@azure/msal-common 14.0.1 → 14.0.3

package/dist/index.cjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.0.1 2023-08-11 */
+/*! @azure/msal-common v14.0.3 2023-09-05 */
 'use strict';
 'use strict';
 
@@ -65,6 +65,15 @@ const Constants = {
     SHR_NONCE_VALIDITY: 240,
     INVALID_INSTANCE: "invalid_instance",
 };
+const HttpStatus = {
+    SUCCESS_RANGE_START: 200,
+    SUCCESS_RANGE_END: 299,
+    REDIRECT: 302,
+    CLIENT_ERROR_RANGE_START: 400,
+    CLIENT_ERROR_RANGE_END: 499,
+    SERVER_ERROR_RANGE_START: 500,
+    SERVER_ERROR_RANGE_END: 599,
+};
 const OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
     Constants.PROFILE_SCOPE,
@@ -457,6 +466,218 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Log message level.
+ */
+exports.LogLevel = void 0;
+(function (LogLevel) {
+    LogLevel[LogLevel["Error"] = 0] = "Error";
+    LogLevel[LogLevel["Warning"] = 1] = "Warning";
+    LogLevel[LogLevel["Info"] = 2] = "Info";
+    LogLevel[LogLevel["Verbose"] = 3] = "Verbose";
+    LogLevel[LogLevel["Trace"] = 4] = "Trace";
+})(exports.LogLevel || (exports.LogLevel = {}));
+/**
+ * Class which facilitates logging of messages to a specific place.
+ */
+class Logger {
+    constructor(loggerOptions, packageName, packageVersion) {
+        // Current log level, defaults to info.
+        this.level = exports.LogLevel.Info;
+        const defaultLoggerCallback = () => {
+            return;
+        };
+        const setLoggerOptions = loggerOptions || Logger.createDefaultLoggerOptions();
+        this.localCallback =
+            setLoggerOptions.loggerCallback || defaultLoggerCallback;
+        this.piiLoggingEnabled = setLoggerOptions.piiLoggingEnabled || false;
+        this.level =
+            typeof setLoggerOptions.logLevel === "number"
+                ? setLoggerOptions.logLevel
+                : exports.LogLevel.Info;
+        this.correlationId =
+            setLoggerOptions.correlationId || Constants.EMPTY_STRING;
+        this.packageName = packageName || Constants.EMPTY_STRING;
+        this.packageVersion = packageVersion || Constants.EMPTY_STRING;
+    }
+    static createDefaultLoggerOptions() {
+        return {
+            loggerCallback: () => {
+                // allow users to not set loggerCallback
+            },
+            piiLoggingEnabled: false,
+            logLevel: exports.LogLevel.Info,
+        };
+    }
+    /**
+     * Create new Logger with existing configurations.
+     */
+    clone(packageName, packageVersion, correlationId) {
+        return new Logger({
+            loggerCallback: this.localCallback,
+            piiLoggingEnabled: this.piiLoggingEnabled,
+            logLevel: this.level,
+            correlationId: correlationId || this.correlationId,
+        }, packageName, packageVersion);
+    }
+    /**
+     * Log message with required options.
+     */
+    logMessage(logMessage, options) {
+        if (options.logLevel > this.level ||
+            (!this.piiLoggingEnabled && options.containsPii)) {
+            return;
+        }
+        const timestamp = new Date().toUTCString();
+        // Add correlationId to logs if set, correlationId provided on log messages take precedence
+        const logHeader = `[${timestamp}] : [${options.correlationId || this.correlationId || ""}]`;
+        const log = `${logHeader} : ${this.packageName}@${this.packageVersion} : ${exports.LogLevel[options.logLevel]} - ${logMessage}`;
+        // debug(`msal:${LogLevel[options.logLevel]}${options.containsPii ? "-Pii": Constants.EMPTY_STRING}${options.context ? `:${options.context}` : Constants.EMPTY_STRING}`)(logMessage);
+        this.executeCallback(options.logLevel, log, options.containsPii || false);
+    }
+    /**
+     * Execute callback with message.
+     */
+    executeCallback(level, message, containsPii) {
+        if (this.localCallback) {
+            this.localCallback(level, message, containsPii);
+        }
+    }
+    /**
+     * Logs error messages.
+     */
+    error(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Error,
+            containsPii: false,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Logs error messages with PII.
+     */
+    errorPii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Error,
+            containsPii: true,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Logs warning messages.
+     */
+    warning(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Warning,
+            containsPii: false,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Logs warning messages with PII.
+     */
+    warningPii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Warning,
+            containsPii: true,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Logs info messages.
+     */
+    info(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Info,
+            containsPii: false,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Logs info messages with PII.
+     */
+    infoPii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Info,
+            containsPii: true,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Logs verbose messages.
+     */
+    verbose(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Verbose,
+            containsPii: false,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Logs verbose messages with PII.
+     */
+    verbosePii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Verbose,
+            containsPii: true,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Logs trace messages.
+     */
+    trace(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Trace,
+            containsPii: false,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Logs trace messages with PII.
+     */
+    tracePii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: exports.LogLevel.Trace,
+            containsPii: true,
+            correlationId: correlationId || Constants.EMPTY_STRING,
+        });
+    }
+    /**
+     * Returns whether PII Logging is enabled or not.
+     */
+    isPiiLoggingEnabled() {
+        return this.piiLoggingEnabled || false;
+    }
+}
+
+/* eslint-disable header/header */
+const name = "@azure/msal-common";
+const version = "14.0.3";
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const AzureCloudInstance = {
+    // AzureCloudInstance is not specified.
+    None: "none",
+    // Microsoft Azure public cloud
+    AzurePublic: "https://login.microsoftonline.com",
+    // Microsoft PPE
+    AzurePpe: "https://login.windows-ppe.net",
+    // Microsoft Chinese national/regional cloud
+    AzureChina: "https://login.chinacloudapi.cn",
+    // Microsoft German national/regional cloud ("Black Forest")
+    AzureGermany: "https://login.microsoftonline.de",
+    // US Government cloud
+    AzureUsGovernment: "https://login.microsoftonline.us",
+};
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -982,765 +1203,515 @@ class ClientAuthError extends AuthError {
  * Licensed under the MIT License.
  */
 /**
- * @hidden
+ * ClientConfigurationErrorMessage class containing string constants used by error codes and messages.
  */
-class StringUtils {
-    /**
-     * decode a JWT
-     *
-     * @param authToken
-     */
-    static decodeAuthToken(authToken) {
-        if (StringUtils.isEmpty(authToken)) {
-            throw ClientAuthError.createTokenNullOrEmptyError(authToken);
-        }
-        const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
-        const matches = tokenPartsRegex.exec(authToken);
-        if (!matches || matches.length < 4) {
-            throw ClientAuthError.createTokenParsingError(`Given token is malformed: ${JSON.stringify(authToken)}`);
-        }
-        const crackedToken = {
-            header: matches[1],
-            JWSPayload: matches[2],
-            JWSSig: matches[3],
-        };
-        return crackedToken;
-    }
-    /**
-     * Check if a string is empty.
-     *
-     * @param str
-     */
-    static isEmpty(str) {
-        return typeof str === "undefined" || !str || 0 === str.length;
-    }
-    /**
-     * Check if stringified object is empty
-     * @param strObj
-     */
-    static isEmptyObj(strObj) {
-        if (strObj && !StringUtils.isEmpty(strObj)) {
-            try {
-                const obj = JSON.parse(strObj);
-                return Object.keys(obj).length === 0;
-            }
-            catch (e) { }
-        }
-        return true;
-    }
-    static startsWith(str, search) {
-        return str.indexOf(search) === 0;
-    }
-    static endsWith(str, search) {
-        return (str.length >= search.length &&
-            str.lastIndexOf(search) === str.length - search.length);
-    }
-    /**
-     * Parses string into an object.
-     *
-     * @param query
-     */
-    static queryStringToObject(query) {
-        const obj = {};
-        const params = query.split("&");
-        const decode = (s) => decodeURIComponent(s.replace(/\+/g, " "));
-        params.forEach((pair) => {
-            if (pair.trim()) {
-                const [key, value] = pair.split(/=(.+)/g, 2); // Split on the first occurence of the '=' character
-                if (key && value) {
-                    obj[decode(key)] = decode(value);
-                }
-            }
-        });
-        return obj;
+const ClientConfigurationErrorMessage = {
+    redirectUriNotSet: {
+        code: "redirect_uri_empty",
+        desc: "A redirect URI is required for all calls, and none has been set.",
+    },
+    postLogoutUriNotSet: {
+        code: "post_logout_uri_empty",
+        desc: "A post logout redirect has not been set.",
+    },
+    claimsRequestParsingError: {
+        code: "claims_request_parsing_error",
+        desc: "Could not parse the given claims request object.",
+    },
+    authorityUriInsecure: {
+        code: "authority_uri_insecure",
+        desc: "Authority URIs must use https.  Please see here for valid authority configuration options: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-initializing-client-applications#configuration-options",
+    },
+    urlParseError: {
+        code: "url_parse_error",
+        desc: "URL could not be parsed into appropriate segments.",
+    },
+    urlEmptyError: {
+        code: "empty_url_error",
+        desc: "URL was empty or null.",
+    },
+    emptyScopesError: {
+        code: "empty_input_scopes_error",
+        desc: "Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",
+    },
+    nonArrayScopesError: {
+        code: "nonarray_input_scopes_error",
+        desc: "Scopes cannot be passed as non-array.",
+    },
+    clientIdSingleScopeError: {
+        code: "clientid_input_scopes_error",
+        desc: "Client ID can only be provided as a single scope.",
+    },
+    invalidPrompt: {
+        code: "invalid_prompt_value",
+        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create', 'none' and 'no_session'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
+    },
+    invalidClaimsRequest: {
+        code: "invalid_claims",
+        desc: "Given claims parameter must be a stringified JSON object.",
+    },
+    tokenRequestEmptyError: {
+        code: "token_request_empty",
+        desc: "Token request was empty and not found in cache.",
+    },
+    logoutRequestEmptyError: {
+        code: "logout_request_empty",
+        desc: "The logout request was null or undefined.",
+    },
+    invalidCodeChallengeMethod: {
+        code: "invalid_code_challenge_method",
+        desc: 'code_challenge_method passed is invalid. Valid values are "plain" and "S256".',
+    },
+    invalidCodeChallengeParams: {
+        code: "pkce_params_missing",
+        desc: "Both params: code_challenge and code_challenge_method are to be passed if to be sent in the request",
+    },
+    invalidCloudDiscoveryMetadata: {
+        code: "invalid_cloud_discovery_metadata",
+        desc: "Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields",
+    },
+    invalidAuthorityMetadata: {
+        code: "invalid_authority_metadata",
+        desc: "Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields.",
+    },
+    untrustedAuthority: {
+        code: "untrusted_authority",
+        desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.",
+    },
+    invalidAzureCloudInstance: {
+        code: "invalid_azure_cloud_instance",
+        desc: "Invalid AzureCloudInstance provided. Please refer MSAL JS docs: aks.ms/msaljs/azure_cloud_instance for valid values",
+    },
+    missingSshJwk: {
+        code: "missing_ssh_jwk",
+        desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme.",
+    },
+    missingSshKid: {
+        code: "missing_ssh_kid",
+        desc: "Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme.",
+    },
+    missingNonceAuthenticationHeader: {
+        code: "missing_nonce_authentication_header",
+        desc: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",
+    },
+    invalidAuthenticationHeader: {
+        code: "invalid_authentication_header",
+        desc: "Invalid authentication header provided",
+    },
+    cannotSetOIDCOptions: {
+        code: "cannot_set_OIDCOptions",
+        desc: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
+    },
+    cannotAllowNativeBroker: {
+        code: "cannot_allow_native_broker",
+        desc: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
+    },
+    authorityMismatch: {
+        code: "authority_mismatch",
+        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+    },
+};
+/**
+ * Error thrown when there is an error in configuration of the MSAL.js library.
+ */
+class ClientConfigurationError extends ClientAuthError {
+    constructor(errorCode, errorMessage) {
+        super(errorCode, errorMessage);
+        this.name = "ClientConfigurationError";
+        Object.setPrototypeOf(this, ClientConfigurationError.prototype);
     }
     /**
-     * Trims entries in an array.
-     *
-     * @param arr
+     * Creates an error thrown when the redirect uri is empty (not set by caller)
      */
-    static trimArrayEntries(arr) {
-        return arr.map((entry) => entry.trim());
+    static createRedirectUriEmptyError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.redirectUriNotSet.code, ClientConfigurationErrorMessage.redirectUriNotSet.desc);
     }
     /**
-     * Removes empty strings from array
-     * @param arr
+     * Creates an error thrown when the post-logout redirect uri is empty (not set by caller)
      */
-    static removeEmptyStringsFromArray(arr) {
-        return arr.filter((entry) => {
-            return !StringUtils.isEmpty(entry);
-        });
+    static createPostLogoutRedirectUriEmptyError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.postLogoutUriNotSet.code, ClientConfigurationErrorMessage.postLogoutUriNotSet.desc);
     }
     /**
-     * Attempts to parse a string into JSON
-     * @param str
+     * Creates an error thrown when the claims request could not be successfully parsed
      */
-    static jsonParseHelper(str) {
-        try {
-            return JSON.parse(str);
-        }
-        catch (e) {
-            return null;
-        }
+    static createClaimsRequestParsingError(claimsRequestParseError) {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.claimsRequestParsingError.code, `${ClientConfigurationErrorMessage.claimsRequestParsingError.desc} Given value: ${claimsRequestParseError}`);
     }
     /**
-     * Tests if a given string matches a given pattern, with support for wildcards and queries.
-     * @param pattern Wildcard pattern to string match. Supports "*" for wildcards and "?" for queries
-     * @param input String to match against
+     * Creates an error thrown if authority uri is given an insecure protocol.
+     * @param urlString
      */
-    static matchPattern(pattern, input) {
-        /**
-         * Wildcard support: https://stackoverflow.com/a/3117248/4888559
-         * Queries: replaces "?" in string with escaped "\?" for regex test
-         */
-        // eslint-disable-next-line security/detect-non-literal-regexp
-        const regex = new RegExp(pattern
-            .replace(/\\/g, "\\\\")
-            .replace(/\*/g, "[^ ]*")
-            .replace(/\?/g, "\\?"));
-        return regex.test(input);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Log message level.
- */
-exports.LogLevel = void 0;
-(function (LogLevel) {
-    LogLevel[LogLevel["Error"] = 0] = "Error";
-    LogLevel[LogLevel["Warning"] = 1] = "Warning";
-    LogLevel[LogLevel["Info"] = 2] = "Info";
-    LogLevel[LogLevel["Verbose"] = 3] = "Verbose";
-    LogLevel[LogLevel["Trace"] = 4] = "Trace";
-})(exports.LogLevel || (exports.LogLevel = {}));
-/**
- * Class which facilitates logging of messages to a specific place.
- */
-class Logger {
-    constructor(loggerOptions, packageName, packageVersion) {
-        // Current log level, defaults to info.
-        this.level = exports.LogLevel.Info;
-        const defaultLoggerCallback = () => {
-            return;
-        };
-        const setLoggerOptions = loggerOptions || Logger.createDefaultLoggerOptions();
-        this.localCallback =
-            setLoggerOptions.loggerCallback || defaultLoggerCallback;
-        this.piiLoggingEnabled = setLoggerOptions.piiLoggingEnabled || false;
-        this.level =
-            typeof setLoggerOptions.logLevel === "number"
-                ? setLoggerOptions.logLevel
-                : exports.LogLevel.Info;
-        this.correlationId =
-            setLoggerOptions.correlationId || Constants.EMPTY_STRING;
-        this.packageName = packageName || Constants.EMPTY_STRING;
-        this.packageVersion = packageVersion || Constants.EMPTY_STRING;
+    static createInsecureAuthorityUriError(urlString) {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.authorityUriInsecure.code, `${ClientConfigurationErrorMessage.authorityUriInsecure.desc} Given URI: ${urlString}`);
     }
-    static createDefaultLoggerOptions() {
-        return {
-            loggerCallback: () => {
-                // allow users to not set loggerCallback
-            },
-            piiLoggingEnabled: false,
-            logLevel: exports.LogLevel.Info,
-        };
+    /**
+     * Creates an error thrown if URL string does not parse into separate segments.
+     * @param urlString
+     */
+    static createUrlParseError(urlParseError) {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.urlParseError.code, `${ClientConfigurationErrorMessage.urlParseError.desc} Given Error: ${urlParseError}`);
     }
     /**
-     * Create new Logger with existing configurations.
+     * Creates an error thrown if URL string is empty or null.
+     * @param urlString
      */
-    clone(packageName, packageVersion, correlationId) {
-        return new Logger({
-            loggerCallback: this.localCallback,
-            piiLoggingEnabled: this.piiLoggingEnabled,
-            logLevel: this.level,
-            correlationId: correlationId || this.correlationId,
-        }, packageName, packageVersion);
+    static createUrlEmptyError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.urlEmptyError.code, ClientConfigurationErrorMessage.urlEmptyError.desc);
     }
     /**
-     * Log message with required options.
+     * Error thrown when scopes are empty.
+     * @param scopesValue
      */
-    logMessage(logMessage, options) {
-        if (options.logLevel > this.level ||
-            (!this.piiLoggingEnabled && options.containsPii)) {
-            return;
-        }
-        const timestamp = new Date().toUTCString();
-        // Add correlationId to logs if set, correlationId provided on log messages take precedence
-        let logHeader;
-        if (!StringUtils.isEmpty(options.correlationId)) {
-            logHeader = `[${timestamp}] : [${options.correlationId}]`;
-        }
-        else if (!StringUtils.isEmpty(this.correlationId)) {
-            logHeader = `[${timestamp}] : [${this.correlationId}]`;
-        }
-        else {
-            logHeader = `[${timestamp}]`;
-        }
-        const log = `${logHeader} : ${this.packageName}@${this.packageVersion} : ${exports.LogLevel[options.logLevel]} - ${logMessage}`;
-        // debug(`msal:${LogLevel[options.logLevel]}${options.containsPii ? "-Pii": Constants.EMPTY_STRING}${options.context ? `:${options.context}` : Constants.EMPTY_STRING}`)(logMessage);
-        this.executeCallback(options.logLevel, log, options.containsPii || false);
+    static createEmptyScopesArrayError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.emptyScopesError.code, `${ClientConfigurationErrorMessage.emptyScopesError.desc}`);
     }
     /**
-     * Execute callback with message.
+     * Error thrown when client id scope is not provided as single scope.
+     * @param inputScopes
      */
-    executeCallback(level, message, containsPii) {
-        if (this.localCallback) {
-            this.localCallback(level, message, containsPii);
-        }
+    static createClientIdSingleScopeError(inputScopes) {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.clientIdSingleScopeError.code, `${ClientConfigurationErrorMessage.clientIdSingleScopeError.desc} Given Scopes: ${inputScopes}`);
     }
     /**
-     * Logs error messages.
