@azure/msal-browser 5.0.0-alpha.0 → 5.0.1

package/dist/cache/BrowserCacheManager.mjs

@@ -1,9 +1,9 @@
-/*! @azure/msal-browser v5.0.0-alpha.0 2025-10-02 */
+/*! @azure/msal-browser v5.0.1 2026-01-16 */
 'use strict';
-import { CacheManager, CacheHelpers, TimeUtils, Constants, createCacheError, CacheErrorCodes, invokeAsync, PerformanceEvents, AccountEntityUtils, StringUtils, CacheError, DEFAULT_CRYPTO_IMPLEMENTATION } from '@azure/msal-common/browser';
+import { CacheManager, TimeUtils, CacheHelpers, Constants, AuthToken, getTenantIdFromIdTokenClaims, buildTenantProfile, AccountEntityUtils, createCacheError, CacheErrorCodes, invokeAsync, PerformanceEvents, StringUtils, CacheError, DEFAULT_CRYPTO_IMPLEMENTATION } from '@azure/msal-common/browser';
 import { createBrowserAuthError } from '../error/BrowserAuthError.mjs';
-import { BrowserCacheLocation, InMemoryCacheKeys, TemporaryCacheKeys, INTERACTION_TYPE } from '../utils/BrowserConstants.mjs';
-import { ACCOUNT_SCHEMA_VERSION, CREDENTIAL_SCHEMA_VERSION, getAccountKeysCacheKey, PREFIX, CACHE_KEY_SEPARATOR, VERSION_CACHE_KEY, getTokenKeysCacheKey } from './CacheKeys.mjs';
+import { InMemoryCacheKeys, BrowserCacheLocation, TemporaryCacheKeys, INTERACTION_TYPE } from '../utils/BrowserConstants.mjs';
+import { ACCOUNT_SCHEMA_VERSION, CREDENTIAL_SCHEMA_VERSION, VERSION_CACHE_KEY, getTokenKeysCacheKey, getAccountKeysCacheKey, PREFIX, CACHE_KEY_SEPARATOR } from './CacheKeys.mjs';
 import { LocalStorage } from './LocalStorage.mjs';
 import { SessionStorage } from './SessionStorage.mjs';
 import { MemoryStorage } from './MemoryStorage.mjs';
@@ -12,7 +12,7 @@ import { base64Encode } from '../encode/Base64Encode.mjs';
 import { CookieStorage } from './CookieStorage.mjs';
 import { getAccountKeys, getTokenKeys } from './CacheHelpers.mjs';
 import { EventType } from '../event/EventType.mjs';
-import { clearHash } from '../utils/BrowserUtils.mjs';
+import { clearHash, cancelPendingBridgeResponse } from '../utils/BrowserUtils.mjs';
 import { version } from '../packageMetadata.mjs';
 import { removeElementFromArray } from '../utils/Helpers.mjs';
 import { isEncrypted } from './EncryptedData.mjs';
@@ -49,108 +49,338 @@ class BrowserCacheManager extends CacheManager {
      * Migrates any existing cache data from previous versions of MSAL.js into the current cache structure.
      */
     async migrateExistingCache(correlationId) {
-        const accountKeys0 = getAccountKeys(this.browserStorage, 0);
-        const tokenKeys0 = getTokenKeys(this.clientId, this.browserStorage, 0);
+        let accountKeys = getAccountKeys(this.browserStorage);
+        let tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
         this.performanceClient.addFields({
-            oldAccountCount: accountKeys0.length,
-            oldAccessCount: tokenKeys0.accessToken.length,
-            oldIdCount: tokenKeys0.idToken.length,
-            oldRefreshCount: tokenKeys0.refreshToken.length,
+            preMigrateAcntCount: accountKeys.length,
+            preMigrateATCount: tokenKeys.accessToken.length,
+            preMigrateITCount: tokenKeys.idToken.length,
+            preMigrateRTCount: tokenKeys.refreshToken.length,
         }, correlationId);
-        const accountKeys1 = getAccountKeys(this.browserStorage, 1);
-        const tokenKeys1 = getTokenKeys(this.clientId, this.browserStorage, 1);
+        for (let i = 0; i < ACCOUNT_SCHEMA_VERSION; i++) {
+            const credentialSchema = i; // For now account and credential schemas are the same, but may diverge in future
+            await this.removeStaleAccounts(i, credentialSchema, correlationId);
+        }
+        // Must migrate idTokens first to ensure we have KMSI info for the rest
+        for (let i = 0; i < CREDENTIAL_SCHEMA_VERSION; i++) {
+            const accountSchema = i; // For now account and credential schemas are the same, but may diverge in future
+            await this.migrateIdTokens(i, accountSchema, correlationId);
+        }
+        const kmsiMap = this.getKMSIValues();
+        for (let i = 0; i < CREDENTIAL_SCHEMA_VERSION; i++) {
+            await this.migrateAccessTokens(i, kmsiMap, correlationId);
+            await this.migrateRefreshTokens(i, kmsiMap, correlationId);
+        }
+        accountKeys = getAccountKeys(this.browserStorage);
+        tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
         this.performanceClient.addFields({
-            currAccountCount: accountKeys1.length,
-            currAccessCount: tokenKeys1.accessToken.length,
-            currIdCount: tokenKeys1.idToken.length,
-            currRefreshCount: tokenKeys1.refreshToken.length,
+            postMigrateAcntCount: accountKeys.length,
+            postMigrateATCount: tokenKeys.accessToken.length,
+            postMigrateITCount: tokenKeys.idToken.length,
+            postMigrateRTCount: tokenKeys.refreshToken.length,
         }, correlationId);
-        await Promise.all([
-            this.updateV0ToCurrent(ACCOUNT_SCHEMA_VERSION, accountKeys0, accountKeys1, correlationId),
-            this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.idToken, tokenKeys1.idToken, correlationId),
-            this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.accessToken, tokenKeys1.accessToken, correlationId),
-            this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.refreshToken, tokenKeys1.refreshToken, correlationId),
-        ]);
-        if (accountKeys0.length > 0) {
-            this.browserStorage.setItem(getAccountKeysCacheKey(0), JSON.stringify(accountKeys0));
+    }
+    /**
+     * Parses entry, adds lastUpdatedAt if it doesn't exist, removes entry if expired or invalid
+     * @param key
+     * @param correlationId
+     * @returns
+     */
+    async updateOldEntry(key, correlationId) {
+        const rawValue = this.browserStorage.getItem(key);
+        const parsedValue = this.validateAndParseJson(rawValue || "");
+        if (!parsedValue) {
+            this.browserStorage.removeItem(key);
+            return null;
         }
-        else {
-            this.browserStorage.removeItem(getAccountKeysCacheKey(0));
+        if (!parsedValue.lastUpdatedAt) {
+            // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
+            parsedValue.lastUpdatedAt = Date.now().toString();
+            this.setItem(key, JSON.stringify(parsedValue), correlationId);
         }
-        if (accountKeys1.length > 0) {
-            this.browserStorage.setItem(getAccountKeysCacheKey(1), JSON.stringify(accountKeys1));
+        else if (TimeUtils.isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
+            this.browserStorage.removeItem(key);
+            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+            return null;
         }
-        else {
-            this.browserStorage.removeItem(getAccountKeysCacheKey(1));
-        }
-        this.setTokenKeys(tokenKeys0, correlationId, 0);
-        this.setTokenKeys(tokenKeys1, correlationId, 1);
-    }
-    async updateV0ToCurrent(currentSchema, v0Keys, v1Keys, correlationId) {
-        const upgradePromises = [];
-        for (const v0Key of [...v0Keys]) {
-            const rawV0Value = this.browserStorage.getItem(v0Key);
-            const parsedV0Value = this.validateAndParseJson(rawV0Value || "");
-            if (!parsedV0Value) {
-                removeElementFromArray(v0Keys, v0Key);
+        const decryptedData = isEncrypted(parsedValue)
+            ? await this.browserStorage.decryptData(key, parsedValue, correlationId)
+            : parsedValue;
