npm - @azure/msal-browser - Versions diffs - 4.26.2 → 4.28.0 - Mend

@azure/msal-browser 4.26.2 → 4.28.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (400) hide show

package/lib/msal-browser.js CHANGED Viewed

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v4.26.2 2025-11-19 */
+/*! @azure/msal-browser v4.28.0 2026-01-13 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -283,7 +283,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -300,7 +300,7 @@
         unexpectedError: unexpectedError
     });
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -349,7 +349,7 @@
             : AuthErrorMessages[code]);
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -449,7 +449,7 @@
         userTimeoutReached: userTimeoutReached
     });
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -706,7 +706,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -745,7 +745,7 @@
         },
     };
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -936,12 +936,12 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "15.13.2";
+    const version$1 = "15.14.0";
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -961,7 +961,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -988,7 +988,8 @@
     const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
     const authorityMismatch = "authority_mismatch";
     const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
-    const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
+    const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
+    const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
     var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -1004,6 +1005,7 @@
         invalidClaims: invalidClaims,
         invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
         invalidCodeChallengeMethod: invalidCodeChallengeMethod,
+        invalidPlatformBrokerConfiguration: invalidPlatformBrokerConfiguration,
         invalidRequestMethodForEAR: invalidRequestMethodForEAR,
         logoutRequestEmpty: logoutRequestEmpty,
         missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,
@@ -1017,7 +1019,7 @@
         urlParseError: urlParseError
     });
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1047,6 +1049,7 @@
         [authorityMismatch]: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
         [invalidAuthorizePostBodyParameters]: "Invalid authorize post body parameters provided. If you are using authorizePostBodyParameters, the request method must be POST. Please check the request method and parameters.",
         [invalidRequestMethodForEAR]: "Invalid request method for EAR protocol mode. The request method cannot be GET when using EAR protocol mode. Please change the request method to POST.",
+        [invalidPlatformBrokerConfiguration]: "Invalid platform broker configuration. `allowPlatformBrokerWithDOM` can only be enabled when `allowPlatformBroker` is enabled.",
     };
     /**
      * ClientConfigurationErrorMessage class containing string constants used by error codes and messages.
@@ -1145,6 +1148,10 @@
             code: invalidRequestMethodForEAR,
             desc: ClientConfigurationErrorMessages[invalidRequestMethodForEAR],
         },
+        invalidPlatformBrokerConfiguration: {
+            code: invalidPlatformBrokerConfiguration,
+            desc: ClientConfigurationErrorMessages[invalidPlatformBrokerConfiguration],
+        },
     };
     /**
      * Error thrown when there is an error in configuration of the MSAL.js library.
@@ -1160,7 +1167,7 @@
         return new ClientConfigurationError(errorCode);
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1257,7 +1264,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1452,7 +1459,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1492,7 +1499,7 @@
         };
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1574,7 +1581,7 @@
         return updatedAccountInfo;
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1589,7 +1596,7 @@
         Ciam: 3,
     };
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1611,7 +1618,7 @@
         return null;
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1635,7 +1642,7 @@
         EAR: "EAR",
     };
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1856,7 +1863,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1937,7 +1944,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2053,7 +2060,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2217,7 +2224,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2356,7 +2363,7 @@
         return null;
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2364,7 +2371,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2409,7 +2416,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2579,15 +2586,16 @@
          * @param cacheRecord {CacheRecord}
          * @param correlationId {?string} correlation id
          * @param kmsi - Keep Me Signed In
+         * @param apiId - API identifier for telemetry tracking
          * @param storeInCache {?StoreInCache}
          */
-        async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
+        async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
             if (!cacheRecord) {
                 throw createClientAuthError(invalidCacheRecord);
             }
             try {
                 if (!!cacheRecord.account) {
-                    await this.setAccount(cacheRecord.account, correlationId, kmsi);
