+            /*
+             * Filter out responses with no matched resolvers sooner to keep channel ports open while waiting for
+             * the proper response.
+             */
+            if (!handshakeResolver) {
+                this.logger.trace(this.platformAuthType +
+                    `.onWindowMessage - resolver can't be found for request ${request.responseId}`);
+                return;
+            }
+            // If we receive this message back it means no extension intercepted the request, meaning no extension supporting handshake protocol is installed
+            this.logger.verbose(request.extensionId
+                ? `Extension with id: ${request.extensionId} not installed`
+                : "No extension installed");
+            clearTimeout(this.timeoutId);
+            this.messageChannel.port1.close();
+            this.messageChannel.port2.close();
+            window.removeEventListener("message", this.windowListener, false);
+            this.handshakeEvent.end({
+                success: false,
+                extensionInstalled: false,
+            });
+            handshakeResolver.reject(createBrowserAuthError(nativeExtensionNotInstalled));
+        }
+    }
+    /**
+     * Invoked when a message is received from the extension on the MessageChannel port
+     * @param event
+     */
+    onChannelMessage(event) {
+        this.logger.trace(this.platformAuthType + " - onChannelMessage called.");
+        const request = event.data;
+        const resolver = this.resolvers.get(request.responseId);
+        const handshakeResolver = this.handshakeResolvers.get(request.responseId);
+        try {
+            const method = request.body.method;
+            if (method === NativeExtensionMethod.Response) {
+                if (!resolver) {
+                    return;
+                }
+                const response = request.body.response;
+                this.logger.trace(this.platformAuthType +
+                    " - Received response from browser extension");
+                this.logger.tracePii(this.platformAuthType +
+                    ` - Received response from browser extension: ${JSON.stringify(response)}`);
+                if (response.status !== "Success") {
+                    resolver.reject(createNativeAuthError(response.code, response.description, response.ext));
+                }
+                else if (response.result) {
+                    if (response.result["code"] &&
+                        response.result["description"]) {
+                        resolver.reject(createNativeAuthError(response.result["code"], response.result["description"], response.result["ext"]));
+                    }
+                    else {
+                        resolver.resolve(response.result);
+                    }
+                }
+                else {
+                    throw createAuthError(unexpectedError, "Event does not contain result.");
+                }
+                this.resolvers.delete(request.responseId);
+            }
+            else if (method === NativeExtensionMethod.HandshakeResponse) {
+                if (!handshakeResolver) {
+                    this.logger.trace(this.platformAuthType +
+                        `.onChannelMessage - resolver can't be found for request ${request.responseId}`);
+                    return;
+                }
+                clearTimeout(this.timeoutId); // Clear setTimeout
+                window.removeEventListener("message", this.windowListener, false); // Remove 'No extension' listener
+                this.extensionId = request.extensionId;
+                this.extensionVersion = request.body.version;
+                this.logger.verbose(this.platformAuthType +
+                    ` - Received HandshakeResponse from extension: ${this.extensionId}`);
+                this.handshakeEvent.end({
+                    extensionInstalled: true,
+                    success: true,
+                });
+                handshakeResolver.resolve();
+                this.handshakeResolvers.delete(request.responseId);
+            }
+            // Do nothing if method is not Response or HandshakeResponse
+        }
+        catch (err) {
+            this.logger.error("Error parsing response from WAM Extension");
+            this.logger.errorPii(`Error parsing response from WAM Extension: ${err}`);
+            this.logger.errorPii(`Unable to parse ${event}`);
+            if (resolver) {
+                resolver.reject(err);
+            }
+            else if (handshakeResolver) {
+                handshakeResolver.reject(err);
+            }
         }
-        this.performanceClient.addFields({
-            extensionId: this.nativeMessageHandler.getExtensionId(),
-            extensionVersion: this.nativeMessageHandler.getExtensionVersion(),
-            matsBrokerVersion: mats.broker_version,
-            matsAccountJoinOnStart: mats.account_join_on_start,
-            matsAccountJoinOnEnd: mats.account_join_on_end,
-            matsDeviceJoin: mats.device_join,
-            matsPromptBehavior: mats.prompt_behavior,
-            matsApiErrorCode: mats.api_error_code,
-            matsUiVisible: mats.ui_visible,
-            matsSilentCode: mats.silent_code,
-            matsSilentBiSubCode: mats.silent_bi_sub_code,
-            matsSilentMessage: mats.silent_message,
-            matsSilentStatus: mats.silent_status,
-            matsHttpStatus: mats.http_status,
-            matsHttpEventCount: mats.http_event_count,
-        }, this.correlationId);
-        return mats;
     }
     /**
      * Validates native platform response before processing
      * @param response
      */
-    validateNativeResponse(response) {
+    validatePlatformBrokerResponse(response) {
         if (response.hasOwnProperty("access_token") &&
             response.hasOwnProperty("id_token") &&
             response.hasOwnProperty("client_info") &&
@@ -14258,425 +14656,258 @@ class NativeInteractionClient extends BaseInteractionClient {
         }
     }
     /**
-     * Gets MATS telemetry from native response
-     * @param response
-     * @returns
-     */
-    getMATSFromResponse(response) {
-        if (response.properties.MATS) {
-            try {
-                return JSON.parse(response.properties.MATS);
-            }
-            catch (e) {
-                this.logger.error("NativeInteractionClient - Error parsing MATS telemetry, returning null instead");
-            }
-        }
-        return null;
-    }
-    /**
-     * Returns whether or not response came from native cache
-     * @param response
+     * Returns the Id for the browser extension this handler is communicating with
      * @returns
      */
-    isResponseFromCache(mats) {
-        if (typeof mats.is_cached === "undefined") {
-            this.logger.verbose("NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false.");
-            return false;
-        }
-        return !!mats.is_cached;
