@azure/msal-browser 4.8.0 → 4.9.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v4.8.0 2025-03-20 */
+/*! @azure/msal-browser v4.9.0 2025-03-25 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -41,11 +41,8 @@
         PROFILE_SCOPE: "profile",
         OFFLINE_ACCESS_SCOPE: "offline_access",
         EMAIL_SCOPE: "email",
-        // Default response type for authorization code flow
-        CODE_RESPONSE_TYPE: "code",
         CODE_GRANT_TYPE: "authorization_code",
         RT_GRANT_TYPE: "refresh_token",
-        FRAGMENT_RESPONSE_MODE: "fragment",
         S256_CODE_CHALLENGE_METHOD: "S256",
         URL_FORM_CONTENT_TYPE: "application/x-www-form-urlencoded;charset=utf-8",
         AUTHORIZATION_PENDING: "authorization_pending",
@@ -65,8 +62,6 @@
             "login.microsoft.com",
             "sts.windows.net",
         ],
-        TOKEN_RESPONSE_TYPE: "token",
-        ID_TOKEN_RESPONSE_TYPE: "id_token",
         SHR_NONCE_VALIDITY: 240,
         INVALID_INSTANCE: "invalid_instance",
     };
@@ -150,8 +145,17 @@
         PLAIN: "plain",
         S256: "S256",
     };
+    /**
+     * Allowed values for response_type
+     */
+    const OAuthResponseType = {
+        CODE: "code",
+        IDTOKEN_TOKEN: "id_token token",
+        IDTOKEN_TOKEN_REFRESHTOKEN: "id_token token refresh_token",
+    };
     /**
      * allowed values for server response type
+     * @deprecated Use ResponseMode instead
      */
     const ServerResponseType = {
         QUERY: "query",
@@ -161,7 +165,8 @@
      * allowed values for response_mode
      */
     const ResponseMode = {
-        ...ServerResponseType,
+        QUERY: "query",
+        FRAGMENT: "fragment",
         FORM_POST: "form_post",
     };
     /**
@@ -303,7 +308,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -320,7 +325,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -369,7 +374,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -467,7 +472,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -719,7 +724,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -758,7 +763,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -949,12 +954,12 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "15.3.0";
+    const version$1 = "15.4.0";
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -974,7 +979,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1035,7 +1040,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1090,7 +1095,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1417,7 +1422,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1471,7 +1476,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1609,7 +1614,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1706,7 +1711,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1897,7 +1902,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1937,7 +1942,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2016,7 +2021,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2031,7 +2036,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2053,7 +2058,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2062,11 +2067,22 @@
      * Protocol modes supported by MSAL.
      */
     const ProtocolMode = {
+        /**
+         * Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
+         */
         AAD: "AAD",
+        /**
+         * Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
+         * Support is limited for this mode.
+         */
         OIDC: "OIDC",
+        /**
+         * Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
+         */
+        EAR: "EAR",
     };
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2162,11 +2178,11 @@
             if (authority.authorityType === AuthorityType.Adfs) {
                 account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
             }
-            else if (authority.protocolMode === ProtocolMode.AAD) {
-                account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
+            else if (authority.protocolMode === ProtocolMode.OIDC) {
+                account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
             }
             else {
-                account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
+                account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
             }
             let clientInfo;
             if (accountDetails.clientInfo && base64Decode) {
@@ -2309,7 +2325,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2344,6 +2360,7 @@
             const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
             // Check for known response properties
             if (deserializedHash.code ||
+                deserializedHash.ear_jwe ||
                 deserializedHash.error ||
                 deserializedHash.error_description ||
                 deserializedHash.state) {
@@ -2366,7 +2383,7 @@
         return queryParameterArray.join("&");
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2530,7 +2547,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2670,7 +2687,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2678,7 +2695,7 @@
     const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
     const cacheUnknownErrorCode = "cache_error_unknown";
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2705,7 +2722,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3890,7 +3907,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3989,7 +4006,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3999,7 +4016,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4045,9 +4062,11 @@
     const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
     const BROKER_CLIENT_ID = "brk_client_id";
     const BROKER_REDIRECT_URI = "brk_redirect_uri";
-    const INSTANCE_AWARE = "instance_aware";
+    const INSTANCE_AWARE = "instance_aware";
+    const EAR_JWK = "ear_jwk";
+    const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4066,10 +4085,12 @@
         }
     }
     /**
-     * add response_type = code
+     * Add the given response_type
+     * @param parameters
+     * @param responseType
      */
-    function addResponseTypeCode(parameters) {
-        parameters.set(RESPONSE_TYPE, Constants.CODE_RESPONSE_TYPE);
+    function addResponseType(parameters, responseType) {
+        parameters.set(RESPONSE_TYPE, responseType);
     }
     /**
      * add response_mode. defaults to query.
@@ -4400,9 +4421,20 @@
         if (!parameters.has(BROKER_REDIRECT_URI)) {
             parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
         }
+    }
+    /**
+     * Add EAR (Encrypted Authorize Response) request parameters
+     * @param parameters
+     * @param jwk
+     */
+    function addEARParameters(parameters, jwk) {
+        parameters.set(EAR_JWK, encodeURIComponent(jwk));
+        // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
+        const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
+        parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4414,7 +4446,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4424,7 +4456,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4434,7 +4466,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4620,6 +4652,9 @@
          */
         HandleCodeResponseFromServer: "handleCodeResponseFromServer",
         HandleCodeResponse: "handleCodeResponse",
+        HandleResponseEar: "handleResponseEar",
+        HandleResponsePlatformBroker: "handleResponsePlatformBroker",
+        HandleResponseCode: "handleResponseCode",
         UpdateTokenEndpointAuthority: "updateTokenEndpointAuthority",
         /**
          * APIs in Authorization Code Client (msal-common)
@@ -4686,6 +4721,8 @@
         UrlEncodeArr: "urlEncodeArr",
         Encrypt: "encrypt",
         Decrypt: "decrypt",
+        GenerateEarKey: "generateEarKey",
+        DecryptEarResponse: "decryptEarResponse",
     };
     const PerformanceEventAbbreviations = new Map([
         [PerformanceEvents.AcquireTokenByCode, "ATByCode"],
@@ -4803,6 +4840,12 @@
             "HandleCodeResFromServer",
         ],
         [PerformanceEvents.HandleCodeResponse, "HandleCodeResp"],
+        [PerformanceEvents.HandleResponseEar, "HandleRespEar"],
+        [PerformanceEvents.HandleResponseCode, "HandleRespCode"],
+        [
+            PerformanceEvents.HandleResponsePlatformBroker,
+            "HandleRespPlatBroker",
+        ],
         [PerformanceEvents.UpdateTokenEndpointAuthority, "UpdTEndpointAuth"],
         [PerformanceEvents.AuthClientAcquireToken, "AuthClientAT"],
         [PerformanceEvents.AuthClientExecuteTokenRequest, "AuthClientExecTReq"],
@@ -4905,6 +4948,8 @@
         [PerformanceEvents.UrlEncodeArr, "urlEncArr"],
         [PerformanceEvents.Encrypt, "encrypt"],
         [PerformanceEvents.Decrypt, "decrypt"],
+        [PerformanceEvents.GenerateEarKey, "genEarKey"],
+        [PerformanceEvents.DecryptEarResponse, "decryptEarResp"],
     ]);
     /**
      * State of the performance event.
@@ -4934,7 +4979,7 @@
         "encryptedCacheExpiredCount",
     ]);
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5030,7 +5075,7 @@
         };
     };
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5139,7 +5184,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5317,7 +5362,7 @@
             return (authorityUri.PathSegments.length === 1 &&
                 !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0]) &&
                 this.getAuthorityType(authorityUri) === AuthorityType.Default &&
-                this.protocolMode === ProtocolMode.AAD);
+                this.protocolMode !== ProtocolMode.OIDC);
         }
         /**
          * Replaces tenant in url path with current tenant. Defaults to common.
@@ -5364,7 +5409,7 @@
             const canonicalAuthorityHost = this.hostnameAndPort;
             if (this.canonicalAuthority.endsWith("v2.0/") ||
                 this.authorityType === AuthorityType.Adfs ||
-                (this.protocolMode !== ProtocolMode.AAD &&
+                (this.protocolMode === ProtocolMode.OIDC &&
                     !this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost))) {
                 return `${this.canonicalAuthority}.well-known/openid-configuration`;
             }
@@ -5978,7 +6023,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6009,7 +6054,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6028,7 +6073,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6049,7 +6094,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6136,7 +6181,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6166,7 +6211,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6314,7 +6359,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6340,7 +6385,7 @@
         refreshTokenExpired: refreshTokenExpired
     });
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6428,7 +6473,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6500,7 +6545,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6584,7 +6629,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6611,7 +6656,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6942,7 +6987,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7009,7 +7054,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7027,7 +7072,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7260,7 +7305,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7469,7 +7514,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7567,7 +7612,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7582,7 +7627,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7711,10 +7756,10 @@
         if (request.embeddedClientId) {
             addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
         }
-        if (request.extraQueryParameters) {
-            addExtraQueryParameters(parameters, request.extraQueryParameters);
-        }
-        if (authOptions.instanceAware) {
+        // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
+        if (authOptions.instanceAware &&
+            (!request.extraQueryParameters ||
+                !Object.keys(request.extraQueryParameters).includes(INSTANCE_AWARE))) {
             addInstanceAware(parameters);
         }
         return parameters;
@@ -7806,7 +7851,7 @@
         return account.idTokenClaims?.login_hint || null;
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7864,7 +7909,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8127,7 +8172,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8135,7 +8180,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8160,7 +8205,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8200,7 +8245,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8279,7 +8324,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.3.0 2025-03-20 */
+    /*! @azure/msal-common v15.4.0 2025-03-25 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8893,6 +8938,8 @@
      * Licensed under the MIT License.
      */
     const pkceNotCreated = "pkce_not_created";
+    const earJwkEmpty = "ear_jwk_empty";
+    const earJweEmpty = "ear_jwe_empty";
     const cryptoNonExistent = "crypto_nonexistent";
     const emptyNavigateUri = "empty_navigate_uri";
     const hashEmptyError = "hash_empty_error";
@@ -8915,7 +8962,6 @@
     const silentPromptValueError = "silent_prompt_value_error";
     const noTokenRequestCacheError = "no_token_request_cache_error";
     const unableToParseTokenRequestCacheError = "unable_to_parse_token_request_cache_error";
-    const noCachedAuthorityError = "no_cached_authority_error";
     const authRequestNotSetError = "auth_request_not_set_error";
     const invalidCacheType = "invalid_cache_type";
     const nonBrowserEnvironment = "non_browser_environment";
@@ -8939,7 +8985,8 @@
     const invalidBase64String = "invalid_base64_string";
     const invalidPopTokenRequest = "invalid_pop_token_request";
     const failedToBuildHeaders = "failed_to_build_headers";
-    const failedToParseHeaders = "failed_to_parse_headers";
+    const failedToParseHeaders = "failed_to_parse_headers";
+    const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
 
     var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -8952,9 +8999,12 @@
         cryptoNonExistent: cryptoNonExistent,
         databaseNotOpen: databaseNotOpen,
         databaseUnavailable: databaseUnavailable,
+        earJweEmpty: earJweEmpty,
+        earJwkEmpty: earJwkEmpty,
         emptyNavigateUri: emptyNavigateUri,
         emptyWindowError: emptyWindowError,
         failedToBuildHeaders: failedToBuildHeaders,
+        failedToDecryptEarResponse: failedToDecryptEarResponse,
         failedToParseHeaders: failedToParseHeaders,
         failedToParseResponse: failedToParseResponse,
         getRequestFailed: getRequestFailed,
@@ -8972,7 +9022,6 @@
         nativeHandshakeTimeout: nativeHandshakeTimeout,
         nativePromptNotSupported: nativePromptNotSupported,
         noAccountError: noAccountError,
-        noCachedAuthorityError: noCachedAuthorityError,
         noNetworkConnectivity: noNetworkConnectivity,
         noStateInHash: noStateInHash,
         noTokenRequestCacheError: noTokenRequestCacheError,
@@ -9003,6 +9052,8 @@
      */
     const BrowserAuthErrorMessages = {
         [pkceNotCreated]: "The PKCE code challenge and verifier could not be generated.",
+        [earJwkEmpty]: "No EAR encryption key provided. This is unexpected.",
+        [earJweEmpty]: "Server response does not contain ear_jwe property. This is unexpected.",
         [cryptoNonExistent]: "The crypto object or function is not available.",
         [emptyNavigateUri]: "Navigation URI is empty. Please check stack trace for more info.",
         [hashEmptyError]: `Hash value cannot be processed because it is empty. Please verify that your redirectUri is not clearing the hash. ${ErrorLink}`,
@@ -9025,7 +9076,6 @@
         [silentPromptValueError]: "The value given for the prompt value is not valid for silent requests - must be set to 'none' or 'no_session'.",
         [noTokenRequestCacheError]: "No token request found in cache.",
         [unableToParseTokenRequestCacheError]: "The cached token request could not be parsed.",
-        [noCachedAuthorityError]: "No cached authority found.",
         [authRequestNotSetError]: "Auth Request not set. Please ensure initiateAuthRequest was called from the InteractionHandler",
         [invalidCacheType]: "Invalid cache type",
         [nonBrowserEnvironment]: "Login and token requests are not supported in non-browser environments.",
@@ -9050,6 +9100,7 @@
         [invalidPopTokenRequest]: "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
         [failedToBuildHeaders]: "Failed to build request headers object.",
         [failedToParseHeaders]: "Failed to parse response headers",
+        [failedToDecryptEarResponse]: "Failed to decrypt ear response",
     };
     /**
      * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9152,10 +9203,6 @@
             code: unableToParseTokenRequestCacheError,
             desc: BrowserAuthErrorMessages[unableToParseTokenRequestCacheError],
         },
-        noCachedAuthorityError: {
-            code: noCachedAuthorityError,
-            desc: BrowserAuthErrorMessages[noCachedAuthorityError],
-        },
         authRequestNotSet: {
             code: authRequestNotSetError,
             desc: BrowserAuthErrorMessages[authRequestNotSetError],
@@ -9323,21 +9370,12 @@
      * Temporary cache keys for MSAL, deleted after any request.
      */
     const TemporaryCacheKeys = {
-        AUTHORITY: "authority",
-        ACQUIRE_TOKEN_ACCOUNT: "acquireToken.account",
-        SESSION_STATE: "session.state",
-        REQUEST_STATE: "request.state",
-        NONCE_IDTOKEN: "nonce.id_token",
         ORIGIN_URI: "request.origin",
-        RENEW_STATUS: "token.renew.status",
         URL_HASH: "urlHash",
         REQUEST_PARAMS: "request.params",
-        SCOPES: "scopes",
+        VERIFIER: "code.verifier",
         INTERACTION_STATUS_KEY: "interaction.status",
-        CCS_CREDENTIAL: "ccs.credential",
-        CORRELATION_ID: "request.correlationId",
         NATIVE_REQUEST: "request.native",
-        REDIRECT_CONTEXT: "request.redirect.context",
     };
     const StaticCacheKeys = {
         ACCOUNT_KEYS: "msal.account.keys",
@@ -9707,6 +9745,69 @@
     async function sign(key, data) {
         return window.crypto.subtle.sign(keygenAlgorithmOptions, key, data);
     }
+    /**
+     * Generates Base64 encoded jwk used in the Encrypted Authorize Response (EAR) flow
+     */
+    async function generateEarKey() {
+        const key = await generateBaseKey();
+        const keyStr = urlEncodeArr(new Uint8Array(key));
+        const jwk = {
+            alg: "dir",
+            kty: "oct",
+            k: keyStr,
+        };
+        return base64Encode(JSON.stringify(jwk));
+    }
+    /**
+     * Parses earJwk for encryption key and returns CryptoKey object
+     * @param earJwk
+     * @returns
+     */
+    async function importEarKey(earJwk) {
+        const b64DecodedJwk = base64Decode(earJwk);
+        const jwkJson = JSON.parse(b64DecodedJwk);
+        const rawKey = jwkJson.k;
+        const keyBuffer = base64DecToArr(rawKey);
+        return window.crypto.subtle.importKey(RAW, keyBuffer, AES_GCM, false, [
+            DECRYPT,
+        ]);
+    }
+    /**
+     * Decrypt ear_jwe response returned in the Encrypted Authorize Response (EAR) flow
+     * @param earJwk
+     * @param earJwe
+     * @returns
+     */
+    async function decryptEarResponse(earJwk, earJwe) {
+        const earJweParts = earJwe.split(".");
+        if (earJweParts.length !== 5) {
+            throw createBrowserAuthError(failedToDecryptEarResponse, "jwe_length");
+        }
+        const key = await importEarKey(earJwk).catch(() => {
+            throw createBrowserAuthError(failedToDecryptEarResponse, "import_key");
+        });
+        try {
+            const header = new TextEncoder().encode(earJweParts[0]);
+            const iv = base64DecToArr(earJweParts[2]);
+            const ciphertext = base64DecToArr(earJweParts[3]);
+            const tag = base64DecToArr(earJweParts[4]);
+            const tagLengthBits = tag.byteLength * 8;
+            // Concat ciphertext and tag
+            const encryptedData = new Uint8Array(ciphertext.length + tag.length);
+            encryptedData.set(ciphertext);
+            encryptedData.set(tag, ciphertext.length);
+            const decryptedData = await window.crypto.subtle.decrypt({
+                name: AES_GCM,
+                iv: iv,
+                tagLength: tagLengthBits,
+                additionalData: header,
+            }, key, encryptedData);
+            return new TextDecoder().decode(decryptedData);
+        }
+        catch (e) {
+            throw createBrowserAuthError(failedToDecryptEarResponse, "decrypt");
+        }
+    }
     /**
      * Generates symmetric base encryption key. This may be stored as all encryption/decryption keys will be derived from this one.
