@azure/msal-browser 4.5.1 → 4.8.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v4.5.1 2025-03-04 */
+/*! @azure/msal-browser v4.8.0 2025-03-20 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -254,13 +254,6 @@
         INVALID_GRANT_ERROR: "invalid_grant",
         CLIENT_MISMATCH_ERROR: "client_mismatch",
     };
-    /**
-     * Password grant parameters
-     */
-    const PasswordGrantConstants = {
-        username: "username",
-        password: "password",
-    };
     /**
      * Response codes
      */
@@ -310,7 +303,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -327,7 +320,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -376,7 +369,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -474,7 +467,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -726,7 +719,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -765,7 +758,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -956,12 +949,12 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "15.2.0";
+    const version$1 = "15.3.0";
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -981,7 +974,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1042,7 +1035,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1057,6 +1050,24 @@
         // Date.getTime() returns in milliseconds.
         return Math.round(new Date().getTime() / 1000.0);
     }
+    /**
+     * Converts JS Date object to seconds
+     * @param date Date
+     */
+    function toSecondsFromDate(date) {
+        // Convert date to seconds
+        return date.getTime() / 1000;
+    }
+    /**
+     * Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
+     * @param seconds
+     */
+    function toDateFromSeconds(seconds) {
+        if (seconds) {
+            return new Date(Number(seconds) * 1000);
+        }
+        return new Date();
+    }
     /**
      * check if a token is expired based on given UTC time in seconds.
      * @param expiresOn
@@ -1079,7 +1090,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1406,7 +1417,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1460,7 +1471,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1598,7 +1609,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1695,7 +1706,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1886,7 +1897,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1926,7 +1937,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2005,7 +2016,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2020,7 +2031,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2042,7 +2053,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2055,7 +2066,7 @@
         OIDC: "OIDC",
     };
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2298,7 +2309,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2343,9 +2354,19 @@
             throw createClientAuthError(hashNotDeserialized);
         }
         return null;
+    }
+    /**
+     * Utility to create a URL from the params map
+     */
+    function mapToQueryString(parameters) {
+        const queryParameterArray = new Array();
+        parameters.forEach((value, key) => {
+            queryParameterArray.push(`${key}=${encodeURIComponent(value)}`);
+        });
+        return queryParameterArray.join("&");
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2509,7 +2530,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2649,7 +2670,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2657,7 +2678,7 @@
     const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
     const cacheUnknownErrorCode = "cache_error_unknown";
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2684,7 +2705,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3869,7 +3890,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3968,7 +3989,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3978,7 +3999,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4010,14 +4031,11 @@
     const X_APP_VER = "x-app-ver";
     const POST_LOGOUT_URI = "post_logout_redirect_uri";
     const ID_TOKEN_HINT = "id_token_hint";
-    const DEVICE_CODE = "device_code";
     const CLIENT_SECRET = "client_secret";
     const CLIENT_ASSERTION = "client_assertion";
     const CLIENT_ASSERTION_TYPE = "client_assertion_type";
     const TOKEN_TYPE = "token_type";
     const REQ_CNF = "req_cnf";
-    const OBO_ASSERTION = "assertion";
-    const REQUESTED_TOKEN_USE = "requested_token_use";
     const RETURN_SPA_CODE = "return_spa_code";
     const NATIVE_BROKER = "nativebroker";
     const LOGOUT_HINT = "logout_hint";
@@ -4026,76 +4044,10 @@
     const DOMAIN_HINT = "domain_hint";
     const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
     const BROKER_CLIENT_ID = "brk_client_id";
-    const BROKER_REDIRECT_URI = "brk_redirect_uri";
-
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Validates server consumable params from the "request" objects
-     */
-    class RequestValidator {
-        /**
-         * Utility to check if the `redirectUri` in the request is a non-null value
-         * @param redirectUri
-         */
-        static validateRedirectUri(redirectUri) {
-            if (!redirectUri) {
-                throw createClientConfigurationError(redirectUriEmpty);
-            }
-        }
-        /**
-         * Utility to validate prompt sent by the user in the request
-         * @param prompt
-         */
-        static validatePrompt(prompt) {
-            const promptValues = [];
-            for (const value in PromptValue) {
-                promptValues.push(PromptValue[value]);
-            }
-            if (promptValues.indexOf(prompt) < 0) {
-                throw createClientConfigurationError(invalidPromptValue);
-            }
-        }
-        static validateClaims(claims) {
-            try {
-                JSON.parse(claims);
-            }
-            catch (e) {
-                throw createClientConfigurationError(invalidClaims);
-            }
-        }
-        /**
-         * Utility to validate code_challenge and code_challenge_method
-         * @param codeChallenge
-         * @param codeChallengeMethod
-         */
-        static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-            if (!codeChallenge || !codeChallengeMethod) {
-                throw createClientConfigurationError(pkceParamsMissing);
-            }
-            else {
-                this.validateCodeChallengeMethod(codeChallengeMethod);
-            }
-        }
-        /**
-         * Utility to validate code_challenge_method
-         * @param codeChallengeMethod
-         */
-        static validateCodeChallengeMethod(codeChallengeMethod) {
-            if ([
-                CodeChallengeMethodValues.PLAIN,
-                CodeChallengeMethodValues.S256,
-            ].indexOf(codeChallengeMethod) < 0) {
-                throw createClientConfigurationError(invalidCodeChallengeMethod);
-            }
-        }
-    }
+    const BROKER_REDIRECT_URI = "brk_redirect_uri";
+    const INSTANCE_AWARE = "instance_aware";
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4113,397 +4065,344 @@
             }, correlationId);
         }
     }
-    /** @internal */
-    class RequestParameterBuilder {
-        constructor(correlationId, performanceClient) {
-            this.parameters = new Map();
-            this.performanceClient = performanceClient;
-            this.correlationId = correlationId;
-        }
-        /**
-         * add response_type = code
-         */
-        addResponseTypeCode() {
-            this.parameters.set(RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
-        }
-        /**
-         * add response_type = token id_token
-         */
-        addResponseTypeForTokenAndIdToken() {
-            this.parameters.set(RESPONSE_TYPE, encodeURIComponent(`${Constants.TOKEN_RESPONSE_TYPE} ${Constants.ID_TOKEN_RESPONSE_TYPE}`));
-        }
-        /**
-         * add response_mode. defaults to query.
-         * @param responseMode
-         */
-        addResponseMode(responseMode) {
-            this.parameters.set(RESPONSE_MODE, encodeURIComponent(responseMode ? responseMode : ResponseMode.QUERY));
-        }
-        /**
-         * Add flag to indicate STS should attempt to use WAM if available
-         */
-        addNativeBroker() {
-            this.parameters.set(NATIVE_BROKER, encodeURIComponent("1"));
-        }
-        /**
-         * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
-         * @param scopeSet
-         * @param addOidcScopes
-         */
-        addScopes(scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
-            // Always add openid to the scopes when adding OIDC scopes
-            if (addOidcScopes &&
-                !defaultScopes.includes("openid") &&
-                !scopes.includes("openid")) {
-                defaultScopes.push("openid");
-            }
-            const requestScopes = addOidcScopes
-                ? [...(scopes || []), ...defaultScopes]
-                : scopes || [];
-            const scopeSet = new ScopeSet(requestScopes);
-            this.parameters.set(SCOPE, encodeURIComponent(scopeSet.printScopes()));
+    /**
+     * add response_type = code
+     */
+    function addResponseTypeCode(parameters) {
+        parameters.set(RESPONSE_TYPE, Constants.CODE_RESPONSE_TYPE);
+    }
+    /**
+     * add response_mode. defaults to query.
+     * @param responseMode
+     */
+    function addResponseMode(parameters, responseMode) {
+        parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
+    }
+    /**
+     * Add flag to indicate STS should attempt to use WAM if available
+     */
+    function addNativeBroker(parameters) {
+        parameters.set(NATIVE_BROKER, "1");
+    }
+    /**
+     * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
+     * @param scopeSet
+     * @param addOidcScopes
+     */
+    function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+        // Always add openid to the scopes when adding OIDC scopes
+        if (addOidcScopes &&
+            !defaultScopes.includes("openid") &&
+            !scopes.includes("openid")) {
+            defaultScopes.push("openid");
+        }
+        const requestScopes = addOidcScopes
+            ? [...(scopes || []), ...defaultScopes]
+            : scopes || [];
+        const scopeSet = new ScopeSet(requestScopes);
+        parameters.set(SCOPE, scopeSet.printScopes());
+    }
+    /**
+     * add clientId
+     * @param clientId
+     */
+    function addClientId(parameters, clientId) {
+        parameters.set(CLIENT_ID, clientId);
+    }
+    /**
+     * add redirect_uri
+     * @param redirectUri
+     */
+    function addRedirectUri(parameters, redirectUri) {
+        parameters.set(REDIRECT_URI, redirectUri);
+    }
+    /**
+     * add post logout redirectUri
+     * @param redirectUri
+     */
+    function addPostLogoutRedirectUri(parameters, redirectUri) {
+        parameters.set(POST_LOGOUT_URI, redirectUri);
+    }
+    /**
+     * add id_token_hint to logout request
+     * @param idTokenHint
+     */
+    function addIdTokenHint(parameters, idTokenHint) {
+        parameters.set(ID_TOKEN_HINT, idTokenHint);
+    }
+    /**
+     * add domain_hint
+     * @param domainHint
+     */
+    function addDomainHint(parameters, domainHint) {
+        parameters.set(DOMAIN_HINT, domainHint);
+    }
+    /**
+     * add login_hint
+     * @param loginHint
+     */
+    function addLoginHint(parameters, loginHint) {
+        parameters.set(LOGIN_HINT, loginHint);
+    }
+    /**
+     * Adds the CCS (Cache Credential Service) query parameter for login_hint
+     * @param loginHint
+     */
+    function addCcsUpn(parameters, loginHint) {
+        parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
+    }
+    /**
+     * Adds the CCS (Cache Credential Service) query parameter for account object
+     * @param loginHint
+     */
+    function addCcsOid(parameters, clientInfo) {
+        parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
+    }
+    /**
+     * add sid
+     * @param sid
+     */
+    function addSid(parameters, sid) {
+        parameters.set(SID, sid);
+    }
+    /**
+     * add claims
+     * @param claims
+     */
+    function addClaims(parameters, claims, clientCapabilities) {
+        const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
+        try {
+            JSON.parse(mergedClaims);
         }
-        /**
-         * add clientId
-         * @param clientId
-         */
-        addClientId(clientId) {
-            this.parameters.set(CLIENT_ID, encodeURIComponent(clientId));
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
         }
-        /**
-         * add redirect_uri