-    }
-    /**
-     * Translates developer provided request object into NativeRequest object
-     * @param request
-     */
-    async initializeNativeRequest(request) {
-        this.logger.trace("NativeInteractionClient - initializeNativeRequest called");
-        const requestAuthority = request.authority || this.config.auth.authority;
-        if (request.account) {
-            // validate authority
-            await this.getDiscoveredAuthority({
-                requestAuthority,
-                requestAzureCloudOptions: request.azureCloudOptions,
-                account: request.account,
-            });
-        }
-        const canonicalAuthority = new UrlString(requestAuthority);
-        canonicalAuthority.validateAsUri();
-        // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
-        const { scopes, ...remainingProperties } = request;
-        const scopeSet = new ScopeSet(scopes || []);
-        scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
-        const getPrompt = () => {
-            // If request is silent, prompt is always none
-            switch (this.apiId) {
-                case ApiId.ssoSilent:
-                case ApiId.acquireTokenSilent_silentFlow:
-                    this.logger.trace("initializeNativeRequest: silent request sets prompt to none");
-                    return PromptValue.NONE;
-            }
-            // Prompt not provided, request may proceed and native broker decides if it needs to prompt
-            if (!request.prompt) {
-                this.logger.trace("initializeNativeRequest: prompt was not provided");
-                return undefined;
-            }
-            // If request is interactive, check if prompt provided is allowed to go directly to native broker
-            switch (request.prompt) {
-                case PromptValue.NONE:
-                case PromptValue.CONSENT:
-                case PromptValue.LOGIN:
-                    this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
-                    return request.prompt;
-                default:
-                    this.logger.trace(`initializeNativeRequest: prompt = ${request.prompt} is not compatible with native flow`);
-                    throw createBrowserAuthError(nativePromptNotSupported);
-            }
-        };
-        const validatedRequest = {
-            ...remainingProperties,
-            accountId: this.accountId,
-            clientId: this.config.auth.clientId,
-            authority: canonicalAuthority.urlString,
-            scope: scopeSet.printScopes(),
-            redirectUri: this.getRedirectUri(request.redirectUri),
-            prompt: getPrompt(),
-            correlationId: this.correlationId,
-            tokenType: request.authenticationScheme,
-            windowTitleSubstring: document.title,
-            extraParameters: {
-                ...request.extraQueryParameters,
-                ...request.tokenQueryParameters,
-            },
-            extendedExpiryToken: false,
-            keyId: request.popKid,
-        };
-        // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
-        if (validatedRequest.signPopToken && !!request.popKid) {
-            throw createBrowserAuthError(invalidPopTokenRequest);
-        }
-        this.handleExtraBrokerParams(validatedRequest);
-        validatedRequest.extraParameters =
-            validatedRequest.extraParameters || {};
-        validatedRequest.extraParameters.telemetry =
-            NativeConstants.MATS_TELEMETRY;
-        if (request.authenticationScheme === AuthenticationScheme.POP) {
-            // add POP request type
-            const shrParameters = {
-                resourceRequestUri: request.resourceRequestUri,
-                resourceRequestMethod: request.resourceRequestMethod,
-                shrClaims: request.shrClaims,
-                shrNonce: request.shrNonce,
-            };
-            const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-            // generate reqCnf if not provided in the request
-            let reqCnfData;
-            if (!validatedRequest.keyId) {
-                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
-                reqCnfData = generatedReqCnfData.reqCnfString;
-                validatedRequest.keyId = generatedReqCnfData.kid;
-                validatedRequest.signPopToken = true;
-            }
-            else {
-                reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
-                validatedRequest.signPopToken = false;
-            }
-            // SPAs require whole string to be passed to broker
-            validatedRequest.reqCnf = reqCnfData;
-        }
-        this.addRequestSKUs(validatedRequest);
-        return validatedRequest;
-    }
-    /**
-     * Handles extra broker request parameters
-     * @param request {NativeTokenRequest}
-     * @private
-     */
-    handleExtraBrokerParams(request) {
-        const hasExtraBrokerParams = request.extraParameters &&
-            request.extraParameters.hasOwnProperty(BROKER_CLIENT_ID) &&
-            request.extraParameters.hasOwnProperty(BROKER_REDIRECT_URI) &&
-            request.extraParameters.hasOwnProperty(CLIENT_ID);
-        if (!request.embeddedClientId && !hasExtraBrokerParams) {
-            return;
-        }
-        let child_client_id = "";
-        const child_redirect_uri = request.redirectUri;
-        if (request.embeddedClientId) {
-            request.redirectUri = this.config.auth.redirectUri;
-            child_client_id = request.embeddedClientId;
-        }
-        else if (request.extraParameters) {
-            request.redirectUri =
-                request.extraParameters[BROKER_REDIRECT_URI];
-            child_client_id =
-                request.extraParameters[CLIENT_ID];
-        }
-        request.extraParameters = {
-            child_client_id,
-            child_redirect_uri,
-        };
-        this.performanceClient?.addFields({
-            embeddedClientId: child_client_id,
-            embeddedRedirectUri: child_redirect_uri,
-        }, request.correlationId);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
- * @param config
- * @param authority
- * @param request
- * @param logger
- * @param performanceClient
- * @returns
- */
-async function getStandardParameters(config, authority, request, logger, performanceClient) {
-    const parameters = getStandardAuthorizeRequestParameters({ ...config.auth, authority: authority }, request, logger, performanceClient);
-    addLibraryInfo(parameters, {
-        sku: BrowserConstants.MSAL_SKU,
-        version: version,
-        os: "",
-        cpu: "",
-    });
-    if (config.auth.protocolMode !== ProtocolMode.OIDC) {
-        addApplicationTelemetry(parameters, config.telemetry.application);
-    }
-    if (request.platformBroker) {
-        // signal ests that this is a WAM call
-        addNativeBroker(parameters);
-        // pass the req_cnf for POP
