@azure/msal-common 14.0.0-beta.0 → 14.0.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.0.0-beta.0 2023-06-19 */
+/*! @azure/msal-common v14.0.0 2023-08-08 */
 'use strict';
 'use strict';
 
@@ -198,11 +198,17 @@ const CodeChallengeMethodValues = {
     S256: "S256",
 };
 /**
- * allowed values for response_mode
+ * allowed values for server response type
  */
-const ResponseMode = {
+const ServerResponseType = {
     QUERY: "query",
     FRAGMENT: "fragment",
+};
+/**
+ * allowed values for response_mode
+ */
+const ResponseMode = {
+    ...ServerResponseType,
     FORM_POST: "form_post",
 };
 /**
@@ -1296,7 +1302,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "14.0.0-beta.0";
+const version = "14.0.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1309,9 +1315,9 @@ const AzureCloudInstance = {
     AzurePublic: "https://login.microsoftonline.com",
     // Microsoft PPE
     AzurePpe: "https://login.windows-ppe.net",
-    // Microsoft Chinese national cloud
+    // Microsoft Chinese national/regional cloud
     AzureChina: "https://login.chinacloudapi.cn",
-    // Microsoft German national cloud ("Black Forest")
+    // Microsoft German national/regional cloud ("Black Forest")
     AzureGermany: "https://login.microsoftonline.de",
     // US Government cloud
     AzureUsGovernment: "https://login.microsoftonline.us",
@@ -1415,12 +1421,20 @@ const ClientConfigurationErrorMessage = {
     },
     invalidAuthenticationHeader: {
         code: "invalid_authentication_header",
-        desc: "Invalid authentication header provided"
+        desc: "Invalid authentication header provided",
+    },
+    cannotSetOIDCOptions: {
+        code: "cannot_set_OIDCOptions",
+        desc: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
+    },
+    cannotAllowNativeBroker: {
+        code: "cannot_allow_native_broker",
+        desc: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
     },
     authorityMismatch: {
         code: "authority_mismatch",
-        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority."
-    }
+        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+    },
 };
 /**
  * Error thrown when there is an error in configuration of the MSAL.js library.
@@ -1569,6 +1583,18 @@ class ClientConfigurationError extends ClientAuthError {
     static createInvalidAuthenticationHeaderError(invalidHeaderName, details) {
         return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, `${ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc}. Invalid header: ${invalidHeaderName}. Details: ${details}`);
     }
+    /**
+     * Throws error when provided non-default OIDCOptions when not in OIDC protocol mode
+     */
+    static createCannotSetOIDCOptionsError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotSetOIDCOptions.code, ClientConfigurationErrorMessage.cannotSetOIDCOptions.desc);
+    }
+    /**
+     * Throws error when allowNativeBroker is set to true when not in AAD protocol mode
+     */
+    static createCannotAllowNativeBrokerError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotAllowNativeBroker.code, ClientConfigurationErrorMessage.cannotAllowNativeBroker.desc);
+    }
     /**
      * Create an error when the authority provided in request does not match authority provided in account or MSAL.js configuration.
      */
@@ -1824,7 +1850,19 @@ const AuthorityType = {
     Default: 0,
     Adfs: 1,
     Dsts: 2,
-    Ciam: 3
+    Ciam: 3,
+};
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Protocol modes supported by MSAL.
+ */
+const ProtocolMode = {
+    AAD: "AAD",
+    OIDC: "OIDC",
 };
 
 /*
@@ -1847,7 +1885,6 @@ const AuthorityType = {
  *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
  *      authorityType: Accounts authority type as a string
  *      name: Full name for the account, including given name and family name,
- *      clientInfo: Full base64 encoded client info received from ESTS
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
  *      idTokenClaims: Object containing claims parsed from ID token
@@ -1874,24 +1911,6 @@ class AccountEntity {
             localAccountId: this.localAccountId,
         });
     }
-    /**
-     * returns the type of the cache (in this case account)
-     */
-    generateType() {
-        switch (this.authorityType) {
-            case CacheAccountType.ADFS_ACCOUNT_TYPE:
-                return CacheType.ADFS;
-            case CacheAccountType.MSAV1_ACCOUNT_TYPE:
-                return CacheType.MSA;
-            case CacheAccountType.MSSTS_ACCOUNT_TYPE:
-                return CacheType.MSSTS;
-            case CacheAccountType.GENERIC_ACCOUNT_TYPE:
-                return CacheType.GENERIC;
-            default: {
-                throw ClientAuthError.createUnexpectedAccountTypeError();
-            }
-        }
-    }
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -1905,6 +1924,7 @@ class AccountEntity {
             name: this.name,
             idTokenClaims: this.idTokenClaims,
             nativeAccountId: this.nativeAccountId,
+            authorityType: this.authorityType,
         };
     }
     /**
@@ -1921,84 +1941,74 @@ class AccountEntity {
     }
     /**
      * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-     * @param clientInfo
-     * @param authority
-     * @param idToken
-     * @param policy
+     * @param accountDetails
      */
-    static createAccount(clientInfo, homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
+    static createAccount(accountDetails, authority) {
         const account = new AccountEntity();
-        account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
-        account.clientInfo = clientInfo;
-        account.homeAccountId = homeAccountId;
-        account.nativeAccountId = nativeAccountId;
-        const env = environment || (authority && authority.getPreferredCache());
+        if (authority.authorityType === AuthorityType.Adfs) {
+            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
+        }
+        else if (authority.protocolMode === ProtocolMode.AAD) {
+            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
+        }
+        else {
+            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        }
+        account.clientInfo = accountDetails.clientInfo;
+        account.homeAccountId = accountDetails.homeAccountId;
+        account.nativeAccountId = accountDetails.nativeAccountId;
+        const env = accountDetails.environment ||
+            (authority && authority.getPreferredCache());
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
         }
         account.environment = env;
         // non AAD scenarios can have empty realm
-        account.realm = idToken?.claims?.tid || Constants.EMPTY_STRING;
-        if (idToken) {
-            account.idTokenClaims = idToken.claims;
-            // How do you account for MSA CID here?
