@azure/msal-common 15.8.1 → 15.10.0

package/lib/{index-node-BCM1mkg5.js → index-node-Dy4fVJGl.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.8.1 2025-07-08 */
+/*! @azure/msal-common v15.10.0 2025-08-05 */
 'use strict';
 'use strict';
 
@@ -9,8 +9,6 @@
 const Constants = {
     LIBRARY_NAME: "MSAL.JS",
     SKU: "msal.js.common",
-    // Prefix for all library cache entries
-    CACHE_PREFIX: "msal",
     // default authority
     DEFAULT_AUTHORITY: "https://login.microsoftonline.com/common/",
     DEFAULT_AUTHORITY_HOST: "login.microsoftonline.com",
@@ -81,6 +79,10 @@ const HttpStatus = {
     SERVER_ERROR_RANGE_END: 599,
     MULTI_SIDED_ERROR: 600,
 };
+const HttpMethod = {
+    GET: "GET",
+    POST: "POST",
+};
 const OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
     Constants.PROFILE_SCOPE,
@@ -846,7 +848,9 @@ const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
 const invalidAuthenticationHeader = "invalid_authentication_header";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
-const authorityMismatch = "authority_mismatch";
+const authorityMismatch = "authority_mismatch";
+const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
 
 var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -858,9 +862,11 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     emptyInputScopesError: emptyInputScopesError,
     invalidAuthenticationHeader: invalidAuthenticationHeader,
     invalidAuthorityMetadata: invalidAuthorityMetadata,
+    invalidAuthorizePostBodyParameters: invalidAuthorizePostBodyParameters,
     invalidClaims: invalidClaims,
     invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
     invalidCodeChallengeMethod: invalidCodeChallengeMethod,
+    invalidRequestMethodForEAR: invalidRequestMethodForEAR,
     logoutRequestEmpty: logoutRequestEmpty,
     missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,
     missingSshJwk: missingSshJwk,
@@ -899,6 +905,8 @@ const ClientConfigurationErrorMessages = {
     [cannotSetOIDCOptions]: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
     [cannotAllowPlatformBroker]: "Cannot set allowPlatformBroker parameter to true when not in AAD protocol mode.",
     [authorityMismatch]: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+    [invalidAuthorizePostBodyParameters]: "Invalid authorize post body parameters provided. If you are using authorizePostBodyParameters, the request method must be POST. Please check the request method and parameters.",
+    [invalidRequestMethodForEAR]: "Invalid request method for EAR protocol mode. The request method cannot be GET when using EAR protocol mode. Please change the request method to POST.",
 };
 /**
  * ClientConfigurationErrorMessage class containing string constants used by error codes and messages.
@@ -989,6 +997,14 @@ const ClientConfigurationErrorMessage = {
         code: authorityMismatch,
         desc: ClientConfigurationErrorMessages[authorityMismatch],
     },
+    invalidAuthorizePostBodyParameters: {
+        code: invalidAuthorizePostBodyParameters,
+        desc: ClientConfigurationErrorMessages[invalidAuthorizePostBodyParameters],
+    },
+    invalidRequestMethodForEAR: {
+        code: invalidRequestMethodForEAR,
+        desc: ClientConfigurationErrorMessages[invalidRequestMethodForEAR],
+    },
 };
 /**
  * Error thrown when there is an error in configuration of the MSAL.js library.
@@ -2039,6 +2055,16 @@ const IntFields = new Set([
     "multiMatchedRT",
     "unencryptedCacheCount",
     "encryptedCacheExpiredCount",
+    "oldAccountCount",
+    "oldAccessCount",
+    "oldIdCount",
+    "oldRefreshCount",
+    "currAccountCount",
+    "currAccessCount",
+    "currIdCount",
+    "currRefreshCount",
+    "expiredCacheRemovedCount",
+    "upgradedCacheCount",
 ]);
 
 /*
@@ -2283,6 +2309,16 @@ function isTokenExpired(expiresOn, offset) {
     // If current time + offset is greater than token expiration time, then token is expired.
     return offsetCurrentTimeSec > expirationSec;
 }
+/**
+ * Checks if a cache entry is expired based on the last updated time and cache retention days.