-        if (request.authenticationScheme === AuthenticationScheme.POP) {
-            const cryptoOps = new CryptoOps(logger, performanceClient);
-            const popTokenGenerator = new PopTokenGenerator(cryptoOps);
-            // req_cnf is always sent as a string for SPAs
-            let reqCnfData;
-            if (!request.popKid) {
-                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, logger, performanceClient, request.correlationId)(request, logger);
-                reqCnfData = generatedReqCnfData.reqCnfString;
-            }
-            else {
-                reqCnfData = cryptoOps.encodeKid(request.popKid);
-            }
-            addPopToken(parameters, reqCnfData);
-        }
+    getExtensionId() {
+        return this.extensionId;
     }
-    instrumentBrokerParams(parameters, request.correlationId, performanceClient);
-    return parameters;
-}
-/**
- * Gets the full /authorize URL with request parameters when using Auth Code + PKCE
- * @param config
- * @param authority
- * @param request
- * @param logger
- * @param performanceClient
- * @returns
- */
-async function getAuthCodeRequestUrl(config, authority, request, logger, performanceClient) {
-    if (!request.codeChallenge) {
-        throw createClientConfigurationError(pkceParamsMissing);
+    /**
+     * Returns the version for the browser extension this handler is communicating with
+     * @returns
+     */
+    getExtensionVersion() {
+        return this.extensionVersion;
     }
-    const parameters = await invokeAsync(getStandardParameters, PerformanceEvents.GetStandardParams, logger, performanceClient, request.correlationId)(config, authority, request, logger, performanceClient);
-    addResponseType(parameters, OAuthResponseType.CODE);
-    addCodeChallengeParams(parameters, request.codeChallenge, Constants.S256_CODE_CHALLENGE_METHOD);
-    addExtraQueryParameters(parameters, request.extraQueryParameters || {});
-    return getAuthorizeUrl(authority, parameters, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
-}
-/**
- * Gets the form that will be posted to /authorize with request parameters when using EAR
- */
-async function getEARForm(frame, config, authority, request, logger, performanceClient) {
-    if (!request.earJwk) {
-        throw createBrowserAuthError(earJwkEmpty);
+    getExtensionName() {
+        return this.getExtensionId() ===
+            PlatformAuthConstants.PREFERRED_EXTENSION_ID
+            ? "chrome"
+            : this.getExtensionId()?.length
+                ? "unknown"
+                : undefined;
     }
-    const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
-    addResponseType(parameters, OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN);
-    addEARParameters(parameters, request.earJwk);
-    const queryParams = new Map();
-    addExtraQueryParameters(queryParams, request.extraQueryParameters || {});
-    const url = getAuthorizeUrl(authority, queryParams, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
-    return createForm(frame, url, parameters);
-}
-/**
- * Creates form element in the provided document with auth parameters in the post body
- * @param frame
- * @param authorizeUrl
- * @param parameters
- * @returns
- */
-function createForm(frame, authorizeUrl, parameters) {
-    const form = frame.createElement("form");
-    form.method = "post";
-    form.action = authorizeUrl;
-    parameters.forEach((value, key) => {
-        const param = frame.createElement("input");
-        param.hidden = true;
-        param.name = key;
-        param.value = value;
-        form.appendChild(param);
-    });
-    frame.body.appendChild(form);
-    return form;
-}
-/**
- * Response handler when server returns accountId on the /authorize request
- * @param request
- * @param accountId
- * @param apiId
- * @param config
- * @param browserStorage
- * @param nativeStorage
- * @param eventHandler
- * @param logger
- * @param performanceClient
- * @param nativeMessageHandler
- * @returns
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
  */
-async function handleResponsePlatformBroker(request, accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler) {
-    if (!nativeMessageHandler) {
-        throw createBrowserAuthError(nativeConnectionNotEstablished);
+class PlatformAuthDOMHandler {
+    constructor(logger, performanceClient, correlationId) {
+        this.logger = logger;
+        this.performanceClient = performanceClient;
+        this.correlationId = correlationId;
+        this.platformAuthType = PlatformAuthConstants.PLATFORM_DOM_PROVIDER;
     }
-    const browserCrypto = new CryptoOps(logger, performanceClient);
-    const nativeInteractionClient = new NativeInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, config.system.navigationClient, apiId, performanceClient, nativeMessageHandler, accountId, nativeStorage, request.correlationId);
-    const { userRequestState } = ProtocolUtils.parseRequestState(browserCrypto, request.state);
-    return invokeAsync(nativeInteractionClient.acquireToken.bind(nativeInteractionClient), PerformanceEvents.NativeInteractionClientAcquireToken, logger, performanceClient, request.correlationId)({
-        ...request,
-        state: userRequestState,
-        prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
-    });
-}
-/**
- * Response handler when server returns code on the /authorize request
- * @param request
- * @param response
- * @param codeVerifier
- * @param authClient
- * @param browserStorage
- * @param logger
- * @param performanceClient
- * @returns
- */
-async function handleResponseCode(request, response, codeVerifier, apiId, config, authClient, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler) {
-    // Remove throttle if it exists
-    ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
-    if (response.accountId) {
-        return invokeAsync(handleResponsePlatformBroker, PerformanceEvents.HandleResponsePlatformBroker, logger, performanceClient, request.correlationId)(request, response.accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler);
+    static async createProvider(logger, performanceClient, correlationId) {
+        logger.trace("PlatformAuthDOMHandler: createProvider called");
+        // @ts-ignore
+        if (window.navigator?.platformAuthentication) {
+            const supportedContracts = 
+            // @ts-ignore
+            await window.navigator.platformAuthentication.getSupportedContracts(PlatformAuthConstants.MICROSOFT_ENTRA_BROKERID);
+            if (supportedContracts?.includes(PlatformAuthConstants.PLATFORM_DOM_APIS)) {
+                logger.trace("Platform auth api available in DOM");
+                return new PlatformAuthDOMHandler(logger, performanceClient, correlationId);
+            }
+        }
+        return undefined;
     }
-    const authCodeRequest = {
-        ...request,
-        code: response.code || "",
-        codeVerifier: codeVerifier,
-    };
-    // Create popup interaction handler.