-            account.localAccountId =
-                idToken?.claims?.oid ||
-                    idToken?.claims?.sub ||
-                    Constants.EMPTY_STRING;
-            /*
-             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-             * In most cases it will contain a single email. This field should not be relied upon if a custom
-             * policy is configured to return more than 1 email.
-             */
-            const preferredUsername = idToken?.claims?.preferred_username;
-            const email = idToken?.claims?.emails
-                ? idToken.claims.emails[0]
-                : null;
-            account.username =
-                preferredUsername || email || Constants.EMPTY_STRING;
-            account.name = idToken?.claims?.name;
-        }
-        account.cloudGraphHostName = cloudGraphHostName;
-        account.msGraphHost = msGraphHost;
+        account.realm =
+            accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
+        account.idTokenClaims = accountDetails.idTokenClaims;
+        // How do you account for MSA CID here?
+        account.localAccountId =
+            accountDetails.idTokenClaims.oid ||
+                accountDetails.idTokenClaims.sub ||
+                Constants.EMPTY_STRING;
+        /*
+         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+         * In most cases it will contain a single email. This field should not be relied upon if a custom
+         * policy is configured to return more than 1 email.
+         */
+        const preferredUsername = accountDetails.idTokenClaims.preferred_username ||
+            accountDetails.idTokenClaims.upn;
+        const email = accountDetails.idTokenClaims.emails
+            ? accountDetails.idTokenClaims.emails[0]
+            : null;
+        account.username = preferredUsername || email || Constants.EMPTY_STRING;
+        account.name = accountDetails.idTokenClaims.name;
+        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
+        account.msGraphHost = accountDetails.msGraphHost;
         return account;
     }
     /**
-     * Builds non-AAD/ADFS account.
-     * @param authority
-     * @param idToken
+     * Creates an AccountEntity object from AccountInfo
+     * @param accountInfo
+     * @param cloudGraphHostName
+     * @param msGraphHost
+     * @returns
      */
-    static createGenericAccount(homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
+    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
         const account = new AccountEntity();
         account.authorityType =
-            authority && authority.authorityType === AuthorityType.Adfs
-                ? CacheAccountType.ADFS_ACCOUNT_TYPE
-                : CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        account.homeAccountId = homeAccountId;
-        // non AAD scenarios can have empty realm
-        account.realm = Constants.EMPTY_STRING;
-        const env = environment || (authority && authority.getPreferredCache());
-        if (!env) {
-            throw ClientAuthError.createInvalidCacheEnvironmentError();
-        }
-        if (idToken) {
-            // How do you account for MSA CID here?
-            account.localAccountId =
-                idToken?.claims?.oid ||
-                    idToken?.claims?.sub ||
-                    Constants.EMPTY_STRING;
-            // upn claim for most ADFS scenarios
-            account.username = idToken?.claims?.upn || Constants.EMPTY_STRING;
-            account.name = idToken?.claims?.name || Constants.EMPTY_STRING;
-            account.idTokenClaims = idToken?.claims;
-        }
-        account.environment = env;
+            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.homeAccountId = accountInfo.homeAccountId;
+        account.localAccountId = accountInfo.localAccountId;
+        account.nativeAccountId = accountInfo.nativeAccountId;
+        account.realm = accountInfo.tenantId;
+        account.environment = accountInfo.environment;
+        account.username = accountInfo.username;
+        account.name = accountInfo.name;
+        account.idTokenClaims = accountInfo.idTokenClaims;
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;
-        /*
-         * add uniqueName to claims
-         * account.name = idToken.claims.uniqueName;
-         */
         return account;
     }
     /**
@@ -2006,9 +2016,9 @@ class AccountEntity {
      * @param serverClientInfo
      * @param authType
      */
-    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idToken) {
-        const accountId = idToken?.claims?.sub
-            ? idToken.claims.sub
+    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
+        const accountId = idTokenClaims?.sub
+            ? idTokenClaims.sub
             : Constants.EMPTY_STRING;
         // since ADFS does not have tid and does not set client_info
         if (authType === AuthorityType.Adfs ||
@@ -2189,20 +2199,21 @@ class CacheManager {
      * saves a cache record
      * @param cacheRecord
      */
-    async saveCacheRecord(cacheRecord) {
+    async saveCacheRecord(cacheRecord, storeInCache) {
         if (!cacheRecord) {
             throw ClientAuthError.createNullOrUndefinedCacheRecord();
         }
         if (!!cacheRecord.account) {
             this.setAccount(cacheRecord.account);
         }
-        if (!!cacheRecord.idToken) {
+        if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
             this.setIdTokenCredential(cacheRecord.idToken);
         }
-        if (!!cacheRecord.accessToken) {
+        if (!!cacheRecord.accessToken && storeInCache?.accessToken !== false) {
             await this.saveAccessToken(cacheRecord.accessToken);
         }
-        if (!!cacheRecord.refreshToken) {
+        if (!!cacheRecord.refreshToken &&
+            storeInCache?.refreshToken !== false) {
             this.setRefreshTokenCredential(cacheRecord.refreshToken);
         }
         if (!!cacheRecord.appMetadata) {
@@ -3155,6 +3166,9 @@ const DEFAULT_LOGGER_IMPLEMENTATION = {
     logLevel: exports.LogLevel.Info,
     correlationId: Constants.EMPTY_STRING,
 };
+const DEFAULT_CACHE_OPTIONS = {
+    claimsBasedCachingEnabled: false,
+};
 const DEFAULT_NETWORK_IMPLEMENTATION = {
     async sendGetRequestAsync() {
         const notImplErr = "Network interface - sendGetRequestAsync() has not been implemented";
@@ -3192,7 +3206,7 @@ const DEFAULT_TELEMETRY_OPTIONS = {
  *
  * @returns Configuration
  */
-function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
+function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, cacheOptions: userCacheOptions, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
     const loggerOptions = {
         ...DEFAULT_LOGGER_IMPLEMENTATION,
         ...userLoggerOption,
@@ -3201,6 +3215,7 @@ function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions:
         authOptions: buildAuthOptions(userAuthOptions),
         systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
         loggerOptions: loggerOptions,
+        cacheOptions: { ...DEFAULT_CACHE_OPTIONS, ...userCacheOptions },
         storageInterface: storageImplementation ||
             new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),
         networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
@@ -3225,6 +3240,13 @@ function buildAuthOptions(authOptions) {
         ...authOptions,
     };
 }
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+function isOidcProtocolMode(config) {
+    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+}
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3458,7 +3480,7 @@ class RequestValidator {
             }
         });
         // remove empty string parameters
-        return Object.fromEntries(Object.entries(eQParams).filter(kv => kv[1] !== ""));
+        return Object.fromEntries(Object.entries(eQParams).filter((kv) => kv[1] !== ""));
     }
 }
 
@@ -3500,9 +3522,15 @@ class RequestParameterBuilder {
      * @param scopeSet
      * @param addOidcScopes
      */
-    addScopes(scopes, addOidcScopes = true) {
+    addScopes(scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+        // Always add openid to the scopes when adding OIDC scopes
+        if (addOidcScopes &&
+            !defaultScopes.includes("openid") &&
+            !scopes.includes("openid")) {
+            defaultScopes.push("openid");
+        }
         const requestScopes = addOidcScopes
-            ? [...(scopes || []), ...OIDC_DEFAULT_SCOPES]
+            ? [...(scopes || []), ...defaultScopes]
             : scopes || [];
         const scopeSet = new ScopeSet(requestScopes);
         this.parameters.set(AADServerParamKeys.SCOPE, encodeURIComponent(scopeSet.printScopes()));
@@ -4689,6 +4717,30 @@ class UrlString {
         }
         return Constants.EMPTY_STRING;
     }
+    /**
+     * Parses query server response string from given string.