-         * @param redirectUri
-         */
-        addRedirectUri(redirectUri) {
-            RequestValidator.validateRedirectUri(redirectUri);
-            this.parameters.set(REDIRECT_URI, encodeURIComponent(redirectUri));
+        parameters.set(CLAIMS, mergedClaims);
+    }
+    /**
+     * add correlationId
+     * @param correlationId
+     */
+    function addCorrelationId(parameters, correlationId) {
+        parameters.set(CLIENT_REQUEST_ID, correlationId);
+    }
+    /**
+     * add library info query params
+     * @param libraryInfo
+     */
+    function addLibraryInfo(parameters, libraryInfo) {
+        // Telemetry Info
+        parameters.set(X_CLIENT_SKU, libraryInfo.sku);
+        parameters.set(X_CLIENT_VER, libraryInfo.version);
+        if (libraryInfo.os) {
+            parameters.set(X_CLIENT_OS, libraryInfo.os);
         }
-        /**
-         * add post logout redirectUri
-         * @param redirectUri
-         */
-        addPostLogoutRedirectUri(redirectUri) {
-            RequestValidator.validateRedirectUri(redirectUri);
-            this.parameters.set(POST_LOGOUT_URI, encodeURIComponent(redirectUri));
+        if (libraryInfo.cpu) {
+            parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
         }
-        /**
-         * add id_token_hint to logout request
-         * @param idTokenHint
-         */
-        addIdTokenHint(idTokenHint) {
-            this.parameters.set(ID_TOKEN_HINT, encodeURIComponent(idTokenHint));
+    }
+    /**
+     * Add client telemetry parameters
+     * @param appTelemetry
+     */
+    function addApplicationTelemetry(parameters, appTelemetry) {
+        if (appTelemetry?.appName) {
+            parameters.set(X_APP_NAME, appTelemetry.appName);
         }
-        /**
-         * add domain_hint
-         * @param domainHint
-         */
-        addDomainHint(domainHint) {
-            this.parameters.set(DOMAIN_HINT, encodeURIComponent(domainHint));
+        if (appTelemetry?.appVersion) {
+            parameters.set(X_APP_VER, appTelemetry.appVersion);
         }
-        /**
-         * add login_hint
-         * @param loginHint
-         */
-        addLoginHint(loginHint) {
-            this.parameters.set(LOGIN_HINT, encodeURIComponent(loginHint));
+    }
+    /**
+     * add prompt
+     * @param prompt
+     */
+    function addPrompt(parameters, prompt) {
+        parameters.set(PROMPT, prompt);
+    }
+    /**
+     * add state
+     * @param state
+     */
+    function addState(parameters, state) {
+        if (state) {
+            parameters.set(STATE, state);
         }
-        /**
-         * Adds the CCS (Cache Credential Service) query parameter for login_hint
-         * @param loginHint
-         */
-        addCcsUpn(loginHint) {
-            this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent(`UPN:${loginHint}`));
+    }
+    /**
+     * add nonce
+     * @param nonce
+     */
+    function addNonce(parameters, nonce) {
+        parameters.set(NONCE, nonce);
+    }
+    /**
+     * add code_challenge and code_challenge_method
+     * - throw if either of them are not passed
+     * @param codeChallenge
+     * @param codeChallengeMethod
+     */
+    function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
+        if (codeChallenge && codeChallengeMethod) {
+            parameters.set(CODE_CHALLENGE, codeChallenge);
+            parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
         }
-        /**
-         * Adds the CCS (Cache Credential Service) query parameter for account object
-         * @param loginHint
-         */
-        addCcsOid(clientInfo) {
-            this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent(`Oid:${clientInfo.uid}@${clientInfo.utid}`));
+        else {
+            throw createClientConfigurationError(pkceParamsMissing);
         }
-        /**
-         * add sid
-         * @param sid
-         */
-        addSid(sid) {
-            this.parameters.set(SID, encodeURIComponent(sid));
+    }
+    /**
+     * add the `authorization_code` passed by the user to exchange for a token
+     * @param code
+     */
+    function addAuthorizationCode(parameters, code) {
+        parameters.set(CODE, code);
+    }
+    /**
+     * add the `refreshToken` passed by the user
+     * @param refreshToken
+     */
+    function addRefreshToken(parameters, refreshToken) {
+        parameters.set(REFRESH_TOKEN, refreshToken);
+    }
+    /**
+     * add the `code_verifier` passed by the user to exchange for a token
+     * @param codeVerifier
+     */
+    function addCodeVerifier(parameters, codeVerifier) {
+        parameters.set(CODE_VERIFIER, codeVerifier);
+    }
+    /**
+     * add client_secret
+     * @param clientSecret
+     */
+    function addClientSecret(parameters, clientSecret) {
+        parameters.set(CLIENT_SECRET, clientSecret);
+    }
+    /**
+     * add clientAssertion for confidential client flows
+     * @param clientAssertion
+     */
+    function addClientAssertion(parameters, clientAssertion) {
+        if (clientAssertion) {
+            parameters.set(CLIENT_ASSERTION, clientAssertion);
         }
-        /**
-         * add claims
-         * @param claims
-         */
-        addClaims(claims, clientCapabilities) {
-            const mergedClaims = this.addClientCapabilitiesToClaims(claims, clientCapabilities);
-            RequestValidator.validateClaims(mergedClaims);
-            this.parameters.set(CLAIMS, encodeURIComponent(mergedClaims));
+    }
+    /**
+     * add clientAssertionType for confidential client flows
+     * @param clientAssertionType
+     */
+    function addClientAssertionType(parameters, clientAssertionType) {
+        if (clientAssertionType) {
+            parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
         }
-        /**
-         * add correlationId
-         * @param correlationId
-         */
-        addCorrelationId(correlationId) {
-            this.parameters.set(CLIENT_REQUEST_ID, encodeURIComponent(correlationId));
+    }
+    /**
+     * add grant type
+     * @param grantType
+     */
+    function addGrantType(parameters, grantType) {
+        parameters.set(GRANT_TYPE, grantType);
+    }
+    /**
+     * add client info
+     *
+     */
+    function addClientInfo(parameters) {
+        parameters.set(CLIENT_INFO, "1");
+    }
+    function addInstanceAware(parameters) {
+        if (!parameters.has(INSTANCE_AWARE)) {
+            parameters.set(INSTANCE_AWARE, "true");
         }
-        /**
-         * add library info query params
-         * @param libraryInfo
-         */
-        addLibraryInfo(libraryInfo) {
-            // Telemetry Info
-            this.parameters.set(X_CLIENT_SKU, libraryInfo.sku);
-            this.parameters.set(X_CLIENT_VER, libraryInfo.version);
-            if (libraryInfo.os) {
-                this.parameters.set(X_CLIENT_OS, libraryInfo.os);
-            }
-            if (libraryInfo.cpu) {
-                this.parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
+    }
+    /**
+     * add extraQueryParams
+     * @param eQParams
+     */
+    function addExtraQueryParameters(parameters, eQParams) {
+        Object.entries(eQParams).forEach(([key, value]) => {
+            if (!parameters.has(key) && value) {
+                parameters.set(key, value);
             }
+        });
+    }
+    function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+        let mergedClaims;
+        // Parse provided claims into JSON object or initialize empty object
+        if (!claims) {
+            mergedClaims = {};
         }
-        /**
-         * Add client telemetry parameters
-         * @param appTelemetry
-         */
-        addApplicationTelemetry(appTelemetry) {
-            if (appTelemetry?.appName) {
-                this.parameters.set(X_APP_NAME, appTelemetry.appName);
+        else {
+            try {
+                mergedClaims = JSON.parse(claims);
             }
-            if (appTelemetry?.appVersion) {
-                this.parameters.set(X_APP_VER, appTelemetry.appVersion);
+            catch (e) {
+                throw createClientConfigurationError(invalidClaims);
             }
         }
-        /**
-         * add prompt
-         * @param prompt
-         */
-        addPrompt(prompt) {
-            RequestValidator.validatePrompt(prompt);
-            this.parameters.set(`${PROMPT}`, encodeURIComponent(prompt));
-        }
-        /**
-         * add state
-         * @param state
-         */
-        addState(state) {
-            if (state) {
-                this.parameters.set(STATE, encodeURIComponent(state));
+        if (clientCapabilities && clientCapabilities.length > 0) {
+            if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+                // Add access_token key to claims object
+                mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
             }
+            // Add xms_cc claim with provided clientCapabilities to access_token key
+            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
+                {
+                    values: clientCapabilities,
+                };
         }
-        /**
-         * add nonce
-         * @param nonce
-         */
-        addNonce(nonce) {
-            this.parameters.set(NONCE, encodeURIComponent(nonce));
+        return JSON.stringify(mergedClaims);
+    }
+    /**
+     * add pop_jwk to query params
+     * @param cnfString
+     */
+    function addPopToken(parameters, cnfString) {
+        if (cnfString) {
+            parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
+            parameters.set(REQ_CNF, cnfString);
         }
-        /**
-         * add code_challenge and code_challenge_method
-         * - throw if either of them are not passed
-         * @param codeChallenge
-         * @param codeChallengeMethod
-         */
-        addCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-            RequestValidator.validateCodeChallengeParams(codeChallenge, codeChallengeMethod);
-            if (codeChallenge && codeChallengeMethod) {
-                this.parameters.set(CODE_CHALLENGE, encodeURIComponent(codeChallenge));
-                this.parameters.set(CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
-            }
-            else {
-                throw createClientConfigurationError(pkceParamsMissing);
-            }
-        }
-        /**
-         * add the `authorization_code` passed by the user to exchange for a token
-         * @param code
-         */
-        addAuthorizationCode(code) {
-            this.parameters.set(CODE, encodeURIComponent(code));
-        }
-        /**
-         * add the `authorization_code` passed by the user to exchange for a token
-         * @param code
-         */
-        addDeviceCode(code) {
-            this.parameters.set(DEVICE_CODE, encodeURIComponent(code));
-        }
-        /**
-         * add the `refreshToken` passed by the user
-         * @param refreshToken
-         */
-        addRefreshToken(refreshToken) {
-            this.parameters.set(REFRESH_TOKEN, encodeURIComponent(refreshToken));
-        }
-        /**
-         * add the `code_verifier` passed by the user to exchange for a token
-         * @param codeVerifier
-         */
-        addCodeVerifier(codeVerifier) {
-            this.parameters.set(CODE_VERIFIER, encodeURIComponent(codeVerifier));
-        }
-        /**
-         * add client_secret
-         * @param clientSecret
-         */
-        addClientSecret(clientSecret) {
-            this.parameters.set(CLIENT_SECRET, encodeURIComponent(clientSecret));
-        }
-        /**
-         * add clientAssertion for confidential client flows
-         * @param clientAssertion
-         */
-        addClientAssertion(clientAssertion) {
-            if (clientAssertion) {
-                this.parameters.set(CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
-            }
-        }
-        /**
-         * add clientAssertionType for confidential client flows
-         * @param clientAssertionType
-         */
-        addClientAssertionType(clientAssertionType) {
-            if (clientAssertionType) {
-                this.parameters.set(CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
-            }
-        }
-        /**
-         * add OBO assertion for confidential client flows
-         * @param clientAssertion
-         */
-        addOboAssertion(oboAssertion) {
-            this.parameters.set(OBO_ASSERTION, encodeURIComponent(oboAssertion));
-        }
-        /**
-         * add grant type
-         * @param grantType
-         */