+        if (!decryptedData || !CacheHelpers.isCredentialEntity(decryptedData)) {
+            this.performanceClient.incrementFields({ invalidCacheCount: 1 }, correlationId);
+            return null;
+        }
+        if ((CacheHelpers.isAccessTokenEntity(decryptedData) ||
+            CacheHelpers.isRefreshTokenEntity(decryptedData)) &&
+            decryptedData.expiresOn &&
+            TimeUtils.isTokenExpired(decryptedData.expiresOn, Constants.DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
+            this.browserStorage.removeItem(key);
+            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+            return null;
+        }
+        return decryptedData;
+    }
+    /**
+     * Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
+     * @param accountSchema
+     * @param credentialSchema
+     * @param correlationId
+     * @returns
+     */
+    async removeStaleAccounts(accountSchema, credentialSchema, correlationId) {
+        const accountKeysToCheck = getAccountKeys(this.browserStorage, accountSchema);
+        if (accountKeysToCheck.length === 0) {
+            return;
+        }
+        for (const accountKey of [...accountKeysToCheck]) {
+            this.performanceClient.incrementFields({ oldAcntCount: 1 }, correlationId);
+            const rawValue = this.browserStorage.getItem(accountKey);
+            const parsedValue = this.validateAndParseJson(rawValue || "");
+            if (!parsedValue) {
+                removeElementFromArray(accountKeysToCheck, accountKey);
+                continue;
+            }
+            if (!parsedValue.lastUpdatedAt) {
+                // Add lastUpdatedAt to the existing entry if it doesnt exist so we know when it's safe to remove it
+                parsedValue.lastUpdatedAt = Date.now().toString();
+                this.setItem(accountKey, JSON.stringify(parsedValue), correlationId);
                 continue;
             }
-            if (!parsedV0Value.lastUpdatedAt) {
-                // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
-                parsedV0Value.lastUpdatedAt = Date.now().toString();
-                this.setItem(v0Key, JSON.stringify(parsedV0Value), correlationId);
+            else if (TimeUtils.isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
+                // Cache expired remove account and associated tokens
+                await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
+                removeElementFromArray(accountKeysToCheck, accountKey);
             }
-            const decryptedData = isEncrypted(parsedV0Value)
-                ? await this.browserStorage.decryptData(v0Key, parsedV0Value, correlationId)
-                : parsedV0Value;
-            let expirationTime;
-            if (decryptedData) {
-                if (CacheHelpers.isAccessTokenEntity(decryptedData)) {
-                    expirationTime = decryptedData.expiresOn;
+        }
+        this.setAccountKeys(accountKeysToCheck, correlationId, accountSchema);
+    }
+    /**
+     * Remove the given account and all associated tokens from the cache
+     * @param accountKey
+     * @param rawObject
+     * @param credentialSchema
+     * @param correlationId
+     */
+    async removeAccountOldSchema(accountKey, rawObject, credentialSchema, correlationId) {
+        const decryptedData = isEncrypted(rawObject)
+            ? (await this.browserStorage.decryptData(accountKey, rawObject, correlationId))
+            : rawObject;
+        const homeAccountId = decryptedData?.homeAccountId;
+        if (homeAccountId) {
+            const tokenKeys = this.getTokenKeys(credentialSchema);
+            [...tokenKeys.idToken]
+                .filter((key) => key.includes(homeAccountId))
+                .forEach((key) => {
+                this.browserStorage.removeItem(key);
+                removeElementFromArray(tokenKeys.idToken, key);
+            });
+            [...tokenKeys.accessToken]
+                .filter((key) => key.includes(homeAccountId))
+                .forEach((key) => {
+                this.browserStorage.removeItem(key);
+                removeElementFromArray(tokenKeys.accessToken, key);
+            });
+            [...tokenKeys.refreshToken]
+                .filter((key) => key.includes(homeAccountId))
+                .forEach((key) => {
+                this.browserStorage.removeItem(key);
+                removeElementFromArray(tokenKeys.refreshToken, key);
+            });
+            this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
+        }
+        this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
+        this.browserStorage.removeItem(accountKey);
+    }
+    /**
+     * Gets key value pair mapping homeAccountId to KMSI value
+     * @returns
+     */
+    getKMSIValues() {
+        const kmsiMap = {};
+        const tokenKeys = this.getTokenKeys().idToken;
+        for (const key of tokenKeys) {
+            const rawValue = this.browserStorage.getUserData(key);
+            if (rawValue) {
+                const idToken = JSON.parse(rawValue);
+                const claims = AuthToken.extractTokenClaims(idToken.secret, base64Decode);
+                if (claims) {
+                    kmsiMap[idToken.homeAccountId] = AuthToken.isKmsi(claims);
                 }
-                else if (CacheHelpers.isRefreshTokenEntity(decryptedData)) {
-                    expirationTime = decryptedData.expiresOn;
+            }
+        }
+        return kmsiMap;
+    }
+    /**
+     * Migrates id tokens from the old schema to the new schema, also migrates associated account object if it doesn't already exist in the new schema
+     * @param credentialSchema
+     * @param accountSchema
+     * @param correlationId
+     * @returns
+     */
+    async migrateIdTokens(credentialSchema, accountSchema, correlationId) {
+        const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+        if (credentialKeysToMigrate.idToken.length === 0) {
+            return;
+        }
+        const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+        const currentAccountKeys = getAccountKeys(this.browserStorage);
+        const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
+        for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
+            this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
+            const oldSchemaData = (await this.updateOldEntry(idTokenKey, correlationId));
+            if (!oldSchemaData) {
+                removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
+                continue;
+            }
+            const currentAccountKey = currentAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
+            const previousAccountKey = previousAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
+            let account = null;
+            if (currentAccountKey) {
+                account = this.getAccount(currentAccountKey, correlationId);
+            }
+            else if (previousAccountKey) {
+                const rawValue = this.browserStorage.getItem(previousAccountKey);
+                const parsedValue = this.validateAndParseJson(rawValue || "");
+                account =
+                    parsedValue && isEncrypted(parsedValue)
+                        ? (await this.browserStorage.decryptData(previousAccountKey, parsedValue, correlationId))
+                        : parsedValue;
+            }
+            if (!account) {
+                // Don't migrate idToken if we don't have an account for it
+                this.performanceClient.incrementFields({ skipITMigrateCount: 1 }, correlationId);