      */
@@ -10292,9 +10393,9 @@
             const logger = new Logger(providedSystemOptions.loggerOptions);
             logger.warning(JSON.stringify(createClientConfigurationError(cannotSetOIDCOptions)));
         }
-        // Throw an error if user has set allowPlatformBroker to true without being in AAD protocol mode
+        // Throw an error if user has set allowPlatformBroker to true with OIDC protocol mode
         if (userInputAuth?.protocolMode &&
-            userInputAuth.protocolMode !== ProtocolMode.AAD &&
+            userInputAuth.protocolMode === ProtocolMode.OIDC &&
             providedSystemOptions?.allowPlatformBroker) {
             throw createClientConfigurationError(cannotAllowPlatformBroker);
         }
@@ -10311,12 +10412,21 @@
             system: providedSystemOptions,
             telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...userInputTelemetry },
         };
+        /**
+         * Temporarily disable EAR until implementation is complete
+         * TODO: Remove this
+         */
+        if (overlayedConfig.auth.protocolMode === ProtocolMode.EAR) {
+            const logger = new Logger(providedSystemOptions.loggerOptions);
+            logger.warning("EAR Protocol Mode is not yet supported. Overriding to use PKCE auth");
+            overlayedConfig.auth.protocolMode = ProtocolMode.AAD;
+        }
         return overlayedConfig;
     }
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "4.8.0";
+    const version = "4.9.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11637,28 +11747,6 @@
         }
     }
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Extracts the BrowserStateObject from the state string.
-     * @param browserCrypto
-     * @param state
-     */
-    function extractBrowserRequestState(browserCrypto, state) {
-        if (!state) {
-            return null;
-        }
-        try {
-            const requestStateObj = ProtocolUtils.parseRequestState(browserCrypto, state);
-            return requestStateObj.libraryState.meta;
-        }
-        catch (e) {
-            throw createClientAuthError(invalidState);
-        }
-    }
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -12358,177 +12446,53 @@
             }
             return JSON.stringify(key);
         }
-        /**
-         * Create authorityKey to cache authority
-         * @param state
-         */
-        generateAuthorityKey(stateString) {
-            const { libraryState: { id: stateId }, } = ProtocolUtils.parseRequestState(this.cryptoImpl, stateString);
-            return this.generateCacheKey(`${TemporaryCacheKeys.AUTHORITY}.${stateId}`);
-        }
-        /**
-         * Create Nonce key to cache nonce
-         * @param state
-         */
-        generateNonceKey(stateString) {
-            const { libraryState: { id: stateId }, } = ProtocolUtils.parseRequestState(this.cryptoImpl, stateString);
-            return this.generateCacheKey(`${TemporaryCacheKeys.NONCE_IDTOKEN}.${stateId}`);
-        }
-        /**
-         * Creates full cache key for the request state
-         * @param stateString State string for the request
-         */
-        generateStateKey(stateString) {
-            // Use the library state id to key temp storage for uniqueness for multiple concurrent requests
-            const { libraryState: { id: stateId }, } = ProtocolUtils.parseRequestState(this.cryptoImpl, stateString);
-            return this.generateCacheKey(`${TemporaryCacheKeys.REQUEST_STATE}.${stateId}`);
-        }
-        /**
-         * Gets the cached authority based on the cached state. Returns empty if no cached state found.
-         */
-        getCachedAuthority(cachedState) {
-            const stateCacheKey = this.generateStateKey(cachedState);
-            const state = this.getTemporaryCache(stateCacheKey);
-            if (!state) {
-                return null;
-            }
-            const authorityCacheKey = this.generateAuthorityKey(state);
-            return this.getTemporaryCache(authorityCacheKey);
-        }
-        /**
-         * Updates account, authority, and state in cache
-         * @param serverAuthenticationRequest
-         * @param account
-         */
-        updateCacheEntries(state, nonce, authorityInstance, loginHint, account) {
-            this.logger.trace("BrowserCacheManager.updateCacheEntries called");
-            // Cache the request state
-            const stateCacheKey = this.generateStateKey(state);
-            this.setTemporaryCache(stateCacheKey, state, false);
-            // Cache the nonce
-            const nonceCacheKey = this.generateNonceKey(state);
-            this.setTemporaryCache(nonceCacheKey, nonce, false);
-            // Cache authorityKey
-            const authorityCacheKey = this.generateAuthorityKey(state);
-            this.setTemporaryCache(authorityCacheKey, authorityInstance, false);
-            if (account) {
-                const ccsCredential = {
-                    credential: account.homeAccountId,
-                    type: CcsCredentialType.HOME_ACCOUNT_ID,
-                };
-                this.setTemporaryCache(TemporaryCacheKeys.CCS_CREDENTIAL, JSON.stringify(ccsCredential), true);
-            }
-            else if (loginHint) {
-                const ccsCredential = {
-                    credential: loginHint,
-                    type: CcsCredentialType.UPN,
-                };
-                this.setTemporaryCache(TemporaryCacheKeys.CCS_CREDENTIAL, JSON.stringify(ccsCredential), true);
-            }
-        }
         /**
          * Reset all temporary cache items
          * @param state
          */
-        resetRequestCache(state) {
+        resetRequestCache() {
             this.logger.trace("BrowserCacheManager.resetRequestCache called");
-            // check state and remove associated cache items
-            if (state) {
-                this.temporaryCacheStorage.getKeys().forEach((key) => {
-                    if (key.indexOf(state) !== -1) {
-                        this.removeTemporaryItem(key);
-                    }
-                });
-                // delete generic interactive request parameters
-                this.removeTemporaryItem(this.generateStateKey(state));
-                this.removeTemporaryItem(this.generateNonceKey(state));
-                this.removeTemporaryItem(this.generateAuthorityKey(state));
-            }
             this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
+            this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.VERIFIER));
             this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.ORIGIN_URI));
             this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.URL_HASH));
-            this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.CORRELATION_ID));
-            this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.CCS_CREDENTIAL));
             this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST));
             this.setInteractionInProgress(false);
         }
-        /**
-         * Removes temporary cache for the provided state
-         * @param stateString
-         */
-        cleanRequestByState(stateString) {
-            this.logger.trace("BrowserCacheManager.cleanRequestByState called");
-            // Interaction is completed - remove interaction status.
-            if (stateString) {
-                const stateKey = this.generateStateKey(stateString);
-                const cachedState = this.temporaryCacheStorage.getItem(stateKey);
-                this.logger.infoPii(`BrowserCacheManager.cleanRequestByState: Removing temporary cache items for state: ${cachedState}`);
-                this.resetRequestCache(cachedState || Constants.EMPTY_STRING);
-            }
-        }
-        /**
-         * Looks in temporary cache for any state values with the provided interactionType and removes all temporary cache items for that state
-         * Used in scenarios where temp cache needs to be cleaned but state is not known, such as clicking browser back button.
-         * @param interactionType
-         */
-        cleanRequestByInteractionType(interactionType) {
-            this.logger.trace("BrowserCacheManager.cleanRequestByInteractionType called");
-            // Loop through all keys to find state key
-            this.temporaryCacheStorage.getKeys().forEach((key) => {
-                // If this key is not the state key, move on
-                if (key.indexOf(TemporaryCacheKeys.REQUEST_STATE) === -1) {
-                    return;
-                }
-                // Retrieve state value, return if not a valid value
-                const stateValue = this.temporaryCacheStorage.getItem(key);
-                if (!stateValue) {
-                    return;
-                }
-                // Extract state and ensure it matches given InteractionType, then clean request cache
-                const parsedState = extractBrowserRequestState(this.cryptoImpl, stateValue);
-                if (parsedState &&
-                    parsedState.interactionType === interactionType) {
-                    this.logger.infoPii(`BrowserCacheManager.cleanRequestByInteractionType: Removing temporary cache items for state: ${stateValue}`);
-                    this.resetRequestCache(stateValue);
-                }
-            });
-            this.setInteractionInProgress(false);
-        }
-        cacheCodeRequest(authCodeRequest) {
-            this.logger.trace("BrowserCacheManager.cacheCodeRequest called");
+        cacheAuthorizeRequest(authCodeRequest, codeVerifier) {
+            this.logger.trace("BrowserCacheManager.cacheAuthorizeRequest called");
             const encodedValue = base64Encode(JSON.stringify(authCodeRequest));
             this.setTemporaryCache(TemporaryCacheKeys.REQUEST_PARAMS, encodedValue, true);
+            if (codeVerifier) {
+                const encodedVerifier = base64Encode(codeVerifier);
+                this.setTemporaryCache(TemporaryCacheKeys.VERIFIER, encodedVerifier, true);
+            }
         }
         /**
          * Gets the token exchange parameters from the cache. Throws an error if nothing is found.
          */
-        getCachedRequest(state) {
+        getCachedRequest() {
             this.logger.trace("BrowserCacheManager.getCachedRequest called");
             // Get token request from cache and parse as TokenExchangeParameters.
             const encodedTokenRequest = this.getTemporaryCache(TemporaryCacheKeys.REQUEST_PARAMS, true);
             if (!encodedTokenRequest) {
                 throw createBrowserAuthError(noTokenRequestCacheError);
             }
+            const encodedVerifier = this.getTemporaryCache(TemporaryCacheKeys.VERIFIER, true);
             let parsedRequest;
+            let verifier = "";
             try {
                 parsedRequest = JSON.parse(base64Decode(encodedTokenRequest));
+                if (encodedVerifier) {
+                    verifier = base64Decode(encodedVerifier);
+                }
             }
             catch (e) {
                 this.logger.errorPii(`Attempted to parse: ${encodedTokenRequest}`);
                 this.logger.error(`Parsing cached token request threw with error: ${e}`);
                 throw createBrowserAuthError(unableToParseTokenRequestCacheError);
             }
-            this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
-            // Get cached authority and use if no authority is cached with request.
-            if (!parsedRequest.authority) {
-                const authorityCacheKey = this.generateAuthorityKey(state);
-                const cachedAuthority = this.getTemporaryCache(authorityCacheKey);
-                if (!cachedAuthority) {
-                    throw createBrowserAuthError(noCachedAuthorityError);
-                }
-                parsedRequest.authority = cachedAuthority;
-            }
-            return parsedRequest;
+            return [parsedRequest, verifier];
         }
         /**
          * Gets cached native request for redirect flows
@@ -13354,1083 +13318,1103 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    class SilentCacheClient extends StandardInteractionClient {
+    class NativeMessageHandler {
+        constructor(logger, handshakeTimeoutMs, performanceClient, extensionId) {
+            this.logger = logger;
+            this.handshakeTimeoutMs = handshakeTimeoutMs;
+            this.extensionId = extensionId;
+            this.resolvers = new Map(); // Used for non-handshake messages
+            this.handshakeResolvers = new Map(); // Used for handshake messages
+            this.messageChannel = new MessageChannel();
+            this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
+            this.performanceClient = performanceClient;
+            this.handshakeEvent = performanceClient.startMeasurement(PerformanceEvents.NativeMessageHandlerHandshake);
+        }
         /**
-         * Returns unexpired tokens from the cache, if available
-         * @param silentRequest
+         * Sends a given message to the extension and resolves with the extension response
+         * @param body
          */
-        async acquireToken(silentRequest) {
-            this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
-            // Telemetry manager only used to increment cacheHits here
-            const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow);
-            const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), PerformanceEvents.StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
-                serverTelemetryManager,
-                requestAuthority: silentRequest.authority,
-                requestAzureCloudOptions: silentRequest.azureCloudOptions,
-                account: silentRequest.account,
+        async sendMessage(body) {
+            this.logger.trace("NativeMessageHandler - sendMessage called.");
+            const req = {
+                channel: NativeConstants.CHANNEL_ID,
+                extensionId: this.extensionId,
+                responseId: createNewGuid(),
+                body: body,
+            };
+            this.logger.trace("NativeMessageHandler - Sending request to browser extension");
+            this.logger.tracePii(`NativeMessageHandler - Sending request to browser extension: ${JSON.stringify(req)}`);
+            this.messageChannel.port1.postMessage(req);
+            return new Promise((resolve, reject) => {
+                this.resolvers.set(req.responseId, { resolve, reject });
             });
-            const silentAuthClient = new SilentFlowClient(clientConfig, this.performanceClient);
-            this.logger.verbose("Silent auth client created");
+        }
+        /**
+         * Returns an instance of the MessageHandler that has successfully established a connection with an extension
+         * @param {Logger} logger
+         * @param {number} handshakeTimeoutMs
+         * @param {IPerformanceClient} performanceClient
+         * @param {ICrypto} crypto
+         */
+        static async createProvider(logger, handshakeTimeoutMs, performanceClient) {
+            logger.trace("NativeMessageHandler - createProvider called.");
             try {
-                const response = await invokeAsync(silentAuthClient.acquireCachedToken.bind(silentAuthClient), PerformanceEvents.SilentFlowClientAcquireCachedToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest);
-                const authResponse = response[0];
-                this.performanceClient.addFields({
-                    fromCache: true,
-                }, silentRequest.correlationId);
-                return authResponse;
+                const preferredProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, performanceClient, NativeConstants.PREFERRED_EXTENSION_ID);
+                await preferredProvider.sendHandshakeRequest();
+                return preferredProvider;
             }
-            catch (error) {
-                if (error instanceof BrowserAuthError &&
-                    error.errorCode === cryptoKeyNotFound) {
-                    this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
-                }
-                throw error;
+            catch (e) {
+                // If preferred extension fails for whatever reason, fallback to using any installed extension
+                const backupProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, performanceClient);
+                await backupProvider.sendHandshakeRequest();
+                return backupProvider;
             }
         }
         /**
-         * API to silenty clear the browser cache.
-         * @param logoutRequest
+         * Send handshake request helper.
          */
-        logout(logoutRequest) {
-            this.logger.verbose("logoutRedirect called");
-            const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-            return this.clearCacheOnLogout(validLogoutRequest?.account);
-        }
-    }
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    class NativeInteractionClient extends BaseInteractionClient {
-        constructor(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, nativeStorageImpl, correlationId) {
-            super(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
-            this.apiId = apiId;
-            this.accountId = accountId;
-            this.nativeMessageHandler = provider;
-            this.nativeStorageManager = nativeStorageImpl;
-            this.silentCacheClient = new SilentCacheClient(config, this.nativeStorageManager, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
-            const extensionName = this.nativeMessageHandler.getExtensionId() ===
-                NativeConstants.PREFERRED_EXTENSION_ID
-                ? "chrome"
-                : this.nativeMessageHandler.getExtensionId()?.length
-                    ? "unknown"
-                    : undefined;
-            this.skus = ServerTelemetryManager.makeExtraSkuString({
-                libraryName: BrowserConstants.MSAL_SKU,
-                libraryVersion: version,
-                extensionName: extensionName,
-                extensionVersion: this.nativeMessageHandler.getExtensionVersion(),
+        async sendHandshakeRequest() {
+            this.logger.trace("NativeMessageHandler - sendHandshakeRequest called.");
+            // Register this event listener before sending handshake
+            window.addEventListener("message", this.windowListener, false); // false is important, because content script message processing should work first
+            const req = {
+                channel: NativeConstants.CHANNEL_ID,
+                extensionId: this.extensionId,
+                responseId: createNewGuid(),
+                body: {
+                    method: NativeExtensionMethod.HandshakeRequest,
+                },
+            };
+            this.handshakeEvent.add({
+                extensionId: this.extensionId,
+                extensionHandshakeTimeoutMs: this.handshakeTimeoutMs,
             });
-        }
-        /**
-         * Adds SKUs to request extra query parameters
-         * @param request {NativeTokenRequest}
-         * @private
-         */
-        addRequestSKUs(request) {
-            request.extraParameters = {
-                ...request.extraParameters,
-                [X_CLIENT_EXTRA_SKU]: this.skus,
+            this.messageChannel.port1.onmessage = (event) => {
+                this.onChannelMessage(event);
             };
-        }
-        /**
-         * Acquire token from native platform via browser extension
-         * @param request
-         */
-        async acquireToken(request, cacheLookupPolicy) {
-            this.performanceClient.addQueueMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
-            this.logger.trace("NativeInteractionClient - acquireToken called.");
-            // start the perf measurement
-            const nativeATMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
-            const reqTimestamp = nowSeconds();
-            const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-            try {
-                // initialize native request
-                const nativeRequest = await this.initializeNativeRequest(request);
-                // check if the tokens can be retrieved from internal cache
-                try {
-                    const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
-                    nativeATMeasurement.end({
-                        success: true,
-                        isNativeBroker: false,
-                        fromCache: true,
-                    });
-                    return result;
-                }
-                catch (e) {
-                    if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
-                        this.logger.info("MSAL internal Cache does not contain tokens, return error as per cache policy");
-                        throw e;
-                    }
-                    // continue with a native call for any and all errors
-                    this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
-                }
-                const { ...nativeTokenRequest } = nativeRequest;
-                // fall back to native calls
-                const messageBody = {
-                    method: NativeExtensionMethod.GetToken,
-                    request: nativeTokenRequest,
-                };
-                const response = await this.nativeMessageHandler.sendMessage(messageBody);
-                const validatedResponse = this.validateNativeResponse(response);
-                return await this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
-                    .then((result) => {
-                    nativeATMeasurement.end({
-                        success: true,
-                        isNativeBroker: true,
-                        requestId: result.requestId,
-                    });
-                    serverTelemetryManager.clearNativeBrokerErrorCode();
-                    return result;
-                })
-                    .catch((error) => {
-                    nativeATMeasurement.end({
+            window.postMessage(req, window.origin, [this.messageChannel.port2]);
+            return new Promise((resolve, reject) => {
+                this.handshakeResolvers.set(req.responseId, { resolve, reject });
+                this.timeoutId = window.setTimeout(() => {
+                    /*
+                     * Throw an error if neither HandshakeResponse nor original Handshake request are received in a reasonable timeframe.