-        addRequestTokenUse(tokenUse) {
-            this.parameters.set(REQUESTED_TOKEN_USE, encodeURIComponent(tokenUse));
-        }
-        /**
-         * add grant type
-         * @param grantType
-         */
-        addGrantType(grantType) {
-            this.parameters.set(GRANT_TYPE, encodeURIComponent(grantType));
-        }
-        /**
-         * add client info
-         *
-         */
-        addClientInfo() {
-            this.parameters.set(CLIENT_INFO, "1");
-        }
-        /**
-         * add extraQueryParams
-         * @param eQParams
-         */
-        addExtraQueryParameters(eQParams) {
-            Object.entries(eQParams).forEach(([key, value]) => {
-                if (!this.parameters.has(key) && value) {
-                    this.parameters.set(key, value);
-                }
-            });
-        }
-        addClientCapabilitiesToClaims(claims, clientCapabilities) {
-            let mergedClaims;
-            // Parse provided claims into JSON object or initialize empty object
-            if (!claims) {
-                mergedClaims = {};
-            }
-            else {
-                try {
-                    mergedClaims = JSON.parse(claims);
-                }
-                catch (e) {
-                    throw createClientConfigurationError(invalidClaims);
-                }
-            }
-            if (clientCapabilities && clientCapabilities.length > 0) {
-                if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
-                    // Add access_token key to claims object
-                    mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
-                }
-                // Add xms_cc claim with provided clientCapabilities to access_token key
-                mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] = {
-                    values: clientCapabilities,
-                };
-            }
-            return JSON.stringify(mergedClaims);
-        }
-        /**
-         * adds `username` for Password Grant flow
-         * @param username
-         */
-        addUsername(username) {
-            this.parameters.set(PasswordGrantConstants.username, encodeURIComponent(username));
-        }
-        /**
-         * adds `password` for Password Grant flow
-         * @param password
-         */
-        addPassword(password) {
-            this.parameters.set(PasswordGrantConstants.password, encodeURIComponent(password));
-        }
-        /**
-         * add pop_jwk to query params
-         * @param cnfString
-         */
-        addPopToken(cnfString) {
-            if (cnfString) {
-                this.parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
-                this.parameters.set(REQ_CNF, encodeURIComponent(cnfString));
-            }
-        }
-        /**
-         * add SSH JWK and key ID to query params
-         */
-        addSshJwk(sshJwkString) {
-            if (sshJwkString) {
-                this.parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
-                this.parameters.set(REQ_CNF, encodeURIComponent(sshJwkString));
-            }
-        }
-        /**
-         * add server telemetry fields
-         * @param serverTelemetryManager
-         */
-        addServerTelemetry(serverTelemetryManager) {
-            this.parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-            this.parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
-        }
-        /**
-         * Adds parameter that indicates to the server that throttling is supported
-         */
-        addThrottling() {
-            this.parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
-        }
-        /**
-         * Adds logout_hint parameter for "silent" logout which prevent server account picker
-         */
-        addLogoutHint(logoutHint) {
-            this.parameters.set(LOGOUT_HINT, encodeURIComponent(logoutHint));
+    }
+    /**
+     * add SSH JWK and key ID to query params
+     */
+    function addSshJwk(parameters, sshJwkString) {
+        if (sshJwkString) {
+            parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
+            parameters.set(REQ_CNF, sshJwkString);
         }
-        addBrokerParameters(params) {
-            const brokerParams = {};
-            brokerParams[BROKER_CLIENT_ID] =
-                params.brokerClientId;
-            brokerParams[BROKER_REDIRECT_URI] =
-                params.brokerRedirectUri;
-            this.addExtraQueryParameters(brokerParams);
+    }
+    /**
+     * add server telemetry fields
+     * @param serverTelemetryManager
+     */
+    function addServerTelemetry(parameters, serverTelemetryManager) {
+        parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+        parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+    }
+    /**
+     * Adds parameter that indicates to the server that throttling is supported
+     */
+    function addThrottling(parameters) {
+        parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+    }
+    /**
+     * Adds logout_hint parameter for "silent" logout which prevent server account picker
+     */
+    function addLogoutHint(parameters, logoutHint) {
+        parameters.set(LOGOUT_HINT, logoutHint);
+    }
+    function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
+        if (!parameters.has(BROKER_CLIENT_ID)) {
+            parameters.set(BROKER_CLIENT_ID, brokerClientId);
         }
-        /**
-         * Utility to create a URL from the params map
-         */
-        createQueryString() {
-            const queryParameterArray = new Array();
-            this.parameters.forEach((value, key) => {
-                queryParameterArray.push(`${key}=${value}`);
-            });
-            instrumentBrokerParams(this.parameters, this.correlationId, this.performanceClient);
-            return queryParameterArray.join("&");
+        if (!parameters.has(BROKER_REDIRECT_URI)) {
+            parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4515,7 +4414,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4525,7 +4424,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4535,7 +4434,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4711,11 +4610,11 @@
         StandardInteractionClientCreateAuthCodeClient: "standardInteractionClientCreateAuthCodeClient",
         StandardInteractionClientGetClientConfiguration: "standardInteractionClientGetClientConfiguration",
         StandardInteractionClientInitializeAuthorizationRequest: "standardInteractionClientInitializeAuthorizationRequest",
-        StandardInteractionClientInitializeAuthorizationCodeRequest: "standardInteractionClientInitializeAuthorizationCodeRequest",
         /**
          * getAuthCodeUrl API (msal-browser and msal-node).
          */
         GetAuthCodeUrl: "getAuthCodeUrl",
+        GetStandardParams: "getStandardParams",
         /**
          * Functions from InteractionHandler (msal-browser)
          */
@@ -4728,7 +4627,6 @@
         AuthClientAcquireToken: "authClientAcquireToken",
         AuthClientExecuteTokenRequest: "authClientExecuteTokenRequest",
         AuthClientCreateTokenRequestBody: "authClientCreateTokenRequestBody",
-        AuthClientCreateQueryString: "authClientCreateQueryString",
         /**
          * Generate functions in PopTokenGenerator (msal-common)
          */
@@ -4899,10 +4797,6 @@
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
             "StdIntClientInitAuthReq",
         ],
-        [
-            PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-            "StdIntClientInitAuthCodeReq",
-        ],
         [PerformanceEvents.GetAuthCodeUrl, "GetAuthCodeUrl"],
         [
             PerformanceEvents.HandleCodeResponseFromServer,
@@ -4916,10 +4810,6 @@
             PerformanceEvents.AuthClientCreateTokenRequestBody,
             "AuthClientCreateTReqBody",
         ],
-        [
-            PerformanceEvents.AuthClientCreateQueryString,
-            "AuthClientCreateQueryStr",
-        ],
         [PerformanceEvents.PopTokenGenerateCnf, "PopTGenCnf"],
         [PerformanceEvents.PopTokenGenerateKid, "PopTGenKid"],
         [PerformanceEvents.HandleServerTokenResponse, "HandleServerTRes"],
@@ -5044,7 +4934,7 @@
         "encryptedCacheExpiredCount",
     ]);
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5140,7 +5030,7 @@
         };
     };
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5249,7 +5139,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6088,7 +5978,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6119,7 +6009,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6138,7 +6028,28 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function getRequestThumbprint(clientId, request, homeAccountId) {
+        return {
+            clientId: clientId,
+            authority: request.authority,
+            scopes: request.scopes,
+            homeAccountIdentifier: homeAccountId,
+            claims: request.claims,
+            authenticationScheme: request.authenticationScheme,
+            resourceRequestMethod: request.resourceRequestMethod,
+            resourceRequestUri: request.resourceRequestUri,
+            shrClaims: request.shrClaims,
+            sshKid: request.sshKid,
+            embeddedClientId: request.embeddedClientId || request.tokenBodyParameters?.clientId,
+        };
+    }
+
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6219,24 +6130,13 @@
                 ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
         }
         static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
-            const thumbprint = {
-                clientId: clientId,
-                authority: request.authority,
-                scopes: request.scopes,
-                homeAccountIdentifier: homeAccountIdentifier,
-                claims: request.claims,
-                authenticationScheme: request.authenticationScheme,
-                resourceRequestMethod: request.resourceRequestMethod,
-                resourceRequestUri: request.resourceRequestUri,
-                shrClaims: request.shrClaims,
-                sshKid: request.sshKid,
-            };
+            const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
             const key = this.generateThrottlingStorageKey(thumbprint);
             cacheManager.removeItem(key);
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6266,7 +6166,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6401,22 +6301,20 @@
          * @param request
          */
         createTokenQueryParameters(request) {
-            const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+            const parameters = new Map();
             if (request.embeddedClientId) {
-                parameterBuilder.addBrokerParameters({
-                    brokerClientId: this.config.authOptions.clientId,
-                    brokerRedirectUri: this.config.authOptions.redirectUri,
-                });
+                addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
             }
             if (request.tokenQueryParameters) {
-                parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);
+                addExtraQueryParameters(parameters, request.tokenQueryParameters);
             }
-            parameterBuilder.addCorrelationId(request.correlationId);
-            return parameterBuilder.createQueryString();
+            addCorrelationId(parameters, request.correlationId);
+            instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            return mapToQueryString(parameters);
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6442,7 +6340,7 @@
         refreshTokenExpired: refreshTokenExpired
     });
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6530,7 +6428,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6602,7 +6500,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6686,7 +6584,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6713,19 +6611,12 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    function parseServerErrorNo(serverResponse) {
-        const errorCodePrefix = "code=";
-        const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
-        return errorCodePrefixIndex && errorCodePrefixIndex >= 0
-            ? serverResponse.error_uri?.substring(errorCodePrefixIndex + errorCodePrefix.length)
-            : undefined;
-    }
     /**
      * Class that handles response parsing.
      * @internal
@@ -6740,46 +6631,6 @@
             this.persistencePlugin = persistencePlugin;
             this.performanceClient = performanceClient;
         }
-        /**
-         * Function which validates server authorization code response.