+                    await this.setAccount(cacheRecord.account, correlationId, kmsi, apiId);
                 }
                 if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
                     await this.setIdTokenCredential(cacheRecord.idToken, correlationId, kmsi);
@@ -3519,7 +3527,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3776,6 +3784,11 @@
         Decrypt: "decrypt",
         GenerateEarKey: "generateEarKey",
         DecryptEarResponse: "decryptEarResponse",
+        LoadExternalTokens: "LoadExternalTokens",
+        LoadAccount: "loadAccount",
+        LoadIdToken: "loadIdToken",
+        LoadAccessToken: "loadAccessToken",
+        LoadRefreshToken: "loadRefreshToken",
     };
     const PerformanceEventAbbreviations = new Map([
         [PerformanceEvents.AcquireTokenByCode, "ATByCode"],
@@ -4041,7 +4054,7 @@
         "upgradedCacheCount",
     ]);
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4120,7 +4133,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4220,7 +4233,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4230,7 +4243,7 @@
         UPN: "UPN",
     };
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4280,7 +4293,7 @@
     const EAR_JWK = "ear_jwk";
     const EAR_JWE_CRYPTO = "ear_jwe_crypto";
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4660,7 +4673,7 @@
         });
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4672,7 +4685,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4682,7 +4695,7 @@
             response.hasOwnProperty("metadata"));
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4692,7 +4705,7 @@
             response.hasOwnProperty("error_description"));
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4788,7 +4801,7 @@
         };
     };
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4894,7 +4907,7 @@
         },
     };
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4959,7 +4972,7 @@
         return cachedAtSec > nowSeconds();
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5221,7 +5234,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6060,7 +6073,7 @@
         };
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6091,7 +6104,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6110,7 +6123,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6131,7 +6144,7 @@
         };
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6218,7 +6231,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6249,7 +6262,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6397,7 +6410,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6425,7 +6438,7 @@
         uxNotAllowed: uxNotAllowed
     });
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6515,7 +6528,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6587,7 +6600,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6669,7 +6682,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6696,7 +6709,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6760,7 +6773,7 @@
          * @param serverTokenResponse
          * @param authority
          */
-        async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
+        async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.HandleServerTokenResponse, serverTokenResponse.correlation_id);
             // create an idToken object (not entity)
             let idTokenClaims;
@@ -6815,7 +6828,7 @@
                         return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                     }
                 }
-                await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), request.storeInCache);
+                await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), apiId, request.storeInCache);
             }
             finally {
                 if (this.persistencePlugin &&
@@ -6885,6 +6898,9 @@
                         ? parseInt(serverTokenResponse.refresh_token_expires_in, 10)
                         : serverTokenResponse.refresh_token_expires_in;
                     rtExpiresOn = reqTimestamp + rtExpiresIn;
+                    this.performanceClient?.addFields({
+                        ntwkRtExpiresOnSeconds: rtExpiresOn,
+                    }, request.correlationId);
                 }
                 cachedRefreshToken = createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token, this.clientId, serverTokenResponse.foci, userAssertionHash, rtExpiresOn);
             }
@@ -7027,7 +7043,7 @@
         return baseAccount;
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7045,7 +7061,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7067,8 +7083,9 @@
          * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
          * authorization_code_grant
          * @param request
+         * @param apiId - API identifier for telemetry tracking
          */
-        async acquireToken(request, authCodePayload) {
+        async acquireToken(request, apiId, authCodePayload) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientAcquireToken, request.correlationId);
             if (!request.code) {
                 throw createClientAuthError(requestCannotBeMade);
@@ -7080,7 +7097,7 @@
             const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin, this.performanceClient);
             // Validate response. This function throws a server error if an error is returned by the server.
