@azure/msal-browser 2.23.0 → 2.24.0-beta.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.23.0 2022-04-04 */
+/*! @azure/msal-browser v2.24.0-beta.0 2022-04-27 */
 'use strict';
 'use strict';
 
@@ -105,7 +105,7 @@ function __spread() {
     return ar;
 }
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*! *****************************************************************************
 Copyright (c) Microsoft Corporation.
 
@@ -192,7 +192,7 @@ function __spreadArrays() {
     return r;
 }
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -240,7 +240,9 @@ var Constants = {
     IMDS_TIMEOUT: 2000,
     AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
-    KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"]
+    KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
+    TOKEN_RESPONSE_TYPE: "token",
+    ID_TOKEN_RESPONSE_TYPE: "id_token"
 };
 var OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
@@ -333,6 +335,7 @@ var AADServerParamKeys;
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
     AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
+    AADServerParamKeys["NATIVE_BROKER"] = "nativebroker";
     AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
@@ -558,7 +561,7 @@ var CacheOutcome;
     CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
 })(CacheOutcome || (CacheOutcome = {}));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -602,7 +605,7 @@ var AuthError = /** @class */ (function (_super) {
     return AuthError;
 }(Error));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -677,7 +680,7 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
     }
 };
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1139,7 +1142,7 @@ var ClientAuthError = /** @class */ (function (_super) {
     return ClientAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1264,7 +1267,7 @@ var StringUtils = /** @class */ (function () {
     return StringUtils;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1444,12 +1447,12 @@ var Logger = /** @class */ (function () {
     return Logger;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /* eslint-disable header/header */
 var name$1 = "@azure/msal-common";
-var version$1 = "6.2.0";
+var version$1 = "6.3.0-beta.0";
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1470,7 +1473,7 @@ exports.AzureCloudInstance = void 0;
     AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
 })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1629,7 +1632,7 @@ var CredentialEntity = /** @class */ (function () {
     return CredentialEntity;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1884,7 +1887,7 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     return ClientConfigurationError;
 }(ClientAuthError));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2068,7 +2071,7 @@ var ScopeSet = /** @class */ (function () {
     return ScopeSet;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2106,7 +2109,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2120,7 +2123,7 @@ var AuthorityType;
     AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
 })(AuthorityType || (AuthorityType = {}));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2147,6 +2150,7 @@ var AuthorityType;
  *      lastModificationApp:
  *      oboAssertion: access token passed in as part of OBO request
  *      idTokenClaims: Object containing claims parsed from ID token
+ *      nativeAccountId: Account identifier on the native device
  * }
  */
 var AccountEntity = /** @class */ (function () {
@@ -2200,7 +2204,8 @@ var AccountEntity = /** @class */ (function () {
             username: this.username,
             localAccountId: this.localAccountId,
             name: this.name,
-            idTokenClaims: this.idTokenClaims
+            idTokenClaims: this.idTokenClaims,
+            nativeAccountId: this.nativeAccountId
         };
     };
     /**
@@ -2222,12 +2227,13 @@ var AccountEntity = /** @class */ (function () {
      * @param idToken
      * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
         var _a, _b, _c, _d, _e, _f;
         var account = new AccountEntity();
         account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
         account.clientInfo = clientInfo;
         account.homeAccountId = homeAccountId;
+        account.nativeAccountId = nativeAccountId;
         var env = environment || (authority && authority.getPreferredCache());
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -2349,12 +2355,13 @@ var AccountEntity = /** @class */ (function () {
             (accountA.username === accountB.username) &&
             (accountA.tenantId === accountB.tenantId) &&
             (accountA.environment === accountB.environment) &&
+            (accountA.nativeAccountId === accountB.nativeAccountId) &&
             claimsMatch;
     };
     return AccountEntity;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2392,7 +2399,7 @@ var AuthToken = /** @class */ (function () {
     return AuthToken;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2760,7 +2767,7 @@ var CacheManager = /** @class */ (function () {
         });
     };
     /**
-     * returns a boolean if the given account is removed
+     * Removes credentials associated with the provided account
      * @param account
      */
     CacheManager.prototype.removeAccountContext = function (account) {
@@ -3234,7 +3241,7 @@ var DefaultStorageClass = /** @class */ (function (_super) {
     return DefaultStorageClass;
 }(CacheManager));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3328,7 +3335,7 @@ function buildAuthOptions(authOptions) {
     return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS }, authOptions);
 }
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3348,7 +3355,7 @@ var ServerError = /** @class */ (function (_super) {
     return ServerError;
 }(AuthError));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3444,7 +3451,7 @@ var ThrottlingUtils = /** @class */ (function () {
     return ThrottlingUtils;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3493,7 +3500,7 @@ var NetworkManager = /** @class */ (function () {
     return NetworkManager;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3504,7 +3511,7 @@ var CcsCredentialType;
     CcsCredentialType["UPN"] = "UPN";
 })(CcsCredentialType || (CcsCredentialType = {}));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3593,7 +3600,7 @@ var BaseClient = /** @class */ (function () {
     return BaseClient;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3679,7 +3686,7 @@ var RequestValidator = /** @class */ (function () {
     return RequestValidator;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3695,6 +3702,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addResponseTypeCode = function () {
         this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
     };
+    /**
+     * add response_type = token id_token
+     */
+    RequestParameterBuilder.prototype.addResponseTypeForTokenAndIdToken = function () {
+        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.TOKEN_RESPONSE_TYPE + " " + Constants.ID_TOKEN_RESPONSE_TYPE));
+    };
     /**
      * add response_mode. defaults to query.