+                     * This typically suggests an event handler stopped propagation of the Handshake request but did not respond to it on the MessageChannel port
+                     */
+                    window.removeEventListener("message", this.windowListener, false);
+                    this.messageChannel.port1.close();
+                    this.messageChannel.port2.close();
+                    this.handshakeEvent.end({
+                        extensionHandshakeTimedOut: true,
                         success: false,
-                        errorCode: error.errorCode,
-                        subErrorCode: error.subError,
-                        isNativeBroker: true,
                     });
-                    throw error;
-                });
-            }
-            catch (e) {
-                if (e instanceof NativeAuthError) {
-                    serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
-                }
-                throw e;
-            }
-        }
-        /**
-         * Creates silent flow request
-         * @param request
-         * @param cachedAccount
-         * @returns CommonSilentFlowRequest
-         */
-        createSilentCacheRequest(request, cachedAccount) {
-            return {
-                authority: request.authority,
-                correlationId: this.correlationId,
-                scopes: ScopeSet.fromString(request.scope).asArray(),
-                account: cachedAccount,
-                forceRefresh: false,
-            };
+                    reject(createBrowserAuthError(nativeHandshakeTimeout));
+                    this.handshakeResolvers.delete(req.responseId);
+                }, this.handshakeTimeoutMs); // Use a reasonable timeout in milliseconds here
+            });
         }
         /**
-         * Fetches the tokens from the cache if un-expired
-         * @param nativeAccountId
-         * @param request
-         * @returns authenticationResult
+         * Invoked when a message is posted to the window. If a handshake request is received it means the extension is not installed.
+         * @param event
          */
-        async acquireTokensFromCache(nativeAccountId, request) {
-            if (!nativeAccountId) {
-                this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided");
-                throw createClientAuthError(noAccountFound);
+        onWindowMessage(event) {
+            this.logger.trace("NativeMessageHandler - onWindowMessage called");
+            // We only accept messages from ourselves
+            if (event.source !== window) {
+                return;
             }
-            // fetch the account from browser cache
-            const account = this.browserStorage.getBaseAccountInfo({
-                nativeAccountId,
-            });
-            if (!account) {
-                throw createClientAuthError(noAccountFound);
+            const request = event.data;
+            if (!request.channel ||
+                request.channel !== NativeConstants.CHANNEL_ID) {
+                return;
             }
-            // leverage silent flow for cached tokens retrieval
-            try {
-                const silentRequest = this.createSilentCacheRequest(request, account);
-                const result = await this.silentCacheClient.acquireToken(silentRequest);
-                const fullAccount = {
-                    ...account,
-                    idTokenClaims: result?.idTokenClaims,
-                    idToken: result?.idToken,
-                };
-                return {
-                    ...result,
-                    account: fullAccount,
-                };
+            if (request.extensionId && request.extensionId !== this.extensionId) {
+                return;
             }
-            catch (e) {
-                throw e;
+            if (request.body.method === NativeExtensionMethod.HandshakeRequest) {
+                const handshakeResolver = this.handshakeResolvers.get(request.responseId);
+                /*
+                 * Filter out responses with no matched resolvers sooner to keep channel ports open while waiting for
+                 * the proper response.
+                 */
+                if (!handshakeResolver) {
+                    this.logger.trace(`NativeMessageHandler.onWindowMessage - resolver can't be found for request ${request.responseId}`);
+                    return;
+                }
+                // If we receive this message back it means no extension intercepted the request, meaning no extension supporting handshake protocol is installed
+                this.logger.verbose(request.extensionId
+                    ? `Extension with id: ${request.extensionId} not installed`
+                    : "No extension installed");
+                clearTimeout(this.timeoutId);
+                this.messageChannel.port1.close();
+                this.messageChannel.port2.close();
+                window.removeEventListener("message", this.windowListener, false);
+                this.handshakeEvent.end({
+                    success: false,
+                    extensionInstalled: false,
+                });
+                handshakeResolver.reject(createBrowserAuthError(nativeExtensionNotInstalled));
             }
         }
         /**
-         * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
-         * @param {RedirectRequest} request
-         * @param {InProgressPerformanceEvent} rootMeasurement
+         * Invoked when a message is received from the extension on the MessageChannel port
+         * @param event
          */
-        async acquireTokenRedirect(request, rootMeasurement) {
-            this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
-            const { ...remainingParameters } = request;
-            delete remainingParameters.onRedirectNavigate;
-            const nativeRequest = await this.initializeNativeRequest(remainingParameters);
-            const messageBody = {
-                method: NativeExtensionMethod.GetToken,
-                request: nativeRequest,
-            };
+        onChannelMessage(event) {
+            this.logger.trace("NativeMessageHandler - onChannelMessage called.");
+            const request = event.data;
+            const resolver = this.resolvers.get(request.responseId);
+            const handshakeResolver = this.handshakeResolvers.get(request.responseId);
             try {
-                const response = await this.nativeMessageHandler.sendMessage(messageBody);
-                this.validateNativeResponse(response);
-            }
-            catch (e) {
-                // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
-                if (e instanceof NativeAuthError) {
-                    const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                    serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
-                    if (isFatalNativeAuthError(e)) {
-                        throw e;
+                const method = request.body.method;
+                if (method === NativeExtensionMethod.Response) {
+                    if (!resolver) {
+                        return;
+                    }
+                    const response = request.body.response;
+                    this.logger.trace("NativeMessageHandler - Received response from browser extension");
+                    this.logger.tracePii(`NativeMessageHandler - Received response from browser extension: ${JSON.stringify(response)}`);
+                    if (response.status !== "Success") {
+                        resolver.reject(createNativeAuthError(response.code, response.description, response.ext));
+                    }
+                    else if (response.result) {
+                        if (response.result["code"] &&
+                            response.result["description"]) {
+                            resolver.reject(createNativeAuthError(response.result["code"], response.result["description"], response.result["ext"]));
+                        }
+                        else {
+                            resolver.resolve(response.result);
+                        }
+                    }
+                    else {
+                        throw createAuthError(unexpectedError, "Event does not contain result.");
                     }
+                    this.resolvers.delete(request.responseId);
+                }
+                else if (method === NativeExtensionMethod.HandshakeResponse) {
+                    if (!handshakeResolver) {
+                        this.logger.trace(`NativeMessageHandler.onChannelMessage - resolver can't be found for request ${request.responseId}`);
+                        return;
+                    }
+                    clearTimeout(this.timeoutId); // Clear setTimeout
+                    window.removeEventListener("message", this.windowListener, false); // Remove 'No extension' listener
+                    this.extensionId = request.extensionId;
+                    this.extensionVersion = request.body.version;
+                    this.logger.verbose(`NativeMessageHandler - Received HandshakeResponse from extension: ${this.extensionId}`);
+                    this.handshakeEvent.end({
+                        extensionInstalled: true,
+                        success: true,
+                    });
+                    handshakeResolver.resolve();
+                    this.handshakeResolvers.delete(request.responseId);
+                }
+                // Do nothing if method is not Response or HandshakeResponse
+            }
+            catch (err) {
+                this.logger.error("Error parsing response from WAM Extension");
+                this.logger.errorPii(`Error parsing response from WAM Extension: ${err}`);
+                this.logger.errorPii(`Unable to parse ${event}`);
+                if (resolver) {
+                    resolver.reject(err);
+                }
+                else if (handshakeResolver) {
+                    handshakeResolver.reject(err);
                 }
             }
-            this.browserStorage.setTemporaryCache(TemporaryCacheKeys.NATIVE_REQUEST, JSON.stringify(nativeRequest), true);
-            const navigationOptions = {
-                apiId: ApiId.acquireTokenRedirect,
-                timeout: this.config.system.redirectNavigationTimeout,
-                noHistory: false,
-            };
-            const redirectUri = this.config.auth.navigateToLoginRequestUrl
-                ? window.location.href
-                : this.getRedirectUri(request.redirectUri);
-            rootMeasurement.end({ success: true });
-            await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
         }
         /**
-         * If the previous page called native platform for a token using redirect APIs, send the same request again and return the response
-         * @param performanceClient {IPerformanceClient?}
-         * @param correlationId {string?} correlation identifier
+         * Returns the Id for the browser extension this handler is communicating with
+         * @returns
          */
-        async handleRedirectPromise(performanceClient, correlationId) {
-            this.logger.trace("NativeInteractionClient - handleRedirectPromise called.");
-            if (!this.browserStorage.isInteractionInProgress(true)) {
-                this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
-                return null;
-            }
-            // remove prompt from the request to prevent WAM from prompting twice
-            const cachedRequest = this.browserStorage.getCachedNativeRequest();
-            if (!cachedRequest) {
-                this.logger.verbose("NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null.");
-                if (performanceClient && correlationId) {
-                    performanceClient?.addFields({ errorCode: "no_cached_request" }, correlationId);
-                }
-                return null;
-            }
-            const { prompt, ...request } = cachedRequest;
-            if (prompt) {
-                this.logger.verbose("NativeInteractionClient - handleRedirectPromise called and prompt was included in the original request, removing prompt from cached request to prevent second interaction with native broker window.");
-            }
-            this.browserStorage.removeItem(this.browserStorage.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST));
-            const messageBody = {
-                method: NativeExtensionMethod.GetToken,
-                request: request,
-            };
-            const reqTimestamp = nowSeconds();
-            try {
-                this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.");
-                const response = await this.nativeMessageHandler.sendMessage(messageBody);
-                this.validateNativeResponse(response);
-                const result = this.handleNativeResponse(response, request, reqTimestamp);
-                this.browserStorage.setInteractionInProgress(false);
-                const res = await result;
-                const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                serverTelemetryManager.clearNativeBrokerErrorCode();
-                return res;
-            }
-            catch (e) {
-                this.browserStorage.setInteractionInProgress(false);
-                throw e;
-            }
+        getExtensionId() {
+            return this.extensionId;
         }
         /**
-         * Logout from native platform via browser extension
-         * @param request
+         * Returns the version for the browser extension this handler is communicating with
+         * @returns
          */
-        logout() {
-            this.logger.trace("NativeInteractionClient - logout called.");
-            return Promise.reject("Logout not implemented yet");
+        getExtensionVersion() {
+            return this.extensionVersion;
         }
         /**
-         * Transform response from native platform into AuthenticationResult object which will be returned to the end user
-         * @param response
-         * @param request
-         * @param reqTimestamp
+         * Returns boolean indicating whether or not the request should attempt to use native broker
+         * @param logger
+         * @param config
+         * @param nativeExtensionProvider
+         * @param authenticationScheme
          */
-        async handleNativeResponse(response, request, reqTimestamp) {
-            this.logger.trace("NativeInteractionClient - handleNativeResponse called.");
-            // generate identifiers
-            const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
-            const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
-            const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
-                nativeAccountId: request.accountId,
-            })?.homeAccountId;
-            // add exception for double brokering, please note this is temporary and will be fortified in future
-            if (request.extraParameters?.child_client_id &&
-                response.account.id !== request.accountId) {
-                this.logger.info("handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch");
+        static isPlatformBrokerAvailable(config, logger, nativeExtensionProvider, authenticationScheme) {
+            logger.trace("isPlatformBrokerAvailable called");
+            if (!config.system.allowPlatformBroker) {
+                logger.trace("isPlatformBrokerAvailable: allowPlatformBroker is not enabled, returning false");
+                // Developer disabled WAM
+                return false;
             }
-            else if (homeAccountIdentifier !== cachedhomeAccountId &&
-                response.account.id !== request.accountId) {
-                // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
-                throw createNativeAuthError(userSwitch);
+            if (!nativeExtensionProvider) {
+                logger.trace("isPlatformBrokerAvailable: Platform extension provider is not initialized, returning false");
+                // Extension is not available
+                return false;
             }
-            // Get the preferred_cache domain for the given authority
-            const authority = await this.getDiscoveredAuthority({
-                requestAuthority: request.authority,
-            });
-            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
-            idTokenClaims.tid, undefined, // auth code payload
-            response.account.id, this.logger);
-            // Ensure expires_in is in number format
-            response.expires_in = Number(response.expires_in);
-            // generate authenticationResult
-            const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
-            // cache accounts and tokens in the appropriate storage
-            await this.cacheAccount(baseAccount);
-            await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
-            return result;
+            if (authenticationScheme) {
+                switch (authenticationScheme) {
+                    case AuthenticationScheme.BEARER:
+                    case AuthenticationScheme.POP:
+                        logger.trace("isPlatformBrokerAvailable: authenticationScheme is supported, returning true");
+                        return true;
+                    default:
+                        logger.trace("isPlatformBrokerAvailable: authenticationScheme is not supported, returning false");
+                        return false;
+                }
+            }
+            return true;
         }
-        /**
-         * creates an homeAccountIdentifier for the account
-         * @param response
-         * @param idTokenObj
-         * @returns
-         */
-        createHomeAccountIdentifier(response, idTokenClaims) {
-            // Save account in browser storage
-            const homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenClaims);
-            return homeAccountIdentifier;
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Extracts the BrowserStateObject from the state string.
+     * @param browserCrypto
+     * @param state
+     */
+    function extractBrowserRequestState(browserCrypto, state) {
+        if (!state) {
+            return null;
         }
-        /**
-         * Helper to generate scopes
-         * @param response
-         * @param request
-         * @returns
-         */
-        generateScopes(response, request) {
-            return response.scope
-                ? ScopeSet.fromString(response.scope)
-                : ScopeSet.fromString(request.scope);
+        try {
+            const requestStateObj = ProtocolUtils.parseRequestState(browserCrypto, state);
+            return requestStateObj.libraryState.meta;
+        }
+        catch (e) {
+            throw createClientAuthError(invalidState);
+        }
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function deserializeResponse(responseString, responseLocation, logger) {
+        // Deserialize hash fragment response parameters.
+        const serverParams = getDeserializedResponse(responseString);
+        if (!serverParams) {
+            if (!stripLeadingHashOrQuery(responseString)) {
+                // Hash or Query string is empty
+                logger.error(`The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`);
+                throw createBrowserAuthError(hashEmptyError);
+            }
+            else {
+                logger.error(`A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`);
+                logger.errorPii(`The ${responseLocation} detected is: ${responseString}`);
+                throw createBrowserAuthError(hashDoesNotContainKnownProperties);
+            }
+        }
+        return serverParams;
+    }
+    /**
+     * Returns the interaction type that the response object belongs to
+     */
+    function validateInteractionType(response, browserCrypto, interactionType) {
+        if (!response.state) {
+            throw createBrowserAuthError(noStateInHash);
+        }
+        const platformStateObj = extractBrowserRequestState(browserCrypto, response.state);
+        if (!platformStateObj) {
+            throw createBrowserAuthError(unableToParseState);
+        }
+        if (platformStateObj.interactionType !== interactionType) {
+            throw createBrowserAuthError(stateInteractionTypeMismatch);
+        }
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Abstract class which defines operations for a browser interaction handling class.
+     */
+    class InteractionHandler {
+        constructor(authCodeModule, storageImpl, authCodeRequest, logger, performanceClient) {
+            this.authModule = authCodeModule;
+            this.browserStorage = storageImpl;
+            this.authCodeRequest = authCodeRequest;
+            this.logger = logger;
+            this.performanceClient = performanceClient;
         }
         /**
-         * If PoP token is requesred, records the PoP token if returned from the WAM, else generates one in the browser
-         * @param request
-         * @param response
+         * Function to handle response parameters from hash.
+         * @param locationHash
          */
-        async generatePopAccessToken(response, request) {
-            if (request.tokenType === AuthenticationScheme.POP &&
-                request.signPopToken) {
-                /**
-                 * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
-                 * is still received, SHR is calculated locally
-                 */
-                // Check if native layer returned an SHR token
-                if (response.shr) {
-                    this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer");
-                    return response.shr;
+        async handleCodeResponse(response, request) {
+            this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
+            let authCodeResponse;
+            try {
+                authCodeResponse = getAuthorizationCodePayload(response, request.state);
+            }
+            catch (e) {
+                if (e instanceof ServerError &&
+                    e.subError === userCancelled) {
+                    // Translate server error caused by user closing native prompt to corresponding first class MSAL error
+                    throw createBrowserAuthError(userCancelled);
                 }
-                // Generate SHR in msal js if WAM does not compute it when POP is enabled
-                const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-                const shrParameters = {
-                    resourceRequestMethod: request.resourceRequestMethod,
-                    resourceRequestUri: request.resourceRequestUri,
-                    shrClaims: request.shrClaims,
-                    shrNonce: request.shrNonce,
-                };
-                /**
-                 * KeyID must be present in the native request from when the PoP key was generated in order for
-                 * PopTokenGenerator to query the full key for signing
-                 */
-                if (!request.keyId) {
-                    throw createClientAuthError(keyIdMissing);
+                else {
+                    throw e;
                 }
-                return popTokenGenerator.signPopToken(response.access_token, request.keyId, shrParameters);
+            }
+            return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request);
+        }
+        /**
+         * Process auth code response from AAD
+         * @param authCodeResponse
+         * @param state
+         * @param authority
+         * @param networkModule
+         * @returns
+         */
+        async handleCodeResponseFromServer(authCodeResponse, request, validateNonce = true) {
+            this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromServer, request.correlationId);
+            this.logger.trace("InteractionHandler.handleCodeResponseFromServer called");
+            // Assign code to request
+            this.authCodeRequest.code = authCodeResponse.code;
+            // Check for new cloud instance
+            if (authCodeResponse.cloud_instance_host_name) {
+                await invokeAsync(this.authModule.updateAuthority.bind(this.authModule), PerformanceEvents.UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodeResponse.cloud_instance_host_name, request.correlationId);
+            }
+            // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
+            if (validateNonce) {
+                // TODO: Assigning "response nonce" to "request nonce" is confusing. Refactor the function doing validation to accept request nonce directly
+                authCodeResponse.nonce = request.nonce || undefined;
+            }
+            authCodeResponse.state = request.state;
+            // Add CCS parameters if available
+            if (authCodeResponse.client_info) {
+                this.authCodeRequest.clientInfo = authCodeResponse.client_info;
             }
             else {
-                return response.access_token;
+                const ccsCred = this.createCcsCredentials(request);
+                if (ccsCred) {
+                    this.authCodeRequest.ccsCredential = ccsCred;
+                }
             }
+            // Acquire token with retrieved code.