+ * @param lastUpdatedAt
+ * @param cacheRetentionDays
+ * @returns
+ */
+function isCacheExpired(lastUpdatedAt, cacheRetentionDays) {
+    const cacheExpirationTimestamp = Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1000;
+    return Date.now() > cacheExpirationTimestamp;
+}
 /**
  * If the current time is earlier than the time that a token was cached at, we must discard the token
  * i.e. The system clock was turned back after acquiring the cached token
@@ -2305,6 +2341,7 @@ function delay(t, value) {
 var TimeUtils = /*#__PURE__*/Object.freeze({
     __proto__: null,
     delay: delay,
+    isCacheExpired: isCacheExpired,
     isTokenExpired: isTokenExpired,
     nowSeconds: nowSeconds,
     toDateFromSeconds: toDateFromSeconds,
@@ -2316,24 +2353,6 @@ var TimeUtils = /*#__PURE__*/Object.freeze({
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-/**
- * Cache Key: <home_account_id>-<environment>-<credential_type>-<client_id or familyId>-<realm>-<scopes>-<claims hash>-<scheme>
- * IdToken Example: uid.utid-login.microsoftonline.com-idtoken-app_client_id-contoso.com
- * AccessToken Example: uid.utid-login.microsoftonline.com-accesstoken-app_client_id-contoso.com-scope1 scope2--pop
- * RefreshToken Example: uid.utid-login.microsoftonline.com-refreshtoken-1-contoso.com
- * @param credentialEntity
- * @returns
- */
-function generateCredentialKey(credentialEntity) {
-    const credentialKey = [
-        generateAccountId(credentialEntity),
-        generateCredentialId(credentialEntity),
-        generateTarget(credentialEntity),
-        generateClaimsHash(credentialEntity),
-        generateScheme(credentialEntity),
-    ];
-    return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-}
 /**
  * Create IdTokenEntity
  * @param homeAccountId
@@ -2349,6 +2368,7 @@ function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tena
         clientId: clientId,
         secret: idToken,
         realm: tenantId,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
     };
     return idTokenEntity;
 }
@@ -2376,6 +2396,7 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
         realm: tenantId,
         target: scopes,
         tokenType: tokenType || AuthenticationScheme.BEARER,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
     };
     if (userAssertionHash) {
         atEntity.userAssertionHash = userAssertionHash;
@@ -2423,6 +2444,7 @@ function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clie
         environment: environment,
         clientId: clientId,
         secret: refreshToken,
+        lastUpdatedAt: Date.now().toString(),
     };
     if (userAssertionHash) {
         rtEntity.userAssertionHash = userAssertionHash;
@@ -2480,56 +2502,6 @@ function isRefreshTokenEntity(entity) {
     return (isCredentialEntity(entity) &&
         entity["credentialType"] === CredentialType.REFRESH_TOKEN);
 }
-/**
- * Generate Account Id key component as per the schema: <home_account_id>-<environment>
- */
-function generateAccountId(credentialEntity) {
-    const accountId = [
-        credentialEntity.homeAccountId,
-        credentialEntity.environment,
-    ];
-    return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-}
-/**
- * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
- */
-function generateCredentialId(credentialEntity) {
-    const clientOrFamilyId = credentialEntity.credentialType === CredentialType.REFRESH_TOKEN
-        ? credentialEntity.familyId || credentialEntity.clientId
-        : credentialEntity.clientId;
-    const credentialId = [
-        credentialEntity.credentialType,
-        clientOrFamilyId,
-        credentialEntity.realm || "",
-    ];
-    return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-}
-/**
- * Generate target key component as per schema: <target>
- */
-function generateTarget(credentialEntity) {
-    return (credentialEntity.target || "").toLowerCase();
-}
-/**
- * Generate requested claims key component as per schema: <requestedClaims>
- */
-function generateClaimsHash(credentialEntity) {
-    return (credentialEntity.requestedClaimsHash || "").toLowerCase();
-}
-/**
- * Generate scheme key componenet as per schema: <scheme>
- */
-function generateScheme(credentialEntity) {
-    /*
-     * PoP Tokens and SSH certs include scheme in cache key
-     * Cast to lowercase to handle "bearer" from ADFS
-     */
-    return credentialEntity.tokenType &&
-        credentialEntity.tokenType.toLowerCase() !==
-            AuthenticationScheme.BEARER.toLowerCase()
-        ? credentialEntity.tokenType.toLowerCase()
-        : "";
-}
 /**
  * validates if a given cache entry is "Telemetry", parses <key,value>
  * @param key
@@ -2644,7 +2616,6 @@ var CacheHelpers = /*#__PURE__*/Object.freeze({
     createRefreshTokenEntity: createRefreshTokenEntity,
     generateAppMetadataKey: generateAppMetadataKey,
     generateAuthorityMetadataExpiresAt: generateAuthorityMetadataExpiresAt,
-    generateCredentialKey: generateCredentialKey,
     isAccessTokenEntity: isAccessTokenEntity,
     isAppMetadataEntity: isAppMetadataEntity,
     isAuthorityMetadataEntity: isAuthorityMetadataEntity,
@@ -3882,7 +3853,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "15.8.1";
+const version = "15.10.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4073,44 +4044,6 @@ class ScopeSet {
     }
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Function to build a client info object from server clientInfo string
- * @param rawClientInfo
- * @param crypto
- */
-function buildClientInfo(rawClientInfo, base64Decode) {
-    if (!rawClientInfo) {
-        throw createClientAuthError(clientInfoEmptyError);
-    }
-    try {
-        const decodedClientInfo = base64Decode(rawClientInfo);
-        return JSON.parse(decodedClientInfo);
-    }
-    catch (e) {
-        throw createClientAuthError(clientInfoDecodingError);
-    }
-}
-/**
- * Function to build a client info object from cached homeAccountId string
- * @param homeAccountId
- */
-function buildClientInfoFromHomeAccountId(homeAccountId) {
-    if (!homeAccountId) {
-        throw createClientAuthError(clientInfoDecodingError);
-    }
-    const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
-    return {
-        uid: clientInfoParts[0],
-        utid: clientInfoParts.length < 2
-            ? Constants.EMPTY_STRING
-            : clientInfoParts[1],
-    };
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4136,7 +4069,7 @@ function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
  */
 function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
     if (idTokenClaims) {
-        const { oid, sub, tid, name, tfp, acr } = idTokenClaims;
+        const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint, } = idTokenClaims;
         /**
          * Since there is no way to determine if the authority is AAD or B2C, we exhaust all the possible claims that can serve as tenant ID with the following precedence:
          * tid - TenantID claim that identifies the tenant that issued the token in AAD. Expected in all AAD ID tokens, not present in B2C ID Tokens.