      * @param responseMode
@@ -3702,6 +3715,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addResponseMode = function (responseMode) {
         this.parameters.set(AADServerParamKeys.RESPONSE_MODE, encodeURIComponent((responseMode) ? responseMode : ResponseMode.QUERY));
     };
+    /**
+     * Add flag to indicate STS should attempt to use WAM if available
+     */
+    RequestParameterBuilder.prototype.addNativeBroker = function () {
+        this.parameters.set(AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
+    };
     /**
      * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
      * @param scopeSet
@@ -4041,7 +4060,7 @@ var RequestParameterBuilder = /** @class */ (function () {
     return RequestParameterBuilder;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4106,7 +4125,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
     return IdTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4156,7 +4175,7 @@ var TimeUtils = /** @class */ (function () {
     return TimeUtils;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4270,7 +4289,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
     return AccessTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4337,7 +4356,7 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
     return RefreshTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4401,7 +4420,7 @@ var InteractionRequiredAuthError = /** @class */ (function (_super) {
     return InteractionRequiredAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4417,7 +4436,7 @@ var CacheRecord = /** @class */ (function () {
     return CacheRecord;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4488,7 +4507,7 @@ var ProtocolUtils = /** @class */ (function () {
     return ProtocolUtils;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4689,7 +4708,7 @@ var UrlString = /** @class */ (function () {
     return UrlString;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4704,6 +4723,11 @@ var PopTokenGenerator = /** @class */ (function () {
     function PopTokenGenerator(cryptoUtils) {
         this.cryptoUtils = cryptoUtils;
     }
+    /**
+     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.generateCnf = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var reqCnf;
@@ -4717,6 +4741,23 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Generates the hash of the req_cnf
+     * @param cnf
+     * @returns
+     */
+    PopTokenGenerator.prototype.generateCnfHash = function (cnf) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                return [2 /*return*/, this.cryptoUtils.hashString(cnf)];
+            });
+        });
+    };
+    /**
+     * Generates key_id for a SHR token request
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.generateKid = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var kidThumbprint;
@@ -4733,6 +4774,12 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Signs the POP access_token with the local generated key-pair
+     * @param accessToken
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.signPopToken = function (accessToken, request) {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
@@ -4746,6 +4793,14 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Utility function to generate the signed JWT for an access_token
+     * @param payload
+     * @param kid
+     * @param request
+     * @param claims
+     * @returns
+     */
     PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
         return __awaiter(this, void 0, void 0, function () {
             var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
@@ -4764,7 +4819,7 @@ var PopTokenGenerator = /** @class */ (function () {
     return PopTokenGenerator;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4834,7 +4889,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return AppMetadataEntity;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4870,7 +4925,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return TokenCacheContext;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5126,7 +5181,8 @@ var ResponseHandler = /** @class */ (function () {
                                 state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
                                 msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
-                                code: code
+                                code: code,
+                                fromNativeBroker: false
                             }];
                 }
             });
@@ -5135,7 +5191,7 @@ var ResponseHandler = /** @class */ (function () {
     return ResponseHandler;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5166,8 +5222,12 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
         return __awaiter(this, void 0, void 0, function () {
             var queryString;
             return __generator(this, function (_a) {
-                queryString = this.createAuthCodeUrlQueryString(request);
-                return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.createAuthCodeUrlQueryString(request)];
+                    case 1:
+                        queryString = _a.sent();
+                        return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                }
             });
         });
     };
@@ -5417,96 +5477,116 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      * @param request
      */
     AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
-        var parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(this.config.authOptions.clientId);
-        var requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
-        parameterBuilder.addScopes(requestScopes);
-        // validate the redirectUri (to be a non null value)
-        parameterBuilder.addRedirectUri(request.redirectUri);
-        // generate the correlationId if not set by the user and add
-        var correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
-        parameterBuilder.addCorrelationId(correlationId);
-        // add response_mode. If not passed in it defaults to query.
-        parameterBuilder.addResponseMode(request.responseMode);
-        // add response_type = code
-        parameterBuilder.addResponseTypeCode();
-        // add library info parameters
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        // add client_info=1
-        parameterBuilder.addClientInfo();
-        if (request.codeChallenge && request.codeChallengeMethod) {
-            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
-        }
-        if (request.prompt) {
-            parameterBuilder.addPrompt(request.prompt);
-        }
-        if (request.domainHint) {
-            parameterBuilder.addDomainHint(request.domainHint);
-        }
-        // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
-        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
-            // AAD will throw if prompt=select_account is passed with an account hint
-            if (request.sid && request.prompt === PromptValue.NONE) {
-                // SessionID is only used in silent calls
-                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
-                parameterBuilder.addSid(request.sid);
-            }
-            else if (request.account) {
-                var accountSid = this.extractAccountSid(request.account);
-                // If account and loginHint are provided, we will check account first for sid before adding loginHint
-                if (accountSid && request.prompt === PromptValue.NONE) {
-                    // SessionId is only used in silent calls
-                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
-                    parameterBuilder.addSid(accountSid);
-                    try {
-                        var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                    }
-                }
-                else if (request.loginHint) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
-                    parameterBuilder.addLoginHint(request.loginHint);
-                    parameterBuilder.addCcsUpn(request.loginHint);
-                }
-                else if (request.account.username) {
-                    // Fallback to account username if provided
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
-                    parameterBuilder.addLoginHint(request.account.username);
-                    try {
-                        var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                    }
+        return __awaiter(this, void 0, void 0, function () {
+            var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, cnf, cnfHash;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        parameterBuilder = new RequestParameterBuilder();
+                        parameterBuilder.addClientId(this.config.authOptions.clientId);
+                        requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
+                        parameterBuilder.addScopes(requestScopes);
+                        // validate the redirectUri (to be a non null value)
+                        parameterBuilder.addRedirectUri(request.redirectUri);
+                        correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
+                        parameterBuilder.addCorrelationId(correlationId);
+                        // add response_mode. If not passed in it defaults to query.