-    const interactionHandler = new InteractionHandler(authClient, browserStorage, authCodeRequest, logger, performanceClient);
-    // Handle response from hash string.
-    const result = await invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, logger, performanceClient, request.correlationId)(response, request);
-    return result;
-}
-/**
- * Response handler when server returns ear_jwe on the /authorize request
- * @param request
- * @param response
- * @param apiId
- * @param config
- * @param authority
- * @param browserStorage
- * @param nativeStorage
- * @param eventHandler
- * @param logger
- * @param performanceClient
- * @param nativeMessageHandler
- * @returns
- */
-async function handleResponseEAR(request, response, apiId, config, authority, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler) {
-    // Remove throttle if it exists
-    ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
-    // Validate state & check response for errors
-    validateAuthorizationResponse(response, request.state);
-    if (!response.ear_jwe) {
-        throw createBrowserAuthError(earJweEmpty);
+    /**
+     * Returns the Id for the broker extension this handler is communicating with
+     * @returns
+     */
+    getExtensionId() {
+        return PlatformAuthConstants.MICROSOFT_ENTRA_BROKERID;
     }
-    if (!request.earJwk) {
-        throw createBrowserAuthError(earJwkEmpty);
+    getExtensionVersion() {
+        return "";
     }
-    const decryptedData = JSON.parse(await invokeAsync(decryptEarResponse, PerformanceEvents.DecryptEarResponse, logger, performanceClient, request.correlationId)(request.earJwk, response.ear_jwe));
-    if (decryptedData.accountId) {
-        return invokeAsync(handleResponsePlatformBroker, PerformanceEvents.HandleResponsePlatformBroker, logger, performanceClient, request.correlationId)(request, decryptedData.accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler);
+    getExtensionName() {
+        return PlatformAuthConstants.DOM_API_NAME;
+    }
+    /**
+     * Send token request to platform broker via browser DOM API
+     * @param request
+     * @returns
+     */
+    async sendMessage(request) {
+        this.logger.trace(this.platformAuthType + " - Sending request to browser DOM API");
+        try {
+            const platformDOMRequest = this.initializePlatformDOMRequest(request);
+            const response = 
+            // @ts-ignore
+            await window.navigator.platformAuthentication.executeGetToken(platformDOMRequest);
+            return this.validatePlatformBrokerResponse(response);
+        }
+        catch (e) {
+            this.logger.error(this.platformAuthType + " - executeGetToken DOM API error");
+            throw e;
+        }
+    }
+    initializePlatformDOMRequest(request) {
+        this.logger.trace(this.platformAuthType + " - initializeNativeDOMRequest called");
+        const { accountId, clientId, authority, scope, redirectUri, correlationId, state, storeInCache, embeddedClientId, extraParameters, ...remainingProperties } = request;
+        const validExtraParameters = this.getDOMExtraParams(remainingProperties);
+        const platformDOMRequest = {
+            accountId: accountId,
+            brokerId: this.getExtensionId(),
+            authority: authority,
+            clientId: clientId,
+            correlationId: correlationId || this.correlationId,
+            extraParameters: { ...extraParameters, ...validExtraParameters },
+            isSecurityTokenService: false,
+            redirectUri: redirectUri,
+            scope: scope,
+            state: state,
+            storeInCache: storeInCache,
+            embeddedClientId: embeddedClientId,
+        };
+        return platformDOMRequest;
+    }
+    validatePlatformBrokerResponse(response) {
+        if (response.hasOwnProperty("isSuccess")) {
+            if (response.hasOwnProperty("accessToken") &&
+                response.hasOwnProperty("idToken") &&
+                response.hasOwnProperty("clientInfo") &&
+                response.hasOwnProperty("account") &&
+                response.hasOwnProperty("scopes") &&
+                response.hasOwnProperty("expiresIn")) {
+                this.logger.trace(this.platformAuthType +
+                    " - platform broker returned successful and valid response");
+                return this.convertToPlatformBrokerResponse(response);
+            }
+            else if (response.hasOwnProperty("error")) {
+                const errorResponse = response;
+                if (errorResponse.isSuccess === false &&
+                    errorResponse.error &&
+                    errorResponse.error.code) {
+                    this.logger.trace(this.platformAuthType +
+                        " - platform broker returned error response");
+                    throw createNativeAuthError(errorResponse.error.code, errorResponse.error.description, {
+                        error: parseInt(errorResponse.error.errorCode),
+                        protocol_error: errorResponse.error.protocolError,
+                        status: errorResponse.error.status,
+                        properties: errorResponse.error.properties,
+                    });
+                }
+            }
+        }
+        throw createAuthError(unexpectedError, "Response missing expected properties.");
+    }
+    convertToPlatformBrokerResponse(response) {
+        this.logger.trace(this.platformAuthType + " - convertToNativeResponse called");
+        const nativeResponse = {
+            access_token: response.accessToken,
+            id_token: response.idToken,
+            client_info: response.clientInfo,
+            account: response.account,
+            expires_in: response.expiresIn,
+            scope: response.scopes,
+            state: response.state || "",
+            properties: response.properties || {},
+            extendedLifetimeToken: response.extendedLifetimeToken ?? false,
+            shr: response.proofOfPossessionPayload,
+        };
+        return nativeResponse;
+    }
+    getDOMExtraParams(extraParameters) {
+        const stringifiedParams = Object.entries(extraParameters).reduce((record, [key, value]) => {
+            record[key] = String(value);
+            return record;
+        }, {});
+        const validExtraParams = {
+            ...stringifiedParams,
+        };
+        return validExtraParams;
     }
-    const responseHandler = new ResponseHandler(config.auth.clientId, browserStorage, new CryptoOps(logger, performanceClient), logger, null, null, performanceClient);
-    // Validate response. This function throws a server error if an error is returned by the server.