+                continue;
+            }
+            const claims = AuthToken.extractTokenClaims(oldSchemaData.secret, base64Decode);
+            const newIdTokenKey = this.generateCredentialKey(oldSchemaData);
+            const currentIdToken = this.getIdTokenCredential(newIdTokenKey, correlationId);
+            const oldTokenHasSignInState = Object.keys(claims).includes("signin_state");
+            const currentTokenHasSignInState = currentIdToken &&
+                Object.keys(AuthToken.extractTokenClaims(currentIdToken.secret, base64Decode) || {}).includes("signin_state");
+            /**
+             * Only migrate if:
+             * 1. Token doesn't yet exist in current schema
+             * 2. Old schema token has been updated more recently than the current one AND migrating it won't result in loss of KMSI state
+             */
+            if (!currentIdToken ||
+                (oldSchemaData.lastUpdatedAt > currentIdToken.lastUpdatedAt &&
+                    (oldTokenHasSignInState || !currentTokenHasSignInState))) {
+                const tenantProfiles = account.tenantProfiles || [];
+                const tenantId = getTenantIdFromIdTokenClaims(claims) || account.realm;
+                if (tenantId &&
+                    !tenantProfiles.find((tenantProfile) => {
+                        return tenantProfile.tenantId === tenantId;
+                    })) {
+                    const newTenantProfile = buildTenantProfile(account.homeAccountId, account.localAccountId, tenantId, claims);
+                    tenantProfiles.push(newTenantProfile);
+                }
+                account.tenantProfiles = tenantProfiles;
+                const newAccountKey = this.generateAccountKey(AccountEntityUtils.getAccountInfo(account));
+                const kmsi = AuthToken.isKmsi(claims);
+                await this.setUserData(newAccountKey, JSON.stringify(account), correlationId, account.lastUpdatedAt, kmsi);
+                if (!currentAccountKeys.includes(newAccountKey)) {
+                    currentAccountKeys.push(newAccountKey);
                 }
+                await this.setUserData(newIdTokenKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                this.performanceClient.incrementFields({ migratedITCount: 1 }, correlationId);
+                currentCredentialKeys.idToken.push(newIdTokenKey);
+            }
+        }
+        this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+        this.setTokenKeys(currentCredentialKeys, correlationId);
+        this.setAccountKeys(currentAccountKeys, correlationId);
+    }
+    /**
+     * Migrates access tokens from old cache schema to current schema
+     * @param credentialSchema
+     * @param kmsiMap
+     * @param correlationId
+     * @returns
+     */
+    async migrateAccessTokens(credentialSchema, kmsiMap, correlationId) {
+        const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+        if (credentialKeysToMigrate.accessToken.length === 0) {
+            return;
+        }
+        const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+        for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
+            this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
+            const oldSchemaData = (await this.updateOldEntry(accessTokenKey, correlationId));
+            if (!oldSchemaData) {
+                removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
+                continue;
             }
-            if (!decryptedData ||
-                TimeUtils.isCacheExpired(parsedV0Value.lastUpdatedAt, this.cacheConfig.cacheRetentionDays) ||
-                (expirationTime &&
-                    TimeUtils.isTokenExpired(expirationTime, Constants.DEFAULT_TOKEN_RENEWAL_OFFSET_SEC))) {
-                this.browserStorage.removeItem(v0Key);
-                removeElementFromArray(v0Keys, v0Key);
-                this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+            if (!(oldSchemaData.homeAccountId in kmsiMap)) {
+                // Don't migrate tokens if we don't have an idToken for them
+                this.performanceClient.incrementFields({ skipATMigrateCount: 1 }, correlationId);
                 continue;
             }
-            if (this.cacheConfig.cacheLocation !==
-                BrowserCacheLocation.LocalStorage ||
-                isEncrypted(parsedV0Value)) {
-                const v1Key = `${PREFIX}.${currentSchema}${CACHE_KEY_SEPARATOR}${v0Key}`;
-                const rawV1Entry = this.browserStorage.getItem(v1Key);
-                if (!rawV1Entry) {
-                    upgradePromises.push(this.setUserData(v1Key, JSON.stringify(decryptedData), correlationId, parsedV0Value.lastUpdatedAt).then(() => {
-                        v1Keys.push(v1Key);
-                        this.performanceClient.incrementFields({ upgradedCacheCount: 1 }, correlationId);
-                    }));
-                    continue;
+            const newKey = this.generateCredentialKey(oldSchemaData);
+            const kmsi = kmsiMap[oldSchemaData.homeAccountId];
+            if (!currentCredentialKeys.accessToken.includes(newKey)) {
+                await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
+                currentCredentialKeys.accessToken.push(newKey);
+            }
+            else {
+                const currentToken = this.getAccessTokenCredential(newKey, correlationId);
+                if (!currentToken ||
+                    oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
+                    // If the token already exists, only overwrite it if the old token has a more recent lastUpdatedAt
+                    await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                    this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
                 }
-                else {
-                    const parsedV1Entry = this.validateAndParseJson(rawV1Entry);
-                    // If the entry already exists but is older than the v0 entry, replace it
-                    if (Number(parsedV0Value.lastUpdatedAt) >
-                        Number(parsedV1Entry.lastUpdatedAt)) {
-                        upgradePromises.push(this.setUserData(v1Key, JSON.stringify(decryptedData), correlationId, parsedV0Value.lastUpdatedAt).then(() => {
-                            this.performanceClient.incrementFields({ updatedCacheFromV0Count: 1 }, correlationId);
-                        }));
-                        continue;
-                    }
+            }
+        }
+        this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+        this.setTokenKeys(currentCredentialKeys, correlationId);
+    }
+    /**
+     * Migrates refresh tokens from old cache schema to current schema
+     * @param credentialSchema
+     * @param kmsiMap
+     * @param correlationId
+     * @returns
+     */
+    async migrateRefreshTokens(credentialSchema, kmsiMap, correlationId) {
+        const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+        if (credentialKeysToMigrate.refreshToken.length === 0) {
+            return;
+        }
+        const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+        for (const refreshTokenKey of [
+            ...credentialKeysToMigrate.refreshToken,
+        ]) {
+            this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
+            const oldSchemaData = (await this.updateOldEntry(refreshTokenKey, correlationId));
+            if (!oldSchemaData) {
+                removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