+     * Error thrown when prompt is not an allowed type.
+     * @param promptValue
      */
-    error(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Error,
-            containsPii: false,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createInvalidPromptError(promptValue) {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidPrompt.code, `${ClientConfigurationErrorMessage.invalidPrompt.desc} Given value: ${promptValue}`);
     }
     /**
-     * Logs error messages with PII.
+     * Creates error thrown when claims parameter is not a stringified JSON object
      */
-    errorPii(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Error,
-            containsPii: true,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createInvalidClaimsRequestError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidClaimsRequest.code, ClientConfigurationErrorMessage.invalidClaimsRequest.desc);
     }
     /**
-     * Logs warning messages.
+     * Throws error when token request is empty and nothing cached in storage.
      */
-    warning(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Warning,
-            containsPii: false,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createEmptyLogoutRequestError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.logoutRequestEmptyError.code, ClientConfigurationErrorMessage.logoutRequestEmptyError.desc);
     }
     /**
-     * Logs warning messages with PII.
+     * Throws error when token request is empty and nothing cached in storage.
      */
-    warningPii(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Warning,
-            containsPii: true,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createEmptyTokenRequestError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.tokenRequestEmptyError.code, ClientConfigurationErrorMessage.tokenRequestEmptyError.desc);
     }
     /**
-     * Logs info messages.
+     * Throws error when an invalid code_challenge_method is passed by the user
      */
-    info(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Info,
-            containsPii: false,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createInvalidCodeChallengeMethodError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidCodeChallengeMethod.code, ClientConfigurationErrorMessage.invalidCodeChallengeMethod.desc);
     }
     /**
-     * Logs info messages with PII.
+     * Throws error when both params: code_challenge and code_challenge_method are not passed together
      */
-    infoPii(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Info,
-            containsPii: true,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createInvalidCodeChallengeParamsError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidCodeChallengeParams.code, ClientConfigurationErrorMessage.invalidCodeChallengeParams.desc);
     }
     /**
-     * Logs verbose messages.
+     * Throws an error when the user passes invalid cloudDiscoveryMetadata
      */
-    verbose(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Verbose,
-            containsPii: false,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createInvalidCloudDiscoveryMetadataError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidCloudDiscoveryMetadata.code, ClientConfigurationErrorMessage.invalidCloudDiscoveryMetadata.desc);
     }
     /**
-     * Logs verbose messages with PII.
+     * Throws an error when the user passes invalid cloudDiscoveryMetadata
      */
-    verbosePii(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Verbose,
-            containsPii: true,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createInvalidAuthorityMetadataError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthorityMetadata.code, ClientConfigurationErrorMessage.invalidAuthorityMetadata.desc);
     }
     /**
-     * Logs trace messages.
+     * Throws error when provided authority is not a member of the trusted host list
      */
-    trace(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Trace,
-            containsPii: false,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createUntrustedAuthorityError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.untrustedAuthority.code, ClientConfigurationErrorMessage.untrustedAuthority.desc);
     }
     /**
-     * Logs trace messages with PII.
+     * Throws error when the AzureCloudInstance is set to an invalid value
      */
-    tracePii(message, correlationId) {
-        this.logMessage(message, {
-            logLevel: exports.LogLevel.Trace,
-            containsPii: true,
-            correlationId: correlationId || Constants.EMPTY_STRING,
-        });
+    static createInvalidAzureCloudInstanceError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAzureCloudInstance.code, ClientConfigurationErrorMessage.invalidAzureCloudInstance.desc);
     }
     /**
-     * Returns whether PII Logging is enabled or not.
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
      */
-    isPiiLoggingEnabled() {
-        return this.piiLoggingEnabled || false;
+    static createMissingSshJwkError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshJwk.code, ClientConfigurationErrorMessage.missingSshJwk.desc);
+    }
+    /**
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key ID is omitted from the request
+     */
+    static createMissingSshKidError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshKid.code, ClientConfigurationErrorMessage.missingSshKid.desc);
+    }
+    /**
+     * Throws error when provided headers don't contain a header that a server nonce can be extracted from
+     */
+    static createMissingNonceAuthenticationHeadersError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.code, ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.desc);
+    }
+    /**
+     * Throws error when a provided header is invalid in any way
+     */
+    static createInvalidAuthenticationHeaderError(invalidHeaderName, details) {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, `${ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc}. Invalid header: ${invalidHeaderName}. Details: ${details}`);
+    }
+    /**
+     * Throws error when provided non-default OIDCOptions when not in OIDC protocol mode
+     */
+    static createCannotSetOIDCOptionsError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotSetOIDCOptions.code, ClientConfigurationErrorMessage.cannotSetOIDCOptions.desc);
+    }
+    /**
+     * Throws error when allowNativeBroker is set to true when not in AAD protocol mode
+     */
+    static createCannotAllowNativeBrokerError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotAllowNativeBroker.code, ClientConfigurationErrorMessage.cannotAllowNativeBroker.desc);
+    }
+    /**
+     * Create an error when the authority provided in request does not match authority provided in account or MSAL.js configuration.
+     */
+    static createAuthorityMismatchError() {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.authorityMismatch.code, ClientConfigurationErrorMessage.authorityMismatch.desc);
     }
 }
 
-/* eslint-disable header/header */
-const name = "@azure/msal-common";
-const version = "14.0.1";
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-const AzureCloudInstance = {
-    // AzureCloudInstance is not specified.
-    None: "none",
-    // Microsoft Azure public cloud
-    AzurePublic: "https://login.microsoftonline.com",
-    // Microsoft PPE
-    AzurePpe: "https://login.windows-ppe.net",
-    // Microsoft Chinese national/regional cloud
-    AzureChina: "https://login.chinacloudapi.cn",
-    // Microsoft German national/regional cloud ("Black Forest")
-    AzureGermany: "https://login.microsoftonline.de",
-    // US Government cloud
-    AzureUsGovernment: "https://login.microsoftonline.us",
-};
+/**
+ * @hidden
+ */
+class StringUtils {
+    /**
+     * Check if stringified object is empty
+     * @param strObj
+     */
+    static isEmptyObj(strObj) {
+        if (strObj) {
+            try {
+                const obj = JSON.parse(strObj);
+                return Object.keys(obj).length === 0;
+            }
+            catch (e) { }
+        }
+        return true;
+    }
+    static startsWith(str, search) {
+        return str.indexOf(search) === 0;
+    }
+    static endsWith(str, search) {
+        return (str.length >= search.length &&
+            str.lastIndexOf(search) === str.length - search.length);
+    }
+    /**
+     * Parses string into an object.
+     *
+     * @param query
+     */
+    static queryStringToObject(query) {
+        const obj = {};
+        const params = query.split("&");
+        const decode = (s) => decodeURIComponent(s.replace(/\+/g, " "));
+        params.forEach((pair) => {
+            if (pair.trim()) {
+                const [key, value] = pair.split(/=(.+)/g, 2); // Split on the first occurence of the '=' character
+                if (key && value) {
+                    obj[decode(key)] = decode(value);
+                }
+            }
+        });
+        return obj;
+    }
+    /**
+     * Trims entries in an array.
+     *
+     * @param arr
+     */
+    static trimArrayEntries(arr) {
+        return arr.map((entry) => entry.trim());
+    }
+    /**
+     * Removes empty strings from array
+     * @param arr
+     */
+    static removeEmptyStringsFromArray(arr) {
+        return arr.filter((entry) => {
+            return !!entry;
+        });
+    }
+    /**
+     * Attempts to parse a string into JSON
+     * @param str
+     */
+    static jsonParseHelper(str) {
+        try {
+            return JSON.parse(str);
+        }
+        catch (e) {
+            return null;
+        }
+    }
+    /**
+     * Tests if a given string matches a given pattern, with support for wildcards and queries.
+     * @param pattern Wildcard pattern to string match. Supports "*" for wildcards and "?" for queries
+     * @param input String to match against
+     */
+    static matchPattern(pattern, input) {
+        /**
+         * Wildcard support: https://stackoverflow.com/a/3117248/4888559
+         * Queries: replaces "?" in string with escaped "\?" for regex test
+         */
+        // eslint-disable-next-line security/detect-non-literal-regexp
+        const regex = new RegExp(pattern
+            .replace(/\\/g, "\\\\")
+            .replace(/\*/g, "[^ ]*")
+            .replace(/\?/g, "\\?"));
+        return regex.test(input);
+    }
+}
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * ClientConfigurationErrorMessage class containing string constants used by error codes and messages.
- */
-const ClientConfigurationErrorMessage = {
-    redirectUriNotSet: {
-        code: "redirect_uri_empty",
-        desc: "A redirect URI is required for all calls, and none has been set.",
-    },
-    postLogoutUriNotSet: {
-        code: "post_logout_uri_empty",
-        desc: "A post logout redirect has not been set.",
-    },
-    claimsRequestParsingError: {
-        code: "claims_request_parsing_error",
-        desc: "Could not parse the given claims request object.",
-    },
-    authorityUriInsecure: {
-        code: "authority_uri_insecure",
-        desc: "Authority URIs must use https.  Please see here for valid authority configuration options: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-initializing-client-applications#configuration-options",
-    },
-    urlParseError: {
-        code: "url_parse_error",
-        desc: "URL could not be parsed into appropriate segments.",
-    },
-    urlEmptyError: {
-        code: "empty_url_error",
-        desc: "URL was empty or null.",
-    },
-    emptyScopesError: {
-        code: "empty_input_scopes_error",
-        desc: "Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",
-    },
-    nonArrayScopesError: {
-        code: "nonarray_input_scopes_error",
-        desc: "Scopes cannot be passed as non-array.",
-    },
-    clientIdSingleScopeError: {
-        code: "clientid_input_scopes_error",
-        desc: "Client ID can only be provided as a single scope.",
-    },
-    invalidPrompt: {
-        code: "invalid_prompt_value",
-        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create', 'none' and 'no_session'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
-    },
-    invalidClaimsRequest: {
-        code: "invalid_claims",
-        desc: "Given claims parameter must be a stringified JSON object.",
-    },
-    tokenRequestEmptyError: {
-        code: "token_request_empty",
-        desc: "Token request was empty and not found in cache.",
-    },
-    logoutRequestEmptyError: {
-        code: "logout_request_empty",
-        desc: "The logout request was null or undefined.",
-    },
-    invalidCodeChallengeMethod: {
-        code: "invalid_code_challenge_method",
-        desc: 'code_challenge_method passed is invalid. Valid values are "plain" and "S256".',
-    },
-    invalidCodeChallengeParams: {
-        code: "pkce_params_missing",
-        desc: "Both params: code_challenge and code_challenge_method are to be passed if to be sent in the request",
-    },
-    invalidCloudDiscoveryMetadata: {
-        code: "invalid_cloud_discovery_metadata",
-        desc: "Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields",
-    },
-    invalidAuthorityMetadata: {
-        code: "invalid_authority_metadata",
-        desc: "Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields.",
-    },
-    untrustedAuthority: {
-        code: "untrusted_authority",
-        desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.",
-    },
-    invalidAzureCloudInstance: {
-        code: "invalid_azure_cloud_instance",
-        desc: "Invalid AzureCloudInstance provided. Please refer MSAL JS docs: aks.ms/msaljs/azure_cloud_instance for valid values",
-    },
-    missingSshJwk: {
-        code: "missing_ssh_jwk",
-        desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme.",
-    },
-    missingSshKid: {
-        code: "missing_ssh_kid",
-        desc: "Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme.",
-    },
-    missingNonceAuthenticationHeader: {
-        code: "missing_nonce_authentication_header",
-        desc: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",
-    },
-    invalidAuthenticationHeader: {
-        code: "invalid_authentication_header",
-        desc: "Invalid authentication header provided",
-    },
-    cannotSetOIDCOptions: {
-        code: "cannot_set_OIDCOptions",
-        desc: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
-    },
-    cannotAllowNativeBroker: {
-        code: "cannot_allow_native_broker",
-        desc: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
-    },
-    authorityMismatch: {
-        code: "authority_mismatch",
-        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
-    },
-};
-/**
- * Error thrown when there is an error in configuration of the MSAL.js library.
+ * The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
+ * the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions
+ * to ensure uniqueness of strings.
  */
-class ClientConfigurationError extends ClientAuthError {
-    constructor(errorCode, errorMessage) {
-        super(errorCode, errorMessage);
-        this.name = "ClientConfigurationError";
-        Object.setPrototypeOf(this, ClientConfigurationError.prototype);
-    }
-    /**
-     * Creates an error thrown when the redirect uri is empty (not set by caller)
-     */
-    static createRedirectUriEmptyError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.redirectUriNotSet.code, ClientConfigurationErrorMessage.redirectUriNotSet.desc);
+class ScopeSet {
+    constructor(inputScopes) {
+        // Filter empty string and null/undefined array items
+        const scopeArr = inputScopes
+            ? StringUtils.trimArrayEntries([...inputScopes])
+            : [];
+        const filteredInput = scopeArr
+            ? StringUtils.removeEmptyStringsFromArray(scopeArr)
+            : [];
+        // Validate and filter scopes (validate function throws if validation fails)
+        this.validateInputScopes(filteredInput);
+        this.scopes = new Set(); // Iterator in constructor not supported by IE11
+        filteredInput.forEach((scope) => this.scopes.add(scope));
     }
     /**
-     * Creates an error thrown when the post-logout redirect uri is empty (not set by caller)
+     * Factory method to create ScopeSet from space-delimited string
+     * @param inputScopeString
+     * @param appClientId
+     * @param scopesRequired
      */
-    static createPostLogoutRedirectUriEmptyError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.postLogoutUriNotSet.code, ClientConfigurationErrorMessage.postLogoutUriNotSet.desc);
+    static fromString(inputScopeString) {
+        const scopeString = inputScopeString || Constants.EMPTY_STRING;
+        const inputScopes = scopeString.split(" ");
+        return new ScopeSet(inputScopes);
     }
     /**
-     * Creates an error thrown when the claims request could not be successfully parsed
+     * Creates the set of scopes to search for in cache lookups
+     * @param inputScopeString
+     * @returns
      */
-    static createClaimsRequestParsingError(claimsRequestParseError) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.claimsRequestParsingError.code, `${ClientConfigurationErrorMessage.claimsRequestParsingError.desc} Given value: ${claimsRequestParseError}`);
+    static createSearchScopes(inputScopeString) {
+        const scopeSet = new ScopeSet(inputScopeString);
+        if (!scopeSet.containsOnlyOIDCScopes()) {
+            scopeSet.removeOIDCScopes();
+        }
+        else {
+            scopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
+        }
+        return scopeSet;
     }
     /**
-     * Creates an error thrown if authority uri is given an insecure protocol.
-     * @param urlString
+     * Used to validate the scopes input parameter requested  by the developer.
+     * @param {Array<string>} inputScopes - Developer requested permissions. Not all scopes are guaranteed to be included in the access token returned.
+     * @param {boolean} scopesRequired - Boolean indicating whether the scopes array is required or not
      */
-    static createInsecureAuthorityUriError(urlString) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.authorityUriInsecure.code, `${ClientConfigurationErrorMessage.authorityUriInsecure.desc} Given URI: ${urlString}`);
+    validateInputScopes(inputScopes) {
+        // Check if scopes are required but not given or is an empty array
+        if (!inputScopes || inputScopes.length < 1) {
+            throw ClientConfigurationError.createEmptyScopesArrayError();
+        }
     }
     /**
-     * Creates an error thrown if URL string does not parse into separate segments.
-     * @param urlString
+     * Check if a given scope is present in this set of scopes.
+     * @param scope
      */
-    static createUrlParseError(urlParseError) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.urlParseError.code, `${ClientConfigurationErrorMessage.urlParseError.desc} Given Error: ${urlParseError}`);
+    containsScope(scope) {
+        const lowerCaseScopes = this.printScopesLowerCase().split(" ");
+        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
+        // compare lowercase scopes
+        return scope
+            ? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
+            : false;
     }
     /**
-     * Creates an error thrown if URL string is empty or null.
-     * @param urlString
+     * Check if a set of scopes is present in this set of scopes.
+     * @param scopeSet
      */
-    static createUrlEmptyError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.urlEmptyError.code, ClientConfigurationErrorMessage.urlEmptyError.desc);
+    containsScopeSet(scopeSet) {
+        if (!scopeSet || scopeSet.scopes.size <= 0) {
+            return false;
+        }
+        return (this.scopes.size >= scopeSet.scopes.size &&
+            scopeSet.asArray().every((scope) => this.containsScope(scope)));
     }
     /**
-     * Error thrown when scopes are empty.
-     * @param scopesValue
+     * Check if set of scopes contains only the defaults
      */
-    static createEmptyScopesArrayError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.emptyScopesError.code, `${ClientConfigurationErrorMessage.emptyScopesError.desc}`);
+    containsOnlyOIDCScopes() {
+        let defaultScopeCount = 0;
+        OIDC_SCOPES.forEach((defaultScope) => {
+            if (this.containsScope(defaultScope)) {
+                defaultScopeCount += 1;
+            }
+        });
+        return this.scopes.size === defaultScopeCount;
     }
     /**
-     * Error thrown when client id scope is not provided as single scope.
-     * @param inputScopes
+     * Appends single scope if passed
+     * @param newScope
      */
-    static createClientIdSingleScopeError(inputScopes) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.clientIdSingleScopeError.code, `${ClientConfigurationErrorMessage.clientIdSingleScopeError.desc} Given Scopes: ${inputScopes}`);
+    appendScope(newScope) {
+        if (newScope) {
+            this.scopes.add(newScope.trim());
+        }
     }
     /**
-     * Error thrown when prompt is not an allowed type.
-     * @param promptValue
+     * Appends multiple scopes if passed
+     * @param newScopes
      */
-    static createInvalidPromptError(promptValue) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidPrompt.code, `${ClientConfigurationErrorMessage.invalidPrompt.desc} Given value: ${promptValue}`);
+    appendScopes(newScopes) {
+        try {
+            newScopes.forEach((newScope) => this.appendScope(newScope));
+        }
+        catch (e) {
+            throw ClientAuthError.createAppendScopeSetError(e);
+        }
     }
     /**
-     * Creates error thrown when claims parameter is not a stringified JSON object
+     * Removes element from set of scopes.
+     * @param scope
      */
-    static createInvalidClaimsRequestError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidClaimsRequest.code, ClientConfigurationErrorMessage.invalidClaimsRequest.desc);
+    removeScope(scope) {
+        if (!scope) {
+            throw ClientAuthError.createRemoveEmptyScopeFromSetError(scope);
+        }
+        this.scopes.delete(scope.trim());
     }
     /**
-     * Throws error when token request is empty and nothing cached in storage.
+     * Removes default scopes from set of scopes
+     * Primarily used to prevent cache misses if the default scopes are not returned from the server
      */
-    static createEmptyLogoutRequestError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.logoutRequestEmptyError.code, ClientConfigurationErrorMessage.logoutRequestEmptyError.desc);
+    removeOIDCScopes() {
+        OIDC_SCOPES.forEach((defaultScope) => {
+            this.scopes.delete(defaultScope);
+        });
     }
     /**
-     * Throws error when token request is empty and nothing cached in storage.
