@azure/msal-browser 4.25.1 → 4.26.1

package/lib/custom-auth-path/msal-custom-auth.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.25.1 2025-10-17 */
+/*! @azure/msal-browser v4.26.1 2025-11-06 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -276,7 +276,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -287,7 +287,7 @@ const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 const unexpectedError = "unexpected_error";
 const postRequestFailed$1 = "post_request_failed";
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -322,7 +322,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -372,7 +372,7 @@ const missingTenantIdError = "missing_tenant_id_error";
 const methodNotImplemented = "method_not_implemented";
 const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -446,7 +446,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -485,7 +485,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -676,12 +676,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.13.0";
+const version$1 = "15.13.1";
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -690,7 +690,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -719,7 +719,7 @@ const authorityMismatch = "authority_mismatch";
 const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -764,7 +764,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -861,7 +861,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1056,7 +1056,47 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Function to build a client info object from server clientInfo string
+ * @param rawClientInfo
+ * @param crypto
+ */
+function buildClientInfo(rawClientInfo, base64Decode) {
+    if (!rawClientInfo) {
+        throw createClientAuthError(clientInfoEmptyError);
+    }
+    try {
+        const decodedClientInfo = base64Decode(rawClientInfo);
+        return JSON.parse(decodedClientInfo);
+    }
+    catch (e) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+}
+/**
+ * Function to build a client info object from cached homeAccountId string
+ * @param homeAccountId
+ */
+function buildClientInfoFromHomeAccountId(homeAccountId) {
+    if (!homeAccountId) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+    const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
+    return {
+        uid: clientInfoParts[0],
+        utid: clientInfoParts.length < 2
+            ? Constants.EMPTY_STRING
+            : clientInfoParts[1],
+    };
+}
+
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1138,228 +1178,530 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
-
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Extract token by decoding the rawToken
- *
- * @param encodedToken
- */
-function extractTokenClaims(encodedToken, base64Decode) {
-    const jswPayload = getJWSPayload(encodedToken);
-    // token will be decoded to get the username
-    try {
-        // base64Decode() should throw an error if there is an issue
-        const base64Decoded = base64Decode(jswPayload);
-        return JSON.parse(base64Decoded);
-    }
-    catch (err) {
-        throw createClientAuthError(tokenParsingError);
-    }
-}
-/**
- * decode a JWT
- *
- * @param authToken
- */
-function getJWSPayload(authToken) {
-    if (!authToken) {
-        throw createClientAuthError(nullOrEmptyToken);
-    }
-    const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
-    const matches = tokenPartsRegex.exec(authToken);
-    if (!matches || matches.length < 4) {
-        throw createClientAuthError(tokenParsingError);
-    }
-    /**
-     * const crackedToken = {
-     *  header: matches[1],
-     *  JWSPayload: matches[2],
-     *  JWSSig: matches[3],
-     * };
-     */
-    return matches[2];
-}
-/**
- * Determine if the token's max_age has transpired
+ * Authority types supported by MSAL.
  */
-function checkMaxAge(authTime, maxAge) {
-    /*
-     * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-     * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
-     * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
-     */
-    const fiveMinuteSkew = 300000; // five minutes in milliseconds
-    if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
-        throw createClientAuthError(maxAgeTranspired);
-    }
-}
-
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+const AuthorityType = {
+    Default: 0,
+    Adfs: 1,
+    Dsts: 2,
+    Ciam: 3,
+};
 
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Canonicalizes a URL by making it lowercase and ensuring it ends with /
- * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
- * @param url - URL to canonicalize
- * @returns Canonicalized URL
- */
-function canonicalizeUrl(url) {
-    if (!url) {
-        return url;
-    }
-    let lowerCaseUrl = url.toLowerCase();
-    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
-    }
-    else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
-    }
-    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
-        lowerCaseUrl += "/";
-    }
-    return lowerCaseUrl;
-}
-/**
- * Parses hash string from given string. Returns empty string if no hash symbol is found.
- * @param hashString
- */
-function stripLeadingHashOrQuery(responseString) {
-    if (responseString.startsWith("#/")) {
-        return responseString.substring(2);
-    }
-    else if (responseString.startsWith("#") ||
-        responseString.startsWith("?")) {
-        return responseString.substring(1);
-    }
-    return responseString;
-}
-/**
- * Returns URL hash as server auth code response object.
+ * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+ * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+ * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+ * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+ * Downcased to match the realm case-insensitive comparison requirements
+ * @param idTokenClaims
+ * @returns
  */
-function getDeserializedResponse(responseString) {
-    // Check if given hash is empty
-    if (!responseString || responseString.indexOf("=") < 0) {
-        return null;
-    }
-    try {
-        // Strip the # or ? symbol if present
-        const normalizedResponse = stripLeadingHashOrQuery(responseString);
-        // If # symbol was not present, above will return empty string, so give original hash value
-        const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
-        // Check for known response properties
-        if (deserializedHash.code ||
-            deserializedHash.ear_jwe ||
-            deserializedHash.error ||
-            deserializedHash.error_description ||
-            deserializedHash.state) {
-            return deserializedHash;
-        }
-    }
-    catch (e) {
-        throw createClientAuthError(hashNotDeserialized);
+function getTenantIdFromIdTokenClaims(idTokenClaims) {
+    if (idTokenClaims) {
+        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
+        return tenantId || null;
     }
     return null;
-}
-/**
- * Utility to create a URL from the params map
- */
-function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParameters) {
-    const queryParameterArray = new Array();
-    parameters.forEach((value, key) => {
-        if (!encodeExtraParams &&
-            extraQueryParameters &&
-            key in extraQueryParameters) {
-            queryParameterArray.push(`${key}=${value}`);
-        }
-        else {
-            queryParameterArray.push(`${key}=${encodeURIComponent(value)}`);
-        }
-    });
-    return queryParameterArray.join("&");
-}
-/**
- * Normalizes URLs for comparison by removing hash, canonicalizing,
- * and ensuring consistent URL encoding in query parameters.
- * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
- * @param url - URL to normalize
- * @returns Normalized URL string for comparison
- */
-function normalizeUrlForComparison(url) {
-    if (!url) {
-        return url;
-    }
-    // Remove hash first
-    const urlWithoutHash = url.split("#")[0];
-    try {
-        // Parse the URL to handle encoding consistently
-        const urlObj = new URL(urlWithoutHash);
-        /*
-         * Reconstruct the URL with properly decoded query parameters
-         * This ensures that %27 and ' are treated as equivalent
-         */
-        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
-        // Apply canonicalization logic inline to avoid circular dependency
-        return canonicalizeUrl(normalizedUrl);
-    }
-    catch (e) {
-        // Fallback to original logic if URL parsing fails
-        return canonicalizeUrl(urlWithoutHash);
-    }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
-
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Url object class which can perform various transformations on url strings.
+ * Protocol modes supported by MSAL.
  */
-class UrlString {
-    get urlString() {
-        return this._urlString;
-    }
-    constructor(url) {
-        this._urlString = url;
-        if (!this._urlString) {
-            // Throws error if url is empty
-            throw createClientConfigurationError(urlEmptyError);
-        }
-        if (!url.includes("#")) {
-            this._urlString = UrlString.canonicalizeUri(url);
-        }
-    }
+const ProtocolMode = {
     /**
-     * Ensure urls are lower case and end with a / character.
-     * @param url
+     * Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
      */
-    static canonicalizeUri(url) {
-        if (url) {
-            let lowerCaseUrl = url.toLowerCase();
-            if (StringUtils.endsWith(lowerCaseUrl, "?")) {
-                lowerCaseUrl = lowerCaseUrl.slice(0, -1);
-            }
-            else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
-                lowerCaseUrl = lowerCaseUrl.slice(0, -2);
-            }
-            if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
-                lowerCaseUrl += "/";
-            }
-            return lowerCaseUrl;
-        }
-        return url;
-    }
+    AAD: "AAD",
     /**
-     * Throws if urlString passed is not a valid authority URI string.
+     * Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
+     * Support is limited for this mode.
+     */
+    OIDC: "OIDC",
+    /**
+     * Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
+     */
+    EAR: "EAR",
+};
+
+/*! @azure/msal-common v15.13.1 2025-11-06 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
+ *
+ * Key : Value Schema
+ *
+ * Key: <home_account_id>-<environment>-<realm*>
+ *
+ * Value Schema:
+ * {
+ *      homeAccountId: home account identifier for the auth scheme,
+ *      environment: entity that issued the token, represented as a full host
+ *      realm: Full tenant or organizational identifier that the account belongs to
+ *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
+ *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
+ *      authorityType: Accounts authority type as a string
+ *      name: Full name for the account, including given name and family name,
+ *      lastModificationTime: last time this entity was modified in the cache
+ *      lastModificationApp:
+ *      nativeAccountId: Account identifier on the native device
+ *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
+ * }
+ * @internal
+ */
+class AccountEntity {
+    /**
+     * Returns the AccountInfo interface for this account.
+     */
+    static getAccountInfo(accountEntity) {
+        return {
+            homeAccountId: accountEntity.homeAccountId,
+            environment: accountEntity.environment,
+            tenantId: accountEntity.realm,
+            username: accountEntity.username,
+            localAccountId: accountEntity.localAccountId,
+            loginHint: accountEntity.loginHint,
+            name: accountEntity.name,
+            nativeAccountId: accountEntity.nativeAccountId,
+            authorityType: accountEntity.authorityType,
+            // Deserialize tenant profiles array into a Map
+            tenantProfiles: new Map((accountEntity.tenantProfiles || []).map((tenantProfile) => {
+                return [tenantProfile.tenantId, tenantProfile];
+            })),
+            dataBoundary: accountEntity.dataBoundary,
+        };
+    }
+    /**
+     * Returns true if the account entity is in single tenant format (outdated), false otherwise
+     */
+    isSingleTenant() {
+        return !this.tenantProfiles;
+    }
+    /**
+     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
+     * @param accountDetails
+     */
+    static createAccount(accountDetails, authority, base64Decode) {
+        const account = new AccountEntity();
+        if (authority.authorityType === AuthorityType.Adfs) {
+            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
+        }
+        else if (authority.protocolMode === ProtocolMode.OIDC) {
+            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        }
+        else {
+            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
+        }
+        let clientInfo;
+        if (accountDetails.clientInfo && base64Decode) {
+            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+            if (clientInfo.xms_tdbr) {
+                account.dataBoundary =
+                    clientInfo.xms_tdbr === "EU" ? "EU" : "None";
+            }
+        }
+        account.clientInfo = accountDetails.clientInfo;
+        account.homeAccountId = accountDetails.homeAccountId;
+        account.nativeAccountId = accountDetails.nativeAccountId;
+        const env = accountDetails.environment ||
+            (authority && authority.getPreferredCache());
+        if (!env) {
+            throw createClientAuthError(invalidCacheEnvironment);
+        }
+        account.environment = env;
+        // non AAD scenarios can have empty realm
+        account.realm =
+            clientInfo?.utid ||
+                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+                "";
+        // How do you account for MSA CID here?