@@ -4148,6 +4081,8 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             tenantId: tenantId,
             localAccountId: oid || sub || "",
             name: name,
+            username: preferred_username || upn || "",
+            loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
         };
     }
@@ -4155,6 +4090,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
         return {
             tenantId,
             localAccountId,
+            username: "",
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
         };
     }
@@ -4193,21 +4129,56 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+const cacheQuotaExceeded = "cache_quota_exceeded";
+const cacheErrorUnknown = "cache_error_unknown";
+
+var CacheErrorCodes = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    cacheErrorUnknown: cacheErrorUnknown,
+    cacheQuotaExceeded: cacheQuotaExceeded
+});
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CacheErrorMessages = {
+    [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
+    [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
+};
 /**
- * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
- * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
- * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
- * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
- * Downcased to match the realm case-insensitive comparison requirements
- * @param idTokenClaims
+ * Error thrown when there is an error with the cache
+ */
+class CacheError extends AuthError {
+    constructor(errorCode, errorMessage) {
+        const message = errorMessage ||
+            (CacheErrorMessages[errorCode]
+                ? CacheErrorMessages[errorCode]
+                : CacheErrorMessages[cacheErrorUnknown]);
+        super(`${errorCode}: ${message}`);
+        Object.setPrototypeOf(this, CacheError.prototype);
+        this.name = "CacheError";
+        this.errorCode = errorCode;
+        this.errorMessage = message;
+    }
+}
+/**
+ * Helper function to wrap browser errors in a CacheError object
+ * @param e
  * @returns
  */
-function getTenantIdFromIdTokenClaims(idTokenClaims) {
-    if (idTokenClaims) {
-        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
-        return tenantId || null;
+function createCacheError(e) {
+    if (!(e instanceof Error)) {
+        return new CacheError(cacheErrorUnknown);
+    }
+    if (e.name === "QuotaExceededError" ||
+        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+        e.message.includes("exceeded the quota")) {
+        return new CacheError(cacheQuotaExceeded);
+    }
+    else {
+        return new CacheError(e.name, e.message);
     }
-    return null;
 }
 
 /*
@@ -4215,383 +4186,86 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
  * Licensed under the MIT License.
  */
 /**
- * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
- *
- * Key : Value Schema
- *
- * Key: <home_account_id>-<environment>-<realm*>
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
- *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
- *      authorityType: Accounts authority type as a string
- *      name: Full name for the account, including given name and family name,
- *      lastModificationTime: last time this entity was modified in the cache
- *      lastModificationApp:
- *      nativeAccountId: Account identifier on the native device
- *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
- * }
+ * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
  * @internal
  */
-class AccountEntity {
-    /**
-     * Generate Account Id key component as per the schema: <home_account_id>-<environment>
-     */
-    generateAccountId() {
-        const accountId = [this.homeAccountId, this.environment];
-        return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+class CacheManager {
+    constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
+        this.clientId = clientId;
+        this.cryptoImpl = cryptoImpl;
+        this.commonLogger = logger.clone(name, version);
+        this.staticAuthorityOptions = staticAuthorityOptions;
+        this.performanceClient = performanceClient;
     }
     /**
-     * Generate Account Cache Key as per the schema: <home_account_id>-<environment>-<realm*>
+     * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
+     * @param accountFilter - (Optional) filter to narrow down the accounts returned
+     * @returns Array of AccountInfo objects in cache
      */
-    generateAccountKey() {
-        return AccountEntity.generateAccountCacheKey({
-            homeAccountId: this.homeAccountId,
-            environment: this.environment,
-            tenantId: this.realm,
-            username: this.username,
-            localAccountId: this.localAccountId,
-        });
+    getAllAccounts(accountFilter, correlationId) {
+        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
     }
     /**
-     * Returns the AccountInfo interface for this account.
+     * Gets first tenanted AccountInfo object found based on provided filters
      */
-    getAccountInfo() {
-        return {
-            homeAccountId: this.homeAccountId,
-            environment: this.environment,
-            tenantId: this.realm,
-            username: this.username,
-            localAccountId: this.localAccountId,
-            name: this.name,
-            nativeAccountId: this.nativeAccountId,
-            authorityType: this.authorityType,
-            // Deserialize tenant profiles array into a Map
-            tenantProfiles: new Map((this.tenantProfiles || []).map((tenantProfile) => {
-                return [tenantProfile.tenantId, tenantProfile];
-            })),
-        };
+    getAccountInfoFilteredBy(accountFilter, correlationId) {
+        const allAccounts = this.getAllAccounts(accountFilter, correlationId);
+        if (allAccounts.length > 1) {
+            // If one or more accounts are found, prioritize accounts that have an ID token
+            const sortedAccounts = allAccounts.sort((account) => {
+                return account.idTokenClaims ? -1 : 1;
+            });
+            return sortedAccounts[0];
+        }
+        else if (allAccounts.length === 1) {
+            // If only one account is found, return it regardless of whether a matching ID token was found
+            return allAccounts[0];
+        }
+        else {
+            return null;
+        }
     }
     /**
-     * Returns true if the account entity is in single tenant format (outdated), false otherwise
+     * Returns a single matching
+     * @param accountFilter
+     * @returns
      */
-    isSingleTenant() {
-        return !this.tenantProfiles;
+    getBaseAccountInfo(accountFilter, correlationId) {
+        const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
+        if (accountEntities.length > 0) {
+            return accountEntities[0].getAccountInfo();
+        }
+        else {
+            return null;
+        }
     }
     /**
-     * Generates account key from interface
-     * @param accountInterface