+                        parameterBuilder.addResponseMode(request.responseMode);
+                        // add response_type = code
+                        parameterBuilder.addResponseTypeCode();
+                        // add library info parameters
+                        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+                        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+                        // add client_info=1
+                        parameterBuilder.addClientInfo();
+                        if (request.codeChallenge && request.codeChallengeMethod) {
+                            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
+                        }
+                        if (request.prompt) {
+                            parameterBuilder.addPrompt(request.prompt);
+                        }
+                        if (request.domainHint) {
+                            parameterBuilder.addDomainHint(request.domainHint);
+                        }
+                        // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
+                        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+                            // AAD will throw if prompt=select_account is passed with an account hint
+                            if (request.sid && request.prompt === PromptValue.NONE) {
+                                // SessionID is only used in silent calls
+                                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
+                                parameterBuilder.addSid(request.sid);
+                            }
+                            else if (request.account) {
+                                accountSid = this.extractAccountSid(request.account);
+                                // If account and loginHint are provided, we will check account first for sid before adding loginHint
+                                if (accountSid && request.prompt === PromptValue.NONE) {
+                                    // SessionId is only used in silent calls
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
+                                    parameterBuilder.addSid(accountSid);
+                                    try {
+                                        clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                        parameterBuilder.addCcsOid(clientInfo);
+                                    }
+                                    catch (e) {
+                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                    }
+                                }
+                                else if (request.loginHint) {
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
+                                    parameterBuilder.addLoginHint(request.loginHint);
+                                    parameterBuilder.addCcsUpn(request.loginHint);
+                                }
+                                else if (request.account.username) {
+                                    // Fallback to account username if provided
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
+                                    parameterBuilder.addLoginHint(request.account.username);
+                                    try {
+                                        clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                        parameterBuilder.addCcsOid(clientInfo);
+                                    }
+                                    catch (e) {
+                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                    }
+                                }
+                            }
+                            else if (request.loginHint) {
+                                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
+                                parameterBuilder.addLoginHint(request.loginHint);
+                                parameterBuilder.addCcsUpn(request.loginHint);
+                            }
+                        }
+                        else {
+                            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
+                        }
+                        if (request.nonce) {
+                            parameterBuilder.addNonce(request.nonce);
+                        }
+                        if (request.state) {
+                            parameterBuilder.addState(request.state);
+                        }
+                        if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
+                            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+                        }
+                        if (request.extraQueryParameters) {
+                            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+                        }
+                        if (!request.nativeBroker) return [3 /*break*/, 3];
+                        // signal ests that this is a WAM call
+                        parameterBuilder.addNativeBroker();
+                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                        popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
+                        return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
+                    case 1:
+                        cnf = _a.sent();
+                        return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
+                    case 2:
+                        cnfHash = _a.sent();
+                        parameterBuilder.addPopToken(cnfHash);
+                        _a.label = 3;
+                    case 3: return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
-            }
-            else if (request.loginHint) {
-                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
-                parameterBuilder.addLoginHint(request.loginHint);
-                parameterBuilder.addCcsUpn(request.loginHint);
-            }
-        }
-        else {
-            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
-        }
-        if (request.nonce) {
-            parameterBuilder.addNonce(request.nonce);
-        }
-        if (request.state) {
-            parameterBuilder.addState(request.state);
-        }
-        if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
-        }
-        if (request.extraQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
-        }
-        return parameterBuilder.createQueryString();
+            });
+        });
     };
     /**
      * This API validates the `EndSessionRequest` and creates a URL
@@ -5548,7 +5628,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     return AuthorizationCodeClient;
 }(BaseClient));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5760,7 +5840,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
     return RefreshTokenClient;
 }(BaseClient));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5876,7 +5956,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     return SilentFlowClient;
 }(BaseClient));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5887,7 +5967,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("issuer"));
 }
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5901,7 +5981,7 @@ exports.ProtocolMode = void 0;
     ProtocolMode["OIDC"] = "OIDC";
 })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5976,7 +6056,7 @@ var AuthorityMetadataEntity = /** @class */ (function () {
     return AuthorityMetadataEntity;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5986,7 +6066,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6108,7 +6188,7 @@ var RegionDiscovery = /** @class */ (function () {
     return RegionDiscovery;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6698,7 +6778,7 @@ var Authority = /** @class */ (function () {
     return Authority;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6759,7 +6839,7 @@ var AuthorityFactory = /** @class */ (function () {
     return AuthorityFactory;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6790,7 +6870,7 @@ var ServerTelemetryEntity = /** @class */ (function () {
     return ServerTelemetryEntity;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6818,7 +6898,7 @@ var ThrottlingEntity = /** @class */ (function () {
     return ThrottlingEntity;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6835,7 +6915,7 @@ var StubbedNetworkModule = {
     }
 };
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6894,7 +6974,7 @@ var AuthenticationHeaderParser = /** @class */ (function () {
     return AuthenticationHeaderParser;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7056,7 +7136,7 @@ var ServerTelemetryManager = /** @class */ (function () {
     return ServerTelemetryManager;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7089,6 +7169,11 @@ exports.PerformanceEvents = void 0;
      * Internal API for acquireTokenSilent.
      */
     PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
+    /**
+     * acquireTokenPopup (msal-browser).
+     * Used to acquire a new access token interactively through pop ups
+     */
+    PerformanceEvents["AcquireTokenPopup"] = "acquireTokenPopup";
     /**
      * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
      * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
@@ -7124,6 +7209,16 @@ exports.PerformanceEvents = void 0;
      * Used to load authority metadata for a request.
      */
     PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
+    /**
+     * acquireToken APIs in msal-browser.
+     * Used to make an /authorize endpoint call with native brokering enabled.
+     */
+    PerformanceEvents["FetchAccountIdWithNativeBroker"] = "fetchAccountIdWithNativeBroker";
+    /**
+     * acquireToken API in NativeInteractionClient class (msal-browser).
+     * Used to acquire a token from Native component when native brokering is enabled.
+     */
+    PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
 })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
 /**
  * State of the performance event.