-     */
-    static createEmptyTokenRequestError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.tokenRequestEmptyError.code, ClientConfigurationErrorMessage.tokenRequestEmptyError.desc);
-    }
-    /**
-     * Throws error when an invalid code_challenge_method is passed by the user
-     */
-    static createInvalidCodeChallengeMethodError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidCodeChallengeMethod.code, ClientConfigurationErrorMessage.invalidCodeChallengeMethod.desc);
-    }
-    /**
-     * Throws error when both params: code_challenge and code_challenge_method are not passed together
-     */
-    static createInvalidCodeChallengeParamsError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidCodeChallengeParams.code, ClientConfigurationErrorMessage.invalidCodeChallengeParams.desc);
-    }
-    /**
-     * Throws an error when the user passes invalid cloudDiscoveryMetadata
-     */
-    static createInvalidCloudDiscoveryMetadataError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidCloudDiscoveryMetadata.code, ClientConfigurationErrorMessage.invalidCloudDiscoveryMetadata.desc);
-    }
-    /**
-     * Throws an error when the user passes invalid cloudDiscoveryMetadata
-     */
-    static createInvalidAuthorityMetadataError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthorityMetadata.code, ClientConfigurationErrorMessage.invalidAuthorityMetadata.desc);
-    }
-    /**
-     * Throws error when provided authority is not a member of the trusted host list
-     */
-    static createUntrustedAuthorityError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.untrustedAuthority.code, ClientConfigurationErrorMessage.untrustedAuthority.desc);
-    }
-    /**
-     * Throws error when the AzureCloudInstance is set to an invalid value
-     */
-    static createInvalidAzureCloudInstanceError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAzureCloudInstance.code, ClientConfigurationErrorMessage.invalidAzureCloudInstance.desc);
-    }
-    /**
-     * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
-     */
-    static createMissingSshJwkError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshJwk.code, ClientConfigurationErrorMessage.missingSshJwk.desc);
-    }
-    /**
-     * Throws an error when the authentication scheme is set to SSH but the SSH public key ID is omitted from the request
-     */
-    static createMissingSshKidError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshKid.code, ClientConfigurationErrorMessage.missingSshKid.desc);
-    }
-    /**
-     * Throws error when provided headers don't contain a header that a server nonce can be extracted from
-     */
-    static createMissingNonceAuthenticationHeadersError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.code, ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.desc);
-    }
-    /**
-     * Throws error when a provided header is invalid in any way
-     */
-    static createInvalidAuthenticationHeaderError(invalidHeaderName, details) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, `${ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc}. Invalid header: ${invalidHeaderName}. Details: ${details}`);
-    }
-    /**
-     * Throws error when provided non-default OIDCOptions when not in OIDC protocol mode
-     */
-    static createCannotSetOIDCOptionsError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotSetOIDCOptions.code, ClientConfigurationErrorMessage.cannotSetOIDCOptions.desc);
-    }
-    /**
-     * Throws error when allowNativeBroker is set to true when not in AAD protocol mode
-     */
-    static createCannotAllowNativeBrokerError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotAllowNativeBroker.code, ClientConfigurationErrorMessage.cannotAllowNativeBroker.desc);
-    }
-    /**
-     * Create an error when the authority provided in request does not match authority provided in account or MSAL.js configuration.
-     */
-    static createAuthorityMismatchError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.authorityMismatch.code, ClientConfigurationErrorMessage.authorityMismatch.desc);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
- * the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions
- * to ensure uniqueness of strings.
- */
-class ScopeSet {
-    constructor(inputScopes) {
-        // Filter empty string and null/undefined array items
-        const scopeArr = inputScopes
-            ? StringUtils.trimArrayEntries([...inputScopes])
-            : [];
-        const filteredInput = scopeArr
-            ? StringUtils.removeEmptyStringsFromArray(scopeArr)
-            : [];
-        // Validate and filter scopes (validate function throws if validation fails)
-        this.validateInputScopes(filteredInput);
-        this.scopes = new Set(); // Iterator in constructor not supported by IE11
-        filteredInput.forEach((scope) => this.scopes.add(scope));
-    }
-    /**
-     * Factory method to create ScopeSet from space-delimited string
-     * @param inputScopeString
-     * @param appClientId
-     * @param scopesRequired
-     */
-    static fromString(inputScopeString) {
-        const scopeString = inputScopeString || Constants.EMPTY_STRING;
-        const inputScopes = scopeString.split(" ");
-        return new ScopeSet(inputScopes);
-    }
-    /**
-     * Creates the set of scopes to search for in cache lookups
-     * @param inputScopeString
-     * @returns
-     */
-    static createSearchScopes(inputScopeString) {
-        const scopeSet = new ScopeSet(inputScopeString);
-        if (!scopeSet.containsOnlyOIDCScopes()) {
-            scopeSet.removeOIDCScopes();
-        }
-        else {
-            scopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
-        }
-        return scopeSet;
-    }
-    /**
-     * Used to validate the scopes input parameter requested  by the developer.
-     * @param {Array<string>} inputScopes - Developer requested permissions. Not all scopes are guaranteed to be included in the access token returned.
-     * @param {boolean} scopesRequired - Boolean indicating whether the scopes array is required or not
-     */
-    validateInputScopes(inputScopes) {
-        // Check if scopes are required but not given or is an empty array
-        if (!inputScopes || inputScopes.length < 1) {
-            throw ClientConfigurationError.createEmptyScopesArrayError();
-        }
-    }
-    /**
-     * Check if a given scope is present in this set of scopes.
-     * @param scope
-     */
-    containsScope(scope) {
-        const lowerCaseScopes = this.printScopesLowerCase().split(" ");
-        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
-        // compare lowercase scopes
-        return !StringUtils.isEmpty(scope)
-            ? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
-            : false;
-    }
-    /**
-     * Check if a set of scopes is present in this set of scopes.
-     * @param scopeSet
-     */
-    containsScopeSet(scopeSet) {
-        if (!scopeSet || scopeSet.scopes.size <= 0) {
-            return false;
-        }
-        return (this.scopes.size >= scopeSet.scopes.size &&
-            scopeSet.asArray().every((scope) => this.containsScope(scope)));
-    }
-    /**
-     * Check if set of scopes contains only the defaults
-     */
-    containsOnlyOIDCScopes() {
-        let defaultScopeCount = 0;
-        OIDC_SCOPES.forEach((defaultScope) => {
-            if (this.containsScope(defaultScope)) {
-                defaultScopeCount += 1;
-            }
-        });
-        return this.scopes.size === defaultScopeCount;
-    }
-    /**
-     * Appends single scope if passed
-     * @param newScope
-     */
-    appendScope(newScope) {
-        if (!StringUtils.isEmpty(newScope)) {
-            this.scopes.add(newScope.trim());
-        }
-    }
-    /**
-     * Appends multiple scopes if passed
-     * @param newScopes
-     */
-    appendScopes(newScopes) {
-        try {
-            newScopes.forEach((newScope) => this.appendScope(newScope));
-        }
-        catch (e) {
-            throw ClientAuthError.createAppendScopeSetError(e);
-        }
-    }
-    /**
-     * Removes element from set of scopes.
-     * @param scope
-     */
-    removeScope(scope) {
-        if (StringUtils.isEmpty(scope)) {
-            throw ClientAuthError.createRemoveEmptyScopeFromSetError(scope);
-        }
-        this.scopes.delete(scope.trim());
-    }
-    /**
-     * Removes default scopes from set of scopes
-     * Primarily used to prevent cache misses if the default scopes are not returned from the server
-     */
-    removeOIDCScopes() {
-        OIDC_SCOPES.forEach((defaultScope) => {
-            this.scopes.delete(defaultScope);
-        });
-    }
-    /**
-     * Combines an array of scopes with the current set of scopes.
-     * @param otherScopes
+     * Combines an array of scopes with the current set of scopes.
+     * @param otherScopes
      */
     unionScopeSets(otherScopes) {
         if (!otherScopes) {
@@ -1811,7 +1782,7 @@ class ScopeSet {
  * @param crypto
  */
 function buildClientInfo(rawClientInfo, crypto) {
-    if (StringUtils.isEmpty(rawClientInfo)) {
+    if (!rawClientInfo) {
         throw ClientAuthError.createClientInfoEmptyError();
     }
     try {
@@ -1827,7 +1798,7 @@ function buildClientInfo(rawClientInfo, crypto) {
  * @param homeAccountId
  */
 function buildClientInfoFromHomeAccountId(homeAccountId) {
-    if (StringUtils.isEmpty(homeAccountId)) {
+    if (!homeAccountId) {
         throw ClientAuthError.createClientInfoDecodingError("Home account ID was empty.");
     }
     const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
@@ -1890,6 +1861,7 @@ const ProtocolMode = {
  *      idTokenClaims: Object containing claims parsed from ID token
  *      nativeAccountId: Account identifier on the native device
  * }
+ * @internal
  */
 class AccountEntity {
     /**
@@ -2029,8 +2001,7 @@ class AccountEntity {
         if (serverClientInfo) {
             try {
                 const clientInfo = buildClientInfo(serverClientInfo, cryptoObj);
-                if (!StringUtils.isEmpty(clientInfo.uid) &&
-                    !StringUtils.isEmpty(clientInfo.utid)) {
+                if (clientInfo.uid && clientInfo.utid) {
                     return `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`;
                 }
             }
@@ -2091,56 +2062,74 @@ class AccountEntity {
  * Licensed under the MIT License.
  */
 /**
- * JWT Token representation class. Parses token string and generates claims object.
+ * Extract token by decoding the rawToken
+ *
+ * @param encodedToken
  */
-class AuthToken {
-    constructor(rawToken, crypto) {
-        if (StringUtils.isEmpty(rawToken)) {
-            throw ClientAuthError.createTokenNullOrEmptyError(rawToken);
-        }
-        this.rawToken = rawToken;
-        this.claims = AuthToken.extractTokenClaims(rawToken, crypto);
+function extractTokenClaims(encodedToken, base64Decode) {
+    const jswPayload = getJWSPayload(encodedToken);
+    // token will be decoded to get the username
+    try {
+        // base64Decode() should throw an error if there is an issue
+        const base64Decoded = base64Decode(jswPayload);
+        return JSON.parse(base64Decoded);
     }
-    /**
-     * Extract token by decoding the rawToken
-     *
-     * @param encodedToken
-     */
-    static extractTokenClaims(encodedToken, crypto) {
-        const decodedToken = StringUtils.decodeAuthToken(encodedToken);
-        // token will be decoded to get the username
-        try {
-            const base64TokenPayload = decodedToken.JWSPayload;
-            // base64Decode() should throw an error if there is an issue
-            const base64Decoded = crypto.base64Decode(base64TokenPayload);
-            return JSON.parse(base64Decoded);
-        }
-        catch (err) {
-            throw ClientAuthError.createTokenParsingError(err);
-        }
+    catch (err) {
+        throw ClientAuthError.createTokenParsingError(err);
+    }
+}
+/**
+ * decode a JWT
+ *
+ * @param authToken
+ */
+function getJWSPayload(authToken) {
+    if (!authToken) {
+        throw ClientAuthError.createTokenNullOrEmptyError(authToken);
+    }
+    const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
+    const matches = tokenPartsRegex.exec(authToken);
+    if (!matches || matches.length < 4) {
+        throw ClientAuthError.createTokenParsingError(`Given token is malformed: ${JSON.stringify(authToken)}`);
     }
     /**
-     * Determine if the token's max_age has transpired
+     * const crackedToken = {
+     *  header: matches[1],
+     *  JWSPayload: matches[2],
+     *  JWSSig: matches[3],
+     * };
      */
-    static checkMaxAge(authTime, maxAge) {
-        /*
-         * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-         * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
-         * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
-         */
-        const fiveMinuteSkew = 300000; // five minutes in milliseconds
-        if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
-            throw ClientAuthError.createMaxAgeTranspiredError();
-        }
+    return matches[2];
+}
+/**
+ * Determine if the token's max_age has transpired
+ */
+function checkMaxAge(authTime, maxAge) {
+    /*
+     * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+     * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
+     * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
+     */
+    const fiveMinuteSkew = 300000; // five minutes in milliseconds
+    if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
+        throw ClientAuthError.createMaxAgeTranspiredError();
     }
 }
 
+var AuthToken = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    checkMaxAge: checkMaxAge,
+    extractTokenClaims: extractTokenClaims,
+    getJWSPayload: getJWSPayload
+});
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
+ * @internal
  */
 class CacheManager {
     constructor(clientId, cryptoImpl, logger) {
@@ -2191,7 +2180,7 @@ class CacheManager {
         const idToken = this.getIdToken(accountInfo);
         if (idToken) {
             accountInfo.idToken = idToken.secret;
-            accountInfo.idTokenClaims = new AuthToken(idToken.secret, this.cryptoImpl).claims;
+            accountInfo.idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
         }
         return accountInfo;
     }
@@ -2587,7 +2576,7 @@ class CacheManager {
         const cachedRefreshToken = this.getRefreshToken(account, false, tokenKeys);
         const cachedAppMetadata = this.readAppMetadataFromCache(environment);
         if (cachedAccount && cachedIdToken) {
-            cachedAccount.idTokenClaims = new AuthToken(cachedIdToken.secret, this.cryptoImpl).claims;
+            cachedAccount.idTokenClaims = extractTokenClaims(cachedIdToken.secret, this.cryptoImpl.base64Decode);
         }
         return {
             account: cachedAccount,
@@ -2743,7 +2732,7 @@ class CacheManager {
         else if (numAccessTokens > 1) {
             this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them");
             accessTokens.forEach((accessToken) => {
-                this.removeAccessToken(accessToken.generateCredentialKey());
+                void this.removeAccessToken(accessToken.generateCredentialKey());
             });
             return null;
         }
@@ -3057,6 +3046,7 @@ class CacheManager {
         return obj;
     }
 }
+/** @internal */
 class DefaultStorageClass extends CacheManager {
     setAccount() {
         const notImplErr = "Storage interface - setAccount() has not been implemented for the cacheStorage interface.";
@@ -3275,6 +3265,7 @@ class ServerError extends AuthError {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/** @internal */
 class ThrottlingUtils {
     /**
      * Prepares a RequestThumbprint to be stored as a key.
@@ -3370,6 +3361,7 @@ class ThrottlingUtils {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/** @internal */
 class NetworkManager {
     constructor(networkClient, cacheManager) {
         this.networkClient = networkClient;
@@ -3422,7 +3414,7 @@ class RequestValidator {
      * @param redirectUri
      */
     static validateRedirectUri(redirectUri) {
-        if (StringUtils.isEmpty(redirectUri)) {
+        if (!redirectUri) {
             throw ClientConfigurationError.createRedirectUriEmptyError();
         }
     }
@@ -3453,8 +3445,7 @@ class RequestValidator {
      * @param codeChallengeMethod
      */
     static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-        if (StringUtils.isEmpty(codeChallenge) ||
-            StringUtils.isEmpty(codeChallengeMethod)) {
+        if (!codeChallenge || !codeChallengeMethod) {
             throw ClientConfigurationError.createInvalidCodeChallengeParamsError();
         }
         else {
@@ -3482,7 +3473,7 @@ class RequestValidator {
             return {};
         }
         // Remove any query parameters already included in SSO params
-        queryParams.forEach((value, key) => {
+        queryParams.forEach((_value, key) => {
             if (eQParams[key]) {
                 delete eQParams[key];
             }
@@ -3496,6 +3487,7 @@ class RequestValidator {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/** @internal */
 class RequestParameterBuilder {
     constructor() {
         this.parameters = new Map();
@@ -3664,7 +3656,7 @@ class RequestParameterBuilder {
      * @param state
      */
     addState(state) {
-        if (!StringUtils.isEmpty(state)) {
+        if (state) {
             this.parameters.set(AADServerParamKeys.STATE, encodeURIComponent(state));
         }
     }
@@ -3731,7 +3723,7 @@ class RequestParameterBuilder {
      * @param clientAssertion
      */
     addClientAssertion(clientAssertion) {
-        if (!StringUtils.isEmpty(clientAssertion)) {
+        if (clientAssertion) {
             this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
         }
     }
@@ -3740,7 +3732,7 @@ class RequestParameterBuilder {
      * @param clientAssertionType
      */
     addClientAssertionType(clientAssertionType) {
-        if (!StringUtils.isEmpty(clientAssertionType)) {
+        if (clientAssertionType) {
             this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
         }
     }
@@ -3827,7 +3819,7 @@ class RequestParameterBuilder {
      * @param cnfString
      */
     addPopToken(cnfString) {
-        if (!StringUtils.isEmpty(cnfString)) {
+        if (cnfString) {
             this.parameters.set(AADServerParamKeys.TOKEN_TYPE, AuthenticationScheme.POP);
             this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
         }
@@ -3836,7 +3828,7 @@ class RequestParameterBuilder {
      * add SSH JWK and key ID to query params
      */
     addSshJwk(sshJwkString) {
-        if (!StringUtils.isEmpty(sshJwkString)) {
+        if (sshJwkString) {
             this.parameters.set(AADServerParamKeys.TOKEN_TYPE, AuthenticationScheme.SSH);
             this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
         }
@@ -3878,18 +3870,254 @@ class RequestParameterBuilder {
  * Licensed under the MIT License.
  */
 /**
- * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
+ * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
+ *
+ * @export
+ * @enum {number}
  */
-class BaseClient {
-    constructor(configuration, performanceClient) {
-        // Set the configuration
-        this.config = buildClientConfiguration(configuration);
-        // Initialize the logger
-        this.logger = new Logger(this.config.loggerOptions, name, version);
-        // Initialize crypto
-        this.cryptoUtils = this.config.cryptoInterface;
-        // Initialize storage interface
-        this.cacheManager = this.config.storageInterface;
+const PerformanceEvents = {
+    /**
+     * acquireTokenByCode API (msal-browser and msal-node).
+     * Used to acquire tokens by trading an authorization code against the token endpoint.
+     */
+    AcquireTokenByCode: "acquireTokenByCode",
+    /**
+     * acquireTokenByRefreshToken API (msal-browser and msal-node).
+     * Used to renew an access token using a refresh token against the token endpoint.
+     */
+    AcquireTokenByRefreshToken: "acquireTokenByRefreshToken",
+    /**
+     * acquireTokenSilent API (msal-browser and msal-node).
+     * Used to silently acquire a new access token (from the cache or the network).
+     */
+    AcquireTokenSilent: "acquireTokenSilent",
+    /**
+     * acquireTokenSilentAsync (msal-browser).
+     * Internal API for acquireTokenSilent.
+     */
+    AcquireTokenSilentAsync: "acquireTokenSilentAsync",
+    /**
+     * acquireTokenPopup (msal-browser).
+     * Used to acquire a new access token interactively through pop ups
+     */
+    AcquireTokenPopup: "acquireTokenPopup",
+    /**
+     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
+     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
+     */
+    CryptoOptsGetPublicKeyThumbprint: "cryptoOptsGetPublicKeyThumbprint",
+    /**
+     * signJwt API in CryptoOpts class (msal-browser).
