@azure/msal-browser 2.23.0 → 2.24.0-beta.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.23.0 2022-04-04 */
+/*! @azure/msal-browser v2.24.0-beta.0 2022-04-27 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -107,7 +107,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -194,7 +194,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -242,7 +242,9 @@
         IMDS_TIMEOUT: 2000,
         AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
         REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
-        KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"]
+        KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
+        TOKEN_RESPONSE_TYPE: "token",
+        ID_TOKEN_RESPONSE_TYPE: "id_token"
     };
     var OIDC_DEFAULT_SCOPES = [
         Constants.OPENID_SCOPE,
@@ -335,6 +337,7 @@
         AADServerParamKeys["FOCI"] = "foci";
         AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
         AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
+        AADServerParamKeys["NATIVE_BROKER"] = "nativebroker";
         AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
     })(AADServerParamKeys || (AADServerParamKeys = {}));
     /**
@@ -560,7 +563,7 @@
         CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
     })(CacheOutcome || (CacheOutcome = {}));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -604,7 +607,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -679,7 +682,7 @@
         }
     };
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1141,7 +1144,7 @@
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1266,7 +1269,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1446,12 +1449,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "6.2.0";
+    var version$1 = "6.3.0-beta.0";
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1472,7 +1475,7 @@
         AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
     })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1631,7 +1634,7 @@
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1886,7 +1889,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2070,7 +2073,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2108,7 +2111,7 @@
         };
     }
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2122,7 +2125,7 @@
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2149,6 +2152,7 @@
      *      lastModificationApp:
      *      oboAssertion: access token passed in as part of OBO request
      *      idTokenClaims: Object containing claims parsed from ID token
+     *      nativeAccountId: Account identifier on the native device
      * }
      */
     var AccountEntity = /** @class */ (function () {
@@ -2202,7 +2206,8 @@
                 username: this.username,
                 localAccountId: this.localAccountId,
                 name: this.name,
-                idTokenClaims: this.idTokenClaims
+                idTokenClaims: this.idTokenClaims,
+                nativeAccountId: this.nativeAccountId
             };
         };
         /**
@@ -2224,12 +2229,13 @@
          * @param idToken
          * @param policy
          */
-        AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+        AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
             var _a, _b, _c, _d, _e, _f;
             var account = new AccountEntity();
             account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
             account.clientInfo = clientInfo;
             account.homeAccountId = homeAccountId;
+            account.nativeAccountId = nativeAccountId;
             var env = environment || (authority && authority.getPreferredCache());
             if (!env) {
                 throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -2351,12 +2357,13 @@
                 (accountA.username === accountB.username) &&
                 (accountA.tenantId === accountB.tenantId) &&
                 (accountA.environment === accountB.environment) &&
+                (accountA.nativeAccountId === accountB.nativeAccountId) &&
                 claimsMatch;
         };
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2394,7 +2401,7 @@
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2762,7 +2769,7 @@
             });
         };
         /**
-         * returns a boolean if the given account is removed
+         * Removes credentials associated with the provided account
          * @param account
          */
         CacheManager.prototype.removeAccountContext = function (account) {
@@ -3236,7 +3243,7 @@
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3330,7 +3337,7 @@
         return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS }, authOptions);
     }
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3350,7 +3357,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3446,7 +3453,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3495,7 +3502,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3506,7 +3513,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3595,7 +3602,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3681,7 +3688,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3697,6 +3704,12 @@
         RequestParameterBuilder.prototype.addResponseTypeCode = function () {
             this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
         };
+        /**
+         * add response_type = token id_token
+         */
+        RequestParameterBuilder.prototype.addResponseTypeForTokenAndIdToken = function () {
+            this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.TOKEN_RESPONSE_TYPE + " " + Constants.ID_TOKEN_RESPONSE_TYPE));
+        };
         /**
          * add response_mode. defaults to query.
          * @param responseMode
@@ -3704,6 +3717,12 @@
         RequestParameterBuilder.prototype.addResponseMode = function (responseMode) {
             this.parameters.set(AADServerParamKeys.RESPONSE_MODE, encodeURIComponent((responseMode) ? responseMode : ResponseMode.QUERY));
         };
+        /**
+         * Add flag to indicate STS should attempt to use WAM if available
+         */
+        RequestParameterBuilder.prototype.addNativeBroker = function () {
+            this.parameters.set(AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
+        };
         /**
          * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
          * @param scopeSet
@@ -4043,7 +4062,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4108,7 +4127,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4158,7 +4177,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4272,7 +4291,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4339,7 +4358,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4403,7 +4422,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4419,7 +4438,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4490,7 +4509,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4691,7 +4710,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4706,6 +4725,11 @@
         function PopTokenGenerator(cryptoUtils) {
             this.cryptoUtils = cryptoUtils;
         }
+        /**
+         * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+         * @param request
+         * @returns
+         */
         PopTokenGenerator.prototype.generateCnf = function (request) {
             return __awaiter(this, void 0, void 0, function () {
                 var reqCnf;
@@ -4719,6 +4743,23 @@
                 });
             });
         };
+        /**
+         * Generates the hash of the req_cnf
+         * @param cnf
+         * @returns
+         */
+        PopTokenGenerator.prototype.generateCnfHash = function (cnf) {
+            return __awaiter(this, void 0, void 0, function () {
+                return __generator(this, function (_a) {
+                    return [2 /*return*/, this.cryptoUtils.hashString(cnf)];
+                });
+            });
+        };
+        /**
+         * Generates key_id for a SHR token request
+         * @param request
+         * @returns
+         */
         PopTokenGenerator.prototype.generateKid = function (request) {
             return __awaiter(this, void 0, void 0, function () {
                 var kidThumbprint;
@@ -4735,6 +4776,12 @@
                 });
             });
         };
+        /**
+         * Signs the POP access_token with the local generated key-pair
+         * @param accessToken
+         * @param request
+         * @returns
+         */
         PopTokenGenerator.prototype.signPopToken = function (accessToken, request) {
             var _a;
             return __awaiter(this, void 0, void 0, function () {
@@ -4748,6 +4795,14 @@
                 });
             });
         };
+        /**
+         * Utility function to generate the signed JWT for an access_token
+         * @param payload
+         * @param kid
+         * @param request
+         * @param claims
+         * @returns
+         */
         PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
             return __awaiter(this, void 0, void 0, function () {
                 var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
@@ -4766,7 +4821,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4836,7 +4891,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4872,7 +4927,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5128,7 +5183,8 @@
                                     state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                     cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
                                     msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
-                                    code: code
+                                    code: code,
+                                    fromNativeBroker: false
                                 }];
                     }
                 });
@@ -5137,7 +5193,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5168,8 +5224,12 @@
             return __awaiter(this, void 0, void 0, function () {
                 var queryString;
                 return __generator(this, function (_a) {
-                    queryString = this.createAuthCodeUrlQueryString(request);
-                    return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.createAuthCodeUrlQueryString(request)];
+                        case 1:
+                            queryString = _a.sent();
+                            return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                    }
                 });
             });
         };
@@ -5419,96 +5479,116 @@
          * @param request
          */
         AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
-            var parameterBuilder = new RequestParameterBuilder();
-            parameterBuilder.addClientId(this.config.authOptions.clientId);
-            var requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
-            parameterBuilder.addScopes(requestScopes);
-            // validate the redirectUri (to be a non null value)
-            parameterBuilder.addRedirectUri(request.redirectUri);
-            // generate the correlationId if not set by the user and add
-            var correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
-            parameterBuilder.addCorrelationId(correlationId);
-            // add response_mode. If not passed in it defaults to query.
-            parameterBuilder.addResponseMode(request.responseMode);
-            // add response_type = code
-            parameterBuilder.addResponseTypeCode();
-            // add library info parameters
-            parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-            // add client_info=1
-            parameterBuilder.addClientInfo();
-            if (request.codeChallenge && request.codeChallengeMethod) {
-                parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
-            }
-            if (request.prompt) {
-                parameterBuilder.addPrompt(request.prompt);
-            }
-            if (request.domainHint) {
-                parameterBuilder.addDomainHint(request.domainHint);
-            }
-            // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
-            if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
-                // AAD will throw if prompt=select_account is passed with an account hint
-                if (request.sid && request.prompt === PromptValue.NONE) {
-                    // SessionID is only used in silent calls
-                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
-                    parameterBuilder.addSid(request.sid);
-                }
-                else if (request.account) {
-                    var accountSid = this.extractAccountSid(request.account);
-                    // If account and loginHint are provided, we will check account first for sid before adding loginHint
-                    if (accountSid && request.prompt === PromptValue.NONE) {
-                        // SessionId is only used in silent calls
-                        this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
-                        parameterBuilder.addSid(accountSid);
-                        try {
-                            var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                            parameterBuilder.addCcsOid(clientInfo);
-                        }
-                        catch (e) {
-                            this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                        }
-                    }
-                    else if (request.loginHint) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
-                        parameterBuilder.addLoginHint(request.loginHint);
-                        parameterBuilder.addCcsUpn(request.loginHint);
-                    }
-                    else if (request.account.username) {
-                        // Fallback to account username if provided
-                        this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
-                        parameterBuilder.addLoginHint(request.account.username);
-                        try {
-                            var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                            parameterBuilder.addCcsOid(clientInfo);
-                        }
-                        catch (e) {
-                            this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                        }
+            return __awaiter(this, void 0, void 0, function () {
+                var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, cnf, cnfHash;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            parameterBuilder = new RequestParameterBuilder();
+                            parameterBuilder.addClientId(this.config.authOptions.clientId);
+                            requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
+                            parameterBuilder.addScopes(requestScopes);
+                            // validate the redirectUri (to be a non null value)
+                            parameterBuilder.addRedirectUri(request.redirectUri);
+                            correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
+                            parameterBuilder.addCorrelationId(correlationId);
+                            // add response_mode. If not passed in it defaults to query.
+                            parameterBuilder.addResponseMode(request.responseMode);
+                            // add response_type = code
+                            parameterBuilder.addResponseTypeCode();
+                            // add library info parameters
+                            parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+                            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+                            // add client_info=1
+                            parameterBuilder.addClientInfo();
+                            if (request.codeChallenge && request.codeChallengeMethod) {
+                                parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
+                            }
+                            if (request.prompt) {
+                                parameterBuilder.addPrompt(request.prompt);
+                            }
+                            if (request.domainHint) {
+                                parameterBuilder.addDomainHint(request.domainHint);
+                            }
+                            // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
+                            if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+                                // AAD will throw if prompt=select_account is passed with an account hint
+                                if (request.sid && request.prompt === PromptValue.NONE) {
+                                    // SessionID is only used in silent calls
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
+                                    parameterBuilder.addSid(request.sid);
+                                }
+                                else if (request.account) {
+                                    accountSid = this.extractAccountSid(request.account);
+                                    // If account and loginHint are provided, we will check account first for sid before adding loginHint
+                                    if (accountSid && request.prompt === PromptValue.NONE) {
+                                        // SessionId is only used in silent calls
+                                        this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
+                                        parameterBuilder.addSid(accountSid);
+                                        try {
+                                            clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                            parameterBuilder.addCcsOid(clientInfo);
+                                        }
+                                        catch (e) {
+                                            this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                        }
+                                    }
+                                    else if (request.loginHint) {
+                                        this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
+                                        parameterBuilder.addLoginHint(request.loginHint);
+                                        parameterBuilder.addCcsUpn(request.loginHint);
+                                    }
+                                    else if (request.account.username) {
+                                        // Fallback to account username if provided
+                                        this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
+                                        parameterBuilder.addLoginHint(request.account.username);
+                                        try {
+                                            clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                            parameterBuilder.addCcsOid(clientInfo);
+                                        }
+                                        catch (e) {
+                                            this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                        }
+                                    }
+                                }
+                                else if (request.loginHint) {
+                                    this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
+                                    parameterBuilder.addLoginHint(request.loginHint);
+                                    parameterBuilder.addCcsUpn(request.loginHint);
+                                }
+                            }
+                            else {
+                                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
+                            }
+                            if (request.nonce) {
+                                parameterBuilder.addNonce(request.nonce);
+                            }
+                            if (request.state) {
+                                parameterBuilder.addState(request.state);
+                            }
+                            if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
+                                parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+                            }
+                            if (request.extraQueryParameters) {
+                                parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+                            }
+                            if (!request.nativeBroker) return [3 /*break*/, 3];
+                            // signal ests that this is a WAM call
+                            parameterBuilder.addNativeBroker();
+                            if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                            popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
+                            return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
+                        case 1:
+                            cnf = _a.sent();
+                            return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
+                        case 2:
+                            cnfHash = _a.sent();
+                            parameterBuilder.addPopToken(cnfHash);
+                            _a.label = 3;
+                        case 3: return [2 /*return*/, parameterBuilder.createQueryString()];
                     }
-                }
-                else if (request.loginHint) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
-                    parameterBuilder.addLoginHint(request.loginHint);
-                    parameterBuilder.addCcsUpn(request.loginHint);
-                }
-            }
-            else {
-                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
-            }
-            if (request.nonce) {
-                parameterBuilder.addNonce(request.nonce);
-            }
-            if (request.state) {
-                parameterBuilder.addState(request.state);
-            }
-            if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
-                parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
-            }
-            if (request.extraQueryParameters) {
-                parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
-            }
-            return parameterBuilder.createQueryString();
+                });
+            });
         };
         /**
          * This API validates the `EndSessionRequest` and creates a URL
@@ -5550,7 +5630,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5762,7 +5842,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5878,7 +5958,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5889,7 +5969,7 @@
             response.hasOwnProperty("issuer"));
     }
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5903,7 +5983,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5978,7 +6058,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5988,7 +6068,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6110,7 +6190,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6700,7 +6780,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6761,7 +6841,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6792,7 +6872,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6820,7 +6900,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6837,7 +6917,7 @@
         }
     };
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6896,7 +6976,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7058,7 +7138,7 @@
         return ServerTelemetryManager;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7091,6 +7171,11 @@
          * Internal API for acquireTokenSilent.