+     * Extract hash between '?code=' and '#' if trailing '# is present.
+     * Returns empty string if no query symbol is found.
+     * @param queryString
+     */
+    static parseQueryServerResponse(queryString) {
+        const queryIndex1 = queryString.indexOf("?code");
+        const queryIndex2 = queryString.indexOf("/?code");
+        const hashIndex = queryString.indexOf("#");
+        if (queryIndex2 > -1 && hashIndex > -1) {
+            return queryString.substring(queryIndex2 + 2, hashIndex);
+        }
+        else if (queryIndex2 > -1) {
+            return queryString.substring(queryIndex2 + 2);
+        }
+        else if (queryIndex1 > -1 && hashIndex > -1) {
+            return queryString.substring(queryIndex1 + 1, hashIndex);
+        }
+        else if (queryIndex1 > -1) {
+            return queryString.substring(queryIndex1 + 1);
+        }
+        return Constants.EMPTY_STRING;
+    }
     static constructAuthorityUriFromObject(urlObject) {
         return new UrlString(urlObject.Protocol +
             "//" +
@@ -4734,6 +4786,21 @@ class UrlString {
         }
         return deserializedQueryString;
     }
+    /**
+     * Returns either deserialized query string or deserialized hash, depending on the serverResponseType
+     * as a server auth code response object.
+     */
+    static getDeserializedCodeResponse(serverResponseType, hashFragment) {
+        const hashUrlString = new UrlString(hashFragment);
+        let serverParams;
+        if (serverResponseType === ServerResponseType.QUERY) {
+            serverParams = UrlString.getDeserializedQueryString(hashFragment);
+        }
+        else {
+            serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
+        }
+        return serverParams;
+    }
     /**
      * Check if the hash of the URL string contains known properties
      */
@@ -4952,6 +5019,7 @@ const PerformanceEvents = {
     UpdateCloudDiscoveryMetadataMeasurement: "updateCloudDiscoveryMetadataMeasurement",
     UsernamePasswordClientAcquireToken: "usernamePasswordClientAcquireToken",
     NativeMessageHandlerHandshake: "nativeMessageHandlerHandshake",
+    NativeGenerateAuthResult: "nativeGenerateAuthResult",
 };
 /**
  * State of the performance event.
@@ -5177,12 +5245,25 @@ class ResponseHandler {
      */
     validateServerAuthorizationCodeResponse(serverResponseHash, cachedState, cryptoObj) {
         if (!serverResponseHash.state || !cachedState) {
-            throw !serverResponseHash.state
-                ? ClientAuthError.createStateNotFoundError("Server State")
-                : ClientAuthError.createStateNotFoundError("Cached State");
+            throw serverResponseHash.state
+                ? ClientAuthError.createStateNotFoundError("Cached State")
+                : ClientAuthError.createStateNotFoundError("Server State");
+        }
+        let decodedServerResponseHash;
+        let decodedCachedState;
+        try {
+            decodedServerResponseHash = decodeURIComponent(serverResponseHash.state);
+        }
+        catch (e) {
+            throw ClientAuthError.createInvalidStateError(serverResponseHash.state, `Server response hash URI could not be decoded`);
+        }
+        try {
+            decodedCachedState = decodeURIComponent(cachedState);
+        }
+        catch (e) {
+            throw ClientAuthError.createInvalidStateError(serverResponseHash.state, `Cached state URI could not be decoded`);
         }
-        if (decodeURIComponent(serverResponseHash.state) !==
-            decodeURIComponent(cachedState)) {
+        if (decodedServerResponseHash !== decodedCachedState) {
             throw ClientAuthError.createStateMismatchError();
         }
         // Check for error
@@ -5242,7 +5323,7 @@ class ResponseHandler {
             }
         }
         // generate homeAccountId
-        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
+        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj?.claims);
         // save the response tokens
         let requestStateObj;
         if (!!authCodePayload && !!authCodePayload.state) {
@@ -5275,7 +5356,7 @@ class ResponseHandler {
                     return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache);
         }
         finally {
             if (this.persistencePlugin &&
@@ -5304,7 +5385,13 @@ class ResponseHandler {
         if (!StringUtils.isEmpty(serverTokenResponse.id_token) &&
             !!idTokenObj) {
             cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
-            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
+            cachedAccount = AccountEntity.createAccount({
+                homeAccountId: this.homeAccountIdentifier,
+                idTokenClaims: idTokenObj.claims,
+                clientInfo: serverTokenResponse.client_info,
+                cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
+                msGraphHost: authCodePayload?.msgraph_host,
+            }, authority);
         }
         // AccessToken
         let cachedAccessToken = null;
@@ -5348,34 +5435,6 @@ class ResponseHandler {
         }
         return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
     }
-    /**
-     * Generate Account
-     * @param serverTokenResponse
-     * @param idToken
-     * @param authority
-     */
-    generateAccountEntity(serverTokenResponse, idToken, authority, authCodePayload) {
-        const authorityType = authority.authorityType;
-        const cloudGraphHostName = authCodePayload
-            ? authCodePayload.cloud_graph_host_name
-            : Constants.EMPTY_STRING;
-        const msGraphhost = authCodePayload
-            ? authCodePayload.msgraph_host
-            : Constants.EMPTY_STRING;
-        // ADFS does not require client_info in the response
-        if (authorityType === AuthorityType.Adfs) {
-            this.logger.verbose("Authority type is ADFS, creating ADFS account");
-            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
-        }
-        // This fallback applies to B2C as well as they fall under an AAD account type.