+     * Used to signed a pop token.
+     */
+    CryptoOptsSignJwt: "cryptoOptsSignJwt",
+    /**
+     * acquireToken API in the SilentCacheClient class (msal-browser).
+     * Used to read access tokens from the cache.
+     */
+    SilentCacheClientAcquireToken: "silentCacheClientAcquireToken",
+    /**
+     * acquireToken API in the SilentIframeClient class (msal-browser).
+     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
+     */
+    SilentIframeClientAcquireToken: "silentIframeClientAcquireToken",
+    /**
+     * acquireToken API in SilentRereshClient (msal-browser).
+     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
+     */
+    SilentRefreshClientAcquireToken: "silentRefreshClientAcquireToken",
+    /**
+     * ssoSilent API (msal-browser).
+     * Used to silently acquire an authorization code and set of tokens using a hidden iframe.
+     */
+    SsoSilent: "ssoSilent",
+    /**
+     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
+     * Used to load authority metadata for a request.
+     */
+    StandardInteractionClientGetDiscoveredAuthority: "standardInteractionClientGetDiscoveredAuthority",
+    /**
+     * acquireToken APIs in msal-browser.
+     * Used to make an /authorize endpoint call with native brokering enabled.
+     */
+    FetchAccountIdWithNativeBroker: "fetchAccountIdWithNativeBroker",
+    /**
+     * acquireToken API in NativeInteractionClient class (msal-browser).
+     * Used to acquire a token from Native component when native brokering is enabled.
+     */
+    NativeInteractionClientAcquireToken: "nativeInteractionClientAcquireToken",
+    /**
+     * Time spent creating default headers for requests to token endpoint
+     */
+    BaseClientCreateTokenRequestHeaders: "baseClientCreateTokenRequestHeaders",
+    /**
+     * Time spent sending/waiting for the response of a request to the token endpoint
+     */
+    BaseClientExecutePostToTokenEndpoint: "baseClientExecutePostToTokenEndpoint",
+    /**
+     * Used to measure the time taken for completing embedded-broker handshake (PW-Broker).
+     */
+    BrokerHandhshake: "brokerHandshake",
+    /**
+     * acquireTokenByRefreshToken API in BrokerClientApplication (PW-Broker) .
+     */
+    AcquireTokenByRefreshTokenInBroker: "acquireTokenByRefreshTokenInBroker",
+    /**
+     * Time taken for token acquisition by broker
+     */
+    AcquireTokenByBroker: "acquireTokenByBroker",
+    /**
+     * Time spent on the network for refresh token acquisition
+     */
+    RefreshTokenClientExecuteTokenRequest: "refreshTokenClientExecuteTokenRequest",
+    /**
+     * Time taken for acquiring refresh token , records RT size
+     */
+    RefreshTokenClientAcquireToken: "refreshTokenClientAcquireToken",
+    /**
+     * Time taken for acquiring cached refresh token
+     */
+    RefreshTokenClientAcquireTokenWithCachedRefreshToken: "refreshTokenClientAcquireTokenWithCachedRefreshToken",
+    /**
+     * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
+     */
+    RefreshTokenClientAcquireTokenByRefreshToken: "refreshTokenClientAcquireTokenByRefreshToken",
+    /**
+     * Helper function to create token request body in RefreshTokenClient (msal-common).
+     */
+    RefreshTokenClientCreateTokenRequestBody: "refreshTokenClientCreateTokenRequestBody",
+    /**
+     * acquireTokenFromCache (msal-browser).
+     * Internal API for acquiring token from cache
+     */
+    AcquireTokenFromCache: "acquireTokenFromCache",
+    /**
+     * acquireTokenBySilentIframe (msal-browser).
+     * Internal API for acquiring token by silent Iframe
+     */
+    AcquireTokenBySilentIframe: "acquireTokenBySilentIframe",
+    /**
+     * Internal API for initializing base request in BaseInteractionClient (msal-browser)
+     */
+    InitializeBaseRequest: "initializeBaseRequest",
+    /**
+     * Internal API for initializing silent request in SilentCacheClient (msal-browser)
+     */
+    InitializeSilentRequest: "initializeSilentRequest",
+    InitializeClientApplication: "initializeClientApplication",
+    /**
+     * Helper function in SilentIframeClient class (msal-browser).
+     */
+    SilentIframeClientTokenHelper: "silentIframeClientTokenHelper",
+    /**
+     * SilentHandler
+     */
+    SilentHandlerInitiateAuthRequest: "silentHandlerInitiateAuthRequest",
+    SilentHandlerMonitorIframeForHash: "silentHandlerMonitorIframeForHash",
+    SilentHandlerLoadFrame: "silentHandlerLoadFrame",
+    /**
+     * Helper functions in StandardInteractionClient class (msal-browser)
+     */
+    StandardInteractionClientCreateAuthCodeClient: "standardInteractionClientCreateAuthCodeClient",
+    StandardInteractionClientGetClientConfiguration: "standardInteractionClientGetClientConfiguration",
+    StandardInteractionClientInitializeAuthorizationRequest: "standardInteractionClientInitializeAuthorizationRequest",
+    StandardInteractionClientInitializeAuthorizationCodeRequest: "standardInteractionClientInitializeAuthorizationCodeRequest",
+    /**
+     * getAuthCodeUrl API (msal-browser and msal-node).
+     */
+    GetAuthCodeUrl: "getAuthCodeUrl",
+    /**
+     * Functions from InteractionHandler (msal-browser)
+     */
+    HandleCodeResponseFromServer: "handleCodeResponseFromServer",
+    HandleCodeResponseFromHash: "handleCodeResponseFromHash",
+    UpdateTokenEndpointAuthority: "updateTokenEndpointAuthority",
+    /**
+     * APIs in Authorization Code Client (msal-common)
+     */
+    AuthClientAcquireToken: "authClientAcquireToken",
+    AuthClientExecuteTokenRequest: "authClientExecuteTokenRequest",
+    AuthClientCreateTokenRequestBody: "authClientCreateTokenRequestBody",
+    AuthClientCreateQueryString: "authClientCreateQueryString",
+    /**
+     * Generate functions in PopTokenGenerator (msal-common)
+     */
+    PopTokenGenerateCnf: "popTokenGenerateCnf",
+    PopTokenGenerateKid: "popTokenGenerateKid",
+    /**
+     * handleServerTokenResponse API in ResponseHandler (msal-common)
+     */
+    HandleServerTokenResponse: "handleServerTokenResponse",
+    /**
+     * Authority functions
+     */
+    AuthorityFactoryCreateDiscoveredInstance: "authorityFactoryCreateDiscoveredInstance",
+    AuthorityResolveEndpointsAsync: "authorityResolveEndpointsAsync",
+    AuthorityGetCloudDiscoveryMetadataFromNetwork: "authorityGetCloudDiscoveryMetadataFromNetwork",
+    AuthorityUpdateCloudDiscoveryMetadata: "authorityUpdateCloudDiscoveryMetadata",
+    AuthorityGetEndpointMetadataFromNetwork: "authorityGetEndpointMetadataFromNetwork",
+    AuthorityUpdateEndpointMetadata: "authorityUpdateEndpointMetadata",
+    AuthorityUpdateMetadataWithRegionalInformation: "authorityUpdateMetadataWithRegionalInformation",
+    /**
+     * Region Discovery functions
+     */
+    RegionDiscoveryDetectRegion: "regionDiscoveryDetectRegion",
+    RegionDiscoveryGetRegionFromIMDS: "regionDiscoveryGetRegionFromIMDS",
+    RegionDiscoveryGetCurrentVersion: "regionDiscoveryGetCurrentVersion",
+    AcquireTokenByCodeAsync: "acquireTokenByCodeAsync",
+    GetEndpointMetadataFromNetwork: "getEndpointMetadataFromNetwork",
+    GetCloudDiscoveryMetadataFromNetworkMeasurement: "getCloudDiscoveryMetadataFromNetworkMeasurement",
+    HandleRedirectPromiseMeasurement: "handleRedirectPromiseMeasurement",
+    UpdateCloudDiscoveryMetadataMeasurement: "updateCloudDiscoveryMetadataMeasurement",
+    UsernamePasswordClientAcquireToken: "usernamePasswordClientAcquireToken",
+    NativeMessageHandlerHandshake: "nativeMessageHandlerHandshake",
+    NativeGenerateAuthResult: "nativeGenerateAuthResult",
+    /**
+     * Cache operations
+     */
+    ClearTokensAndKeysWithClaims: "clearTokensAndKeysWithClaims",
+};
+/**
+ * State of the performance event.
+ *
+ * @export
+ * @enum {number}
+ */
+const PerformanceEventStatus = {
+    NotStarted: 0,
+    InProgress: 1,
+    Completed: 2,
+};
+const IntFields = new Set([
+    "accessTokenSize",
+    "durationMs",
+    "idTokenSize",
+    "matsSilentStatus",
+    "matsHttpStatus",
+    "refreshTokenSize",
+    "queuedTimeMs",
+    "startTimeMs",
+    "status",
+]);
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
+ * @internal
+ */
+class BaseClient {
+    constructor(configuration, performanceClient) {
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
         // Set the network interface
         this.networkClient = this.config.networkInterface;
         // Set the NetworkManager
@@ -3923,623 +4151,51 @@ class BaseClient {
                     headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;
                     break;
             }
-        }
-        return headers;
-    }
-    /**
-     * Http post to token endpoint
-     * @param tokenEndpoint
-     * @param queryString
-     * @param headers
-     * @param thumbprint
-     */
-    async executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint) {
-        const response = await this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers });
-        if (this.config.serverTelemetryManager &&
-            response.status < 500 &&
-            response.status !== 429) {
-            // Telemetry data successfully logged by server, clear Telemetry cache
-            this.config.serverTelemetryManager.clearTelemetryCache();
-        }
-        return response;
-    }
-    /**
-     * Updates the authority object of the client. Endpoint discovery must be completed.
-     * @param updatedAuthority
-     */
-    updateAuthority(updatedAuthority) {
-        if (!updatedAuthority.discoveryComplete()) {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Updated authority has not completed endpoint discovery.");
-        }
-        this.authority = updatedAuthority;
-    }
-    /**
-     * Creates query string for the /token request
-     * @param request
-     */
-    createTokenQueryParameters(request) {
-        const parameterBuilder = new RequestParameterBuilder();
-        if (request.tokenQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);
-        }
-        return parameterBuilder.createQueryString();
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Base type for credentials to be stored in the cache: eg: ACCESS_TOKEN, ID_TOKEN etc
- *
- * Key:Value Schema:
- *
- * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      familyId: Family ID identifier, usually only used for refresh tokens
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
- *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
- *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
- * }
- */
-class CredentialEntity {
-    /**
-     * Generate Account Id key component as per the schema: <home_account_id>-<environment>
-     */
-    generateAccountId() {
-        return CredentialEntity.generateAccountIdForCacheKey(this.homeAccountId, this.environment);
-    }
-    /**
-     * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
-     */
-    generateCredentialId() {
-        return CredentialEntity.generateCredentialIdForCacheKey(this.credentialType, this.clientId, this.realm, this.familyId);
-    }
-    /**
-     * Generate target key component as per schema: <target>
-     */
-    generateTarget() {
-        return CredentialEntity.generateTargetForCacheKey(this.target);
-    }
-    /**
-     * generates credential key
-     */
-    generateCredentialKey() {
-        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
-    }
-    /**
-     * returns the type of the cache (in this case credential)
-     */
-    generateType() {
-        switch (this.credentialType) {
-            case CredentialType.ID_TOKEN:
-                return CacheType.ID_TOKEN;
-            case CredentialType.ACCESS_TOKEN:
-            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                return CacheType.ACCESS_TOKEN;
-            case CredentialType.REFRESH_TOKEN:
-                return CacheType.REFRESH_TOKEN;
-            default: {
-                throw ClientAuthError.createUnexpectedCredentialTypeError();
-            }
-        }
-    }
-    /**
-     * generates credential key
-     * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
-     */
-    static generateCredentialCacheKey(homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
-        const credentialKey = [
-            this.generateAccountIdForCacheKey(homeAccountId, environment),
-            this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-            this.generateTargetForCacheKey(target),
-            this.generateClaimsHashForCacheKey(requestedClaimsHash),
-            this.generateSchemeForCacheKey(tokenType),
-        ];
-        return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    }
-    /**
-     * generates Account Id for keys
-     * @param homeAccountId
-     * @param environment
-     */
-    static generateAccountIdForCacheKey(homeAccountId, environment) {
-        const accountId = [homeAccountId, environment];
-        return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    }
-    /**
-     * Generates Credential Id for keys
-     * @param credentialType
-     * @param realm
-     * @param clientId
-     * @param familyId
-     */
-    static generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId) {
-        const clientOrFamilyId = credentialType === CredentialType.REFRESH_TOKEN
-            ? familyId || clientId
-            : clientId;
-        const credentialId = [
-            credentialType,
-            clientOrFamilyId,
-            realm || Constants.EMPTY_STRING,
-        ];
-        return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    }
-    /**
-     * Generate target key component as per schema: <target>
-     */
-    static generateTargetForCacheKey(scopes) {
-        return (scopes || Constants.EMPTY_STRING).toLowerCase();
-    }
-    /**
-     * Generate requested claims key component as per schema: <requestedClaims>
-     */
-    static generateClaimsHashForCacheKey(requestedClaimsHash) {
-        return (requestedClaimsHash || Constants.EMPTY_STRING).toLowerCase();
-    }
-    /**
-     * Generate scheme key componenet as per schema: <scheme>
-     */
-    static generateSchemeForCacheKey(tokenType) {
-        /*
-         * PoP Tokens and SSH certs include scheme in cache key
-         * Cast to lowercase to handle "bearer" from ADFS
-         */
-        return tokenType &&
-            tokenType.toLowerCase() !==
-                AuthenticationScheme.BEARER.toLowerCase()
-            ? tokenType.toLowerCase()
-            : Constants.EMPTY_STRING;
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * ID_TOKEN Cache
- *
- * Key:Value Schema:
- *
- * Key Example: uid.utid-login.microsoftonline.com-idtoken-clientId-contoso.com-
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      realm: Full tenant or organizational identifier that the account belongs to
- * }
- */
-class IdTokenEntity extends CredentialEntity {
-    /**
-     * Create IdTokenEntity
-     * @param homeAccountId
-     * @param authenticationResult
-     * @param clientId
-     * @param authority
-     */
-    static createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
-        const idTokenEntity = new IdTokenEntity();
-        idTokenEntity.credentialType = CredentialType.ID_TOKEN;
-        idTokenEntity.homeAccountId = homeAccountId;
-        idTokenEntity.environment = environment;
-        idTokenEntity.clientId = clientId;
-        idTokenEntity.secret = idToken;
-        idTokenEntity.realm = tenantId;
-        return idTokenEntity;
-    }
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isIdTokenEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("credentialType") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("secret") &&
-            entity["credentialType"] === CredentialType.ID_TOKEN);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Utility class which exposes functions for managing date and time operations.
- */
-class TimeUtils {
-    /**
-     * return the current time in Unix time (seconds).
-     */
-    static nowSeconds() {
-        // Date.getTime() returns in milliseconds.
-        return Math.round(new Date().getTime() / 1000.0);
-    }
-    /**
-     * check if a token is expired based on given UTC time in seconds.
-     * @param expiresOn
-     */
-    static isTokenExpired(expiresOn, offset) {
-        // check for access token expiry
-        const expirationSec = Number(expiresOn) || 0;
-        const offsetCurrentTimeSec = TimeUtils.nowSeconds() + offset;
-        // If current time + offset is greater than token expiration time, then token is expired.
-        return offsetCurrentTimeSec > expirationSec;
-    }
-    /**
-     * If the current time is earlier than the time that a token was cached at, we must discard the token
-     * i.e. The system clock was turned back after acquiring the cached token
-     * @param cachedAt
-     * @param offset
-     */
-    static wasClockTurnedBack(cachedAt) {
-        const cachedAtSec = Number(cachedAt);
-        return cachedAtSec > TimeUtils.nowSeconds();
-    }
-    /**
-     * Waits for t number of milliseconds
-     * @param t number
-     * @param value T
-     */
-    static delay(t, value) {
-        return new Promise((resolve) => setTimeout(() => resolve(value), t));
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * ACCESS_TOKEN Credential Type
- *
- * Key:Value Schema:
- *
- * Key Example: uid.utid-login.microsoftonline.com-accesstoken-clientId-contoso.com-user.read
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      familyId: Family ID identifier, usually only used for refresh tokens
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      cachedAt: Absolute device time when entry was created in the cache.
- *      expiresOn: Token expiry time, calculated based on current UTC time in seconds. Represented as a string.
- *      extendedExpiresOn: Additional extended expiry time until when token is valid in case of server-side outage. Represented as string in UTC seconds.
- *      keyId: used for POP and SSH tokenTypes
- *      tokenType: Type of the token issued. Usually "Bearer"
- * }
- */
-class AccessTokenEntity extends CredentialEntity {
-    /**
-     * Create AccessTokenEntity
-     * @param homeAccountId
-     * @param environment
-     * @param accessToken
-     * @param clientId
-     * @param tenantId
-     * @param scopes
-     * @param expiresOn
-     * @param extExpiresOn
-     */
-    static createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, userAssertionHash, keyId, requestedClaims, requestedClaimsHash) {
-        const atEntity = new AccessTokenEntity();
-        atEntity.homeAccountId = homeAccountId;
-        atEntity.credentialType = CredentialType.ACCESS_TOKEN;
-        atEntity.secret = accessToken;
-        const currentTime = TimeUtils.nowSeconds();
-        atEntity.cachedAt = currentTime.toString();
-        /*
-         * Token expiry time.
-         * This value should be  calculated based on the current UTC time measured locally and the value  expires_in Represented as a string in JSON.