+            const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, authCodeResponse));
+            return tokenResponse;
         }
         /**
-         * Generates authentication result
-         * @param response
-         * @param request
-         * @param idTokenObj
-         * @param accountEntity
-         * @param authority
-         * @param reqTimestamp
-         * @returns
+         * Build ccs creds if available
          */
-        async generateAuthenticationResult(response, request, idTokenClaims, accountEntity, authority, reqTimestamp) {
-            // Add Native Broker fields to Telemetry
-            const mats = this.addTelemetryFromNativeResponse(response);
-            // If scopes not returned in server response, use request scopes
-            const responseScopes = response.scope
-                ? ScopeSet.fromString(response.scope)
-                : ScopeSet.fromString(request.scope);
-            const accountProperties = response.account.properties || {};
-            const uid = accountProperties["UID"] ||
-                idTokenClaims.oid ||
-                idTokenClaims.sub ||
-                Constants.EMPTY_STRING;
-            const tid = accountProperties["TenantId"] ||
-                idTokenClaims.tid ||
-                Constants.EMPTY_STRING;
-            const accountInfo = updateAccountTenantProfileData(accountEntity.getAccountInfo(), undefined, // tenantProfile optional
-            idTokenClaims, response.id_token);
-            /**
-             * In pairwise broker flows, this check prevents the broker's native account id
-             * from being returned over the embedded app's account id.
-             */
-            if (accountInfo.nativeAccountId !== response.account.id) {
-                accountInfo.nativeAccountId = response.account.id;
+        createCcsCredentials(request) {
+            if (request.account) {
+                return {
+                    credential: request.account.homeAccountId,
+                    type: CcsCredentialType.HOME_ACCOUNT_ID,
+                };
             }
-            // generate PoP token as needed
-            const responseAccessToken = await this.generatePopAccessToken(response, request);
-            const tokenType = request.tokenType === AuthenticationScheme.POP
-                ? AuthenticationScheme.POP
-                : AuthenticationScheme.BEARER;
-            const result = {
-                authority: authority,
-                uniqueId: uid,
-                tenantId: tid,
-                scopes: responseScopes.asArray(),
-                account: accountInfo,
-                idToken: response.id_token,
-                idTokenClaims: idTokenClaims,
-                accessToken: responseAccessToken,
-                fromCache: mats ? this.isResponseFromCache(mats) : false,
-                // Request timestamp and NativeResponse expires_in are in seconds, converting to Date for AuthenticationResult
-                expiresOn: toDateFromSeconds(reqTimestamp + response.expires_in),
-                tokenType: tokenType,
-                correlationId: this.correlationId,
-                state: response.state,
-                fromNativeBroker: true,
-            };
-            return result;
+            else if (request.loginHint) {
+                return {
+                    credential: request.loginHint,
+                    type: CcsCredentialType.UPN,
+                };
+            }
+            return null;
         }
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    class SilentCacheClient extends StandardInteractionClient {
         /**
-         * cache the account entity in browser storage
-         * @param accountEntity
+         * Returns unexpired tokens from the cache, if available
+         * @param silentRequest
          */
-        async cacheAccount(accountEntity) {
-            // Store the account info and hence `nativeAccountId` in browser cache
-            await this.browserStorage.setAccount(accountEntity, this.correlationId);
-            // Remove any existing cached tokens for this account in browser storage
-            this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
-                this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
+        async acquireToken(silentRequest) {
+            this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
+            // Telemetry manager only used to increment cacheHits here
+            const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow);
+            const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), PerformanceEvents.StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
+                serverTelemetryManager,
+                requestAuthority: silentRequest.authority,
+                requestAzureCloudOptions: silentRequest.azureCloudOptions,
+                account: silentRequest.account,
             });
+            const silentAuthClient = new SilentFlowClient(clientConfig, this.performanceClient);
+            this.logger.verbose("Silent auth client created");
+            try {
+                const response = await invokeAsync(silentAuthClient.acquireCachedToken.bind(silentAuthClient), PerformanceEvents.SilentFlowClientAcquireCachedToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest);
+                const authResponse = response[0];
+                this.performanceClient.addFields({
+                    fromCache: true,
+                }, silentRequest.correlationId);
+                return authResponse;
+            }
+            catch (error) {
+                if (error instanceof BrowserAuthError &&
+                    error.errorCode === cryptoKeyNotFound) {
+                    this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
+                }
+                throw error;
+            }
         }
         /**
-         * Stores the access_token and id_token in inmemory storage
-         * @param response
-         * @param request
-         * @param homeAccountIdentifier
-         * @param idTokenObj
-         * @param responseAccessToken
-         * @param tenantId
-         * @param reqTimestamp
+         * API to silenty clear the browser cache.
+         * @param logoutRequest
          */
-        cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, responseAccessToken, tenantId, reqTimestamp) {
-            const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || "", request.clientId, idTokenClaims.tid || "");
-            // cache accessToken in inmemory storage
-            const expiresIn = request.tokenType === AuthenticationScheme.POP
-                ? Constants.SHR_NONCE_VALIDITY
-                : (typeof response.expires_in === "string"
-                    ? parseInt(response.expires_in, 10)
-                    : response.expires_in) || 0;
-            const tokenExpirationSeconds = reqTimestamp + expiresIn;
-            const responseScopes = this.generateScopes(response, request);
-            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
-            const nativeCacheRecord = {
-                idToken: cachedIdToken,
-                accessToken: cachedAccessToken,
-            };
-            return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, request.storeInCache);
+        logout(logoutRequest) {
+            this.logger.verbose("logoutRedirect called");
+            const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
+            return this.clearCacheOnLogout(validLogoutRequest?.account);
         }
-        addTelemetryFromNativeResponse(response) {
-            const mats = this.getMATSFromResponse(response);
-            if (!mats) {
-                return null;
-            }
-            this.performanceClient.addFields({
-                extensionId: this.nativeMessageHandler.getExtensionId(),
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    class NativeInteractionClient extends BaseInteractionClient {
+        constructor(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, nativeStorageImpl, correlationId) {
+            super(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
+            this.apiId = apiId;
+            this.accountId = accountId;
+            this.nativeMessageHandler = provider;
+            this.nativeStorageManager = nativeStorageImpl;
+            this.silentCacheClient = new SilentCacheClient(config, this.nativeStorageManager, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
+            const extensionName = this.nativeMessageHandler.getExtensionId() ===
+                NativeConstants.PREFERRED_EXTENSION_ID
+                ? "chrome"
+                : this.nativeMessageHandler.getExtensionId()?.length
+                    ? "unknown"
+                    : undefined;
+            this.skus = ServerTelemetryManager.makeExtraSkuString({
+                libraryName: BrowserConstants.MSAL_SKU,
+                libraryVersion: version,
+                extensionName: extensionName,
                 extensionVersion: this.nativeMessageHandler.getExtensionVersion(),
-                matsBrokerVersion: mats.broker_version,
-                matsAccountJoinOnStart: mats.account_join_on_start,
-                matsAccountJoinOnEnd: mats.account_join_on_end,
-                matsDeviceJoin: mats.device_join,
-                matsPromptBehavior: mats.prompt_behavior,
-                matsApiErrorCode: mats.api_error_code,
-                matsUiVisible: mats.ui_visible,
-                matsSilentCode: mats.silent_code,
-                matsSilentBiSubCode: mats.silent_bi_sub_code,
-                matsSilentMessage: mats.silent_message,
-                matsSilentStatus: mats.silent_status,
-                matsHttpStatus: mats.http_status,
-                matsHttpEventCount: mats.http_event_count,
-            }, this.correlationId);
-            return mats;
+            });
         }
         /**
-         * Validates native platform response before processing
-         * @param response
+         * Adds SKUs to request extra query parameters
+         * @param request {NativeTokenRequest}
+         * @private
          */
-        validateNativeResponse(response) {
-            if (response.hasOwnProperty("access_token") &&
-                response.hasOwnProperty("id_token") &&
-                response.hasOwnProperty("client_info") &&
-                response.hasOwnProperty("account") &&
-                response.hasOwnProperty("scope") &&
-                response.hasOwnProperty("expires_in")) {
-                return response;
-            }
-            else {
-                throw createAuthError(unexpectedError, "Response missing expected properties.");
-            }
+        addRequestSKUs(request) {
+            request.extraParameters = {
+                ...request.extraParameters,
+                [X_CLIENT_EXTRA_SKU]: this.skus,
+            };
         }
         /**
-         * Gets MATS telemetry from native response
-         * @param response
-         * @returns
+         * Acquire token from native platform via browser extension
+         * @param request
          */
-        getMATSFromResponse(response) {
-            if (response.properties.MATS) {
+        async acquireToken(request, cacheLookupPolicy) {
+            this.performanceClient.addQueueMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+            this.logger.trace("NativeInteractionClient - acquireToken called.");
+            // start the perf measurement
+            const nativeATMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+            const reqTimestamp = nowSeconds();
+            const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+            try {
+                // initialize native request
+                const nativeRequest = await this.initializeNativeRequest(request);
+                // check if the tokens can be retrieved from internal cache
                 try {
-                    return JSON.parse(response.properties.MATS);
+                    const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
+                    nativeATMeasurement.end({
+                        success: true,
+                        isNativeBroker: false,
+                        fromCache: true,
+                    });
+                    return result;
                 }
                 catch (e) {
-                    this.logger.error("NativeInteractionClient - Error parsing MATS telemetry, returning null instead");
+                    if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
+                        this.logger.info("MSAL internal Cache does not contain tokens, return error as per cache policy");
+                        throw e;
+                    }
+                    // continue with a native call for any and all errors
+                    this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
                 }
+                const { ...nativeTokenRequest } = nativeRequest;
+                // fall back to native calls
+                const messageBody = {
+                    method: NativeExtensionMethod.GetToken,
+                    request: nativeTokenRequest,
+                };
+                const response = await this.nativeMessageHandler.sendMessage(messageBody);
+                const validatedResponse = this.validateNativeResponse(response);
+                return await this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
+                    .then((result) => {
+                    nativeATMeasurement.end({
+                        success: true,
+                        isNativeBroker: true,
+                        requestId: result.requestId,
+                    });
+                    serverTelemetryManager.clearNativeBrokerErrorCode();
+                    return result;
+                })
+                    .catch((error) => {
+                    nativeATMeasurement.end({
+                        success: false,
+                        errorCode: error.errorCode,
+                        subErrorCode: error.subError,
+                        isNativeBroker: true,
+                    });
+                    throw error;
+                });
             }
-            return null;
-        }
-        /**
-         * Returns whether or not response came from native cache
-         * @param response
-         * @returns
-         */
-        isResponseFromCache(mats) {
-            if (typeof mats.is_cached === "undefined") {
-                this.logger.verbose("NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false.");
-                return false;
+            catch (e) {
+                if (e instanceof NativeAuthError) {
+                    serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
+                }
+                throw e;
             }
-            return !!mats.is_cached;
         }
         /**
-         * Translates developer provided request object into NativeRequest object
+         * Creates silent flow request
          * @param request
+         * @param cachedAccount
+         * @returns CommonSilentFlowRequest
          */
-        async initializeNativeRequest(request) {
-            this.logger.trace("NativeInteractionClient - initializeNativeRequest called");
-            const requestAuthority = request.authority || this.config.auth.authority;
-            if (request.account) {
-                // validate authority
-                await this.getDiscoveredAuthority({
-                    requestAuthority,
-                    requestAzureCloudOptions: request.azureCloudOptions,
-                    account: request.account,
-                });
-            }
-            const canonicalAuthority = new UrlString(requestAuthority);
-            canonicalAuthority.validateAsUri();
-            // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
-            const { scopes, ...remainingProperties } = request;
-            const scopeSet = new ScopeSet(scopes || []);
-            scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
-            const getPrompt = () => {
-                // If request is silent, prompt is always none
-                switch (this.apiId) {
-                    case ApiId.ssoSilent:
-                    case ApiId.acquireTokenSilent_silentFlow:
-                        this.logger.trace("initializeNativeRequest: silent request sets prompt to none");
-                        return PromptValue.NONE;
-                }
-                // Prompt not provided, request may proceed and native broker decides if it needs to prompt
-                if (!request.prompt) {
-                    this.logger.trace("initializeNativeRequest: prompt was not provided");
-                    return undefined;
-                }
-                // If request is interactive, check if prompt provided is allowed to go directly to native broker
-                switch (request.prompt) {
-                    case PromptValue.NONE:
-                    case PromptValue.CONSENT:
-                    case PromptValue.LOGIN:
-                        this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
-                        return request.prompt;
-                    default:
-                        this.logger.trace(`initializeNativeRequest: prompt = ${request.prompt} is not compatible with native flow`);
-                        throw createBrowserAuthError(nativePromptNotSupported);
-                }
-            };
-            const validatedRequest = {
-                ...remainingProperties,
-                accountId: this.accountId,
-                clientId: this.config.auth.clientId,
-                authority: canonicalAuthority.urlString,
-                scope: scopeSet.printScopes(),
-                redirectUri: this.getRedirectUri(request.redirectUri),
-                prompt: getPrompt(),
+        createSilentCacheRequest(request, cachedAccount) {
+            return {
+                authority: request.authority,
                 correlationId: this.correlationId,
-                tokenType: request.authenticationScheme,
-                windowTitleSubstring: document.title,
-                extraParameters: {
-                    ...request.extraQueryParameters,
-                    ...request.tokenQueryParameters,
-                },
-                extendedExpiryToken: false,
-                keyId: request.popKid,
+                scopes: ScopeSet.fromString(request.scope).asArray(),
+                account: cachedAccount,
+                forceRefresh: false,
             };
-            // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
-            if (validatedRequest.signPopToken && !!request.popKid) {
-                throw createBrowserAuthError(invalidPopTokenRequest);
-            }
-            this.handleExtraBrokerParams(validatedRequest);
-            validatedRequest.extraParameters =
-                validatedRequest.extraParameters || {};
-            validatedRequest.extraParameters.telemetry =
-                NativeConstants.MATS_TELEMETRY;
-            if (request.authenticationScheme === AuthenticationScheme.POP) {
-                // add POP request type
-                const shrParameters = {
-                    resourceRequestUri: request.resourceRequestUri,
-                    resourceRequestMethod: request.resourceRequestMethod,
-                    shrClaims: request.shrClaims,
-                    shrNonce: request.shrNonce,
-                };
-                const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-                // generate reqCnf if not provided in the request
-                let reqCnfData;
-                if (!validatedRequest.keyId) {
-                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
-                    reqCnfData = generatedReqCnfData.reqCnfString;
-                    validatedRequest.keyId = generatedReqCnfData.kid;
-                    validatedRequest.signPopToken = true;
-                }
-                else {
-                    reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
-                    validatedRequest.signPopToken = false;
-                }
-                // SPAs require whole string to be passed to broker
-                validatedRequest.reqCnf = reqCnfData;
-            }
-            this.addRequestSKUs(validatedRequest);
-            return validatedRequest;
         }
         /**
-         * Handles extra broker request parameters
-         * @param request {NativeTokenRequest}
-         * @private
+         * Fetches the tokens from the cache if un-expired
+         * @param nativeAccountId
+         * @param request
+         * @returns authenticationResult
          */
-        handleExtraBrokerParams(request) {
-            const hasExtraBrokerParams = request.extraParameters &&
-                request.extraParameters.hasOwnProperty(BROKER_CLIENT_ID) &&
-                request.extraParameters.hasOwnProperty(BROKER_REDIRECT_URI) &&
-                request.extraParameters.hasOwnProperty(CLIENT_ID);
-            if (!request.embeddedClientId && !hasExtraBrokerParams) {
-                return;
+        async acquireTokensFromCache(nativeAccountId, request) {
+            if (!nativeAccountId) {
+                this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided");
+                throw createClientAuthError(noAccountFound);
             }
-            let child_client_id = "";
-            const child_redirect_uri = request.redirectUri;
-            if (request.embeddedClientId) {
-                request.redirectUri = this.config.auth.redirectUri;
-                child_client_id = request.embeddedClientId;
+            // fetch the account from browser cache
+            const account = this.browserStorage.getBaseAccountInfo({
+                nativeAccountId,
+            });
+            if (!account) {
+                throw createClientAuthError(noAccountFound);
             }
-            else if (request.extraParameters) {
-                request.redirectUri =
-                    request.extraParameters[BROKER_REDIRECT_URI];
-                child_client_id =
-                    request.extraParameters[CLIENT_ID];
+            // leverage silent flow for cached tokens retrieval
+            try {
+                const silentRequest = this.createSilentCacheRequest(request, account);