             responseHandler.validateTokenResponse(response.body);
-            return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId);
+            return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, authCodePayload, undefined, undefined, undefined, requestId);
         }
         /**
          * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
@@ -7280,7 +7297,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7295,7 +7312,7 @@
         constructor(configuration, performanceClient) {
             super(configuration, performanceClient);
         }
-        async acquireToken(request) {
+        async acquireToken(request, apiId) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
             const reqTimestamp = nowSeconds();
             const response = await invokeAsync(this.executeTokenRequest.bind(this), PerformanceEvents.RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
@@ -7303,13 +7320,13 @@
             const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
             const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
             responseHandler.validateTokenResponse(response.body);
-            return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId);
+            return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, undefined, undefined, true, request.forceCache, requestId);
         }
         /**
          * Gets cached refresh token and attaches to request, then calls acquireToken API
          * @param request
          */
-        async acquireTokenByRefreshToken(request) {
+        async acquireTokenByRefreshToken(request, apiId) {
             // Cannot renew token if no request object is given.
             if (!request) {
                 throw createClientConfigurationError(tokenRequestEmpty);
@@ -7324,7 +7341,7 @@
             // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
             if (isFOCI) {
                 try {
-                    return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true);
+                    return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true, apiId);
                 }
                 catch (e) {
                     const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
@@ -7335,7 +7352,7 @@
                         e.subError === Errors.CLIENT_MISMATCH_ERROR;
                     // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
                     if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
-                        return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
+                        return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
                         // throw in all other cases
                     }
                     else {
@@ -7344,26 +7361,30 @@
                 }
             }
             // fall back to application refresh token acquisition
-            return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
+            return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
         }
         /**
          * makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
          * @param request
          */
-        async acquireTokenWithCachedRefreshToken(request, foci) {
+        async acquireTokenWithCachedRefreshToken(request, foci, apiId) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
             // fetches family RT or application RT based on FOCI value
             const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined, this.performanceClient);
             if (!refreshToken) {
                 throw createInteractionRequiredAuthError(noTokensFound);
             }
-            if (refreshToken.expiresOn &&
-                isTokenExpired(refreshToken.expiresOn, request.refreshTokenExpirationOffsetSeconds ||
-                    DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS)) {
-                this.performanceClient?.addFields({ rtExpiresOnMs: Number(refreshToken.expiresOn) }, request.correlationId);
-                throw createInteractionRequiredAuthError(refreshTokenExpired);
+            if (refreshToken.expiresOn) {
+                const offset = request.refreshTokenExpirationOffsetSeconds ||
+                    DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS;
+                this.performanceClient?.addFields({
+                    cacheRtExpiresOnSeconds: Number(refreshToken.expiresOn),
+                    rtOffsetSeconds: offset,
+                }, request.correlationId);
+                if (isTokenExpired(refreshToken.expiresOn, offset)) {
+                    throw createInteractionRequiredAuthError(refreshTokenExpired);
+                }
             }
-            // attach cached RT size to the current measurement
             const refreshTokenRequest = {
                 ...request,
                 refreshToken: refreshToken.secret,
@@ -7374,11 +7395,10 @@
                 },
             };
             try {
-                return await invokeAsync(this.acquireToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest);
+                return await invokeAsync(this.acquireToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest, apiId);
             }
             catch (e) {
                 if (e instanceof InteractionRequiredAuthError) {
-                    this.performanceClient?.addFields({ rtExpiresOnMs: Number(refreshToken.expiresOn) }, request.correlationId);
                     if (e.subError === badToken) {
                         // Remove bad refresh token from cache
                         this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
@@ -7489,7 +7509,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7587,7 +7607,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7602,7 +7622,7 @@
         },
     };
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7826,7 +7846,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7884,7 +7904,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8147,7 +8167,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8155,7 +8175,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8180,7 +8200,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8220,7 +8240,7 @@
         }
     }
-    /*! @azure/msal-common v15.13.2 2025-11-19 */
+    /*! @azure/msal-common v15.14.0 2026-01-13 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9308,9 +9328,9 @@
     };
     /**
      * API Codes for Telemetry purposes.