-         */
-        atEntity.expiresOn = expiresOn.toString();
-        atEntity.extendedExpiresOn = extExpiresOn.toString();
-        if (refreshOn) {
-            atEntity.refreshOn = refreshOn.toString();
-        }
-        atEntity.environment = environment;
-        atEntity.clientId = clientId;
-        atEntity.realm = tenantId;
-        atEntity.target = scopes;
-        atEntity.userAssertionHash = userAssertionHash;
-        atEntity.tokenType = StringUtils.isEmpty(tokenType)
-            ? AuthenticationScheme.BEARER
-            : tokenType;
-        if (requestedClaims) {
-            atEntity.requestedClaims = requestedClaims;
-            atEntity.requestedClaimsHash = requestedClaimsHash;
-        }
-        /*
-         * Create Access Token With Auth Scheme instead of regular access token
-         * Cast to lower to handle "bearer" from ADFS
-         */
-        if (atEntity.tokenType?.toLowerCase() !==
-            AuthenticationScheme.BEARER.toLowerCase()) {
-            atEntity.credentialType =
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-            switch (atEntity.tokenType) {
-                case AuthenticationScheme.POP:
-                    // Make sure keyId is present and add it to credential
-                    const tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-                    if (!tokenClaims?.cnf?.kid) {
-                        throw ClientAuthError.createTokenClaimsRequiredError();
-                    }
-                    atEntity.keyId = tokenClaims.cnf.kid;
-                    break;
-                case AuthenticationScheme.SSH:
-                    atEntity.keyId = keyId;
-            }
-        }
-        return atEntity;
-    }
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isAccessTokenEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("credentialType") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("secret") &&
-            entity.hasOwnProperty("target") &&
-            (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
-                entity["credentialType"] ===
-                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * REFRESH_TOKEN Cache
- *
- * Key:Value Schema:
- *
- * Key Example: uid.utid-login.microsoftonline.com-refreshtoken-clientId--
- *
- * Value:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      familyId: Family ID identifier, '1' represents Microsoft Family
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- * }
- */
-class RefreshTokenEntity extends CredentialEntity {
-    /**
-     * Create RefreshTokenEntity
-     * @param homeAccountId
-     * @param authenticationResult
-     * @param clientId
-     * @param authority
-     */
-    static createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash) {
-        const rtEntity = new RefreshTokenEntity();
-        rtEntity.clientId = clientId;
-        rtEntity.credentialType = CredentialType.REFRESH_TOKEN;
-        rtEntity.environment = environment;
-        rtEntity.homeAccountId = homeAccountId;
-        rtEntity.secret = refreshToken;
-        rtEntity.userAssertionHash = userAssertionHash;
-        if (familyId)
-            rtEntity.familyId = familyId;
-        return rtEntity;
-    }
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isRefreshTokenEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("credentialType") &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("secret") &&
-            entity["credentialType"] === CredentialType.REFRESH_TOKEN);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
- */
-const InteractionRequiredServerErrorMessage = [
-    "interaction_required",
-    "consent_required",
-    "login_required",
-];
-const InteractionRequiredAuthSubErrorMessage = [
-    "message_only",
-    "additional_action",
-    "basic_action",
-    "user_password_expired",
-    "consent_required",
-];
-/**
- * Interaction required errors defined by the SDK
- */
-const InteractionRequiredAuthErrorMessage = {
-    noTokensFoundError: {
-        code: "no_tokens_found",
-        desc: "No refresh token found in the cache. Please sign-in.",
-    },
-    native_account_unavailable: {
-        code: "native_account_unavailable",
-        desc: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
-    },
-};
-/**
- * Error thrown when user interaction is required.
- */
-class InteractionRequiredAuthError extends AuthError {
-    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims) {
-        super(errorCode, errorMessage, subError);
-        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
-        this.timestamp = timestamp || Constants.EMPTY_STRING;
-        this.traceId = traceId || Constants.EMPTY_STRING;
-        this.correlationId = correlationId || Constants.EMPTY_STRING;
-        this.claims = claims || Constants.EMPTY_STRING;
-        this.name = "InteractionRequiredAuthError";
-    }
-    /**
-     * Helper function used to determine if an error thrown by the server requires interaction to resolve
-     * @param errorCode
-     * @param errorString
-     * @param subError
-     */
-    static isInteractionRequiredError(errorCode, errorString, subError) {
-        const isInteractionRequiredErrorCode = !!errorCode &&
-            InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
-        const isInteractionRequiredSubError = !!subError &&
-            InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
-        const isInteractionRequiredErrorDesc = !!errorString &&
-            InteractionRequiredServerErrorMessage.some((irErrorCode) => {
-                return errorString.indexOf(irErrorCode) > -1;
-            });
-        return (isInteractionRequiredErrorCode ||
-            isInteractionRequiredErrorDesc ||
-            isInteractionRequiredSubError);
-    }
-    /**
-     * Creates an error thrown when the authorization code required for a token request is null or empty.
-     */
-    static createNoTokensFoundError() {
-        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.noTokensFoundError.code, InteractionRequiredAuthErrorMessage.noTokensFoundError.desc);
-    }
-    /**
-     * Creates an error thrown when the native broker returns ACCOUNT_UNAVAILABLE status, indicating that the account was removed and interactive sign-in is required
-     * @returns
-     */
-    static createNativeAccountUnavailableError() {
-        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.native_account_unavailable.code, InteractionRequiredAuthErrorMessage.native_account_unavailable.desc);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class CacheRecord {
-    constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
-        this.account = accountEntity || null;
-        this.idToken = idTokenEntity || null;
-        this.accessToken = accessTokenEntity || null;
-        this.refreshToken = refreshTokenEntity || null;
-        this.appMetadata = appMetadataEntity || null;
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Class which provides helpers for OAuth 2.0 protocol specific values
- */
-class ProtocolUtils {
+        }
+        return headers;
+    }
     /**
-     * Appends user state with random guid, or returns random guid.
-     * @param userState
-     * @param randomGuid
+     * Http post to token endpoint
+     * @param tokenEndpoint
+     * @param queryString
+     * @param headers
+     * @param thumbprint
      */
-    static setRequestState(cryptoObj, userState, meta) {
-        const libraryState = ProtocolUtils.generateLibraryState(cryptoObj, meta);
-        return !StringUtils.isEmpty(userState)
-            ? `${libraryState}${Constants.RESOURCE_DELIM}${userState}`
-            : libraryState;
+    async executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.BaseClientCreateTokenRequestHeaders, correlationId);
+        const response = await this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers });
+        this.performanceClient?.addFields({
+            refreshTokenSize: response.body.refresh_token?.length || 0,
+            httpVerToken: response.headers?.[HeaderNames.X_MS_HTTP_VERSION] || "",
+        }, correlationId);
+        if (this.config.serverTelemetryManager &&
+            response.status < 500 &&
+            response.status !== 429) {
+            // Telemetry data successfully logged by server, clear Telemetry cache
+            this.config.serverTelemetryManager.clearTelemetryCache();
+        }
+        return response;
     }
     /**
-     * Generates the state value used by the common library.
-     * @param randomGuid
-     * @param cryptoObj
+     * Updates the authority object of the client. Endpoint discovery must be completed.
+     * @param updatedAuthority
      */
-    static generateLibraryState(cryptoObj, meta) {
-        if (!cryptoObj) {
-            throw ClientAuthError.createNoCryptoObjectError("generateLibraryState");
-        }
-        // Create a state object containing a unique id and the timestamp of the request creation
-        const stateObj = {
-            id: cryptoObj.createNewGuid(),
-        };
-        if (meta) {
-            stateObj.meta = meta;
+    updateAuthority(updatedAuthority) {
+        if (!updatedAuthority.discoveryComplete()) {
+            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Updated authority has not completed endpoint discovery.");
         }
-        const stateString = JSON.stringify(stateObj);
-        return cryptoObj.base64Encode(stateString);
+        this.authority = updatedAuthority;
     }
     /**
-     * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
-     * @param state
-     * @param cryptoObj
+     * Creates query string for the /token request
+     * @param request
      */
-    static parseRequestState(cryptoObj, state) {
-        if (!cryptoObj) {
-            throw ClientAuthError.createNoCryptoObjectError("parseRequestState");
-        }
-        if (StringUtils.isEmpty(state)) {
-            throw ClientAuthError.createInvalidStateError(state, "Null, undefined or empty state");
-        }
-        try {
-            // Split the state between library state and user passed state and decode them separately
-            const splitState = state.split(Constants.RESOURCE_DELIM);
-            const libraryState = splitState[0];
-            const userState = splitState.length > 1
-                ? splitState.slice(1).join(Constants.RESOURCE_DELIM)
-                : Constants.EMPTY_STRING;
-            const libraryStateString = cryptoObj.base64Decode(libraryState);
-            const libraryStateObj = JSON.parse(libraryStateString);
-            return {
-                userRequestState: !StringUtils.isEmpty(userState)
-                    ? userState
-                    : Constants.EMPTY_STRING,
-                libraryState: libraryStateObj,
-            };
-        }
-        catch (e) {
-            throw ClientAuthError.createInvalidStateError(state, e);
+    createTokenQueryParameters(request) {
+        const parameterBuilder = new RequestParameterBuilder();
+        if (request.tokenQueryParameters) {
+            parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);
         }
+        return parameterBuilder.createQueryString();
     }
 }
 
@@ -4548,280 +4204,408 @@ class ProtocolUtils {
  * Licensed under the MIT License.
  */
 /**
- * Url object class which can perform various transformations on url strings.
+ * Base type for credentials to be stored in the cache: eg: ACCESS_TOKEN, ID_TOKEN etc
+ *
+ * Key:Value Schema:
+ *
+ * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
+ *
+ * Value Schema:
+ * {
+ *      homeAccountId: home account identifier for the auth scheme,
+ *      environment: entity that issued the token, represented as a full host
+ *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
+ *      clientId: client ID of the application
+ *      secret: Actual credential as a string
+ *      familyId: Family ID identifier, usually only used for refresh tokens
+ *      realm: Full tenant or organizational identifier that the account belongs to
+ *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
+ *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+ *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
+ *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
+ * }
  */
-class UrlString {
-    get urlString() {
-        return this._urlString;
+class CredentialEntity {
+    /**
+     * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+     */
+    generateAccountId() {
+        return CredentialEntity.generateAccountIdForCacheKey(this.homeAccountId, this.environment);
     }
-    constructor(url) {
-        this._urlString = url;
-        if (StringUtils.isEmpty(this._urlString)) {
-            // Throws error if url is empty
-            throw ClientConfigurationError.createUrlEmptyError();
-        }
-        if (StringUtils.isEmpty(this.getHash())) {
-            this._urlString = UrlString.canonicalizeUri(url);
-        }
+    /**
+     * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
+     */
+    generateCredentialId() {
+        return CredentialEntity.generateCredentialIdForCacheKey(this.credentialType, this.clientId, this.realm, this.familyId);
     }
     /**
-     * Ensure urls are lower case and end with a / character.
-     * @param url
+     * Generate target key component as per schema: <target>
      */
-    static canonicalizeUri(url) {
-        if (url) {
-            let lowerCaseUrl = url.toLowerCase();
-            if (StringUtils.endsWith(lowerCaseUrl, "?")) {
-                lowerCaseUrl = lowerCaseUrl.slice(0, -1);
-            }
-            else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
-                lowerCaseUrl = lowerCaseUrl.slice(0, -2);
-            }
-            if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
-                lowerCaseUrl += "/";
+    generateTarget() {
+        return CredentialEntity.generateTargetForCacheKey(this.target);
+    }
+    /**
+     * generates credential key
+     */
+    generateCredentialKey() {
+        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
+    }
+    /**
+     * returns the type of the cache (in this case credential)
+     */
+    generateType() {
+        switch (this.credentialType) {
+            case CredentialType.ID_TOKEN:
+                return CacheType.ID_TOKEN;
+            case CredentialType.ACCESS_TOKEN:
+            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
+                return CacheType.ACCESS_TOKEN;
+            case CredentialType.REFRESH_TOKEN:
+                return CacheType.REFRESH_TOKEN;
+            default: {
+                throw ClientAuthError.createUnexpectedCredentialTypeError();
             }
-            return lowerCaseUrl;
         }
-        return url;
     }
     /**
-     * Throws if urlString passed is not a valid authority URI string.
+     * generates credential key
+     * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
      */
-    validateAsUri() {
-        // Attempts to parse url for uri components
-        let components;
-        try {
-            components = this.getUrlComponents();
-        }
-        catch (e) {
-            throw ClientConfigurationError.createUrlParseError(e);
-        }
-        // Throw error if URI or path segments are not parseable.
-        if (!components.HostNameAndPort || !components.PathSegments) {
-            throw ClientConfigurationError.createUrlParseError(`Given url string: ${this.urlString}`);
-        }
-        // Throw error if uri is insecure.
-        if (!components.Protocol ||
-            components.Protocol.toLowerCase() !== "https:") {
-            throw ClientConfigurationError.createInsecureAuthorityUriError(this.urlString);
-        }
+    static generateCredentialCacheKey(homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
+        const credentialKey = [
+            this.generateAccountIdForCacheKey(homeAccountId, environment),
+            this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
+            this.generateTargetForCacheKey(target),
+            this.generateClaimsHashForCacheKey(requestedClaimsHash),
+            this.generateSchemeForCacheKey(tokenType),
+        ];
+        return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     }
     /**
-     * Given a url and a query string return the url with provided query string appended
-     * @param url
-     * @param queryString
+     * generates Account Id for keys
+     * @param homeAccountId
+     * @param environment
      */
-    static appendQueryString(url, queryString) {
-        if (StringUtils.isEmpty(queryString)) {
-            return url;
-        }
-        return url.indexOf("?") < 0
-            ? `${url}?${queryString}`
-            : `${url}&${queryString}`;
+    static generateAccountIdForCacheKey(homeAccountId, environment) {
+        const accountId = [homeAccountId, environment];
+        return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+    }
+    /**
+     * Generates Credential Id for keys
+     * @param credentialType
+     * @param realm
+     * @param clientId
+     * @param familyId
+     */
+    static generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId) {
+        const clientOrFamilyId = credentialType === CredentialType.REFRESH_TOKEN
+            ? familyId || clientId
+            : clientId;
+        const credentialId = [
+            credentialType,
+            clientOrFamilyId,
+            realm || Constants.EMPTY_STRING,
+        ];
+        return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+    }
+    /**
+     * Generate target key component as per schema: <target>
+     */
+    static generateTargetForCacheKey(scopes) {
+        return (scopes || Constants.EMPTY_STRING).toLowerCase();
+    }
+    /**
+     * Generate requested claims key component as per schema: <requestedClaims>
+     */
+    static generateClaimsHashForCacheKey(requestedClaimsHash) {
+        return (requestedClaimsHash || Constants.EMPTY_STRING).toLowerCase();
+    }
+    /**
+     * Generate scheme key componenet as per schema: <scheme>
+     */
+    static generateSchemeForCacheKey(tokenType) {
+        /*
+         * PoP Tokens and SSH certs include scheme in cache key
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        return tokenType &&
+            tokenType.toLowerCase() !==
+                AuthenticationScheme.BEARER.toLowerCase()
+            ? tokenType.toLowerCase()
+            : Constants.EMPTY_STRING;
     }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * ID_TOKEN Cache
+ *
+ * Key:Value Schema:
+ *
+ * Key Example: uid.utid-login.microsoftonline.com-idtoken-clientId-contoso.com-
+ *
+ * Value Schema:
+ * {
+ *      homeAccountId: home account identifier for the auth scheme,
+ *      environment: entity that issued the token, represented as a full host
+ *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
+ *      clientId: client ID of the application
+ *      secret: Actual credential as a string
+ *      realm: Full tenant or organizational identifier that the account belongs to
+ * }
+ */
+class IdTokenEntity extends CredentialEntity {
     /**
-     * Returns a url with the hash removed
-     * @param url
+     * Create IdTokenEntity
+     * @param homeAccountId
+     * @param authenticationResult
+     * @param clientId
+     * @param authority
      */
-    static removeHashFromUrl(url) {
-        return UrlString.canonicalizeUri(url.split("#")[0]);
+    static createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
+        const idTokenEntity = new IdTokenEntity();
+        idTokenEntity.credentialType = CredentialType.ID_TOKEN;
+        idTokenEntity.homeAccountId = homeAccountId;
+        idTokenEntity.environment = environment;
+        idTokenEntity.clientId = clientId;
+        idTokenEntity.secret = idToken;
+        idTokenEntity.realm = tenantId;
+        return idTokenEntity;
     }
     /**
-     * Given a url like https://a:b/common/d?e=f#g, and a tenantId, returns https://a:b/tenantId/d
-     * @param href The url
-     * @param tenantId The tenant id to replace
+     * Validates an entity: checks for all expected params
+     * @param entity
      */
-    replaceTenantPath(tenantId) {
-        const urlObject = this.getUrlComponents();
-        const pathArray = urlObject.PathSegments;
-        if (tenantId &&
-            pathArray.length !== 0 &&
-            (pathArray[0] === AADAuthorityConstants.COMMON ||
-                pathArray[0] === AADAuthorityConstants.ORGANIZATIONS)) {
-            pathArray[0] = tenantId;
+    static isIdTokenEntity(entity) {
+        if (!entity) {
+            return false;
         }
-        return UrlString.constructAuthorityUriFromObject(urlObject);
+        return (entity.hasOwnProperty("homeAccountId") &&
+            entity.hasOwnProperty("environment") &&
+            entity.hasOwnProperty("credentialType") &&
+            entity.hasOwnProperty("realm") &&
+            entity.hasOwnProperty("clientId") &&
+            entity.hasOwnProperty("secret") &&
+            entity["credentialType"] === CredentialType.ID_TOKEN);
     }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Utility class which exposes functions for managing date and time operations.
+ */
+class TimeUtils {
     /**
-     * Returns the anchor part(#) of the URL
+     * return the current time in Unix time (seconds).
      */
-    getHash() {
-        return UrlString.parseHash(this.urlString);
+    static nowSeconds() {
+        // Date.getTime() returns in milliseconds.
+        return Math.round(new Date().getTime() / 1000.0);
     }
     /**
-     * Parses out the components from a url string.
-     * @returns An object with the various components. Please cache this value insted of calling this multiple times on the same url.
+     * check if a token is expired based on given UTC time in seconds.
+     * @param expiresOn
      */
-    getUrlComponents() {
-        // https://gist.github.com/curtisz/11139b2cfcaef4a261e0
-        const regEx = RegExp("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?");
-        // If url string does not match regEx, we throw an error
-        const match = this.urlString.match(regEx);
-        if (!match) {
-            throw ClientConfigurationError.createUrlParseError(`Given url string: ${this.urlString}`);
-        }
-        // Url component object
-        const urlComponents = {
-            Protocol: match[1],
-            HostNameAndPort: match[4],
-            AbsolutePath: match[5],
-            QueryString: match[7],
-        };
-        let pathSegments = urlComponents.AbsolutePath.split("/");
-        pathSegments = pathSegments.filter((val) => val && val.length > 0); // remove empty elements
-        urlComponents.PathSegments = pathSegments;
-        if (!StringUtils.isEmpty(urlComponents.QueryString) &&
-            urlComponents.QueryString.endsWith("/")) {
-            urlComponents.QueryString = urlComponents.QueryString.substring(0, urlComponents.QueryString.length - 1);
-        }
-        return urlComponents;
-    }
-    static getDomainFromUrl(url) {
-        const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
-        const match = url.match(regEx);
-        if (!match) {
-            throw ClientConfigurationError.createUrlParseError(`Given url string: ${url}`);
-        }
-        return match[2];
-    }
-    static getAbsoluteUrl(relativeUrl, baseUrl) {
-        if (relativeUrl[0] === Constants.FORWARD_SLASH) {
-            const url = new UrlString(baseUrl);
-            const baseComponents = url.getUrlComponents();
-            return (baseComponents.Protocol +
-                "//" +
-                baseComponents.HostNameAndPort +
-                relativeUrl);
-        }
-        return relativeUrl;
+    static isTokenExpired(expiresOn, offset) {
+        // check for access token expiry
+        const expirationSec = Number(expiresOn) || 0;
+        const offsetCurrentTimeSec = TimeUtils.nowSeconds() + offset;
+        // If current time + offset is greater than token expiration time, then token is expired.