-    responseHandler.validateTokenResponse(decryptedData);
-    // Temporary until response handler is refactored to be more flow agnostic.
-    const additionalData = {
-        code: "",
-        state: request.state,
-        nonce: request.nonce,
-        client_info: decryptedData.client_info,
-        cloud_graph_host_name: decryptedData.cloud_graph_host_name,
-        cloud_instance_host_name: decryptedData.cloud_instance_host_name,
-        cloud_instance_name: decryptedData.cloud_instance_name,
-        msgraph_host: decryptedData.msgraph_host,
-    };
-    return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, additionalData, undefined, undefined, undefined, undefined));
 }
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-// Constant byte array length
-const RANDOM_BYTE_ARR_LENGTH = 32;
-/**
- * This file defines APIs to generate PKCE codes and code verifiers.
- */
 /**
- * Generates PKCE Codes. See the RFC for more information: https://tools.ietf.org/html/rfc7636
+ * Checks if the platform broker is available in the current environment.
+ * @param loggerOptions
+ * @param perfClient
+ * @returns
  */
-async function generatePkceCodes(performanceClient, logger, correlationId) {
-    performanceClient.addQueueMeasurement(PerformanceEvents.GeneratePkceCodes, correlationId);
-    const codeVerifier = invoke(generateCodeVerifier, PerformanceEvents.GenerateCodeVerifier, logger, performanceClient, correlationId)(performanceClient, logger, correlationId);
-    const codeChallenge = await invokeAsync(generateCodeChallengeFromVerifier, PerformanceEvents.GenerateCodeChallengeFromVerifier, logger, performanceClient, correlationId)(codeVerifier, performanceClient, logger, correlationId);
-    return {
-        verifier: codeVerifier,
-        challenge: codeChallenge,
-    };
+async function isPlatformBrokerAvailable(loggerOptions, perfClient, correlationId) {
+    const logger = new Logger(loggerOptions || {}, name, version);
+    logger.trace("isPlatformBrokerAvailable called");
+    const performanceClient = perfClient || new StubPerformanceClient();
+    if (typeof window === "undefined") {
+        logger.trace("Non-browser environment detected, returning false");
+        return false;
+    }
+    return !!(await getPlatformAuthProvider(logger, performanceClient, correlationId || createNewGuid()));
 }
-/**
- * Generates a random 32 byte buffer and returns the base64
- * encoded string to be used as a PKCE Code Verifier
- */
-function generateCodeVerifier(performanceClient, logger, correlationId) {
+async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout) {
+    logger.trace("getPlatformAuthProvider called", correlationId);
+    const enablePlatformBrokerDOMSupport = isDomEnabledForPlatformAuth();
+    logger.trace("Has client allowed platform auth via DOM API: " +
+        enablePlatformBrokerDOMSupport);
+    let platformAuthProvider;
     try {
-        // Generate random values as utf-8
-        const buffer = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
-        invoke(getRandomValues, PerformanceEvents.GetRandomValues, logger, performanceClient, correlationId)(buffer);
-        // encode verifier as base64
-        const pkceCodeVerifierB64 = urlEncodeArr(buffer);
-        return pkceCodeVerifierB64;
+        if (enablePlatformBrokerDOMSupport) {
+            // Check if DOM platform API is supported first
+            platformAuthProvider = await PlatformAuthDOMHandler.createProvider(logger, performanceClient, correlationId);
+        }
+        if (!platformAuthProvider) {
+            logger.trace("Platform auth via DOM API not available, checking for extension");
+            /*
+             * If DOM APIs are not available, check if browser extension is available.
+             * Platform authentication via DOM APIs is preferred over extension APIs.
+             */
+            platformAuthProvider =
+                await PlatformAuthExtensionHandler.createProvider(logger, nativeBrokerHandshakeTimeout ||
+                    DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS, performanceClient);
+        }
     }
     catch (e) {
-        throw createBrowserAuthError(pkceNotCreated);
+        logger.trace("Platform auth not available", e);
     }
+    return platformAuthProvider;
 }
 /**
- * Creates a base64 encoded PKCE Code Challenge string from the
- * hash created from the PKCE Code Verifier supplied
+ * Returns true if the DOM API support for platform auth is enabled in session storage
+ * @returns boolean
+ * @deprecated
  */
-async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceClient, logger, correlationId) {
-    performanceClient.addQueueMeasurement(PerformanceEvents.GenerateCodeChallengeFromVerifier, correlationId);
+function isDomEnabledForPlatformAuth() {
+    let sessionStorage;
     try {
-        // hashed verifier
-        const pkceHashedCodeVerifier = await invokeAsync(sha256Digest, PerformanceEvents.Sha256Digest, logger, performanceClient, correlationId)(pkceCodeVerifier, performanceClient, correlationId);
-        // encode hash as base64
-        return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
+        sessionStorage = window[BrowserCacheLocation.SessionStorage];
+        // Mute errors if it's a non-browser environment or cookies are blocked.