          */
         PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
+        /**
+         * acquireTokenPopup (msal-browser).
+         * Used to acquire a new access token interactively through pop ups
+         */
+        PerformanceEvents["AcquireTokenPopup"] = "acquireTokenPopup";
         /**
          * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
          * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
@@ -7126,6 +7211,16 @@
          * Used to load authority metadata for a request.
          */
         PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
+        /**
+         * acquireToken APIs in msal-browser.
+         * Used to make an /authorize endpoint call with native brokering enabled.
+         */
+        PerformanceEvents["FetchAccountIdWithNativeBroker"] = "fetchAccountIdWithNativeBroker";
+        /**
+         * acquireToken API in NativeInteractionClient class (msal-browser).
+         * Used to acquire a token from Native component when native brokering is enabled.
+         */
+        PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
     })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
     /**
      * State of the performance event.
@@ -7140,7 +7235,7 @@
         PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
     })(PerformanceEventStatus || (PerformanceEventStatus = {}));
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7410,7 +7505,7 @@
         return PerformanceClient;
     }());
 
-    /*! @azure/msal-common v6.2.0 2022-04-04 */
+    /*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7479,6 +7574,17 @@
          */
         MSAL_SKU: "msal.js.browser",
     };
+    var NativeConstants = {
+        CHANNEL_ID: "53ee284d-920a-4b59-9d30-a60315b26836",
+        PREFERRED_EXTENSION_ID: "ppnbnpeolgkicgegkbkbjmhlideopiji"
+    };
+    var NativeExtensionMethod;
+    (function (NativeExtensionMethod) {
+        NativeExtensionMethod["HandshakeRequest"] = "Handshake";
+        NativeExtensionMethod["HandshakeResponse"] = "HandshakeResponse";
+        NativeExtensionMethod["GetToken"] = "GetToken";
+        NativeExtensionMethod["Response"] = "Response";
+    })(NativeExtensionMethod || (NativeExtensionMethod = {}));
     exports.BrowserCacheLocation = void 0;
     (function (BrowserCacheLocation) {
         BrowserCacheLocation["LocalStorage"] = "localStorage";
@@ -7511,6 +7617,7 @@
         TemporaryCacheKeys["INTERACTION_STATUS_KEY"] = "interaction.status";
         TemporaryCacheKeys["CCS_CREDENTIAL"] = "ccs.credential";
         TemporaryCacheKeys["CORRELATION_ID"] = "request.correlationId";
+        TemporaryCacheKeys["NATIVE_REQUEST"] = "request.native";
     })(exports.TemporaryCacheKeys || (exports.TemporaryCacheKeys = {}));
     /**
      * Cache keys stored in-memory
@@ -8129,9 +8236,37 @@
             code: "auth_code_required",
             desc: "An authorization code must be provided (as the `code` property on the request) to this flow."
         },
+        authCodeOrNativeAccountRequired: {
+            code: "auth_code_or_nativeAccountId_required",
+            desc: "An authorization code or nativeAccountId must be provided to this flow."
+        },
         databaseUnavailable: {
             code: "database_unavailable",
             desc: "IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts."
+        },
+        unableToAcquireTokenFromNativePlatform: {
+            code: "unable_to_acquire_token_from_native_platform",
+            desc: "Unable to acquire token from native platform. For a list of possible reasons visit aka.ms/msaljs/browser-errors."
+        },
+        nativeHandshakeTimeout: {
+            code: "native_handshake_timeout",
+            desc: "Timed out while attempting to establish connection to browser extension"
+        },
+        nativeExtensionNotInstalled: {
+            code: "native_extension_not_installed",
+            desc: "Native extension is not installed. If you think this is a mistake call the initialize function."
+        },
+        nativeConnectionNotEstablished: {
+            code: "native_connection_not_established",
+            desc: "Connection to native platform has not been established. Please install a compatible browser extension and run initialize(). For more please visit aka.ms/msaljs/browser-errors."
+        },
+        nativeBrokerCalledBeforeInitialize: {
+            code: "native_broker_called_before_initialize",
+            desc: "You must call and await the initialize function before attempting to call any other MSAL API when native brokering is enabled. For more please visit aka.ms/msaljs/browser-errors."
+        },
+        nativePromptNotSupported: {
+            code: "native_prompt_not_supported",
+            desc: "The provided prompt is not supported by the native platform. This request should be routed to the web based flow."
         }
     };
     /**
@@ -8371,12 +8506,56 @@
         BrowserAuthError.createAuthCodeRequiredError = function () {
             return new BrowserAuthError(BrowserAuthErrorMessage.authCodeRequired.code, BrowserAuthErrorMessage.authCodeRequired.desc);
         };
+        /**
+         * Create an error when an authorization code or native account ID is required but not provided
+         */
+        BrowserAuthError.createAuthCodeOrNativeAccountIdRequiredError = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.authCodeOrNativeAccountRequired.code, BrowserAuthErrorMessage.authCodeOrNativeAccountRequired.desc);
+        };
         /**
          * Create an error when IndexedDB is unavailable
          */
         BrowserAuthError.createDatabaseUnavailableError = function () {
             return new BrowserAuthError(BrowserAuthErrorMessage.databaseUnavailable.code, BrowserAuthErrorMessage.databaseUnavailable.desc);
         };
+        /**
+         * Create an error when native token acquisition is not possible
+         */
+        BrowserAuthError.createUnableToAcquireTokenFromNativePlatformError = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.unableToAcquireTokenFromNativePlatform.code, BrowserAuthErrorMessage.unableToAcquireTokenFromNativePlatform.desc);
+        };
+        /**
+         * Create an error thrown when Handshake with browser extension times out
+         */
+        BrowserAuthError.createNativeHandshakeTimeoutError = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.nativeHandshakeTimeout.code, BrowserAuthErrorMessage.nativeHandshakeTimeout.desc);
+        };
+        /**
+         * Create an error thrown when browser extension is not installed
+         */
+        BrowserAuthError.createNativeExtensionNotInstalledError = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.nativeExtensionNotInstalled.code, BrowserAuthErrorMessage.nativeExtensionNotInstalled.desc);
+        };
+        /**
+         * Create an error when native connection has not been established
+         * @returns
+         */
+        BrowserAuthError.createNativeConnectionNotEstablishedError = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.nativeConnectionNotEstablished.code, BrowserAuthErrorMessage.nativeConnectionNotEstablished.desc);
+        };
+        /**
+         * Create an error thrown when the initialize function hasn't been called
+         */
+        BrowserAuthError.createNativeBrokerCalledBeforeInitialize = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.nativeBrokerCalledBeforeInitialize.code, BrowserAuthErrorMessage.nativeBrokerCalledBeforeInitialize.desc);
+        };
+        /**
+         * Create an error thrown when requesting a token directly from the native platform with an unsupported prompt parameter e.g. select_account, login or create
+         * These requests must go through eSTS to ensure eSTS is aware of the new account
+         */
+        BrowserAuthError.createNativePromptParameterNotSupportedError = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.nativePromptNotSupported.code, BrowserAuthErrorMessage.nativePromptNotSupported.desc);
+        };
         return BrowserAuthError;
     }(AuthError));
 
@@ -10022,6 +10201,30 @@
                 return true;
             });
         };
+        /**
+         * Checks the cache for accounts matching loginHint or SID
+         * @param loginHint
+         * @param sid
+         */
+        BrowserCacheManager.prototype.getAccountInfoByHints = function (loginHint, sid) {
+            var matchingAccounts = this.getAllAccounts().filter(function (accountInfo) {
+                if (sid) {
+                    var accountSid = accountInfo.idTokenClaims && accountInfo.idTokenClaims["sid"];
+                    return sid === accountSid;
+                }
+                if (loginHint) {
+                    return loginHint === accountInfo.username;
+                }
+                return false;
+            });
+            if (matchingAccounts.length === 1) {
+                return matchingAccounts[0];
+            }
+            else if (matchingAccounts.length > 1) {
+                throw ClientAuthError.createMultipleMatchingAccountsInCacheError();
+            }
+            return null;
+        };
         /**
          * fetch throttling entity from the platform cache
          * @param throttlingCacheKey
@@ -10339,6 +10542,7 @@
             this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.URL_HASH));
             this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.CORRELATION_ID));
             this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.CCS_CREDENTIAL));
+            this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.NATIVE_REQUEST));
             this.setInteractionInProgress(false);
         };
         /**
@@ -10416,6 +10620,23 @@
             }
             return parsedRequest;
         };
+        /**
+         * Gets cached native request for redirect flows
+         */
+        BrowserCacheManager.prototype.getCachedNativeRequest = function () {
+            this.logger.trace("BrowserCacheManager.getCachedNativeRequest called");
+            var cachedRequest = this.getTemporaryCache(exports.TemporaryCacheKeys.NATIVE_REQUEST, true);
+            if (!cachedRequest) {
+                this.logger.trace("BrowserCacheManager.getCachedNativeRequest: No cached native request found");
+                return null;
+            }
+            var parsedRequest = this.validateAndParseJson(cachedRequest);
+            if (!parsedRequest) {
+                this.logger.error("BrowserCacheManager.getCachedNativeRequest: Unable to parse native request");
+                return null;
+            }
+            return parsedRequest;
+        };
         BrowserCacheManager.prototype.isInteractionInProgress = function (matchClientId) {
             var clientId = this.getInteractionInProgress();
             if (matchClientId) {
@@ -10879,6 +11100,16 @@
                 throw BrowserAuthError.createNonBrowserEnvironmentError();
             }
         };
+        /**
+         * Throws error if native brokering is enabled but initialize hasn't been called
+         * @param allowNativeBroker
+         * @param initialized
+         */
+        BrowserUtils.blockNativeBrokerCalledBeforeInitialized = function (allowNativeBroker, initialized) {
+            if (allowNativeBroker && !initialized) {
+                throw BrowserAuthError.createNativeBrokerCalledBeforeInitialize();
+            }
+        };
         /**
          * Returns boolean of whether current browser is an Internet Explorer or Edge browser.
          */
@@ -10946,6 +11177,7 @@
     var DEFAULT_POPUP_TIMEOUT_MS = 60000;
     var DEFAULT_IFRAME_TIMEOUT_MS = 6000;
     var DEFAULT_REDIRECT_TIMEOUT_MS = 30000;
+    var DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS = 2000;
     /**
      * MSAL function that sets the default options when not explicitly configured from app developer
      *
@@ -10990,7 +11222,7 @@
         // Default system options for browser
         var DEFAULT_BROWSER_SYSTEM_OPTIONS = __assign$1(__assign$1({}, DEFAULT_SYSTEM_OPTIONS), { loggerOptions: DEFAULT_LOGGER_OPTIONS, networkClient: isBrowserEnvironment ? BrowserUtils.getBrowserNetworkClient() : StubbedNetworkModule, navigationClient: new NavigationClient(), loadFrameTimeout: 0, 
             // If loadFrameTimeout is provided, use that as default.