+                const result = await this.silentCacheClient.acquireToken(silentRequest);
+                const fullAccount = {
+                    ...account,
+                    idTokenClaims: result?.idTokenClaims,
+                    idToken: result?.idToken,
+                };
+                return {
+                    ...result,
+                    account: fullAccount,
+                };
+            }
+            catch (e) {
+                throw e;
             }
-            request.extraParameters = {
-                child_client_id,
-                child_redirect_uri,
-            };
-            this.performanceClient?.addFields({
-                embeddedClientId: child_client_id,
-                embeddedRedirectUri: child_redirect_uri,
-            }, request.correlationId);
-        }
-    }
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    class NativeMessageHandler {
-        constructor(logger, handshakeTimeoutMs, performanceClient, extensionId) {
-            this.logger = logger;
-            this.handshakeTimeoutMs = handshakeTimeoutMs;
-            this.extensionId = extensionId;
-            this.resolvers = new Map(); // Used for non-handshake messages
-            this.handshakeResolvers = new Map(); // Used for handshake messages
-            this.messageChannel = new MessageChannel();
-            this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
-            this.performanceClient = performanceClient;
-            this.handshakeEvent = performanceClient.startMeasurement(PerformanceEvents.NativeMessageHandlerHandshake);
         }
         /**
-         * Sends a given message to the extension and resolves with the extension response
-         * @param body
+         * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
+         * @param {RedirectRequest} request
+         * @param {InProgressPerformanceEvent} rootMeasurement
          */
-        async sendMessage(body) {
-            this.logger.trace("NativeMessageHandler - sendMessage called.");
-            const req = {
-                channel: NativeConstants.CHANNEL_ID,
-                extensionId: this.extensionId,
-                responseId: createNewGuid(),
-                body: body,
+        async acquireTokenRedirect(request, rootMeasurement) {
+            this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
+            const { ...remainingParameters } = request;
+            delete remainingParameters.onRedirectNavigate;
+            const nativeRequest = await this.initializeNativeRequest(remainingParameters);
+            const messageBody = {
+                method: NativeExtensionMethod.GetToken,
+                request: nativeRequest,
             };
-            this.logger.trace("NativeMessageHandler - Sending request to browser extension");
-            this.logger.tracePii(`NativeMessageHandler - Sending request to browser extension: ${JSON.stringify(req)}`);
-            this.messageChannel.port1.postMessage(req);
-            return new Promise((resolve, reject) => {
-                this.resolvers.set(req.responseId, { resolve, reject });
-            });
+            try {
+                const response = await this.nativeMessageHandler.sendMessage(messageBody);
+                this.validateNativeResponse(response);
+            }
+            catch (e) {
+                // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
+                if (e instanceof NativeAuthError) {
+                    const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                    serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
+                    if (isFatalNativeAuthError(e)) {
+                        throw e;
+                    }
+                }
+            }
+            this.browserStorage.setTemporaryCache(TemporaryCacheKeys.NATIVE_REQUEST, JSON.stringify(nativeRequest), true);
+            const navigationOptions = {
+                apiId: ApiId.acquireTokenRedirect,
+                timeout: this.config.system.redirectNavigationTimeout,
+                noHistory: false,
+            };
+            const redirectUri = this.config.auth.navigateToLoginRequestUrl
+                ? window.location.href
+                : this.getRedirectUri(request.redirectUri);
+            rootMeasurement.end({ success: true });
+            await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
         }
         /**
-         * Returns an instance of the MessageHandler that has successfully established a connection with an extension
-         * @param {Logger} logger
-         * @param {number} handshakeTimeoutMs
-         * @param {IPerformanceClient} performanceClient
-         * @param {ICrypto} crypto
+         * If the previous page called native platform for a token using redirect APIs, send the same request again and return the response
+         * @param performanceClient {IPerformanceClient?}
+         * @param correlationId {string?} correlation identifier
          */
-        static async createProvider(logger, handshakeTimeoutMs, performanceClient) {
-            logger.trace("NativeMessageHandler - createProvider called.");
+        async handleRedirectPromise(performanceClient, correlationId) {
+            this.logger.trace("NativeInteractionClient - handleRedirectPromise called.");
+            if (!this.browserStorage.isInteractionInProgress(true)) {
+                this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
+                return null;
+            }
+            // remove prompt from the request to prevent WAM from prompting twice
+            const cachedRequest = this.browserStorage.getCachedNativeRequest();
+            if (!cachedRequest) {
+                this.logger.verbose("NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null.");
+                if (performanceClient && correlationId) {
+                    performanceClient?.addFields({ errorCode: "no_cached_request" }, correlationId);
+                }
+                return null;
+            }
+            const { prompt, ...request } = cachedRequest;
+            if (prompt) {
+                this.logger.verbose("NativeInteractionClient - handleRedirectPromise called and prompt was included in the original request, removing prompt from cached request to prevent second interaction with native broker window.");
+            }
+            this.browserStorage.removeItem(this.browserStorage.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST));
+            const messageBody = {
+                method: NativeExtensionMethod.GetToken,
+                request: request,
+            };
+            const reqTimestamp = nowSeconds();
             try {
-                const preferredProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, performanceClient, NativeConstants.PREFERRED_EXTENSION_ID);
-                await preferredProvider.sendHandshakeRequest();
-                return preferredProvider;
+                this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.");
+                const response = await this.nativeMessageHandler.sendMessage(messageBody);
+                this.validateNativeResponse(response);
+                const result = this.handleNativeResponse(response, request, reqTimestamp);
+                const res = await result;
+                const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                serverTelemetryManager.clearNativeBrokerErrorCode();
+                return res;
             }
             catch (e) {
-                // If preferred extension fails for whatever reason, fallback to using any installed extension
-                const backupProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, performanceClient);
-                await backupProvider.sendHandshakeRequest();
-                return backupProvider;
+                throw e;
             }
         }
         /**
-         * Send handshake request helper.
+         * Logout from native platform via browser extension
+         * @param request
          */
-        async sendHandshakeRequest() {
-            this.logger.trace("NativeMessageHandler - sendHandshakeRequest called.");
-            // Register this event listener before sending handshake
-            window.addEventListener("message", this.windowListener, false); // false is important, because content script message processing should work first
-            const req = {
-                channel: NativeConstants.CHANNEL_ID,
-                extensionId: this.extensionId,
-                responseId: createNewGuid(),
-                body: {
-                    method: NativeExtensionMethod.HandshakeRequest,
-                },
-            };
-            this.handshakeEvent.add({
-                extensionId: this.extensionId,
-                extensionHandshakeTimeoutMs: this.handshakeTimeoutMs,
-            });
-            this.messageChannel.port1.onmessage = (event) => {
-                this.onChannelMessage(event);
-            };
-            window.postMessage(req, window.origin, [this.messageChannel.port2]);
-            return new Promise((resolve, reject) => {
-                this.handshakeResolvers.set(req.responseId, { resolve, reject });
-                this.timeoutId = window.setTimeout(() => {
-                    /*
-                     * Throw an error if neither HandshakeResponse nor original Handshake request are received in a reasonable timeframe.
-                     * This typically suggests an event handler stopped propagation of the Handshake request but did not respond to it on the MessageChannel port
-                     */
-                    window.removeEventListener("message", this.windowListener, false);
-                    this.messageChannel.port1.close();
-                    this.messageChannel.port2.close();
-                    this.handshakeEvent.end({
-                        extensionHandshakeTimedOut: true,
-                        success: false,
-                    });
-                    reject(createBrowserAuthError(nativeHandshakeTimeout));
-                    this.handshakeResolvers.delete(req.responseId);
-                }, this.handshakeTimeoutMs); // Use a reasonable timeout in milliseconds here
-            });
+        logout() {
+            this.logger.trace("NativeInteractionClient - logout called.");
+            return Promise.reject("Logout not implemented yet");
         }
         /**
-         * Invoked when a message is posted to the window. If a handshake request is received it means the extension is not installed.
-         * @param event
+         * Transform response from native platform into AuthenticationResult object which will be returned to the end user
+         * @param response
+         * @param request
+         * @param reqTimestamp
          */
-        onWindowMessage(event) {
-            this.logger.trace("NativeMessageHandler - onWindowMessage called");
-            // We only accept messages from ourselves
-            if (event.source !== window) {
-                return;
-            }
-            const request = event.data;
-            if (!request.channel ||
-                request.channel !== NativeConstants.CHANNEL_ID) {
-                return;
-            }
-            if (request.extensionId && request.extensionId !== this.extensionId) {
-                return;
+        async handleNativeResponse(response, request, reqTimestamp) {
+            this.logger.trace("NativeInteractionClient - handleNativeResponse called.");
+            // generate identifiers
+            const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
+            const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
+            const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
+                nativeAccountId: request.accountId,
+            })?.homeAccountId;
+            // add exception for double brokering, please note this is temporary and will be fortified in future
+            if (request.extraParameters?.child_client_id &&
+                response.account.id !== request.accountId) {
+                this.logger.info("handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch");
             }
-            if (request.body.method === NativeExtensionMethod.HandshakeRequest) {
-                const handshakeResolver = this.handshakeResolvers.get(request.responseId);
-                /*
-                 * Filter out responses with no matched resolvers sooner to keep channel ports open while waiting for
-                 * the proper response.
-                 */
-                if (!handshakeResolver) {
-                    this.logger.trace(`NativeMessageHandler.onWindowMessage - resolver can't be found for request ${request.responseId}`);
-                    return;
-                }
-                // If we receive this message back it means no extension intercepted the request, meaning no extension supporting handshake protocol is installed
-                this.logger.verbose(request.extensionId
-                    ? `Extension with id: ${request.extensionId} not installed`
-                    : "No extension installed");
-                clearTimeout(this.timeoutId);
-                this.messageChannel.port1.close();
-                this.messageChannel.port2.close();
-                window.removeEventListener("message", this.windowListener, false);
-                this.handshakeEvent.end({
-                    success: false,
-                    extensionInstalled: false,
-                });
-                handshakeResolver.reject(createBrowserAuthError(nativeExtensionNotInstalled));
+            else if (homeAccountIdentifier !== cachedhomeAccountId &&
+                response.account.id !== request.accountId) {
+                // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
+                throw createNativeAuthError(userSwitch);
             }
+            // Get the preferred_cache domain for the given authority
+            const authority = await this.getDiscoveredAuthority({
+                requestAuthority: request.authority,
+            });
+            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
+            idTokenClaims.tid, undefined, // auth code payload
+            response.account.id, this.logger);
+            // Ensure expires_in is in number format
+            response.expires_in = Number(response.expires_in);
+            // generate authenticationResult
+            const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
+            // cache accounts and tokens in the appropriate storage
+            await this.cacheAccount(baseAccount);
+            await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
+            return result;
         }
         /**
-         * Invoked when a message is received from the extension on the MessageChannel port
-         * @param event
+         * creates an homeAccountIdentifier for the account
+         * @param response
+         * @param idTokenObj
+         * @returns
          */
-        onChannelMessage(event) {
-            this.logger.trace("NativeMessageHandler - onChannelMessage called.");
-            const request = event.data;
-            const resolver = this.resolvers.get(request.responseId);
-            const handshakeResolver = this.handshakeResolvers.get(request.responseId);
-            try {
-                const method = request.body.method;
-                if (method === NativeExtensionMethod.Response) {
-                    if (!resolver) {
-                        return;
-                    }
-                    const response = request.body.response;
-                    this.logger.trace("NativeMessageHandler - Received response from browser extension");
-                    this.logger.tracePii(`NativeMessageHandler - Received response from browser extension: ${JSON.stringify(response)}`);
-                    if (response.status !== "Success") {
-                        resolver.reject(createNativeAuthError(response.code, response.description, response.ext));
-                    }
-                    else if (response.result) {
-                        if (response.result["code"] &&
-                            response.result["description"]) {
-                            resolver.reject(createNativeAuthError(response.result["code"], response.result["description"], response.result["ext"]));
-                        }
-                        else {
-                            resolver.resolve(response.result);
-                        }
-                    }
-                    else {
-                        throw createAuthError(unexpectedError, "Event does not contain result.");
-                    }
-                    this.resolvers.delete(request.responseId);
+        createHomeAccountIdentifier(response, idTokenClaims) {
+            // Save account in browser storage
+            const homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenClaims);
+            return homeAccountIdentifier;
+        }
+        /**
+         * Helper to generate scopes
+         * @param response
+         * @param request
+         * @returns
+         */
+        generateScopes(response, request) {
+            return response.scope
+                ? ScopeSet.fromString(response.scope)
+                : ScopeSet.fromString(request.scope);
+        }
+        /**
+         * If PoP token is requesred, records the PoP token if returned from the WAM, else generates one in the browser
+         * @param request
+         * @param response
+         */
+        async generatePopAccessToken(response, request) {
+            if (request.tokenType === AuthenticationScheme.POP &&
+                request.signPopToken) {
+                /**
+                 * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
+                 * is still received, SHR is calculated locally
+                 */
+                // Check if native layer returned an SHR token
+                if (response.shr) {
+                    this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer");
+                    return response.shr;
                 }
-                else if (method === NativeExtensionMethod.HandshakeResponse) {
-                    if (!handshakeResolver) {
-                        this.logger.trace(`NativeMessageHandler.onChannelMessage - resolver can't be found for request ${request.responseId}`);
-                        return;
-                    }
-                    clearTimeout(this.timeoutId); // Clear setTimeout
-                    window.removeEventListener("message", this.windowListener, false); // Remove 'No extension' listener
-                    this.extensionId = request.extensionId;
-                    this.extensionVersion = request.body.version;
-                    this.logger.verbose(`NativeMessageHandler - Received HandshakeResponse from extension: ${this.extensionId}`);
-                    this.handshakeEvent.end({
-                        extensionInstalled: true,
-                        success: true,
-                    });
-                    handshakeResolver.resolve();
-                    this.handshakeResolvers.delete(request.responseId);
+                // Generate SHR in msal js if WAM does not compute it when POP is enabled
+                const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+                const shrParameters = {
+                    resourceRequestMethod: request.resourceRequestMethod,
+                    resourceRequestUri: request.resourceRequestUri,
+                    shrClaims: request.shrClaims,
+                    shrNonce: request.shrNonce,
+                };
+                /**
+                 * KeyID must be present in the native request from when the PoP key was generated in order for
+                 * PopTokenGenerator to query the full key for signing
+                 */
+                if (!request.keyId) {
+                    throw createClientAuthError(keyIdMissing);
                 }
-                // Do nothing if method is not Response or HandshakeResponse
+                return popTokenGenerator.signPopToken(response.access_token, request.keyId, shrParameters);
             }
-            catch (err) {
-                this.logger.error("Error parsing response from WAM Extension");
-                this.logger.errorPii(`Error parsing response from WAM Extension: ${err}`);
-                this.logger.errorPii(`Unable to parse ${event}`);
-                if (resolver) {
-                    resolver.reject(err);
-                }
-                else if (handshakeResolver) {
-                    handshakeResolver.reject(err);
-                }
+            else {
+                return response.access_token;
             }
         }
         /**
-         * Returns the Id for the browser extension this handler is communicating with
+         * Generates authentication result
+         * @param response
+         * @param request
+         * @param idTokenObj
+         * @param accountEntity
+         * @param authority
+         * @param reqTimestamp
          * @returns
          */
-        getExtensionId() {
-            return this.extensionId;
+        async generateAuthenticationResult(response, request, idTokenClaims, accountEntity, authority, reqTimestamp) {
+            // Add Native Broker fields to Telemetry
+            const mats = this.addTelemetryFromNativeResponse(response);
+            // If scopes not returned in server response, use request scopes
+            const responseScopes = response.scope
+                ? ScopeSet.fromString(response.scope)
+                : ScopeSet.fromString(request.scope);
+            const accountProperties = response.account.properties || {};
+            const uid = accountProperties["UID"] ||
+                idTokenClaims.oid ||
+                idTokenClaims.sub ||
+                Constants.EMPTY_STRING;
+            const tid = accountProperties["TenantId"] ||
+                idTokenClaims.tid ||
+                Constants.EMPTY_STRING;
+            const accountInfo = updateAccountTenantProfileData(accountEntity.getAccountInfo(), undefined, // tenantProfile optional
+            idTokenClaims, response.id_token);
+            /**
+             * In pairwise broker flows, this check prevents the broker's native account id
+             * from being returned over the embedded app's account id.