-        if (StringUtils.isEmpty(serverTokenResponse.client_info) &&
-            authority.protocolMode === "AAD") {
-            throw ClientAuthError.createClientInfoEmptyError();
-        }
-        return serverTokenResponse.client_info
-            ? AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost)
-            : AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
-    }
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
      *
@@ -5465,6 +5524,8 @@ class AuthorizationCodeClient extends BaseClient {
         super(configuration, performanceClient);
         // Flag to indicate if client is for hybrid spa auth code redemption
         this.includeRedirectUri = true;
+        this.oidcDefaultScopes =
+            this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
     }
     /**
      * Creates the URL of the authorization request letting the user input credentials and consent to the
@@ -5503,7 +5564,7 @@ class AuthorizationCodeClient extends BaseClient {
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
         const httpVerAuthority = response.headers?.[HeaderNames.X_MS_HTTP_VERSION];
         if (httpVerAuthority) {
-            atsMeasurement?.addStaticFields({
+            atsMeasurement?.add({
                 httpVerAuthority,
             });
         }
@@ -5514,14 +5575,14 @@ class AuthorizationCodeClient extends BaseClient {
         return responseHandler
             .handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)
             .then((result) => {
-            atsMeasurement?.endMeasurement({
+            atsMeasurement?.end({
                 success: true,
             });
             return result;
         })
             .catch((error) => {
             this.logger.verbose("Error in fetching token in ACC", request.correlationId);
-            atsMeasurement?.endMeasurement({
+            atsMeasurement?.end({
                 errorCode: error.errorCode,
                 subErrorCode: error.subError,
                 success: false,
@@ -5537,10 +5598,8 @@ class AuthorizationCodeClient extends BaseClient {
     handleFragmentResponse(hashFragment, cachedState) {
         // Handle responses.
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);
-        // Deserialize hash fragment response parameters.
-        const hashUrlString = new UrlString(hashFragment);
-        // Deserialize hash fragment response parameters.
-        const serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
+        const serverParams = UrlString.getDeserializedCodeResponse(this.config.authOptions.authority.options.OIDCOptions
+            ?.serverResponseType, hashFragment);
         // Get code response
         responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState, this.cryptoUtils);
         // throw when there is no auth code in the response
@@ -5626,14 +5685,14 @@ class AuthorizationCodeClient extends BaseClient {
             parameterBuilder.addRedirectUri(request.redirectUri);
         }
         // Add scope array, parameter builder will add default scopes and dedupe
-        parameterBuilder.addScopes(request.scopes);
+        parameterBuilder.addScopes(request.scopes, true, this.oidcDefaultScopes);
         // add code: user set, not validated
         parameterBuilder.addAuthorizationCode(request.code);
         // Add library metadata
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
         parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
-        if (this.serverTelemetryManager) {
+        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
         }
         // add code_verifier if passed
@@ -5732,7 +5791,7 @@ class AuthorizationCodeClient extends BaseClient {
             ...(request.scopes || []),
             ...(request.extraScopesToConsent || []),
         ];
-        parameterBuilder.addScopes(requestScopes);
+        parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);
         // validate the redirectUri (to be a non null value)
         parameterBuilder.addRedirectUri(request.redirectUri);
         // generate the correlationId if not set by the user and add
@@ -5745,7 +5804,9 @@ class AuthorizationCodeClient extends BaseClient {
         parameterBuilder.addResponseTypeCode();
         // add library info parameters
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+        if (!isOidcProtocolMode(this.config)) {
+            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+        }
         // add client_info=1
         parameterBuilder.addClientInfo();
         if (request.codeChallenge && request.codeChallengeMethod) {
@@ -5906,11 +5967,11 @@ class RefreshTokenClient extends BaseClient {
         this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
         const response = await this.executeTokenRequest(request, this.authority);
         const httpVerToken = response.headers?.[HeaderNames.X_MS_HTTP_VERSION];
-        atsMeasurement?.addStaticFields({
+        atsMeasurement?.add({
             refreshTokenSize: response.body.refresh_token?.length || 0,
         });
         if (httpVerToken) {
-            atsMeasurement?.addStaticFields({
+            atsMeasurement?.add({
                 httpVerToken,
             });
         }
@@ -5922,14 +5983,14 @@ class RefreshTokenClient extends BaseClient {
         return responseHandler
             .handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId)
             .then((result) => {
-            atsMeasurement?.endMeasurement({
+            atsMeasurement?.end({
                 success: true,
             });
             return result;
         })
             .catch((error) => {
             this.logger.verbose("Error in fetching refresh token", request.correlationId);
-            atsMeasurement?.endMeasurement({
+            atsMeasurement?.end({
                 errorCode: error.errorCode,
                 subErrorCode: error.subError,
                 success: false,
@@ -5993,11 +6054,11 @@ class RefreshTokenClient extends BaseClient {
         this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
         const refreshToken = this.cacheManager.getRefreshToken(request.account, foci);
         if (!refreshToken) {
-            atsMeasurement?.discardMeasurement();
+            atsMeasurement?.discard();
             throw InteractionRequiredAuthError.createNoTokensFoundError();
         }
         // attach cached RT size to the current measurement
-        atsMeasurement?.endMeasurement({
+        atsMeasurement?.end({
             success: true,
         });
         const refreshTokenRequest = {
@@ -6038,13 +6099,13 @@ class RefreshTokenClient extends BaseClient {
         };
         return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)
             .then((result) => {
-            acquireTokenMeasurement?.endMeasurement({