+        return sessionStorage?.getItem(PLATFORM_AUTH_DOM_SUPPORT) === "true";
     }
     catch (e) {
-        throw createBrowserAuthError(pkceNotCreated);
+        return false;
+    }
+}
+/**
+ * Returns boolean indicating whether or not the request should attempt to use native broker
+ * @param logger
+ * @param config
+ * @param platformAuthProvider
+ * @param authenticationScheme
+ */
+function isPlatformAuthAllowed(config, logger, platformAuthProvider, authenticationScheme) {
+    logger.trace("isBrokerAvailable called");
+    if (!config.system.allowPlatformBroker) {
+        logger.trace("isBrokerAvailable: allowPlatformBroker is not enabled, returning false");
+        // Developer disabled WAM
+        return false;
+    }
+    if (!platformAuthProvider) {
+        logger.trace("isBrokerAvailable: Platform auth provider is not initialized, returning false");
+        // Platform broker auth providers are not available
+        return false;
+    }
+    if (authenticationScheme) {
+        switch (authenticationScheme) {
+            case AuthenticationScheme.BEARER:
+            case AuthenticationScheme.POP:
+                logger.trace("isBrokerAvailable: authenticationScheme is supported, returning true");
+                return true;
+            default:
+                logger.trace("isBrokerAvailable: authenticationScheme is not supported, returning false");
+                return false;
+        }
     }
+    return true;
 }
 
 /*
@@ -14684,8 +14915,8 @@ async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceCl
  * Licensed under the MIT License.
  */
 class PopupClient extends StandardInteractionClient {
-    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, nativeMessageHandler, correlationId) {
-        super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId);
+    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, platformAuthHandler, correlationId) {
+        super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, platformAuthHandler, correlationId);
         // Properly sets this reference for the unload event.
         this.unloadWindow = this.unloadWindow.bind(this);
         this.nativeStorage = nativeStorageImpl;
@@ -14773,7 +15004,7 @@ class PopupClient extends StandardInteractionClient {
         if (popupParams.popup) {
             preconnect(validRequest.authority);
         }
-        const isPlatformBroker = NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
+        const isPlatformBroker = isPlatformAuthAllowed(this.config, this.logger, this.platformAuthProvider, request.authenticationScheme);
         validRequest.platformBroker = isPlatformBroker;
         if (this.config.auth.protocolMode === ProtocolMode.EAR) {
             return this.executeEarFlow(validRequest, popupParams);
@@ -14815,7 +15046,7 @@ class PopupClient extends StandardInteractionClient {
             // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
             const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
             const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
-            return await invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+            return await invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
         catch (e) {
             // Close the synchronous popup if an error is thrown before the window unload event is registered
@@ -14851,7 +15082,7 @@ class PopupClient extends StandardInteractionClient {
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(this.monitorPopupForHash.bind(this), PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupWindow, popupParams.popupWindowParent);
         const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
-        return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, ApiId.acquireTokenPopup, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+        return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, ApiId.acquireTokenPopup, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
     /**
      *
@@ -15148,8 +15379,8 @@ function getNavigationType() {
     return navigation?.type;
 }
 class RedirectClient extends StandardInteractionClient {
-    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, nativeMessageHandler, correlationId) {
-        super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId);
+    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, platformAuthHandler, correlationId) {
+        super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, platformAuthHandler, correlationId);
         this.nativeStorage = nativeStorageImpl;
     }
     /**
@@ -15158,8 +15389,7 @@ class RedirectClient extends StandardInteractionClient {
      */
     async acquireToken(request) {
         const validRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, exports.InteractionType.Redirect);
-        validRequest.platformBroker =
-            NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
+        validRequest.platformBroker = isPlatformAuthAllowed(this.config, this.logger, this.platformAuthProvider, request.authenticationScheme);
         const handleBackButton = (event) => {
             // Clear temporary cache if the back button is clicked during the redirect flow.
             if (event.persisted) {
@@ -15399,10 +15629,10 @@ class RedirectClient extends StandardInteractionClient {
                 requestExtraQueryParameters: request.extraQueryParameters,
                 account: request.account,
             });
-            return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, request.correlationId)(request, serverParams, ApiId.acquireTokenRedirect, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+            return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, request.correlationId)(request, serverParams, ApiId.acquireTokenRedirect, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
         const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({ serverTelemetryManager, requestAuthority: request.authority });
-        return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, request.correlationId)(request, serverParams, codeVerifier, ApiId.acquireTokenRedirect, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+        return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, request.correlationId)(request, serverParams, codeVerifier, ApiId.acquireTokenRedirect, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
     /**
      * Redirects window to given URL.
@@ -15686,8 +15916,8 @@ function removeHiddenIframe(iframe) {
  * Licensed under the MIT License.
  */
 class SilentIframeClient extends StandardInteractionClient {
-    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, nativeMessageHandler, correlationId) {
-        super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId);
+    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, platformAuthProvider, correlationId) {
+        super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, platformAuthProvider, correlationId);
         this.apiId = apiId;
         this.nativeStorage = nativeStorageImpl;
     }
@@ -15717,8 +15947,7 @@ class SilentIframeClient extends StandardInteractionClient {
         }
         // Create silent request
         const silentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)(inputRequest, exports.InteractionType.Silent);
-        silentRequest.platformBroker =
-            NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme);
+        silentRequest.platformBroker = isPlatformAuthAllowed(this.config, this.logger, this.platformAuthProvider, silentRequest.authenticationScheme);
         preconnect(silentRequest.authority);
         if (this.config.auth.protocolMode === ProtocolMode.EAR) {
             return this.executeEarFlow(silentRequest);
@@ -15784,7 +16013,7 @@ class SilentIframeClient extends StandardInteractionClient {
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
         const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger);
-        return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+        return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
     /**
      * Currently Unsupported
@@ -15815,7 +16044,7 @@ class SilentIframeClient extends StandardInteractionClient {
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
         const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger);
-        return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+        return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
 }
 
@@ -16096,8 +16325,8 @@ class HybridSpaAuthorizationCodeClient extends AuthorizationCodeClient {
  * Licensed under the MIT License.