-            windowHashTimeout: (userInputSystem && userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem && userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false });
+            windowHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false, allowNativeBroker: false, nativeBrokerHandshakeTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.nativeBrokerHandshakeTimeout) || DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS });
         var DEFAULT_TELEMETRY_OPTIONS = {
             application: {
                 appName: Constants.EMPTY_STRING,
@@ -11008,7 +11240,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.23.0";
+    var version = "2.24.0-beta.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11016,6 +11248,8 @@
      */
     exports.EventType = void 0;
     (function (EventType) {
+        EventType["INITIALIZE_START"] = "msal:initializeStart";
+        EventType["INITIALIZE_END"] = "msal:initializeEnd";
         EventType["ACCOUNT_ADDED"] = "msal:accountAdded";
         EventType["ACCOUNT_REMOVED"] = "msal:accountRemoved";
         EventType["LOGIN_START"] = "msal:loginStart";
@@ -11165,12 +11399,14 @@
      * Licensed under the MIT License.
      */
     var BaseInteractionClient = /** @class */ (function () {
-        function BaseInteractionClient(config, storageImpl, browserCrypto, logger, eventHandler, performanceClient, correlationId) {
+        function BaseInteractionClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) {
             this.config = config;
             this.browserStorage = storageImpl;
             this.browserCrypto = browserCrypto;
             this.networkClient = this.config.system.networkClient;
             this.eventHandler = eventHandler;
+            this.navigationClient = navigationClient;
+            this.nativeMessageHandler = nativeMessageHandler;
             this.correlationId = correlationId || this.browserCrypto.createNewGuid();
             this.logger = logger.clone(BrowserConstants.MSAL_SKU, version, this.correlationId);
             this.performanceClient = performanceClient;
@@ -11293,6 +11529,36 @@
             };
             return new ServerTelemetryManager(telemetryPayload, this.browserStorage);
         };
+        /**
+         * Used to get a discovered version of the default authority.
+         * @param requestAuthority
+         * @param requestCorrelationId
+         */
+        BaseInteractionClient.prototype.getDiscoveredAuthority = function (requestAuthority) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var authorityOptions;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.logger.verbose("getDiscoveredAuthority called");
+                            authorityOptions = {
+                                protocolMode: this.config.auth.protocolMode,
+                                knownAuthorities: this.config.auth.knownAuthorities,
+                                cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
+                                authorityMetadata: this.config.auth.authorityMetadata
+                            };
+                            if (!requestAuthority) return [3 /*break*/, 2];
+                            this.logger.verbose("Creating discovered authority with request authority");
+                            return [4 /*yield*/, AuthorityFactory.createDiscoveredInstance(requestAuthority, this.config.system.networkClient, this.browserStorage, authorityOptions)];
+                        case 1: return [2 /*return*/, _a.sent()];
+                        case 2:
+                            this.logger.verbose("Creating discovered authority with configured authority");
+                            return [4 /*yield*/, AuthorityFactory.createDiscoveredInstance(this.config.auth.authority, this.config.system.networkClient, this.browserStorage, authorityOptions)];
+                        case 3: return [2 /*return*/, _a.sent()];
+                    }
+                });
+            });
+        };
         return BaseInteractionClient;
     }());
 
@@ -11305,10 +11571,8 @@
      */
     var StandardInteractionClient = /** @class */ (function (_super) {
         __extends$1(StandardInteractionClient, _super);
-        function StandardInteractionClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId) {
-            var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, performanceClient, correlationId) || this;
-            _this.navigationClient = navigationClient;
-            return _this;
+        function StandardInteractionClient() {
+            return _super !== null && _super.apply(this, arguments) || this;
         }
         /**
          * Generates an auth code request tied to the url request.
@@ -11338,7 +11602,7 @@
          */
         StandardInteractionClient.prototype.initializeLogoutRequest = function (logoutRequest) {
             this.logger.verbose("initializeLogoutRequest called", logoutRequest === null || logoutRequest === void 0 ? void 0 : logoutRequest.correlationId);
-            var validLogoutRequest = __assign$1({ correlationId: this.browserCrypto.createNewGuid() }, logoutRequest);
+            var validLogoutRequest = __assign$1({ correlationId: this.correlationId || this.browserCrypto.createNewGuid() }, logoutRequest);
             /**
              * Set logout_hint to be login_hint from ID Token Claims if present
              * and logoutHint attribute wasn't manually set in logout request
@@ -11480,10 +11744,8 @@
          * @param hash
          * @param interactionType
          */
-        StandardInteractionClient.prototype.validateAndExtractStateFromHash = function (hash, interactionType, requestCorrelationId) {
+        StandardInteractionClient.prototype.validateAndExtractStateFromHash = function (serverParams, interactionType, requestCorrelationId) {
             this.logger.verbose("validateAndExtractStateFromHash called", requestCorrelationId);
-            // Deserialize hash fragment response parameters.
-            var serverParams = UrlString.getDeserializedHash(hash);
             if (!serverParams.state) {
                 throw BrowserAuthError.createHashDoesNotContainStateError();
             }
@@ -11788,7 +12050,18 @@
                     if (!requestState) {
                         throw ClientAuthError.createStateNotFoundError("Cached State");
                     }
-                    authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                    try {
+                        authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                    }
+                    catch (e) {
+                        if (e instanceof ServerError && e.subError === BrowserAuthErrorMessage.userCancelledError.code) {
+                            // Translate server error caused by user closing native prompt to corresponding first class MSAL error
+                            throw BrowserAuthError.createUserCancelledError();
+                        }
+                        else {
+                            throw e;
+                        }
+                    }
                     return [2 /*return*/, this.handleCodeResponseFromServer(authCodeResponse, state, authority, networkModule)];
                 });
             });
@@ -11952,56 +12225,689 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    var PopupClient = /** @class */ (function (_super) {
-        __extends$1(PopupClient, _super);
-        function PopupClient() {
-            return _super !== null && _super.apply(this, arguments) || this;
+    var NativeStatusCode;
+    (function (NativeStatusCode) {
+        NativeStatusCode["USER_INTERACTION_REQUIRED"] = "USER_INTERACTION_REQUIRED";
+        NativeStatusCode["USER_CANCEL"] = "USER_CANCEL";
+        NativeStatusCode["NO_NETWORK"] = "NO_NETWORK";
+        NativeStatusCode["TRANSIENT_ERROR"] = "TRANSIENT_ERROR";
+        NativeStatusCode["PERSISTENT_ERROR"] = "PERSISTENT_ERROR";
+    })(NativeStatusCode || (NativeStatusCode = {}));
+    var NativeAuthErrorMessage = {
+        extensionError: {
+            code: "ContentError"
+        },
+        userSwitch: {
+            code: "user_switch",
+            desc: "User attempted to switch accounts in the native broker, which is not allowed. All new accounts must sign-in through the standard web flow first, please try again."
+        }
+    };
+    var NativeAuthError = /** @class */ (function (_super) {
+        __extends$1(NativeAuthError, _super);
+        function NativeAuthError(errorCode, description, ext) {
+            var _this = _super.call(this, errorCode, description) || this;
+            Object.setPrototypeOf(_this, NativeAuthError.prototype);
+            _this.name = "NativeAuthError";
+            _this.ext = ext;
+            return _this;
         }
         /**
-         * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
-         * @param request
+         * These errors should result in a fallback to the 'standard' browser based auth flow.
          */
-        PopupClient.prototype.acquireToken = function (request) {
-            try {
-                var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority, this.correlationId);
-                var popupWindowAttributes = request.popupWindowAttributes || {};
-                // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
-                if (this.config.system.asyncPopups) {
-                    this.logger.verbose("asyncPopups set to true, acquiring token");
-                    // Passes on popup position and dimensions if in request
-                    return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes);
-                }
-                else {
-                    // asyncPopups flag is set to false. Opens popup before acquiring token.
-                    this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
-                    var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
-                    return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes, popup);
-                }
+        NativeAuthError.prototype.isFatal = function () {
+            if (this.ext && this.ext.status && this.ext.status === NativeStatusCode.PERSISTENT_ERROR) {
+                return true;
             }
-            catch (e) {
-                return Promise.reject(e);
+            switch (this.errorCode) {
+                case NativeAuthErrorMessage.extensionError.code:
+                    return true;
+                default:
+                    return false;
             }
         };
         /**
-         * Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
-         * @param logoutRequest
+         * Create the appropriate error object based on the WAM status code.
+         * @param code
+         * @param description
+         * @param ext
+         * @returns
          */
-        PopupClient.prototype.logout = function (logoutRequest) {
-            try {
-                this.logger.verbose("logoutPopup called");
-                var validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-                var popupName = PopupUtils.generateLogoutPopupName(this.config.auth.clientId, validLogoutRequest);
-                var authority = logoutRequest && logoutRequest.authority;
-                var mainWindowRedirectUri = logoutRequest && logoutRequest.mainWindowRedirectUri;
-                var popupWindowAttributes = (logoutRequest === null || logoutRequest === void 0 ? void 0 : logoutRequest.popupWindowAttributes) || {};
-                // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
-                if (this.config.system.asyncPopups) {
-                    this.logger.verbose("asyncPopups set to true");
-                    // Passes on popup position and dimensions if in request
-                    return this.logoutPopupAsync(validLogoutRequest, popupName, popupWindowAttributes, authority, undefined, mainWindowRedirectUri);
+        NativeAuthError.createError = function (code, description, ext) {
+            if (ext && ext.status) {
+                switch (ext.status) {
+                    case NativeStatusCode.USER_INTERACTION_REQUIRED:
+                        return new InteractionRequiredAuthError(code, description);
+                    case NativeStatusCode.USER_CANCEL:
+                        return BrowserAuthError.createUserCancelledError();
+                    case NativeStatusCode.NO_NETWORK:
+                        return BrowserAuthError.createNoNetworkConnectivityError();
                 }
-                else {
-                    // asyncPopups flag is set to false. Opens popup before logging out.