+     * Matches filtered account entities with cached ID tokens that match the tenant profile-specific account filters
+     * and builds the account info objects from the matching ID token's claims
+     * @param cachedAccounts
+     * @param accountFilter
+     * @returns Array of AccountInfo objects that match account and tenant profile filters
      */
-    static generateAccountCacheKey(accountInterface) {
-        const homeTenantId = accountInterface.homeAccountId.split(".")[1];
-        const accountKey = [
-            accountInterface.homeAccountId,
-            accountInterface.environment || "",
-            homeTenantId || accountInterface.tenantId || "",
-        ];
-        return accountKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+    buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
+        return cachedAccounts.flatMap((accountEntity) => {
+            return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
+        });
     }
-    /**
-     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-     * @param accountDetails
-     */
-    static createAccount(accountDetails, authority, base64Decode) {
-        const account = new AccountEntity();
-        if (authority.authorityType === AuthorityType.Adfs) {
-            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
-        }
-        else if (authority.protocolMode === ProtocolMode.OIDC) {
-            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        }
-        else {
-            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
+    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
+        let tenantedAccountInfo = null;
+        let idTokenClaims;
+        if (tenantProfileFilter) {
+            if (!this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter)) {
+                return null;
+            }
         }
-        let clientInfo;
-        if (accountDetails.clientInfo && base64Decode) {
-            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
-        }
-        account.clientInfo = accountDetails.clientInfo;
-        account.homeAccountId = accountDetails.homeAccountId;
-        account.nativeAccountId = accountDetails.nativeAccountId;
-        const env = accountDetails.environment ||
-            (authority && authority.getPreferredCache());
-        if (!env) {
-            throw createClientAuthError(invalidCacheEnvironment);
-        }
-        account.environment = env;
-        // non AAD scenarios can have empty realm
-        account.realm =
-            clientInfo?.utid ||
-                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
-                "";
-        // How do you account for MSA CID here?
-        account.localAccountId =
-            clientInfo?.uid ||
-                accountDetails.idTokenClaims?.oid ||
-                accountDetails.idTokenClaims?.sub ||
-                "";
-        /*
-         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-         * In most cases it will contain a single email. This field should not be relied upon if a custom
-         * policy is configured to return more than 1 email.
-         */
-        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
-            accountDetails.idTokenClaims?.upn;
-        const email = accountDetails.idTokenClaims?.emails
-            ? accountDetails.idTokenClaims.emails[0]
-            : null;
-        account.username = preferredUsername || email || "";
-        account.name = accountDetails.idTokenClaims?.name || "";
-        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
-        account.msGraphHost = accountDetails.msGraphHost;
-        if (accountDetails.tenantProfiles) {
-            account.tenantProfiles = accountDetails.tenantProfiles;
-        }
-        else {
-            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
-            account.tenantProfiles = [tenantProfile];
-        }
-        return account;
-    }
-    /**
-     * Creates an AccountEntity object from AccountInfo
-     * @param accountInfo
-     * @param cloudGraphHostName
-     * @param msGraphHost
-     * @returns
-     */
-    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
-        const account = new AccountEntity();
-        account.authorityType =
-            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        account.homeAccountId = accountInfo.homeAccountId;
-        account.localAccountId = accountInfo.localAccountId;
-        account.nativeAccountId = accountInfo.nativeAccountId;
-        account.realm = accountInfo.tenantId;
-        account.environment = accountInfo.environment;
-        account.username = accountInfo.username;
-        account.name = accountInfo.name;
-        account.cloudGraphHostName = cloudGraphHostName;
-        account.msGraphHost = msGraphHost;
-        // Serialize tenant profiles map into an array
-        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
-        return account;
-    }
-    /**
-     * Generate HomeAccountId from server response
-     * @param serverClientInfo
-     * @param authType
-     */
-    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
-        // since ADFS/DSTS do not have tid and does not set client_info
-        if (!(authType === AuthorityType.Adfs ||
-            authType === AuthorityType.Dsts)) {
-            // for cases where there is clientInfo
-            if (serverClientInfo) {
-                try {
-                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
-                    if (clientInfo.uid && clientInfo.utid) {
-                        return `${clientInfo.uid}.${clientInfo.utid}`;
-                    }
-                }
-                catch (e) { }
-            }
-            logger.warning("No client info in response");
-        }
-        // default to "sub" claim
-        return idTokenClaims?.sub || "";
-    }
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isAccountEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("localAccountId") &&
-            entity.hasOwnProperty("username") &&
-            entity.hasOwnProperty("authorityType"));
-    }
-    /**
-     * Helper function to determine whether 2 accountInfo objects represent the same account
-     * @param accountA
-     * @param accountB
-     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
-     */
-    static accountInfoIsEqual(accountA, accountB, compareClaims) {
-        if (!accountA || !accountB) {
-            return false;
-        }
-        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
-        if (compareClaims) {
-            const accountAClaims = (accountA.idTokenClaims ||
-                {});
-            const accountBClaims = (accountB.idTokenClaims ||
-                {});
-            // issued at timestamp and nonce are expected to change each time a new id token is acquired
-            claimsMatch =
-                accountAClaims.iat === accountBClaims.iat &&
-                    accountAClaims.nonce === accountBClaims.nonce;
-        }
-        return (accountA.homeAccountId === accountB.homeAccountId &&
-            accountA.localAccountId === accountB.localAccountId &&