+        account.localAccountId =
+            clientInfo?.uid ||
+                accountDetails.idTokenClaims?.oid ||
+                accountDetails.idTokenClaims?.sub ||
+                "";
+        /*
+         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+         * In most cases it will contain a single email. This field should not be relied upon if a custom
+         * policy is configured to return more than 1 email.
+         */
+        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
+            accountDetails.idTokenClaims?.upn;
+        const email = accountDetails.idTokenClaims?.emails
+            ? accountDetails.idTokenClaims.emails[0]
+            : null;
+        account.username = preferredUsername || email || "";
+        account.loginHint = accountDetails.idTokenClaims?.login_hint;
+        account.name = accountDetails.idTokenClaims?.name || "";
+        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
+        account.msGraphHost = accountDetails.msGraphHost;
+        if (accountDetails.tenantProfiles) {
+            account.tenantProfiles = accountDetails.tenantProfiles;
+        }
+        else {
+            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
+            account.tenantProfiles = [tenantProfile];
+        }
+        return account;
+    }
+    /**
+     * Creates an AccountEntity object from AccountInfo
+     * @param accountInfo
+     * @param cloudGraphHostName
+     * @param msGraphHost
+     * @returns
+     */
+    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
+        const account = new AccountEntity();
+        account.authorityType =
+            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.homeAccountId = accountInfo.homeAccountId;
+        account.localAccountId = accountInfo.localAccountId;
+        account.nativeAccountId = accountInfo.nativeAccountId;
+        account.realm = accountInfo.tenantId;
+        account.environment = accountInfo.environment;
+        account.username = accountInfo.username;
+        account.name = accountInfo.name;
+        account.loginHint = accountInfo.loginHint;
+        account.cloudGraphHostName = cloudGraphHostName;
+        account.msGraphHost = msGraphHost;
+        // Serialize tenant profiles map into an array
+        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
+        account.dataBoundary = accountInfo.dataBoundary;
+        return account;
+    }
+    /**
+     * Generate HomeAccountId from server response
+     * @param serverClientInfo
+     * @param authType
+     */
+    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
+        // since ADFS/DSTS do not have tid and does not set client_info
+        if (!(authType === AuthorityType.Adfs ||
+            authType === AuthorityType.Dsts)) {
+            // for cases where there is clientInfo
+            if (serverClientInfo) {
+                try {
+                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
+                    if (clientInfo.uid && clientInfo.utid) {
+                        return `${clientInfo.uid}.${clientInfo.utid}`;
+                    }
+                }
+                catch (e) { }
+            }
+            logger.warning("No client info in response");
+        }
+        // default to "sub" claim
+        return idTokenClaims?.sub || "";
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    static isAccountEntity(entity) {
+        if (!entity) {
+            return false;
+        }
+        return (entity.hasOwnProperty("homeAccountId") &&
+            entity.hasOwnProperty("environment") &&
+            entity.hasOwnProperty("realm") &&
+            entity.hasOwnProperty("localAccountId") &&
+            entity.hasOwnProperty("username") &&
+            entity.hasOwnProperty("authorityType"));
+    }
+    /**
+     * Helper function to determine whether 2 accountInfo objects represent the same account
+     * @param accountA
+     * @param accountB
+     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
+     */
+    static accountInfoIsEqual(accountA, accountB, compareClaims) {
+        if (!accountA || !accountB) {
+            return false;
+        }
+        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
+        if (compareClaims) {
+            const accountAClaims = (accountA.idTokenClaims ||
+                {});
+            const accountBClaims = (accountB.idTokenClaims ||
+                {});
+            // issued at timestamp and nonce are expected to change each time a new id token is acquired
+            claimsMatch =
+                accountAClaims.iat === accountBClaims.iat &&
+                    accountAClaims.nonce === accountBClaims.nonce;
+        }
+        return (accountA.homeAccountId === accountB.homeAccountId &&
+            accountA.localAccountId === accountB.localAccountId &&
+            accountA.username === accountB.username &&
+            accountA.tenantId === accountB.tenantId &&
+            accountA.loginHint === accountB.loginHint &&
+            accountA.environment === accountB.environment &&
+            accountA.nativeAccountId === accountB.nativeAccountId &&
+            claimsMatch);
+    }
+}
+
+/*! @azure/msal-common v15.13.1 2025-11-06 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Extract token by decoding the rawToken
+ *
+ * @param encodedToken
+ */
+function extractTokenClaims(encodedToken, base64Decode) {
+    const jswPayload = getJWSPayload(encodedToken);
+    // token will be decoded to get the username
+    try {
+        // base64Decode() should throw an error if there is an issue
+        const base64Decoded = base64Decode(jswPayload);
+        return JSON.parse(base64Decoded);
+    }
+    catch (err) {
+        throw createClientAuthError(tokenParsingError);
+    }
+}
+/**
+ * Check if the signin_state claim contains "kmsi"
+ * @param idTokenClaims
+ * @returns
+ */
+function isKmsi(idTokenClaims) {
+    if (!idTokenClaims.signin_state) {
+        return false;
+    }
+    /**
+     * Signin_state claim known values:
+     * dvc_mngd - device is managed
+     * dvc_dmjd - device is domain joined
+     * kmsi - user opted to "keep me signed in"
+     * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
+     */
+    const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
+    const kmsi = idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
+    return kmsi;
+}
+/**
+ * decode a JWT
+ *
+ * @param authToken
+ */
+function getJWSPayload(authToken) {
+    if (!authToken) {
+        throw createClientAuthError(nullOrEmptyToken);
+    }
+    const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
+    const matches = tokenPartsRegex.exec(authToken);
+    if (!matches || matches.length < 4) {
+        throw createClientAuthError(tokenParsingError);
+    }
+    /**
+     * const crackedToken = {
+     *  header: matches[1],
+     *  JWSPayload: matches[2],
+     *  JWSSig: matches[3],
+     * };
+     */
+    return matches[2];
+}
+/**
+ * Determine if the token's max_age has transpired
+ */
+function checkMaxAge(authTime, maxAge) {
+    /*
+     * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+     * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
+     * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
+     */
+    const fiveMinuteSkew = 300000; // five minutes in milliseconds
+    if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
+        throw createClientAuthError(maxAgeTranspired);
+    }
+}
+
+/*! @azure/msal-common v15.13.1 2025-11-06 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Canonicalizes a URL by making it lowercase and ensuring it ends with /
+ * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
+ * @param url - URL to canonicalize
+ * @returns Canonicalized URL
+ */
+function canonicalizeUrl(url) {
+    if (!url) {
+        return url;
+    }
+    let lowerCaseUrl = url.toLowerCase();
+    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
+    }
+    else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
+    }
+    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
+        lowerCaseUrl += "/";
+    }
+    return lowerCaseUrl;
+}
+/**
+ * Parses hash string from given string. Returns empty string if no hash symbol is found.
+ * @param hashString
+ */
+function stripLeadingHashOrQuery(responseString) {
+    if (responseString.startsWith("#/")) {
+        return responseString.substring(2);
+    }
+    else if (responseString.startsWith("#") ||
+        responseString.startsWith("?")) {
+        return responseString.substring(1);
+    }
+    return responseString;
+}
+/**
+ * Returns URL hash as server auth code response object.
+ */
+function getDeserializedResponse(responseString) {
+    // Check if given hash is empty
+    if (!responseString || responseString.indexOf("=") < 0) {
+        return null;
+    }
+    try {
+        // Strip the # or ? symbol if present
+        const normalizedResponse = stripLeadingHashOrQuery(responseString);
+        // If # symbol was not present, above will return empty string, so give original hash value
+        const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
+        // Check for known response properties
+        if (deserializedHash.code ||
+            deserializedHash.ear_jwe ||
+            deserializedHash.error ||
+            deserializedHash.error_description ||
+            deserializedHash.state) {
+            return deserializedHash;
+        }
+    }
+    catch (e) {
+        throw createClientAuthError(hashNotDeserialized);
+    }
+    return null;
+}
+/**
+ * Utility to create a URL from the params map
+ */
+function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParameters) {
+    const queryParameterArray = new Array();
+    parameters.forEach((value, key) => {
+        if (!encodeExtraParams &&
+            extraQueryParameters &&
+            key in extraQueryParameters) {
+            queryParameterArray.push(`${key}=${value}`);
+        }
+        else {
+            queryParameterArray.push(`${key}=${encodeURIComponent(value)}`);
+        }
+    });
+    return queryParameterArray.join("&");
+}
+/**
+ * Normalizes URLs for comparison by removing hash, canonicalizing,
+ * and ensuring consistent URL encoding in query parameters.
+ * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * @param url - URL to normalize
+ * @returns Normalized URL string for comparison
+ */
+function normalizeUrlForComparison(url) {
+    if (!url) {
+        return url;
+    }
+    // Remove hash first
+    const urlWithoutHash = url.split("#")[0];
+    try {
+        // Parse the URL to handle encoding consistently
+        const urlObj = new URL(urlWithoutHash);
+        /*
+         * Reconstruct the URL with properly decoded query parameters
+         * This ensures that %27 and ' are treated as equivalent
+         */
+        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
+        // Apply canonicalization logic inline to avoid circular dependency
+        return canonicalizeUrl(normalizedUrl);
+    }
+    catch (e) {
+        // Fallback to original logic if URL parsing fails
+        return canonicalizeUrl(urlWithoutHash);
+    }
+}
+
+/*! @azure/msal-common v15.13.1 2025-11-06 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Url object class which can perform various transformations on url strings.
+ */
+class UrlString {
+    get urlString() {
+        return this._urlString;
+    }
+    constructor(url) {
+        this._urlString = url;
+        if (!this._urlString) {
+            // Throws error if url is empty
+            throw createClientConfigurationError(urlEmptyError);
+        }
+        if (!url.includes("#")) {
+            this._urlString = UrlString.canonicalizeUri(url);
+        }
+    }
+    /**
+     * Ensure urls are lower case and end with a / character.
+     * @param url
+     */
+    static canonicalizeUri(url) {
+        if (url) {
+            let lowerCaseUrl = url.toLowerCase();
+            if (StringUtils.endsWith(lowerCaseUrl, "?")) {
+                lowerCaseUrl = lowerCaseUrl.slice(0, -1);
+            }
+            else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
+                lowerCaseUrl = lowerCaseUrl.slice(0, -2);
+            }
+            if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
+                lowerCaseUrl += "/";
+            }
+            return lowerCaseUrl;
+        }
+        return url;
+    }
+    /**
+     * Throws if urlString passed is not a valid authority URI string.