@@ -7138,7 +7233,7 @@ var PerformanceEventStatus;
     PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
 })(PerformanceEventStatus || (PerformanceEventStatus = {}));
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7408,7 +7503,7 @@ var PerformanceClient = /** @class */ (function () {
     return PerformanceClient;
 }());
 
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7477,6 +7572,17 @@ var BrowserConstants = {
      */
     MSAL_SKU: "msal.js.browser",
 };
+var NativeConstants = {
+    CHANNEL_ID: "53ee284d-920a-4b59-9d30-a60315b26836",
+    PREFERRED_EXTENSION_ID: "ppnbnpeolgkicgegkbkbjmhlideopiji"
+};
+var NativeExtensionMethod;
+(function (NativeExtensionMethod) {
+    NativeExtensionMethod["HandshakeRequest"] = "Handshake";
+    NativeExtensionMethod["HandshakeResponse"] = "HandshakeResponse";
+    NativeExtensionMethod["GetToken"] = "GetToken";
+    NativeExtensionMethod["Response"] = "Response";
+})(NativeExtensionMethod || (NativeExtensionMethod = {}));
 exports.BrowserCacheLocation = void 0;
 (function (BrowserCacheLocation) {
     BrowserCacheLocation["LocalStorage"] = "localStorage";
@@ -7509,6 +7615,7 @@ exports.TemporaryCacheKeys = void 0;
     TemporaryCacheKeys["INTERACTION_STATUS_KEY"] = "interaction.status";
     TemporaryCacheKeys["CCS_CREDENTIAL"] = "ccs.credential";
     TemporaryCacheKeys["CORRELATION_ID"] = "request.correlationId";
+    TemporaryCacheKeys["NATIVE_REQUEST"] = "request.native";
 })(exports.TemporaryCacheKeys || (exports.TemporaryCacheKeys = {}));
 /**
  * Cache keys stored in-memory
@@ -8127,9 +8234,37 @@ var BrowserAuthErrorMessage = {
         code: "auth_code_required",
         desc: "An authorization code must be provided (as the `code` property on the request) to this flow."
     },
+    authCodeOrNativeAccountRequired: {
+        code: "auth_code_or_nativeAccountId_required",
+        desc: "An authorization code or nativeAccountId must be provided to this flow."
+    },
     databaseUnavailable: {
         code: "database_unavailable",
         desc: "IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts."
+    },
+    unableToAcquireTokenFromNativePlatform: {
+        code: "unable_to_acquire_token_from_native_platform",
+        desc: "Unable to acquire token from native platform. For a list of possible reasons visit aka.ms/msaljs/browser-errors."
+    },
+    nativeHandshakeTimeout: {
+        code: "native_handshake_timeout",
+        desc: "Timed out while attempting to establish connection to browser extension"
+    },
+    nativeExtensionNotInstalled: {
+        code: "native_extension_not_installed",
+        desc: "Native extension is not installed. If you think this is a mistake call the initialize function."
+    },
+    nativeConnectionNotEstablished: {
+        code: "native_connection_not_established",
+        desc: "Connection to native platform has not been established. Please install a compatible browser extension and run initialize(). For more please visit aka.ms/msaljs/browser-errors."
+    },
+    nativeBrokerCalledBeforeInitialize: {
+        code: "native_broker_called_before_initialize",
+        desc: "You must call and await the initialize function before attempting to call any other MSAL API when native brokering is enabled. For more please visit aka.ms/msaljs/browser-errors."
+    },
+    nativePromptNotSupported: {
+        code: "native_prompt_not_supported",
+        desc: "The provided prompt is not supported by the native platform. This request should be routed to the web based flow."
     }
 };
 /**
@@ -8369,12 +8504,56 @@ var BrowserAuthError = /** @class */ (function (_super) {
     BrowserAuthError.createAuthCodeRequiredError = function () {
         return new BrowserAuthError(BrowserAuthErrorMessage.authCodeRequired.code, BrowserAuthErrorMessage.authCodeRequired.desc);
     };
+    /**
+     * Create an error when an authorization code or native account ID is required but not provided
+     */
+    BrowserAuthError.createAuthCodeOrNativeAccountIdRequiredError = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.authCodeOrNativeAccountRequired.code, BrowserAuthErrorMessage.authCodeOrNativeAccountRequired.desc);
+    };
     /**
      * Create an error when IndexedDB is unavailable
      */
     BrowserAuthError.createDatabaseUnavailableError = function () {
         return new BrowserAuthError(BrowserAuthErrorMessage.databaseUnavailable.code, BrowserAuthErrorMessage.databaseUnavailable.desc);
     };
+    /**
+     * Create an error when native token acquisition is not possible
+     */
+    BrowserAuthError.createUnableToAcquireTokenFromNativePlatformError = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.unableToAcquireTokenFromNativePlatform.code, BrowserAuthErrorMessage.unableToAcquireTokenFromNativePlatform.desc);
+    };
+    /**
+     * Create an error thrown when Handshake with browser extension times out
+     */
+    BrowserAuthError.createNativeHandshakeTimeoutError = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.nativeHandshakeTimeout.code, BrowserAuthErrorMessage.nativeHandshakeTimeout.desc);
+    };
+    /**
+     * Create an error thrown when browser extension is not installed
+     */
+    BrowserAuthError.createNativeExtensionNotInstalledError = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.nativeExtensionNotInstalled.code, BrowserAuthErrorMessage.nativeExtensionNotInstalled.desc);
+    };
+    /**
+     * Create an error when native connection has not been established
+     * @returns
+     */
+    BrowserAuthError.createNativeConnectionNotEstablishedError = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.nativeConnectionNotEstablished.code, BrowserAuthErrorMessage.nativeConnectionNotEstablished.desc);
+    };
+    /**
+     * Create an error thrown when the initialize function hasn't been called
+     */
+    BrowserAuthError.createNativeBrokerCalledBeforeInitialize = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.nativeBrokerCalledBeforeInitialize.code, BrowserAuthErrorMessage.nativeBrokerCalledBeforeInitialize.desc);