+        return offsetCurrentTimeSec > expirationSec;
     }
     /**
-     * Parses hash string from given string. Returns empty string if no hash symbol is found.
-     * @param hashString
+     * If the current time is earlier than the time that a token was cached at, we must discard the token
+     * i.e. The system clock was turned back after acquiring the cached token
+     * @param cachedAt
+     * @param offset
      */
-    static parseHash(hashString) {
-        const hashIndex1 = hashString.indexOf("#");
-        const hashIndex2 = hashString.indexOf("#/");
-        if (hashIndex2 > -1) {
-            return hashString.substring(hashIndex2 + 2);
-        }
-        else if (hashIndex1 > -1) {
-            return hashString.substring(hashIndex1 + 1);
-        }
-        return Constants.EMPTY_STRING;
+    static wasClockTurnedBack(cachedAt) {
+        const cachedAtSec = Number(cachedAt);
+        return cachedAtSec > TimeUtils.nowSeconds();
     }
     /**
-     * Parses query string from given string. Returns empty string if no query symbol is found.
-     * @param queryString
+     * Waits for t number of milliseconds
+     * @param t number
+     * @param value T
      */
-    static parseQueryString(queryString) {
-        const queryIndex1 = queryString.indexOf("?");
-        const queryIndex2 = queryString.indexOf("/?");
-        if (queryIndex2 > -1) {
-            return queryString.substring(queryIndex2 + 2);
-        }
-        else if (queryIndex1 > -1) {
-            return queryString.substring(queryIndex1 + 1);
-        }
-        return Constants.EMPTY_STRING;
+    static delay(t, value) {
+        return new Promise((resolve) => setTimeout(() => resolve(value), t));
     }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * ACCESS_TOKEN Credential Type
+ *
+ * Key:Value Schema:
+ *
+ * Key Example: uid.utid-login.microsoftonline.com-accesstoken-clientId-contoso.com-user.read
+ *
+ * Value Schema:
+ * {
+ *      homeAccountId: home account identifier for the auth scheme,
+ *      environment: entity that issued the token, represented as a full host
+ *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
+ *      clientId: client ID of the application
+ *      secret: Actual credential as a string
+ *      familyId: Family ID identifier, usually only used for refresh tokens
+ *      realm: Full tenant or organizational identifier that the account belongs to
+ *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
+ *      cachedAt: Absolute device time when entry was created in the cache.
+ *      expiresOn: Token expiry time, calculated based on current UTC time in seconds. Represented as a string.
+ *      extendedExpiresOn: Additional extended expiry time until when token is valid in case of server-side outage. Represented as string in UTC seconds.
+ *      keyId: used for POP and SSH tokenTypes
+ *      tokenType: Type of the token issued. Usually "Bearer"
+ * }
+ */
+class AccessTokenEntity extends CredentialEntity {
     /**
-     * Parses query server response string from given string.
-     * Extract hash between '?code=' and '#' if trailing '# is present.
-     * Returns empty string if no query symbol is found.
-     * @param queryString
+     * Create AccessTokenEntity
+     * @param homeAccountId
+     * @param environment
+     * @param accessToken
+     * @param clientId
+     * @param tenantId
+     * @param scopes
+     * @param expiresOn
+     * @param extExpiresOn
      */
-    static parseQueryServerResponse(queryString) {
-        const queryIndex1 = queryString.indexOf("?code");
-        const queryIndex2 = queryString.indexOf("/?code");
-        const hashIndex = queryString.indexOf("#");
-        if (queryIndex2 > -1 && hashIndex > -1) {
-            return queryString.substring(queryIndex2 + 2, hashIndex);
-        }
-        else if (queryIndex2 > -1) {
-            return queryString.substring(queryIndex2 + 2);
-        }
-        else if (queryIndex1 > -1 && hashIndex > -1) {
-            return queryString.substring(queryIndex1 + 1, hashIndex);
-        }
-        else if (queryIndex1 > -1) {
-            return queryString.substring(queryIndex1 + 1);
+    static createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, userAssertionHash, keyId, requestedClaims, requestedClaimsHash) {
+        const atEntity = new AccessTokenEntity();
+        atEntity.homeAccountId = homeAccountId;
+        atEntity.credentialType = CredentialType.ACCESS_TOKEN;
+        atEntity.secret = accessToken;
+        const currentTime = TimeUtils.nowSeconds();
+        atEntity.cachedAt = currentTime.toString();
+        /*
+         * Token expiry time.
+         * This value should be  calculated based on the current UTC time measured locally and the value  expires_in Represented as a string in JSON.
+         */
+        atEntity.expiresOn = expiresOn.toString();
+        atEntity.extendedExpiresOn = extExpiresOn.toString();
+        if (refreshOn) {
+            atEntity.refreshOn = refreshOn.toString();
         }
-        return Constants.EMPTY_STRING;
-    }
-    static constructAuthorityUriFromObject(urlObject) {
-        return new UrlString(urlObject.Protocol +
-            "//" +
-            urlObject.HostNameAndPort +
-            "/" +
-            urlObject.PathSegments.join("/"));
-    }
-    /**
-     * Returns URL hash as server auth code response object.
-     */
-    static getDeserializedHash(hash) {
-        // Check if given hash is empty
-        if (StringUtils.isEmpty(hash)) {
-            return {};
+        atEntity.environment = environment;
+        atEntity.clientId = clientId;
+        atEntity.realm = tenantId;
+        atEntity.target = scopes;
+        atEntity.userAssertionHash = userAssertionHash;
+        atEntity.tokenType = tokenType || AuthenticationScheme.BEARER;
+        if (requestedClaims) {
+            atEntity.requestedClaims = requestedClaims;
+            atEntity.requestedClaimsHash = requestedClaimsHash;
         }
-        // Strip the # symbol if present
-        const parsedHash = UrlString.parseHash(hash);
-        // If # symbol was not present, above will return empty string, so give original hash value
-        const deserializedHash = StringUtils.queryStringToObject(StringUtils.isEmpty(parsedHash) ? hash : parsedHash);
-        // Check if deserialization didn't work
-        if (!deserializedHash) {
-            throw ClientAuthError.createHashNotDeserializedError(JSON.stringify(deserializedHash));
+        /*
+         * Create Access Token With Auth Scheme instead of regular access token
+         * Cast to lower to handle "bearer" from ADFS
+         */
+        if (atEntity.tokenType?.toLowerCase() !==
+            AuthenticationScheme.BEARER.toLowerCase()) {
+            atEntity.credentialType =
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+            switch (atEntity.tokenType) {
+                case AuthenticationScheme.POP:
+                    // Make sure keyId is present and add it to credential
+                    const tokenClaims = extractTokenClaims(accessToken, cryptoUtils.base64Decode);
+                    if (!tokenClaims?.cnf?.kid) {
+                        throw ClientAuthError.createTokenClaimsRequiredError();
+                    }
+                    atEntity.keyId = tokenClaims.cnf.kid;
+                    break;
+                case AuthenticationScheme.SSH:
+                    atEntity.keyId = keyId;
+            }
         }
-        return deserializedHash;
+        return atEntity;
     }
     /**
-     * Returns URL query string as server auth code response object.
+     * Validates an entity: checks for all expected params
+     * @param entity
      */
-    static getDeserializedQueryString(query) {
-        // Check if given query is empty
-        if (StringUtils.isEmpty(query)) {
-            return {};
-        }
-        // Strip the ? symbol if present
-        const parsedQueryString = UrlString.parseQueryString(query);
-        // If ? symbol was not present, above will return empty string, so give original query value
-        const deserializedQueryString = StringUtils.queryStringToObject(StringUtils.isEmpty(parsedQueryString)
-            ? query
-            : parsedQueryString);
-        // Check if deserialization didn't work
-        if (!deserializedQueryString) {
-            throw ClientAuthError.createHashNotDeserializedError(JSON.stringify(deserializedQueryString));
+    static isAccessTokenEntity(entity) {
+        if (!entity) {
+            return false;
         }
-        return deserializedQueryString;
+        return (entity.hasOwnProperty("homeAccountId") &&
+            entity.hasOwnProperty("environment") &&
+            entity.hasOwnProperty("credentialType") &&
+            entity.hasOwnProperty("realm") &&
+            entity.hasOwnProperty("clientId") &&
+            entity.hasOwnProperty("secret") &&
+            entity.hasOwnProperty("target") &&
+            (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
+                entity["credentialType"] ===
+                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
     }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * REFRESH_TOKEN Cache
+ *
+ * Key:Value Schema:
+ *
+ * Key Example: uid.utid-login.microsoftonline.com-refreshtoken-clientId--
+ *
+ * Value:
+ * {
+ *      homeAccountId: home account identifier for the auth scheme,
+ *      environment: entity that issued the token, represented as a full host
+ *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
+ *      clientId: client ID of the application
+ *      secret: Actual credential as a string
+ *      familyId: Family ID identifier, '1' represents Microsoft Family
+ *      realm: Full tenant or organizational identifier that the account belongs to
+ *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
+ * }
+ */
+class RefreshTokenEntity extends CredentialEntity {
     /**
-     * Returns either deserialized query string or deserialized hash, depending on the serverResponseType
-     * as a server auth code response object.
+     * Create RefreshTokenEntity
+     * @param homeAccountId
+     * @param authenticationResult
+     * @param clientId
+     * @param authority
      */
-    static getDeserializedCodeResponse(serverResponseType, hashFragment) {
-        const hashUrlString = new UrlString(hashFragment);
-        let serverParams;
-        if (serverResponseType === ServerResponseType.QUERY) {
-            serverParams = UrlString.getDeserializedQueryString(hashFragment);
-        }
-        else {
-            serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
-        }
-        return serverParams;
+    static createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash) {
+        const rtEntity = new RefreshTokenEntity();
+        rtEntity.clientId = clientId;
+        rtEntity.credentialType = CredentialType.REFRESH_TOKEN;
+        rtEntity.environment = environment;
+        rtEntity.homeAccountId = homeAccountId;
+        rtEntity.secret = refreshToken;
+        rtEntity.userAssertionHash = userAssertionHash;
+        if (familyId)
+            rtEntity.familyId = familyId;
+        return rtEntity;
     }
     /**
-     * Check if the hash of the URL string contains known properties
+     * Validates an entity: checks for all expected params
+     * @param entity
      */
-    static hashContainsKnownProperties(hash) {
-        if (StringUtils.isEmpty(hash) || hash.indexOf("=") < 0) {
-            // Hash doesn't contain key/value pairs
+    static isRefreshTokenEntity(entity) {
+        if (!entity) {
             return false;
         }
-        const parameters = UrlString.getDeserializedHash(hash);
-        return !!(parameters.code ||
-            parameters.error_description ||
-            parameters.error ||
-            parameters.state);
+        return (entity.hasOwnProperty("homeAccountId") &&
+            entity.hasOwnProperty("environment") &&
+            entity.hasOwnProperty("credentialType") &&
+            entity.hasOwnProperty("clientId") &&
+            entity.hasOwnProperty("secret") &&
+            entity["credentialType"] === CredentialType.REFRESH_TOKEN);
     }
 }
 
@@ -4830,227 +4614,444 @@ class UrlString {
  * Licensed under the MIT License.
  */
 /**
- * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
- *
- * @export
- * @enum {number}
+ * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
  */
-const PerformanceEvents = {
-    /**
-     * acquireTokenByCode API (msal-browser and msal-node).
-     * Used to acquire tokens by trading an authorization code against the token endpoint.
-     */
-    AcquireTokenByCode: "acquireTokenByCode",
-    /**
-     * acquireTokenByRefreshToken API (msal-browser and msal-node).
-     * Used to renew an access token using a refresh token against the token endpoint.
-     */
-    AcquireTokenByRefreshToken: "acquireTokenByRefreshToken",
-    /**
-     * acquireTokenSilent API (msal-browser and msal-node).
-     * Used to silently acquire a new access token (from the cache or the network).
-     */
-    AcquireTokenSilent: "acquireTokenSilent",
-    /**
-     * acquireTokenSilentAsync (msal-browser).
-     * Internal API for acquireTokenSilent.
-     */
-    AcquireTokenSilentAsync: "acquireTokenSilentAsync",
-    /**
-     * acquireTokenPopup (msal-browser).
-     * Used to acquire a new access token interactively through pop ups
-     */
-    AcquireTokenPopup: "acquireTokenPopup",
-    /**
-     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
-     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
-     */
-    CryptoOptsGetPublicKeyThumbprint: "cryptoOptsGetPublicKeyThumbprint",
-    /**
-     * signJwt API in CryptoOpts class (msal-browser).
-     * Used to signed a pop token.
-     */
-    CryptoOptsSignJwt: "cryptoOptsSignJwt",
-    /**
-     * acquireToken API in the SilentCacheClient class (msal-browser).
-     * Used to read access tokens from the cache.
-     */
-    SilentCacheClientAcquireToken: "silentCacheClientAcquireToken",
-    /**
-     * acquireToken API in the SilentIframeClient class (msal-browser).
-     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
-     */
-    SilentIframeClientAcquireToken: "silentIframeClientAcquireToken",
-    /**
-     * acquireToken API in SilentRereshClient (msal-browser).
-     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
-     */
-    SilentRefreshClientAcquireToken: "silentRefreshClientAcquireToken",
-    /**
-     * ssoSilent API (msal-browser).
-     * Used to silently acquire an authorization code and set of tokens using a hidden iframe.
-     */
-    SsoSilent: "ssoSilent",
-    /**
-     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
-     * Used to load authority metadata for a request.
-     */
-    StandardInteractionClientGetDiscoveredAuthority: "standardInteractionClientGetDiscoveredAuthority",
-    /**
-     * acquireToken APIs in msal-browser.
-     * Used to make an /authorize endpoint call with native brokering enabled.
-     */
-    FetchAccountIdWithNativeBroker: "fetchAccountIdWithNativeBroker",
-    /**
-     * acquireToken API in NativeInteractionClient class (msal-browser).
-     * Used to acquire a token from Native component when native brokering is enabled.
-     */
-    NativeInteractionClientAcquireToken: "nativeInteractionClientAcquireToken",
-    /**
-     * Time spent creating default headers for requests to token endpoint
-     */
-    BaseClientCreateTokenRequestHeaders: "baseClientCreateTokenRequestHeaders",
-    /**
-     * Used to measure the time taken for completing embedded-broker handshake (PW-Broker).
-     */
-    BrokerHandhshake: "brokerHandshake",
-    /**
-     * acquireTokenByRefreshToken API in BrokerClientApplication (PW-Broker) .
-     */
-    AcquireTokenByRefreshTokenInBroker: "acquireTokenByRefreshTokenInBroker",
+const InteractionRequiredServerErrorMessage = [
+    "interaction_required",
+    "consent_required",
+    "login_required",
+];
+const InteractionRequiredAuthSubErrorMessage = [
+    "message_only",
+    "additional_action",
+    "basic_action",
+    "user_password_expired",
+    "consent_required",
+];
+/**
+ * Interaction required errors defined by the SDK
+ */
+const InteractionRequiredAuthErrorMessage = {
+    noTokensFoundError: {
+        code: "no_tokens_found",
+        desc: "No refresh token found in the cache. Please sign-in.",
+    },
+    native_account_unavailable: {
+        code: "native_account_unavailable",
+        desc: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
+    },
+};
+/**
+ * Error thrown when user interaction is required.
+ */
+class InteractionRequiredAuthError extends AuthError {
+    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims) {
+        super(errorCode, errorMessage, subError);
+        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
+        this.timestamp = timestamp || Constants.EMPTY_STRING;
+        this.traceId = traceId || Constants.EMPTY_STRING;
+        this.correlationId = correlationId || Constants.EMPTY_STRING;
+        this.claims = claims || Constants.EMPTY_STRING;
+        this.name = "InteractionRequiredAuthError";
+    }
     /**
-     * Time taken for token acquisition by broker
+     * Helper function used to determine if an error thrown by the server requires interaction to resolve
+     * @param errorCode
+     * @param errorString
+     * @param subError
      */
-    AcquireTokenByBroker: "acquireTokenByBroker",
+    static isInteractionRequiredError(errorCode, errorString, subError) {
+        const isInteractionRequiredErrorCode = !!errorCode &&
+            InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
+        const isInteractionRequiredSubError = !!subError &&
+            InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
+        const isInteractionRequiredErrorDesc = !!errorString &&
+            InteractionRequiredServerErrorMessage.some((irErrorCode) => {
+                return errorString.indexOf(irErrorCode) > -1;
+            });
+        return (isInteractionRequiredErrorCode ||
+            isInteractionRequiredErrorDesc ||
+            isInteractionRequiredSubError);
+    }
     /**
-     * Time spent on the network for refresh token acquisition
+     * Creates an error thrown when the authorization code required for a token request is null or empty.
      */
-    RefreshTokenClientExecuteTokenRequest: "refreshTokenClientExecuteTokenRequest",
+    static createNoTokensFoundError() {
+        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.noTokensFoundError.code, InteractionRequiredAuthErrorMessage.noTokensFoundError.desc);
+    }
     /**
-     * Time taken for acquiring refresh token , records RT size
+     * Creates an error thrown when the native broker returns ACCOUNT_UNAVAILABLE status, indicating that the account was removed and interactive sign-in is required
+     * @returns
      */
-    RefreshTokenClientAcquireToken: "refreshTokenClientAcquireToken",
+    static createNativeAccountUnavailableError() {
+        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.native_account_unavailable.code, InteractionRequiredAuthErrorMessage.native_account_unavailable.desc);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class CacheRecord {
+    constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
+        this.account = accountEntity || null;
+        this.idToken = idTokenEntity || null;
+        this.accessToken = accessTokenEntity || null;
+        this.refreshToken = refreshTokenEntity || null;
+        this.appMetadata = appMetadataEntity || null;
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Class which provides helpers for OAuth 2.0 protocol specific values
+ */
+class ProtocolUtils {
     /**
-     * Time taken for acquiring cached refresh token
+     * Appends user state with random guid, or returns random guid.
+     * @param userState
+     * @param randomGuid
      */
-    RefreshTokenClientAcquireTokenWithCachedRefreshToken: "refreshTokenClientAcquireTokenWithCachedRefreshToken",
+    static setRequestState(cryptoObj, userState, meta) {
+        const libraryState = ProtocolUtils.generateLibraryState(cryptoObj, meta);
+        return userState
+            ? `${libraryState}${Constants.RESOURCE_DELIM}${userState}`
+            : libraryState;
+    }
     /**
-     * acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
+     * Generates the state value used by the common library.