-     * Before adding a new code you must claim it in the MSAL Telemetry tracker as these number spaces are shared across all MSALs
      * 0-99 Silent Flow
      * 800-899 Auth Code Flow
+     * 900-999 Miscellaneous
      */
     const ApiId = {
         acquireTokenRedirect: 861,
@@ -9322,6 +9342,30 @@
         acquireTokenSilent_silentFlow: 61,
         logout: 961,
         logoutPopup: 962,
+        hydrateCache: 963,
+        loadExternalTokens: 964,
+    };
+    /**
+     * API Names for Telemetry purposes.
+     */
+    const ApiName = {
+        861: "acquireTokenRedirect",
+        862: "acquireTokenPopup",
+        863: "ssoSilent",
+        864: "acquireTokenSilent_authCode",
+        865: "handleRedirectPromise",
+        866: "acquireTokenByCode",
+        61: "acquireTokenSilent_silentFlow",
+        961: "logout",
+        962: "logoutPopup",
+        963: "hydrateCache",
+        964: "loadExternalTokens",
+    };
+    const apiIdToName = (id) => {
+        if (typeof id === "number" && id in ApiName) {
+            return ApiName[id];
+        }
+        return "unknown";
     };
     /*
      * Interaction type of the API - used for state and telemetry
@@ -10290,6 +10334,7 @@
             asyncPopups: false,
             allowRedirectInIframe: false,
             allowPlatformBroker: false,
+            allowPlatformBrokerWithDOM: false,
             nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
                 DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
             pollIntervalMilliseconds: BrowserConstants.DEFAULT_POLL_INTERVAL_MS,
@@ -10336,7 +10381,7 @@
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "4.26.2";
+    const version = "4.28.0";
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10350,7 +10395,6 @@
     const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
     const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
     const BROWSER_PERF_ENABLED_KEY = `${PREFIX}.${BROWSER_PREFIX}.performance.enabled`;
-    const PLATFORM_AUTH_DOM_SUPPORT = `${PREFIX}.${BROWSER_PREFIX}.platform.auth.dom`;
     const VERSION_CACHE_KEY = `${PREFIX}.version`;
     const ACCOUNT_KEYS = "account.keys";
     const TOKEN_KEYS = "token.keys";
@@ -12357,17 +12401,21 @@
             if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
                 return null;
             }
+            this.performanceClient.addFields({
+                accountCachedBy: apiIdToName(parsedAccount.cachedByApiId),
+            }, correlationId);
             return CacheManager.toObject(new AccountEntity(), parsedAccount);
         }
         /**
          * set account entity in the platform cache
          * @param account
          */
-        async setAccount(account, correlationId, kmsi) {
+        async setAccount(account, correlationId, kmsi, apiId) {
             this.logger.trace("BrowserCacheManager.setAccount called");
             const key = this.generateAccountKey(AccountEntity.getAccountInfo(account));
             const timestamp = Date.now().toString();
             account.lastUpdatedAt = timestamp;
+            account.cachedByApiId = apiId;
             await this.setUserData(key, JSON.stringify(account), correlationId, timestamp, kmsi);
             const wasAdded = this.addAccountKeyToMap(key, correlationId);
             this.performanceClient.addFields({ kmsi: kmsi }, correlationId);
@@ -13147,7 +13195,7 @@
                 idToken: idTokenEntity,
                 accessToken: accessTokenEntity,
             };
-            return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode)));
+            return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode)), ApiId.hydrateCache);
         }
         /**
          * saves a cache record
@@ -13155,9 +13203,9 @@
          * @param storeInCache {?StoreInCache}
          * @param correlationId {?string} correlation id
          */
-        async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
+        async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
             try {
-                await super.saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache);
+                await super.saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache);
             }
             catch (e) {
                 if (e instanceof CacheError &&
@@ -13916,7 +13964,7 @@
          * Function to handle response parameters from hash.