  */
 class SilentAuthCodeClient extends StandardInteractionClient {
-    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeMessageHandler, correlationId) {
-        super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId);
+    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, platformAuthProvider, correlationId) {
+        super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, platformAuthProvider, correlationId);
         this.apiId = apiId;
     }
     /**
@@ -16155,6 +16384,25 @@ class SilentAuthCodeClient extends StandardInteractionClient {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function collectInstanceStats(currentClientId, performanceEvent, logger) {
+    const frameInstances = 
+    // @ts-ignore
+    window.msal?.clientIds || [];
+    const msalInstanceCount = frameInstances.length;
+    const sameClientIdInstanceCount = frameInstances.filter((i) => i === currentClientId).length;
+    if (sameClientIdInstanceCount > 1) {
+        logger.warning("There is already an instance of MSAL.js in the window with the same client id.");
+    }
+    performanceEvent.add({
+        msalInstanceCount: msalInstanceCount,
+        sameClientIdInstanceCount: sameClientIdInstanceCount,
+    });
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -16266,7 +16514,7 @@ class StandardController {
      * Initializer function to perform async startup tasks such as connecting to WAM extension
      * @param request {?InitializeApplicationRequest} correlation id
      */
-    async initialize(request) {
+    async initialize(request, isBroker) {
         this.logger.trace("initialize called");
         if (this.initialized) {
             this.logger.info("initialize has already been called, exiting early.");
@@ -16282,11 +16530,18 @@ class StandardController {
         const allowPlatformBroker = this.config.system.allowPlatformBroker;
         const initMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.InitializeClientApplication, initCorrelationId);
         this.eventHandler.emitEvent(EventType.INITIALIZE_START);
+        // Broker applications are initialized twice, so we avoid double-counting it
+        if (!isBroker) {
+            try {
+                this.logMultipleInstances(initMeasurement);
+            }
+            catch { }
+        }
         await invokeAsync(this.browserStorage.initialize.bind(this.browserStorage), PerformanceEvents.InitializeCache, this.logger, this.performanceClient, initCorrelationId)(initCorrelationId);
         if (allowPlatformBroker) {
             try {
-                this.nativeExtensionProvider =
-                    await NativeMessageHandler.createProvider(this.logger, this.config.system.nativeBrokerHandshakeTimeout, this.performanceClient);
+                // check if platform authentication is available via DOM or browser extension and create relevant handlers
+                this.platformAuthProvider = await getPlatformAuthProvider(this.logger, this.performanceClient, initCorrelationId, this.config.system.nativeBrokerHandshakeTimeout);
             }
             catch (e) {
                 this.logger.verbose(e);
@@ -16356,18 +16611,15 @@ class StandardController {
         }
         const loggedInAccounts = this.getAllAccounts();
         const platformBrokerRequest = this.browserStorage.getCachedNativeRequest();
-        const useNative = platformBrokerRequest &&
-            NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
-            this.nativeExtensionProvider &&
-            !hash;
+        const useNative = platformBrokerRequest && this.platformAuthProvider && !hash;
         let rootMeasurement;
         this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
         let redirectResponse;
         try {
-            if (useNative && this.nativeExtensionProvider) {
+            if (useNative && this.platformAuthProvider) {
                 rootMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenRedirect, platformBrokerRequest?.correlationId || "");
                 this.logger.trace("handleRedirectPromise - acquiring token from native platform");
-                const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
+                const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.platformAuthProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
                 redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), PerformanceEvents.HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
             }
             else {
@@ -16496,15 +16748,15 @@ class StandardController {
                 this.eventHandler.emitEvent(EventType.LOGIN_START, exports.InteractionType.Redirect, request);
             }
             let result;
-            if (this.nativeExtensionProvider &&
+            if (this.platformAuthProvider &&
                 this.canUsePlatformBroker(request)) {
-                const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
+                const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.platformAuthProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
                 result = nativeClient
                     .acquireTokenRedirect(request, atrMeasurement)
                     .catch((e) => {
                     if (e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)) {
-                        this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                         const redirectClient = this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
@@ -16585,7 +16837,7 @@ class StandardController {
                 .catch((e) => {
                 if (e instanceof NativeAuthError &&
                     isFatalNativeAuthError(e)) {
-                    this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                     const popupClient = this.createPopupClient(correlationId);
                     return popupClient.acquireToken(request, pkce);
                 }
@@ -16694,7 +16946,7 @@ class StandardController {
             result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
                 // If native token acquisition fails for availability reasons fallback to standard flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
-                    this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                     const silentIframeClient = this.createSilentIframeClient(validRequest.correlationId);
                     return silentIframeClient.acquireToken(validRequest);
                 }
@@ -16796,7 +17048,7 @@ class StandardController {
                         // If native token acquisition fails for availability reasons fallback to standard flow
                         if (e instanceof NativeAuthError &&
                             isFatalNativeAuthError(e)) {
-                            this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                            this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                         }
                         throw e;
                     });
@@ -17054,10 +17306,10 @@ class StandardController {
      */
     async acquireTokenNative(request, apiId, accountId, cacheLookupPolicy) {
         this.logger.trace("acquireTokenNative called");
-        if (!this.nativeExtensionProvider) {
+        if (!this.platformAuthProvider) {
             throw createBrowserAuthError(nativeConnectionNotEstablished);
         }