-            accountA.username === accountB.username &&
-            accountA.tenantId === accountB.tenantId &&
-            accountA.environment === accountB.environment &&
-            accountA.nativeAccountId === accountB.nativeAccountId &&
-            claimsMatch);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const cacheQuotaExceeded = "cache_quota_exceeded";
-const cacheErrorUnknown = "cache_error_unknown";
-
-var CacheErrorCodes = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    cacheErrorUnknown: cacheErrorUnknown,
-    cacheQuotaExceeded: cacheQuotaExceeded
-});
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CacheErrorMessages = {
-    [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
-    [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
-};
-/**
- * Error thrown when there is an error with the cache
- */
-class CacheError extends AuthError {
-    constructor(errorCode, errorMessage) {
-        const message = errorMessage ||
-            (CacheErrorMessages[errorCode]
-                ? CacheErrorMessages[errorCode]
-                : CacheErrorMessages[cacheErrorUnknown]);
-        super(`${errorCode}: ${message}`);
-        Object.setPrototypeOf(this, CacheError.prototype);
-        this.name = "CacheError";
-        this.errorCode = errorCode;
-        this.errorMessage = message;
-    }
-}
-/**
- * Helper function to wrap browser errors in a CacheError object
- * @param e
- * @returns
- */
-function createCacheError(e) {
-    if (!(e instanceof Error)) {
-        return new CacheError(cacheErrorUnknown);
-    }
-    if (e.name === "QuotaExceededError" ||
-        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
-        e.message.includes("exceeded the quota")) {
-        return new CacheError(cacheQuotaExceeded);
-    }
-    else {
-        return new CacheError(e.name, e.message);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
- * @internal
- */
-class CacheManager {
-    constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
-        this.clientId = clientId;
-        this.cryptoImpl = cryptoImpl;
-        this.commonLogger = logger.clone(name, version);
-        this.staticAuthorityOptions = staticAuthorityOptions;
-        this.performanceClient = performanceClient;
-    }
-    /**
-     * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
-     * @param accountFilter - (Optional) filter to narrow down the accounts returned
-     * @returns Array of AccountInfo objects in cache
-     */
-    getAllAccounts(accountFilter, correlationId) {
-        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
-    }
-    /**
-     * Gets first tenanted AccountInfo object found based on provided filters
-     */
-    getAccountInfoFilteredBy(accountFilter, correlationId) {
-        const allAccounts = this.getAllAccounts(accountFilter, correlationId);
-        if (allAccounts.length > 1) {
-            // If one or more accounts are found, prioritize accounts that have an ID token
-            const sortedAccounts = allAccounts.sort((account) => {
-                return account.idTokenClaims ? -1 : 1;
-            });
-            return sortedAccounts[0];
-        }
-        else if (allAccounts.length === 1) {
-            // If only one account is found, return it regardless of whether a matching ID token was found
-            return allAccounts[0];
-        }
-        else {
-            return null;
-        }
-    }
-    /**
-     * Returns a single matching
-     * @param accountFilter
-     * @returns
-     */
-    getBaseAccountInfo(accountFilter, correlationId) {
-        const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
-        if (accountEntities.length > 0) {
-            return accountEntities[0].getAccountInfo();
-        }
-        else {
-            return null;
-        }
-    }
-    /**
-     * Matches filtered account entities with cached ID tokens that match the tenant profile-specific account filters
-     * and builds the account info objects from the matching ID token's claims
-     * @param cachedAccounts
-     * @param accountFilter
-     * @returns Array of AccountInfo objects that match account and tenant profile filters
-     */
-    buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
-        return cachedAccounts.flatMap((accountEntity) => {
-            return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
-        });
-    }
-    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
-        let tenantedAccountInfo = null;
-        let idTokenClaims;
-        if (tenantProfileFilter) {
-            if (!this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter)) {
-                return null;
-            }
-        }
-        const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
-        if (idToken) {
-            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
-            if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
-                // ID token sourced claims don't match so this tenant profile is not a match
-                return null;
-            }
+        const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
+        if (idToken) {
+            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
+            if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
+                // ID token sourced claims don't match so this tenant profile is not a match
+                return null;
+            }
         }
         // Expand tenant profile into account info based on matching tenant profile and if available matching ID token claims
         tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
@@ -4744,10 +4418,6 @@ class CacheManager {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
-            if (!this.isAccountKey(cacheKey, accountFilter.homeAccountId)) {
-                // Don't parse value if the key doesn't match the account filters
-                return;
-            }
             const entity = this.getAccount(cacheKey, correlationId);
             // Match base account fields
             if (!entity) {
@@ -4793,64 +4463,6 @@ class CacheManager {
         });
         return matchingAccounts;
     }
-    /**
-     * Returns true if the given key matches our account key schema. Also matches homeAccountId and/or tenantId if provided
-     * @param key
-     * @param homeAccountId
-     * @param tenantId
-     * @returns
-     */
-    isAccountKey(key, homeAccountId, tenantId) {
-        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 3) {
-            // Account cache keys contain 3 items separated by '-' (each item may also contain '-')
-            return false;
-        }
-        if (homeAccountId &&
-            !key.toLowerCase().includes(homeAccountId.toLowerCase())) {
-            return false;
-        }
-        if (tenantId && !key.toLowerCase().includes(tenantId.toLowerCase())) {
-            return false;
-        }
-        // Do not check environment as aliasing can cause false negatives
-        return true;
-    }
-    /**
-     * Returns true if the given key matches our credential key schema.