+                continue;
+            }
+            if (!(oldSchemaData.homeAccountId in kmsiMap)) {
+                // Don't migrate tokens if we don't have an idToken for them
+                this.performanceClient.incrementFields({ skipRTMigrateCount: 1 }, correlationId);
+                continue;
+            }
+            const newKey = this.generateCredentialKey(oldSchemaData);
+            const kmsi = kmsiMap[oldSchemaData.homeAccountId];
+            if (!currentCredentialKeys.refreshToken.includes(newKey)) {
+                await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
+                currentCredentialKeys.refreshToken.push(newKey);
+            }
+            else {
+                const currentToken = this.getRefreshTokenCredential(newKey, correlationId);
+                if (!currentToken ||
+                    oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
+                    // If the token already exists, only overwrite it if the old token has a more recent lastUpdatedAt
+                    await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                    this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
                 }
             }
-            /*
-             * Note: If we reach here for unencrypted localStorage data, we continue without migrating
-             * as we can't migrate unencrypted localStorage data right now since we can't guarantee KMSI=no
-             */
         }
-        return Promise.all(upgradePromises);
+        this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+        this.setTokenKeys(currentCredentialKeys, correlationId);
     }
     /**
      * Tracks upgrades and downgrades for telemetry and debugging purposes
@@ -158,7 +388,7 @@ class BrowserCacheManager extends CacheManager {
     trackVersionChanges(correlationId) {
         const previousVersion = this.browserStorage.getItem(VERSION_CACHE_KEY);
         if (previousVersion) {
-            this.logger.info(`MSAL.js was last initialized by version: '${previousVersion}'`, correlationId);
+            this.logger.info("1wuc87", correlationId);
             this.performanceClient.addFields({ previousLibraryVersion: previousVersion }, correlationId);
         }
         if (previousVersion !== version) {
@@ -195,20 +425,31 @@ class BrowserCacheManager extends CacheManager {
      * @param value
      */
     setItem(key, value, correlationId) {
-        let tokenKeysV0Count = 0;
-        let accessTokenKeys = [];
+        const tokenKeysCount = new Array(CREDENTIAL_SCHEMA_VERSION + 1).fill(0); // Array mapping schema version to number of token keys stored for that version
+        const accessTokenKeys = []; // Flat map of all access token keys stored, ordered by schema version
         const maxRetries = 20;
         for (let i = 0; i <= maxRetries; i++) {
+            // Attempt to store item in cache, if cache is full this call will throw and we'll attempt to clear space by removing access tokens from the cache one by one, starting with tokens stored by previous versions of MSAL.js
             try {
                 this.browserStorage.setItem(key, value);
                 if (i > 0) {
-                    // Finally update the token keys array with the tokens removed
-                    if (i <= tokenKeysV0Count) {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId, 0);
-                    }
-                    else {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, tokenKeysV0Count), correlationId, 0);
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(tokenKeysV0Count, i), correlationId);
+                    // If any tokens were removed in order to store this item update the token keys array with the tokens removed
+                    for (let schemaVersion = 0; schemaVersion <= CREDENTIAL_SCHEMA_VERSION; schemaVersion++) {
+                        // Get the sum of all previous token counts to use as start index for this schema version
+                        const startIndex = tokenKeysCount
+                            .slice(0, schemaVersion)
+                            .reduce((sum, count) => sum + count, 0);
+                        if (startIndex >= i) {
+                            // Done removing tokens
+                            break;
+                        }
+                        const endIndex = i > startIndex + tokenKeysCount[schemaVersion]
+                            ? startIndex + tokenKeysCount[schemaVersion]
+                            : i;
+                        if (i > startIndex &&
+                            tokenKeysCount[schemaVersion] > 0) {
+                            this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
+                        }
                     }
                 }
                 break; // If setItem succeeds, exit the loop
@@ -220,16 +461,19 @@ class BrowserCacheManager extends CacheManager {
                     i < maxRetries) {
                     if (!accessTokenKeys.length) {
                         // If we are currently trying to set the token keys, use the value we're trying to set
-                        const tokenKeys0 = key ===
-                            getTokenKeysCacheKey(this.clientId, 0)
-                            ? JSON.parse(value).accessToken
-                            : this.getTokenKeys(0).accessToken;
-                        const tokenKeys1 = key ===
-                            getTokenKeysCacheKey(this.clientId)
-                            ? JSON.parse(value).accessToken
-                            : this.getTokenKeys().accessToken;
-                        accessTokenKeys = [...tokenKeys0, ...tokenKeys1];
-                        tokenKeysV0Count = tokenKeys0.length;
+                        for (let i = 0; i <= CREDENTIAL_SCHEMA_VERSION; i++) {
+                            if (key ===
+                                getTokenKeysCacheKey(this.clientId, i)) {
+                                const tokenKeys = JSON.parse(value).accessToken;
+                                accessTokenKeys.push(...tokenKeys);
+                                tokenKeysCount[i] = tokenKeys.length;
+                            }
+                            else {
+                                const tokenKeys = this.getTokenKeys(i).accessToken;
+                                accessTokenKeys.push(...tokenKeys);
+                                tokenKeysCount[i] = tokenKeys.length;
+                            }
+                        }
                     }
                     if (accessTokenKeys.length <= i) {
                         // Nothing to remove, rethrow the error
@@ -252,21 +496,32 @@ class BrowserCacheManager extends CacheManager {
      * @param value
      * @param correlationId
      */
-    async setUserData(key, value, correlationId, timestamp) {
-        let tokenKeysV0Count = 0;
-        let accessTokenKeys = [];
+    async setUserData(key, value, correlationId, timestamp, kmsi) {
+        const tokenKeysCount = new Array(CREDENTIAL_SCHEMA_VERSION + 1).fill(0); // Array mapping schema version to number of token keys stored for that version
+        const accessTokenKeys = []; // Flat map of all access token keys stored, ordered by schema version
         const maxRetries = 20;
         for (let i = 0; i <= maxRetries; i++) {
             try {
-                await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient, correlationId)(key, value, correlationId, timestamp);