+     * @param randomGuid
+     * @param cryptoObj
      */
-    RefreshTokenClientAcquireTokenByRefreshToken: "refreshTokenClientAcquireTokenByRefreshToken",
+    static generateLibraryState(cryptoObj, meta) {
+        if (!cryptoObj) {
+            throw ClientAuthError.createNoCryptoObjectError("generateLibraryState");
+        }
+        // Create a state object containing a unique id and the timestamp of the request creation
+        const stateObj = {
+            id: cryptoObj.createNewGuid(),
+        };
+        if (meta) {
+            stateObj.meta = meta;
+        }
+        const stateString = JSON.stringify(stateObj);
+        return cryptoObj.base64Encode(stateString);
+    }
     /**
-     * Helper function to create token request body in RefreshTokenClient (msal-common).
+     * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
+     * @param state
+     * @param cryptoObj
      */
-    RefreshTokenClientCreateTokenRequestBody: "refreshTokenClientCreateTokenRequestBody",
+    static parseRequestState(cryptoObj, state) {
+        if (!cryptoObj) {
+            throw ClientAuthError.createNoCryptoObjectError("parseRequestState");
+        }
+        if (!state) {
+            throw ClientAuthError.createInvalidStateError(state, "Null, undefined or empty state");
+        }
+        try {
+            // Split the state between library state and user passed state and decode them separately
+            const splitState = state.split(Constants.RESOURCE_DELIM);
+            const libraryState = splitState[0];
+            const userState = splitState.length > 1
+                ? splitState.slice(1).join(Constants.RESOURCE_DELIM)
+                : Constants.EMPTY_STRING;
+            const libraryStateString = cryptoObj.base64Decode(libraryState);
+            const libraryStateObj = JSON.parse(libraryStateString);
+            return {
+                userRequestState: userState || Constants.EMPTY_STRING,
+                libraryState: libraryStateObj,
+            };
+        }
+        catch (e) {
+            throw ClientAuthError.createInvalidStateError(state, e);
+        }
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Url object class which can perform various transformations on url strings.
+ */
+class UrlString {
+    get urlString() {
+        return this._urlString;
+    }
+    constructor(url) {
+        this._urlString = url;
+        if (!this._urlString) {
+            // Throws error if url is empty
+            throw ClientConfigurationError.createUrlEmptyError();
+        }
+        if (!this.getHash()) {
+            this._urlString = UrlString.canonicalizeUri(url);
+        }
+    }
     /**
-     * acquireTokenFromCache (msal-browser).
-     * Internal API for acquiring token from cache
+     * Ensure urls are lower case and end with a / character.
+     * @param url
      */
-    AcquireTokenFromCache: "acquireTokenFromCache",
+    static canonicalizeUri(url) {
+        if (url) {
+            let lowerCaseUrl = url.toLowerCase();
+            if (StringUtils.endsWith(lowerCaseUrl, "?")) {
+                lowerCaseUrl = lowerCaseUrl.slice(0, -1);
+            }
+            else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
+                lowerCaseUrl = lowerCaseUrl.slice(0, -2);
+            }
+            if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
+                lowerCaseUrl += "/";
+            }
+            return lowerCaseUrl;
+        }
+        return url;
+    }
     /**
-     * acquireTokenBySilentIframe (msal-browser).
-     * Internal API for acquiring token by silent Iframe
+     * Throws if urlString passed is not a valid authority URI string.
      */
-    AcquireTokenBySilentIframe: "acquireTokenBySilentIframe",
+    validateAsUri() {
+        // Attempts to parse url for uri components
+        let components;
+        try {
+            components = this.getUrlComponents();
+        }
+        catch (e) {
+            throw ClientConfigurationError.createUrlParseError(e);
+        }
+        // Throw error if URI or path segments are not parseable.
+        if (!components.HostNameAndPort || !components.PathSegments) {
+            throw ClientConfigurationError.createUrlParseError(`Given url string: ${this.urlString}`);
+        }
+        // Throw error if uri is insecure.
+        if (!components.Protocol ||
+            components.Protocol.toLowerCase() !== "https:") {
+            throw ClientConfigurationError.createInsecureAuthorityUriError(this.urlString);
+        }
+    }
     /**
-     * Internal API for initializing base request in BaseInteractionClient (msal-browser)
+     * Given a url and a query string return the url with provided query string appended
+     * @param url
+     * @param queryString
      */
-    InitializeBaseRequest: "initializeBaseRequest",
+    static appendQueryString(url, queryString) {
+        if (!queryString) {
+            return url;
+        }
+        return url.indexOf("?") < 0
+            ? `${url}?${queryString}`
+            : `${url}&${queryString}`;
+    }
     /**
-     * Internal API for initializing silent request in SilentCacheClient (msal-browser)
+     * Returns a url with the hash removed
+     * @param url
      */
-    InitializeSilentRequest: "initializeSilentRequest",
-    InitializeClientApplication: "initializeClientApplication",
+    static removeHashFromUrl(url) {
+        return UrlString.canonicalizeUri(url.split("#")[0]);
+    }
     /**
-     * Helper function in SilentIframeClient class (msal-browser).
+     * Given a url like https://a:b/common/d?e=f#g, and a tenantId, returns https://a:b/tenantId/d
+     * @param href The url
+     * @param tenantId The tenant id to replace
      */
-    SilentIframeClientTokenHelper: "silentIframeClientTokenHelper",
+    replaceTenantPath(tenantId) {
+        const urlObject = this.getUrlComponents();
+        const pathArray = urlObject.PathSegments;
+        if (tenantId &&
+            pathArray.length !== 0 &&
+            (pathArray[0] === AADAuthorityConstants.COMMON ||
+                pathArray[0] === AADAuthorityConstants.ORGANIZATIONS)) {
+            pathArray[0] = tenantId;
+        }
+        return UrlString.constructAuthorityUriFromObject(urlObject);
+    }
     /**
-     * SilentHandler
+     * Returns the anchor part(#) of the URL
      */
-    SilentHandlerInitiateAuthRequest: "silentHandlerInitiateAuthRequest",
-    SilentHandlerMonitorIframeForHash: "silentHandlerMonitorIframeForHash",
-    SilentHandlerLoadFrame: "silentHandlerLoadFrame",
+    getHash() {
+        return UrlString.parseHash(this.urlString);
+    }
     /**
-     * Helper functions in StandardInteractionClient class (msal-browser)
+     * Parses out the components from a url string.
+     * @returns An object with the various components. Please cache this value insted of calling this multiple times on the same url.
      */
-    StandardInteractionClientCreateAuthCodeClient: "standardInteractionClientCreateAuthCodeClient",
-    StandardInteractionClientGetClientConfiguration: "standardInteractionClientGetClientConfiguration",
-    StandardInteractionClientInitializeAuthorizationRequest: "standardInteractionClientInitializeAuthorizationRequest",
-    StandardInteractionClientInitializeAuthorizationCodeRequest: "standardInteractionClientInitializeAuthorizationCodeRequest",
+    getUrlComponents() {
+        // https://gist.github.com/curtisz/11139b2cfcaef4a261e0
+        const regEx = RegExp("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?");
+        // If url string does not match regEx, we throw an error
+        const match = this.urlString.match(regEx);
+        if (!match) {
+            throw ClientConfigurationError.createUrlParseError(`Given url string: ${this.urlString}`);
+        }
+        // Url component object
+        const urlComponents = {
+            Protocol: match[1],
+            HostNameAndPort: match[4],
+            AbsolutePath: match[5],
+            QueryString: match[7],
+        };
+        let pathSegments = urlComponents.AbsolutePath.split("/");
+        pathSegments = pathSegments.filter((val) => val && val.length > 0); // remove empty elements
+        urlComponents.PathSegments = pathSegments;
+        if (urlComponents.QueryString &&
+            urlComponents.QueryString.endsWith("/")) {
+            urlComponents.QueryString = urlComponents.QueryString.substring(0, urlComponents.QueryString.length - 1);
+        }
+        return urlComponents;
+    }
+    static getDomainFromUrl(url) {
+        const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
+        const match = url.match(regEx);
+        if (!match) {
+            throw ClientConfigurationError.createUrlParseError(`Given url string: ${url}`);
+        }
+        return match[2];
+    }
+    static getAbsoluteUrl(relativeUrl, baseUrl) {
+        if (relativeUrl[0] === Constants.FORWARD_SLASH) {
+            const url = new UrlString(baseUrl);
+            const baseComponents = url.getUrlComponents();
+            return (baseComponents.Protocol +
+                "//" +
+                baseComponents.HostNameAndPort +
+                relativeUrl);
+        }
+        return relativeUrl;
+    }
     /**
-     * getAuthCodeUrl API (msal-browser and msal-node).
+     * Parses hash string from given string. Returns empty string if no hash symbol is found.
+     * @param hashString
      */
-    GetAuthCodeUrl: "getAuthCodeUrl",
+    static parseHash(hashString) {
+        const hashIndex1 = hashString.indexOf("#");
+        const hashIndex2 = hashString.indexOf("#/");
+        if (hashIndex2 > -1) {
+            return hashString.substring(hashIndex2 + 2);
+        }
+        else if (hashIndex1 > -1) {
+            return hashString.substring(hashIndex1 + 1);
+        }
+        return Constants.EMPTY_STRING;
+    }
     /**
-     * Functions from InteractionHandler (msal-browser)
+     * Parses query string from given string. Returns empty string if no query symbol is found.
+     * @param queryString
      */
-    HandleCodeResponseFromServer: "handleCodeResponseFromServer",
-    HandleCodeResponseFromHash: "handleCodeResponseFromHash",
-    UpdateTokenEndpointAuthority: "updateTokenEndpointAuthority",
+    static parseQueryString(queryString) {
+        const queryIndex1 = queryString.indexOf("?");
+        const queryIndex2 = queryString.indexOf("/?");
+        if (queryIndex2 > -1) {
+            return queryString.substring(queryIndex2 + 2);
+        }
+        else if (queryIndex1 > -1) {
+            return queryString.substring(queryIndex1 + 1);
+        }
+        return Constants.EMPTY_STRING;
+    }
     /**
-     * APIs in Authorization Code Client (msal-common)
+     * Parses query server response string from given string.
+     * Extract hash between '?code=' and '#' if trailing '# is present.
+     * Returns empty string if no query symbol is found.
+     * @param queryString
      */
-    AuthClientAcquireToken: "authClientAcquireToken",
-    AuthClientExecuteTokenRequest: "authClientExecuteTokenRequest",
-    AuthClientCreateTokenRequestBody: "authClientCreateTokenRequestBody",
-    AuthClientCreateQueryString: "authClientCreateQueryString",
+    static parseQueryServerResponse(queryString) {
+        const queryIndex1 = queryString.indexOf("?code");
+        const queryIndex2 = queryString.indexOf("/?code");
+        const hashIndex = queryString.indexOf("#");
+        if (queryIndex2 > -1 && hashIndex > -1) {
+            return queryString.substring(queryIndex2 + 2, hashIndex);
+        }
+        else if (queryIndex2 > -1) {
+            return queryString.substring(queryIndex2 + 2);
+        }
+        else if (queryIndex1 > -1 && hashIndex > -1) {
+            return queryString.substring(queryIndex1 + 1, hashIndex);
+        }
+        else if (queryIndex1 > -1) {
+            return queryString.substring(queryIndex1 + 1);
+        }
+        return Constants.EMPTY_STRING;
+    }
+    static constructAuthorityUriFromObject(urlObject) {
+        return new UrlString(urlObject.Protocol +
+            "//" +
+            urlObject.HostNameAndPort +
+            "/" +
+            urlObject.PathSegments.join("/"));
+    }
     /**
-     * Generate functions in PopTokenGenerator (msal-common)
+     * Returns URL hash as server auth code response object.
      */
-    PopTokenGenerateCnf: "popTokenGenerateCnf",
-    PopTokenGenerateKid: "popTokenGenerateKid",
+    static getDeserializedHash(hash) {
+        // Check if given hash is empty
+        if (!hash) {
+            return {};
+        }
+        // Strip the # symbol if present
+        const parsedHash = UrlString.parseHash(hash);
+        // If # symbol was not present, above will return empty string, so give original hash value
+        const deserializedHash = StringUtils.queryStringToObject(parsedHash || hash);
+        // Check if deserialization didn't work
+        if (!deserializedHash) {
+            throw ClientAuthError.createHashNotDeserializedError(JSON.stringify(deserializedHash));
+        }
+        return deserializedHash;
+    }
     /**
-     * handleServerTokenResponse API in ResponseHandler (msal-common)
+     * Returns URL query string as server auth code response object.
      */
-    HandleServerTokenResponse: "handleServerTokenResponse",
+    static getDeserializedQueryString(query) {
+        // Check if given query is empty
+        if (!query) {
+            return {};
+        }
+        // Strip the ? symbol if present
+        const parsedQueryString = UrlString.parseQueryString(query);
+        // If ? symbol was not present, above will return empty string, so give original query value
+        const deserializedQueryString = StringUtils.queryStringToObject(parsedQueryString || query);
+        // Check if deserialization didn't work
+        if (!deserializedQueryString) {
+            throw ClientAuthError.createHashNotDeserializedError(JSON.stringify(deserializedQueryString));
+        }
+        return deserializedQueryString;
+    }
     /**
-     * Authority functions
+     * Returns either deserialized query string or deserialized hash, depending on the serverResponseType
+     * as a server auth code response object.
      */
-    AuthorityFactoryCreateDiscoveredInstance: "authorityFactoryCreateDiscoveredInstance",
-    AuthorityResolveEndpointsAsync: "authorityResolveEndpointsAsync",
-    AuthorityGetCloudDiscoveryMetadataFromNetwork: "authorityGetCloudDiscoveryMetadataFromNetwork",
-    AuthorityUpdateCloudDiscoveryMetadata: "authorityUpdateCloudDiscoveryMetadata",
-    AuthorityGetEndpointMetadataFromNetwork: "authorityGetEndpointMetadataFromNetwork",
-    AuthorityUpdateEndpointMetadata: "authorityUpdateEndpointMetadata",
-    AuthorityUpdateMetadataWithRegionalInformation: "authorityUpdateMetadataWithRegionalInformation",
+    static getDeserializedCodeResponse(serverResponseType, hashFragment) {
+        const hashUrlString = new UrlString(hashFragment);
+        let serverParams;
+        if (serverResponseType === ServerResponseType.QUERY) {
+            serverParams = UrlString.getDeserializedQueryString(hashFragment);
+        }
+        else {
+            serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
+        }
+        return serverParams;
+    }
     /**
-     * Region Discovery functions
+     * Check if the hash of the URL string contains known properties
      */
-    RegionDiscoveryDetectRegion: "regionDiscoveryDetectRegion",
-    RegionDiscoveryGetRegionFromIMDS: "regionDiscoveryGetRegionFromIMDS",
-    RegionDiscoveryGetCurrentVersion: "regionDiscoveryGetCurrentVersion",
-    AcquireTokenByCodeAsync: "acquireTokenByCodeAsync",
-    GetEndpointMetadataFromNetwork: "getEndpointMetadataFromNetwork",
-    GetCloudDiscoveryMetadataFromNetworkMeasurement: "getCloudDiscoveryMetadataFromNetworkMeasurement",
-    HandleRedirectPromiseMeasurement: "handleRedirectPromiseMeasurement",
-    UpdateCloudDiscoveryMetadataMeasurement: "updateCloudDiscoveryMetadataMeasurement",
-    UsernamePasswordClientAcquireToken: "usernamePasswordClientAcquireToken",
-    NativeMessageHandlerHandshake: "nativeMessageHandlerHandshake",
-    NativeGenerateAuthResult: "nativeGenerateAuthResult",
-};
-/**
- * State of the performance event.
- *
- * @export
- * @enum {number}
- */
-const PerformanceEventStatus = {
-    NotStarted: 0,
-    InProgress: 1,
-    Completed: 2,
-};
-const IntFields = new Set([
-    "accessTokenSize",
-    "durationMs",
-    "idTokenSize",
-    "matsSilentStatus",
-    "matsHttpStatus",
-    "refreshTokenSize",
-    "queuedTimeMs",
-    "startTimeMs",
-    "status",
-]);
+    static hashContainsKnownProperties(hash) {
+        if (!hash || hash.indexOf("=") < 0) {
+            // Hash doesn't contain key/value pairs
+            return false;
+        }
+        const parameters = UrlString.getDeserializedHash(hash);
+        return !!(parameters.code ||
+            parameters.error_description ||
+            parameters.error ||
+            parameters.state);
+    }
+}
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5060,6 +5061,7 @@ const KeyLocation = {
     SW: "sw",
     UHW: "uhw",
 };
+/** @internal */
 class PopTokenGenerator {
     constructor(cryptoUtils, performanceClient) {
         this.cryptoUtils = cryptoUtils;
@@ -5234,6 +5236,7 @@ class AppMetadataEntity {
  */
 /**
  * Class that handles response parsing.
+ * @internal
  */
 class ResponseHandler {
     constructor(clientId, cacheStorage, cryptoObj, logger, serializableCache, persistencePlugin, performanceClient) {
@@ -5290,17 +5293,37 @@ class ResponseHandler {
     /**
      * Function which validates server authorization token response.
      * @param serverResponse
+     * @param refreshAccessToken
      */
-    validateTokenResponse(serverResponse) {
+    validateTokenResponse(serverResponse, refreshAccessToken) {
         // Check for error
         if (serverResponse.error ||
             serverResponse.error_description ||
             serverResponse.suberror) {
+            const errString = `${serverResponse.error_codes} - [${serverResponse.timestamp}]: ${serverResponse.error_description} - Correlation ID: ${serverResponse.correlation_id} - Trace ID: ${serverResponse.trace_id}`;
+            const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror);
+            // check if 500 error
+            if (refreshAccessToken &&
+                serverResponse.status &&
+                serverResponse.status >= HttpStatus.SERVER_ERROR_RANGE_START &&
+                serverResponse.status <= HttpStatus.SERVER_ERROR_RANGE_END) {
+                this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed.\n${serverError}`);
+                // don't throw an exception, but alert the user via a log that the token was unable to be refreshed
+                return;
+                // check if 400 error
+            }
+            else if (refreshAccessToken &&
+                serverResponse.status &&
+                serverResponse.status >= HttpStatus.CLIENT_ERROR_RANGE_START &&
+                serverResponse.status <= HttpStatus.CLIENT_ERROR_RANGE_END) {
+                this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token.\n${serverError}`);
+                // don't throw an exception, but alert the user via a log that the token was unable to be refreshed
+                return;
+            }
             if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
                 throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || Constants.EMPTY_STRING, serverResponse.trace_id || Constants.EMPTY_STRING, serverResponse.correlation_id || Constants.EMPTY_STRING, serverResponse.claims || Constants.EMPTY_STRING);
             }
-            const errString = `${serverResponse.error_codes} - [${serverResponse.timestamp}]: ${serverResponse.error_description} - Correlation ID: ${serverResponse.correlation_id} - Trace ID: ${serverResponse.trace_id}`;
-            throw new ServerError(serverResponse.error, errString, serverResponse.suberror);
+            throw serverError;
         }
     }
     /**
@@ -5311,27 +5334,26 @@ class ResponseHandler {
     async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.HandleServerTokenResponse, serverTokenResponse.correlation_id);
         // create an idToken object (not entity)
-        let idTokenObj;
+        let idTokenClaims;
         if (serverTokenResponse.id_token) {
-            idTokenObj = new AuthToken(serverTokenResponse.id_token || Constants.EMPTY_STRING, this.cryptoObj);
+            idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || Constants.EMPTY_STRING, this.cryptoObj.base64Decode);
             // token nonce check (TODO: Add a warning if no nonce is given?)