+            acquireTokenMeasurement?.end({
                 success: true,
             });
             return result;
         })
             .catch((error) => {
-            acquireTokenMeasurement?.endMeasurement({
+            acquireTokenMeasurement?.end({
                 success: false,
             });
             throw error;
@@ -6060,13 +6121,13 @@ class RefreshTokenClient extends BaseClient {
         const acquireTokenMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.BaseClientCreateTokenRequestHeaders, correlationId);
         const parameterBuilder = new RequestParameterBuilder();
         parameterBuilder.addClientId(this.config.authOptions.clientId);
-        parameterBuilder.addScopes(request.scopes);
+        parameterBuilder.addScopes(request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
         parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
         parameterBuilder.addClientInfo();
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
         parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
-        if (this.serverTelemetryManager) {
+        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
         }
         parameterBuilder.addCorrelationId(correlationId);
@@ -6091,7 +6152,7 @@ class RefreshTokenClient extends BaseClient {
                 parameterBuilder.addSshJwk(request.sshJwk);
             }
             else {
-                acquireTokenMeasurement?.endMeasurement({
+                acquireTokenMeasurement?.end({
                     success: false,
                 });
                 throw ClientConfigurationError.createMissingSshJwkError();
@@ -6120,7 +6181,7 @@ class RefreshTokenClient extends BaseClient {
                     break;
             }
         }
-        acquireTokenMeasurement?.endMeasurement({
+        acquireTokenMeasurement?.end({
             success: true,
         });
         return parameterBuilder.createQueryString();
@@ -6170,6 +6231,12 @@ class SilentFlowClient extends BaseClient {
             this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
             throw ClientAuthError.createRefreshRequiredError();
         }
+        else if (!this.config.cacheOptions.claimsBasedCachingEnabled &&
+            !StringUtils.isEmptyObj(request.claims)) {
+            // Must refresh due to request parameters.
+            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims-based caching is disabled and claims were requested.");
+            throw ClientAuthError.createRefreshRequiredError();
+        }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
             throw ClientAuthError.createNoAccountInSilentRequestError();
@@ -7109,18 +7176,14 @@ const rawMetdataJSON = {
 };
 const EndpointMetadata = rawMetdataJSON.endpointMetadata;
 const InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Protocol modes supported by MSAL.
- */
-const ProtocolMode = {
-    AAD: "AAD",
-    OIDC: "OIDC",
-};
+const InstanceDiscoveryMetadataAliases = new Set();
+for (const key in InstanceDiscoveryMetadata) {
+    for (const metadata of InstanceDiscoveryMetadata[key].metadata) {
+        for (const alias of metadata.aliases) {
+            InstanceDiscoveryMetadataAliases.add(alias);
+        }
+    }
+}
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7498,10 +7561,10 @@ class Authority {
      * @private
      */
     canReplaceTenant(authorityUri) {
-        return authorityUri.PathSegments.length === 1
-            && !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0])
-            && this.getAuthorityType(authorityUri) === AuthorityType.Default
-            && this.protocolMode === ProtocolMode.AAD;
+        return (authorityUri.PathSegments.length === 1 &&
+            !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0]) &&
+            this.getAuthorityType(authorityUri) === AuthorityType.Default &&
+            this.protocolMode === ProtocolMode.AAD);
     }
     /**
      * Replaces tenant in url path with current tenant. Defaults to common.
@@ -7522,8 +7585,9 @@ class Authority {
         const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
         currentAuthorityParts.forEach((currentPart, index) => {
             let cachedPart = cachedAuthorityParts[index];
-            if (index === 0 && this.canReplaceTenant(cachedAuthorityUrlComponents)) {
-                const tenantId = (new UrlString(this.metadata.authorization_endpoint)).getUrlComponents().PathSegments[0];
+            if (index === 0 &&
+                this.canReplaceTenant(cachedAuthorityUrlComponents)) {
+                const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
                 /**
                  * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
                  * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
@@ -7544,8 +7608,9 @@ class Authority {
      * The default open id configuration endpoint for any canonical authority.
      */
     get defaultOpenIdConfigurationEndpoint() {
+        const canonicalAuthorityHost = this.hostnameAndPort;
         if (this.authorityType === AuthorityType.Adfs ||
-            this.protocolMode === ProtocolMode.OIDC) {
+            !this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost)) {
             return `${this.canonicalAuthority}.well-known/openid-configuration`;
         }
         return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
@@ -7588,41 +7653,65 @@ class Authority {
      */
     async updateEndpointMetadata(metadataEntity) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityUpdateEndpointMetadata, this.correlationId);
+        this.logger.verbose("Attempting to get endpoint metadata from authority configuration");
         let metadata = this.getEndpointMetadataFromConfig();
         if (metadata) {
+            this.logger.verbose("Found endpoint metadata in authority configuration");
             metadataEntity.updateEndpointMetadata(metadata, false);
             return AuthorityMetadataSource.CONFIG;
         }
+        this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.");
+        // skipAuthorityMetadataCache is used to bypass hardcoded authority metadata and force a network metadata cache lookup and network metadata request if no cached response is available.
+        if (this.authorityOptions.skipAuthorityMetadataCache) {
+            this.logger.verbose("Skipping hardcoded metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get endpoint metadata from the network metadata cache.");
+        }
+        else {
+            let hardcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
+            if (hardcodedMetadata) {
+                this.logger.verbose("Found endpoint metadata from hardcoded values.");
+                // If the user prefers to use an azure region replace the global endpoints with regional information.