      */
     validateAsUri() {
         // Attempts to parse url for uri components
@@ -1479,7 +1821,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1618,7 +1960,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1626,7 +1968,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1671,7 +2013,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1730,7 +2072,7 @@ class CacheManager {
     getBaseAccountInfo(accountFilter, correlationId) {
         const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
         if (accountEntities.length > 0) {
-            return accountEntities[0].getAccountInfo();
+            return AccountEntity.getAccountInfo(accountEntities[0]);
         }
         else {
             return null;
@@ -1769,7 +2111,7 @@ class CacheManager {
         return tenantedAccountInfo;
     }
     getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
-        const accountInfo = accountEntity.getAccountInfo();
+        const accountInfo = AccountEntity.getAccountInfo(accountEntity);
         let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
         const tokenKeys = this.getTokenKeys();
         // If a tenant ID was provided, only return the tenant profile for that tenant ID if it exists
@@ -1839,27 +2181,28 @@ class CacheManager {
     /**
      * saves a cache record
      * @param cacheRecord {CacheRecord}
-     * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
+     * @param kmsi - Keep Me Signed In
+     * @param storeInCache {?StoreInCache}
      */
-    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
+    async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
         if (!cacheRecord) {
             throw createClientAuthError(invalidCacheRecord);
         }
         try {
             if (!!cacheRecord.account) {
-                await this.setAccount(cacheRecord.account, correlationId);
+                await this.setAccount(cacheRecord.account, correlationId, kmsi);
             }
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                await this.setIdTokenCredential(cacheRecord.idToken, correlationId);
+                await this.setIdTokenCredential(cacheRecord.idToken, correlationId, kmsi);
             }
             if (!!cacheRecord.accessToken &&
                 storeInCache?.accessToken !== false) {
-                await this.saveAccessToken(cacheRecord.accessToken, correlationId);
+                await this.saveAccessToken(cacheRecord.accessToken, correlationId, kmsi);
             }
             if (!!cacheRecord.refreshToken &&
                 storeInCache?.refreshToken !== false) {
-                await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
+                await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId, kmsi);
             }
             if (!!cacheRecord.appMetadata) {
                 this.setAppMetadata(cacheRecord.appMetadata, correlationId);
@@ -1879,7 +2222,7 @@ class CacheManager {
      * saves access token credential
      * @param credential
      */
-    async saveAccessToken(credential, correlationId) {
+    async saveAccessToken(credential, correlationId, kmsi) {
         const accessTokenFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -1904,7 +2247,7 @@ class CacheManager {
                 }
             }
         });
-        await this.setAccessTokenCredential(credential, correlationId);
+        await this.setAccessTokenCredential(credential, correlationId, kmsi);
     }
     /**
      * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
@@ -2774,36 +3117,12 @@ class DefaultStorageClass extends CacheManager {
     generateCredentialKey() {
         throw createClientAuthError(methodNotImplemented);
     }
-    generateAccountKey() {
-        throw createClientAuthError(methodNotImplemented);
-    }
-}
-
-/*! @azure/msal-common v15.13.0 2025-10-17 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Protocol modes supported by MSAL.
- */
-const ProtocolMode = {
-    /**
-     * Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
-     */
-    AAD: "AAD",
-    /**
-     * Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
-     * Support is limited for this mode.
-     */
-    OIDC: "OIDC",
-    /**
-     * Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
-     */
-    EAR: "EAR",
-};
+    generateAccountKey() {
+        throw createClientAuthError(methodNotImplemented);
+    }
+}
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3070,7 +3389,7 @@ const PerformanceEvents = {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3149,7 +3468,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3249,7 +3568,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3259,47 +3578,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Function to build a client info object from server clientInfo string
- * @param rawClientInfo
- * @param crypto
- */
-function buildClientInfo(rawClientInfo, base64Decode) {
-    if (!rawClientInfo) {
-        throw createClientAuthError(clientInfoEmptyError);
-    }
-    try {
-        const decodedClientInfo = base64Decode(rawClientInfo);
-        return JSON.parse(decodedClientInfo);
-    }
-    catch (e) {
-        throw createClientAuthError(clientInfoDecodingError);
-    }
-}
-/**
- * Function to build a client info object from cached homeAccountId string
- * @param homeAccountId
- */
-function buildClientInfoFromHomeAccountId(homeAccountId) {
-    if (!homeAccountId) {
-        throw createClientAuthError(clientInfoDecodingError);
-    }
-    const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
-    return {
-        uid: clientInfoParts[0],
-        utid: clientInfoParts.length < 2
-            ? Constants.EMPTY_STRING
-            : clientInfoParts[1],
-    };
-}
-
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3349,7 +3628,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3729,22 +4008,7 @@ function addPostBodyParameters(parameters, bodyParameters) {
     });
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Authority types supported by MSAL.
- */
-const AuthorityType = {
-    Default: 0,
-    Adfs: 1,
-    Dsts: 2,
-    Ciam: 3,
-};
-
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3756,7 +4020,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3766,7 +4030,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3776,7 +4040,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3872,7 +4136,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3978,7 +4242,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4043,7 +4307,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4305,7 +4569,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5144,7 +5408,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5175,7 +5439,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5194,7 +5458,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5215,7 +5479,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5248,483 +5512,240 @@ class ThrottlingUtils {
     }
     /**
      * Performs necessary throttling checks after a network request.
-     * @param cacheManager
-     * @param thumbprint
-     * @param response
-     */
-    static postProcess(cacheManager, thumbprint, response, correlationId) {
-        if (ThrottlingUtils.checkResponseStatus(response) ||
-            ThrottlingUtils.checkResponseForRetryAfter(response)) {
-            const thumbprintValue = {
-                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
-                error: response.body.error,
-                errorCodes: response.body.error_codes,
-                errorMessage: response.body.error_description,
-                subError: response.body.suberror,
-            };
-            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
-        }
-    }
-    /**
-     * Checks a NetworkResponse object's status codes against 429 or 5xx
-     * @param response
-     */
-    static checkResponseStatus(response) {
-        return (response.status === 429 ||
-            (response.status >= 500 && response.status < 600));
-    }
-    /**
-     * Checks a NetworkResponse object's RetryAfter header
-     * @param response
-     */
-    static checkResponseForRetryAfter(response) {
-        if (response.headers) {
-            return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
-                (response.status < 200 || response.status >= 300));
-        }
-        return false;
-    }
-    /**
-     * Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
-     * @param throttleTime
-     */
-    static calculateThrottleTime(throttleTime) {
-        const time = throttleTime <= 0 ? 0 : throttleTime;
-        const currentSeconds = Date.now() / 1000;
-        return Math.floor(Math.min(currentSeconds +
-            (time || ThrottlingConstants.DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds +
-            ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
-    }
-    static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
-        const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
-        const key = this.generateThrottlingStorageKey(thumbprint);
-        cacheManager.removeItem(key, request.correlationId);
-    }
-}
-
-/*! @azure/msal-common v15.13.0 2025-10-17 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Represents network related errors
- */
-class NetworkError extends AuthError {
-    constructor(error, httpStatus, responseHeaders) {
-        super(error.errorCode, error.errorMessage, error.subError);
-        Object.setPrototypeOf(this, NetworkError.prototype);
-        this.name = "NetworkError";
-        this.error = error;
-        this.httpStatus = httpStatus;
-        this.responseHeaders = responseHeaders;
-    }
-}
-/**
- * Creates NetworkError object for a failed network request
- * @param error - Error to be thrown back to the caller
- * @param httpStatus - Status code of the network request
- * @param responseHeaders - Response headers of the network request, when available
- * @returns NetworkError object
- */
-function createNetworkError(error, httpStatus, responseHeaders, additionalError) {
-    error.errorMessage = `${error.errorMessage}, additionalErrorInfo: error.name:${additionalError?.name}, error.message:${additionalError?.message}`;
-    return new NetworkError(error, httpStatus, responseHeaders);
-}
-
-/*! @azure/msal-common v15.13.0 2025-10-17 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
- * @internal
- */
-class BaseClient {
-    constructor(configuration, performanceClient) {
-        // Set the configuration
-        this.config = buildClientConfiguration(configuration);
-        // Initialize the logger
-        this.logger = new Logger(this.config.loggerOptions, name$1, version$1);
-        // Initialize crypto
-        this.cryptoUtils = this.config.cryptoInterface;
-        // Initialize storage interface
-        this.cacheManager = this.config.storageInterface;
-        // Set the network interface
-        this.networkClient = this.config.networkInterface;
-        // Set TelemetryManager
-        this.serverTelemetryManager = this.config.serverTelemetryManager;
-        // set Authority
-        this.authority = this.config.authOptions.authority;
-        // set performance telemetry client
-        this.performanceClient = performanceClient;
-    }
-    /**
-     * Creates default headers for requests to token endpoint
-     */
-    createTokenRequestHeaders(ccsCred) {
-        const headers = {};
-        headers[HeaderNames.CONTENT_TYPE] = Constants.URL_FORM_CONTENT_TYPE;
-        if (!this.config.systemOptions.preventCorsPreflight && ccsCred) {
-            switch (ccsCred.type) {
-                case CcsCredentialType.HOME_ACCOUNT_ID:
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
-                        headers[HeaderNames.CCS_HEADER] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
-                    }
-                    catch (e) {
-                        this.logger.verbose("Could not parse home account ID for CCS Header: " +
-                            e);
-                    }
-                    break;
-                case CcsCredentialType.UPN:
-                    headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;
-                    break;
-            }
-        }
-        return headers;
-    }
-    /**
-     * Http post to token endpoint
-     * @param tokenEndpoint
-     * @param queryString
-     * @param headers
-     * @param thumbprint
-     */
-    async executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, queuedEvent) {
-        if (queuedEvent) {
-            this.performanceClient?.addQueueMeasurement(queuedEvent, correlationId);
-        }
-        const response = await this.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId);
-        if (this.config.serverTelemetryManager &&
-            response.status < 500 &&
-            response.status !== 429) {
-            // Telemetry data successfully logged by server, clear Telemetry cache
-            this.config.serverTelemetryManager.clearTelemetryCache();
-        }
-        return response;
-    }
-    /**
-     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
-     * @param thumbprint - Request thumbprint for throttling
-     * @param tokenEndpoint - Endpoint to make the POST to
-     * @param options - Body and Headers to include on the POST request
-     * @param correlationId - CorrelationId for telemetry
-     */
-    async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
-        ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
-        let response;
-        try {
-            response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
-            const responseHeaders = response.headers || {};
-            this.performanceClient?.addFields({
-                refreshTokenSize: response.body.refresh_token?.length || 0,
-                httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
-                requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
-            }, correlationId);
-        }
-        catch (e) {
-            if (e instanceof NetworkError) {
-                const responseHeaders = e.responseHeaders;
-                if (responseHeaders) {
-                    this.performanceClient?.addFields({
-                        httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
-                        requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
-                            "",
-                        contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
-                            undefined,
-                        contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
-                            undefined,
-                        httpStatus: e.httpStatus,
-                    }, correlationId);
-                }
-                throw e.error;
-            }
-            if (e instanceof AuthError) {
-                throw e;
-            }
-            else {
-                throw createClientAuthError(networkError);
-            }
+     * @param cacheManager
+     * @param thumbprint
+     * @param response
+     */
+    static postProcess(cacheManager, thumbprint, response, correlationId) {
+        if (ThrottlingUtils.checkResponseStatus(response) ||
+            ThrottlingUtils.checkResponseForRetryAfter(response)) {
+            const thumbprintValue = {
+                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
+                error: response.body.error,
+                errorCodes: response.body.error_codes,
+                errorMessage: response.body.error_description,
+                subError: response.body.suberror,
+            };
+            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
         }
-        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
-        return response;
     }
     /**
-     * Updates the authority object of the client. Endpoint discovery must be completed.