+             */
+            if (accountInfo.nativeAccountId !== response.account.id) {
+                accountInfo.nativeAccountId = response.account.id;
+            }
+            // generate PoP token as needed
+            const responseAccessToken = await this.generatePopAccessToken(response, request);
+            const tokenType = request.tokenType === AuthenticationScheme.POP
+                ? AuthenticationScheme.POP
+                : AuthenticationScheme.BEARER;
+            const result = {
+                authority: authority,
+                uniqueId: uid,
+                tenantId: tid,
+                scopes: responseScopes.asArray(),
+                account: accountInfo,
+                idToken: response.id_token,
+                idTokenClaims: idTokenClaims,
+                accessToken: responseAccessToken,
+                fromCache: mats ? this.isResponseFromCache(mats) : false,
+                // Request timestamp and NativeResponse expires_in are in seconds, converting to Date for AuthenticationResult
+                expiresOn: toDateFromSeconds(reqTimestamp + response.expires_in),
+                tokenType: tokenType,
+                correlationId: this.correlationId,
+                state: response.state,
+                fromNativeBroker: true,
+            };
+            return result;
         }
         /**
-         * Returns the version for the browser extension this handler is communicating with
-         * @returns
+         * cache the account entity in browser storage
+         * @param accountEntity
          */
-        getExtensionVersion() {
-            return this.extensionVersion;
+        async cacheAccount(accountEntity) {
+            // Store the account info and hence `nativeAccountId` in browser cache
+            await this.browserStorage.setAccount(accountEntity, this.correlationId);
+            // Remove any existing cached tokens for this account in browser storage
+            this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
+                this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
+            });
         }
         /**
-         * Returns boolean indicating whether or not the request should attempt to use native broker
-         * @param logger
-         * @param config
-         * @param nativeExtensionProvider
-         * @param authenticationScheme
+         * Stores the access_token and id_token in inmemory storage
+         * @param response
+         * @param request
+         * @param homeAccountIdentifier
+         * @param idTokenObj
+         * @param responseAccessToken
+         * @param tenantId
+         * @param reqTimestamp
          */
-        static isPlatformBrokerAvailable(config, logger, nativeExtensionProvider, authenticationScheme) {
-            logger.trace("isPlatformBrokerAvailable called");
-            if (!config.system.allowPlatformBroker) {
-                logger.trace("isPlatformBrokerAvailable: allowPlatformBroker is not enabled, returning false");
-                // Developer disabled WAM
-                return false;
+        cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, responseAccessToken, tenantId, reqTimestamp) {
+            const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || "", request.clientId, idTokenClaims.tid || "");
+            // cache accessToken in inmemory storage
+            const expiresIn = request.tokenType === AuthenticationScheme.POP
+                ? Constants.SHR_NONCE_VALIDITY
+                : (typeof response.expires_in === "string"
+                    ? parseInt(response.expires_in, 10)
+                    : response.expires_in) || 0;
+            const tokenExpirationSeconds = reqTimestamp + expiresIn;
+            const responseScopes = this.generateScopes(response, request);
+            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+            const nativeCacheRecord = {
+                idToken: cachedIdToken,
+                accessToken: cachedAccessToken,
+            };
+            return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, request.storeInCache);
+        }
+        addTelemetryFromNativeResponse(response) {
+            const mats = this.getMATSFromResponse(response);
+            if (!mats) {
+                return null;
             }
-            if (!nativeExtensionProvider) {
-                logger.trace("isPlatformBrokerAvailable: Platform extension provider is not initialized, returning false");
-                // Extension is not available
-                return false;
+            this.performanceClient.addFields({
+                extensionId: this.nativeMessageHandler.getExtensionId(),
+                extensionVersion: this.nativeMessageHandler.getExtensionVersion(),
+                matsBrokerVersion: mats.broker_version,
+                matsAccountJoinOnStart: mats.account_join_on_start,
+                matsAccountJoinOnEnd: mats.account_join_on_end,
+                matsDeviceJoin: mats.device_join,
+                matsPromptBehavior: mats.prompt_behavior,
+                matsApiErrorCode: mats.api_error_code,
+                matsUiVisible: mats.ui_visible,
+                matsSilentCode: mats.silent_code,
+                matsSilentBiSubCode: mats.silent_bi_sub_code,
+                matsSilentMessage: mats.silent_message,
+                matsSilentStatus: mats.silent_status,
+                matsHttpStatus: mats.http_status,
+                matsHttpEventCount: mats.http_event_count,
+            }, this.correlationId);
+            return mats;
+        }
+        /**
+         * Validates native platform response before processing
+         * @param response
+         */
+        validateNativeResponse(response) {
+            if (response.hasOwnProperty("access_token") &&
+                response.hasOwnProperty("id_token") &&
+                response.hasOwnProperty("client_info") &&
+                response.hasOwnProperty("account") &&
+                response.hasOwnProperty("scope") &&
+                response.hasOwnProperty("expires_in")) {
+                return response;
             }
-            if (authenticationScheme) {
-                switch (authenticationScheme) {
-                    case AuthenticationScheme.BEARER:
-                    case AuthenticationScheme.POP:
-                        logger.trace("isPlatformBrokerAvailable: authenticationScheme is supported, returning true");
-                        return true;
-                    default:
-                        logger.trace("isPlatformBrokerAvailable: authenticationScheme is not supported, returning false");
-                        return false;
-                }
+            else {
+                throw createAuthError(unexpectedError, "Response missing expected properties.");
             }
-            return true;
-        }
-    }
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Abstract class which defines operations for a browser interaction handling class.
-     */
-    class InteractionHandler {
-        constructor(authCodeModule, storageImpl, authCodeRequest, logger, performanceClient) {
-            this.authModule = authCodeModule;
-            this.browserStorage = storageImpl;
-            this.authCodeRequest = authCodeRequest;
-            this.logger = logger;
-            this.performanceClient = performanceClient;
         }
         /**
-         * Function to handle response parameters from hash.
-         * @param locationHash
+         * Gets MATS telemetry from native response
+         * @param response
+         * @returns
          */
-        async handleCodeResponse(response, request) {
-            this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
-            let authCodeResponse;
-            try {
-                authCodeResponse = getAuthorizationCodePayload(response, request.state);
-            }
-            catch (e) {
-                if (e instanceof ServerError &&
-                    e.subError === userCancelled) {
-                    // Translate server error caused by user closing native prompt to corresponding first class MSAL error
-                    throw createBrowserAuthError(userCancelled);
+        getMATSFromResponse(response) {
+            if (response.properties.MATS) {
+                try {
+                    return JSON.parse(response.properties.MATS);
                 }
-                else {
-                    throw e;
+                catch (e) {
+                    this.logger.error("NativeInteractionClient - Error parsing MATS telemetry, returning null instead");
                 }
             }
-            return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request);
+            return null;
         }
         /**
-         * Process auth code response from AAD
-         * @param authCodeResponse
-         * @param state
-         * @param authority
-         * @param networkModule
+         * Returns whether or not response came from native cache
+         * @param response
          * @returns
          */
-        async handleCodeResponseFromServer(authCodeResponse, request, validateNonce = true) {
-            this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromServer, request.correlationId);
-            this.logger.trace("InteractionHandler.handleCodeResponseFromServer called");
-            // Assign code to request
-            this.authCodeRequest.code = authCodeResponse.code;
-            // Check for new cloud instance
-            if (authCodeResponse.cloud_instance_host_name) {
-                await invokeAsync(this.authModule.updateAuthority.bind(this.authModule), PerformanceEvents.UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodeResponse.cloud_instance_host_name, request.correlationId);
-            }
-            // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
-            if (validateNonce) {
-                // TODO: Assigning "response nonce" to "request nonce" is confusing. Refactor the function doing validation to accept request nonce directly
-                authCodeResponse.nonce = request.nonce || undefined;
-            }
-            authCodeResponse.state = request.state;
-            // Add CCS parameters if available
-            if (authCodeResponse.client_info) {
-                this.authCodeRequest.clientInfo = authCodeResponse.client_info;
-            }
-            else {
-                const ccsCred = this.createCcsCredentials(request);
-                if (ccsCred) {
-                    this.authCodeRequest.ccsCredential = ccsCred;
-                }
+        isResponseFromCache(mats) {
+            if (typeof mats.is_cached === "undefined") {
+                this.logger.verbose("NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false.");
+                return false;
             }
-            // Acquire token with retrieved code.
-            const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, authCodeResponse));
-            return tokenResponse;
+            return !!mats.is_cached;
         }
         /**
-         * Build ccs creds if available
+         * Translates developer provided request object into NativeRequest object
+         * @param request
          */
-        createCcsCredentials(request) {
+        async initializeNativeRequest(request) {
+            this.logger.trace("NativeInteractionClient - initializeNativeRequest called");
+            const requestAuthority = request.authority || this.config.auth.authority;
             if (request.account) {
-                return {
-                    credential: request.account.homeAccountId,
-                    type: CcsCredentialType.HOME_ACCOUNT_ID,
-                };
+                // validate authority
+                await this.getDiscoveredAuthority({
+                    requestAuthority,
+                    requestAzureCloudOptions: request.azureCloudOptions,
+                    account: request.account,
+                });
             }
-            else if (request.loginHint) {
-                return {
-                    credential: request.loginHint,
-                    type: CcsCredentialType.UPN,
+            const canonicalAuthority = new UrlString(requestAuthority);
+            canonicalAuthority.validateAsUri();
+            // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
+            const { scopes, ...remainingProperties } = request;
+            const scopeSet = new ScopeSet(scopes || []);
+            scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
+            const getPrompt = () => {
+                // If request is silent, prompt is always none
+                switch (this.apiId) {
+                    case ApiId.ssoSilent:
+                    case ApiId.acquireTokenSilent_silentFlow:
+                        this.logger.trace("initializeNativeRequest: silent request sets prompt to none");
+                        return PromptValue.NONE;
+                }
+                // Prompt not provided, request may proceed and native broker decides if it needs to prompt
+                if (!request.prompt) {
+                    this.logger.trace("initializeNativeRequest: prompt was not provided");
+                    return undefined;
+                }
+                // If request is interactive, check if prompt provided is allowed to go directly to native broker
+                switch (request.prompt) {
+                    case PromptValue.NONE:
+                    case PromptValue.CONSENT:
+                    case PromptValue.LOGIN:
+                        this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
+                        return request.prompt;
+                    default:
+                        this.logger.trace(`initializeNativeRequest: prompt = ${request.prompt} is not compatible with native flow`);
+                        throw createBrowserAuthError(nativePromptNotSupported);
+                }
+            };
+            const validatedRequest = {
+                ...remainingProperties,
+                accountId: this.accountId,
+                clientId: this.config.auth.clientId,
+                authority: canonicalAuthority.urlString,
+                scope: scopeSet.printScopes(),
+                redirectUri: this.getRedirectUri(request.redirectUri),
+                prompt: getPrompt(),
+                correlationId: this.correlationId,
+                tokenType: request.authenticationScheme,
+                windowTitleSubstring: document.title,
+                extraParameters: {
+                    ...request.extraQueryParameters,
+                    ...request.tokenQueryParameters,
+                },
+                extendedExpiryToken: false,
+                keyId: request.popKid,
+            };
+            // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
+            if (validatedRequest.signPopToken && !!request.popKid) {
+                throw createBrowserAuthError(invalidPopTokenRequest);
+            }
+            this.handleExtraBrokerParams(validatedRequest);
+            validatedRequest.extraParameters =
+                validatedRequest.extraParameters || {};
+            validatedRequest.extraParameters.telemetry =
+                NativeConstants.MATS_TELEMETRY;
+            if (request.authenticationScheme === AuthenticationScheme.POP) {
+                // add POP request type
+                const shrParameters = {
+                    resourceRequestUri: request.resourceRequestUri,
+                    resourceRequestMethod: request.resourceRequestMethod,
+                    shrClaims: request.shrClaims,
+                    shrNonce: request.shrNonce,
                 };
+                const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+                // generate reqCnf if not provided in the request
+                let reqCnfData;
+                if (!validatedRequest.keyId) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                    validatedRequest.keyId = generatedReqCnfData.kid;
+                    validatedRequest.signPopToken = true;
+                }
+                else {
+                    reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
+                    validatedRequest.signPopToken = false;
+                }
+                // SPAs require whole string to be passed to broker
+                validatedRequest.reqCnf = reqCnfData;
             }
-            return null;
+            this.addRequestSKUs(validatedRequest);
+            return validatedRequest;
         }
-    }
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    function deserializeResponse(responseString, responseLocation, logger) {
-        // Deserialize hash fragment response parameters.
-        const serverParams = getDeserializedResponse(responseString);
-        if (!serverParams) {
-            if (!stripLeadingHashOrQuery(responseString)) {
-                // Hash or Query string is empty
-                logger.error(`The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`);
-                throw createBrowserAuthError(hashEmptyError);
+        /**
+         * Handles extra broker request parameters
+         * @param request {NativeTokenRequest}
+         * @private
+         */
+        handleExtraBrokerParams(request) {
+            const hasExtraBrokerParams = request.extraParameters &&
+                request.extraParameters.hasOwnProperty(BROKER_CLIENT_ID) &&
+                request.extraParameters.hasOwnProperty(BROKER_REDIRECT_URI) &&
+                request.extraParameters.hasOwnProperty(CLIENT_ID);
+            if (!request.embeddedClientId && !hasExtraBrokerParams) {
+                return;
             }
-            else {
-                logger.error(`A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`);
-                logger.errorPii(`The ${responseLocation} detected is: ${responseString}`);
-                throw createBrowserAuthError(hashDoesNotContainKnownProperties);
+            let child_client_id = "";
+            const child_redirect_uri = request.redirectUri;
+            if (request.embeddedClientId) {
+                request.redirectUri = this.config.auth.redirectUri;
+                child_client_id = request.embeddedClientId;
             }
-        }
-        return serverParams;
-    }
-    /**
-     * Returns the interaction type that the response object belongs to
-     */
-    function validateInteractionType(response, browserCrypto, interactionType) {
-        if (!response.state) {
-            throw createBrowserAuthError(noStateInHash);
-        }
-        const platformStateObj = extractBrowserRequestState(browserCrypto, response.state);
-        if (!platformStateObj) {
-            throw createBrowserAuthError(unableToParseState);
-        }
-        if (platformStateObj.interactionType !== interactionType) {
-            throw createBrowserAuthError(stateInteractionTypeMismatch);
+            else if (request.extraParameters) {
+                request.redirectUri =
+                    request.extraParameters[BROKER_REDIRECT_URI];
+                child_client_id =
+                    request.extraParameters[CLIENT_ID];
+            }
+            request.extraParameters = {
+                child_client_id,
+                child_redirect_uri,
+            };
+            this.performanceClient?.addFields({
+                embeddedClientId: child_client_id,
+                embeddedRedirectUri: child_redirect_uri,
+            }, request.correlationId);
         }
     }
 
@@ -14494,9 +14478,147 @@
             throw createClientConfigurationError(pkceParamsMissing);
         }
         const parameters = await invokeAsync(getStandardParameters, PerformanceEvents.GetStandardParams, logger, performanceClient, request.correlationId)(config, authority, request, logger, performanceClient);
-        addResponseTypeCode(parameters);
+        addResponseType(parameters, OAuthResponseType.CODE);
         addCodeChallengeParams(parameters, request.codeChallenge, Constants.S256_CODE_CHALLENGE_METHOD);
+        addExtraQueryParameters(parameters, request.extraQueryParameters || {});
         return getAuthorizeUrl(authority, parameters);
+    }
+    /**
+     * Gets the form that will be posted to /authorize with request parameters when using EAR
+     */
+    async function getEARForm(frame, config, authority, request, logger, performanceClient) {
+        if (!request.earJwk) {
+            throw createBrowserAuthError(earJwkEmpty);
+        }
+        const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
+        addResponseType(parameters, OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN);
+        addEARParameters(parameters, request.earJwk);
+        const queryParams = new Map();
+        addExtraQueryParameters(queryParams, request.extraQueryParameters || {});
+        const url = getAuthorizeUrl(authority, queryParams);
+        return createForm(frame, url, parameters);
+    }
+    /**
+     * Creates form element in the provided document with auth parameters in the post body
+     * @param frame
+     * @param authorizeUrl
+     * @param parameters
+     * @returns
+     */
+    function createForm(frame, authorizeUrl, parameters) {
+        const form = frame.createElement("form");
+        form.method = "post";
+        form.action = authorizeUrl;
+        parameters.forEach((value, key) => {
+            const param = frame.createElement("input");
+            param.hidden = true;
+            param.name = key;
+            param.value = value;
+            form.appendChild(param);
+        });
+        frame.body.appendChild(form);
+        return form;
+    }
+    /**
+     * Response handler when server returns accountId on the /authorize request
+     * @param request
+     * @param accountId
+     * @param apiId
+     * @param config
+     * @param browserStorage
+     * @param nativeStorage
+     * @param eventHandler
+     * @param logger
+     * @param performanceClient
+     * @param nativeMessageHandler
+     * @returns
+     */
+    async function handleResponsePlatformBroker(request, accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler) {
+        if (!nativeMessageHandler) {
+            throw createBrowserAuthError(nativeConnectionNotEstablished);
+        }
+        const browserCrypto = new CryptoOps(logger, performanceClient);
+        const nativeInteractionClient = new NativeInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, config.system.navigationClient, apiId, performanceClient, nativeMessageHandler, accountId, nativeStorage, request.correlationId);
+        const { userRequestState } = ProtocolUtils.parseRequestState(browserCrypto, request.state);
+        return invokeAsync(nativeInteractionClient.acquireToken.bind(nativeInteractionClient), PerformanceEvents.NativeInteractionClientAcquireToken, logger, performanceClient, request.correlationId)({
+            ...request,
+            state: userRequestState,
+            prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
+        });
+    }
+    /**
+     * Response handler when server returns code on the /authorize request
+     * @param request
+     * @param response
+     * @param codeVerifier
+     * @param authClient
+     * @param browserStorage
+     * @param logger
+     * @param performanceClient
+     * @returns
+     */
+    async function handleResponseCode(request, response, codeVerifier, apiId, config, authClient, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler) {
+        // Remove throttle if it exists
+        ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
+        if (response.accountId) {
+            return invokeAsync(handleResponsePlatformBroker, PerformanceEvents.HandleResponsePlatformBroker, logger, performanceClient, request.correlationId)(request, response.accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler);
+        }
+        const authCodeRequest = {
+            ...request,
+            code: response.code || "",
+            codeVerifier: codeVerifier,
+        };
+        // Create popup interaction handler.
+        const interactionHandler = new InteractionHandler(authClient, browserStorage, authCodeRequest, logger, performanceClient);
+        // Handle response from hash string.