+    };
+    /**
+     * Create an error thrown when requesting a token directly from the native platform with an unsupported prompt parameter e.g. select_account, login or create
+     * These requests must go through eSTS to ensure eSTS is aware of the new account
+     */
+    BrowserAuthError.createNativePromptParameterNotSupportedError = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.nativePromptNotSupported.code, BrowserAuthErrorMessage.nativePromptNotSupported.desc);
+    };
     return BrowserAuthError;
 }(AuthError));
 
@@ -10020,6 +10199,30 @@ var BrowserCacheManager = /** @class */ (function (_super) {
             return true;
         });
     };
+    /**
+     * Checks the cache for accounts matching loginHint or SID
+     * @param loginHint
+     * @param sid
+     */
+    BrowserCacheManager.prototype.getAccountInfoByHints = function (loginHint, sid) {
+        var matchingAccounts = this.getAllAccounts().filter(function (accountInfo) {
+            if (sid) {
+                var accountSid = accountInfo.idTokenClaims && accountInfo.idTokenClaims["sid"];
+                return sid === accountSid;
+            }
+            if (loginHint) {
+                return loginHint === accountInfo.username;
+            }
+            return false;
+        });
+        if (matchingAccounts.length === 1) {
+            return matchingAccounts[0];
+        }
+        else if (matchingAccounts.length > 1) {
+            throw ClientAuthError.createMultipleMatchingAccountsInCacheError();
+        }
+        return null;
+    };
     /**
      * fetch throttling entity from the platform cache
      * @param throttlingCacheKey
@@ -10337,6 +10540,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.URL_HASH));
         this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.CORRELATION_ID));
         this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.CCS_CREDENTIAL));
+        this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.NATIVE_REQUEST));
         this.setInteractionInProgress(false);
     };
     /**
@@ -10414,6 +10618,23 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         }
         return parsedRequest;
     };
+    /**
+     * Gets cached native request for redirect flows
+     */
+    BrowserCacheManager.prototype.getCachedNativeRequest = function () {
+        this.logger.trace("BrowserCacheManager.getCachedNativeRequest called");
+        var cachedRequest = this.getTemporaryCache(exports.TemporaryCacheKeys.NATIVE_REQUEST, true);
+        if (!cachedRequest) {
+            this.logger.trace("BrowserCacheManager.getCachedNativeRequest: No cached native request found");
+            return null;
+        }
+        var parsedRequest = this.validateAndParseJson(cachedRequest);
+        if (!parsedRequest) {
+            this.logger.error("BrowserCacheManager.getCachedNativeRequest: Unable to parse native request");
+            return null;
+        }
+        return parsedRequest;
+    };
     BrowserCacheManager.prototype.isInteractionInProgress = function (matchClientId) {
         var clientId = this.getInteractionInProgress();
         if (matchClientId) {
@@ -10877,6 +11098,16 @@ var BrowserUtils = /** @class */ (function () {
             throw BrowserAuthError.createNonBrowserEnvironmentError();
         }
     };
+    /**
+     * Throws error if native brokering is enabled but initialize hasn't been called
+     * @param allowNativeBroker
+     * @param initialized
+     */
+    BrowserUtils.blockNativeBrokerCalledBeforeInitialized = function (allowNativeBroker, initialized) {
+        if (allowNativeBroker && !initialized) {
+            throw BrowserAuthError.createNativeBrokerCalledBeforeInitialize();
+        }
+    };
     /**
      * Returns boolean of whether current browser is an Internet Explorer or Edge browser.
      */
@@ -10944,6 +11175,7 @@ var NavigationClient = /** @class */ (function () {
 var DEFAULT_POPUP_TIMEOUT_MS = 60000;
 var DEFAULT_IFRAME_TIMEOUT_MS = 6000;
 var DEFAULT_REDIRECT_TIMEOUT_MS = 30000;
+var DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS = 2000;
 /**
  * MSAL function that sets the default options when not explicitly configured from app developer
  *
@@ -10988,7 +11220,7 @@ function buildConfiguration(_a, isBrowserEnvironment) {
     // Default system options for browser
     var DEFAULT_BROWSER_SYSTEM_OPTIONS = __assign$1(__assign$1({}, DEFAULT_SYSTEM_OPTIONS), { loggerOptions: DEFAULT_LOGGER_OPTIONS, networkClient: isBrowserEnvironment ? BrowserUtils.getBrowserNetworkClient() : StubbedNetworkModule, navigationClient: new NavigationClient(), loadFrameTimeout: 0, 
         // If loadFrameTimeout is provided, use that as default.
-        windowHashTimeout: (userInputSystem && userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem && userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false });
+        windowHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false, allowNativeBroker: false, nativeBrokerHandshakeTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.nativeBrokerHandshakeTimeout) || DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS });
     var DEFAULT_TELEMETRY_OPTIONS = {
         application: {
             appName: Constants.EMPTY_STRING,
@@ -11006,7 +11238,7 @@ function buildConfiguration(_a, isBrowserEnvironment) {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-browser";
-var version = "2.23.0";
+var version = "2.24.0-beta.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11014,6 +11246,8 @@ var version = "2.23.0";
  */
 exports.EventType = void 0;
 (function (EventType) {
+    EventType["INITIALIZE_START"] = "msal:initializeStart";
+    EventType["INITIALIZE_END"] = "msal:initializeEnd";
     EventType["ACCOUNT_ADDED"] = "msal:accountAdded";
     EventType["ACCOUNT_REMOVED"] = "msal:accountRemoved";
     EventType["LOGIN_START"] = "msal:loginStart";
@@ -11163,12 +11397,14 @@ var EventHandler = /** @class */ (function () {
  * Licensed under the MIT License.