-     * @param updatedAuthority
+     * Checks a NetworkResponse object's status codes against 429 or 5xx
+     * @param response
      */
-    async updateAuthority(cloudInstanceHostname, correlationId) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.UpdateTokenEndpointAuthority, correlationId);
-        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${this.authority.tenant}/`;
-        const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
-        this.authority = cloudInstanceAuthority;
+    static checkResponseStatus(response) {
+        return (response.status === 429 ||
+            (response.status >= 500 && response.status < 600));
     }
     /**
-     * Creates query string for the /token request
-     * @param request
+     * Checks a NetworkResponse object's RetryAfter header
+     * @param response
      */
-    createTokenQueryParameters(request) {
-        const parameters = new Map();
-        if (request.embeddedClientId) {
-            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
-        }
-        if (request.tokenQueryParameters) {
-            addExtraQueryParameters(parameters, request.tokenQueryParameters);
+    static checkResponseForRetryAfter(response) {
+        if (response.headers) {
+            return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
+                (response.status < 200 || response.status >= 300));
         }
-        addCorrelationId(parameters, request.correlationId);
-        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-        return mapToQueryString(parameters);
+        return false;
+    }
+    /**
+     * Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
+     * @param throttleTime
+     */
+    static calculateThrottleTime(throttleTime) {
+        const time = throttleTime <= 0 ? 0 : throttleTime;
+        const currentSeconds = Date.now() / 1000;
+        return Math.floor(Math.min(currentSeconds +
+            (time || ThrottlingConstants.DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds +
+            ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
+    }
+    static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
+        const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
+        const key = this.generateThrottlingStorageKey(thumbprint);
+        cacheManager.removeItem(key, request.correlationId);
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
- * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
- * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
- * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
- * Downcased to match the realm case-insensitive comparison requirements
- * @param idTokenClaims
- * @returns
+ * Represents network related errors
  */
-function getTenantIdFromIdTokenClaims(idTokenClaims) {
-    if (idTokenClaims) {
-        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
-        return tenantId || null;
+class NetworkError extends AuthError {
+    constructor(error, httpStatus, responseHeaders) {
+        super(error.errorCode, error.errorMessage, error.subError);
+        Object.setPrototypeOf(this, NetworkError.prototype);
+        this.name = "NetworkError";
+        this.error = error;
+        this.httpStatus = httpStatus;
+        this.responseHeaders = responseHeaders;
     }
-    return null;
+}
+/**
+ * Creates NetworkError object for a failed network request
+ * @param error - Error to be thrown back to the caller
+ * @param httpStatus - Status code of the network request
+ * @param responseHeaders - Response headers of the network request, when available
+ * @returns NetworkError object
+ */
+function createNetworkError(error, httpStatus, responseHeaders, additionalError) {
+    error.errorMessage = `${error.errorMessage}, additionalErrorInfo: error.name:${additionalError?.name}, error.message:${additionalError?.message}`;
+    return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
- *
- * Key : Value Schema
- *
- * Key: <home_account_id>-<environment>-<realm*>
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
- *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
- *      authorityType: Accounts authority type as a string
- *      name: Full name for the account, including given name and family name,
- *      lastModificationTime: last time this entity was modified in the cache
- *      lastModificationApp:
- *      nativeAccountId: Account identifier on the native device
- *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
- * }
+ * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
  * @internal
  */
-class AccountEntity {
-    /**
-     * Returns the AccountInfo interface for this account.
-     */
-    getAccountInfo() {
-        return {
-            homeAccountId: this.homeAccountId,
-            environment: this.environment,
-            tenantId: this.realm,
-            username: this.username,
-            localAccountId: this.localAccountId,
-            loginHint: this.loginHint,
-            name: this.name,
-            nativeAccountId: this.nativeAccountId,
-            authorityType: this.authorityType,
-            // Deserialize tenant profiles array into a Map
-            tenantProfiles: new Map((this.tenantProfiles || []).map((tenantProfile) => {
-                return [tenantProfile.tenantId, tenantProfile];
-            })),
-            dataBoundary: this.dataBoundary,
-        };
-    }
-    /**
-     * Returns true if the account entity is in single tenant format (outdated), false otherwise
-     */
-    isSingleTenant() {
-        return !this.tenantProfiles;
-    }
-    /**
-     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-     * @param accountDetails
-     */
-    static createAccount(accountDetails, authority, base64Decode) {
-        const account = new AccountEntity();
-        if (authority.authorityType === AuthorityType.Adfs) {
-            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
-        }
-        else if (authority.protocolMode === ProtocolMode.OIDC) {
-            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        }
-        else {
-            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
-        }
-        let clientInfo;
-        if (accountDetails.clientInfo && base64Decode) {
-            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
-            if (clientInfo.xms_tdbr) {
-                account.dataBoundary =
-                    clientInfo.xms_tdbr === "EU" ? "EU" : "None";
-            }
-        }
-        account.clientInfo = accountDetails.clientInfo;
-        account.homeAccountId = accountDetails.homeAccountId;
-        account.nativeAccountId = accountDetails.nativeAccountId;
-        const env = accountDetails.environment ||
-            (authority && authority.getPreferredCache());
-        if (!env) {
-            throw createClientAuthError(invalidCacheEnvironment);
-        }
-        account.environment = env;
-        // non AAD scenarios can have empty realm
-        account.realm =
-            clientInfo?.utid ||
-                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
-                "";
-        // How do you account for MSA CID here?
-        account.localAccountId =
-            clientInfo?.uid ||
-                accountDetails.idTokenClaims?.oid ||
-                accountDetails.idTokenClaims?.sub ||
-                "";
-        /*
-         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-         * In most cases it will contain a single email. This field should not be relied upon if a custom
-         * policy is configured to return more than 1 email.
-         */
-        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
-            accountDetails.idTokenClaims?.upn;
-        const email = accountDetails.idTokenClaims?.emails
-            ? accountDetails.idTokenClaims.emails[0]
-            : null;
-        account.username = preferredUsername || email || "";
-        account.loginHint = accountDetails.idTokenClaims?.login_hint;
-        account.name = accountDetails.idTokenClaims?.name || "";
-        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
-        account.msGraphHost = accountDetails.msGraphHost;
-        if (accountDetails.tenantProfiles) {
-            account.tenantProfiles = accountDetails.tenantProfiles;
-        }
-        else {
-            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
-            account.tenantProfiles = [tenantProfile];
-        }
-        return account;
+class BaseClient {
+    constructor(configuration, performanceClient) {
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name$1, version$1);
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
     }
     /**
-     * Creates an AccountEntity object from AccountInfo
-     * @param accountInfo
-     * @param cloudGraphHostName
-     * @param msGraphHost
-     * @returns
+     * Creates default headers for requests to token endpoint
      */
-    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
-        const account = new AccountEntity();
-        account.authorityType =
-            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        account.homeAccountId = accountInfo.homeAccountId;
-        account.localAccountId = accountInfo.localAccountId;
-        account.nativeAccountId = accountInfo.nativeAccountId;
-        account.realm = accountInfo.tenantId;
-        account.environment = accountInfo.environment;
-        account.username = accountInfo.username;
-        account.name = accountInfo.name;
-        account.loginHint = accountInfo.loginHint;
-        account.cloudGraphHostName = cloudGraphHostName;
-        account.msGraphHost = msGraphHost;
-        // Serialize tenant profiles map into an array
-        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
-        account.dataBoundary = accountInfo.dataBoundary;
-        return account;
+    createTokenRequestHeaders(ccsCred) {
+        const headers = {};
+        headers[HeaderNames.CONTENT_TYPE] = Constants.URL_FORM_CONTENT_TYPE;
+        if (!this.config.systemOptions.preventCorsPreflight && ccsCred) {
+            switch (ccsCred.type) {
+                case CcsCredentialType.HOME_ACCOUNT_ID:
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
+                        headers[HeaderNames.CCS_HEADER] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
+                    }
+                    catch (e) {
+                        this.logger.verbose("Could not parse home account ID for CCS Header: " +
+                            e);
+                    }
+                    break;
+                case CcsCredentialType.UPN:
+                    headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;
+                    break;
+            }
+        }
+        return headers;
     }
     /**
-     * Generate HomeAccountId from server response
-     * @param serverClientInfo
-     * @param authType
+     * Http post to token endpoint
+     * @param tokenEndpoint
+     * @param queryString
+     * @param headers
+     * @param thumbprint
      */
-    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
-        // since ADFS/DSTS do not have tid and does not set client_info
-        if (!(authType === AuthorityType.Adfs ||
-            authType === AuthorityType.Dsts)) {
-            // for cases where there is clientInfo
-            if (serverClientInfo) {
-                try {
-                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
-                    if (clientInfo.uid && clientInfo.utid) {
-                        return `${clientInfo.uid}.${clientInfo.utid}`;
-                    }
+    async executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, queuedEvent) {
+        if (queuedEvent) {
+            this.performanceClient?.addQueueMeasurement(queuedEvent, correlationId);
+        }
+        const response = await this.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId);
+        if (this.config.serverTelemetryManager &&
+            response.status < 500 &&
+            response.status !== 429) {
+            // Telemetry data successfully logged by server, clear Telemetry cache
+            this.config.serverTelemetryManager.clearTelemetryCache();
+        }
+        return response;
+    }
+    /**
+     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+     * @param thumbprint - Request thumbprint for throttling
+     * @param tokenEndpoint - Endpoint to make the POST to
+     * @param options - Body and Headers to include on the POST request
+     * @param correlationId - CorrelationId for telemetry
+     */
+    async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
+        ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
+        let response;
+        try {
+            response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
+            const responseHeaders = response.headers || {};
+            this.performanceClient?.addFields({
+                refreshTokenSize: response.body.refresh_token?.length || 0,
+                httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+            }, correlationId);
+        }
+        catch (e) {
+            if (e instanceof NetworkError) {
+                const responseHeaders = e.responseHeaders;
+                if (responseHeaders) {
+                    this.performanceClient?.addFields({
+                        httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                        requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
+                            "",
+                        contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                            undefined,
+                        contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                            undefined,
+                        httpStatus: e.httpStatus,
+                    }, correlationId);
                 }
-                catch (e) { }
+                throw e.error;
+            }
+            if (e instanceof AuthError) {
+                throw e;
+            }
+            else {
+                throw createClientAuthError(networkError);
             }
-            logger.warning("No client info in response");
         }
-        // default to "sub" claim
-        return idTokenClaims?.sub || "";
+        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
+        return response;
     }
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Updates the authority object of the client. Endpoint discovery must be completed.