+                // Attempt to store item in cache, if cache is full this call will throw and we'll attempt to clear space by removing access tokens from the cache one by one, starting with tokens stored by previous versions of MSAL.js
+                await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient, correlationId)(key, value, correlationId, timestamp, kmsi);
                 if (i > 0) {
-                    // Finally update the token keys array with the tokens removed
-                    if (i <= tokenKeysV0Count) {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId, 0);
-                    }
-                    else {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, tokenKeysV0Count), correlationId, 0);
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(tokenKeysV0Count, i), correlationId);
+                    // If any tokens were removed in order to store this item update the token keys array with the tokens removed
+                    for (let schemaVersion = 0; schemaVersion <= CREDENTIAL_SCHEMA_VERSION; schemaVersion++) {
+                        // Get the sum of all previous token counts to use as start index for this schema version
+                        const startIndex = tokenKeysCount
+                            .slice(0, schemaVersion)
+                            .reduce((sum, count) => sum + count, 0);
+                        if (startIndex >= i) {
+                            // Done removing tokens
+                            break;
+                        }
+                        const endIndex = i > startIndex + tokenKeysCount[schemaVersion]
+                            ? startIndex + tokenKeysCount[schemaVersion]
+                            : i;
+                        if (i > startIndex &&
+                            tokenKeysCount[schemaVersion] > 0) {
+                            this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
+                        }
                     }
                 }
                 break; // If setItem succeeds, exit the loop
@@ -277,10 +532,12 @@ class BrowserCacheManager extends CacheManager {
                     CacheErrorCodes.cacheQuotaExceeded &&
                     i < maxRetries) {
                     if (!accessTokenKeys.length) {
-                        const tokenKeys0 = this.getTokenKeys(0).accessToken;
-                        const tokenKeys1 = this.getTokenKeys().accessToken;
-                        accessTokenKeys = [...tokenKeys0, ...tokenKeys1];
-                        tokenKeysV0Count = tokenKeys0.length;
+                        // If we are currently trying to set the token keys, use the value we're trying to set
+                        for (let i = 0; i <= CREDENTIAL_SCHEMA_VERSION; i++) {
+                            const tokenKeys = this.getTokenKeys(i).accessToken;
+                            accessTokenKeys.push(...tokenKeys);
+                            tokenKeysCount[i] = tokenKeys.length;
+                        }
                     }
                     if (accessTokenKeys.length <= i) {
                         // Nothing left to remove, rethrow the error
@@ -304,7 +561,7 @@ class BrowserCacheManager extends CacheManager {
      * @returns
      */
     getAccount(accountKey, correlationId) {
-        this.logger.trace("BrowserCacheManager.getAccount called", correlationId);
+        this.logger.trace("1lfvm6", correlationId);
         const serializedAccount = this.browserStorage.getUserData(accountKey);
         if (!serializedAccount) {
             this.removeAccountKeyFromMap(accountKey, correlationId);
@@ -321,13 +578,22 @@ class BrowserCacheManager extends CacheManager {
      * set account entity in the platform cache
      * @param account
      */
-    async setAccount(account, correlationId) {
-        this.logger.trace("BrowserCacheManager.setAccount called", correlationId);
+    async setAccount(account, correlationId, kmsi) {
+        this.logger.trace("1bz3wr", correlationId);
         const key = this.generateAccountKey(AccountEntityUtils.getAccountInfo(account));
         const timestamp = Date.now().toString();
         account.lastUpdatedAt = timestamp;
-        await this.setUserData(key, JSON.stringify(account), correlationId, timestamp);
+        await this.setUserData(key, JSON.stringify(account), correlationId, timestamp, kmsi);
         this.addAccountKeyToMap(key, correlationId);
+        this.performanceClient.addFields({ kmsi: kmsi }, correlationId);
+    }
+    setAccountKeys(accountKeys, correlationId, schemaVersion = ACCOUNT_SCHEMA_VERSION) {
+        if (accountKeys.length === 0) {
+            this.removeItem(getAccountKeysCacheKey(schemaVersion));
+        }
+        else {
+            this.setItem(getAccountKeysCacheKey(schemaVersion), JSON.stringify(accountKeys), correlationId);
+        }
     }
     /**
      * Returns the array of account keys currently cached
@@ -341,18 +607,18 @@ class BrowserCacheManager extends CacheManager {
      * @param key
      */
     addAccountKeyToMap(key, correlationId) {
-        this.logger.trace("BrowserCacheManager.addAccountKeyToMap called", correlationId);
-        this.logger.tracePii(`BrowserCacheManager.addAccountKeyToMap called with key: '${key}'`, correlationId);
+        this.logger.trace("0rb85k", correlationId);
+        this.logger.tracePii("1l9bdo", correlationId);
         const accountKeys = this.getAccountKeys();
         if (accountKeys.indexOf(key) === -1) {
             // Only add key if it does not already exist in the map
             accountKeys.push(key);
             this.setItem(getAccountKeysCacheKey(), JSON.stringify(accountKeys), correlationId);
-            this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added", correlationId);
+            this.logger.verbose("0xia39", correlationId);
             return true;
         }
         else {
-            this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key already exists in map", correlationId);
+            this.logger.verbose("0161kk", correlationId);
             return false;
         }
     }
@@ -361,24 +627,16 @@ class BrowserCacheManager extends CacheManager {
      * @param key
      */
     removeAccountKeyFromMap(key, correlationId) {
-        this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called", correlationId);
-        this.logger.tracePii(`BrowserCacheManager.removeAccountKeyFromMap called with key: '${key}'`, correlationId);
+        this.logger.trace("1jpigu", correlationId);
+        this.logger.tracePii("1xzspl", correlationId);
         const accountKeys = this.getAccountKeys();
         const removalIndex = accountKeys.indexOf(key);
         if (removalIndex > -1) {
             accountKeys.splice(removalIndex, 1);
-            if (accountKeys.length === 0) {
-                // If no keys left, remove the map
-                this.removeItem(getAccountKeysCacheKey());
-                return;
-            }
-            else {
-                this.setItem(getAccountKeysCacheKey(), JSON.stringify(accountKeys), correlationId);
-            }
-            this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed", correlationId);
+            this.setAccountKeys(accountKeys, correlationId);
         }
         else {
-            this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap key not found in existing map", correlationId);
+            this.logger.trace("1dytu2", correlationId);
         }
     }
     /**
@@ -410,7 +668,7 @@ class BrowserCacheManager extends CacheManager {
         const tokenKeys = this.getTokenKeys();
         const idRemoval = tokenKeys.idToken.indexOf(key);