  */
 var BaseInteractionClient = /** @class */ (function () {
-    function BaseInteractionClient(config, storageImpl, browserCrypto, logger, eventHandler, performanceClient, correlationId) {
+    function BaseInteractionClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) {
         this.config = config;
         this.browserStorage = storageImpl;
         this.browserCrypto = browserCrypto;
         this.networkClient = this.config.system.networkClient;
         this.eventHandler = eventHandler;
+        this.navigationClient = navigationClient;
+        this.nativeMessageHandler = nativeMessageHandler;
         this.correlationId = correlationId || this.browserCrypto.createNewGuid();
         this.logger = logger.clone(BrowserConstants.MSAL_SKU, version, this.correlationId);
         this.performanceClient = performanceClient;
@@ -11291,6 +11527,36 @@ var BaseInteractionClient = /** @class */ (function () {
         };
         return new ServerTelemetryManager(telemetryPayload, this.browserStorage);
     };
+    /**
+     * Used to get a discovered version of the default authority.
+     * @param requestAuthority
+     * @param requestCorrelationId
+     */
+    BaseInteractionClient.prototype.getDiscoveredAuthority = function (requestAuthority) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var authorityOptions;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.verbose("getDiscoveredAuthority called");
+                        authorityOptions = {
+                            protocolMode: this.config.auth.protocolMode,
+                            knownAuthorities: this.config.auth.knownAuthorities,
+                            cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
+                            authorityMetadata: this.config.auth.authorityMetadata
+                        };
+                        if (!requestAuthority) return [3 /*break*/, 2];
+                        this.logger.verbose("Creating discovered authority with request authority");
+                        return [4 /*yield*/, AuthorityFactory.createDiscoveredInstance(requestAuthority, this.config.system.networkClient, this.browserStorage, authorityOptions)];
+                    case 1: return [2 /*return*/, _a.sent()];
+                    case 2:
+                        this.logger.verbose("Creating discovered authority with configured authority");
+                        return [4 /*yield*/, AuthorityFactory.createDiscoveredInstance(this.config.auth.authority, this.config.system.networkClient, this.browserStorage, authorityOptions)];
+                    case 3: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
     return BaseInteractionClient;
 }());
 
@@ -11303,10 +11569,8 @@ var BaseInteractionClient = /** @class */ (function () {
  */
 var StandardInteractionClient = /** @class */ (function (_super) {
     __extends$1(StandardInteractionClient, _super);
-    function StandardInteractionClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId) {
-        var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, performanceClient, correlationId) || this;
-        _this.navigationClient = navigationClient;
-        return _this;
+    function StandardInteractionClient() {
+        return _super !== null && _super.apply(this, arguments) || this;
     }
     /**
      * Generates an auth code request tied to the url request.
@@ -11336,7 +11600,7 @@ var StandardInteractionClient = /** @class */ (function (_super) {
      */
     StandardInteractionClient.prototype.initializeLogoutRequest = function (logoutRequest) {
         this.logger.verbose("initializeLogoutRequest called", logoutRequest === null || logoutRequest === void 0 ? void 0 : logoutRequest.correlationId);
-        var validLogoutRequest = __assign$1({ correlationId: this.browserCrypto.createNewGuid() }, logoutRequest);
+        var validLogoutRequest = __assign$1({ correlationId: this.correlationId || this.browserCrypto.createNewGuid() }, logoutRequest);
         /**
          * Set logout_hint to be login_hint from ID Token Claims if present
          * and logoutHint attribute wasn't manually set in logout request
@@ -11478,10 +11742,8 @@ var StandardInteractionClient = /** @class */ (function (_super) {
      * @param hash
      * @param interactionType
      */
-    StandardInteractionClient.prototype.validateAndExtractStateFromHash = function (hash, interactionType, requestCorrelationId) {
+    StandardInteractionClient.prototype.validateAndExtractStateFromHash = function (serverParams, interactionType, requestCorrelationId) {
         this.logger.verbose("validateAndExtractStateFromHash called", requestCorrelationId);
-        // Deserialize hash fragment response parameters.
-        var serverParams = UrlString.getDeserializedHash(hash);
         if (!serverParams.state) {
             throw BrowserAuthError.createHashDoesNotContainStateError();
         }
@@ -11786,7 +12048,18 @@ var InteractionHandler = /** @class */ (function () {
                 if (!requestState) {
                     throw ClientAuthError.createStateNotFoundError("Cached State");
                 }
-                authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                try {
+                    authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                }
+                catch (e) {
+                    if (e instanceof ServerError && e.subError === BrowserAuthErrorMessage.userCancelledError.code) {
+                        // Translate server error caused by user closing native prompt to corresponding first class MSAL error
+                        throw BrowserAuthError.createUserCancelledError();
+                    }
+                    else {
+                        throw e;
+                    }
+                }
                 return [2 /*return*/, this.handleCodeResponseFromServer(authCodeResponse, state, authority, networkModule)];
             });
         });
@@ -11950,56 +12223,689 @@ var PopupHandler = /** @class */ (function (_super) {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-var PopupClient = /** @class */ (function (_super) {
-    __extends$1(PopupClient, _super);
-    function PopupClient() {
-        return _super !== null && _super.apply(this, arguments) || this;
+var NativeStatusCode;
+(function (NativeStatusCode) {
+    NativeStatusCode["USER_INTERACTION_REQUIRED"] = "USER_INTERACTION_REQUIRED";
+    NativeStatusCode["USER_CANCEL"] = "USER_CANCEL";
+    NativeStatusCode["NO_NETWORK"] = "NO_NETWORK";
+    NativeStatusCode["TRANSIENT_ERROR"] = "TRANSIENT_ERROR";
+    NativeStatusCode["PERSISTENT_ERROR"] = "PERSISTENT_ERROR";
+})(NativeStatusCode || (NativeStatusCode = {}));
+var NativeAuthErrorMessage = {
+    extensionError: {
+        code: "ContentError"
+    },
+    userSwitch: {
+        code: "user_switch",
+        desc: "User attempted to switch accounts in the native broker, which is not allowed. All new accounts must sign-in through the standard web flow first, please try again."