+     * @param updatedAuthority
      */
-    static isAccountEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("localAccountId") &&
-            entity.hasOwnProperty("username") &&
-            entity.hasOwnProperty("authorityType"));
+    async updateAuthority(cloudInstanceHostname, correlationId) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.UpdateTokenEndpointAuthority, correlationId);
+        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${this.authority.tenant}/`;
+        const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
+        this.authority = cloudInstanceAuthority;
     }
     /**
-     * Helper function to determine whether 2 accountInfo objects represent the same account
-     * @param accountA
-     * @param accountB
-     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
+     * Creates query string for the /token request
+     * @param request
      */
-    static accountInfoIsEqual(accountA, accountB, compareClaims) {
-        if (!accountA || !accountB) {
-            return false;
+    createTokenQueryParameters(request) {
+        const parameters = new Map();
+        if (request.embeddedClientId) {
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
         }
-        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
-        if (compareClaims) {
-            const accountAClaims = (accountA.idTokenClaims ||
-                {});
-            const accountBClaims = (accountB.idTokenClaims ||
-                {});
-            // issued at timestamp and nonce are expected to change each time a new id token is acquired
-            claimsMatch =
-                accountAClaims.iat === accountBClaims.iat &&
-                    accountAClaims.nonce === accountBClaims.nonce;
+        if (request.tokenQueryParameters) {
+            addExtraQueryParameters(parameters, request.tokenQueryParameters);
         }
-        return (accountA.homeAccountId === accountB.homeAccountId &&
-            accountA.localAccountId === accountB.localAccountId &&
-            accountA.username === accountB.username &&
-            accountA.tenantId === accountB.tenantId &&
-            accountA.loginHint === accountB.loginHint &&
-            accountA.environment === accountB.environment &&
-            accountA.nativeAccountId === accountB.nativeAccountId &&
-            claimsMatch);
+        addCorrelationId(parameters, request.correlationId);
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5740,7 +5761,7 @@ const consentRequired = "consent_required";
 const loginRequired = "login_required";
 const badToken = "bad_token";
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5812,7 +5833,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5884,7 +5905,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5966,7 +5987,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5993,7 +6014,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6105,14 +6126,14 @@ class ResponseHandler {
             if (handlingRefreshTokenResponse &&
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
-                const key = this.cacheStorage.generateAccountKey(cacheRecord.account.getAccountInfo());
+                const key = this.cacheStorage.generateAccountKey(AccountEntity.getAccountInfo(cacheRecord.account));
                 const account = this.cacheStorage.getAccount(key, request.correlationId);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, request.storeInCache);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), request.storeInCache);
         }
         finally {
             if (this.persistencePlugin &&
@@ -6259,7 +6280,7 @@ class ResponseHandler {
                 serverTokenResponse?.spa_accountid;
         }
         const accountInfo = cacheRecord.account
-            ? updateAccountTenantProfileData(cacheRecord.account.getAccountInfo(), undefined, // tenantProfile optional
+            ? updateAccountTenantProfileData(AccountEntity.getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
             idTokenClaims, cacheRecord.idToken?.secret)
             : null;
         return {
@@ -6324,7 +6345,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6342,7 +6363,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6577,7 +6598,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6786,7 +6807,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6884,7 +6905,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6899,7 +6920,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7123,7 +7144,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7386,7 +7407,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7394,7 +7415,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7419,7 +7440,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-17 */
+/*! @azure/msal-common v15.13.1 2025-11-06 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7854,7 +7875,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.25.1";
+const version = "4.26.1";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14148,9 +14169,9 @@ function getSortedObjectString(obj) {
  */
 const PREFIX = "msal";
 const BROWSER_PREFIX = "browser";
-const CACHE_KEY_SEPARATOR = "-";
-const CREDENTIAL_SCHEMA_VERSION = 1;
-const ACCOUNT_SCHEMA_VERSION = 1;
+const CACHE_KEY_SEPARATOR = "|";
+const CREDENTIAL_SCHEMA_VERSION = 2;
+const ACCOUNT_SCHEMA_VERSION = 2;
 const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
 const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
 const PLATFORM_AUTH_DOM_SUPPORT = `${PREFIX}.${BROWSER_PREFIX}.platform.auth.dom`;
@@ -14378,7 +14399,10 @@ class LocalStorage {
             return null;
         }
         try {
-            return JSON.parse(decryptedData);
+            return {
+                ...JSON.parse(decryptedData),
+                lastUpdatedAt: data.lastUpdatedAt,
+            };
         }
         catch (e) {
             this.performanceClient.incrementFields({ encryptedCacheCorruptionCount: 1 }, correlationId);
@@ -14388,19 +14412,24 @@ class LocalStorage {
     setItem(key, value) {
         window.localStorage.setItem(key, value);
     }
-    async setUserData(key, value, correlationId, timestamp) {
+    async setUserData(key, value, correlationId, timestamp, kmsi) {
         if (!this.initialized || !this.encryptionCookie) {
             throw createBrowserAuthError(uninitializedPublicClientApplication);
         }
-        const { data, nonce } = await invokeAsync(encrypt, PerformanceEvents.Encrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, value, this.getContext(key));
-        const encryptedData = {
-            id: this.encryptionCookie.id,
-            nonce: nonce,
-            data: data,
-            lastUpdatedAt: timestamp,
-        };
+        if (kmsi) {
+            this.setItem(key, value);
+        }
+        else {
+            const { data, nonce } = await invokeAsync(encrypt, PerformanceEvents.Encrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, value, this.getContext(key));
+            const encryptedData = {
+                id: this.encryptionCookie.id,
+                nonce: nonce,
+                data: data,
+                lastUpdatedAt: timestamp,
+            };
+            this.setItem(key, JSON.stringify(encryptedData));
+        }
         this.memoryStorage.setItem(key, value);
-        this.setItem(key, JSON.stringify(encryptedData));
         // Notify other frames to update their in-memory cache
         this.broadcast.postMessage({
             key: key,
@@ -14500,13 +14529,14 @@ class LocalStorage {
         if (!isEncrypted(encObj)) {
             // Data is not encrypted
             this.performanceClient.incrementFields({ unencryptedCacheCount: 1 }, correlationId);
-            return encObj;
+            return rawCache;
         }
         if (encObj.id !== this.encryptionCookie.id) {
             // Data was encrypted with a different key. It must be removed because it is from a previous session.
             this.performanceClient.incrementFields({ encryptedCacheExpiredCount: 1 }, correlationId);
             return null;
         }
+        this.performanceClient.incrementFields({ encryptedCacheCount: 1 }, correlationId);
         return invokeAsync(decrypt, PerformanceEvents.Decrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, encObj.nonce, this.getContext(key), encObj.data);
     }
     /**
@@ -14698,108 +14728,338 @@ class BrowserCacheManager extends CacheManager {
      * Migrates any existing cache data from previous versions of MSAL.js into the current cache structure.
      */
     async migrateExistingCache(correlationId) {
-        const accountKeys0 = getAccountKeys(this.browserStorage, 0);
-        const tokenKeys0 = getTokenKeys(this.clientId, this.browserStorage, 0);
+        let accountKeys = getAccountKeys(this.browserStorage);
+        let tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
         this.performanceClient.addFields({
-            oldAccountCount: accountKeys0.length,
-            oldAccessCount: tokenKeys0.accessToken.length,
-            oldIdCount: tokenKeys0.idToken.length,
-            oldRefreshCount: tokenKeys0.refreshToken.length,
+            preMigrateAcntCount: accountKeys.length,
+            preMigrateATCount: tokenKeys.accessToken.length,
+            preMigrateITCount: tokenKeys.idToken.length,
+            preMigrateRTCount: tokenKeys.refreshToken.length,
         }, correlationId);
-        const accountKeys1 = getAccountKeys(this.browserStorage, 1);
-        const tokenKeys1 = getTokenKeys(this.clientId, this.browserStorage, 1);
+        for (let i = 0; i < ACCOUNT_SCHEMA_VERSION; i++) {
+            const credentialSchema = i; // For now account and credential schemas are the same, but may diverge in future
+            await this.removeStaleAccounts(i, credentialSchema, correlationId);
+        }
+        // Must migrate idTokens first to ensure we have KMSI info for the rest
+        for (let i = 0; i < CREDENTIAL_SCHEMA_VERSION; i++) {
+            const accountSchema = i; // For now account and credential schemas are the same, but may diverge in future
+            await this.migrateIdTokens(i, accountSchema, correlationId);
+        }
+        const kmsiMap = this.getKMSIValues();
+        for (let i = 0; i < CREDENTIAL_SCHEMA_VERSION; i++) {
+            await this.migrateAccessTokens(i, kmsiMap, correlationId);
+            await this.migrateRefreshTokens(i, kmsiMap, correlationId);
+        }
+        accountKeys = getAccountKeys(this.browserStorage);
+        tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
         this.performanceClient.addFields({
-            currAccountCount: accountKeys1.length,
-            currAccessCount: tokenKeys1.accessToken.length,
-            currIdCount: tokenKeys1.idToken.length,
-            currRefreshCount: tokenKeys1.refreshToken.length,
+            postMigrateAcntCount: accountKeys.length,
+            postMigrateATCount: tokenKeys.accessToken.length,
+            postMigrateITCount: tokenKeys.idToken.length,
+            postMigrateRTCount: tokenKeys.refreshToken.length,
         }, correlationId);
-        await Promise.all([
-            this.updateV0ToCurrent(ACCOUNT_SCHEMA_VERSION, accountKeys0, accountKeys1, correlationId),
-            this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.idToken, tokenKeys1.idToken, correlationId),
-            this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.accessToken, tokenKeys1.accessToken, correlationId),
-            this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.refreshToken, tokenKeys1.refreshToken, correlationId),
-        ]);
-        if (accountKeys0.length > 0) {
-            this.browserStorage.setItem(getAccountKeysCacheKey(0), JSON.stringify(accountKeys0));
+    }
+    /**
+     * Parses entry, adds lastUpdatedAt if it doesn't exist, removes entry if expired or invalid
+     * @param key
+     * @param correlationId
+     * @returns
+     */
+    async updateOldEntry(key, correlationId) {
+        const rawValue = this.browserStorage.getItem(key);
+        const parsedValue = this.validateAndParseJson(rawValue || "");
+        if (!parsedValue) {
+            this.browserStorage.removeItem(key);
+            return null;
         }
-        else {
-            this.browserStorage.removeItem(getAccountKeysCacheKey(0));
+        if (!parsedValue.lastUpdatedAt) {
+            // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
+            parsedValue.lastUpdatedAt = Date.now().toString();
+            this.setItem(key, JSON.stringify(parsedValue), correlationId);
         }
-        if (accountKeys1.length > 0) {
-            this.browserStorage.setItem(getAccountKeysCacheKey(1), JSON.stringify(accountKeys1));
+        else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
+            this.browserStorage.removeItem(key);
+            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+            return null;
         }
-        else {
-            this.browserStorage.removeItem(getAccountKeysCacheKey(1));
-        }
-        this.setTokenKeys(tokenKeys0, correlationId, 0);
-        this.setTokenKeys(tokenKeys1, correlationId, 1);
-    }
-    async updateV0ToCurrent(currentSchema, v0Keys, v1Keys, correlationId) {