         if (idRemoval > -1) {
-            this.logger.info("idToken removed from tokenKeys map", correlationId);
+            this.logger.info("05udv9", correlationId);
             tokenKeys.idToken.splice(idRemoval, 1);
             this.setTokenKeys(tokenKeys, correlationId);
         }
@@ -430,7 +688,7 @@ class BrowserCacheManager extends CacheManager {
      * @param tokenKeys
      */
     removeAccessTokenKeys(keys, correlationId, schemaVersion = CREDENTIAL_SCHEMA_VERSION) {
-        this.logger.trace("removeAccessTokenKey called", correlationId);
+        this.logger.trace("17o18n", correlationId);
         const tokenKeys = this.getTokenKeys(schemaVersion);
         let keysRemoved = 0;
         keys.forEach((key) => {
@@ -441,7 +699,7 @@ class BrowserCacheManager extends CacheManager {
             }
         });
         if (keysRemoved > 0) {
-            this.logger.info(`removed '${keysRemoved}' accessToken keys from tokenKeys map`, correlationId);
+            this.logger.info("15i5d5", correlationId);
             this.setTokenKeys(tokenKeys, correlationId, schemaVersion);
             return;
         }
@@ -455,7 +713,7 @@ class BrowserCacheManager extends CacheManager {
         const tokenKeys = this.getTokenKeys();
         const refreshRemoval = tokenKeys.refreshToken.indexOf(key);
         if (refreshRemoval > -1) {
-            this.logger.info("refreshToken removed from tokenKeys map", correlationId);
+            this.logger.info("1f4fq3", correlationId);
             tokenKeys.refreshToken.splice(refreshRemoval, 1);
             this.setTokenKeys(tokenKeys, correlationId);
         }
@@ -492,31 +750,31 @@ class BrowserCacheManager extends CacheManager {
     getIdTokenCredential(idTokenKey, correlationId) {
         const value = this.browserStorage.getUserData(idTokenKey);
         if (!value) {
-            this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit", correlationId);
+            this.logger.trace("1jukz6", correlationId);
             this.removeIdToken(idTokenKey, correlationId);
             return null;
         }
         const parsedIdToken = this.validateAndParseJson(value);
         if (!parsedIdToken || !CacheHelpers.isIdTokenEntity(parsedIdToken)) {
-            this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit", correlationId);
+            this.logger.trace("1jukz6", correlationId);
             return null;
         }
-        this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit", correlationId);
+        this.logger.trace("01ju66", correlationId);
         return parsedIdToken;
     }
     /**
      * set IdToken credential to the platform cache
      * @param idToken
      */
-    async setIdTokenCredential(idToken, correlationId) {
-        this.logger.trace("BrowserCacheManager.setIdTokenCredential called", correlationId);
+    async setIdTokenCredential(idToken, correlationId, kmsi) {
+        this.logger.trace("13hjll", correlationId);
         const idTokenKey = this.generateCredentialKey(idToken);
         const timestamp = Date.now().toString();
         idToken.lastUpdatedAt = timestamp;
-        await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp);
+        await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp, kmsi);
         const tokenKeys = this.getTokenKeys();
         if (tokenKeys.idToken.indexOf(idTokenKey) === -1) {
-            this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map", correlationId);
+            this.logger.info("07jy92", correlationId);
             tokenKeys.idToken.push(idTokenKey);
             this.setTokenKeys(tokenKeys, correlationId);
         }
@@ -528,35 +786,35 @@ class BrowserCacheManager extends CacheManager {
     getAccessTokenCredential(accessTokenKey, correlationId) {
         const value = this.browserStorage.getUserData(accessTokenKey);
         if (!value) {
-            this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit", correlationId);
+            this.logger.trace("0bqvx8", correlationId);
             this.removeAccessTokenKeys([accessTokenKey], correlationId);
             return null;
         }
         const parsedAccessToken = this.validateAndParseJson(value);
         if (!parsedAccessToken ||
             !CacheHelpers.isAccessTokenEntity(parsedAccessToken)) {
-            this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit", correlationId);
+            this.logger.trace("0bqvx8", correlationId);
             return null;
         }
-        this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit", correlationId);
+        this.logger.trace("1o81rl", correlationId);
         return parsedAccessToken;
     }
     /**
      * set accessToken credential to the platform cache
      * @param accessToken
      */
-    async setAccessTokenCredential(accessToken, correlationId) {
-        this.logger.trace("BrowserCacheManager.setAccessTokenCredential called", correlationId);
+    async setAccessTokenCredential(accessToken, correlationId, kmsi) {
+        this.logger.trace("1pondb", correlationId);
         const accessTokenKey = this.generateCredentialKey(accessToken);
         const timestamp = Date.now().toString();
         accessToken.lastUpdatedAt = timestamp;
-        await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp);
+        await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp, kmsi);
         const tokenKeys = this.getTokenKeys();
         const index = tokenKeys.accessToken.indexOf(accessTokenKey);
         if (index !== -1) {
             tokenKeys.accessToken.splice(index, 1); // Remove existing key before pushing to the end
         }
-        this.logger.trace(`access token '${index === -1 ? "added to" : "updated in"}' map`, correlationId);
+        this.logger.trace("1onhey", correlationId);
         tokenKeys.accessToken.push(accessTokenKey);
         this.setTokenKeys(tokenKeys, correlationId);
     }
@@ -567,32 +825,32 @@ class BrowserCacheManager extends CacheManager {
     getRefreshTokenCredential(refreshTokenKey, correlationId) {
         const value = this.browserStorage.getUserData(refreshTokenKey);
         if (!value) {
-            this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit", correlationId);
+            this.logger.trace("0jlizt", correlationId);
             this.removeRefreshToken(refreshTokenKey, correlationId);
             return null;
         }
         const parsedRefreshToken = this.validateAndParseJson(value);
         if (!parsedRefreshToken ||
             !CacheHelpers.isRefreshTokenEntity(parsedRefreshToken)) {
-            this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit", correlationId);
+            this.logger.trace("0jlizt", correlationId);
             return null;
         }
-        this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit", correlationId);
+        this.logger.trace("0nokxi", correlationId);
         return parsedRefreshToken;
     }
     /**
      * set refreshToken credential to the platform cache
      * @param refreshToken
      */
-    async setRefreshTokenCredential(refreshToken, correlationId) {
-        this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called", correlationId);
+    async setRefreshTokenCredential(refreshToken, correlationId, kmsi) {
+        this.logger.trace("0tcg8d", correlationId);
         const refreshTokenKey = this.generateCredentialKey(refreshToken);
         const timestamp = Date.now().toString();
         refreshToken.lastUpdatedAt = timestamp;
-        await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp);