+    }
+};
+var NativeAuthError = /** @class */ (function (_super) {
+    __extends$1(NativeAuthError, _super);
+    function NativeAuthError(errorCode, description, ext) {
+        var _this = _super.call(this, errorCode, description) || this;
+        Object.setPrototypeOf(_this, NativeAuthError.prototype);
+        _this.name = "NativeAuthError";
+        _this.ext = ext;
+        return _this;
     }
     /**
-     * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
-     * @param request
+     * These errors should result in a fallback to the 'standard' browser based auth flow.
      */
-    PopupClient.prototype.acquireToken = function (request) {
-        try {
-            var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority, this.correlationId);
-            var popupWindowAttributes = request.popupWindowAttributes || {};
-            // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
-            if (this.config.system.asyncPopups) {
-                this.logger.verbose("asyncPopups set to true, acquiring token");
-                // Passes on popup position and dimensions if in request
-                return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes);
-            }
-            else {
-                // asyncPopups flag is set to false. Opens popup before acquiring token.
-                this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
-                var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
-                return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes, popup);
-            }
+    NativeAuthError.prototype.isFatal = function () {
+        if (this.ext && this.ext.status && this.ext.status === NativeStatusCode.PERSISTENT_ERROR) {
+            return true;
         }
-        catch (e) {
-            return Promise.reject(e);
+        switch (this.errorCode) {
+            case NativeAuthErrorMessage.extensionError.code:
+                return true;
+            default:
+                return false;
         }
     };
     /**
-     * Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
-     * @param logoutRequest
+     * Create the appropriate error object based on the WAM status code.
+     * @param code
+     * @param description
+     * @param ext
+     * @returns
      */
-    PopupClient.prototype.logout = function (logoutRequest) {
-        try {
-            this.logger.verbose("logoutPopup called");
-            var validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-            var popupName = PopupUtils.generateLogoutPopupName(this.config.auth.clientId, validLogoutRequest);
-            var authority = logoutRequest && logoutRequest.authority;
-            var mainWindowRedirectUri = logoutRequest && logoutRequest.mainWindowRedirectUri;
-            var popupWindowAttributes = (logoutRequest === null || logoutRequest === void 0 ? void 0 : logoutRequest.popupWindowAttributes) || {};
-            // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
-            if (this.config.system.asyncPopups) {
-                this.logger.verbose("asyncPopups set to true");
-                // Passes on popup position and dimensions if in request
-                return this.logoutPopupAsync(validLogoutRequest, popupName, popupWindowAttributes, authority, undefined, mainWindowRedirectUri);
+    NativeAuthError.createError = function (code, description, ext) {
+        if (ext && ext.status) {
+            switch (ext.status) {
+                case NativeStatusCode.USER_INTERACTION_REQUIRED:
+                    return new InteractionRequiredAuthError(code, description);
+                case NativeStatusCode.USER_CANCEL:
+                    return BrowserAuthError.createUserCancelledError();
+                case NativeStatusCode.NO_NETWORK:
+                    return BrowserAuthError.createNoNetworkConnectivityError();
             }
-            else {
-                // asyncPopups flag is set to false. Opens popup before logging out.
+        }
+        return new NativeAuthError(code, description, ext);
+    };
+    /**
+     * Creates user switch error when the user chooses a different account in the native broker prompt
+     * @returns
+     */
+    NativeAuthError.createUserSwitchError = function () {
+        return new NativeAuthError(NativeAuthErrorMessage.userSwitch.code, NativeAuthErrorMessage.userSwitch.desc);
+    };
+    return NativeAuthError;
+}(AuthError));
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var NativeInteractionClient = /** @class */ (function (_super) {
+    __extends$1(NativeInteractionClient, _super);
+    function NativeInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, correlationId) {
+        var _this = _super.call(this, config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId) || this;
+        _this.apiId = apiId;
+        _this.accountId = accountId;
+        _this.nativeMessageHandler = provider;
+        return _this;
+    }
+    /**
+     * Acquire token from native platform via browser extension
+     * @param request
+     */
+    NativeInteractionClient.prototype.acquireToken = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var nativeATMeasurement, nativeRequest, messageBody, reqTimestamp, response, validatedResponse;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.trace("NativeInteractionClient - acquireToken called.");
+                        nativeATMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+                        return [4 /*yield*/, this.initializeNativeRequest(request)];
+                    case 1:
+                        nativeRequest = _a.sent();
+                        messageBody = {
+                            method: NativeExtensionMethod.GetToken,
+                            request: nativeRequest
+                        };
+                        reqTimestamp = TimeUtils.nowSeconds();
+                        return [4 /*yield*/, this.nativeMessageHandler.sendMessage(messageBody)];
+                    case 2:
+                        response = _a.sent();
+                        validatedResponse = this.validateNativeResponse(response);
+                        return [2 /*return*/, this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
+                                .then(function (result) {
+                                nativeATMeasurement.endMeasurement({
+                                    success: true,
+                                    isNativeBroker: true
+                                });
+                                return result;
+                            })
+                                .catch(function (error) {
+                                nativeATMeasurement.endMeasurement({
+                                    success: false,
+                                    isNativeBroker: true
+                                });
+                                throw error;
+                            })];
+                }
+            });
+        });
+    };
+    /**
+     * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
+     * @param request
+     */
+    NativeInteractionClient.prototype.acquireTokenRedirect = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var nativeRequest, messageBody, response, e_1, navigationOptions, redirectUri;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
+                        return [4 /*yield*/, this.initializeNativeRequest(request)];
+                    case 1:
+                        nativeRequest = _a.sent();
+                        messageBody = {
+                            method: NativeExtensionMethod.GetToken,
+                            request: nativeRequest
+                        };
+                        _a.label = 2;
+                    case 2:
+                        _a.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, this.nativeMessageHandler.sendMessage(messageBody)];
+                    case 3:
+                        response = _a.sent();
+                        this.validateNativeResponse(response);