-     * @param key
-     */
-    isCredentialKey(key) {
-        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 6) {
-            // Credential cache keys contain 6 items separated by '-' (each item may also contain '-')
-            return false;
-        }
-        const lowerCaseKey = key.toLowerCase();
-        // Credential keys must indicate what credential type they represent
-        if (lowerCaseKey.indexOf(CredentialType.ID_TOKEN.toLowerCase()) ===
-            -1 &&
-            lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN.toLowerCase()) ===
-                -1 &&
-            lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) === -1 &&
-            lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) ===
-                -1) {
-            return false;
-        }
-        if (lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) >
-            -1) {
-            // Refresh tokens must contain the client id or family id
-            const clientIdValidation = `${CredentialType.REFRESH_TOKEN}${Separators.CACHE_KEY_SEPARATOR}${this.clientId}${Separators.CACHE_KEY_SEPARATOR}`;
-            const familyIdValidation = `${CredentialType.REFRESH_TOKEN}${Separators.CACHE_KEY_SEPARATOR}${THE_FAMILY_ID}${Separators.CACHE_KEY_SEPARATOR}`;
-            if (lowerCaseKey.indexOf(clientIdValidation.toLowerCase()) === -1 &&
-                lowerCaseKey.indexOf(familyIdValidation.toLowerCase()) === -1) {
-                return false;
-            }
-        }
-        else if (lowerCaseKey.indexOf(this.clientId.toLowerCase()) === -1) {
-            // Tokens must contain the clientId
-            return false;
-        }
-        return true;
-    }
     /**
      * Returns whether or not the given credential entity matches the filter
      * @param entity
@@ -4975,22 +4587,26 @@ class CacheManager {
      * Removes all accounts and related tokens from cache.
      */
     removeAllAccounts(correlationId) {
-        const allAccountKeys = this.getAccountKeys();
-        allAccountKeys.forEach((cacheKey) => {
-            this.removeAccount(cacheKey, correlationId);
+        const accounts = this.getAllAccounts({}, correlationId);
+        accounts.forEach((account) => {
+            this.removeAccount(account, correlationId);
         });
     }
     /**
      * Removes the account and related tokens for a given account key
      * @param account
      */
-    removeAccount(accountKey, correlationId) {
-        const account = this.getAccount(accountKey, correlationId);
-        if (!account) {
-            return;
-        }
+    removeAccount(account, correlationId) {
         this.removeAccountContext(account, correlationId);
-        this.removeItem(accountKey, correlationId);
+        const accountKeys = this.getAccountKeys();
+        const keyFilter = (key) => {
+            return (key.includes(account.homeAccountId) &&
+                key.includes(account.environment));
+        };
+        accountKeys.filter(keyFilter).forEach((key) => {
+            this.removeItem(key, correlationId);
+            this.performanceClient.incrementFields({ accountsRemoved: 1 }, correlationId);
+        });
     }
     /**
      * Removes credentials associated with the provided account
@@ -4998,21 +4614,18 @@ class CacheManager {
      */
     removeAccountContext(account, correlationId) {
         const allTokenKeys = this.getTokenKeys();
-        const accountId = account.generateAccountId();
-        allTokenKeys.idToken.forEach((key) => {
-            if (key.indexOf(accountId) === 0) {
-                this.removeIdToken(key, correlationId);
-            }
+        const keyFilter = (key) => {
+            return (key.includes(account.homeAccountId) &&
+                key.includes(account.environment));
+        };
+        allTokenKeys.idToken.filter(keyFilter).forEach((key) => {
+            this.removeIdToken(key, correlationId);
         });
-        allTokenKeys.accessToken.forEach((key) => {
-            if (key.indexOf(accountId) === 0) {
-                this.removeAccessToken(key, correlationId);
-            }
+        allTokenKeys.accessToken.filter(keyFilter).forEach((key) => {
+            this.removeAccessToken(key, correlationId);
         });
-        allTokenKeys.refreshToken.forEach((key) => {
-            if (key.indexOf(accountId) === 0) {
-                this.removeRefreshToken(key, correlationId);
-            }
+        allTokenKeys.refreshToken.filter(keyFilter).forEach((key) => {
+            this.removeRefreshToken(key, correlationId);
         });
     }
     /**
@@ -5052,14 +4665,6 @@ class CacheManager {
         });
         return true;
     }
-    /**
-     * Retrieve AccountEntity from cache
-     * @param account
-     */
-    readAccountFromCache(account, correlationId) {
-        const accountKey = AccountEntity.generateAccountCacheKey(account);
-        return this.getAccount(accountKey, correlationId);
-    }
     /**
      * Retrieve IdTokenEntity from cache
      * @param account {AccountInfo}
@@ -5229,7 +4834,7 @@ class CacheManager {
         else if (numAccessTokens > 1) {
             this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them", correlationId);
             accessTokens.forEach((accessToken) => {
-                this.removeAccessToken(generateCredentialKey(accessToken), correlationId);
+                this.removeAccessToken(this.generateCredentialKey(accessToken), correlationId);
             });
             this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
             return null;
@@ -5670,6 +5275,12 @@ class DefaultStorageClass extends CacheManager {
     getTokenKeys() {
         throw createClientAuthError(methodNotImplemented);
     }
+    generateCredentialKey() {
+        throw createClientAuthError(methodNotImplemented);
+    }
+    generateAccountKey() {
+        throw createClientAuthError(methodNotImplemented);
+    }
 }
 
 /*
@@ -5838,24 +5449,62 @@ function buildAuthOptions(authOptions) {
         encodeExtraQueryParams: false,
         ...authOptions,
     };
-}
-/**
- * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
- * @param ClientConfiguration
- */
-function isOidcProtocolMode(config) {
-    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+}
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+function isOidcProtocolMode(config) {
+    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CcsCredentialType = {
+    HOME_ACCOUNT_ID: "home_account_id",