+            }
+            return new NativeAuthError(code, description, ext);
+        };
+        /**
+         * Creates user switch error when the user chooses a different account in the native broker prompt
+         * @returns
+         */
+        NativeAuthError.createUserSwitchError = function () {
+            return new NativeAuthError(NativeAuthErrorMessage.userSwitch.code, NativeAuthErrorMessage.userSwitch.desc);
+        };
+        return NativeAuthError;
+    }(AuthError));
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var NativeInteractionClient = /** @class */ (function (_super) {
+        __extends$1(NativeInteractionClient, _super);
+        function NativeInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, correlationId) {
+            var _this = _super.call(this, config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId) || this;
+            _this.apiId = apiId;
+            _this.accountId = accountId;
+            _this.nativeMessageHandler = provider;
+            return _this;
+        }
+        /**
+         * Acquire token from native platform via browser extension
+         * @param request
+         */
+        NativeInteractionClient.prototype.acquireToken = function (request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var nativeATMeasurement, nativeRequest, messageBody, reqTimestamp, response, validatedResponse;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.logger.trace("NativeInteractionClient - acquireToken called.");
+                            nativeATMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+                            return [4 /*yield*/, this.initializeNativeRequest(request)];
+                        case 1:
+                            nativeRequest = _a.sent();
+                            messageBody = {
+                                method: NativeExtensionMethod.GetToken,
+                                request: nativeRequest
+                            };
+                            reqTimestamp = TimeUtils.nowSeconds();
+                            return [4 /*yield*/, this.nativeMessageHandler.sendMessage(messageBody)];
+                        case 2:
+                            response = _a.sent();
+                            validatedResponse = this.validateNativeResponse(response);
+                            return [2 /*return*/, this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
+                                    .then(function (result) {
+                                    nativeATMeasurement.endMeasurement({
+                                        success: true,
+                                        isNativeBroker: true
+                                    });
+                                    return result;
+                                })
+                                    .catch(function (error) {
+                                    nativeATMeasurement.endMeasurement({
+                                        success: false,
+                                        isNativeBroker: true
+                                    });
+                                    throw error;
+                                })];
+                    }
+                });
+            });
+        };
+        /**
+         * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
+         * @param request
+         */
+        NativeInteractionClient.prototype.acquireTokenRedirect = function (request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var nativeRequest, messageBody, response, e_1, navigationOptions, redirectUri;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
+                            return [4 /*yield*/, this.initializeNativeRequest(request)];
+                        case 1:
+                            nativeRequest = _a.sent();
+                            messageBody = {
+                                method: NativeExtensionMethod.GetToken,
+                                request: nativeRequest
+                            };
+                            _a.label = 2;
+                        case 2:
+                            _a.trys.push([2, 4, , 5]);
+                            return [4 /*yield*/, this.nativeMessageHandler.sendMessage(messageBody)];
+                        case 3:
+                            response = _a.sent();
+                            this.validateNativeResponse(response);
+                            return [3 /*break*/, 5];
+                        case 4:
+                            e_1 = _a.sent();
+                            // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
+                            if (e_1 instanceof NativeAuthError && e_1.isFatal()) {
+                                throw e_1;
+                            }
+                            return [3 /*break*/, 5];
+                        case 5:
+                            this.browserStorage.setTemporaryCache(exports.TemporaryCacheKeys.NATIVE_REQUEST, JSON.stringify(nativeRequest), true);
+                            navigationOptions = {
+                                apiId: exports.ApiId.acquireTokenRedirect,
+                                timeout: this.config.system.redirectNavigationTimeout,
+                                noHistory: false
+                            };
+                            redirectUri = this.config.auth.navigateToLoginRequestUrl ? window.location.href : this.getRedirectUri(request.redirectUri);
+                            return [4 /*yield*/, this.navigationClient.navigateExternal(redirectUri, navigationOptions)];
+                        case 6:
+                            _a.sent(); // Need to treat this as external to ensure handleRedirectPromise is run again
+                            return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * If the previous page called native platform for a token using redirect APIs, send the same request again and return the response
+         */
+        NativeInteractionClient.prototype.handleRedirectPromise = function () {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var cachedRequest, messageBody, reqTimestamp, response, result, e_2;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.logger.trace("NativeInteractionClient - handleRedirectPromise called.");
+                            if (!this.browserStorage.isInteractionInProgress(true)) {
+                                this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
+                                return [2 /*return*/, null];
+                            }
+                            cachedRequest = this.browserStorage.getCachedNativeRequest();
+                            if (!cachedRequest) {
+                                this.logger.verbose("NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null.");
+                                return [2 /*return*/, null];
+                            }
+                            this.browserStorage.removeItem(this.browserStorage.generateCacheKey(exports.TemporaryCacheKeys.NATIVE_REQUEST));
+                            messageBody = {
+                                method: NativeExtensionMethod.GetToken,
+                                request: cachedRequest
+                            };
+                            reqTimestamp = TimeUtils.nowSeconds();
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.");
+                            return [4 /*yield*/, this.nativeMessageHandler.sendMessage(messageBody)];
+                        case 2:
+                            response = _a.sent();
+                            this.validateNativeResponse(response);
+                            result = this.handleNativeResponse(response, cachedRequest, reqTimestamp);
+                            this.browserStorage.setInteractionInProgress(false);
+                            return [2 /*return*/, result];
+                        case 3:
+                            e_2 = _a.sent();
+                            this.browserStorage.setInteractionInProgress(false);
+                            throw e_2;
+                        case 4: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Logout from native platform via browser extension
+         * @param request
+         */
+        NativeInteractionClient.prototype.logout = function () {
+            this.logger.trace("NativeInteractionClient - logout called.");
+            return Promise.reject("Logout not implemented yet");
+        };
+        /**
+         * Transform response from native platform into AuthenticationResult object which will be returned to the end user
+         * @param response
+         * @param request
+         * @param reqTimestamp
+         */
+        NativeInteractionClient.prototype.handleNativeResponse = function (response, request, reqTimestamp) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var idTokenObj, authority, authorityPreferredCache, homeAccountIdentifier, accountEntity, responseScopes, accountProperties, uid, tid, responseAccessToken, responseTokenType, _a, popTokenGenerator, shrParameters, result;
+                var _this = this;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            this.logger.trace("NativeInteractionClient - handleNativeResponse called.");
+                            if (response.account.id !== request.accountId) {
+                                // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
+                                throw NativeAuthError.createUserSwitchError();
+                            }
+                            idTokenObj = new AuthToken(response.id_token || Constants.EMPTY_STRING, this.browserCrypto);
+                            return [4 /*yield*/, this.getDiscoveredAuthority(request.authority)];
+                        case 1:
+                            authority = _b.sent();
+                            authorityPreferredCache = authority.getPreferredCache();
+                            homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj);
+                            accountEntity = AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, undefined, authorityPreferredCache, response.account.id);
+                            this.browserStorage.setAccount(accountEntity);
+                            responseScopes = response.scopes ? ScopeSet.fromString(response.scopes) : ScopeSet.fromString(request.scopes);
+                            accountProperties = response.account.properties || {};
+                            uid = accountProperties["UID"] || idTokenObj.claims.oid || idTokenObj.claims.sub || Constants.EMPTY_STRING;
+                            tid = accountProperties["TenantId"] || idTokenObj.claims.tid || Constants.EMPTY_STRING;
+                            responseTokenType = exports.AuthenticationScheme.BEARER;
+                            _a = request.token_type;
+                            switch (_a) {
+                                case exports.AuthenticationScheme.POP: return [3 /*break*/, 2];
+                            }
+                            return [3 /*break*/, 4];
+                        case 2:
+                            // Set the token type to POP in the response
+                            responseTokenType = exports.AuthenticationScheme.POP;
+                            // Check if native layer returned an SHR token
+                            if (response.shr) {
+                                this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer");
+                                responseAccessToken = response.shr;
+                                return [3 /*break*/, 5];
+                            }
+                            popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+                            shrParameters = {
+                                resourceRequestMethod: request.resourceRequestMethod,
+                                resourceRequestUri: request.resourceRequestUri,
+                                shrClaims: request.shrClaims,
+                                shrNonce: request.shrNonce
+                            };
+                            return [4 /*yield*/, popTokenGenerator.signPopToken(response.access_token, shrParameters)];
+                        case 3:
+                            responseAccessToken = _b.sent();
+                            return [3 /*break*/, 5];
+                        case 4:
+                            {
+                                responseAccessToken = response.access_token;
+                            }
+                            _b.label = 5;
+                        case 5:
+                            result = {
+                                authority: authority.canonicalAuthority,
+                                uniqueId: uid,
+                                tenantId: tid,
+                                scopes: responseScopes.asArray(),
+                                account: accountEntity.getAccountInfo(),
+                                idToken: response.id_token,
+                                idTokenClaims: idTokenObj.claims,
+                                accessToken: responseAccessToken,
+                                fromCache: false,
+                                expiresOn: new Date(Number(reqTimestamp + response.expires_in) * 1000),
+                                tokenType: responseTokenType,
+                                correlationId: this.correlationId,
+                                state: response.state,
+                                fromNativeBroker: true
+                            };
+                            // Remove any existing cached tokens for this account
+                            this.browserStorage.removeAccountContext(accountEntity).catch(function (e) {
+                                _this.logger.error("Error occurred while removing account context from browser storage. " + e);
+                            });
+                            return [2 /*return*/, result];
+                    }
+                });
+            });
+        };
+        /**
+         * Validates native platform response before processing
+         * @param response
+         */
+        NativeInteractionClient.prototype.validateNativeResponse = function (response) {
+            if (response.hasOwnProperty("access_token") &&
+                response.hasOwnProperty("id_token") &&
+                response.hasOwnProperty("client_info") &&
+                response.hasOwnProperty("account") &&
+                response.hasOwnProperty("scopes") &&
+                response.hasOwnProperty("expires_in")) {
+                return response;
+            }
+            else {
+                throw NativeAuthError.createUnexpectedError("Response missing expected properties.");
+            }
+        };
+        /**
+         * Translates developer provided request object into NativeRequest object
+         * @param request
+         */
+        NativeInteractionClient.prototype.initializeNativeRequest = function (request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var authority, canonicalAuthority, scopes, scopeSet, instanceAware, validatedRequest, shrParameters, popTokenGenerator, cnf, _a;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            this.logger.trace("NativeInteractionClient - initializeNativeRequest called");
+                            authority = request.authority || this.config.auth.authority;
+                            canonicalAuthority = new UrlString(authority);
+                            canonicalAuthority.validateAsUri();
+                            scopes = request && request.scopes || [];
+                            scopeSet = new ScopeSet(scopes);
+                            scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
+                            if (request.prompt) {
+                                switch (request.prompt) {
+                                    case PromptValue.NONE:
+                                    case PromptValue.CONSENT:
+                                        this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
+                                        break;
+                                    default:
+                                        this.logger.trace("initializeNativeRequest: prompt = " + request.prompt + " is not compatible with native flow");
+                                        throw BrowserAuthError.createNativePromptParameterNotSupportedError();
+                                }
+                            }
+                            instanceAware = !!(request.extraQueryParameters && request.extraQueryParameters.instance_aware);
+                            validatedRequest = __assign$1(__assign$1({}, request), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scopes: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), correlationId: this.correlationId, instance_aware: instanceAware, token_type: request.authenticationScheme, extraParameters: __assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), extendedExpiryToken: false // Make this configurable?
+                             });
+                            if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                            shrParameters = {
+                                resourceRequestUri: request.resourceRequestUri,
+                                resourceRequestMethod: request.resourceRequestMethod,
+                                shrClaims: request.shrClaims,
+                                shrNonce: request.shrNonce
+                            };
+                            popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+                            return [4 /*yield*/, popTokenGenerator.generateCnf(shrParameters)];
+                        case 1:
+                            cnf = _b.sent();
+                            // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
+                            _a = validatedRequest;
+                            return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
+                        case 2:
+                            // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
+                            _a.req_cnf = _b.sent();
+                            _b.label = 3;
+                        case 3:
+                            if (this.apiId === exports.ApiId.ssoSilent || this.apiId === exports.ApiId.acquireTokenSilent_silentFlow) {
+                                validatedRequest.prompt = PromptValue.NONE;
+                            }
+                            return [2 /*return*/, validatedRequest];
+                    }
+                });
+            });
+        };
+        return NativeInteractionClient;
+    }(BaseInteractionClient));
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var NativeMessageHandler = /** @class */ (function () {
+        function NativeMessageHandler(logger, handshakeTimeoutMs, extensionId) {
+            this.logger = logger;
+            this.handshakeTimeoutMs = handshakeTimeoutMs;
+            this.extensionId = extensionId;
+            this.resolvers = new Map(); // Used for non-handshake messages
+            this.handshakeResolvers = new Map(); // Used for handshake messages
+            this.responseId = 0;
+            this.messageChannel = new MessageChannel();
+            this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
+        }
+        /**
+         * Sends a given message to the extension and resolves with the extension response
+         * @param body
+         */
+        NativeMessageHandler.prototype.sendMessage = function (body) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var req;
+                var _this = this;
+                return __generator$1(this, function (_a) {
+                    this.logger.trace("NativeMessageHandler - sendMessage called.");
+                    req = {
+                        channel: NativeConstants.CHANNEL_ID,
+                        extensionId: this.extensionId,
+                        responseId: this.responseId++,
+                        body: body
+                    };
+                    this.logger.trace("NativeMessageHandler - Sending request to browser extension");
+                    this.logger.tracePii("NativeMessageHandler - Sending request to browser extension: " + JSON.stringify(req));
+                    this.messageChannel.port1.postMessage(req);
+                    return [2 /*return*/, new Promise(function (resolve, reject) {
+                            _this.resolvers.set(req.responseId, { resolve: resolve, reject: reject });
+                        })];
+                });
+            });
+        };
+        /**
+         * Returns an instance of the MessageHandler that has successfully established a connection with an extension
+         * @param logger
+         * @param handshakeTimeoutMs
+         */
+        NativeMessageHandler.createProvider = function (logger, handshakeTimeoutMs) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var preferredProvider, backupProvider;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            logger.trace("NativeMessageHandler - createProvider called.");
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 5]);
+                            preferredProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, NativeConstants.PREFERRED_EXTENSION_ID);
+                            return [4 /*yield*/, preferredProvider.sendHandshakeRequest()];
+                        case 2:
+                            _a.sent();
+                            return [2 /*return*/, preferredProvider];
+                        case 3:
+                            _a.sent();
+                            backupProvider = new NativeMessageHandler(logger, handshakeTimeoutMs);
+                            return [4 /*yield*/, backupProvider.sendHandshakeRequest()];
+                        case 4:
+                            _a.sent();
+                            return [2 /*return*/, backupProvider];
+                        case 5: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Send handshake request helper.
+         */
+        NativeMessageHandler.prototype.sendHandshakeRequest = function () {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var req;
+                var _this = this;
+                return __generator$1(this, function (_a) {
+                    this.logger.trace("NativeMessageHandler - sendHandshakeRequest called.");
+                    // Register this event listener before sending handshake
+                    window.addEventListener("message", this.windowListener, false); // false is important, because content script message processing should work first
+                    req = {
+                        channel: NativeConstants.CHANNEL_ID,
+                        extensionId: this.extensionId,
+                        responseId: this.responseId++,
+                        body: {
+                            method: NativeExtensionMethod.HandshakeRequest
+                        }
+                    };
+                    this.messageChannel.port1.onmessage = function (event) {
+                        _this.onChannelMessage(event);
+                    };
+                    window.postMessage(req, window.origin, [this.messageChannel.port2]);
+                    return [2 /*return*/, new Promise(function (resolve, reject) {
+                            _this.handshakeResolvers.set(req.responseId, { resolve: resolve, reject: reject });
+                            _this.timeoutId = window.setTimeout(function () {
+                                /*
+                                 * Throw an error if neither HandshakeResponse nor original Handshake request are received in a reasonable timeframe.