-         * @param serverResponseHash
-         * @param requestState
-         * @param cryptoObj
-         */
-        validateServerAuthorizationCodeResponse(serverResponse, requestState) {
-            if (!serverResponse.state || !requestState) {
-                throw serverResponse.state
-                    ? createClientAuthError(stateNotFound, "Cached State")
-                    : createClientAuthError(stateNotFound, "Server State");
-            }
-            let decodedServerResponseState;
-            let decodedRequestState;
-            try {
-                decodedServerResponseState = decodeURIComponent(serverResponse.state);
-            }
-            catch (e) {
-                throw createClientAuthError(invalidState, serverResponse.state);
-            }
-            try {
-                decodedRequestState = decodeURIComponent(requestState);
-            }
-            catch (e) {
-                throw createClientAuthError(invalidState, serverResponse.state);
-            }
-            if (decodedServerResponseState !== decodedRequestState) {
-                throw createClientAuthError(stateMismatch);
-            }
-            // Check for error
-            if (serverResponse.error ||
-                serverResponse.error_description ||
-                serverResponse.suberror) {
-                const serverErrorNo = parseServerErrorNo(serverResponse);
-                if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-                    throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
-                }
-                throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
-            }
-        }
         /**
          * Function which validates server authorization token response.
          * @param serverResponse
@@ -7005,10 +6856,11 @@
                     accessToken = cacheRecord.accessToken.secret;
                 }
                 responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
-                expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
-                extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+                // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
+                expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
+                extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
                 if (cacheRecord.accessToken.refreshOn) {
-                    refreshOn = new Date(Number(cacheRecord.accessToken.refreshOn) * 1000);
+                    refreshOn = toDateFromSeconds(cacheRecord.accessToken.refreshOn);
                 }
             }
             if (cacheRecord.appMetadata) {
@@ -7090,7 +6942,74 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Validates server consumable params from the "request" objects
+     */
+    class RequestValidator {
+        /**
+         * Utility to check if the `redirectUri` in the request is a non-null value
+         * @param redirectUri
+         */
+        static validateRedirectUri(redirectUri) {
+            if (!redirectUri) {
+                throw createClientConfigurationError(redirectUriEmpty);
+            }
+        }
+        /**
+         * Utility to validate prompt sent by the user in the request
+         * @param prompt
+         */
+        static validatePrompt(prompt) {
+            const promptValues = [];
+            for (const value in PromptValue) {
+                promptValues.push(PromptValue[value]);
+            }
+            if (promptValues.indexOf(prompt) < 0) {
+                throw createClientConfigurationError(invalidPromptValue);
+            }
+        }
+        static validateClaims(claims) {
+            try {
+                JSON.parse(claims);
+            }
+            catch (e) {
+                throw createClientConfigurationError(invalidClaims);
+            }
+        }
+        /**
+         * Utility to validate code_challenge and code_challenge_method
+         * @param codeChallenge
+         * @param codeChallengeMethod
+         */
+        static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
+            if (!codeChallenge || !codeChallengeMethod) {
+                throw createClientConfigurationError(pkceParamsMissing);
+            }
+            else {
+                this.validateCodeChallengeMethod(codeChallengeMethod);
+            }
+        }
+        /**
+         * Utility to validate code_challenge_method
+         * @param codeChallengeMethod
+         */
+        static validateCodeChallengeMethod(codeChallengeMethod) {
+            if ([
+                CodeChallengeMethodValues.PLAIN,
+                CodeChallengeMethodValues.S256,
+            ].indexOf(codeChallengeMethod) < 0) {
+                throw createClientConfigurationError(invalidCodeChallengeMethod);
+            }
+        }
+    }
+
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7108,7 +7027,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7126,21 +7045,6 @@
             this.oidcDefaultScopes =
                 this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
         }
-        /**
-         * Creates the URL of the authorization request letting the user input credentials and consent to the
-         * application. The URL target the /authorize endpoint of the authority configured in the
-         * application object.
-         *
-         * Once the user inputs their credentials and consents, the authority will send a response to the redirect URI
-         * sent in the request and should contain an authorization code, which can then be used to acquire tokens via
-         * acquireToken(AuthorizationCodeRequest)
-         * @param request
-         */
-        async getAuthCodeUrl(request) {
-            this.performanceClient?.addQueueMeasurement(PerformanceEvents.GetAuthCodeUrl, request.correlationId);
-            const queryString = await invokeAsync(this.createAuthCodeUrlQueryString.bind(this), PerformanceEvents.AuthClientCreateQueryString, this.logger, this.performanceClient, request.correlationId)(request);
-            return UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString);
-        }
         /**
          * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
          * authorization_code_grant
@@ -7160,22 +7064,6 @@
             responseHandler.validateTokenResponse(response.body);
             return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId);
         }
-        /**
-         * Handles the hash fragment response from public client code request. Returns a code response used by
-         * the client to exchange for a token in acquireToken.
-         * @param hashFragment
-         */
-        handleFragmentResponse(serverParams, cachedState) {
-            // Handle responses.
-            const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);
-            // Get code response
-            responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState);
-            // throw when there is no auth code in the response
-            if (!serverParams.code) {
-                throw createClientAuthError(authorizationCodeMissingFromServerResponse);
-            }
-            return serverParams;
-        }
         /**
          * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
          * Default behaviour is to redirect the user to `window.location.href`.
@@ -7214,18 +7102,7 @@
                 }
             }
             const headers = this.createTokenRequestHeaders(ccsCredential || request.ccsCredential);
-            const thumbprint = {
-                clientId: request.tokenBodyParameters?.clientId ||
-                    this.config.authOptions.clientId,
-                authority: authority.canonicalAuthority,
-                scopes: request.scopes,
-                claims: request.claims,
-                authenticationScheme: request.authenticationScheme,
-                resourceRequestMethod: request.resourceRequestMethod,
-                resourceRequestUri: request.resourceRequestUri,
-                shrClaims: request.shrClaims,
-                sshKid: request.sshKid,
-            };
+            const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
             return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint);
         }
         /**
@@ -7234,8 +7111,8 @@
          */
         async createTokenRequestBody(request) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);
-            const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
-            parameterBuilder.addClientId(request.embeddedClientId ||
+            const parameters = new Map();
+            addClientId(parameters, request.embeddedClientId ||
                 request.tokenBodyParameters?.[CLIENT_ID] ||
                 this.config.authOptions.clientId);
             /*
@@ -7248,33 +7125,33 @@
             }
             else {
                 // Validate and include redirect uri
-                parameterBuilder.addRedirectUri(request.redirectUri);
+                addRedirectUri(parameters, request.redirectUri);
             }
             // Add scope array, parameter builder will add default scopes and dedupe
-            parameterBuilder.addScopes(request.scopes, true, this.oidcDefaultScopes);
+            addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
             // add code: user set, not validated
-            parameterBuilder.addAuthorizationCode(request.code);
+            addAuthorizationCode(parameters, request.code);
             // Add library metadata
-            parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-            parameterBuilder.addThrottling();
+            addLibraryInfo(parameters, this.config.libraryInfo);
+            addApplicationTelemetry(parameters, this.config.telemetry.application);
+            addThrottling(parameters);
             if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
-                parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
+                addServerTelemetry(parameters, this.serverTelemetryManager);
             }
             // add code_verifier if passed
             if (request.codeVerifier) {
-                parameterBuilder.addCodeVerifier(request.codeVerifier);
+                addCodeVerifier(parameters, request.codeVerifier);
             }
             if (this.config.clientCredentials.clientSecret) {
-                parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
+                addClientSecret(parameters, this.config.clientCredentials.clientSecret);
             }
             if (this.config.clientCredentials.clientAssertion) {
                 const clientAssertion = this.config.clientCredentials.clientAssertion;
-                parameterBuilder.addClientAssertion(await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
-                parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
+                addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+                addClientAssertionType(parameters, clientAssertion.assertionType);
             }
-            parameterBuilder.addGrantType(GrantType.AUTHORIZATION_CODE_GRANT);
-            parameterBuilder.addClientInfo();
+            addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
+            addClientInfo(parameters);
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
                 let reqCnfData;
@@ -7286,11 +7163,11 @@
                     reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
                 }
                 // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-                parameterBuilder.addPopToken(reqCnfData);
+                addPopToken(parameters, reqCnfData);
             }
             else if (request.authenticationScheme === AuthenticationScheme.SSH) {
                 if (request.sshJwk) {
-                    parameterBuilder.addSshJwk(request.sshJwk);
+                    addSshJwk(parameters, request.sshJwk);
                 }
                 else {
                     throw createClientConfigurationError(missingSshJwk);
@@ -7299,7 +7176,7 @@
             if (!StringUtils.isEmptyObj(request.claims) ||
                 (this.config.authOptions.clientCapabilities &&
                     this.config.authOptions.clientCapabilities.length > 0)) {
-                parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+                addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
             }
             let ccsCred = undefined;
             if (request.clientInfo) {
@@ -7323,7 +7200,7 @@
                     case CcsCredentialType.HOME_ACCOUNT_ID:
                         try {
                             const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
-                            parameterBuilder.addCcsOid(clientInfo);
+                            addCcsOid(parameters, clientInfo);
                         }
                         catch (e) {
                             this.logger.verbose("Could not parse home account ID for CCS Header: " +
@@ -7331,234 +7208,59 @@
                         }
                         break;
                     case CcsCredentialType.UPN:
-                        parameterBuilder.addCcsUpn(ccsCred.credential);
+                        addCcsUpn(parameters, ccsCred.credential);
                         break;
                 }
             }
             if (request.embeddedClientId) {
-                parameterBuilder.addBrokerParameters({
-                    brokerClientId: this.config.authOptions.clientId,
-                    brokerRedirectUri: this.config.authOptions.redirectUri,
-                });
+                addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
             }
             if (request.tokenBodyParameters) {
-                parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+                addExtraQueryParameters(parameters, request.tokenBodyParameters);
             }
             // Add hybrid spa parameters if not already provided
             if (request.enableSpaAuthorizationCode &&
                 (!request.tokenBodyParameters ||
                     !request.tokenBodyParameters[RETURN_SPA_CODE])) {
-                parameterBuilder.addExtraQueryParameters({
+                addExtraQueryParameters(parameters, {
                     [RETURN_SPA_CODE]: "1",
                 });
             }
-            return parameterBuilder.createQueryString();
-        }
-        /**
-         * This API validates the `AuthorizationCodeUrlRequest` and creates a URL
-         * @param request
-         */
-        async createAuthCodeUrlQueryString(request) {
-            // generate the correlationId if not set by the user and add
-            const correlationId = request.correlationId ||
-                this.config.cryptoInterface.createNewGuid();
-            this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, correlationId);
-            const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
-            parameterBuilder.addClientId(request.embeddedClientId ||
-                request.extraQueryParameters?.[CLIENT_ID] ||
-                this.config.authOptions.clientId);
-            const requestScopes = [
-                ...(request.scopes || []),
-                ...(request.extraScopesToConsent || []),
-            ];
-            parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);
-            // validate the redirectUri (to be a non null value)
-            parameterBuilder.addRedirectUri(request.redirectUri);
-            parameterBuilder.addCorrelationId(correlationId);
-            // add response_mode. If not passed in it defaults to query.