+    UPN: "UPN",
+};
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Function to build a client info object from server clientInfo string
+ * @param rawClientInfo
+ * @param crypto
+ */
+function buildClientInfo(rawClientInfo, base64Decode) {
+    if (!rawClientInfo) {
+        throw createClientAuthError(clientInfoEmptyError);
+    }
+    try {
+        const decodedClientInfo = base64Decode(rawClientInfo);
+        return JSON.parse(decodedClientInfo);
+    }
+    catch (e) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+}
+/**
+ * Function to build a client info object from cached homeAccountId string
+ * @param homeAccountId
+ */
+function buildClientInfoFromHomeAccountId(homeAccountId) {
+    if (!homeAccountId) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+    const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
+    return {
+        uid: clientInfoParts[0],
+        utid: clientInfoParts.length < 2
+            ? Constants.EMPTY_STRING
+            : clientInfoParts[1],
+    };
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CcsCredentialType = {
-    HOME_ACCOUNT_ID: "home_account_id",
-    UPN: "UPN",
-};
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6255,6 +5904,18 @@ function addEARParameters(parameters, jwk) {
     // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
     const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+/**
+ * Adds authorize body parameters to the request parameters
+ * @param parameters
+ * @param bodyParameters
+ */
+function addPostBodyParameters(parameters, bodyParameters) {
+    Object.entries(bodyParameters).forEach(([key, value]) => {
+        if (value) {
+            parameters.set(key, value);
+        }
+    });
 }
 
 var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
@@ -6289,6 +5950,7 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     addOboAssertion: addOboAssertion,
     addPassword: addPassword,
     addPopToken: addPopToken,
+    addPostBodyParameters: addPostBodyParameters,
     addPostLogoutRedirectUri: addPostLogoutRedirectUri,
     addPrompt: addPrompt,
     addRedirectUri: addRedirectUri,
@@ -6603,6 +6265,240 @@ class BaseClient {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+ * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+ * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+ * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+ * Downcased to match the realm case-insensitive comparison requirements
+ * @param idTokenClaims
+ * @returns
+ */
+function getTenantIdFromIdTokenClaims(idTokenClaims) {
+    if (idTokenClaims) {
+        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
+        return tenantId || null;
+    }
+    return null;
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
+ *
+ * Key : Value Schema
+ *
+ * Key: <home_account_id>-<environment>-<realm*>
+ *
+ * Value Schema:
+ * {
+ *      homeAccountId: home account identifier for the auth scheme,
+ *      environment: entity that issued the token, represented as a full host
+ *      realm: Full tenant or organizational identifier that the account belongs to
+ *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
+ *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
+ *      authorityType: Accounts authority type as a string
+ *      name: Full name for the account, including given name and family name,
+ *      lastModificationTime: last time this entity was modified in the cache
+ *      lastModificationApp:
+ *      nativeAccountId: Account identifier on the native device
+ *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
+ * }
+ * @internal
+ */
+class AccountEntity {
+    /**
+     * Returns the AccountInfo interface for this account.
+     */
+    getAccountInfo() {
+        return {
+            homeAccountId: this.homeAccountId,
+            environment: this.environment,
+            tenantId: this.realm,
+            username: this.username,
+            localAccountId: this.localAccountId,
+            loginHint: this.loginHint,
+            name: this.name,
+            nativeAccountId: this.nativeAccountId,
+            authorityType: this.authorityType,
+            // Deserialize tenant profiles array into a Map
+            tenantProfiles: new Map((this.tenantProfiles || []).map((tenantProfile) => {
+                return [tenantProfile.tenantId, tenantProfile];
+            })),
+        };
+    }
+    /**
+     * Returns true if the account entity is in single tenant format (outdated), false otherwise
+     */
+    isSingleTenant() {
+        return !this.tenantProfiles;
+    }
+    /**
+     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
+     * @param accountDetails
+     */
+    static createAccount(accountDetails, authority, base64Decode) {
+        const account = new AccountEntity();
+        if (authority.authorityType === AuthorityType.Adfs) {
+            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
+        }
+        else if (authority.protocolMode === ProtocolMode.OIDC) {
+            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        }
+        else {
+            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
+        }
+        let clientInfo;
+        if (accountDetails.clientInfo && base64Decode) {
+            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+        }
+        account.clientInfo = accountDetails.clientInfo;
+        account.homeAccountId = accountDetails.homeAccountId;
+        account.nativeAccountId = accountDetails.nativeAccountId;
+        const env = accountDetails.environment ||
+            (authority && authority.getPreferredCache());
+        if (!env) {
+            throw createClientAuthError(invalidCacheEnvironment);
+        }
+        account.environment = env;
+        // non AAD scenarios can have empty realm
+        account.realm =
+            clientInfo?.utid ||
+                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+                "";
+        // How do you account for MSA CID here?
+        account.localAccountId =
+            clientInfo?.uid ||
+                accountDetails.idTokenClaims?.oid ||
+                accountDetails.idTokenClaims?.sub ||
+                "";
+        /*
+         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+         * In most cases it will contain a single email. This field should not be relied upon if a custom
+         * policy is configured to return more than 1 email.