+                                 * This typically suggests an event handler stopped propagation of the Handshake request but did not respond to it on the MessageChannel port
+                                 */
+                                window.removeEventListener("message", _this.windowListener, false);
+                                _this.messageChannel.port1.close();
+                                _this.messageChannel.port2.close();
+                                reject(BrowserAuthError.createNativeHandshakeTimeoutError());
+                                _this.handshakeResolvers.delete(req.responseId);
+                            }, _this.handshakeTimeoutMs); // Use a reasonable timeout in milliseconds here
+                        })];
+                });
+            });
+        };
+        /**
+         * Invoked when a message is posted to the window. If a handshake request is received it means the extension is not installed.
+         * @param event
+         */
+        NativeMessageHandler.prototype.onWindowMessage = function (event) {
+            this.logger.trace("NativeMessageHandler - onWindowMessage called");
+            // We only accept messages from ourselves
+            if (event.source !== window) {
+                return;
+            }
+            var request = event.data;
+            if (!request.channel || request.channel !== NativeConstants.CHANNEL_ID) {
+                return;
+            }
+            if (request.extensionId && request.extensionId !== this.extensionId) {
+                return;
+            }
+            if (request.body.method === NativeExtensionMethod.HandshakeRequest) {
+                // If we receive this message back it means no extension intercepted the request, meaning no extension supporting handshake protocol is installed
+                this.logger.verbose(request.extensionId ? "Extension with id: " + request.extensionId + " not installed" : "No extension installed");
+                clearTimeout(this.timeoutId);
+                this.messageChannel.port1.close();
+                this.messageChannel.port2.close();
+                window.removeEventListener("message", this.windowListener, false);
+                var handshakeResolver = this.handshakeResolvers.get(request.responseId);
+                if (handshakeResolver) {
+                    handshakeResolver.reject(BrowserAuthError.createNativeExtensionNotInstalledError());
+                }
+            }
+        };
+        /**
+         * Invoked when a message is received from the extension on the MessageChannel port
+         * @param event
+         */
+        NativeMessageHandler.prototype.onChannelMessage = function (event) {
+            this.logger.trace("NativeMessageHandler - onChannelMessage called.");
+            var request = event.data;
+            var resolver = this.resolvers.get(request.responseId);
+            var handshakeResolver = this.handshakeResolvers.get(request.responseId);
+            try {
+                var method = request.body.method;
+                if (method === NativeExtensionMethod.Response) {
+                    if (!resolver) {
+                        return;
+                    }
+                    var response = request.body.response;
+                    this.logger.trace("NativeMessageHandler - Received response from browser extension");
+                    this.logger.tracePii("NativeMessageHandler - Received response from browser extension: " + JSON.stringify(response));
+                    if (response.status !== "Success") {
+                        resolver.reject(NativeAuthError.createError(response.code, response.description, response.ext));
+                    }
+                    else if (response.result) {
+                        if (response.result["code"] && response.result["description"]) {
+                            resolver.reject(NativeAuthError.createError(response.result["code"], response.result["description"], response.result["ext"]));
+                        }
+                        else {
+                            resolver.resolve(response.result);
+                        }
+                    }
+                    else {
+                        throw AuthError.createUnexpectedError("Event does not contain result.");
+                    }
+                    this.resolvers.delete(request.responseId);
+                }
+                else if (method === NativeExtensionMethod.HandshakeResponse) {
+                    if (!handshakeResolver) {
+                        return;
+                    }
+                    clearTimeout(this.timeoutId); // Clear setTimeout
+                    window.removeEventListener("message", this.windowListener, false); // Remove 'No extension' listener
+                    this.extensionId = request.extensionId;
+                    this.logger.verbose("NativeMessageHandler - Received HandshakeResponse from extension: " + this.extensionId);
+                    handshakeResolver.resolve();
+                    this.handshakeResolvers.delete(request.responseId);
+                }
+                // Do nothing if method is not Response or HandshakeResponse
+            }
+            catch (err) {
+                this.logger.error("Error parsing response from WAM Extension");
+                this.logger.errorPii("Error parsing response from WAM Extension: " + err.toString());
+                this.logger.errorPii("Unable to parse " + event);
+                if (resolver) {
+                    resolver.reject(err);
+                }
+                else if (handshakeResolver) {
+                    handshakeResolver.reject(err);
+                }
+            }
+        };
+        /**
+         * Returns boolean indicating whether or not the request should attempt to use native broker
+         * @param logger
+         * @param config
+         * @param nativeExtensionProvider
+         * @param authenticationScheme
+         */
+        NativeMessageHandler.isNativeAvailable = function (config, logger, nativeExtensionProvider, authenticationScheme) {
+            logger.trace("isNativeAvailable called");
+            if (!config.system.allowNativeBroker) {
+                logger.trace("isNativeAvailable: allowNativeBroker is not enabled, returning false");
+                // Developer disabled WAM
+                return false;
+            }
+            if (!nativeExtensionProvider) {
+                logger.trace("isNativeAvailable: WAM extension provider is not initialized, returning false");
+                // Extension is not available
+                return false;
+            }
+            if (authenticationScheme) {
+                switch (authenticationScheme) {
+                    case exports.AuthenticationScheme.BEARER:
+                    case exports.AuthenticationScheme.POP:
+                        logger.trace("isNativeAvailable: authenticationScheme is supported, returning true");
+                        return true;
+                    default:
+                        logger.trace("isNativeAvailable: authenticationScheme is not supported, returning false");
+                        return false;
+                }
+            }
+            return true;
+        };
+        return NativeMessageHandler;
+    }());
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var PopupClient = /** @class */ (function (_super) {
+        __extends$1(PopupClient, _super);
+        function PopupClient() {
+            return _super !== null && _super.apply(this, arguments) || this;
+        }
+        /**
+         * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
+         * @param request
+         */
+        PopupClient.prototype.acquireToken = function (request) {
+            try {
+                var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority, this.correlationId);
+                var popupWindowAttributes = request.popupWindowAttributes || {};
+                // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
+                if (this.config.system.asyncPopups) {
+                    this.logger.verbose("asyncPopups set to true, acquiring token");
+                    // Passes on popup position and dimensions if in request
+                    return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes);
+                }
+                else {
+                    // asyncPopups flag is set to false. Opens popup before acquiring token.
+                    this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
+                    var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
+                    return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes, popup);
+                }
+            }
+            catch (e) {
+                return Promise.reject(e);
+            }
+        };
+        /**
+         * Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
+         * @param logoutRequest
+         */
+        PopupClient.prototype.logout = function (logoutRequest) {
+            try {
+                this.logger.verbose("logoutPopup called");
+                var validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
+                var popupName = PopupUtils.generateLogoutPopupName(this.config.auth.clientId, validLogoutRequest);
+                var authority = logoutRequest && logoutRequest.authority;
+                var mainWindowRedirectUri = logoutRequest && logoutRequest.mainWindowRedirectUri;
+                var popupWindowAttributes = (logoutRequest === null || logoutRequest === void 0 ? void 0 : logoutRequest.popupWindowAttributes) || {};
+                // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
+                if (this.config.system.asyncPopups) {
+                    this.logger.verbose("asyncPopups set to true");
+                    // Passes on popup position and dimensions if in request
+                    return this.logoutPopupAsync(validLogoutRequest, popupName, popupWindowAttributes, authority, undefined, mainWindowRedirectUri);
+                }
+                else {
+                    // asyncPopups flag is set to false. Opens popup before logging out.
                     this.logger.verbose("asyncPopup set to false, opening popup");
                     var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
                     return this.logoutPopupAsync(validLogoutRequest, popupName, popupWindowAttributes, authority, popup, mainWindowRedirectUri);
@@ -12023,7 +12929,8 @@
          */
         PopupClient.prototype.acquireTokenPopupAsync = function (request, popupName, popupWindowAttributes, popup) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var serverTelemetryManager, validRequest, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_1;
+                var serverTelemetryManager, validRequest, authCodeRequest, authClient, isNativeBroker, fetchNativeAccountIdMeasurement, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, serverParams, state_1, nativeInteractionClient, userRequestState, result, e_1;
+                var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -12043,7 +12950,12 @@
                         case 4:
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
-                            return [4 /*yield*/, authClient.getAuthCodeUrl(validRequest)];
+                            isNativeBroker = NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
+                            fetchNativeAccountIdMeasurement = void 0;
+                            if (isNativeBroker) {
+                                fetchNativeAccountIdMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.FetchAccountIdWithNativeBroker, request.correlationId);
+                            }
+                            return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, validRequest), { nativeBroker: isNativeBroker }))];
                         case 5:
                             navigateUrl = _a.sent();
                             interactionHandler = new PopupHandler(authClient, this.browserStorage, authCodeRequest, this.logger);
@@ -12057,10 +12969,30 @@
                             return [4 /*yield*/, interactionHandler.monitorPopupForHash(popupWindow)];
                         case 6:
                             hash = _a.sent();
-                            state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Popup, validRequest.correlationId);
+                            serverParams = UrlString.getDeserializedHash(hash);
+                            state_1 = this.validateAndExtractStateFromHash(serverParams, exports.InteractionType.Popup, validRequest.correlationId);
                             // Remove throttle if it exists
                             ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
-                            return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
+                            if (serverParams.accountId) {
+                                this.logger.verbose("Account id found in hash, calling WAM for token");
+                                // end measurement for server call with native brokering enabled
+                                if (fetchNativeAccountIdMeasurement) {
+                                    fetchNativeAccountIdMeasurement.endMeasurement({
+                                        success: true,
+                                        isNativeBroker: true
+                                    });
+                                }
+                                if (!this.nativeMessageHandler) {
+                                    throw BrowserAuthError.createNativeConnectionNotEstablishedError();
+                                }
+                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, validRequest.correlationId);
+                                userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state_1).userRequestState;
+                                return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, validRequest), { state: userRequestState, prompt: undefined // Server should handle the prompt, ideally native broker can do this part silently
+                                     })).finally(function () {
+                                        _this.browserStorage.cleanRequestByState(state_1);
+                                    })];
+                            }
+                            return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state_1, authClient.authority, this.networkClient)];
                         case 7:
                             result = _a.sent();
                             return [2 /*return*/, result];
@@ -12242,7 +13174,7 @@
          * Handle authorization code response in the window.