-            if (authCodePayload &&
-                !StringUtils.isEmpty(authCodePayload.nonce)) {
-                if (idTokenObj.claims.nonce !== authCodePayload.nonce) {
+            if (authCodePayload && authCodePayload.nonce) {
+                if (idTokenClaims.nonce !== authCodePayload.nonce) {
                     throw ClientAuthError.createNonceMismatchError();
                 }
             }
             // token max_age check
             if (request.maxAge || request.maxAge === 0) {
-                const authTime = idTokenObj.claims.auth_time;
+                const authTime = idTokenClaims.auth_time;
                 if (!authTime) {
                     throw ClientAuthError.createAuthTimeNotFoundError();
                 }
-                AuthToken.checkMaxAge(authTime, request.maxAge);
+                checkMaxAge(authTime, request.maxAge);
             }
         }
         // generate homeAccountId
-        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj?.claims);
+        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
         // save the response tokens
         let requestStateObj;
         if (!!authCodePayload && !!authCodePayload.state) {
@@ -5340,7 +5362,7 @@ class ResponseHandler {
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
             serverTokenResponse.key_id || request.sshKid || undefined;
-        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload);
+        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload);
         let cacheContext;
         try {
             if (this.persistencePlugin && this.serializableCache) {
@@ -5361,7 +5383,7 @@ class ResponseHandler {
                 const account = this.cacheStorage.getAccount(key);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                    return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId);
+                    return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
             await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache);
@@ -5374,7 +5396,7 @@ class ResponseHandler {
                 await this.persistencePlugin.afterCacheAccess(cacheContext);
             }
         }
-        return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse, serverRequestId);
+        return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, serverTokenResponse, serverRequestId);
     }
     /**
      * Generates CacheRecord
@@ -5382,20 +5404,19 @@ class ResponseHandler {
      * @param idTokenObj
      * @param authority
      */
-    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload) {
+    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
         const env = authority.getPreferredCache();
-        if (StringUtils.isEmpty(env)) {
+        if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
         }
         // IdToken: non AAD scenarios can have empty realm
         let cachedIdToken;
         let cachedAccount;
-        if (!StringUtils.isEmpty(serverTokenResponse.id_token) &&
-            !!idTokenObj) {
-            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+        if (serverTokenResponse.id_token && !!idTokenClaims) {
+            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, idTokenClaims.tid || "");
             cachedAccount = AccountEntity.createAccount({
                 homeAccountId: this.homeAccountIdentifier,
-                idTokenClaims: idTokenObj.claims,
+                idTokenClaims: idTokenClaims,
                 clientInfo: serverTokenResponse.client_info,
                 cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
                 msGraphHost: authCodePayload?.msgraph_host,
@@ -5403,7 +5424,7 @@ class ResponseHandler {
         }
         // AccessToken
         let cachedAccessToken = null;
-        if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
+        if (serverTokenResponse.access_token) {
             // If scopes not returned in server response, use request scopes
             const responseScopes = serverTokenResponse.scope
                 ? ScopeSet.fromString(serverTokenResponse.scope)
@@ -5427,18 +5448,16 @@ class ResponseHandler {
                 ? reqTimestamp + refreshIn
                 : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj
-                ? idTokenObj.claims.tid || Constants.EMPTY_STRING
-                : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenClaims?.tid || authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         let cachedRefreshToken = null;
-        if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {
+        if (serverTokenResponse.refresh_token) {
             cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, userAssertionHash);
         }
         // appMetadata
         let cachedAppMetadata = null;
-        if (!StringUtils.isEmpty(serverTokenResponse.foci)) {
+        if (serverTokenResponse.foci) {
             cachedAppMetadata = AppMetadataEntity.createAppMetadataEntity(this.clientId, env, serverTokenResponse.foci);
         }
         return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
@@ -5453,11 +5472,12 @@ class ResponseHandler {
      * @param fromTokenCache
      * @param stateString
      */
-    static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, serverTokenResponse, requestId) {
+    static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenClaims, requestState, serverTokenResponse, requestId) {
         let accessToken = Constants.EMPTY_STRING;
         let responseScopes = [];
         let expiresOn = null;
         let extExpiresOn;
+        let refreshOn;
         let familyId = Constants.EMPTY_STRING;
         if (cacheRecord.accessToken) {
             if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP) {
@@ -5474,17 +5494,18 @@ class ResponseHandler {
             responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
             expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
             extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+            if (cacheRecord.accessToken.refreshOn) {
+                refreshOn = new Date(Number(cacheRecord.accessToken.refreshOn) * 1000);
+            }
         }
         if (cacheRecord.appMetadata) {
             familyId =
                 cacheRecord.appMetadata.familyId === THE_FAMILY_ID
                     ? THE_FAMILY_ID
-                    : Constants.EMPTY_STRING;
+                    : "";
         }
-        const uid = idTokenObj?.claims.oid ||
-            idTokenObj?.claims.sub ||
-            Constants.EMPTY_STRING;
-        const tid = idTokenObj?.claims.tid || Constants.EMPTY_STRING;
+        const uid = idTokenClaims?.oid || idTokenClaims?.sub || "";
+        const tid = idTokenClaims?.tid || "";
         // for hybrid + native bridge enablement, send back the native account Id
         if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
             cacheRecord.account.nativeAccountId =
@@ -5498,14 +5519,15 @@ class ResponseHandler {
             account: cacheRecord.account
                 ? cacheRecord.account.getAccountInfo()
                 : null,
-            idToken: idTokenObj ? idTokenObj.rawToken : Constants.EMPTY_STRING,
-            idTokenClaims: idTokenObj ? idTokenObj.claims : {},
+            idToken: cacheRecord?.idToken?.secret || "",
+            idTokenClaims: idTokenClaims || {},
             accessToken: accessToken,
             fromCache: fromTokenCache,
             expiresOn: expiresOn,
+            extExpiresOn: extExpiresOn,
+            refreshOn: refreshOn,
             correlationId: request.correlationId,
             requestId: requestId || Constants.EMPTY_STRING,
-            extExpiresOn: extExpiresOn,
             familyId: familyId,
             tokenType: cacheRecord.accessToken?.tokenType || Constants.EMPTY_STRING,
             state: requestState
@@ -5520,12 +5542,99 @@ class ResponseHandler {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Wraps a function with a performance measurement.
+ * Usage: invoke(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
+ * @param callback
+ * @param eventName
+ * @param logger
+ * @param telemetryClient
+ * @param correlationId
+ * @returns
+ * @internal
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const invoke = (callback, eventName, logger, telemetryClient, correlationId) => {
+    return (...args) => {
+        logger.trace(`Executing function ${eventName}`);
+        const inProgressEvent = telemetryClient?.startMeasurement(eventName, correlationId);
+        telemetryClient?.setPreQueueTime(eventName, correlationId);
+        try {
+            const result = callback(...args);
+            inProgressEvent?.end({
+                success: true,
+            });
+            logger.trace(`Returning result from ${eventName}`);
+            return result;
+        }
+        catch (e) {
+            logger.trace(`Error occurred in ${eventName}`);
+            try {
+                logger.trace(JSON.stringify(e));
+            }
+            catch (e) {
+                logger.trace("Unable to print error message.");
+            }
+            inProgressEvent?.end({
+                success: false,
+            });
+            throw e;
+        }
+    };
+};
+/**
+ * Wraps an async function with a performance measurement.
+ * Usage: invokeAsync(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
+ * @param callback
+ * @param eventName
+ * @param logger
+ * @param telemetryClient
+ * @param correlationId
+ * @returns
+ * @internal
+ *
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId) => {
+    return (...args) => {
+        logger.trace(`Executing function ${eventName}`);
+        const inProgressEvent = telemetryClient?.startMeasurement(eventName, correlationId);
+        telemetryClient?.setPreQueueTime(eventName, correlationId);
+        return callback(...args)
+            .then((response) => {
+            logger.trace(`Returning result from ${eventName}`);
+            inProgressEvent?.end({
+                success: true,
+            });
+            return response;
+        })
+            .catch((e) => {
+            logger.trace(`Error occurred in ${eventName}`);
+            try {
+                logger.trace(JSON.stringify(e));
+            }
+            catch (e) {
+                logger.trace("Unable to print error message.");
+            }
+            inProgressEvent?.end({
+                success: false,
+            });
+            throw e;
+        });
+    };
+};
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
  * Oauth2.0 Authorization Code client
+ * @internal
  */
 class AuthorizationCodeClient extends BaseClient {
     constructor(configuration, performanceClient) {
@@ -5547,8 +5656,7 @@ class AuthorizationCodeClient extends BaseClient {
      */
     async getAuthCodeUrl(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.GetAuthCodeUrl, request.correlationId);
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthClientCreateQueryString, request.correlationId);
-        const queryString = await this.createAuthCodeUrlQueryString(request);
+        const queryString = await invokeAsync(this.createAuthCodeUrlQueryString.bind(this), PerformanceEvents.AuthClientCreateQueryString, this.logger, this.performanceClient, request.correlationId)(request);
         return UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString);
     }
     /**
@@ -5557,46 +5665,18 @@ class AuthorizationCodeClient extends BaseClient {
      * @param request
      */
     async acquireToken(request, authCodePayload) {
-        if (!request || !request.code) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientAcquireToken, request.correlationId);
+        if (!request.code) {
             throw ClientAuthError.createTokenRequestCannotBeMadeError();
         }
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientAcquireToken, request.correlationId);
-        const atsMeasurement = this.performanceClient?.startMeasurement(
-        // @ts-ignore
-        "AuthCodeClientAcquireToken", request.correlationId);
-        this.logger.info("in acquireToken call in auth-code client");
         const reqTimestamp = TimeUtils.nowSeconds();
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthClientExecuteTokenRequest, request.correlationId);
-        const response = await this.executeTokenRequest(this.authority, request);
+        const response = await invokeAsync(this.executeTokenRequest.bind(this), PerformanceEvents.AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request);
         // Retrieve requestId from response headers
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
-        const httpVerAuthority = response.headers?.[HeaderNames.X_MS_HTTP_VERSION];
-        if (httpVerAuthority) {
-            atsMeasurement?.add({
-                httpVerAuthority,
-            });
-        }
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin, this.performanceClient);
         // Validate response. This function throws a server error if an error is returned by the server.
         responseHandler.validateTokenResponse(response.body);
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.HandleServerTokenResponse, request.correlationId);
-        return responseHandler
-            .handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)
-            .then((result) => {
-            atsMeasurement?.end({
-                success: true,
-            });
-            return result;
-        })
-            .catch((error) => {
-            this.logger.verbose("Error in fetching token in ACC", request.correlationId);
-            atsMeasurement?.end({
-                errorCode: error.errorCode,
-                subErrorCode: error.subError,
-                success: false,
-            });
-            throw error;
-        });
+        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId);
     }
     /**
      * Handles the hash fragment response from public client code request. Returns a code response used by
@@ -5641,10 +5721,9 @@ class AuthorizationCodeClient extends BaseClient {
      */
     async executeTokenRequest(authority, request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientExecuteTokenRequest, request.correlationId);
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);
         const queryParametersString = this.createTokenQueryParameters(request);
         const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
-        const requestBody = await this.createTokenRequestBody(request);
+        const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), PerformanceEvents.AuthClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
         let ccsCredential = undefined;
         if (request.clientInfo) {
             try {
@@ -5670,7 +5749,7 @@ class AuthorizationCodeClient extends BaseClient {
             shrClaims: request.shrClaims,
             sshKid: request.sshKid,
         };
-        return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint);
+        return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.BaseClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId);
     }
     /**
      * Generates a map for all the params to be sent to the service
@@ -5899,7 +5978,7 @@ class AuthorizationCodeClient extends BaseClient {
         if (request.state) {
             parameterBuilder.addState(request.state);
         }
-        if (!StringUtils.isEmpty(request.claims) ||
+        if (request.claims ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
             parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
@@ -5964,6 +6043,7 @@ class AuthorizationCodeClient extends BaseClient {
  */
 /**
  * OAuth2.0 refresh token client
+ * @internal
  */
 class RefreshTokenClient extends BaseClient {
     constructor(configuration, performanceClient) {
@@ -5976,15 +6056,6 @@ class RefreshTokenClient extends BaseClient {
         const reqTimestamp = TimeUtils.nowSeconds();
         this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
         const response = await this.executeTokenRequest(request, this.authority);
-        const httpVerToken = response.headers?.[HeaderNames.X_MS_HTTP_VERSION];
-        atsMeasurement?.add({
-            refreshTokenSize: response.body.refresh_token?.length || 0,
-        });
-        if (httpVerToken) {
-            atsMeasurement?.add({
-                httpVerToken,
-            });
-        }
         // Retrieve requestId from response headers
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
@@ -6107,7 +6178,7 @@ class RefreshTokenClient extends BaseClient {
             shrClaims: request.shrClaims,
             sshKid: request.sshKid,
         };
-        return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)
+        return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint, request.correlationId)
             .then((result) => {
             acquireTokenMeasurement?.end({
                 success: true,
@@ -6202,6 +6273,7 @@ class RefreshTokenClient extends BaseClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/** @internal */
 class SilentFlowClient extends BaseClient {
     constructor(configuration, performanceClient) {
         super(configuration, performanceClient);
@@ -6283,19 +6355,19 @@ class SilentFlowClient extends BaseClient {
      * @param cacheRecord
      */
     async generateResultFromCacheRecord(cacheRecord, request) {
-        let idTokenObj;
+        let idTokenClaims;
         if (cacheRecord.idToken) {
-            idTokenObj = new AuthToken(cacheRecord.idToken.secret, this.config.cryptoInterface);
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
         }
         // token max_age check
         if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenObj?.claims.auth_time;
+            const authTime = idTokenClaims?.auth_time;
             if (!authTime) {
                 throw ClientAuthError.createAuthTimeNotFoundError();
             }
-            AuthToken.checkMaxAge(authTime, request.maxAge);
+            checkMaxAge(authTime, request.maxAge);
         }
-        return await ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenObj);
+        return await ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
     }
 }
 
@@ -7199,6 +7271,7 @@ for (const key in InstanceDiscoveryMetadata) {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/** @internal */
 class AuthorityMetadataEntity {
     constructor() {
         this.expiresAt =
@@ -7407,6 +7480,7 @@ RegionDiscovery.IMDS_OPTIONS = {
 /**
  * The authority class validates the authority URIs used by the user, and retrieves the OpenID Configuration Data from the
  * endpoint. It will store the pertinent config data in this object for use during token calls.
+ * @internal
  */
 class Authority {
     constructor(authority, networkInterface, cacheManager, authorityOptions, logger, performanceClient, correlationId) {
@@ -7620,7 +7694,8 @@ class Authority {
     get defaultOpenIdConfigurationEndpoint() {
         const canonicalAuthorityHost = this.hostnameAndPort;
         if (this.authorityType === AuthorityType.Adfs ||
-            !this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost)) {
+            (this.protocolMode !== ProtocolMode.AAD &&
+                !this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost))) {
             return `${this.canonicalAuthority}.well-known/openid-configuration`;
         }
         return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
@@ -8166,6 +8241,7 @@ Authority.reservedTenantDomains = new Set([
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/** @internal */
 class AuthorityFactory {
     /**
      * Create an authority object of the correct type based on the url
@@ -8203,7 +8279,7 @@ class AuthorityFactory {
      */
     static createInstance(authorityUrl, networkInterface, cacheManager, authorityOptions, logger, performanceClient, correlationId) {
         // Throw error if authority url is empty
-        if (StringUtils.isEmpty(authorityUrl)) {
+        if (!authorityUrl) {
             throw ClientConfigurationError.createUrlEmptyError();
         }
         return new Authority(authorityUrl, networkInterface, cacheManager, authorityOptions, logger, performanceClient, correlationId);
@@ -8321,6 +8397,7 @@ class JoseHeaderError extends AuthError {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/** @internal */
 class JoseHeader {
     constructor(options) {
         this.typ = options.typ;
@@ -8414,6 +8491,7 @@ class AuthenticationHeaderParser {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/** @internal */
 class ServerTelemetryManager {
     constructor(telemetryRequest, cacheManager) {
         this.cacheOutcome = CacheOutcome.NO_CACHE_HIT;
@@ -8486,10 +8564,10 @@ class ServerTelemetryManager {
         lastRequests.failedRequests.push(this.apiId, this.correlationId);
         if (error instanceof Error && !!error && error.toString()) {
             if (error instanceof AuthError) {
-                if (!StringUtils.isEmpty(error.subError)) {
+                if (error.subError) {
                     lastRequests.errors.push(error.subError);
                 }
-                else if (!StringUtils.isEmpty(error.errorCode)) {
+                else if (error.errorCode) {
                     lastRequests.errors.push(error.errorCode);
                 }
                 else {
@@ -9031,10 +9109,30 @@ class StubPerformanceMeasurement {
         return null;
     }
 }
-class StubPerformanceClient extends PerformanceClient {
+class StubPerformanceClient {
     generateId() {
         return "callback-id";
     }
+    startMeasurement(measureName, correlationId) {
+        return {
+            end: () => null,
+            discard: () => { },
+            add: () => { },
+            increment: () => { },
+            event: {
+                eventId: this.generateId(),
+                status: PerformanceEventStatus.InProgress,
+                authority: "",
+                libraryName: "",
+                libraryVersion: "",
+                clientId: "",
+                name: measureName,
+                startTimeMs: Date.now(),
+                correlationId: correlationId || "",
+            },
+            measurement: new StubPerformanceMeasurement(),
+        };
+    }
     startPerformanceMeasurement() {
         return new StubPerformanceMeasurement();
     }
@@ -9111,7 +9209,7 @@ exports.DefaultStorageClass = DefaultStorageClass;
 exports.Errors = Errors;
 exports.GrantType = GrantType;
 exports.HeaderNames = HeaderNames;
-exports.IdToken = AuthToken;
+exports.HttpStatus = HttpStatus;
 exports.IdTokenEntity = IdTokenEntity;
 exports.IntFields = IntFields;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
@@ -9154,5 +9252,7 @@ exports.TokenCacheContext = TokenCacheContext;
 exports.UrlString = UrlString;
 exports.buildClientInfo = buildClientInfo;
 exports.buildClientInfoFromHomeAccountId = buildClientInfoFromHomeAccountId;
+exports.invoke = invoke;
+exports.invokeAsync = invokeAsync;
 exports.version = version;
 //# sourceMappingURL=index.cjs.map