+         */
+        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
+            accountDetails.idTokenClaims?.upn;
+        const email = accountDetails.idTokenClaims?.emails
+            ? accountDetails.idTokenClaims.emails[0]
+            : null;
+        account.username = preferredUsername || email || "";
+        account.loginHint = accountDetails.idTokenClaims?.login_hint;
+        account.name = accountDetails.idTokenClaims?.name || "";
+        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
+        account.msGraphHost = accountDetails.msGraphHost;
+        if (accountDetails.tenantProfiles) {
+            account.tenantProfiles = accountDetails.tenantProfiles;
+        }
+        else {
+            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
+            account.tenantProfiles = [tenantProfile];
+        }
+        return account;
+    }
+    /**
+     * Creates an AccountEntity object from AccountInfo
+     * @param accountInfo
+     * @param cloudGraphHostName
+     * @param msGraphHost
+     * @returns
+     */
+    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
+        const account = new AccountEntity();
+        account.authorityType =
+            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.homeAccountId = accountInfo.homeAccountId;
+        account.localAccountId = accountInfo.localAccountId;
+        account.nativeAccountId = accountInfo.nativeAccountId;
+        account.realm = accountInfo.tenantId;
+        account.environment = accountInfo.environment;
+        account.username = accountInfo.username;
+        account.name = accountInfo.name;
+        account.loginHint = accountInfo.loginHint;
+        account.cloudGraphHostName = cloudGraphHostName;
+        account.msGraphHost = msGraphHost;
+        // Serialize tenant profiles map into an array
+        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
+        return account;
+    }
+    /**
+     * Generate HomeAccountId from server response
+     * @param serverClientInfo
+     * @param authType
+     */
+    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
+        // since ADFS/DSTS do not have tid and does not set client_info
+        if (!(authType === AuthorityType.Adfs ||
+            authType === AuthorityType.Dsts)) {
+            // for cases where there is clientInfo
+            if (serverClientInfo) {
+                try {
+                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
+                    if (clientInfo.uid && clientInfo.utid) {
+                        return `${clientInfo.uid}.${clientInfo.utid}`;
+                    }
+                }
+                catch (e) { }
+            }
+            logger.warning("No client info in response");
+        }
+        // default to "sub" claim
+        return idTokenClaims?.sub || "";
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    static isAccountEntity(entity) {
+        if (!entity) {
+            return false;
+        }
+        return (entity.hasOwnProperty("homeAccountId") &&
+            entity.hasOwnProperty("environment") &&
+            entity.hasOwnProperty("realm") &&
+            entity.hasOwnProperty("localAccountId") &&
+            entity.hasOwnProperty("username") &&
+            entity.hasOwnProperty("authorityType"));
+    }
+    /**
+     * Helper function to determine whether 2 accountInfo objects represent the same account
+     * @param accountA
+     * @param accountB
+     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
+     */
+    static accountInfoIsEqual(accountA, accountB, compareClaims) {
+        if (!accountA || !accountB) {
+            return false;
+        }
+        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
+        if (compareClaims) {
+            const accountAClaims = (accountA.idTokenClaims ||
+                {});
+            const accountBClaims = (accountB.idTokenClaims ||
+                {});
+            // issued at timestamp and nonce are expected to change each time a new id token is acquired
+            claimsMatch =
+                accountAClaims.iat === accountBClaims.iat &&
+                    accountAClaims.nonce === accountBClaims.nonce;
+        }
+        return (accountA.homeAccountId === accountB.homeAccountId &&
+            accountA.localAccountId === accountB.localAccountId &&
+            accountA.username === accountB.username &&
+            accountA.tenantId === accountB.tenantId &&
+            accountA.loginHint === accountB.loginHint &&
+            accountA.environment === accountB.environment &&
+            accountA.nativeAccountId === accountB.nativeAccountId &&
+            claimsMatch);
+    }
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7004,7 +6900,7 @@ class ResponseHandler {
             if (handlingRefreshTokenResponse &&
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
-                const key = cacheRecord.account.generateAccountKey();
+                const key = this.cacheStorage.generateAccountKey(cacheRecord.account.getAccountInfo());
                 const account = this.cacheStorage.getAccount(key, request.correlationId);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
@@ -7578,7 +7474,7 @@ class RefreshTokenClient extends BaseClient {
                 if (e.subError === badToken) {
                     // Remove bad refresh token from cache
                     this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
-                    const badRefreshTokenKey = generateCredentialKey(refreshToken);
+                    const badRefreshTokenKey = this.cacheManager.generateCredentialKey(refreshToken);
                     this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
                 }
             }
@@ -7735,7 +7631,7 @@ class SilentFlowClient extends BaseClient {
         }
         const environment = request.authority || this.authority.getPreferredCache();
         const cacheRecord = {
-            account: this.cacheManager.readAccountFromCache(request.account, request.correlationId),
+            account: this.cacheManager.getAccount(this.cacheManager.generateAccountKey(request.account), request.correlationId),
             accessToken: cachedAccessToken,
             idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId, this.performanceClient),
             refreshToken: null,
@@ -8013,7 +7909,7 @@ function extractAccountSid(account) {
     return account.idTokenClaims?.sid || null;
 }
 function extractLoginHint(account) {
-    return account.idTokenClaims?.login_hint || null;
+    return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
 var Authorize = /*#__PURE__*/Object.freeze({
@@ -8384,6 +8280,7 @@ exports.EncodingTypes = EncodingTypes;
 exports.Errors = Errors;
 exports.GrantType = GrantType;
 exports.HeaderNames = HeaderNames;
+exports.HttpMethod = HttpMethod;
 exports.HttpStatus = HttpStatus;
 exports.IntFields = IntFields;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
@@ -8444,4 +8341,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-BCM1mkg5.js.map
+//# sourceMappingURL=index-node-Dy4fVJGl.js.map