          * @param hash
          */
-        RedirectHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule, clientId) {
+        RedirectHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule) {
             return __awaiter$1(this, void 0, void 0, function () {
                 var stateKey, requestState, authCodeResponse, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
                 return __generator$1(this, function (_a) {
@@ -12260,7 +13192,18 @@
                             if (!requestState) {
                                 throw ClientAuthError.createStateNotFoundError("Cached State");
                             }
-                            authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                            try {
+                                authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                            }
+                            catch (e) {
+                                if (e instanceof ServerError && e.subError === BrowserAuthErrorMessage.userCancelledError.code) {
+                                    // Translate server error caused by user closing native prompt to corresponding first class MSAL error
+                                    throw BrowserAuthError.createUserCancelledError();
+                                }
+                                else {
+                                    throw e;
+                                }
+                            }
                             nonceKey = this.browserStorage.generateNonceKey(requestState);
                             cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
                             // Assign code to request
@@ -12283,10 +13226,6 @@
                                     this.authCodeRequest.ccsCredential = cachedCcsCred;
                                 }
                             }
-                            // Remove throttle if it exists
-                            if (clientId) {
-                                ThrottlingUtils.removeThrottle(this.browserStorage, clientId, this.authCodeRequest);
-                            }
                             return [4 /*yield*/, this.authModule.acquireToken(this.authCodeRequest, authCodeResponse)];
                         case 3:
                             tokenResponse = _a.sent();
@@ -12341,7 +13280,7 @@
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
                             interactionHandler = new RedirectHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.browserCrypto);
-                            return [4 /*yield*/, authClient.getAuthCodeUrl(validRequest)];
+                            return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, validRequest), { nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme) }))];
                         case 5:
                             navigateUrl = _a.sent();
                             redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
@@ -12379,7 +13318,7 @@
          */
         RedirectClient.prototype.handleRedirectPromise = function (hash) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var serverTelemetryManager, responseHash, state, loginRequestUrl, loginRequestUrlNormalized, currentUrlNormalized, handleHashResult, navigationOptions, processHashOnRedirect, homepage, e_2;
+                var serverTelemetryManager, responseHash, state, serverParams, loginRequestUrl, loginRequestUrlNormalized, currentUrlNormalized, handleHashResult, navigationOptions, processHashOnRedirect, homepage, e_2;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -12400,7 +13339,8 @@
                             }
                             state = void 0;
                             try {
-                                state = this.validateAndExtractStateFromHash(responseHash, exports.InteractionType.Redirect);
+                                serverParams = UrlString.getDeserializedHash(responseHash);
+                                state = this.validateAndExtractStateFromHash(serverParams, exports.InteractionType.Redirect);
                                 this.logger.verbose("State extracted from hash");
                             }
                             catch (e) {
@@ -12501,12 +13441,26 @@
          */
         RedirectClient.prototype.handleHash = function (hash, state, serverTelemetryManager) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var cachedRequest, currentAuthority, authClient, interactionHandler;
+                var cachedRequest, serverParams, nativeInteractionClient, userRequestState, currentAuthority, authClient, interactionHandler;
+                var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             cachedRequest = this.browserStorage.getCachedRequest(state, this.browserCrypto);
                             this.logger.verbose("handleHash called, retrieved cached request");
+                            serverParams = UrlString.getDeserializedHash(hash);
+                            if (serverParams.accountId) {
+                                this.logger.verbose("Account id found in hash, calling WAM for token");
+                                if (!this.nativeMessageHandler) {
+                                    throw BrowserAuthError.createNativeConnectionNotEstablishedError();
+                                }
+                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, cachedRequest.correlationId);
+                                userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
+                                return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, cachedRequest), { state: userRequestState, prompt: undefined // Server should handle the prompt, ideally native broker can do this part silently
+                                     })).finally(function () {
+                                        _this.browserStorage.cleanRequestByState(state);
+                                    })];
+                            }
                             currentAuthority = this.browserStorage.getCachedAuthority(state);
                             if (!currentAuthority) {
                                 throw BrowserAuthError.createNoCachedAuthorityError();
@@ -12515,8 +13469,9 @@
                         case 1:
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
+                            ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, cachedRequest);
                             interactionHandler = new RedirectHandler(authClient, this.browserStorage, cachedRequest, this.logger, this.browserCrypto);
-                            return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient, this.config.auth.clientId)];
+                            return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                         case 2: return [2 /*return*/, _a.sent()];
                     }
                 });
@@ -12758,8 +13713,8 @@
      */
     var SilentIframeClient = /** @class */ (function (_super) {
         __extends$1(SilentIframeClient, _super);
-        function SilentIframeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, correlationId) {
-            var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId) || this;
+        function SilentIframeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeMessageHandler, correlationId) {
+            var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
             _this.apiId = apiId;
             return _this;
         }
@@ -12769,7 +13724,7 @@
          */
         SilentIframeClient.prototype.acquireToken = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var acquireTokenMeasurement, silentRequest, serverTelemetryManager, authCodeRequest, authClient, navigateUrl, e_1;
+                var acquireTokenMeasurement, silentRequest, serverTelemetryManager, authClient, e_1;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -12793,27 +13748,20 @@
                             serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
                             _a.label = 2;
                         case 2:
-                            _a.trys.push([2, 7, , 8]);
-                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
-                        case 3:
-                            authCodeRequest = _a.sent();
+                            _a.trys.push([2, 5, , 6]);
                             return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
-                        case 4:
+                        case 3:
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
-                            return [4 /*yield*/, authClient.getAuthCodeUrl(silentRequest)];
-                        case 5:
-                            navigateUrl = _a.sent();
-                            return [4 /*yield*/, this.silentTokenHelper(navigateUrl, authCodeRequest, authClient, this.logger)
-                                    .then(function (result) {
+                            return [4 /*yield*/, this.silentTokenHelper(authClient, silentRequest).then(function (result) {
                                     acquireTokenMeasurement.endMeasurement({
                                         success: true,
                                         fromCache: false
                                     });
                                     return result;
                                 })];
-                        case 6: return [2 /*return*/, _a.sent()];
-                        case 7:
+                        case 4: return [2 /*return*/, _a.sent()];
+                        case 5:
                             e_1 = _a.sent();
                             if (e_1 instanceof AuthError) {
                                 e_1.setCorrelationId(this.correlationId);
@@ -12824,7 +13772,7 @@
                                 success: false
                             });
                             throw e_1;
-                        case 8: return [2 /*return*/];
+                        case 6: return [2 /*return*/];
                     }
                 });
             });
@@ -12842,20 +13790,38 @@
          * @param navigateUrl
          * @param userRequestScopes
          */
-        SilentIframeClient.prototype.silentTokenHelper = function (navigateUrl, authCodeRequest, authClient, browserRequestLogger) {
+        SilentIframeClient.prototype.silentTokenHelper = function (authClient, silentRequest) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var silentHandler, msalFrame, hash, state;
+                var authCodeRequest, navigateUrl, silentHandler, msalFrame, hash, serverParams, state, nativeInteractionClient, userRequestState;
+                var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0:
-                            silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, browserRequestLogger, this.config.system.navigateFrameWait);
-                            return [4 /*yield*/, silentHandler.initiateAuthRequest(navigateUrl)];
+                        case 0: return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
                         case 1:
+                            authCodeRequest = _a.sent();
+                            return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, silentRequest), { nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme) }))];
+                        case 2:
+                            navigateUrl = _a.sent();
+                            silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system.navigateFrameWait);
+                            return [4 /*yield*/, silentHandler.initiateAuthRequest(navigateUrl)];
+                        case 3:
                             msalFrame = _a.sent();
                             return [4 /*yield*/, silentHandler.monitorIframeForHash(msalFrame, this.config.system.iframeHashTimeout)];
-                        case 2:
+                        case 4:
                             hash = _a.sent();
-                            state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Silent, authCodeRequest.correlationId);
+                            serverParams = UrlString.getDeserializedHash(hash);
+                            state = this.validateAndExtractStateFromHash(serverParams, exports.InteractionType.Silent, authCodeRequest.correlationId);
+                            if (serverParams.accountId) {
+                                this.logger.verbose("Account id found in hash, calling WAM for token");
+                                if (!this.nativeMessageHandler) {
+                                    throw BrowserAuthError.createNativeConnectionNotEstablishedError();
+                                }
+                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.correlationId);
+                                userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
+                                return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: PromptValue.NONE })).finally(function () {
+                                        _this.browserStorage.cleanRequestByState(state);
+                                    })];
+                            }
                             // Handle response from hash string
                             return [2 /*return*/, silentHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                     }
@@ -13064,6 +14030,97 @@
         return TokenCache;
     }());
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var SilentCacheClient = /** @class */ (function (_super) {
+        __extends$1(SilentCacheClient, _super);
+        function SilentCacheClient() {
+            return _super !== null && _super.apply(this, arguments) || this;
+        }
+        /**
+         * Returns unexpired tokens from the cache, if available
+         * @param silentRequest
+         */
+        SilentCacheClient.prototype.acquireToken = function (silentRequest) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var acquireTokenMeasurement, serverTelemetryManager, silentAuthClient, cachedToken, error_1;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            acquireTokenMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
+                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
+                            return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
+                        case 1:
+                            silentAuthClient = _a.sent();
+                            this.logger.verbose("Silent auth client created");
+                            _a.label = 2;
+                        case 2:
+                            _a.trys.push([2, 4, , 5]);
+                            return [4 /*yield*/, silentAuthClient.acquireCachedToken(silentRequest)];
+                        case 3:
+                            cachedToken = _a.sent();
+                            acquireTokenMeasurement.endMeasurement({
+                                success: true,
+                                fromCache: true
+                            });
+                            return [2 /*return*/, cachedToken];
+                        case 4:
+                            error_1 = _a.sent();
+                            if (error_1 instanceof BrowserAuthError && error_1.errorCode === BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
+                                this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
+                            }
+                            acquireTokenMeasurement.endMeasurement({
+                                success: false
+                            });
+                            throw error_1;
+                        case 5: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Currently Unsupported
+         */
+        SilentCacheClient.prototype.logout = function () {
+            // Synchronous so we must reject
+            return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
+        };
+        /**
+         * Creates an Silent Flow Client with the given authority, or the default authority.
+         * @param serverTelemetryManager
+         * @param authorityUrl
+         */
+        SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var clientConfig;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
+                        case 1:
+                            clientConfig = _a.sent();
+                            return [2 /*return*/, new SilentFlowClient(clientConfig)];
+                    }
+                });
+            });
+        };
+        SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var _a;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            _a = [__assign$1({}, request)];
+                            return [4 /*yield*/, this.initializeBaseRequest(request)];
+                        case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
+                    }
+                });
+            });
+        };
+        return SilentCacheClient;
+    }(StandardInteractionClient));
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -13084,8 +14141,8 @@
      */
     var SilentAuthCodeClient = /** @class */ (function (_super) {
         __extends$1(SilentAuthCodeClient, _super);
-        function SilentAuthCodeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, correlationId) {
-            var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId) || this;
+        function SilentAuthCodeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeMessageHandler, correlationId) {
+            var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
             _this.apiId = apiId;
             return _this;
         }
@@ -13288,6 +14345,7 @@
             this.isBrowserEnvironment = typeof window !== "undefined";
             // Set the configuration.
             this.config = buildConfiguration(configuration, this.isBrowserEnvironment);
+            this.initialized = false;
             // Initialize logger
             this.logger = new Logger(this.config.system.loggerOptions, name, version);
             // Initialize the network module class.