+        await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp, kmsi);
         const tokenKeys = this.getTokenKeys();
         if (tokenKeys.refreshToken.indexOf(refreshTokenKey) === -1) {
-            this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map", correlationId);
+            this.logger.info("0eckjs", correlationId);
             tokenKeys.refreshToken.push(refreshTokenKey);
             this.setTokenKeys(tokenKeys, correlationId);
         }
@@ -605,16 +863,16 @@ class BrowserCacheManager extends CacheManager {
     getAppMetadata(appMetadataKey, correlationId) {
         const value = this.browserStorage.getItem(appMetadataKey);
         if (!value) {
-            this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit", correlationId);
+            this.logger.trace("1q101h", correlationId);
             return null;
         }
         const parsedMetadata = this.validateAndParseJson(value);
         if (!parsedMetadata ||
             !CacheHelpers.isAppMetadataEntity(appMetadataKey, parsedMetadata)) {
-            this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit", correlationId);
+            this.logger.trace("1q101h", correlationId);
             return null;
         }
-        this.logger.trace("BrowserCacheManager.getAppMetadata: cache hit", correlationId);
+        this.logger.trace("19pvg2", correlationId);
         return parsedMetadata;
     }
     /**
@@ -623,7 +881,7 @@ class BrowserCacheManager extends CacheManager {
      * @param correlationId
      */
     setAppMetadata(appMetadata, correlationId) {
-        this.logger.trace("BrowserCacheManager.setAppMetadata called", correlationId);
+        this.logger.trace("0cyma6", correlationId);
         const appMetadataKey = CacheHelpers.generateAppMetadataKey(appMetadata);
         this.setItem(appMetadataKey, JSON.stringify(appMetadata), correlationId);
     }
@@ -635,16 +893,16 @@ class BrowserCacheManager extends CacheManager {
     getServerTelemetry(serverTelemetryKey, correlationId) {
         const value = this.browserStorage.getItem(serverTelemetryKey);
         if (!value) {
-            this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit", correlationId);
+            this.logger.trace("0jk19c", correlationId);
             return null;
         }
         const parsedEntity = this.validateAndParseJson(value);
         if (!parsedEntity ||
             !CacheHelpers.isServerTelemetryEntity(serverTelemetryKey, parsedEntity)) {
-            this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit", correlationId);
+            this.logger.trace("0jk19c", correlationId);
             return null;
         }
-        this.logger.trace("BrowserCacheManager.getServerTelemetry: cache hit", correlationId);
+        this.logger.trace("12jguk", correlationId);
         return parsedEntity;
     }
     /**
@@ -653,7 +911,7 @@ class BrowserCacheManager extends CacheManager {
      * @param serverTelemetry
      */
     setServerTelemetry(serverTelemetryKey, serverTelemetry, correlationId) {
-        this.logger.trace("BrowserCacheManager.setServerTelemetry called", correlationId);
+        this.logger.trace("1poh61", correlationId);
         this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry), correlationId);
     }
     /**
@@ -662,13 +920,13 @@ class BrowserCacheManager extends CacheManager {
     getAuthorityMetadata(key, correlationId) {
         const value = this.internalStorage.getItem(key);
         if (!value) {
-            this.logger.trace("BrowserCacheManager.getAuthorityMetadata: called, no cache hit", correlationId);
+            this.logger.trace("1r39oe", correlationId);
             return null;
         }
         const parsedMetadata = this.validateAndParseJson(value);
         if (parsedMetadata &&
             CacheHelpers.isAuthorityMetadataEntity(key, parsedMetadata)) {
-            this.logger.trace("BrowserCacheManager.getAuthorityMetadata: cache hit", correlationId);
+            this.logger.trace("1ohvk3", correlationId);
             return parsedMetadata;
         }
         return null;
@@ -706,7 +964,7 @@ class BrowserCacheManager extends CacheManager {
      * @param correlationId
      */
     setAuthorityMetadata(key, entity, correlationId) {
-        this.logger.trace("BrowserCacheManager.setAuthorityMetadata called", correlationId);
+        this.logger.trace("07w8n2", correlationId);
         this.internalStorage.setItem(key, JSON.stringify(entity));
     }
     /**
@@ -716,19 +974,19 @@ class BrowserCacheManager extends CacheManager {
         const activeAccountKeyFilters = this.generateCacheKey(Constants.PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
         const activeAccountValueFilters = this.browserStorage.getItem(activeAccountKeyFilters);
         if (!activeAccountValueFilters) {
-            this.logger.trace("BrowserCacheManager.getActiveAccount: No active account filters found", correlationId);
+            this.logger.trace("08gw0e", correlationId);
             return null;
         }
         const activeAccountValueObj = this.validateAndParseJson(activeAccountValueFilters);
         if (activeAccountValueObj) {
-            this.logger.trace("BrowserCacheManager.getActiveAccount: Active account filters schema found", correlationId);
+            this.logger.trace("1t3ch7", correlationId);
             return this.getAccountInfoFilteredBy({
                 homeAccountId: activeAccountValueObj.homeAccountId,
                 localAccountId: activeAccountValueObj.localAccountId,
                 tenantId: activeAccountValueObj.tenantId,
             }, correlationId);
         }
-        this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found", correlationId);
+        this.logger.trace("0me1up", correlationId);
         return null;
     }
     /**
@@ -738,7 +996,7 @@ class BrowserCacheManager extends CacheManager {
     setActiveAccount(account, correlationId) {
         const activeAccountKey = this.generateCacheKey(Constants.PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
         if (account) {
-            this.logger.verbose("setActiveAccount: Active account set", correlationId);
+            this.logger.verbose("0rsj80", correlationId);
             const activeAccountValue = {
                 homeAccountId: account.homeAccountId,
                 localAccountId: account.localAccountId,
@@ -747,7 +1005,7 @@ class BrowserCacheManager extends CacheManager {
             this.setItem(activeAccountKey, JSON.stringify(activeAccountValue), correlationId);
         }
         else {
-            this.logger.verbose("setActiveAccount: No account passed, active account not set", correlationId);
+            this.logger.verbose("1bp5z5", correlationId);
             this.browserStorage.removeItem(activeAccountKey);
         }
         this.eventHandler.emitEvent(EventType.ACTIVE_ACCOUNT_CHANGED);
@@ -760,16 +1018,16 @@ class BrowserCacheManager extends CacheManager {
     getThrottlingCache(throttlingCacheKey, correlationId) {
         const value = this.browserStorage.getItem(throttlingCacheKey);
         if (!value) {
-            this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit", correlationId);
+            this.logger.trace("1h4wa6", correlationId);
             return null;
         }
         const parsedThrottlingCache = this.validateAndParseJson(value);
         if (!parsedThrottlingCache ||
             !CacheHelpers.isThrottlingEntity(throttlingCacheKey, parsedThrottlingCache)) {
-            this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit", correlationId);