-        const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.nativeExtensionProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
+        const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.platformAuthProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
         return nativeClient.acquireToken(request, cacheLookupPolicy);
     }
     /**
@@ -17066,8 +17318,12 @@ class StandardController {
      */
     canUsePlatformBroker(request, accountId) {
         this.logger.trace("canUsePlatformBroker called");
-        if (!NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme)) {
-            this.logger.trace("canUsePlatformBroker: isPlatformBrokerAvailable returned false, returning false");
+        if (!this.platformAuthProvider) {
+            this.logger.trace("canUsePlatformBroker: platform broker unavilable, returning false");
+            return false;
+        }
+        if (!isPlatformAuthAllowed(this.config, this.logger, this.platformAuthProvider, request.authenticationScheme)) {
+            this.logger.trace("canUsePlatformBroker: isBrokerAvailable returned false, returning false");
             return false;
         }
         if (request.prompt) {
@@ -17107,39 +17363,39 @@ class StandardController {
      * @param correlationId
      */
     createPopupClient(correlationId) {
-        return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, this.nativeExtensionProvider, correlationId);
+        return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, this.platformAuthProvider, correlationId);
     }
     /**
      * Returns new instance of the Redirect Interaction Client
      * @param correlationId
      */
     createRedirectClient(correlationId) {
-        return new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, this.nativeExtensionProvider, correlationId);
+        return new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, this.platformAuthProvider, correlationId);
     }
     /**
      * Returns new instance of the Silent Iframe Interaction Client
      * @param correlationId
      */
     createSilentIframeClient(correlationId) {
-        return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, this.nativeExtensionProvider, correlationId);
+        return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, this.platformAuthProvider, correlationId);
     }
     /**
      * Returns new instance of the Silent Cache Interaction Client
      */
     createSilentCacheClient(correlationId) {
-        return new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+        return new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.platformAuthProvider, correlationId);
     }
     /**
      * Returns new instance of the Silent Refresh Interaction Client
      */
     createSilentRefreshClient(correlationId) {
-        return new SilentRefreshClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+        return new SilentRefreshClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.platformAuthProvider, correlationId);
     }
     /**
      * Returns new instance of the Silent AuthCode Interaction Client
      */
     createSilentAuthCodeClient(correlationId) {
-        return new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenByCode, this.performanceClient, this.nativeExtensionProvider, correlationId);
+        return new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenByCode, this.performanceClient, this.platformAuthProvider, correlationId);
     }
     /**
      * Adds event callbacks to array
@@ -17485,14 +17741,14 @@ class StandardController {
      */
     async acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy) {
         // if the cache policy is set to access_token only, we should not be hitting the native layer yet
-        if (NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider, silentRequest.authenticationScheme) &&
+        if (isPlatformAuthAllowed(this.config, this.logger, this.platformAuthProvider, silentRequest.authenticationScheme) &&
             silentRequest.account.nativeAccountId) {
             this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
             return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
                 // If native token acquisition fails for availability reasons fallback to web flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow");
-                    this.nativeExtensionProvider = undefined; // Prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // Prevent future requests from continuing to attempt
                     // Cache will not contain tokens, given that previous WAM requests succeeded. Skip cache and RT renewal and go straight to iframe renewal
                     throw createClientAuthError(tokenRefreshRequired);
                 }
@@ -17535,6 +17791,23 @@ class StandardController {
         this.performanceClient.addFields({ usePreGeneratedPkce: !!res }, correlationId);
         return res;
     }
+    logMultipleInstances(performanceEvent) {
+        const clientId = this.config.auth.clientId;
+        if (!window)
+            return;
+        // @ts-ignore
+        window.msal = window.msal || {};
+        // @ts-ignore
+        window.msal.clientIds = window.msal.clientIds || [];
+        // @ts-ignore
+        const clientIds = window.msal.clientIds;
+        if (clientIds.length > 0) {
+            this.logger.verbose("There is already an instance of MSAL.js in the window.");
+        }
+        // @ts-ignore
+        window.msal.clientIds.push(clientId);
+        collectInstanceStats(clientId, performanceEvent, this.logger);
+    }
 }
 /**
  * Determines whether an error thrown by the refresh token endpoint can be resolved without interaction
@@ -17821,7 +18094,9 @@ class NestedAppAuthController {
      * Specific implementation of initialize function for NestedAppAuthController
      * @returns
      */
-    async initialize(request) {
+    async initialize(request, 
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    isBroker) {
         const initCorrelationId = request?.correlationId || createNewGuid();
         await this.browserStorage.initialize(initCorrelationId);
         return Promise.resolve();
@@ -18343,6 +18618,7 @@ class PublicClientApplication {
      * @param IController Optional parameter to explictly set the controller. (Will be removed when we remove public constructor)
      */
     constructor(configuration, controller) {
+        this.isBroker = false;
         this.controller =
             controller ||
                 new StandardController(new StandardOperatingContext(configuration));
@@ -18352,7 +18628,7 @@ class PublicClientApplication {
      * @param request {?InitializeApplicationRequest}
      */
     async initialize(request) {
-        return this.controller.initialize(request);
+        return this.controller.initialize(request, this.isBroker);
     }
     /**
      * Use when you want to obtain an access_token for your API via opening a popup window in the user's browser
@@ -19855,6 +20131,7 @@ exports.UrlString = UrlString;
 exports.WrapperSKU = WrapperSKU;
 exports.createNestablePublicClientApplication = createNestablePublicClientApplication;
 exports.createStandardPublicClientApplication = createStandardPublicClientApplication;
+exports.isPlatformBrokerAvailable = isPlatformBrokerAvailable;
 exports.stubbedPublicClientApplication = stubbedPublicClientApplication;
 exports.version = version;
 //# sourceMappingURL=msal-browser.cjs.map