+                if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
+                    this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
+                    this.logger.verbose("Found azure region configuration. Updating endpoints with regional information.");
+                    hardcodedMetadata =
+                        await this.updateMetadataWithRegionalInformation(hardcodedMetadata);
+                }
+                metadataEntity.updateEndpointMetadata(hardcodedMetadata, false);
+                return AuthorityMetadataSource.HARDCODED_VALUES;
+            }
+            else {
+                this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.");
+            }
+        }
+        // Check cached metadata entity expiration status
+        const metadataEntityExpired = metadataEntity.isExpired();
         if (this.isAuthoritySameType(metadataEntity) &&
             metadataEntity.endpointsFromNetwork &&
-            !metadataEntity.isExpired()) {
+            !metadataEntityExpired) {
             // No need to update
+            this.logger.verbose("Found endpoint metadata in the cache.");
             return AuthorityMetadataSource.CACHE;
         }
+        else if (metadataEntityExpired) {
+            this.logger.verbose("The metadata entity is expired.");
+        }
+        this.logger.verbose("Did not find cached endpoint metadata... Attempting to get endpoint metadata from the network.");
         this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork, this.correlationId);
         metadata = await this.getEndpointMetadataFromNetwork();
         if (metadata) {
+            this.logger.verbose("Endpoint metadata was successfully returned from getEndpointMetadataFromNetwork()");
             // If the user prefers to use an azure region replace the global endpoints with regional information.
             if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
                 this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
+                this.logger.verbose("Found azure region configuration. Updating endpoints with regional information.");
                 metadata = await this.updateMetadataWithRegionalInformation(metadata);
             }
             metadataEntity.updateEndpointMetadata(metadata, true);
             return AuthorityMetadataSource.NETWORK;
         }
-        let harcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
-        if (harcodedMetadata &&
-            !this.authorityOptions.skipAuthorityMetadataCache) {
-            // If the user prefers to use an azure region replace the global endpoints with regional information.
-            if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
-                this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
-                harcodedMetadata =
-                    await this.updateMetadataWithRegionalInformation(harcodedMetadata);
-            }
-            metadataEntity.updateEndpointMetadata(harcodedMetadata, false);
-            return AuthorityMetadataSource.HARDCODED_VALUES;
-        }
         else {
+            // Metadata could not be obtained from the config, cache, network or hardcoded values
+            this.logger.error("Did not find endpoint metadata from network... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
             throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
         }
     }
@@ -7671,17 +7760,23 @@ class Authority {
             const response = await this.networkInterface.sendGetRequestAsync(openIdConfigurationEndpoint, options);
             const isValidResponse = isOpenIdConfigResponse(response.body);
             if (isValidResponse) {
-                perfEvent?.endMeasurement({ success: true });
+                perfEvent?.end({ success: true });
                 return response.body;
             }
             else {
-                perfEvent?.endMeasurement({ success: false, errorCode: "invalid_response" });
+                perfEvent?.end({
+                    success: false,
+                    errorCode: "invalid_response",
+                });
                 this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration`);
                 return null;
             }
         }
         catch (e) {
-            perfEvent?.endMeasurement({ success: false, errorCode: "request_failure" });
+            perfEvent?.end({
+                success: false,
+                errorCode: "request_failure",
+            });
             this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: ${e}`);
             return null;
         }
@@ -7697,37 +7792,32 @@ class Authority {
     }
     /**
      * Update the retrieved metadata with regional information.
+     * User selected Azure region will be used if configured.
      */
     async updateMetadataWithRegionalInformation(metadata) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.RegionDiscoveryDetectRegion, this.correlationId);
-        const autodetectedRegionName = await this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration?.environmentRegion, this.regionDiscoveryMetadata);
-        const azureRegion = this.authorityOptions.azureRegionConfiguration?.azureRegion ===
-            Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
-            ? autodetectedRegionName
-            : this.authorityOptions.azureRegionConfiguration?.azureRegion;
-        if (this.authorityOptions.azureRegionConfiguration?.azureRegion ===
-            Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
-            this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName
-                ? RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL
-                : RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
-        }
-        else {
-            if (autodetectedRegionName) {
+        const userConfiguredAzureRegion = this.authorityOptions.azureRegionConfiguration?.azureRegion;
+        if (userConfiguredAzureRegion) {
+            if (userConfiguredAzureRegion !==
+                Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
                 this.regionDiscoveryMetadata.region_outcome =
-                    this.authorityOptions.azureRegionConfiguration
-                        ?.azureRegion === autodetectedRegionName
-                        ? RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED
-                        : RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;
+                    RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                this.regionDiscoveryMetadata.region_used =
+                    userConfiguredAzureRegion;
+                return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
             }
-            else {
+            this.performanceClient?.setPreQueueTime(PerformanceEvents.RegionDiscoveryDetectRegion, this.correlationId);
+            const autodetectedRegionName = await this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration
+                ?.environmentRegion, this.regionDiscoveryMetadata);
+            if (autodetectedRegionName) {
                 this.regionDiscoveryMetadata.region_outcome =
-                    RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                    RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
+                this.regionDiscoveryMetadata.region_used =
+                    autodetectedRegionName;
+                return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
             }
-        }
-        if (azureRegion) {
-            this.regionDiscoveryMetadata.region_used = azureRegion;
-            return Authority.replaceWithRegionalInformation(metadata, azureRegion);
+            this.regionDiscoveryMetadata.region_outcome =
+                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
         }
         return metadata;
     }
@@ -7739,7 +7829,7 @@ class Authority {
      */
     async updateCloudDiscoveryMetadata(metadataEntity) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityUpdateCloudDiscoveryMetadata, this.correlationId);
-        this.logger.verbose("Attempting to get cloud discovery metadata in the config");
+        this.logger.verbose("Attempting to get cloud discovery metadata  from authority configuration");
         this.logger.verbosePii(`Known Authorities: ${this.authorityOptions.knownAuthorities ||
             Constants.NOT_APPLICABLE}`);