+            this.logger.trace("1h4wa6", correlationId);
             return null;
         }
-        this.logger.trace("BrowserCacheManager.getThrottlingCache: cache hit", correlationId);
+        this.logger.trace("0of6n8", correlationId);
         return parsedThrottlingCache;
     }
     /**
@@ -778,7 +1036,7 @@ class BrowserCacheManager extends CacheManager {
      * @param throttlingCache
      */
     setThrottlingCache(throttlingCacheKey, throttlingCache, correlationId) {
-        this.logger.trace("BrowserCacheManager.setThrottlingCache called", correlationId);
+        this.logger.trace("0wfgh6", correlationId);
         this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache), correlationId);
     }
     /**
@@ -796,11 +1054,11 @@ class BrowserCacheManager extends CacheManager {
                 BrowserCacheLocation.LocalStorage) {
                 const item = this.browserStorage.getItem(key);
                 if (item) {
-                    this.logger.trace("BrowserCacheManager.getTemporaryCache: Temporary cache item found in local storage", correlationId);
+                    this.logger.trace("1yt61y", correlationId);
                     return item;
                 }
             }
-            this.logger.trace("BrowserCacheManager.getTemporaryCache: No cache item found in local storage", correlationId);
+            this.logger.trace("1qhy81", correlationId);
             return null;
         }
         return value;
@@ -918,7 +1176,7 @@ class BrowserCacheManager extends CacheManager {
      * @param correlationId
      */
     resetRequestCache(correlationId) {
-        this.logger.trace("BrowserCacheManager.resetRequestCache called", correlationId);
+        this.logger.trace("0h0ynu", correlationId);
         this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
         this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.VERIFIER));
         this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.ORIGIN_URI));
@@ -927,7 +1185,7 @@ class BrowserCacheManager extends CacheManager {
         this.setInteractionInProgress(false, undefined);
     }
     cacheAuthorizeRequest(authCodeRequest, correlationId, codeVerifier) {
-        this.logger.trace("BrowserCacheManager.cacheAuthorizeRequest called", correlationId);
+        this.logger.trace("1tzef5", correlationId);
         const encodedValue = base64Encode(JSON.stringify(authCodeRequest));
         this.setTemporaryCache(TemporaryCacheKeys.REQUEST_PARAMS, encodedValue, true);
         if (codeVerifier) {
@@ -940,7 +1198,7 @@ class BrowserCacheManager extends CacheManager {
      * @param correlationId
      */
     getCachedRequest(correlationId) {
-        this.logger.trace("BrowserCacheManager.getCachedRequest called", correlationId);
+        this.logger.trace("0uen20", correlationId);
         // Get token request from cache and parse as TokenExchangeParameters.
         const encodedTokenRequest = this.getTemporaryCache(TemporaryCacheKeys.REQUEST_PARAMS, correlationId, true);
         if (!encodedTokenRequest) {
@@ -956,8 +1214,8 @@ class BrowserCacheManager extends CacheManager {
             }
         }
         catch (e) {
-            this.logger.errorPii(`Attempted to parse: '${encodedTokenRequest}'`, correlationId);
-            this.logger.error(`Parsing cached token request threw with error: '${e}'`, correlationId);
+            this.logger.errorPii("0ewsey", correlationId);
+            this.logger.error("0tvdic", correlationId);
             throw createBrowserAuthError(unableToParseTokenRequestCacheError);
         }
         return [parsedRequest, verifier];
@@ -967,15 +1225,15 @@ class BrowserCacheManager extends CacheManager {
      * @param correlationId
      */
     getCachedNativeRequest() {
-        this.logger.trace("BrowserCacheManager.getCachedNativeRequest called", "");
+        this.logger.trace("1yxcdm", "");
         const cachedRequest = this.getTemporaryCache(TemporaryCacheKeys.NATIVE_REQUEST, "", true);
         if (!cachedRequest) {
-            this.logger.trace("BrowserCacheManager.getCachedNativeRequest: No cached native request found", "");
+            this.logger.trace("0mnxd4", "");
             return null;
         }
         const parsedRequest = this.validateAndParseJson(cachedRequest);
         if (!parsedRequest) {
-            this.logger.error("BrowserCacheManager.getCachedNativeRequest: Unable to parse native request", "");
+            this.logger.error("0rrkip", "");
             return null;
         }
         return parsedRequest;
@@ -997,24 +1255,32 @@ class BrowserCacheManager extends CacheManager {
         }
         catch (e) {
             // Remove interaction and other temp keys if interaction status can't be parsed
-            this.logger.error(`Cannot parse interaction status. Removing temporary cache items and clearing url hash. Retrying interaction should fix the error`, "");
+            this.logger.error("0jjyys", "");
             this.removeTemporaryItem(key);
             this.resetRequestCache("");
             clearHash(window);
             return null;
         }
     }
-    setInteractionInProgress(inProgress, type = INTERACTION_TYPE.SIGNIN) {
+    setInteractionInProgress(inProgress, type = INTERACTION_TYPE.SIGNIN, allowOverride = false, correlationId = "") {
         // Ensure we don't overwrite interaction in progress for a different clientId
         const key = `${PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}`;
         if (inProgress) {
-            if (this.getInteractionInProgress()) {
-                throw createBrowserAuthError(interactionInProgress);
-            }
-            else {
-                // No interaction is in progress
-                this.setTemporaryCache(key, JSON.stringify({ clientId: this.clientId, type }), false);
+            const existingInteraction = this.getInteractionInProgress();
+            if (existingInteraction) {
+                if (allowOverride) {
+                    this.logger.warning("1pmscr", correlationId);
+                    // Cancel any active bridge monitor from the previous interaction
+                    cancelPendingBridgeResponse(this.logger, correlationId);
+                    // Clear existing interaction to allow new one
+                    this.removeTemporaryItem(key);
+                }
+                else {
+                    throw createBrowserAuthError(interactionInProgress);
+                }
             }
+            // Set new interaction
+            this.setTemporaryCache(key, JSON.stringify({ clientId: this.clientId, type }), false);
         }
         else if (!inProgress &&
             this.getInteractionInProgress()?.clientId === this.clientId) {
@@ -1048,7 +1314,7 @@ class BrowserCacheManager extends CacheManager {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
         };
-        return this.saveCacheRecord(cacheRecord, result.correlationId);
+        return this.saveCacheRecord(cacheRecord, result.correlationId, AuthToken.isKmsi(AuthToken.extractTokenClaims(result.idToken, base64Decode)));
     }
     /**
      * saves a cache record
@@ -1056,9 +1322,9 @@ class BrowserCacheManager extends CacheManager {
      * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
+    async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
         try {
-            await super.saveCacheRecord(cacheRecord, correlationId, storeInCache);
+            await super.saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache);
         }
         catch (e) {
             if (e instanceof CacheError &&