-        const upgradePromises = [];
-        for (const v0Key of [...v0Keys]) {
-            const rawV0Value = this.browserStorage.getItem(v0Key);
-            const parsedV0Value = this.validateAndParseJson(rawV0Value || "");
-            if (!parsedV0Value) {
-                removeElementFromArray(v0Keys, v0Key);
+        const decryptedData = isEncrypted(parsedValue)
+            ? await this.browserStorage.decryptData(key, parsedValue, correlationId)
+            : parsedValue;
+        if (!decryptedData || !isCredentialEntity(decryptedData)) {
+            this.performanceClient.incrementFields({ invalidCacheCount: 1 }, correlationId);
+            return null;
+        }
+        if ((isAccessTokenEntity(decryptedData) ||
+            isRefreshTokenEntity(decryptedData)) &&
+            decryptedData.expiresOn &&
+            isTokenExpired(decryptedData.expiresOn, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
+            this.browserStorage.removeItem(key);
+            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+            return null;
+        }
+        return decryptedData;
+    }
+    /**
+     * Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
+     * @param accountSchema
+     * @param credentialSchema
+     * @param correlationId
+     * @returns
+     */
+    async removeStaleAccounts(accountSchema, credentialSchema, correlationId) {
+        const accountKeysToCheck = getAccountKeys(this.browserStorage, accountSchema);
+        if (accountKeysToCheck.length === 0) {
+            return;
+        }
+        for (const accountKey of [...accountKeysToCheck]) {
+            this.performanceClient.incrementFields({ oldAcntCount: 1 }, correlationId);
+            const rawValue = this.browserStorage.getItem(accountKey);
+            const parsedValue = this.validateAndParseJson(rawValue || "");
+            if (!parsedValue) {
+                removeElementFromArray(accountKeysToCheck, accountKey);
+                continue;
+            }
+            if (!parsedValue.lastUpdatedAt) {
+                // Add lastUpdatedAt to the existing entry if it doesnt exist so we know when it's safe to remove it
+                parsedValue.lastUpdatedAt = Date.now().toString();
+                this.setItem(accountKey, JSON.stringify(parsedValue), correlationId);
+                continue;
+            }
+            else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
+                // Cache expired remove account and associated tokens
+                await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
+                removeElementFromArray(accountKeysToCheck, accountKey);
+            }
+        }
+        this.setAccountKeys(accountKeysToCheck, correlationId, accountSchema);
+    }
+    /**
+     * Remove the given account and all associated tokens from the cache
+     * @param accountKey
+     * @param rawObject
+     * @param credentialSchema
+     * @param correlationId
+     */
+    async removeAccountOldSchema(accountKey, rawObject, credentialSchema, correlationId) {
+        const decryptedData = isEncrypted(rawObject)
+            ? (await this.browserStorage.decryptData(accountKey, rawObject, correlationId))
+            : rawObject;
+        const homeAccountId = decryptedData?.homeAccountId;
+        if (homeAccountId) {
+            const tokenKeys = this.getTokenKeys(credentialSchema);
+            [...tokenKeys.idToken]
+                .filter((key) => key.includes(homeAccountId))
+                .forEach((key) => {
+                this.browserStorage.removeItem(key);
+                removeElementFromArray(tokenKeys.idToken, key);
+            });
+            [...tokenKeys.accessToken]
+                .filter((key) => key.includes(homeAccountId))
+                .forEach((key) => {
+                this.browserStorage.removeItem(key);
+                removeElementFromArray(tokenKeys.accessToken, key);
+            });
+            [...tokenKeys.refreshToken]
+                .filter((key) => key.includes(homeAccountId))
+                .forEach((key) => {
+                this.browserStorage.removeItem(key);
+                removeElementFromArray(tokenKeys.refreshToken, key);
+            });
+            this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
+        }
+        this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
+        this.browserStorage.removeItem(accountKey);
+    }
+    /**
+     * Gets key value pair mapping homeAccountId to KMSI value
+     * @returns
+     */
+    getKMSIValues() {
+        const kmsiMap = {};
+        const tokenKeys = this.getTokenKeys().idToken;
+        for (const key of tokenKeys) {
+            const rawValue = this.browserStorage.getUserData(key);
+            if (rawValue) {
+                const idToken = JSON.parse(rawValue);
+                const claims = extractTokenClaims(idToken.secret, base64Decode);
+                if (claims) {
+                    kmsiMap[idToken.homeAccountId] = isKmsi(claims);
+                }
+            }
+        }
+        return kmsiMap;
+    }
+    /**
+     * Migrates id tokens from the old schema to the new schema, also migrates associated account object if it doesn't already exist in the new schema
+     * @param credentialSchema
+     * @param accountSchema
+     * @param correlationId
+     * @returns
+     */
+    async migrateIdTokens(credentialSchema, accountSchema, correlationId) {
+        const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+        if (credentialKeysToMigrate.idToken.length === 0) {
+            return;
+        }
+        const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+        const currentAccountKeys = getAccountKeys(this.browserStorage);
+        const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
+        for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
+            this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
+            const oldSchemaData = (await this.updateOldEntry(idTokenKey, correlationId));
+            if (!oldSchemaData) {
+                removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
+                continue;
+            }
+            const currentAccountKey = currentAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
+            const previousAccountKey = previousAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
+            let account = null;
+            if (currentAccountKey) {
+                account = this.getAccount(currentAccountKey, correlationId);
+            }
+            else if (previousAccountKey) {
+                const rawValue = this.browserStorage.getItem(previousAccountKey);
+                const parsedValue = this.validateAndParseJson(rawValue || "");
+                account =
+                    parsedValue && isEncrypted(parsedValue)
+                        ? (await this.browserStorage.decryptData(previousAccountKey, parsedValue, correlationId))
+                        : parsedValue;
+            }
+            if (!account) {
+                // Don't migrate idToken if we don't have an account for it
+                this.performanceClient.incrementFields({ skipITMigrateCount: 1 }, correlationId);
                 continue;
             }
-            if (!parsedV0Value.lastUpdatedAt) {
-                // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
-                parsedV0Value.lastUpdatedAt = Date.now().toString();
-                this.setItem(v0Key, JSON.stringify(parsedV0Value), correlationId);
-            }
-            const decryptedData = isEncrypted(parsedV0Value)
-                ? await this.browserStorage.decryptData(v0Key, parsedV0Value, correlationId)
-                : parsedV0Value;
-            let expirationTime;
-            if (decryptedData) {
-                if (isAccessTokenEntity(decryptedData)) {
-                    expirationTime = decryptedData.expiresOn;
+            const claims = extractTokenClaims(oldSchemaData.secret, base64Decode);
+            const newIdTokenKey = this.generateCredentialKey(oldSchemaData);
+            const currentIdToken = this.getIdTokenCredential(newIdTokenKey, correlationId);
+            const oldTokenHasSignInState = Object.keys(claims).includes("signin_state");
+            const currentTokenHasSignInState = currentIdToken &&
+                Object.keys(extractTokenClaims(currentIdToken.secret, base64Decode) || {}).includes("signin_state");
+            /**
+             * Only migrate if:
+             * 1. Token doesn't yet exist in current schema
+             * 2. Old schema token has been updated more recently than the current one AND migrating it won't result in loss of KMSI state
+             */
+            if (!currentIdToken ||
+                (oldSchemaData.lastUpdatedAt > currentIdToken.lastUpdatedAt &&
+                    (oldTokenHasSignInState || !currentTokenHasSignInState))) {
+                const tenantProfiles = account.tenantProfiles || [];
+                const tenantId = getTenantIdFromIdTokenClaims(claims) || account.realm;
+                if (tenantId &&
+                    !tenantProfiles.find((tenantProfile) => {
+                        return tenantProfile.tenantId === tenantId;
+                    })) {
+                    const newTenantProfile = buildTenantProfile(account.homeAccountId, account.localAccountId, tenantId, claims);
+                    tenantProfiles.push(newTenantProfile);
                 }
-                else if (isRefreshTokenEntity(decryptedData)) {
-                    expirationTime = decryptedData.expiresOn;
+                account.tenantProfiles = tenantProfiles;
+                const newAccountKey = this.generateAccountKey(AccountEntity.getAccountInfo(account));
+                const kmsi = isKmsi(claims);
+                await this.setUserData(newAccountKey, JSON.stringify(account), correlationId, account.lastUpdatedAt, kmsi);
+                if (!currentAccountKeys.includes(newAccountKey)) {
+                    currentAccountKeys.push(newAccountKey);
                 }
+                await this.setUserData(newIdTokenKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                this.performanceClient.incrementFields({ migratedITCount: 1 }, correlationId);
+                currentCredentialKeys.idToken.push(newIdTokenKey);
+            }
+        }
+        this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+        this.setTokenKeys(currentCredentialKeys, correlationId);
+        this.setAccountKeys(currentAccountKeys, correlationId);
+    }
+    /**
+     * Migrates access tokens from old cache schema to current schema
+     * @param credentialSchema
+     * @param kmsiMap
+     * @param correlationId
+     * @returns
+     */
+    async migrateAccessTokens(credentialSchema, kmsiMap, correlationId) {
+        const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+        if (credentialKeysToMigrate.accessToken.length === 0) {
+            return;
+        }
+        const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+        for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
+            this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
+            const oldSchemaData = (await this.updateOldEntry(accessTokenKey, correlationId));
+            if (!oldSchemaData) {
+                removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
+                continue;
             }
-            if (!decryptedData ||
-                isCacheExpired(parsedV0Value.lastUpdatedAt, this.cacheConfig.cacheRetentionDays) ||
-                (expirationTime &&
-                    isTokenExpired(expirationTime, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC))) {
-                this.browserStorage.removeItem(v0Key);
-                removeElementFromArray(v0Keys, v0Key);
-                this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+            if (!Object.keys(kmsiMap).includes(oldSchemaData.homeAccountId)) {
+                // Don't migrate tokens if we don't have an idToken for them
+                this.performanceClient.incrementFields({ skipATMigrateCount: 1 }, correlationId);
                 continue;
             }
-            if (this.cacheConfig.cacheLocation !==
-                BrowserCacheLocation.LocalStorage ||
-                isEncrypted(parsedV0Value)) {
-                const v1Key = `${PREFIX}.${currentSchema}${CACHE_KEY_SEPARATOR}${v0Key}`;
-                const rawV1Entry = this.browserStorage.getItem(v1Key);
-                if (!rawV1Entry) {
-                    upgradePromises.push(this.setUserData(v1Key, JSON.stringify(decryptedData), correlationId, parsedV0Value.lastUpdatedAt).then(() => {
-                        v1Keys.push(v1Key);
-                        this.performanceClient.incrementFields({ upgradedCacheCount: 1 }, correlationId);
-                    }));
-                    continue;
+            const newKey = this.generateCredentialKey(oldSchemaData);
+            const kmsi = kmsiMap[oldSchemaData.homeAccountId];
+            if (!currentCredentialKeys.accessToken.includes(newKey)) {
+                await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
+                currentCredentialKeys.accessToken.push(newKey);