@@ -13312,6 +14370,42 @@
             // Initialize the token cache
             this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto);
         }
+        /**
+         * Initializer function to perform async startup tasks such as connecting to WAM extension
+         */
+        ClientApplication.prototype.initialize = function () {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var _a, e_1;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            this.logger.trace("initialize called");
+                            if (this.initialized) {
+                                this.logger.warning("initialize has already been called. This function only needs to be run once.");
+                                return [2 /*return*/];
+                            }
+                            this.eventHandler.emitEvent(exports.EventType.INITIALIZE_START);
+                            if (!this.config.system.allowNativeBroker) return [3 /*break*/, 4];
+                            _b.label = 1;
+                        case 1:
+                            _b.trys.push([1, 3, , 4]);
+                            _a = this;
+                            return [4 /*yield*/, NativeMessageHandler.createProvider(this.logger, this.config.system.nativeBrokerHandshakeTimeout)];
+                        case 2:
+                            _a.nativeExtensionProvider = _b.sent();
+                            return [3 /*break*/, 4];
+                        case 3:
+                            e_1 = _b.sent();
+                            this.logger.verbose(e_1);
+                            return [3 /*break*/, 4];
+                        case 4:
+                            this.initialized = true;
+                            this.eventHandler.emitEvent(exports.EventType.INITIALIZE_END);
+                            return [2 /*return*/];
+                    }
+                });
+            });
+        };
         // #region Redirect Flow
         /**
          * Event handler function which allows users to fire events after the PublicClientApplication object
@@ -13322,10 +14416,12 @@
          */
         ClientApplication.prototype.handleRedirectPromise = function (hash) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var loggedInAccounts, redirectResponseKey, response, correlationId, redirectClient;
+                var loggedInAccounts, redirectResponseKey, response, request, redirectResponse, nativeClient, correlationId, redirectClient;
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     this.logger.verbose("handleRedirectPromise called");
+                    // Block token acquisition before initialize has been called if native brokering is enabled
+                    BrowserUtils.blockNativeBrokerCalledBeforeInitialized(this.config.system.allowNativeBroker, this.initialized);
                     loggedInAccounts = this.getAllAccounts();
                     if (this.isBrowserEnvironment) {
                         redirectResponseKey = hash || Constants.EMPTY_STRING;
@@ -13333,10 +14429,20 @@
                         if (typeof response === "undefined") {
                             this.eventHandler.emitEvent(exports.EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
                             this.logger.verbose("handleRedirectPromise has been called for the first time, storing the promise");
-                            correlationId = this.browserStorage.getTemporaryCache(exports.TemporaryCacheKeys.CORRELATION_ID, true) || Constants.EMPTY_STRING;
-                            redirectClient = new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-                            response = redirectClient.handleRedirectPromise(hash)
-                                .then(function (result) {
+                            request = this.browserStorage.getCachedNativeRequest();
+                            redirectResponse = void 0;
+                            if (request && NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) && this.nativeExtensionProvider && !hash) {
+                                this.logger.trace("handleRedirectPromise - acquiring token from native platform");
+                                nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, request.correlationId);
+                                redirectResponse = nativeClient.handleRedirectPromise();
+                            }
+                            else {
+                                this.logger.trace("handleRedirectPromise - acquiring token from web flow");
+                                correlationId = this.browserStorage.getTemporaryCache(exports.TemporaryCacheKeys.CORRELATION_ID, true) || Constants.EMPTY_STRING;
+                                redirectClient = this.createRedirectClient(correlationId);
+                                redirectResponse = redirectClient.handleRedirectPromise(hash);
+                            }
+                            response = redirectResponse.then(function (result) {
                                 if (result) {
                                     // Emit login event if number of accounts change
                                     var isLoggingIn = loggedInAccounts.length < _this.getAllAccounts().length;
@@ -13351,8 +14457,7 @@
                                 }
                                 _this.eventHandler.emitEvent(exports.EventType.HANDLE_REDIRECT_END, exports.InteractionType.Redirect);
                                 return result;
-                            })
-                                .catch(function (e) {
+                            }).catch(function (e) {
                                 // Emit login event if there is an account
                                 if (loggedInAccounts.length > 0) {
                                     _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Redirect, null, e);
@@ -13386,7 +14491,7 @@
          */
         ClientApplication.prototype.acquireTokenRedirect = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var correlationId, isLoggedIn, redirectClient;
+                var correlationId, isLoggedIn, result, nativeClient, redirectClient;
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     correlationId = this.getRequestCorrelationId(request);
@@ -13399,8 +14504,22 @@
                     else {
                         this.eventHandler.emitEvent(exports.EventType.LOGIN_START, exports.InteractionType.Redirect, request);
                     }
-                    redirectClient = new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-                    return [2 /*return*/, redirectClient.acquireToken(__assign$1(__assign$1({}, request), { correlationId: correlationId })).catch(function (e) {
+                    if (this.nativeExtensionProvider && this.canUseNative(request)) {
+                        nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), request.correlationId);
+                        result = nativeClient.acquireTokenRedirect(request).catch(function (e) {
+                            if (e instanceof NativeAuthError && e.isFatal()) {
+                                _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                                var redirectClient = _this.createRedirectClient(request.correlationId);
+                                return redirectClient.acquireToken(request);
+                            }
+                            throw e;
+                        });
+                    }
+                    else {
+                        redirectClient = this.createRedirectClient(request.correlationId);
+                        result = redirectClient.acquireToken(request);
+                    }
+                    return [2 /*return*/, result.catch(function (e) {
                             // If logged in, emit acquire token events
                             if (isLoggedIn) {
                                 _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Redirect, null, e);
@@ -13425,6 +14544,7 @@
         ClientApplication.prototype.acquireTokenPopup = function (request) {
             var _this = this;
             var correlationId = this.getRequestCorrelationId(request);
+            var atPopupMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenPopup, correlationId);
             try {
                 this.logger.verbose("acquireTokenPopup called", correlationId);
                 this.preflightBrowserEnvironmentCheck(exports.InteractionType.Popup);
@@ -13441,8 +14561,30 @@
             else {
                 this.eventHandler.emitEvent(exports.EventType.LOGIN_START, exports.InteractionType.Popup, request);
             }
-            var popupClient = new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-            return popupClient.acquireToken(__assign$1(__assign$1({}, request), { correlationId: correlationId })).then(function (result) {
+            var result;
+            if (this.canUseNative(request)) {
+                result = this.acquireTokenNative(request, exports.ApiId.acquireTokenPopup).then(function (response) {
+                    _this.browserStorage.setInteractionInProgress(false);
+                    atPopupMeasurement.endMeasurement({
+                        success: true,
+                        isNativeBroker: true
+                    });
+                    atPopupMeasurement.flushMeasurement();
+                    return response;
+                }).catch(function (e) {
+                    if (e instanceof NativeAuthError && e.isFatal()) {
+                        _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        var popupClient = _this.createPopupClient(request.correlationId);
+                        return popupClient.acquireToken(request);
+                    }
+                    throw e;
+                });
+            }
+            else {
+                var popupClient = this.createPopupClient(request.correlationId);
+                result = popupClient.acquireToken(request);
+            }
+            return result.then(function (result) {
                 // If logged in, emit acquire token events
                 var isLoggingIn = loggedInAccounts.length < _this.getAllAccounts().length;
                 if (isLoggingIn) {
@@ -13451,6 +14593,10 @@
                 else {
                     _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Popup, result);
                 }
+                atPopupMeasurement.endMeasurement({
+                    success: true
+                });
+                atPopupMeasurement.flushMeasurement();
                 return result;
             }).catch(function (e) {
                 if (loggedInAccounts.length > 0) {
@@ -13459,6 +14605,10 @@
                 else {
                     _this.eventHandler.emitEvent(exports.EventType.LOGIN_FAILURE, exports.InteractionType.Popup, null, e);
                 }
+                atPopupMeasurement.endMeasurement({
+                    success: false
+                });
+                atPopupMeasurement.flushMeasurement();
                 // Since this function is syncronous we need to reject
                 return Promise.reject(e);
             });
@@ -13482,38 +14632,45 @@
          */
         ClientApplication.prototype.ssoSilent = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var correlationId, ssoSilentMeasurement, silentIframeClient, silentTokenResult, e_1;
+                var correlationId, validRequest, ssoSilentMeasurement, result, silentIframeClient;
+                var _this = this;
                 return __generator$1(this, function (_a) {
-                    switch (_a.label) {
-                        case 0:
-                            correlationId = this.getRequestCorrelationId(request);
-                            this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
-                            ssoSilentMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SsoSilent, correlationId);
-                            this.logger.verbose("ssoSilent called", correlationId);
-                            this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_START, exports.InteractionType.Silent, request);
-                            _a.label = 1;
-                        case 1:
-                            _a.trys.push([1, 3, , 4]);
-                            silentIframeClient = new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.ssoSilent, this.performanceClient, correlationId);
-                            return [4 /*yield*/, silentIframeClient.acquireToken(__assign$1(__assign$1({}, request), { correlationId: correlationId }))];
-                        case 2:
-                            silentTokenResult = _a.sent();
-                            this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, silentTokenResult);
+                    correlationId = this.getRequestCorrelationId(request);
+                    validRequest = __assign$1(__assign$1({}, request), { prompt: PromptValue.NONE, correlationId: correlationId });
+                    this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
+                    ssoSilentMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SsoSilent, correlationId);
+                    this.logger.verbose("ssoSilent called", correlationId);
+                    this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_START, exports.InteractionType.Silent, validRequest);
+                    if (this.canUseNative(validRequest)) {
+                        result = this.acquireTokenNative(validRequest, exports.ApiId.ssoSilent).catch(function (e) {
+                            // If native token acquisition fails for availability reasons fallback to standard flow
+                            if (e instanceof NativeAuthError && e.isFatal()) {
+                                _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                                var silentIframeClient = _this.createSilentIframeClient(validRequest.correlationId);
+                                return silentIframeClient.acquireToken(validRequest);
+                            }
+                            throw e;
+                        });
+                    }
+                    else {
+                        silentIframeClient = this.createSilentIframeClient(validRequest.correlationId);
+                        result = silentIframeClient.acquireToken(validRequest);
+                    }
+                    return [2 /*return*/, result.then(function (response) {
+                            _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, response);
                             ssoSilentMeasurement.endMeasurement({
                                 success: true
                             });
                             ssoSilentMeasurement.flushMeasurement();
-                            return [2 /*return*/, silentTokenResult];
-                        case 3:
-                            e_1 = _a.sent();
-                            this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e_1);
+                            return response;
+                        }).catch(function (e) {
+                            _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e);
                             ssoSilentMeasurement.endMeasurement({
                                 success: false
                             });
                             ssoSilentMeasurement.flushMeasurement();
-                            throw e_1;
-                        case 4: return [2 /*return*/];
-                    }
+                            throw e;
+                        })];
                 });
             });
         };
@@ -13529,7 +14686,7 @@
          */
         ClientApplication.prototype.acquireTokenByCode = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var correlationId, atbcMeasurement, response;
+                var correlationId, atbcMeasurement, hybridAuthCode_1, response;
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     correlationId = this.getRequestCorrelationId(request);
@@ -13538,41 +14695,58 @@
                     this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_START, exports.InteractionType.Silent, request);
                     atbcMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenByCode, request.correlationId);
                     try {
-                        if (!request.code) {
-                            throw BrowserAuthError.createAuthCodeRequiredError();
-                        }
-                        response = this.hybridAuthCodeResponses.get(request.code);
-                        if (!response) {
-                            this.logger.verbose("Initiating new acquireTokenByCode request", correlationId);
-                            response = this.acquireTokenByCodeAsync(__assign$1(__assign$1({}, request), { correlationId: correlationId }))
-                                .then(function (result) {
-                                _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
-                                _this.hybridAuthCodeResponses.delete(request.code);
-                                atbcMeasurement.endMeasurement({
-                                    success: true
+                        if (request.code) {
+                            hybridAuthCode_1 = request.code;
+                            response = this.hybridAuthCodeResponses.get(hybridAuthCode_1);
+                            if (!response) {
+                                this.logger.verbose("Initiating new acquireTokenByCode request", correlationId);
+                                response = this.acquireTokenByCodeAsync(__assign$1(__assign$1({}, request), { correlationId: correlationId }))
+                                    .then(function (result) {
+                                    _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
+                                    _this.hybridAuthCodeResponses.delete(hybridAuthCode_1);
+                                    atbcMeasurement.endMeasurement({
+                                        success: true
+                                    });
+                                    atbcMeasurement.flushMeasurement();
+                                    return result;
+                                })
+                                    .catch(function (error) {
+                                    _this.hybridAuthCodeResponses.delete(hybridAuthCode_1);
+                                    _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, error);
+                                    atbcMeasurement.endMeasurement({
+                                        success: false
+                                    });
+                                    atbcMeasurement.flushMeasurement();
+                                    throw error;
                                 });
-                                atbcMeasurement.flushMeasurement();
-                                return result;
-                            })
-                                .catch(function (error) {
-                                _this.hybridAuthCodeResponses.delete(request.code);
-                                _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, error);
+                                this.hybridAuthCodeResponses.set(hybridAuthCode_1, response);
+                            }
+                            else {
+                                this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
                                 atbcMeasurement.endMeasurement({
-                                    success: false
+                                    success: true
                                 });
-                                atbcMeasurement.flushMeasurement();
-                                throw error;
-                            });
-                            this.hybridAuthCodeResponses.set(request.code, response);
+                                atbcMeasurement.discardMeasurement();
+                            }
+                            return [2 /*return*/, response];
+                        }
+                        else if (request.nativeAccountId) {
+                            if (this.canUseNative(request, request.nativeAccountId)) {
+                                return [2 /*return*/, this.acquireTokenNative(request, exports.ApiId.acquireTokenByCode, request.nativeAccountId).catch(function (e) {
+                                        // If native token acquisition fails for availability reasons fallback to standard flow
+                                        if (e instanceof NativeAuthError && e.isFatal()) {
+                                            _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                                        }
+                                        throw e;
+                                    })];
+                            }
+                            else {
+                                throw BrowserAuthError.createUnableToAcquireTokenFromNativePlatformError();
+                            }
                         }
                         else {
-                            this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
-                            atbcMeasurement.endMeasurement({
-                                success: true
-                            });
-                            atbcMeasurement.discardMeasurement();
+                            throw BrowserAuthError.createAuthCodeOrNativeAccountIdRequiredError();
                         }
-                        return [2 /*return*/, response];
                     }
                     catch (e) {
                         this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
@@ -13597,7 +14771,7 @@
                     switch (_a.label) {
                         case 0:
                             this.logger.trace("acquireTokenByCodeAsync called", request.correlationId);
-                            silentAuthCodeClient = new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenByCode, this.performanceClient, request.correlationId);
+                            silentAuthCodeClient = this.createSilentAuthCodeClient(request.correlationId);
                             return [4 /*yield*/, silentAuthCodeClient.acquireToken(request)];
                         case 1:
                             silentTokenResult = _a.sent();
@@ -13626,7 +14800,7 @@
                     BrowserUtils.blockReloadInHiddenIframes();
                     atbrtMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenByRefreshToken, request.correlationId);
                     this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, request);
-                    silentRefreshClient = new SilentRefreshClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, request.correlationId);
+                    silentRefreshClient = this.createSilentRefreshClient(request.correlationId);
                     return [2 /*return*/, silentRefreshClient.acquireToken(request)
                             .then(function (result) {
                             atbrtMeasurement.endMeasurement({
@@ -13641,7 +14815,7 @@
                             var isInvalidGrantError = (e.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
                             if (isServerError && isInvalidGrantError && !isInteractionRequiredError) {
                                 _this.logger.verbose("Refresh token expired or invalid, attempting acquire token by iframe", request.correlationId);
-                                var silentIframeClient = new SilentIframeClient(_this.config, _this.browserStorage, _this.browserCrypto, _this.logger, _this.eventHandler, _this.navigationClient, exports.ApiId.acquireTokenSilent_authCode, _this.performanceClient, request.correlationId);
+                                var silentIframeClient = _this.createSilentIframeClient(request.correlationId);
                                 return silentIframeClient.acquireToken(request)
                                     .then(function (result) {
                                     atbrtMeasurement.endMeasurement({
@@ -13693,8 +14867,8 @@
                 return __generator$1(this, function (_a) {
                     correlationId = this.getRequestCorrelationId(logoutRequest);
                     this.preflightBrowserEnvironmentCheck(exports.InteractionType.Redirect);
-                    redirectClient = new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-                    return [2 /*return*/, redirectClient.logout(__assign$1({ correlationId: correlationId }, logoutRequest))];
+                    redirectClient = this.createRedirectClient(correlationId);
+                    return [2 /*return*/, redirectClient.logout(logoutRequest)];
                 });
             });
         };
@@ -13706,8 +14880,8 @@
             try {
                 var correlationId = this.getRequestCorrelationId(logoutRequest);
                 this.preflightBrowserEnvironmentCheck(exports.InteractionType.Popup);
-                var popupClient = new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-                return popupClient.logout(__assign$1({ correlationId: correlationId }, logoutRequest));
+                var popupClient = this.createPopupClient(correlationId);
+                return popupClient.logout(logoutRequest);
             }
             catch (e) {
                 // Since this function is syncronous we need to reject
@@ -13813,6 +14987,8 @@
             BrowserUtils.blockReloadInHiddenIframes();
             // Block redirectUri opened in a popup from calling MSAL APIs
             BrowserUtils.blockAcquireTokenInPopups();
+            // Block token acquisition before initialize has been called if native brokering is enabled
+            BrowserUtils.blockNativeBrokerCalledBeforeInitialized(this.config.system.allowNativeBroker, this.initialized);
             // Block redirects if memory storage is enabled but storeAuthStateInCookie is not
             if (interactionType === exports.InteractionType.Redirect &&
                 this.config.cache.cacheLocation === exports.BrowserCacheLocation.MemoryStorage &&
@@ -13835,6 +15011,98 @@
             // Set interaction in progress temporary cache or throw if alread set.