-            parameterBuilder.addResponseMode(request.responseMode);
-            // add response_type = code
-            parameterBuilder.addResponseTypeCode();
-            // add library info parameters
-            parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-            if (!isOidcProtocolMode(this.config)) {
-                parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-            }
-            // add client_info=1
-            parameterBuilder.addClientInfo();
-            if (request.codeChallenge && request.codeChallengeMethod) {
-                parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
-            }
-            if (request.prompt) {
-                parameterBuilder.addPrompt(request.prompt);
-            }
-            if (request.domainHint) {
-                parameterBuilder.addDomainHint(request.domainHint);
-                this.performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
-            }
-            this.performanceClient?.addFields({ prompt: request.prompt }, correlationId);
-            // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
-            if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
-                // AAD will throw if prompt=select_account is passed with an account hint
-                if (request.sid && request.prompt === PromptValue.NONE) {
-                    // SessionID is only used in silent calls
-                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
-                    parameterBuilder.addSid(request.sid);
-                    this.performanceClient?.addFields({ sidFromRequest: true }, correlationId);
-                }
-                else if (request.account) {
-                    const accountSid = this.extractAccountSid(request.account);
-                    let accountLoginHintClaim = this.extractLoginHint(request.account);
-                    if (accountLoginHintClaim && request.domainHint) {
-                        this.logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`);
-                        accountLoginHintClaim = null;
-                    }
-                    // If login_hint claim is present, use it over sid/username
-                    if (accountLoginHintClaim) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
-                        parameterBuilder.addLoginHint(accountLoginHintClaim);
-                        this.performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
-                        try {
-                            const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                            parameterBuilder.addCcsOid(clientInfo);
-                        }
-                        catch (e) {
-                            this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                        }
-                    }
-                    else if (accountSid && request.prompt === PromptValue.NONE) {
-                        /*
-                         * If account and loginHint are provided, we will check account first for sid before adding loginHint
-                         * SessionId is only used in silent calls
-                         */
-                        this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
-                        parameterBuilder.addSid(accountSid);
-                        this.performanceClient?.addFields({ sidFromClaim: true }, correlationId);
-                        try {
-                            const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                            parameterBuilder.addCcsOid(clientInfo);
-                        }
-                        catch (e) {
-                            this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                        }
-                    }
-                    else if (request.loginHint) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
-                        parameterBuilder.addLoginHint(request.loginHint);
-                        parameterBuilder.addCcsUpn(request.loginHint);
-                        this.performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
-                    }
-                    else if (request.account.username) {
-                        // Fallback to account username if provided
-                        this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
-                        parameterBuilder.addLoginHint(request.account.username);
-                        this.performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
-                        try {
-                            const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                            parameterBuilder.addCcsOid(clientInfo);
-                        }
-                        catch (e) {
-                            this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                        }
-                    }
-                }
-                else if (request.loginHint) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
-                    parameterBuilder.addLoginHint(request.loginHint);
-                    parameterBuilder.addCcsUpn(request.loginHint);
-                    this.performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
-                }
-            }
-            else {
-                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
-            }
-            if (request.nonce) {
-                parameterBuilder.addNonce(request.nonce);
-            }
-            if (request.state) {
-                parameterBuilder.addState(request.state);
-            }
-            if (request.claims ||
-                (this.config.authOptions.clientCapabilities &&
-                    this.config.authOptions.clientCapabilities.length > 0)) {
-                parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
-            }
-            if (request.embeddedClientId) {
-                parameterBuilder.addBrokerParameters({
-                    brokerClientId: this.config.authOptions.clientId,
-                    brokerRedirectUri: this.config.authOptions.redirectUri,
-                });
-            }
-            this.addExtraQueryParams(request, parameterBuilder);
-            if (request.platformBroker) {
-                // signal ests that this is a WAM call
-                parameterBuilder.addNativeBroker();
-                // pass the req_cnf for POP
-                if (request.authenticationScheme === AuthenticationScheme.POP) {
-                    const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                    // req_cnf is always sent as a string for SPAs
-                    let reqCnfData;
-                    if (!request.popKid) {
-                        const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                        reqCnfData = generatedReqCnfData.reqCnfString;
-                    }
-                    else {
-                        reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
-                    }
-                    parameterBuilder.addPopToken(reqCnfData);
-                }
-            }
-            return parameterBuilder.createQueryString();
+            instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            return mapToQueryString(parameters);
         }
         /**
          * This API validates the `EndSessionRequest` and creates a URL
          * @param request
          */
         createLogoutUrlQueryString(request) {
-            const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+            const parameters = new Map();
             if (request.postLogoutRedirectUri) {
-                parameterBuilder.addPostLogoutRedirectUri(request.postLogoutRedirectUri);
+                addPostLogoutRedirectUri(parameters, request.postLogoutRedirectUri);
             }
             if (request.correlationId) {
-                parameterBuilder.addCorrelationId(request.correlationId);
+                addCorrelationId(parameters, request.correlationId);
             }
             if (request.idTokenHint) {
-                parameterBuilder.addIdTokenHint(request.idTokenHint);
+                addIdTokenHint(parameters, request.idTokenHint);
             }
             if (request.state) {
-                parameterBuilder.addState(request.state);
+                addState(parameters, request.state);
             }
             if (request.logoutHint) {
-                parameterBuilder.addLogoutHint(request.logoutHint);
-            }
-            this.addExtraQueryParams(request, parameterBuilder);
-            return parameterBuilder.createQueryString();
-        }
-        addExtraQueryParams(request, parameterBuilder) {
-            const hasRequestInstanceAware = request.extraQueryParameters &&
-                request.extraQueryParameters.hasOwnProperty("instance_aware");
-            // Set instance_aware flag if config auth param is set
-            if (!hasRequestInstanceAware && this.config.authOptions.instanceAware) {
-                request.extraQueryParameters = request.extraQueryParameters || {};
-                request.extraQueryParameters["instance_aware"] = "true";
+                addLogoutHint(parameters, request.logoutHint);
             }
             if (request.extraQueryParameters) {
-                parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+                addExtraQueryParameters(parameters, request.extraQueryParameters);
             }
-        }
-        /**
-         * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
-         * @param account
-         */
-        extractAccountSid(account) {
-            return account.idTokenClaims?.sid || null;
-        }
-        extractLoginHint(account) {
-            return account.idTokenClaims?.login_hint || null;
+            if (this.config.authOptions.instanceAware) {
+                addInstanceAware(parameters);
+            }
+            return mapToQueryString(parameters);
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7678,18 +7380,7 @@
             const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
             const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
             const headers = this.createTokenRequestHeaders(request.ccsCredential);
-            const thumbprint = {
-                clientId: request.tokenBodyParameters?.clientId ||
-                    this.config.authOptions.clientId,
-                authority: authority.canonicalAuthority,
-                scopes: request.scopes,
-                claims: request.claims,
-                authenticationScheme: request.authenticationScheme,
-                resourceRequestMethod: request.resourceRequestMethod,
-                resourceRequestUri: request.resourceRequestUri,
-                shrClaims: request.shrClaims,
-                sshKid: request.sshKid,
-            };
+            const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
             return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint);
         }
         /**
@@ -7698,31 +7389,30 @@
          */
         async createTokenRequestBody(request) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);
-            const correlationId = request.correlationId;
-            const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
-            parameterBuilder.addClientId(request.embeddedClientId ||
+            const parameters = new Map();
+            addClientId(parameters, request.embeddedClientId ||
                 request.tokenBodyParameters?.[CLIENT_ID] ||
                 this.config.authOptions.clientId);
             if (request.redirectUri) {
-                parameterBuilder.addRedirectUri(request.redirectUri);
-            }
-            parameterBuilder.addScopes(request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
-            parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
-            parameterBuilder.addClientInfo();
-            parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-            parameterBuilder.addThrottling();
+                addRedirectUri(parameters, request.redirectUri);
+            }
+            addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+            addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
+            addClientInfo(parameters);
+            addLibraryInfo(parameters, this.config.libraryInfo);
+            addApplicationTelemetry(parameters, this.config.telemetry.application);
+            addThrottling(parameters);
             if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
-                parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
+                addServerTelemetry(parameters, this.serverTelemetryManager);
             }
-            parameterBuilder.addRefreshToken(request.refreshToken);
+            addRefreshToken(parameters, request.refreshToken);
             if (this.config.clientCredentials.clientSecret) {
-                parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
+                addClientSecret(parameters, this.config.clientCredentials.clientSecret);
             }
             if (this.config.clientCredentials.clientAssertion) {
                 const clientAssertion = this.config.clientCredentials.clientAssertion;
-                parameterBuilder.addClientAssertion(await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
-                parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
+                addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+                addClientAssertionType(parameters, clientAssertion.assertionType);
             }
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
@@ -7735,11 +7425,11 @@
                     reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
                 }
                 // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-                parameterBuilder.addPopToken(reqCnfData);
+                addPopToken(parameters, reqCnfData);
             }
             else if (request.authenticationScheme === AuthenticationScheme.SSH) {
                 if (request.sshJwk) {
-                    parameterBuilder.addSshJwk(request.sshJwk);
+                    addSshJwk(parameters, request.sshJwk);
                 }
                 else {
                     throw createClientConfigurationError(missingSshJwk);
@@ -7748,7 +7438,7 @@
             if (!StringUtils.isEmptyObj(request.claims) ||
                 (this.config.authOptions.clientCapabilities &&
                     this.config.authOptions.clientCapabilities.length > 0)) {
-                parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+                addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
             }
             if (this.config.systemOptions.preventCorsPreflight &&
                 request.ccsCredential) {
@@ -7756,7 +7446,7 @@
                     case CcsCredentialType.HOME_ACCOUNT_ID:
                         try {
                             const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);
-                            parameterBuilder.addCcsOid(clientInfo);
+                            addCcsOid(parameters, clientInfo);
                         }
                         catch (e) {
                             this.logger.verbose("Could not parse home account ID for CCS Header: " +
@@ -7764,24 +7454,22 @@
                         }
                         break;
                     case CcsCredentialType.UPN:
-                        parameterBuilder.addCcsUpn(request.ccsCredential.credential);
+                        addCcsUpn(parameters, request.ccsCredential.credential);
                         break;
                 }
             }
             if (request.embeddedClientId) {
-                parameterBuilder.addBrokerParameters({
-                    brokerClientId: this.config.authOptions.clientId,
-                    brokerRedirectUri: this.config.authOptions.redirectUri,
-                });
+                addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
             }
             if (request.tokenBodyParameters) {
-                parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+                addExtraQueryParameters(parameters, request.tokenBodyParameters);
             }
-            return parameterBuilder.createQueryString();
+            instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            return mapToQueryString(parameters);
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7875,26 +7563,250 @@
                 }
                 checkMaxAge(authTime, request.maxAge);
             }
-            return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
+            return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
+        }
+    }
+
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    const StubbedNetworkModule = {
+        sendGetRequestAsync: () => {
+            return Promise.reject(createClientAuthError(methodNotImplemented));
+        },
+        sendPostRequestAsync: () => {
+            return Promise.reject(createClientAuthError(methodNotImplemented));
+        },
+    };
+
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+     * @param config
+     * @param request
+     * @param logger
+     * @param performanceClient
+     * @returns
+     */
+    function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
+        // generate the correlationId if not set by the user and add
+        const correlationId = request.correlationId;
+        const parameters = new Map();
+        addClientId(parameters, request.embeddedClientId ||
+            request.extraQueryParameters?.[CLIENT_ID] ||
+            authOptions.clientId);
+        const requestScopes = [
+            ...(request.scopes || []),
+            ...(request.extraScopesToConsent || []),
+        ];
+        addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addRedirectUri(parameters, request.redirectUri);
+        addCorrelationId(parameters, correlationId);
+        // add response_mode. If not passed in it defaults to query.