         this.logger.verbosePii(`Authority Metadata: ${this.authorityOptions.authorityMetadata ||
@@ -7747,17 +7837,29 @@ class Authority {
         this.logger.verbosePii(`Canonical Authority: ${metadataEntity.canonical_authority || Constants.NOT_APPLICABLE}`);
         let metadata = this.getCloudDiscoveryMetadataFromConfig();
         if (metadata) {
-            this.logger.verbose("Found cloud discovery metadata in the config.");
+            this.logger.verbose("Found cloud discovery metadata in authority configuration");
             metadataEntity.updateCloudDiscoveryMetadata(metadata, false);
             return AuthorityMetadataSource.CONFIG;
         }
-        // If the cached metadata came from config but that config was not passed to this instance, we must go to the network
-        this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the cache.");
+        // If the cached metadata came from config but that config was not passed to this instance, we must go to hardcoded values
+        this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.");
+        if (this.options.skipAuthorityMetadataCache) {
+            this.logger.verbose("Skipping hardcoded cloud discovery metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get cloud discovery metadata from the network metadata cache.");
+        }
+        else {
+            const hardcodedMetadata = this.getCloudDiscoveryMetadataFromHardcodedValues();
+            if (hardcodedMetadata) {
+                this.logger.verbose("Found cloud discovery metadata from hardcoded values.");
+                metadataEntity.updateCloudDiscoveryMetadata(hardcodedMetadata, false);
+                return AuthorityMetadataSource.HARDCODED_VALUES;
+            }
+            this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.");
+        }
         const metadataEntityExpired = metadataEntity.isExpired();
         if (this.isAuthoritySameType(metadataEntity) &&
             metadataEntity.aliasesFromNetwork &&
             !metadataEntityExpired) {
-            this.logger.verbose("Found metadata in the cache.");
+            this.logger.verbose("Found cloud discovery metadata in the cache.");
             // No need to update
             return AuthorityMetadataSource.CACHE;
         }
@@ -7772,15 +7874,8 @@ class Authority {
             metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
             return AuthorityMetadataSource.NETWORK;
         }
-        this.logger.verbose("Did not find cloud discovery metadata from the network... Attempting to get cloud discovery metadata from hardcoded values.");
-        const harcodedMetadata = this.getCloudDiscoveryMetadataFromHarcodedValues();
-        if (harcodedMetadata && !this.options.skipAuthorityMetadataCache) {
-            this.logger.verbose("Found cloud discovery metadata from hardcoded values.");
-            metadataEntity.updateCloudDiscoveryMetadata(harcodedMetadata, false);
-            return AuthorityMetadataSource.HARDCODED_VALUES;
-        }
         // Metadata could not be obtained from the config, cache, network or hardcoded values
-        this.logger.error("Did not find cloud discovery metadata from hardcoded values... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
+        this.logger.error("Did not find cloud discovery metadata from network... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
         throw ClientConfigurationError.createUntrustedAuthorityError();
     }
     /**
@@ -7885,9 +7980,11 @@ class Authority {
     /**
      * Get cloud discovery metadata for common authorities
      */
-    getCloudDiscoveryMetadataFromHarcodedValues() {
+    getCloudDiscoveryMetadataFromHardcodedValues() {
         if (this.canonicalAuthority in InstanceDiscoveryMetadata) {
-            return InstanceDiscoveryMetadata[this.canonicalAuthority];
+            const hardcodedMetadataResponse = InstanceDiscoveryMetadata[this.canonicalAuthority];
+            const metadata = Authority.getCloudDiscoveryMetadataFromNetworkResponse(hardcodedMetadataResponse.metadata, this.hostnameAndPort);
+            return metadata;
         }
         return null;
     }
@@ -7962,6 +8059,13 @@ class Authority {
     isAlias(host) {
         return this.metadata.aliases.indexOf(host) > -1;
     }
+    /**
+     * Returns whether or not the provided host is an alias of a known Microsoft authority for purposes of endpoint discovery
+     * @param host
+     */
+    isAliasOfKnownMicrosoftAuthority(host) {
+        return InstanceDiscoveryMetadataAliases.has(host);
+    }
     /**
      * Checks whether the provided host is that of a public cloud authority
      *
@@ -8003,15 +8107,17 @@ class Authority {
      * @param azureRegion string
      */
     static replaceWithRegionalInformation(metadata, azureRegion) {
-        metadata.authorization_endpoint =
-            Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
+        const regionalMetadata = { ...metadata };
+        regionalMetadata.authorization_endpoint =
+            Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
         // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
-        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
-        if (metadata.end_session_endpoint) {
-            metadata.end_session_endpoint =
-                Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+        regionalMetadata.token_endpoint =
+            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
+        if (regionalMetadata.end_session_endpoint) {
+            regionalMetadata.end_session_endpoint =
+                Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
         }
-        return metadata;
+        return regionalMetadata;
     }
     /**
      * Transform CIAM_AUTHORIY as per the below rules:
@@ -8023,11 +8129,14 @@ class Authority {
      * @param authority
      */
     static transformCIAMAuthority(authority) {
-        let ciamAuthority = authority.endsWith(Constants.FORWARD_SLASH) ? authority : `${authority}${Constants.FORWARD_SLASH}`;
+        let ciamAuthority = authority.endsWith(Constants.FORWARD_SLASH)
+            ? authority
+            : `${authority}${Constants.FORWARD_SLASH}`;
         const authorityUrl = new UrlString(authority);
         const authorityUrlComponents = authorityUrl.getUrlComponents();
         // check if transformation is needed
-        if (authorityUrlComponents.PathSegments.length === 0 && (authorityUrlComponents.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL))) {
+        if (authorityUrlComponents.PathSegments.length === 0 &&
+            authorityUrlComponents.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL)) {
             const tenantIdOrDomain = authorityUrlComponents.HostNameAndPort.split(".")[0];
             ciamAuthority = `${ciamAuthority}${tenantIdOrDomain}${Constants.AAD_TENANT_DOMAIN_SUFFIX}`;
         }
@@ -8035,13 +8144,13 @@ class Authority {
     }
 }
 // Reserved tenant domain names that will not be replaced with tenant id
-Authority.reservedTenantDomains = (new Set([
+Authority.reservedTenantDomains = new Set([
     "{tenant}",
     "{tenantid}",
     AADAuthorityConstants.COMMON,
     AADAuthorityConstants.CONSUMERS,
-    AADAuthorityConstants.ORGANIZATIONS
-]));
+    AADAuthorityConstants.ORGANIZATIONS,
+]);
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8503,8 +8612,10 @@ class PerformanceClient {
      * @param {Logger} logger Logger used by the application
      * @param {string} libraryName Name of the library
      * @param {string} libraryVersion Version of the library
+     * @param {ApplicationTelemetry} applicationTelemetry application name and version
+     * @param {Set<String>} intFields integer fields to be truncated
      */
-    constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
+    constructor(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry, intFields) {
         this.authority = authority;
         this.libraryName = libraryName;
         this.libraryVersion = libraryVersion;
@@ -8515,6 +8626,10 @@ class PerformanceClient {
         this.eventsByCorrelationId = new Map();
         this.queueMeasurements = new Map();
         this.preQueueTimeByCorrelationId = new Map();
+        this.intFields = intFields || new Set();
+        for (const item of IntFields) {
+            this.intFields.add(item);
+        }
     }
     /**
      * Starts and returns an platform-specific implementation of IPerformanceMeasurement.