+        const result = await invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, logger, performanceClient, request.correlationId)(response, request);
+        return result;
+    }
+    /**
+     * Response handler when server returns ear_jwe on the /authorize request
+     * @param request
+     * @param response
+     * @param apiId
+     * @param config
+     * @param authority
+     * @param browserStorage
+     * @param nativeStorage
+     * @param eventHandler
+     * @param logger
+     * @param performanceClient
+     * @param nativeMessageHandler
+     * @returns
+     */
+    async function handleResponseEAR(request, response, apiId, config, authority, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler) {
+        // Remove throttle if it exists
+        ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
+        // Validate state & check response for errors
+        validateAuthorizationResponse(response, request.state);
+        if (!response.ear_jwe) {
+            throw createBrowserAuthError(earJweEmpty);
+        }
+        if (!request.earJwk) {
+            throw createBrowserAuthError(earJwkEmpty);
+        }
+        const decryptedData = JSON.parse(await invokeAsync(decryptEarResponse, PerformanceEvents.DecryptEarResponse, logger, performanceClient, request.correlationId)(request.earJwk, response.ear_jwe));
+        if (decryptedData.accountId) {
+            return invokeAsync(handleResponsePlatformBroker, PerformanceEvents.HandleResponsePlatformBroker, logger, performanceClient, request.correlationId)(request, decryptedData.accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, nativeMessageHandler);
+        }
+        const responseHandler = new ResponseHandler(config.auth.clientId, browserStorage, new CryptoOps(logger, performanceClient), logger, null, null, performanceClient);
+        // Validate response. This function throws a server error if an error is returned by the server.
+        responseHandler.validateTokenResponse(decryptedData);
+        // Temporary until response handler is refactored to be more flow agnostic.
+        const additionalData = {
+            code: "",
+            state: request.state,
+            nonce: request.nonce,
+            client_info: decryptedData.client_info,
+            cloud_graph_host_name: decryptedData.cloud_graph_host_name,
+            cloud_instance_host_name: decryptedData.cloud_instance_host_name,
+            cloud_instance_name: decryptedData.cloud_instance_name,
+            msgraph_host: decryptedData.msgraph_host,
+        };
+        return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, additionalData, undefined, undefined, undefined, undefined));
     }
 
     /*
@@ -14564,6 +14686,7 @@
             // Properly sets this reference for the unload event.
             this.unloadWindow = this.unloadWindow.bind(this);
             this.nativeStorage = nativeStorageImpl;
+            this.eventHandler = eventHandler;
         }
         /**
          * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
@@ -14639,11 +14762,7 @@
          */
         async acquireTokenPopupAsync(request, popupParams, pkceCodes) {
             this.logger.verbose("acquireTokenPopupAsync called");
-            const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenPopup);
             const validRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, exports.InteractionType.Popup);
-            const pkce = pkceCodes ||
-                (await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId));
-            validRequest.codeChallenge = pkce.challenge;
             /*
              * Skip pre-connect for async popups to reduce time between user interaction and popup window creation to avoid
              * popup from being blocked by browsers with shorter popup timers
@@ -14651,65 +14770,49 @@
             if (popupParams.popup) {
                 preconnect(validRequest.authority);
             }
+            const isPlatformBroker = NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
+            validRequest.platformBroker = isPlatformBroker;
+            if (this.config.auth.protocolMode === ProtocolMode.EAR) {
+                return this.executeEarFlow(validRequest, popupParams);
+            }
+            else {
+                return this.executeCodeFlow(validRequest, popupParams, pkceCodes);
+            }
+        }
+        /**
+         * Executes auth code + PKCE flow
+         * @param request
+         * @param popupParams
+         * @param pkceCodes
+         * @returns
+         */
+        async executeCodeFlow(request, popupParams, pkceCodes) {
+            const correlationId = request.correlationId;
+            const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenPopup);
+            const pkce = pkceCodes ||
+                (await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId));
+            const popupRequest = {
+                ...request,
+                codeChallenge: pkce.challenge,
+            };
             try {
                 // Initialize the client
-                const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
+                const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
                     serverTelemetryManager,
-                    requestAuthority: validRequest.authority,
-                    requestAzureCloudOptions: validRequest.azureCloudOptions,
-                    requestExtraQueryParameters: validRequest.extraQueryParameters,
-                    account: validRequest.account,
+                    requestAuthority: popupRequest.authority,
+                    requestAzureCloudOptions: popupRequest.azureCloudOptions,
+                    requestExtraQueryParameters: popupRequest.extraQueryParameters,
+                    account: popupRequest.account,
                 });
-                const isPlatformBroker = NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
-                // Start measurement for server calls with native brokering enabled
-                let fetchNativeAccountIdMeasurement;
-                if (isPlatformBroker) {
-                    fetchNativeAccountIdMeasurement =
-                        this.performanceClient.startMeasurement(PerformanceEvents.FetchAccountIdWithNativeBroker, request.correlationId);
-                }
                 // Create acquire token url.
-                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, validRequest.correlationId)(this.config, authClient.authority, {
-                    ...validRequest,
-                    platformBroker: isPlatformBroker,
-                }, this.logger, this.performanceClient);
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, popupRequest, this.logger, this.performanceClient);
                 // Show the UI once the url has been created. Get the window handle for the popup.
                 const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
                 // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
                 const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
                 const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
-                // Remove throttle if it exists
-                ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, validRequest);
-                if (serverParams.accountId) {
-                    this.logger.verbose("Account id found in hash, calling WAM for token");
-                    // end measurement for server call with native brokering enabled
-                    if (fetchNativeAccountIdMeasurement) {
-                        fetchNativeAccountIdMeasurement.end({
-                            success: true,
-                            isNativeBroker: true,
-                        });
-                    }
-                    if (!this.nativeMessageHandler) {
-                        throw createBrowserAuthError(nativeConnectionNotEstablished);
-                    }
-                    const nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.nativeStorage, validRequest.correlationId);
-                    const { userRequestState } = ProtocolUtils.parseRequestState(this.browserCrypto, validRequest.state);
-                    return await nativeInteractionClient.acquireToken({
-                        ...validRequest,
-                        state: userRequestState,
-                        prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
-                    });
-                }
-                const authCodeRequest = {
-                    ...validRequest,
-                    code: serverParams.code || "",
-                    codeVerifier: pkce.verifier,
-                };
-                // Create popup interaction handler.
-                const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
-                // Handle response from hash string.
-                const result = await interactionHandler.handleCodeResponse(serverParams, validRequest);
-                return result;
+                return await invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
             }
             catch (e) {
                 // Close the synchronous popup if an error is thrown before the window unload event is registered
@@ -14721,6 +14824,32 @@
                 throw e;
             }
         }
+        /**
+         * Executes EAR flow
+         * @param request
+         */
+        async executeEarFlow(request, popupParams) {
+            const correlationId = request.correlationId;
+            // Get the frame handle for the silent request
+            const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+            });
+            const earJwk = await invokeAsync(generateEarKey, PerformanceEvents.GenerateEarKey, this.logger, this.performanceClient, correlationId)();
+            const popupRequest = {
+                ...request,
+                earJwk: earJwk,
+            };
+            const popupWindow = popupParams.popup || this.openPopup("about:blank", popupParams);
+            const form = await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient);
+            form.submit();
+            // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+            const responseString = await invokeAsync(this.monitorPopupForHash.bind(this), PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupWindow, popupParams.popupWindowParent);
+            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
+            return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, ApiId.acquireTokenPopup, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+        }
         /**
          *
          * @param validRequest
@@ -14796,7 +14925,6 @@
                     e.setCorrelationId(this.correlationId);
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
-                this.browserStorage.setInteractionInProgress(false);
                 this.eventHandler.emitEvent(EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e);
                 this.eventHandler.emitEvent(EventType.LOGOUT_END, exports.InteractionType.Popup);
                 throw e;
@@ -14908,7 +15036,6 @@
             }
             catch (e) {
                 this.logger.error("error opening popup " + e.message);
-                this.browserStorage.setInteractionInProgress(false);
                 throw createBrowserAuthError(popupWindowError);
             }
         }
@@ -14966,7 +15093,6 @@
          * Event callback to unload main window.
          */
         unloadWindow(e) {
-            this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Popup);
             if (this.currentWindow) {
                 this.currentWindow.close();
             }
@@ -14982,8 +15108,6 @@
             popupWindow.close();
             // Remove window unload function
             popupWindowParent.removeEventListener("beforeunload", this.unloadWindow);
-            // Interaction is completed - remove interaction status.
-            this.browserStorage.setInteractionInProgress(false);
         }
         /**
          * Generates the name for the popup based on the client id and request
@@ -15004,141 +15128,6 @@
         }
     }
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    class RedirectHandler {
-        constructor(authCodeModule, storageImpl, authCodeRequest, logger, performanceClient) {
-            this.authModule = authCodeModule;
-            this.browserStorage = storageImpl;
-            this.authCodeRequest = authCodeRequest;
-            this.logger = logger;
-            this.performanceClient = performanceClient;
-        }
-        /**
-         * Redirects window to given URL.
-         * @param urlNavigate
-         */
-        async initiateAuthRequest(requestUrl, params) {
-            this.logger.verbose("RedirectHandler.initiateAuthRequest called");
-            // Navigate if valid URL
-            if (requestUrl) {
-                // Cache start page, returns to this page after redirectUri if navigateToLoginRequestUrl is true
-                if (params.redirectStartPage) {
-                    this.logger.verbose("RedirectHandler.initiateAuthRequest: redirectStartPage set, caching start page");
-                    this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, params.redirectStartPage, true);
-                }
-                // Set interaction status in the library.
-                this.browserStorage.setTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, this.authCodeRequest.correlationId, true);
-                this.browserStorage.cacheCodeRequest(this.authCodeRequest);
-                this.logger.infoPii(`RedirectHandler.initiateAuthRequest: Navigate to: ${requestUrl}`);
-                const navigationOptions = {
-                    apiId: ApiId.acquireTokenRedirect,
-                    timeout: params.redirectTimeout,
-                    noHistory: false,
-                };
-                // If onRedirectNavigate is implemented, invoke it and provide requestUrl
-                if (typeof params.onRedirectNavigate === "function") {
-                    this.logger.verbose("RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback");
-                    const navigate = params.onRedirectNavigate(requestUrl);
-                    // Returning false from onRedirectNavigate will stop navigation
-                    if (navigate !== false) {
-                        this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating");
-                        await params.navigationClient.navigateExternal(requestUrl, navigationOptions);
-                        return;
-                    }
-                    else {
-                        this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation");
-                        return;
-                    }
-                }
-                else {
-                    // Navigate window to request URL
-                    this.logger.verbose("RedirectHandler.initiateAuthRequest: Navigating window to navigate url");
-                    await params.navigationClient.navigateExternal(requestUrl, navigationOptions);
-                    return;
-                }
-            }
-            else {
-                // Throw error if request URL is empty.
-                this.logger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty");
-                throw createBrowserAuthError(emptyNavigateUri);
-            }
-        }
-        /**
-         * Handle authorization code response in the window.
-         * @param hash
-         */
-        async handleCodeResponse(response, state) {
-            this.logger.verbose("RedirectHandler.handleCodeResponse called");
-            // Interaction is completed - remove interaction status.
-            this.browserStorage.setInteractionInProgress(false);
-            // Handle code response.
-            const stateKey = this.browserStorage.generateStateKey(state);
-            const requestState = this.browserStorage.getTemporaryCache(stateKey);
-            if (!requestState) {
-                throw createClientAuthError(stateNotFound, "Cached State");
-            }
-            let authCodeResponse;
-            try {
-                authCodeResponse = getAuthorizationCodePayload(response, requestState);
-            }
-            catch (e) {
-                if (e instanceof ServerError &&
-                    e.subError === userCancelled) {
-                    // Translate server error caused by user closing native prompt to corresponding first class MSAL error
-                    throw createBrowserAuthError(userCancelled);
-                }
-                else {
-                    throw e;
-                }
-            }
-            // Get cached items
-            const nonceKey = this.browserStorage.generateNonceKey(requestState);
-            const cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
-            // Assign code to request
-            this.authCodeRequest.code = authCodeResponse.code;
-            // Check for new cloud instance
-            if (authCodeResponse.cloud_instance_host_name) {
-                await invokeAsync(this.authModule.updateAuthority.bind(this.authModule), PerformanceEvents.UpdateTokenEndpointAuthority, this.logger, this.performanceClient, this.authCodeRequest.correlationId)(authCodeResponse.cloud_instance_host_name, this.authCodeRequest.correlationId);
-            }
-            authCodeResponse.nonce = cachedNonce || undefined;
-            authCodeResponse.state = requestState;
-            // Add CCS parameters if available
-            if (authCodeResponse.client_info) {
-                this.authCodeRequest.clientInfo = authCodeResponse.client_info;
-            }
-            else {
-                const cachedCcsCred = this.checkCcsCredentials();
-                if (cachedCcsCred) {
-                    this.authCodeRequest.ccsCredential = cachedCcsCred;
-                }
-            }
-            // Acquire token with retrieved code.
-            const tokenResponse = (await this.authModule.acquireToken(this.authCodeRequest, authCodeResponse));
-            this.browserStorage.cleanRequestByState(state);
-            return tokenResponse;
-        }
-        /**
-         * Looks up ccs creds in the cache
-         */
-        checkCcsCredentials() {
-            // Look up ccs credential in temp cache
-            const cachedCcsCred = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CCS_CREDENTIAL, true);
-            if (cachedCcsCred) {
-                try {
-                    return JSON.parse(cachedCcsCred);
-                }
-                catch (e) {
-                    this.authModule.logger.error("Cache credential could not be parsed");
-                    this.authModule.logger.errorPii(`Cache credential could not be parsed: ${cachedCcsCred}`);
-                }
-            }
-            return null;
-        }
-    }
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -15166,62 +15155,96 @@
          */
         async acquireToken(request) {
             const validRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, exports.InteractionType.Redirect);
-            const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId);
-            validRequest.codeChallenge = pkceCodes.challenge;
-            this.browserStorage.updateCacheEntries(validRequest.state, validRequest.nonce, validRequest.authority, validRequest.loginHint || "", validRequest.account || null);
-            const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenRedirect);
+            validRequest.platformBroker =
+                NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
             const handleBackButton = (event) => {
                 // Clear temporary cache if the back button is clicked during the redirect flow.
                 if (event.persisted) {
                     this.logger.verbose("Page was restored from back/forward cache. Clearing temporary cache.");
-                    this.browserStorage.cleanRequestByState(validRequest.state);
+                    this.browserStorage.resetRequestCache();
                     this.eventHandler.emitEvent(EventType.RESTORE_FROM_BFCACHE, exports.InteractionType.Redirect);
                 }
             };
+            const redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
+            this.logger.verbosePii(`Redirect start page: ${redirectStartPage}`);
+            // Cache start page, returns to this page after redirectUri if navigateToLoginRequestUrl is true
+            this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, redirectStartPage, true);
+            // Clear temporary cache if the back button is clicked during the redirect flow.
+            window.addEventListener("pageshow", handleBackButton);
+            try {
+                if (this.config.auth.protocolMode === ProtocolMode.EAR) {
+                    await this.executeEarFlow(validRequest);
+                }
+                else {
+                    await this.executeCodeFlow(validRequest, request.onRedirectNavigate);
+                }
+            }
+            catch (e) {
+                if (e instanceof AuthError) {
+                    e.setCorrelationId(this.correlationId);
+                }
+                window.removeEventListener("pageshow", handleBackButton);
+                throw e;
+            }
+        }
+        /**
+         * Executes auth code + PKCE flow
+         * @param request
+         * @returns
+         */
+        async executeCodeFlow(request, onRedirectNavigate) {
+            const correlationId = request.correlationId;
+            const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenRedirect);
+            const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
+            const redirectRequest = {
+                ...request,
+                codeChallenge: pkceCodes.challenge,
+            };
+            this.browserStorage.cacheAuthorizeRequest(redirectRequest, pkceCodes.verifier);
             try {
                 // Initialize the client
                 const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
                     serverTelemetryManager,
-                    requestAuthority: validRequest.authority,
-                    requestAzureCloudOptions: validRequest.azureCloudOptions,
-                    requestExtraQueryParameters: validRequest.extraQueryParameters,
-                    account: validRequest.account,
+                    requestAuthority: redirectRequest.authority,
+                    requestAzureCloudOptions: redirectRequest.azureCloudOptions,
+                    requestExtraQueryParameters: redirectRequest.extraQueryParameters,
+                    account: redirectRequest.account,
                 });
-                const authCodeRequest = {
-                    ...validRequest,
-                    code: "",
-                    codeVerifier: pkceCodes.verifier,
-                };
-                // Create redirect interaction handler.
-                const interactionHandler = new RedirectHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
                 // Create acquire token url.
-                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, validRequest.correlationId)(this.config, authClient.authority, {
-                    ...validRequest,
-                    platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme),
-                }, this.logger, this.performanceClient);
-                const redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
-                this.logger.verbosePii(`Redirect start page: ${redirectStartPage}`);
-                // Clear temporary cache if the back button is clicked during the redirect flow.