+        addResponseMode(parameters, request.responseMode);
+        // add client_info=1
+        addClientInfo(parameters);
+        if (request.prompt) {
+            addPrompt(parameters, request.prompt);
+            performanceClient?.addFields({ prompt: request.prompt }, correlationId);
+        }
+        if (request.domainHint) {
+            addDomainHint(parameters, request.domainHint);
+            performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
+        }
+        // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
+        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+            // AAD will throw if prompt=select_account is passed with an account hint
+            if (request.sid && request.prompt === PromptValue.NONE) {
+                // SessionID is only used in silent calls
+                logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
+                addSid(parameters, request.sid);
+                performanceClient?.addFields({ sidFromRequest: true }, correlationId);
+            }
+            else if (request.account) {
+                const accountSid = extractAccountSid(request.account);
+                let accountLoginHintClaim = extractLoginHint(request.account);
+                if (accountLoginHintClaim && request.domainHint) {
+                    logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`);
+                    accountLoginHintClaim = null;
+                }
+                // If login_hint claim is present, use it over sid/username
+                if (accountLoginHintClaim) {
+                    logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
+                    addLoginHint(parameters, accountLoginHintClaim);
+                    performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                        addCcsOid(parameters, clientInfo);
+                    }
+                    catch (e) {
+                        logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                    }
+                }
+                else if (accountSid && request.prompt === PromptValue.NONE) {
+                    /*
+                     * If account and loginHint are provided, we will check account first for sid before adding loginHint
+                     * SessionId is only used in silent calls
+                     */
+                    logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
+                    addSid(parameters, accountSid);
+                    performanceClient?.addFields({ sidFromClaim: true }, correlationId);
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                        addCcsOid(parameters, clientInfo);
+                    }
+                    catch (e) {
+                        logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                    }
+                }
+                else if (request.loginHint) {
+                    logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
+                    addLoginHint(parameters, request.loginHint);
+                    addCcsUpn(parameters, request.loginHint);
+                    performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
+                }
+                else if (request.account.username) {
+                    // Fallback to account username if provided
+                    logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
+                    addLoginHint(parameters, request.account.username);
+                    performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                        addCcsOid(parameters, clientInfo);
+                    }
+                    catch (e) {
+                        logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                    }
+                }
+            }
+            else if (request.loginHint) {
+                logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
+                addLoginHint(parameters, request.loginHint);
+                addCcsUpn(parameters, request.loginHint);
+                performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
+            }
+        }
+        else {
+            logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
+        }
+        if (request.nonce) {
+            addNonce(parameters, request.nonce);
+        }
+        if (request.state) {
+            addState(parameters, request.state);
+        }
+        if (request.claims ||
+            (authOptions.clientCapabilities &&
+                authOptions.clientCapabilities.length > 0)) {
+            addClaims(parameters, request.claims, authOptions.clientCapabilities);
+        }
+        if (request.embeddedClientId) {
+            addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
+        }
+        if (request.extraQueryParameters) {
+            addExtraQueryParameters(parameters, request.extraQueryParameters);
+        }
+        if (authOptions.instanceAware) {
+            addInstanceAware(parameters);
+        }
+        return parameters;
+    }
+    /**
+     * Returns authorize endpoint with given request parameters in the query string
+     * @param authority
+     * @param requestParameters
+     * @returns
+     */
+    function getAuthorizeUrl(authority, requestParameters) {
+        const queryString = mapToQueryString(requestParameters);
+        return UrlString.appendQueryString(authority.authorizationEndpoint, queryString);
+    }
+    /**
+     * Handles the hash fragment response from public client code request. Returns a code response used by
+     * the client to exchange for a token in acquireToken.
+     * @param serverParams
+     * @param cachedState
+     */
+    function getAuthorizationCodePayload(serverParams, cachedState) {
+        // Get code response
+        validateAuthorizationResponse(serverParams, cachedState);
+        // throw when there is no auth code in the response
+        if (!serverParams.code) {
+            throw createClientAuthError(authorizationCodeMissingFromServerResponse);
+        }
+        return serverParams;
+    }
+    /**
+     * Function which validates server authorization code response.
+     * @param serverResponseHash
+     * @param requestState
+     */
+    function validateAuthorizationResponse(serverResponse, requestState) {
+        if (!serverResponse.state || !requestState) {
+            throw serverResponse.state
+                ? createClientAuthError(stateNotFound, "Cached State")
+                : createClientAuthError(stateNotFound, "Server State");
+        }
+        let decodedServerResponseState;
+        let decodedRequestState;
+        try {
+            decodedServerResponseState = decodeURIComponent(serverResponse.state);
+        }
+        catch (e) {
+            throw createClientAuthError(invalidState, serverResponse.state);
+        }
+        try {
+            decodedRequestState = decodeURIComponent(requestState);
+        }
+        catch (e) {
+            throw createClientAuthError(invalidState, serverResponse.state);
+        }
+        if (decodedServerResponseState !== decodedRequestState) {
+            throw createClientAuthError(stateMismatch);
+        }
+        // Check for error
+        if (serverResponse.error ||
+            serverResponse.error_description ||
+            serverResponse.suberror) {
+            const serverErrorNo = parseServerErrorNo(serverResponse);
+            if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
+                throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+            }
+            throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
         }
-    }
-
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
+    }
+    /**
+     * Get server error No from the error_uri
+     * @param serverResponse
+     * @returns
      */
-    const StubbedNetworkModule = {
-        sendGetRequestAsync: () => {
-            return Promise.reject(createClientAuthError(methodNotImplemented));
-        },
-        sendPostRequestAsync: () => {
-            return Promise.reject(createClientAuthError(methodNotImplemented));
-        },
-    };
+    function parseServerErrorNo(serverResponse) {
+        const errorCodePrefix = "code=";
+        const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
+        return errorCodePrefixIndex && errorCodePrefixIndex >= 0
+            ? serverResponse.error_uri?.substring(errorCodePrefixIndex + errorCodePrefix.length)
+            : undefined;
+    }
+    /**
+     * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
+     * @param account
+     */
+    function extractAccountSid(account) {
+        return account.idTokenClaims?.sid || null;
+    }
+    function extractLoginHint(account) {
+        return account.idTokenClaims?.login_hint || null;
+    }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7952,7 +7864,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8215,7 +8127,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8223,7 +8135,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8248,7 +8160,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8288,7 +8200,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8367,7 +8279,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.2.0 2025-03-04 */
+    /*! @azure/msal-common v15.3.0 2025-03-20 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10404,7 +10316,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "4.5.1";
+    const version = "4.8.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12683,7 +12595,13 @@
              *
              * The next MSAL VFuture should map these both to same value if possible
              */
-            const accessTokenEntity = createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn ? result.expiresOn.getTime() / 1000 : 0, result.extExpiresOn ? result.extExpiresOn.getTime() / 1000 : 0, base64Decode, undefined, // refreshOn
+            const accessTokenEntity = createAccessTokenEntity(result.account?.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), 
+            // Access token expiresOn stored in seconds, converting from AuthenticationResult expiresOn stored as Date
+            result.expiresOn
+                ? toSecondsFromDate(result.expiresOn)
+                : 0, result.extExpiresOn
+                ? toSecondsFromDate(result.extExpiresOn)
+                : 0, base64Decode, undefined, // refreshOn
             result.tokenType, undefined, // userAssertionHash
             request.sshKid, request.claims, claimsHash);
             const cacheRecord = {
@@ -12889,7 +12807,9 @@
         constructor(logger) {
             this.eventCallbacks = new Map();
             this.logger = logger || new Logger({});
-            this.broadcastChannel = new BroadcastChannel(BROADCAST_CHANNEL_NAME);
+            if (typeof BroadcastChannel !== "undefined") {
+                this.broadcastChannel = new BroadcastChannel(BROADCAST_CHANNEL_NAME);
+            }
             this.invokeCrossTabCallbacks = this.invokeCrossTabCallbacks.bind(this);
         }
         /**
@@ -12939,7 +12859,7 @@
                 case EventType.ACCOUNT_REMOVED:
                 case EventType.ACTIVE_ACCOUNT_CHANGED:
                     // Send event to other open tabs / MSAL instances on same domain
-                    this.broadcastChannel.postMessage(message);
+                    this.broadcastChannel?.postMessage(message);
                     break;
                 default:
                     // Emit event to callbacks registered in this instance
@@ -12972,13 +12892,13 @@
          * Listen for events broadcasted from other tabs/instances
          */
         subscribeCrossTab() {
-            this.broadcastChannel.addEventListener("message", this.invokeCrossTabCallbacks);
+            this.broadcastChannel?.addEventListener("message", this.invokeCrossTabCallbacks);
         }
         /**
          * Unsubscribe from broadcast events
          */
         unsubscribeCrossTab() {
-            this.broadcastChannel.removeEventListener("message", this.invokeCrossTabCallbacks);
+            this.broadcastChannel?.removeEventListener("message", this.invokeCrossTabCallbacks);
         }
     }
 
@@ -13100,61 +13020,6 @@
         }
     }
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    // Constant byte array length
-    const RANDOM_BYTE_ARR_LENGTH = 32;
-    /**
-     * This file defines APIs to generate PKCE codes and code verifiers.