             this.browserStorage.setInteractionInProgress(true);
         };
+        /**
+         * Acquire a token from native device (e.g. WAM)
+         * @param request
+         */
+        ClientApplication.prototype.acquireTokenNative = function (request, apiId, accountId) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var nativeClient;
+                return __generator$1(this, function (_a) {
+                    this.logger.trace("acquireTokenNative called");
+                    if (!this.nativeExtensionProvider) {
+                        throw BrowserAuthError.createNativeConnectionNotEstablishedError();
+                    }
+                    nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.nativeExtensionProvider, accountId || this.getNativeAccountId(request), request.correlationId);
+                    return [2 /*return*/, nativeClient.acquireToken(request)];
+                });
+            });
+        };
+        /**
+         * Returns boolean indicating if this request can use the native broker
+         * @param request
+         */
+        ClientApplication.prototype.canUseNative = function (request, accountId) {
+            this.logger.trace("canUseNative called");
+            if (!NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme)) {
+                this.logger.trace("canUseNative: isNativeAvailable returned false, returning false");
+                return false;
+            }
+            if (request.prompt) {
+                switch (request.prompt) {
+                    case PromptValue.NONE:
+                    case PromptValue.CONSENT:
+                        this.logger.trace("canUseNative: prompt is compatible with native flow");
+                        break;
+                    default:
+                        this.logger.trace("canUseNative: prompt = " + request.prompt + " is not compatible with native flow, returning false");
+                        return false;
+                }
+            }
+            if (!accountId && !this.getNativeAccountId(request)) {
+                this.logger.trace("canUseNative: nativeAccountId is not available, returning false");
+                return false;
+            }
+            return true;
+        };
+        /**
+         * Get the native accountId from the account
+         * @param request
+         * @returns
+         */
+        ClientApplication.prototype.getNativeAccountId = function (request) {
+            var account = request.account || this.browserStorage.getAccountInfoByHints(request.loginHint, request.sid) || this.getActiveAccount();
+            return account && account.nativeAccountId || "";
+        };
+        /**
+         * Returns new instance of the Popup Interaction Client
+         * @param correlationId
+         */
+        ClientApplication.prototype.createPopupClient = function (correlationId) {
+            return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+        };
+        /**
+         * Returns new instance of the Popup Interaction Client
+         * @param correlationId
+         */
+        ClientApplication.prototype.createRedirectClient = function (correlationId) {
+            return new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+        };
+        /**
+         * Returns new instance of the Silent Iframe Interaction Client
+         * @param correlationId
+         */
+        ClientApplication.prototype.createSilentIframeClient = function (correlationId) {
+            return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.ssoSilent, this.performanceClient, this.nativeExtensionProvider, correlationId);
+        };
+        /**
+         * Returns new instance of the Silent Cache Interaction Client
+         */
+        ClientApplication.prototype.createSilentCacheClient = function (correlationId) {
+            return new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+        };
+        /**
+         * Returns new instance of the Silent Refresh Interaction Client
+         */
+        ClientApplication.prototype.createSilentRefreshClient = function (correlationId) {
+            return new SilentRefreshClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+        };
+        /**
+         * Returns new instance of the Silent AuthCode Interaction Client
+         */
+        ClientApplication.prototype.createSilentAuthCodeClient = function (correlationId) {
+            return new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenByCode, this.performanceClient, this.nativeExtensionProvider, correlationId);
+        };
         /**
          * Adds event callbacks to array
          * @param callback
@@ -13943,98 +15211,6 @@
         return ClientApplication;
     }());
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    var SilentCacheClient = /** @class */ (function (_super) {
-        __extends$1(SilentCacheClient, _super);
-        function SilentCacheClient() {
-            return _super !== null && _super.apply(this, arguments) || this;
-        }
-        /**
-         * Returns unexpired tokens from the cache, if available
-         * @param silentRequest
-         */
-        SilentCacheClient.prototype.acquireToken = function (silentRequest) {
-            return __awaiter$1(this, void 0, void 0, function () {
-                var acquireTokenMeasurement, serverTelemetryManager, silentAuthClient, cachedToken, error_1;
-                return __generator$1(this, function (_a) {
-                    switch (_a.label) {
-                        case 0:
-                            acquireTokenMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
-                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
-                            return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
-                        case 1:
-                            silentAuthClient = _a.sent();
-                            this.logger.verbose("Silent auth client created");
-                            _a.label = 2;
-                        case 2:
-                            _a.trys.push([2, 4, , 5]);
-                            return [4 /*yield*/, silentAuthClient.acquireCachedToken(silentRequest)];
-                        case 3:
-                            cachedToken = _a.sent();
-                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, cachedToken);
-                            acquireTokenMeasurement.endMeasurement({
-                                success: true,
-                                fromCache: true
-                            });
-                            return [2 /*return*/, cachedToken];
-                        case 4:
-                            error_1 = _a.sent();
-                            if (error_1 instanceof BrowserAuthError && error_1.errorCode === BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
-                                this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
-                            }
-                            acquireTokenMeasurement.endMeasurement({
-                                success: false
-                            });
-                            throw error_1;
-                        case 5: return [2 /*return*/];
-                    }
-                });
-            });
-        };
-        /**
-         * Currently Unsupported
-         */
-        SilentCacheClient.prototype.logout = function () {
-            // Synchronous so we must reject
-            return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
-        };
-        /**
-         * Creates an Silent Flow Client with the given authority, or the default authority.
-         * @param serverTelemetryManager
-         * @param authorityUrl
-         */
-        SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
-            return __awaiter$1(this, void 0, void 0, function () {
-                var clientConfig;
-                return __generator$1(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
-                        case 1:
-                            clientConfig = _a.sent();
-                            return [2 /*return*/, new SilentFlowClient(clientConfig)];
-                    }
-                });
-            });
-        };
-        SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
-            return __awaiter$1(this, void 0, void 0, function () {
-                var _a;
-                return __generator$1(this, function (_b) {
-                    switch (_b.label) {
-                        case 0:
-                            _a = [__assign$1({}, request)];
-                            return [4 /*yield*/, this.initializeBaseRequest(request)];
-                        case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
-                    }
-                });
-            });
-        };
-        return SilentCacheClient;
-    }(StandardInteractionClient));
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -14178,51 +15354,56 @@
          */
         PublicClientApplication.prototype.acquireTokenSilentAsync = function (request, account) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var astsAsyncMeasurement, silentCacheClient, silentRequest;
+                var astsAsyncMeasurement, result, silentRequest, silentCacheClient, silentRequest_1;
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
+                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
                             astsAsyncMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
-                            silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, request.correlationId);
-                            return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
+                            if (!(NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme) && account.nativeAccountId)) return [3 /*break*/, 1];
+                            this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
+                            silentRequest = __assign$1(__assign$1({}, request), { account: account });
+                            result = this.acquireTokenNative(silentRequest, exports.ApiId.acquireTokenSilent_silentFlow).catch(function (e) { return __awaiter$1(_this, void 0, void 0, function () {
+                                var silentIframeClient;
+                                return __generator$1(this, function (_a) {
+                                    // If native token acquisition fails for availability reasons fallback to web flow
+                                    if (e instanceof NativeAuthError && e.isFatal()) {
+                                        this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow");
+                                        this.nativeExtensionProvider = undefined; // Prevent future requests from continuing to attempt 
+                                        silentIframeClient = this.createSilentIframeClient(request.correlationId);
+                                        return [2 /*return*/, silentIframeClient.acquireToken(request)];
+                                    }
+                                    throw e;
+                                });
+                            }); });
+                            return [3 /*break*/, 3];
                         case 1:
-                            silentRequest = _a.sent();
-                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
-                            return [2 /*return*/, silentCacheClient.acquireToken(silentRequest)
-                                    .then(function (result) {
-                                    astsAsyncMeasurement.endMeasurement({
-                                        success: true,
-                                        fromCache: result.fromCache
-                                    });
-                                    return result;
-                                })
-                                    .catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
-                                    var tokenRenewalResult, tokenRenewalError_1;
-                                    return __generator$1(this, function (_a) {
-                                        switch (_a.label) {
-                                            case 0:
-                                                _a.trys.push([0, 2, , 3]);
-                                                return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
-                                            case 1:
-                                                tokenRenewalResult = _a.sent();
-                                                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
-                                                astsAsyncMeasurement.endMeasurement({
-                                                    success: true,
-                                                    fromCache: tokenRenewalResult.fromCache
-                                                });
-                                                return [2 /*return*/, tokenRenewalResult];
-                                            case 2:
-                                                tokenRenewalError_1 = _a.sent();
-                                                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
-                                                astsAsyncMeasurement.endMeasurement({
-                                                    success: false
-                                                });
-                                                throw tokenRenewalError_1;
-                                            case 3: return [2 /*return*/];
-                                        }
-                                    });
-                                }); })];
+                            this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow");
+                            silentCacheClient = this.createSilentCacheClient(request.correlationId);
+                            return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
+                        case 2:
+                            silentRequest_1 = _a.sent();
+                            result = silentCacheClient.acquireToken(silentRequest_1).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
+                                return __generator$1(this, function (_a) {
+                                    return [2 /*return*/, this.acquireTokenByRefreshToken(silentRequest_1)];
+                                });
+                            }); });
+                            _a.label = 3;
+                        case 3: return [2 /*return*/, result.then(function (response) {
+                                _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
+                                astsAsyncMeasurement.endMeasurement({
+                                    success: true,
+                                    fromCache: response.fromCache
+                                });
+                                return response;
+                            }).catch(function (tokenRenewalError) {
+                                _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError);
+                                astsAsyncMeasurement.endMeasurement({
+                                    success: false
+                                });
+                                throw tokenRenewalError;
+                            })];
                     }
                 });
             });
@@ -14235,6 +15416,9 @@
      * Licensed under the MIT License.
      */
     var stubbedPublicClientApplication = {
+        initialize: function () {
+            return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
+        },
         acquireTokenPopup: function () {
             return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
         },