          * @param locationHash
          */
-        async handleCodeResponse(response, request) {
+        async handleCodeResponse(response, request, apiId) {
             this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
             let authCodeResponse;
             try {
@@ -13932,7 +13980,7 @@
                     throw e;
                 }
             }
-            return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request);
+            return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request, apiId);
         }
         /**
          * Process auth code response from AAD
@@ -13942,7 +13990,7 @@
          * @param networkModule
          * @returns
          */
-        async handleCodeResponseFromServer(authCodeResponse, request, validateNonce = true) {
+        async handleCodeResponseFromServer(authCodeResponse, request, apiId, validateNonce = true) {
             this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromServer, request.correlationId);
             this.logger.trace("InteractionHandler.handleCodeResponseFromServer called");
             // Assign code to request
@@ -13968,7 +14016,7 @@
                 }
             }
             // Acquire token with retrieved code.
-            const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, authCodeResponse));
+            const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, apiId, authCodeResponse));
             return tokenResponse;
         }
         /**
@@ -14516,7 +14564,7 @@
          */
         async cacheAccount(accountEntity, correlationId, kmsi) {
             // Store the account info and hence `nativeAccountId` in browser cache
-            await this.browserStorage.setAccount(accountEntity, this.correlationId, kmsi);
+            await this.browserStorage.setAccount(accountEntity, this.correlationId, kmsi, this.apiId);
             // Remove any existing cached tokens for this account in browser storage
             this.browserStorage.removeAccountContext(AccountEntity.getAccountInfo(accountEntity), correlationId);
         }
@@ -14545,7 +14593,7 @@
                 idToken: cachedIdToken,
                 accessToken: cachedAccessToken,
             };
-            return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), request.storeInCache);
+            return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), this.apiId, request.storeInCache);
         }
         getExpiresInValue(tokenType, expiresIn) {
             return tokenType === AuthenticationScheme.POP
@@ -14920,7 +14968,7 @@
         // Create popup interaction handler.
         const interactionHandler = new InteractionHandler(authClient, browserStorage, authCodeRequest, logger, performanceClient);
         // Handle response from hash string.
-        const result = await invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, logger, performanceClient, request.correlationId)(response, request);
+        const result = await invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, logger, performanceClient, request.correlationId)(response, request, apiId);
         return result;
     }
     /**
@@ -14967,7 +15015,7 @@
             cloud_instance_name: decryptedData.cloud_instance_name,
             msgraph_host: decryptedData.msgraph_host,
         };
-        return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, additionalData, undefined, undefined, undefined, undefined));
+        return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, apiId, additionalData, undefined, undefined, undefined, undefined));
     }
     /*
@@ -15433,7 +15481,7 @@
      * @param perfClient
      * @returns
      */
-    async function isPlatformBrokerAvailable(loggerOptions, perfClient, correlationId) {
+    async function isPlatformBrokerAvailable(loggerOptions, perfClient, correlationId, domConfig) {
         const logger = new Logger(loggerOptions || {}, name, version);
         logger.trace("isPlatformBrokerAvailable called");
         const performanceClient = perfClient || new StubPerformanceClient();
@@ -15441,11 +15489,10 @@
             logger.trace("Non-browser environment detected, returning false");
             return false;
         }
-        return !!(await getPlatformAuthProvider(logger, performanceClient, correlationId || createNewGuid()));
+        return !!(await getPlatformAuthProvider(logger, performanceClient, correlationId || createNewGuid(), undefined, domConfig));
     }
-    async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout) {
+    async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout, enablePlatformBrokerDOMSupport) {
         logger.trace("getPlatformAuthProvider called", correlationId);
-        const enablePlatformBrokerDOMSupport = isDomEnabledForPlatformAuth();
         logger.trace("Has client allowed platform auth via DOM API: " +
             enablePlatformBrokerDOMSupport);
         let platformAuthProvider;
@@ -15470,22 +15517,6 @@
         }
         return platformAuthProvider;
     }
-    /**
-     * Returns true if the DOM API support for platform auth is enabled in session storage
-     * @returns boolean
-     * @deprecated
-     */
-    function isDomEnabledForPlatformAuth() {
-        let sessionStorage;
-        try {
-            sessionStorage = window[BrowserCacheLocation.SessionStorage];
-            // Mute errors if it's a non-browser environment or cookies are blocked.