-     */
-    /**
-     * Generates PKCE Codes. See the RFC for more information: https://tools.ietf.org/html/rfc7636
-     */
-    async function generatePkceCodes(performanceClient, logger, correlationId) {
-        performanceClient.addQueueMeasurement(PerformanceEvents.GeneratePkceCodes, correlationId);
-        const codeVerifier = invoke(generateCodeVerifier, PerformanceEvents.GenerateCodeVerifier, logger, performanceClient, correlationId)(performanceClient, logger, correlationId);
-        const codeChallenge = await invokeAsync(generateCodeChallengeFromVerifier, PerformanceEvents.GenerateCodeChallengeFromVerifier, logger, performanceClient, correlationId)(codeVerifier, performanceClient, logger, correlationId);
-        return {
-            verifier: codeVerifier,
-            challenge: codeChallenge,
-        };
-    }
-    /**
-     * Generates a random 32 byte buffer and returns the base64
-     * encoded string to be used as a PKCE Code Verifier
-     */
-    function generateCodeVerifier(performanceClient, logger, correlationId) {
-        try {
-            // Generate random values as utf-8
-            const buffer = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
-            invoke(getRandomValues, PerformanceEvents.GetRandomValues, logger, performanceClient, correlationId)(buffer);
-            // encode verifier as base64
-            const pkceCodeVerifierB64 = urlEncodeArr(buffer);
-            return pkceCodeVerifierB64;
-        }
-        catch (e) {
-            throw createBrowserAuthError(pkceNotCreated);
-        }
-    }
-    /**
-     * Creates a base64 encoded PKCE Code Challenge string from the
-     * hash created from the PKCE Code Verifier supplied
-     */
-    async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceClient, logger, correlationId) {
-        performanceClient.addQueueMeasurement(PerformanceEvents.GenerateCodeChallengeFromVerifier, correlationId);
-        try {
-            // hashed verifier
-            const pkceHashedCodeVerifier = await invokeAsync(sha256Digest, PerformanceEvents.Sha256Digest, logger, performanceClient, correlationId)(pkceCodeVerifier, performanceClient, correlationId);
-            // encode hash as base64
-            return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
-        }
-        catch (e) {
-            throw createBrowserAuthError(pkceNotCreated);
-        }
-    }
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -13217,25 +13082,6 @@
      * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
      */
     class StandardInteractionClient extends BaseInteractionClient {
-        /**
-         * Generates an auth code request tied to the url request.
-         * @param request
-         * @param pkceCodes
-         */
-        async initializeAuthorizationCodeRequest(request, pkceCodes) {
-            this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.correlationId);
-            const generatedPkceParams = pkceCodes ||
-                (await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId));
-            const authCodeRequest = {
-                ...request,
-                redirectUri: request.redirectUri,
-                code: Constants.EMPTY_STRING,
-                codeVerifier: generatedPkceParams.verifier,
-            };
-            request.codeChallenge = generatedPkceParams.challenge;
-            request.codeChallengeMethod = Constants.S256_CODE_CHALLENGE_METHOD;
-            return authCodeRequest;
-        }
         /**
          * Initializer for the logout request.
          * @param logoutRequest
@@ -13814,7 +13660,12 @@
             const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
                 nativeAccountId: request.accountId,
             })?.homeAccountId;
-            if (homeAccountIdentifier !== cachedhomeAccountId &&
+            // add exception for double brokering, please note this is temporary and will be fortified in future
+            if (request.extraParameters?.child_client_id &&
+                response.account.id !== request.accountId) {
+                this.logger.info("handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch");
+            }
+            else if (homeAccountIdentifier !== cachedhomeAccountId &&
                 response.account.id !== request.accountId) {
                 // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
                 throw createNativeAuthError(userSwitch);
@@ -13826,6 +13677,8 @@
             const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
             idTokenClaims.tid, undefined, // auth code payload
             response.account.id, this.logger);
+            // Ensure expires_in is in number format
+            response.expires_in = Number(response.expires_in);
             // generate authenticationResult
             const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
             // cache accounts and tokens in the appropriate storage
@@ -13942,7 +13795,8 @@
                 idTokenClaims: idTokenClaims,
                 accessToken: responseAccessToken,
                 fromCache: mats ? this.isResponseFromCache(mats) : false,
-                expiresOn: new Date(Number(reqTimestamp + response.expires_in) * 1000),
+                // Request timestamp and NativeResponse expires_in are in seconds, converting to Date for AuthenticationResult
+                expiresOn: toDateFromSeconds(reqTimestamp + response.expires_in),
                 tokenType: tokenType,
                 correlationId: this.correlationId,
                 state: response.state,
@@ -14472,7 +14326,7 @@
             this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
             let authCodeResponse;
             try {
-                authCodeResponse = this.authModule.handleFragmentResponse(response, request.state);
+                authCodeResponse = getAuthorizationCodePayload(response, request.state);
             }
             catch (e) {
                 if (e instanceof ServerError &&
@@ -14580,6 +14434,126 @@
         }
     }
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+     * @param config
+     * @param authority
+     * @param request
+     * @param logger
+     * @param performanceClient
+     * @returns
+     */
+    async function getStandardParameters(config, authority, request, logger, performanceClient) {
+        const parameters = getStandardAuthorizeRequestParameters({ ...config.auth, authority: authority }, request, logger, performanceClient);
+        addLibraryInfo(parameters, {
+            sku: BrowserConstants.MSAL_SKU,
+            version: version,
+            os: "",
+            cpu: "",
+        });
+        if (config.auth.protocolMode !== ProtocolMode.OIDC) {
+            addApplicationTelemetry(parameters, config.telemetry.application);
+        }
+        if (request.platformBroker) {
+            // signal ests that this is a WAM call
+            addNativeBroker(parameters);
+            // pass the req_cnf for POP
+            if (request.authenticationScheme === AuthenticationScheme.POP) {
+                const cryptoOps = new CryptoOps(logger, performanceClient);
+                const popTokenGenerator = new PopTokenGenerator(cryptoOps);
+                // req_cnf is always sent as a string for SPAs
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, logger, performanceClient, request.correlationId)(request, logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                }
+                else {
+                    reqCnfData = cryptoOps.encodeKid(request.popKid);
+                }
+                addPopToken(parameters, reqCnfData);
+            }
+        }
+        instrumentBrokerParams(parameters, request.correlationId, performanceClient);
+        return parameters;
+    }
+    /**
+     * Gets the full /authorize URL with request parameters when using Auth Code + PKCE
+     * @param config
+     * @param authority
+     * @param request
+     * @param logger
+     * @param performanceClient
+     * @returns
+     */
+    async function getAuthCodeRequestUrl(config, authority, request, logger, performanceClient) {
+        if (!request.codeChallenge) {
+            throw createClientConfigurationError(pkceParamsMissing);
+        }
+        const parameters = await invokeAsync(getStandardParameters, PerformanceEvents.GetStandardParams, logger, performanceClient, request.correlationId)(config, authority, request, logger, performanceClient);
+        addResponseTypeCode(parameters);
+        addCodeChallengeParams(parameters, request.codeChallenge, Constants.S256_CODE_CHALLENGE_METHOD);
+        return getAuthorizeUrl(authority, parameters);
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    // Constant byte array length
+    const RANDOM_BYTE_ARR_LENGTH = 32;
+    /**
+     * This file defines APIs to generate PKCE codes and code verifiers.
+     */
+    /**
+     * Generates PKCE Codes. See the RFC for more information: https://tools.ietf.org/html/rfc7636
+     */
+    async function generatePkceCodes(performanceClient, logger, correlationId) {
+        performanceClient.addQueueMeasurement(PerformanceEvents.GeneratePkceCodes, correlationId);
+        const codeVerifier = invoke(generateCodeVerifier, PerformanceEvents.GenerateCodeVerifier, logger, performanceClient, correlationId)(performanceClient, logger, correlationId);
+        const codeChallenge = await invokeAsync(generateCodeChallengeFromVerifier, PerformanceEvents.GenerateCodeChallengeFromVerifier, logger, performanceClient, correlationId)(codeVerifier, performanceClient, logger, correlationId);
+        return {
+            verifier: codeVerifier,
+            challenge: codeChallenge,
+        };
+    }
+    /**
+     * Generates a random 32 byte buffer and returns the base64
+     * encoded string to be used as a PKCE Code Verifier
+     */
+    function generateCodeVerifier(performanceClient, logger, correlationId) {
+        try {
+            // Generate random values as utf-8
+            const buffer = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
+            invoke(getRandomValues, PerformanceEvents.GetRandomValues, logger, performanceClient, correlationId)(buffer);
+            // encode verifier as base64
+            const pkceCodeVerifierB64 = urlEncodeArr(buffer);
+            return pkceCodeVerifierB64;
+        }
+        catch (e) {
+            throw createBrowserAuthError(pkceNotCreated);
+        }
+    }
+    /**
+     * Creates a base64 encoded PKCE Code Challenge string from the
+     * hash created from the PKCE Code Verifier supplied
+     */
+    async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceClient, logger, correlationId) {
+        performanceClient.addQueueMeasurement(PerformanceEvents.GenerateCodeChallengeFromVerifier, correlationId);
+        try {
+            // hashed verifier
+            const pkceHashedCodeVerifier = await invokeAsync(sha256Digest, PerformanceEvents.Sha256Digest, logger, performanceClient, correlationId)(pkceCodeVerifier, performanceClient, correlationId);
+            // encode hash as base64
+            return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
+        }
+        catch (e) {
+            throw createBrowserAuthError(pkceNotCreated);
+        }
+    }
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -14667,6 +14641,9 @@
             this.logger.verbose("acquireTokenPopupAsync called");
             const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenPopup);
             const validRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, exports.InteractionType.Popup);
+            const pkce = pkceCodes ||
+                (await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId));
+            validRequest.codeChallenge = pkce.challenge;
             /*
              * Skip pre-connect for async popups to reduce time between user interaction and popup window creation to avoid
              * popup from being blocked by browsers with shorter popup timers
@@ -14675,8 +14652,6 @@
                 preconnect(validRequest.authority);
             }
             try {
-                // Create auth code request and generate PKCE params
-                const authCodeRequest = await invokeAsync(this.initializeAuthorizationCodeRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.logger, this.performanceClient, this.correlationId)(validRequest, pkceCodes);
                 // Initialize the client
                 const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
                     serverTelemetryManager,
@@ -14693,12 +14668,10 @@
                         this.performanceClient.startMeasurement(PerformanceEvents.FetchAccountIdWithNativeBroker, request.correlationId);
                 }
                 // Create acquire token url.
-                const navigateUrl = await authClient.getAuthCodeUrl({
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, validRequest.correlationId)(this.config, authClient.authority, {
                     ...validRequest,
                     platformBroker: isPlatformBroker,
-                });
-                // Create popup interaction handler.
-                const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
+                }, this.logger, this.performanceClient);
                 // Show the UI once the url has been created. Get the window handle for the popup.
                 const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
@@ -14706,7 +14679,7 @@
                 const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
                 const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
                 // Remove throttle if it exists
-                ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
+                ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, validRequest);
                 if (serverParams.accountId) {
                     this.logger.verbose("Account id found in hash, calling WAM for token");
                     // end measurement for server call with native brokering enabled
@@ -14727,6 +14700,13 @@
                         prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
                     });
                 }
+                const authCodeRequest = {
+                    ...validRequest,
+                    code: serverParams.code || "",
+                    codeVerifier: pkce.verifier,
+                };
+                // Create popup interaction handler.