+            }
+            else {
+                const currentToken = this.getAccessTokenCredential(newKey, correlationId);
+                if (!currentToken ||
+                    oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
+                    // If the token already exists, only overwrite it if the old token has a more recent lastUpdatedAt
+                    await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                    this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
                 }
-                else {
-                    const parsedV1Entry = this.validateAndParseJson(rawV1Entry);
-                    // If the entry already exists but is older than the v0 entry, replace it
-                    if (Number(parsedV0Value.lastUpdatedAt) >
-                        Number(parsedV1Entry.lastUpdatedAt)) {
-                        upgradePromises.push(this.setUserData(v1Key, JSON.stringify(decryptedData), correlationId, parsedV0Value.lastUpdatedAt).then(() => {
-                            this.performanceClient.incrementFields({ updatedCacheFromV0Count: 1 }, correlationId);
-                        }));
-                        continue;
-                    }
+            }
+        }
+        this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+        this.setTokenKeys(currentCredentialKeys, correlationId);
+    }
+    /**
+     * Migrates refresh tokens from old cache schema to current schema
+     * @param credentialSchema
+     * @param kmsiMap
+     * @param correlationId
+     * @returns
+     */
+    async migrateRefreshTokens(credentialSchema, kmsiMap, correlationId) {
+        const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+        if (credentialKeysToMigrate.refreshToken.length === 0) {
+            return;
+        }
+        const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+        for (const refreshTokenKey of [
+            ...credentialKeysToMigrate.refreshToken,
+        ]) {
+            this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
+            const oldSchemaData = (await this.updateOldEntry(refreshTokenKey, correlationId));
+            if (!oldSchemaData) {
+                removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
+                continue;
+            }
+            if (!Object.keys(kmsiMap).includes(oldSchemaData.homeAccountId)) {
+                // Don't migrate tokens if we don't have an idToken for them
+                this.performanceClient.incrementFields({ skipRTMigrateCount: 1 }, correlationId);
+                continue;
+            }
+            const newKey = this.generateCredentialKey(oldSchemaData);
+            const kmsi = kmsiMap[oldSchemaData.homeAccountId];
+            if (!currentCredentialKeys.refreshToken.includes(newKey)) {
+                await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
+                currentCredentialKeys.refreshToken.push(newKey);
+            }
+            else {
+                const currentToken = this.getRefreshTokenCredential(newKey, correlationId);
+                if (!currentToken ||
+                    oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
+                    // If the token already exists, only overwrite it if the old token has a more recent lastUpdatedAt
+                    await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                    this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
                 }
             }
-            /*
-             * Note: If we reach here for unencrypted localStorage data, we continue without migrating
-             * as we can't migrate unencrypted localStorage data right now since we can't guarantee KMSI=no
-             */
         }
-        return Promise.all(upgradePromises);
+        this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+        this.setTokenKeys(currentCredentialKeys, correlationId);
     }
     /**
      * Tracks upgrades and downgrades for telemetry and debugging purposes
@@ -14844,20 +15104,31 @@ class BrowserCacheManager extends CacheManager {
      * @param value
      */
     setItem(key, value, correlationId) {
-        let tokenKeysV0Count = 0;
-        let accessTokenKeys = [];
+        const tokenKeysCount = new Array(CREDENTIAL_SCHEMA_VERSION + 1).fill(0); // Array mapping schema version to number of token keys stored for that version
+        const accessTokenKeys = []; // Flat map of all access token keys stored, ordered by schema version
         const maxRetries = 20;
         for (let i = 0; i <= maxRetries; i++) {
+            // Attempt to store item in cache, if cache is full this call will throw and we'll attempt to clear space by removing access tokens from the cache one by one, starting with tokens stored by previous versions of MSAL.js
             try {
                 this.browserStorage.setItem(key, value);
                 if (i > 0) {
-                    // Finally update the token keys array with the tokens removed
-                    if (i <= tokenKeysV0Count) {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId, 0);
-                    }
-                    else {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, tokenKeysV0Count), correlationId, 0);
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(tokenKeysV0Count, i), correlationId);
+                    // If any tokens were removed in order to store this item update the token keys array with the tokens removed
+                    for (let schemaVersion = 0; schemaVersion <= CREDENTIAL_SCHEMA_VERSION; schemaVersion++) {
+                        // Get the sum of all previous token counts to use as start index for this schema version
+                        const startIndex = tokenKeysCount
+                            .slice(0, schemaVersion)
+                            .reduce((sum, count) => sum + count, 0);
+                        if (startIndex >= i) {
+                            // Done removing tokens
+                            break;
+                        }
+                        const endIndex = i > startIndex + tokenKeysCount[schemaVersion]
+                            ? startIndex + tokenKeysCount[schemaVersion]
+                            : i;
+                        if (i > startIndex &&
+                            tokenKeysCount[schemaVersion] > 0) {
+                            this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
+                        }
                     }
                 }
                 break; // If setItem succeeds, exit the loop
@@ -14869,16 +15140,19 @@ class BrowserCacheManager extends CacheManager {
                     i < maxRetries) {
                     if (!accessTokenKeys.length) {
                         // If we are currently trying to set the token keys, use the value we're trying to set
-                        const tokenKeys0 = key ===
-                            getTokenKeysCacheKey(this.clientId, 0)
-                            ? JSON.parse(value).accessToken
-                            : this.getTokenKeys(0).accessToken;
-                        const tokenKeys1 = key ===
-                            getTokenKeysCacheKey(this.clientId)
-                            ? JSON.parse(value).accessToken
-                            : this.getTokenKeys().accessToken;
-                        accessTokenKeys = [...tokenKeys0, ...tokenKeys1];
-                        tokenKeysV0Count = tokenKeys0.length;
+                        for (let i = 0; i <= CREDENTIAL_SCHEMA_VERSION; i++) {
+                            if (key ===
+                                getTokenKeysCacheKey(this.clientId, i)) {
+                                const tokenKeys = JSON.parse(value).accessToken;
+                                accessTokenKeys.push(...tokenKeys);
+                                tokenKeysCount[i] = tokenKeys.length;
+                            }
+                            else {
+                                const tokenKeys = this.getTokenKeys(i).accessToken;
+                                accessTokenKeys.push(...tokenKeys);
+                                tokenKeysCount[i] = tokenKeys.length;
+                            }
+                        }
                     }
                     if (accessTokenKeys.length <= i) {
                         // Nothing to remove, rethrow the error
@@ -14901,21 +15175,32 @@ class BrowserCacheManager extends CacheManager {
      * @param value
      * @param correlationId
      */
-    async setUserData(key, value, correlationId, timestamp) {
-        let tokenKeysV0Count = 0;
-        let accessTokenKeys = [];
+    async setUserData(key, value, correlationId, timestamp, kmsi) {
+        const tokenKeysCount = new Array(CREDENTIAL_SCHEMA_VERSION + 1).fill(0); // Array mapping schema version to number of token keys stored for that version
+        const accessTokenKeys = []; // Flat map of all access token keys stored, ordered by schema version
         const maxRetries = 20;
         for (let i = 0; i <= maxRetries; i++) {
             try {
-                await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, value, correlationId, timestamp);
+                // Attempt to store item in cache, if cache is full this call will throw and we'll attempt to clear space by removing access tokens from the cache one by one, starting with tokens stored by previous versions of MSAL.js
+                await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, value, correlationId, timestamp, kmsi);
                 if (i > 0) {
-                    // Finally update the token keys array with the tokens removed
-                    if (i <= tokenKeysV0Count) {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId, 0);
-                    }
-                    else {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, tokenKeysV0Count), correlationId, 0);
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(tokenKeysV0Count, i), correlationId);
+                    // If any tokens were removed in order to store this item update the token keys array with the tokens removed
+                    for (let schemaVersion = 0; schemaVersion <= CREDENTIAL_SCHEMA_VERSION; schemaVersion++) {
+                        // Get the sum of all previous token counts to use as start index for this schema version
+                        const startIndex = tokenKeysCount
+                            .slice(0, schemaVersion)
+                            .reduce((sum, count) => sum + count, 0);
+                        if (startIndex >= i) {
+                            // Done removing tokens
+                            break;
+                        }
+                        const endIndex = i > startIndex + tokenKeysCount[schemaVersion]
+                            ? startIndex + tokenKeysCount[schemaVersion]
+                            : i;
+                        if (i > startIndex &&
+                            tokenKeysCount[schemaVersion] > 0) {
+                            this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
+                        }
                     }
                 }
                 break; // If setItem succeeds, exit the loop
@@ -14926,10 +15211,12 @@ class BrowserCacheManager extends CacheManager {
                     cacheQuotaExceeded &&
                     i < maxRetries) {
                     if (!accessTokenKeys.length) {
-                        const tokenKeys0 = this.getTokenKeys(0).accessToken;
-                        const tokenKeys1 = this.getTokenKeys().accessToken;
-                        accessTokenKeys = [...tokenKeys0, ...tokenKeys1];
-                        tokenKeysV0Count = tokenKeys0.length;
+                        // If we are currently trying to set the token keys, use the value we're trying to set
+                        for (let i = 0; i <= CREDENTIAL_SCHEMA_VERSION; i++) {
+                            const tokenKeys = this.getTokenKeys(i).accessToken;
+                            accessTokenKeys.push(...tokenKeys);
+                            tokenKeysCount[i] = tokenKeys.length;
+                        }
                     }
                     if (accessTokenKeys.length <= i) {
                         // Nothing left to remove, rethrow the error
@@ -14969,20 +15256,21 @@ class BrowserCacheManager extends CacheManager {
      * set account entity in the platform cache
      * @param account
      */
-    async setAccount(account, correlationId) {
+    async setAccount(account, correlationId, kmsi) {
         this.logger.trace("BrowserCacheManager.setAccount called");
-        const key = this.generateAccountKey(account.getAccountInfo());
+        const key = this.generateAccountKey(AccountEntity.getAccountInfo(account));
         const timestamp = Date.now().toString();
         account.lastUpdatedAt = timestamp;
-        await this.setUserData(key, JSON.stringify(account), correlationId, timestamp);
+        await this.setUserData(key, JSON.stringify(account), correlationId, timestamp, kmsi);
         const wasAdded = this.addAccountKeyToMap(key, correlationId);
+        this.performanceClient.addFields({ kmsi: kmsi }, correlationId);