-            return sessionStorage?.getItem(PLATFORM_AUTH_DOM_SUPPORT) === "true";
-        }
-        catch (e) {
-            return false;
-        }
-    }
     /**
      * Returns boolean indicating whether or not the request should attempt to use native broker
      * @param logger
@@ -15495,6 +15526,11 @@
      */
     function isPlatformAuthAllowed(config, logger, platformAuthProvider, authenticationScheme) {
         logger.trace("isPlatformAuthAllowed called");
+        // throw an error if allowPlatformBroker is not enabled and allowPlatformBrokerWithDOM is enabled
+        if (!config.system.allowPlatformBroker &&
+            config.system.allowPlatformBrokerWithDOM) {
+            throw createClientConfigurationError(invalidPlatformBrokerConfiguration);
+        }
         if (!config.system.allowPlatformBroker) {
             logger.trace("isPlatformAuthAllowed: allowPlatformBroker is not enabled, returning false");
             // Developer disabled WAM
@@ -16793,7 +16829,7 @@
                 account: silentRequest.account,
             });
             // Send request to renew token. Auth module will throw errors if token cannot be renewed.
-            return invokeAsync(refreshTokenClient.acquireTokenByRefreshToken.bind(refreshTokenClient), PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken, this.logger, this.performanceClient, request.correlationId)(silentRequest).catch((e) => {
+            return invokeAsync(refreshTokenClient.acquireTokenByRefreshToken.bind(refreshTokenClient), PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken, this.logger, this.performanceClient, request.correlationId)(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch((e) => {
                 e.setCorrelationId(this.correlationId);
                 serverTelemetryManager.cacheFailedRequest(e);
                 throw e;
@@ -16837,12 +16873,13 @@
      * Token cache manager
      */
     class TokenCache {
-        constructor(configuration, storage, logger, cryptoObj) {
+        constructor(configuration, storage, logger, cryptoObj, performanceClient) {
             this.isBrowserEnvironment = typeof window !== "undefined";
             this.config = configuration;
             this.storage = storage;
             this.logger = logger;
             this.cryptoObj = cryptoObj;
+            this.performanceClient = performanceClient;
         }
         // Move getAllAccounts here and cache utility APIs
         /**
@@ -16857,30 +16894,38 @@
                 throw createBrowserAuthError(nonBrowserEnvironment);
             }
             const correlationId = request.correlationId || createNewGuid();
-            const idTokenClaims = response.id_token
-                ? extractTokenClaims(response.id_token, base64Decode)
-                : undefined;
-            const kmsi = isKmsi(idTokenClaims || {});
-            const authorityOptions = {
-                protocolMode: this.config.auth.protocolMode,
-                knownAuthorities: this.config.auth.knownAuthorities,
-                cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-                authorityMetadata: this.config.auth.authorityMetadata,
-                skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
-            };
-            const authority = request.authority
-                ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
-                : undefined;
-            const cacheRecordAccount = await this.loadAccount(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
-            const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId, kmsi);
-            const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId, kmsi);
-            const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId, kmsi);
-            return this.generateAuthenticationResult(request, {
-                account: cacheRecordAccount,
-                idToken,
-                accessToken,
-                refreshToken,
-            }, idTokenClaims, authority);
+            const rootMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.LoadExternalTokens, correlationId);
+            try {
+                const idTokenClaims = response.id_token
+                    ? extractTokenClaims(response.id_token, base64Decode)
+                    : undefined;
+                const kmsi = isKmsi(idTokenClaims || {});
+                const authorityOptions = {
+                    protocolMode: this.config.auth.protocolMode,
+                    knownAuthorities: this.config.auth.knownAuthorities,
+                    cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
+                    authorityMetadata: this.config.auth.authorityMetadata,
+                    skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
+                };
+                const authority = request.authority
+                    ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
+                    : undefined;
+                const cacheRecordAccount = await invokeAsync(this.loadAccount.bind(this), PerformanceEvents.LoadAccount, this.logger, this.performanceClient, correlationId)(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