@@ -8529,13 +8644,6 @@ class PerformanceClient {
     ) {
         return {};
     }
-    /**
-     * Get integral fields.
-     * Override to change the set.
-     */
-    getIntFields() {
-        return IntFields;
-    }
     /**
      * Gets map of pre-queue times by correlation Id
      *
@@ -8653,7 +8761,7 @@ class PerformanceClient {
         this.cacheEventByCorrelationId(inProgressEvent);
         // Return the event and functions the caller can use to properly end/flush the measurement
         return {
-            endMeasurement: (event) => {
+            end: (event) => {
                 return this.endMeasurement({
                     // Initial set of event properties
                     ...inProgressEvent,
@@ -8661,14 +8769,14 @@ class PerformanceClient {
                     ...event,
                 }, performanceMeasurement);
             },
-            discardMeasurement: () => {
+            discard: () => {
                 return this.discardMeasurements(inProgressEvent.correlationId);
             },
-            addStaticFields: (fields) => {
-                return this.addStaticFields(fields, inProgressEvent.correlationId);
+            add: (fields) => {
+                return this.addFields(fields, inProgressEvent.correlationId);
             },
-            increment: (counters) => {
-                return this.increment(counters, inProgressEvent.correlationId);
+            increment: (fields) => {
+                return this.incrementFields(fields, inProgressEvent.correlationId);
             },
             measurement: performanceMeasurement,
             event: inProgressEvent,
@@ -8733,7 +8841,7 @@ class PerformanceClient {
             status: PerformanceEventStatus.Completed,
             incompleteSubsCount,
         };
-        this.truncateIntegralFields(finalEvent, this.getIntFields());
+        this.truncateIntegralFields(finalEvent);
         this.emitEvents([finalEvent], event.correlationId);
         return finalEvent;
     }
@@ -8742,7 +8850,7 @@ class PerformanceClient {
      * @param fields
      * @param correlationId
      */
-    addStaticFields(fields, correlationId) {
+    addFields(fields, correlationId) {
         this.logger.trace("PerformanceClient: Updating static fields");
         const event = this.eventsByCorrelationId.get(correlationId);
         if (event) {
@@ -8757,18 +8865,21 @@ class PerformanceClient {
     }
     /**
      * Increment counters to be emitted when the measurements are flushed
-     * @param counters {Counters}
+     * @param fields {string[]}
      * @param correlationId {string} correlation identifier
      */
-    increment(counters, correlationId) {
+    incrementFields(fields, correlationId) {
         this.logger.trace("PerformanceClient: Updating counters");
         const event = this.eventsByCorrelationId.get(correlationId);
         if (event) {
-            for (const counter in counters) {
+            for (const counter in fields) {
                 if (!event.hasOwnProperty(counter)) {
                     event[counter] = 0;
                 }
-                event[counter] += counters[counter];
+                else if (isNaN(Number(event[counter]))) {
+                    return;
+                }
+                event[counter] += fields[counter];
             }
         }
         else {
@@ -8886,8 +8997,8 @@ class PerformanceClient {
      * @param {PerformanceEvent} event performance event to update.
      * @param {Set<string>} intFields integral fields.
      */
-    truncateIntegralFields(event, intFields) {
-        intFields.forEach((key) => {
+    truncateIntegralFields(event) {
+        this.intFields.forEach((key) => {
             if (key in event && typeof event[key] === "number") {
                 event[key] = Math.floor(event[key]);
             }
@@ -8900,9 +9011,15 @@ class PerformanceClient {
  * Licensed under the MIT License.
  */
 class StubPerformanceMeasurement {
-    startMeasurement() { return; }
-    endMeasurement() { return; }
-    flushMeasurement() { return null; }
+    startMeasurement() {
+        return;
+    }
+    endMeasurement() {
+        return;
+    }
+    flushMeasurement() {
+        return null;
+    }
 }
 class StubPerformanceClient extends PerformanceClient {
     generateId() {
@@ -8914,8 +9031,36 @@ class StubPerformanceClient extends PerformanceClient {
     calculateQueuedTime() {
         return 0;
     }
-    addQueueMeasurement() { return; }
-    setPreQueueTime() { return; }
+    addQueueMeasurement() {
+        return;
+    }
+    setPreQueueTime() {
+        return;
+    }
+    endMeasurement() {
+        return null;
+    }
+    discardMeasurements() {
+        return;
+    }
+    removePerformanceCallback() {
+        return true;
+    }
+    addPerformanceCallback() {
+        return "";
+    }
+    emitEvents() {
+        return;
+    }
+    addFields() {
+        return;
+    }
+    incrementFields() {
+        return;
+    }
+    cacheEventByCorrelationId() {
+        return;
+    }
 }
 
 exports.AADAuthorityConstants = AADAuthorityConstants;
@@ -8983,6 +9128,7 @@ exports.ResponseMode = ResponseMode;
 exports.SSOTypes = SSOTypes;
 exports.ScopeSet = ScopeSet;
 exports.ServerError = ServerError;
+exports.ServerResponseType = ServerResponseType;
 exports.ServerTelemetryEntity = ServerTelemetryEntity;
 exports.ServerTelemetryManager = ServerTelemetryManager;
 exports.SilentFlowClient = SilentFlowClient;