-                window.addEventListener("pageshow", handleBackButton);
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, request.correlationId)(this.config, authClient.authority, redirectRequest, this.logger, this.performanceClient);
                 // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
-                return await interactionHandler.initiateAuthRequest(navigateUrl, {
-                    navigationClient: this.navigationClient,
-                    redirectTimeout: this.config.system.redirectNavigationTimeout,
-                    redirectStartPage: redirectStartPage,
-                    onRedirectNavigate: request.onRedirectNavigate ||
-                        this.config.auth.onRedirectNavigate,
-                });
+                return await this.initiateAuthRequest(navigateUrl, onRedirectNavigate);
             }
             catch (e) {
                 if (e instanceof AuthError) {
                     e.setCorrelationId(this.correlationId);
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
-                window.removeEventListener("pageshow", handleBackButton);
-                this.browserStorage.cleanRequestByState(validRequest.state);
                 throw e;
             }
         }
+        /**
+         * Executes EAR flow
+         * @param request
+         */
+        async executeEarFlow(request) {
+            const correlationId = request.correlationId;
+            // Get the frame handle for the silent request
+            const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+            });
+            const earJwk = await invokeAsync(generateEarKey, PerformanceEvents.GenerateEarKey, this.logger, this.performanceClient, correlationId)();
+            const redirectRequest = {
+                ...request,
+                earJwk: earJwk,
+            };
+            this.browserStorage.cacheAuthorizeRequest(redirectRequest);
+            const form = await getEARForm(document, this.config, discoveredAuthority, redirectRequest, this.logger, this.performanceClient);
+            form.submit();
+        }
         /**
          * Checks if navigateToLoginRequestUrl is set, and:
          * - if true, performs logic to cache and navigate
@@ -15229,18 +15252,14 @@
          * @param hash {string} url hash
          * @param parentMeasurement {InProgressPerformanceEvent} parent measurement
          */
-        async handleRedirectPromise(hash = "", parentMeasurement) {
+        async handleRedirectPromise(hash = "", request, pkceVerifier, parentMeasurement) {
             const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.handleRedirectPromise);
             try {
-                if (!this.browserStorage.isInteractionInProgress(true)) {
-                    this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
-                    return null;
-                }
                 const [serverParams, responseString] = this.getRedirectResponse(hash || "");
                 if (!serverParams) {
                     // Not a recognized server response hash or hash not associated with a redirect request
                     this.logger.info("handleRedirectPromise did not detect a response as a result of a redirect. Cleaning temporary cache.");
-                    this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Redirect);
+                    this.browserStorage.resetRequestCache();
                     // Do not instrument "no_server_response" if user clicked back button
                     if (getNavigationType() !== "back_forward") {
                         parentMeasurement.event.errorCode = "no_server_response";
@@ -15262,12 +15281,12 @@
                         // Replace current hash with non-msal hash, if present
                         replaceHash(loginRequestUrl);
                     }
-                    const handleHashResult = await this.handleResponse(serverParams, serverTelemetryManager);
+                    const handleHashResult = await this.handleResponse(serverParams, request, pkceVerifier, serverTelemetryManager);
                     return handleHashResult;
                 }
                 else if (!this.config.auth.navigateToLoginRequestUrl) {
                     this.logger.verbose("NavigateToLoginRequestUrl set to false, handling response");
-                    return await this.handleResponse(serverParams, serverTelemetryManager);
+                    return await this.handleResponse(serverParams, request, pkceVerifier, serverTelemetryManager);
                 }
                 else if (!isInIframe() ||
                     this.config.system.allowRedirectInIframe) {
@@ -15303,7 +15322,7 @@
                     }
                     // If navigateInternal implementation returns false, handle the hash now
                     if (!processHashOnRedirect) {
-                        return await this.handleResponse(serverParams, serverTelemetryManager);
+                        return await this.handleResponse(serverParams, request, pkceVerifier, serverTelemetryManager);
                     }
                 }
                 return null;
@@ -15313,7 +15332,6 @@
                     e.setCorrelationId(this.correlationId);
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
-                this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Redirect);
                 throw e;
             }
         }
@@ -15366,39 +15384,67 @@
          * @param hash
          * @param state
          */
-        async handleResponse(serverParams, serverTelemetryManager) {
+        async handleResponse(serverParams, request, codeVerifier, serverTelemetryManager) {
             const state = serverParams.state;
             if (!state) {
                 throw createBrowserAuthError(noStateInHash);
             }
-            const cachedRequest = this.browserStorage.getCachedRequest(state);
-            this.logger.verbose("handleResponse called, retrieved cached request");
-            if (serverParams.accountId) {
-                this.logger.verbose("Account id found in hash, calling WAM for token");
-                if (!this.nativeMessageHandler) {
-                    throw createBrowserAuthError(nativeConnectionNotEstablished);
-                }
-                const nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.nativeStorage, cachedRequest.correlationId);
-                const { userRequestState } = ProtocolUtils.parseRequestState(this.browserCrypto, state);
-                return nativeInteractionClient
-                    .acquireToken({
-                    ...cachedRequest,
-                    state: userRequestState,
-                    prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
-                })
-                    .finally(() => {
-                    this.browserStorage.cleanRequestByState(state);
+            if (serverParams.ear_jwe) {
+                const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, request.correlationId)({
+                    requestAuthority: request.authority,
+                    requestAzureCloudOptions: request.azureCloudOptions,
+                    requestExtraQueryParameters: request.extraQueryParameters,
+                    account: request.account,
                 });
+                return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, request.correlationId)(request, serverParams, ApiId.acquireTokenRedirect, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+            }
+            const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({ serverTelemetryManager, requestAuthority: request.authority });
+            return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, request.correlationId)(request, serverParams, codeVerifier, ApiId.acquireTokenRedirect, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+        }
+        /**
+         * Redirects window to given URL.
+         * @param urlNavigate
+         * @param onRedirectNavigateRequest - onRedirectNavigate callback provided on the request
+         */
+        async initiateAuthRequest(requestUrl, onRedirectNavigateRequest) {
+            this.logger.verbose("RedirectHandler.initiateAuthRequest called");
+            // Navigate if valid URL
+            if (requestUrl) {
+                this.logger.infoPii(`RedirectHandler.initiateAuthRequest: Navigate to: ${requestUrl}`);
+                const navigationOptions = {
+                    apiId: ApiId.acquireTokenRedirect,
+                    timeout: this.config.system.redirectNavigationTimeout,
+                    noHistory: false,
+                };
+                const onRedirectNavigate = onRedirectNavigateRequest ||
+                    this.config.auth.onRedirectNavigate;
+                // If onRedirectNavigate is implemented, invoke it and provide requestUrl
+                if (typeof onRedirectNavigate === "function") {
+                    this.logger.verbose("RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback");
+                    const navigate = onRedirectNavigate(requestUrl);
+                    // Returning false from onRedirectNavigate will stop navigation
+                    if (navigate !== false) {
+                        this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating");
+                        await this.navigationClient.navigateExternal(requestUrl, navigationOptions);
+                        return;
+                    }
+                    else {
+                        this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation");
+                        return;
+                    }
+                }
+                else {
+                    // Navigate window to request URL
+                    this.logger.verbose("RedirectHandler.initiateAuthRequest: Navigating window to navigate url");
+                    await this.navigationClient.navigateExternal(requestUrl, navigationOptions);
+                    return;
+                }
             }
-            // Hash contains known properties - handle and return in callback
-            const currentAuthority = this.browserStorage.getCachedAuthority(state);
-            if (!currentAuthority) {
-                throw createBrowserAuthError(noCachedAuthorityError);
+            else {
+                // Throw error if request URL is empty.
+                this.logger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty");
+                throw createBrowserAuthError(emptyNavigateUri);
             }
-            const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({ serverTelemetryManager, requestAuthority: currentAuthority });
-            ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, cachedRequest);
-            const interactionHandler = new RedirectHandler(authClient, this.browserStorage, cachedRequest, this.logger, this.performanceClient);
-            return interactionHandler.handleCodeResponse(serverParams, state);
         }
         /**
          * Use to log out the current user, and redirect the user to the postLogoutRedirectUri.
@@ -15497,7 +15543,7 @@
      * @param urlNavigate
      * @param userRequestScopes
      */
-    async function initiateAuthRequest(requestUrl, performanceClient, logger, correlationId, navigateFrameWait) {
+    async function initiateCodeRequest(requestUrl, performanceClient, logger, correlationId, navigateFrameWait) {
         performanceClient.addQueueMeasurement(PerformanceEvents.SilentHandlerInitiateAuthRequest, correlationId);
         if (!requestUrl) {
             // Throw error if request URL is empty.
@@ -15509,6 +15555,15 @@
         }
         return invoke(loadFrameSync, PerformanceEvents.SilentHandlerLoadFrameSync, logger, performanceClient, correlationId)(requestUrl);
     }
+    async function initiateEarRequest(config, authority, request, logger, performanceClient) {
+        const frame = createHiddenIframe();
+        if (!frame.contentDocument) {
+            throw "No document associated with iframe!";
+        }
+        const form = await getEARForm(frame.contentDocument, config, authority, request, logger, performanceClient);
+        form.submit();
+        return frame;
+    }
     /**
      * Monitors an iframe content window until it loads a url with a known hash, or hits a specified timeout.
      * @param iframe
@@ -15659,19 +15714,34 @@
             }
             // Create silent request
             const silentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)(inputRequest, exports.InteractionType.Silent);
+            silentRequest.platformBroker =
+                NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme);
             preconnect(silentRequest.authority);
-            const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+            if (this.config.auth.protocolMode === ProtocolMode.EAR) {
+                return this.executeEarFlow(silentRequest);
+            }
+            else {
+                return this.executeCodeFlow(silentRequest);
+            }
+        }
+        /**
+         * Executes auth code + PKCE flow
+         * @param request
+         * @returns
+         */
+        async executeCodeFlow(request) {
             let authClient;
+            const serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
             try {
                 // Initialize the client
                 authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
                     serverTelemetryManager,
-                    requestAuthority: silentRequest.authority,
-                    requestAzureCloudOptions: silentRequest.azureCloudOptions,
-                    requestExtraQueryParameters: silentRequest.extraQueryParameters,
-                    account: silentRequest.account,
+                    requestAuthority: request.authority,
+                    requestAzureCloudOptions: request.azureCloudOptions,
+                    requestExtraQueryParameters: request.extraQueryParameters,
+                    account: request.account,
                 });
-                return await invokeAsync(this.silentTokenHelper.bind(this), PerformanceEvents.SilentIframeClientTokenHelper, this.logger, this.performanceClient, request.correlationId)(authClient, silentRequest);
+                return await invokeAsync(this.silentTokenHelper.bind(this), PerformanceEvents.SilentIframeClientTokenHelper, this.logger, this.performanceClient, request.correlationId)(authClient, request);
             }
             catch (e) {
                 if (e instanceof AuthError) {
@@ -15686,10 +15756,33 @@
                 this.performanceClient.addFields({
                     retryError: e.errorCode,
                 }, this.correlationId);
-                const retrySilentRequest = await invokeAsync(this.initializeAuthorizationRequest.bind(this), PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, request.correlationId)(inputRequest, exports.InteractionType.Silent);
-                return await invokeAsync(this.silentTokenHelper.bind(this), PerformanceEvents.SilentIframeClientTokenHelper, this.logger, this.performanceClient, this.correlationId)(authClient, retrySilentRequest);
+                return await invokeAsync(this.silentTokenHelper.bind(this), PerformanceEvents.SilentIframeClientTokenHelper, this.logger, this.performanceClient, this.correlationId)(authClient, request);
             }
         }
+        /**
+         * Executes EAR flow
+         * @param request
+         */
+        async executeEarFlow(request) {
+            const correlationId = request.correlationId;
+            const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+            });
+            const earJwk = await invokeAsync(generateEarKey, PerformanceEvents.GenerateEarKey, this.logger, this.performanceClient, correlationId)();
+            const silentRequest = {
+                ...request,
+                earJwk: earJwk,
+            };
+            const msalFrame = await invokeAsync(initiateEarRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+            const responseType = this.config.auth.OIDCOptions.serverResponseType;
+            // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+            const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
+            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger);
+            return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
+        }
         /**
          * Currently Unsupported
          */
@@ -15706,44 +15799,20 @@
         async silentTokenHelper(authClient, request) {
             const correlationId = request.correlationId;
             this.performanceClient.addQueueMeasurement(PerformanceEvents.SilentIframeClientTokenHelper, correlationId);
-            const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId);
+            const pkceCodes = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
             const silentRequest = {
                 ...request,
                 codeChallenge: pkceCodes.challenge,
             };
             // Create authorize request url
-            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, {
-                ...silentRequest,
-                platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme),
-            }, this.logger, this.performanceClient);
+            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
             // Get the frame handle for the silent request
-            const msalFrame = await invokeAsync(initiateAuthRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+            const msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
             const responseType = this.config.auth.OIDCOptions.serverResponseType;
             // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
             const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
-            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, responseType, this.logger);
-            if (serverParams.accountId) {
-                this.logger.verbose("Account id found in hash, calling WAM for token");
-                if (!this.nativeMessageHandler) {
-                    throw createBrowserAuthError(nativeConnectionNotEstablished);
-                }
-                const nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.browserStorage, correlationId);
-                const { userRequestState } = ProtocolUtils.parseRequestState(this.browserCrypto, silentRequest.state);
-                return invokeAsync(nativeInteractionClient.acquireToken.bind(nativeInteractionClient), PerformanceEvents.NativeInteractionClientAcquireToken, this.logger, this.performanceClient, correlationId)({
-                    ...silentRequest,
-                    state: userRequestState,
-                    prompt: silentRequest.prompt || PromptValue.NONE,
-                });
-            }
-            const authCodeRequest = {
-                ...silentRequest,
-                code: serverParams.code || "",
-                codeVerifier: pkceCodes.verifier,
-            };
-            // Create silent handler
-            const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
-            // Handle response from hash string
-            return invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, this.logger, this.performanceClient, correlationId)(serverParams, silentRequest);
+            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger);
+            return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.nativeMessageHandler);
         }
     }
 
@@ -16272,31 +16341,38 @@
          * @returns
          */
         async handleRedirectPromiseInternal(hash) {
+            if (!this.browserStorage.isInteractionInProgress(true)) {
+                this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
+                return null;
+            }
             const loggedInAccounts = this.getAllAccounts();
-            const request = this.browserStorage.getCachedNativeRequest();
-            const useNative = request &&
+            const platformBrokerRequest = this.browserStorage.getCachedNativeRequest();
+            const useNative = platformBrokerRequest &&
                 NativeMessageHandler.isPlatformBrokerAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
                 this.nativeExtensionProvider &&
                 !hash;
-            const correlationId = useNative
-                ? request?.correlationId
-                : this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || "";
-            const rootMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenRedirect, correlationId);
+            let rootMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenRedirect, platformBrokerRequest?.correlationId || "");
             this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
             let redirectResponse;
             if (useNative && this.nativeExtensionProvider) {
                 this.logger.trace("handleRedirectPromise - acquiring token from native platform");
-                const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, this.nativeInternalStorage, request.correlationId);
+                const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
                 redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), PerformanceEvents.HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
             }
             else {
+                const [standardRequest, codeVerifier] = this.browserStorage.getCachedRequest();
+                const correlationId = standardRequest.correlationId;
+                // Reset rootMeasurement now that we have correlationId
+                rootMeasurement.discard();
+                rootMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenRedirect, correlationId);
                 this.logger.trace("handleRedirectPromise - acquiring token from web flow");
                 const redirectClient = this.createRedirectClient(correlationId);
-                redirectResponse = invokeAsync(redirectClient.handleRedirectPromise.bind(redirectClient), PerformanceEvents.HandleRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(hash, rootMeasurement);
+                redirectResponse = invokeAsync(redirectClient.handleRedirectPromise.bind(redirectClient), PerformanceEvents.HandleRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(hash, standardRequest, codeVerifier, rootMeasurement);
             }
             return redirectResponse
                 .then((result) => {
                 if (result) {
+                    this.browserStorage.resetRequestCache();
                     // Emit login event if number of accounts change
                     const isLoggingIn = loggedInAccounts.length < this.getAllAccounts().length;
                     if (isLoggingIn) {
@@ -16328,6 +16404,7 @@
                 return result;
             })
                 .catch((e) => {
+                this.browserStorage.resetRequestCache();
                 const eventError = e;
                 // Emit login event if there is an account
                 if (loggedInAccounts.length > 0) {
@@ -16421,7 +16498,6 @@
                             const redirectClient = this.createRedirectClient(correlationId);
                             return redirectClient.acquireToken(request);
                         }
-                        this.browserStorage.setInteractionInProgress(false);
                         throw e;
                     });
                 }
@@ -16432,6 +16508,7 @@
                 return await result;
             }
             catch (e) {
+                this.browserStorage.resetRequestCache();
                 atrMeasurement.end({ success: false }, e);
                 if (isLoggedIn) {
                     this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Redirect, null, e);
@@ -16483,7 +16560,6 @@
                     correlationId,
                 }, ApiId.acquireTokenPopup)
                     .then((response) => {
-                    this.browserStorage.setInteractionInProgress(false);
                     atPopupMeasurement.end({
                         success: true,
                         isNativeBroker: true,
@@ -16503,7 +16579,6 @@
                         const popupClient = this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request, pkce);
                     }
-                    this.browserStorage.setInteractionInProgress(false);
                     throw e;
                 });
             }
@@ -16544,8 +16619,12 @@
                 // Since this function is syncronous we need to reject
                 return Promise.reject(e);
             })
-                .finally(() => this.config.system.asyncPopups &&
-                this.preGeneratePkceCodes(correlationId));
+                .finally(async () => {
+                this.browserStorage.setInteractionInProgress(false);
+                if (this.config.system.asyncPopups) {
+                    await this.preGeneratePkceCodes(correlationId);
+                }
+            });
         }
         trackPageVisibilityWithMeasurement() {
             const measurement = this.ssoSilentMeasurement ||
@@ -16848,7 +16927,9 @@
                 preflightCheck$1(this.initialized);
                 this.browserStorage.setInteractionInProgress(true);
                 const popupClient = this.createPopupClient(correlationId);
-                return popupClient.logout(logoutRequest);
+                return popupClient.logout(logoutRequest).finally(() => {
+                    this.browserStorage.setInteractionInProgress(false);
+                });
             }
             catch (e) {
                 // Since this function is syncronous we need to reject