+                const idToken = await invokeAsync(this.loadIdToken.bind(this), PerformanceEvents.LoadIdToken, this.logger, this.performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId, kmsi);
+                const accessToken = await invokeAsync(this.loadAccessToken.bind(this), PerformanceEvents.LoadAccessToken, this.logger, this.performanceClient, correlationId)(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId, kmsi);
+                const refreshToken = await invokeAsync(this.loadRefreshToken.bind(this), PerformanceEvents.LoadRefreshToken, this.logger, this.performanceClient, correlationId)(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId, kmsi);
+                rootMeasurement.end({ success: true }, undefined, AccountEntity.getAccountInfo(cacheRecordAccount));
+                return this.generateAuthenticationResult(request, {
+                    account: cacheRecordAccount,
+                    idToken,
+                    accessToken,
+                    refreshToken,
+                }, idTokenClaims, authority);
+            }
+            catch (error) {
+                rootMeasurement.end({ success: false }, error);
+                throw error;
+            }
         }
         /**
          * Helper function to load account to msal-browser cache
@@ -16895,7 +16940,7 @@
             this.logger.verbose("TokenCache - loading account");
             if (request.account) {
                 const accountEntity = AccountEntity.createFromAccountInfo(request.account);
-                await this.storage.setAccount(accountEntity, correlationId, isKmsi(idTokenClaims || {}));
+                await this.storage.setAccount(accountEntity, correlationId, isKmsi(idTokenClaims || {}), ApiId.loadExternalTokens);
                 return accountEntity;
             }
             else if (!authority || (!clientInfo && !idTokenClaims)) {
@@ -16907,7 +16952,7 @@
             const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
             undefined, // nativeAccountId
             this.logger);
-            await this.storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}));
+            await this.storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}), ApiId.loadExternalTokens);
             return cachedAccount;
         }
         /**
@@ -17083,7 +17128,7 @@
                     msgraph_host: request.msGraphHost,
                     cloud_graph_host_name: request.cloudGraphHostName,
                     cloud_instance_host_name: request.cloudInstanceHostName,
-                }, silentRequest, false);
+                }, silentRequest, this.apiId, false);
             }
             catch (e) {
                 if (e instanceof AuthError) {
@@ -17196,7 +17241,7 @@
             };
             this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient, this.eventHandler);
             // Initialize the token cache
-            this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto);
+            this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto, this.performanceClient);
             this.activeSilentTokenRequests = new Map();
             // Register listener functions
             this.trackPageVisibility = this.trackPageVisibility.bind(this);
@@ -17247,7 +17292,7 @@
             if (allowPlatformBroker) {
                 try {
                     // check if platform authentication is available via DOM or browser extension and create relevant handlers
-                    this.platformAuthProvider = await getPlatformAuthProvider(this.logger, this.performanceClient, initCorrelationId, this.config.system.nativeBrokerHandshakeTimeout);
+                    this.platformAuthProvider = await getPlatformAuthProvider(this.logger, this.performanceClient, initCorrelationId, this.config.system.nativeBrokerHandshakeTimeout, this.config.system.allowPlatformBrokerWithDOM);
                 }
                 catch (e) {
                     this.logger.verbose(e);
@@ -18026,7 +18071,7 @@
             this.logger.verbose("hydrateCache called");
             // Account gets saved to browser storage regardless of native or not
             const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-            await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims));
+            await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims), ApiId.hydrateCache);
             if (result.fromNativeBroker) {
                 this.logger.verbose("Response was from native broker, storing in-memory");
                 // Tokens from native broker are stored in-memory
@@ -19304,7 +19349,7 @@
         async hydrateCache(result, request) {
             this.logger.verbose("hydrateCache called");
             const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-            await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims));
+            await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims), ApiId.hydrateCache);
             return this.browserStorage.hydrateCache(result, request);
         }
     }