         /**
          * @deprecated - Remove this in next major version in favor of more consistent LOGIN event
          */
         if (this.cacheConfig.cacheLocation ===
             BrowserCacheLocation.LocalStorage &&
             wasAdded) {
-            this.eventHandler.emitEvent(EventType.ACCOUNT_ADDED, undefined, account.getAccountInfo());
+            this.eventHandler.emitEvent(EventType.ACCOUNT_ADDED, undefined, AccountEntity.getAccountInfo(account));
         }
     }
     /**
@@ -14992,6 +15280,14 @@ class BrowserCacheManager extends CacheManager {
     getAccountKeys() {
         return getAccountKeys(this.browserStorage);
     }
+    setAccountKeys(accountKeys, correlationId, schemaVersion = ACCOUNT_SCHEMA_VERSION) {
+        if (accountKeys.length === 0) {
+            this.removeItem(getAccountKeysCacheKey(schemaVersion));
+        }
+        else {
+            this.setItem(getAccountKeysCacheKey(schemaVersion), JSON.stringify(accountKeys), correlationId);
+        }
+    }
     /**
      * Add a new account to the key map
      * @param key
@@ -15023,14 +15319,7 @@ class BrowserCacheManager extends CacheManager {
         const removalIndex = accountKeys.indexOf(key);
         if (removalIndex > -1) {
             accountKeys.splice(removalIndex, 1);
-            if (accountKeys.length === 0) {
-                // If no keys left, remove the map
-                this.removeItem(getAccountKeysCacheKey());
-                return;
-            }
-            else {
-                this.setItem(getAccountKeysCacheKey(), JSON.stringify(accountKeys), correlationId);
-            }
+            this.setAccountKeys(accountKeys, correlationId);
             this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
         }
         else {
@@ -15170,12 +15459,12 @@ class BrowserCacheManager extends CacheManager {
      * set IdToken credential to the platform cache
      * @param idToken
      */
-    async setIdTokenCredential(idToken, correlationId) {
+    async setIdTokenCredential(idToken, correlationId, kmsi) {
         this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
         const idTokenKey = this.generateCredentialKey(idToken);
         const timestamp = Date.now().toString();
         idToken.lastUpdatedAt = timestamp;
-        await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp);
+        await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp, kmsi);
         const tokenKeys = this.getTokenKeys();
         if (tokenKeys.idToken.indexOf(idTokenKey) === -1) {
             this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
@@ -15207,12 +15496,12 @@ class BrowserCacheManager extends CacheManager {
      * set accessToken credential to the platform cache
      * @param accessToken
      */
-    async setAccessTokenCredential(accessToken, correlationId) {
+    async setAccessTokenCredential(accessToken, correlationId, kmsi) {
         this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
         const accessTokenKey = this.generateCredentialKey(accessToken);
         const timestamp = Date.now().toString();
         accessToken.lastUpdatedAt = timestamp;
-        await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp);
+        await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp, kmsi);
         const tokenKeys = this.getTokenKeys();
         const index = tokenKeys.accessToken.indexOf(accessTokenKey);
         if (index !== -1) {
@@ -15246,12 +15535,12 @@ class BrowserCacheManager extends CacheManager {
      * set refreshToken credential to the platform cache
      * @param refreshToken
      */
-    async setRefreshTokenCredential(refreshToken, correlationId) {
+    async setRefreshTokenCredential(refreshToken, correlationId, kmsi) {
         this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
         const refreshTokenKey = this.generateCredentialKey(refreshToken);
         const timestamp = Date.now().toString();
         refreshToken.lastUpdatedAt = timestamp;
-        await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp);
+        await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp, kmsi);
         const tokenKeys = this.getTokenKeys();
         if (tokenKeys.refreshToken.indexOf(refreshTokenKey) === -1) {
             this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
@@ -15751,7 +16040,7 @@ class BrowserCacheManager extends CacheManager {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
         };
-        return this.saveCacheRecord(cacheRecord, result.correlationId);
+        return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode)));
     }
     /**
      * saves a cache record
@@ -15759,9 +16048,9 @@ class BrowserCacheManager extends CacheManager {
      * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
+    async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
         try {
-            await super.saveCacheRecord(cacheRecord, correlationId, storeInCache);
+            await super.saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache);
         }
         catch (e) {
             if (e instanceof CacheError &&
@@ -16595,7 +16884,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
-        await this.cacheAccount(baseAccount, this.correlationId);
+        await this.cacheAccount(baseAccount, this.correlationId, isKmsi(idTokenClaims));
         await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
         return result;
     }
@@ -16682,7 +16971,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const tid = accountProperties["TenantId"] ||
             idTokenClaims.tid ||
             Constants.EMPTY_STRING;
-        const accountInfo = updateAccountTenantProfileData(accountEntity.getAccountInfo(), undefined, // tenantProfile optional
+        const accountInfo = updateAccountTenantProfileData(AccountEntity.getAccountInfo(accountEntity), undefined, // tenantProfile optional
         idTokenClaims, response.id_token);
         /**
          * In pairwise broker flows, this check prevents the broker's native account id
@@ -16719,11 +17008,11 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * cache the account entity in browser storage
      * @param accountEntity
      */
-    async cacheAccount(accountEntity, correlationId) {
+    async cacheAccount(accountEntity, correlationId, kmsi) {
         // Store the account info and hence `nativeAccountId` in browser cache
-        await this.browserStorage.setAccount(accountEntity, this.correlationId);
+        await this.browserStorage.setAccount(accountEntity, this.correlationId, kmsi);
         // Remove any existing cached tokens for this account in browser storage
-        this.browserStorage.removeAccountContext(accountEntity.getAccountInfo(), correlationId);
+        this.browserStorage.removeAccountContext(AccountEntity.getAccountInfo(accountEntity), correlationId);
     }
     /**
      * Stores the access_token and id_token in inmemory storage
@@ -16750,7 +17039,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
-        return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, request.storeInCache);
+        return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), request.storeInCache);
     }
     getExpiresInValue(tokenType, expiresIn) {
         return tokenType === AuthenticationScheme.POP
@@ -19052,6 +19341,7 @@ function createHiddenIframe() {
     authFrame.style.width = authFrame.style.height = "0";
     authFrame.style.border = "0";
     authFrame.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
+    authFrame.setAttribute("allow", "local-network-access *");
     document.body.appendChild(authFrame);
     return authFrame;
 }
@@ -19304,6 +19594,7 @@ class TokenCache {
         const idTokenClaims = response.id_token
             ? extractTokenClaims(response.id_token, base64Decode)
             : undefined;
+        const kmsi = isKmsi(idTokenClaims || {});
         const authorityOptions = {
             protocolMode: this.config.auth.protocolMode,
             knownAuthorities: this.config.auth.knownAuthorities,
@@ -19315,9 +19606,9 @@ class TokenCache {
             ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
             : undefined;
         const cacheRecordAccount = await this.loadAccount(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
-        const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId);
-        const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId);
-        const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId);
+        const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId, kmsi);
+        const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId, kmsi);
+        const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId, kmsi);
         return this.generateAuthenticationResult(request, {
             account: cacheRecordAccount,
             idToken,
@@ -19338,7 +19629,7 @@ class TokenCache {
         this.logger.verbose("TokenCache - loading account");
         if (request.account) {
             const accountEntity = AccountEntity.createFromAccountInfo(request.account);
-            await this.storage.setAccount(accountEntity, correlationId);
+            await this.storage.setAccount(accountEntity, correlationId, isKmsi(idTokenClaims || {}));
             return accountEntity;
         }
         else if (!authority || (!clientInfo && !idTokenClaims)) {
@@ -19350,7 +19641,7 @@ class TokenCache {
         const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
         undefined, // nativeAccountId
         this.logger);
-        await this.storage.setAccount(cachedAccount, correlationId);
+        await this.storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}));
         return cachedAccount;
     }
     /**
@@ -19361,14 +19652,14 @@ class TokenCache {
      * @param tenantId
      * @returns `IdTokenEntity`
      */
-    async loadIdToken(response, homeAccountId, environment, tenantId, correlationId) {
+    async loadIdToken(response, homeAccountId, environment, tenantId, correlationId, kmsi) {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
             return null;
         }
         this.logger.verbose("TokenCache - loading id token");
         const idTokenEntity = createIdTokenEntity(homeAccountId, environment, response.id_token, this.config.auth.clientId, tenantId);
-        await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
+        await this.storage.setIdTokenCredential(idTokenEntity, correlationId, kmsi);
         return idTokenEntity;
     }
     /**
@@ -19380,7 +19671,7 @@ class TokenCache {
      * @param tenantId
      * @returns `AccessTokenEntity`
      */
-    async loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId) {
+    async loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId, kmsi) {
         if (!response.access_token) {
             this.logger.verbose("TokenCache - no access token found in response");
             return null;
@@ -19403,7 +19694,7 @@ class TokenCache {
             (response.ext_expires_in || response.expires_in) +
                 nowSeconds();
         const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
-        await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
+        await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId, kmsi);
         return accessTokenEntity;
     }
     /**
@@ -19414,7 +19705,7 @@ class TokenCache {
      * @param environment
      * @returns `RefreshTokenEntity`
      */
-    async loadRefreshToken(response, homeAccountId, environment, correlationId) {
+    async loadRefreshToken(response, homeAccountId, environment, correlationId, kmsi) {
         if (!response.refresh_token) {
             this.logger.verbose("TokenCache - no refresh token found in response");
             return null;
@@ -19422,7 +19713,7 @@ class TokenCache {
         this.logger.verbose("TokenCache - loading refresh token");
         const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
         response.refresh_token_expires_in);
-        await this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId);
+        await this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId, kmsi);
         return refreshTokenEntity;
     }
     /**
@@ -19451,7 +19742,7 @@ class TokenCache {
             uniqueId: cacheRecord.account.localAccountId,
             tenantId: cacheRecord.account.realm,
             scopes: responseScopes,
-            account: accountEntity.getAccountInfo(),
+            account: AccountEntity.getAccountInfo(accountEntity),
             idToken: cacheRecord.idToken?.secret || "",
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken,
@@ -20469,7 +20760,7 @@ class StandardController {
         this.logger.verbose("hydrateCache called");
         // Account gets saved to browser storage regardless of native or not
         const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-        await this.browserStorage.setAccount(accountEntity, result.correlationId);
+        await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims));
         if (result.fromNativeBroker) {
             this.logger.verbose("Response was from native broker, storing in-memory");
             // Tokens from native broker are stored in-memory