+                const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
                 // Handle response from hash string.
                 const result = await interactionHandler.handleCodeResponse(serverParams, validRequest);
                 return result;
@@ -15102,7 +15082,7 @@
             }
             let authCodeResponse;
             try {
-                authCodeResponse = this.authModule.handleFragmentResponse(response, requestState);
+                authCodeResponse = getAuthorizationCodePayload(response, requestState);
             }
             catch (e) {
                 if (e instanceof ServerError &&
@@ -15186,6 +15166,8 @@
          */
         async acquireToken(request) {
             const validRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, exports.InteractionType.Redirect);
+            const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId);
+            validRequest.codeChallenge = pkceCodes.challenge;
             this.browserStorage.updateCacheEntries(validRequest.state, validRequest.nonce, validRequest.authority, validRequest.loginHint || "", validRequest.account || null);
             const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenRedirect);
             const handleBackButton = (event) => {
@@ -15197,8 +15179,6 @@
                 }
             };
             try {
-                // Create auth code request and generate PKCE params
-                const authCodeRequest = await invokeAsync(this.initializeAuthorizationCodeRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.logger, this.performanceClient, this.correlationId)(validRequest);
                 // Initialize the client
                 const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
                     serverTelemetryManager,
@@ -15207,13 +15187,18 @@
                     requestExtraQueryParameters: validRequest.extraQueryParameters,
                     account: validRequest.account,
                 });
+                const authCodeRequest = {
+                    ...validRequest,
+                    code: "",
+                    codeVerifier: pkceCodes.verifier,
+                };
                 // Create redirect interaction handler.
                 const interactionHandler = new RedirectHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
                 // Create acquire token url.
-                const navigateUrl = await authClient.getAuthCodeUrl({
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, validRequest.correlationId)(this.config, authClient.authority, {
                     ...validRequest,
                     platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme),
-                });
+                }, this.logger, this.performanceClient);
                 const redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
                 this.logger.verbosePii(`Redirect start page: ${redirectStartPage}`);
                 // Clear temporary cache if the back button is clicked during the redirect flow.
@@ -15718,18 +15703,19 @@
          * @param navigateUrl
          * @param userRequestScopes
          */
-        async silentTokenHelper(authClient, silentRequest) {
-            const correlationId = silentRequest.correlationId;
+        async silentTokenHelper(authClient, request) {
+            const correlationId = request.correlationId;
             this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentIframeClientTokenHelper, correlationId);
-            // Create auth code request and generate PKCE params
-            const authCodeRequest = await invokeAsync(this.initializeAuthorizationCodeRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.logger, this.performanceClient, correlationId)(silentRequest);
+            const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId);
+            const silentRequest = {
+                ...request,
+                codeChallenge: pkceCodes.challenge,
+            };
             // Create authorize request url
-            const navigateUrl = await invokeAsync(authClient.getAuthCodeUrl.bind(authClient), PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)({
+            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, {
                 ...silentRequest,
                 platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme),
-            });
-            // Create silent handler
-            const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
+            }, this.logger, this.performanceClient);
             // Get the frame handle for the silent request
             const msalFrame = await invokeAsync(initiateAuthRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
             const responseType = this.config.auth.OIDCOptions.serverResponseType;
@@ -15749,6 +15735,13 @@
                     prompt: silentRequest.prompt || PromptValue.NONE,
                 });
             }
+            const authCodeRequest = {
+                ...silentRequest,
+                code: serverParams.code || "",
+                codeVerifier: pkceCodes.verifier,
+            };
+            // Create silent handler
+            const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
             // Handle response from hash string
             return invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, this.logger, this.performanceClient, correlationId)(serverParams, silentRequest);
         }
@@ -15943,11 +15936,10 @@
             const scopes = response.scope
                 ? ScopeSet.fromString(response.scope)
                 : new ScopeSet(request.scopes);
-            const expiresOn = options.expiresOn ||
-                response.expires_in + new Date().getTime() / 1000;
+            const expiresOn = options.expiresOn || response.expires_in + nowSeconds();
             const extendedExpiresOn = options.extendedExpiresOn ||
                 (response.ext_expires_in || response.expires_in) +
-                    new Date().getTime() / 1000;
+                    nowSeconds();
             const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
             await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
             return accessTokenEntity;
@@ -15987,8 +15979,9 @@
             if (cacheRecord?.accessToken) {
                 accessToken = cacheRecord.accessToken.secret;
                 responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
-                expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
-                extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+                // Access token expiresOn stored in seconds, converting to Date for AuthenticationResult
+                expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
+                extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
             }
             const accountEntity = cacheRecord.account;
             return {
@@ -17235,60 +17228,63 @@
                 throw createBrowserAuthError(noAccountError);
             }
             atsMeasurement.add({ accountType: getAccountType(account) });
-            const thumbprint = {
-                clientId: this.config.auth.clientId,
-                authority: request.authority || Constants.EMPTY_STRING,
-                scopes: request.scopes,
-                homeAccountIdentifier: account.homeAccountId,
-                claims: request.claims,
-                authenticationScheme: request.authenticationScheme,
-                resourceRequestMethod: request.resourceRequestMethod,
-                resourceRequestUri: request.resourceRequestUri,
-                shrClaims: request.shrClaims,
-                sshKid: request.sshKid,
-                shrOptions: request.shrOptions,
-            };
+            return this.acquireTokenSilentDeduped(request, account, correlationId)
+                .then((result) => {
+                atsMeasurement.end({
+                    success: true,
+                    fromCache: result.fromCache,
+                    isNativeBroker: result.fromNativeBroker,
+                    accessTokenSize: result.accessToken.length,
+                    idTokenSize: result.idToken.length,
+                });
+                return {
+                    ...result,
+                    state: request.state,
+                    correlationId: correlationId, // Ensures PWB scenarios can correctly match request to response
+                };
+            })
+                .catch((error) => {
+                if (error instanceof AuthError) {
+                    // Ensures PWB scenarios can correctly match request to response
+                    error.setCorrelationId(correlationId);
+                }
+                atsMeasurement.end({
+                    success: false,
+                }, error);
+                throw error;
+            });
+        }
+        /**
+         * Checks if identical request is already in flight and returns reference to the existing promise or fires off a new one if this is the first
+         * @param request
+         * @param account
+         * @param correlationId
+         * @returns
+         */
+        async acquireTokenSilentDeduped(request, account, correlationId) {
+            const thumbprint = getRequestThumbprint(this.config.auth.clientId, {
+                ...request,
+                authority: request.authority || this.config.auth.authority,
+                correlationId: correlationId,
+            }, account.homeAccountId);
             const silentRequestKey = JSON.stringify(thumbprint);
-            const cachedResponse = this.activeSilentTokenRequests.get(silentRequestKey);
-            if (typeof cachedResponse === "undefined") {
+            const inProgressRequest = this.activeSilentTokenRequests.get(silentRequestKey);
+            if (typeof inProgressRequest === "undefined") {
                 this.logger.verbose("acquireTokenSilent called for the first time, storing active request", correlationId);
-                const response = invokeAsync(this.acquireTokenSilentAsync.bind(this), PerformanceEvents.AcquireTokenSilentAsync, this.logger, this.performanceClient, correlationId)({
+                this.performanceClient.addFields({ deduped: false }, correlationId);
+                const activeRequest = invokeAsync(this.acquireTokenSilentAsync.bind(this), PerformanceEvents.AcquireTokenSilentAsync, this.logger, this.performanceClient, correlationId)({
                     ...request,
                     correlationId,
-                }, account)
-                    .then((result) => {
-                    this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.end({
-                        success: true,
-                        fromCache: result.fromCache,
-                        isNativeBroker: result.fromNativeBroker,
-                        cacheLookupPolicy: request.cacheLookupPolicy,
-                        accessTokenSize: result.accessToken.length,
-                        idTokenSize: result.idToken.length,
-                    });
-                    return result;
-                })
-                    .catch((error) => {
+                }, account);
+                this.activeSilentTokenRequests.set(silentRequestKey, activeRequest);
+                return activeRequest.finally(() => {
                     this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.end({
-                        success: false,
-                    }, error);
-                    throw error;
                 });
-                this.activeSilentTokenRequests.set(silentRequestKey, response);
-                return {
-                    ...(await response),
-                    state: request.state,
-                };
             }
             else {
                 this.logger.verbose("acquireTokenSilent has been called previously, returning the result from the first call", correlationId);
-                // Discard measurements for memoized calls, as they are usually only a couple of ms and will artificially deflate metrics
-                atsMeasurement.discard();
-                return {
-                    ...(await cachedResponse),
-                    state: request.state,
-                };
+                this.performanceClient.addFields({ deduped: true }, correlationId);
+                return inProgressRequest;
             }
         }
         /**
@@ -17499,8 +17495,7 @@
                 extraParams = new Map(Object.entries(request.extraQueryParameters));
             }
             const correlationId = request.correlationId || this.crypto.createNewGuid();
-            const requestBuilder = new RequestParameterBuilder(correlationId);
-            const claims = requestBuilder.addClientCapabilitiesToClaims(request.claims, this.clientCapabilities);
+            const claims = addClientCapabilitiesToClaims(request.claims, this.clientCapabilities);
             const scopes = request.scopes || OIDC_DEFAULT_SCOPES;
             const tokenRequest = {
                 platformBrokerId: request.account?.homeAccountId,
@@ -17519,7 +17514,8 @@
             if (!response.token.id_token || !response.token.access_token) {
                 throw createClientAuthError(nullOrEmptyToken);
             }
-            const expiresOn = new Date((reqTimestamp + (response.token.expires_in || 0)) * 1000);
+            // Request timestamp and AuthResult expires_in are in seconds, converting to Date for AuthenticationResult
+            const expiresOn = toDateFromSeconds(reqTimestamp + (response.token.expires_in || 0));
             const idTokenClaims = extractTokenClaims(response.token.id_token, this.crypto.base64Decode);
             const account = this.fromNaaAccountInfo(response.account, response.token.id_token, idTokenClaims);
             const scopes = response.token.scope || request.scope;
@@ -17648,10 +17644,10 @@
                 idTokenClaims: idTokenClaims || {},
                 accessToken: accessToken.secret,
                 fromCache: true,
-                expiresOn: new Date(Number(accessToken.expiresOn) * 1000),
+                expiresOn: toDateFromSeconds(accessToken.expiresOn),
+                extExpiresOn: toDateFromSeconds(accessToken.extendedExpiresOn),
                 tokenType: request.authenticationScheme || AuthenticationScheme.BEARER,
                 correlationId,
-                extExpiresOn: new Date(Number(accessToken.extendedExpiresOn) * 1000),
                 state: request.state,
             };
             return authenticationResult;