+                        return [3 /*break*/, 5];
+                    case 4:
+                        e_1 = _a.sent();
+                        // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
+                        if (e_1 instanceof NativeAuthError && e_1.isFatal()) {
+                            throw e_1;
+                        }
+                        return [3 /*break*/, 5];
+                    case 5:
+                        this.browserStorage.setTemporaryCache(exports.TemporaryCacheKeys.NATIVE_REQUEST, JSON.stringify(nativeRequest), true);
+                        navigationOptions = {
+                            apiId: exports.ApiId.acquireTokenRedirect,
+                            timeout: this.config.system.redirectNavigationTimeout,
+                            noHistory: false
+                        };
+                        redirectUri = this.config.auth.navigateToLoginRequestUrl ? window.location.href : this.getRedirectUri(request.redirectUri);
+                        return [4 /*yield*/, this.navigationClient.navigateExternal(redirectUri, navigationOptions)];
+                    case 6:
+                        _a.sent(); // Need to treat this as external to ensure handleRedirectPromise is run again
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * If the previous page called native platform for a token using redirect APIs, send the same request again and return the response
+     */
+    NativeInteractionClient.prototype.handleRedirectPromise = function () {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var cachedRequest, messageBody, reqTimestamp, response, result, e_2;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.trace("NativeInteractionClient - handleRedirectPromise called.");
+                        if (!this.browserStorage.isInteractionInProgress(true)) {
+                            this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
+                            return [2 /*return*/, null];
+                        }
+                        cachedRequest = this.browserStorage.getCachedNativeRequest();
+                        if (!cachedRequest) {
+                            this.logger.verbose("NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null.");
+                            return [2 /*return*/, null];
+                        }
+                        this.browserStorage.removeItem(this.browserStorage.generateCacheKey(exports.TemporaryCacheKeys.NATIVE_REQUEST));
+                        messageBody = {
+                            method: NativeExtensionMethod.GetToken,
+                            request: cachedRequest
+                        };
+                        reqTimestamp = TimeUtils.nowSeconds();
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.");
+                        return [4 /*yield*/, this.nativeMessageHandler.sendMessage(messageBody)];
+                    case 2:
+                        response = _a.sent();
+                        this.validateNativeResponse(response);
+                        result = this.handleNativeResponse(response, cachedRequest, reqTimestamp);
+                        this.browserStorage.setInteractionInProgress(false);
+                        return [2 /*return*/, result];
+                    case 3:
+                        e_2 = _a.sent();
+                        this.browserStorage.setInteractionInProgress(false);
+                        throw e_2;
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Logout from native platform via browser extension
+     * @param request
+     */
+    NativeInteractionClient.prototype.logout = function () {
+        this.logger.trace("NativeInteractionClient - logout called.");
+        return Promise.reject("Logout not implemented yet");
+    };
+    /**
+     * Transform response from native platform into AuthenticationResult object which will be returned to the end user
+     * @param response
+     * @param request
+     * @param reqTimestamp
+     */
+    NativeInteractionClient.prototype.handleNativeResponse = function (response, request, reqTimestamp) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var idTokenObj, authority, authorityPreferredCache, homeAccountIdentifier, accountEntity, responseScopes, accountProperties, uid, tid, responseAccessToken, responseTokenType, _a, popTokenGenerator, shrParameters, result;
+            var _this = this;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.trace("NativeInteractionClient - handleNativeResponse called.");
+                        if (response.account.id !== request.accountId) {
+                            // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
+                            throw NativeAuthError.createUserSwitchError();
+                        }
+                        idTokenObj = new AuthToken(response.id_token || Constants.EMPTY_STRING, this.browserCrypto);
+                        return [4 /*yield*/, this.getDiscoveredAuthority(request.authority)];
+                    case 1:
+                        authority = _b.sent();
+                        authorityPreferredCache = authority.getPreferredCache();
+                        homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj);
+                        accountEntity = AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, undefined, authorityPreferredCache, response.account.id);
+                        this.browserStorage.setAccount(accountEntity);
+                        responseScopes = response.scopes ? ScopeSet.fromString(response.scopes) : ScopeSet.fromString(request.scopes);
+                        accountProperties = response.account.properties || {};
+                        uid = accountProperties["UID"] || idTokenObj.claims.oid || idTokenObj.claims.sub || Constants.EMPTY_STRING;
+                        tid = accountProperties["TenantId"] || idTokenObj.claims.tid || Constants.EMPTY_STRING;
+                        responseTokenType = exports.AuthenticationScheme.BEARER;
+                        _a = request.token_type;
+                        switch (_a) {
+                            case exports.AuthenticationScheme.POP: return [3 /*break*/, 2];
+                        }
+                        return [3 /*break*/, 4];
+                    case 2:
+                        // Set the token type to POP in the response
+                        responseTokenType = exports.AuthenticationScheme.POP;
+                        // Check if native layer returned an SHR token
+                        if (response.shr) {
+                            this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer");
+                            responseAccessToken = response.shr;
+                            return [3 /*break*/, 5];
+                        }
+                        popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+                        shrParameters = {
+                            resourceRequestMethod: request.resourceRequestMethod,
+                            resourceRequestUri: request.resourceRequestUri,
+                            shrClaims: request.shrClaims,
+                            shrNonce: request.shrNonce
+                        };
+                        return [4 /*yield*/, popTokenGenerator.signPopToken(response.access_token, shrParameters)];
+                    case 3:
+                        responseAccessToken = _b.sent();
+                        return [3 /*break*/, 5];
+                    case 4:
+                        {
+                            responseAccessToken = response.access_token;
+                        }
+                        _b.label = 5;
+                    case 5:
+                        result = {
+                            authority: authority.canonicalAuthority,
+                            uniqueId: uid,
+                            tenantId: tid,
+                            scopes: responseScopes.asArray(),
+                            account: accountEntity.getAccountInfo(),
+                            idToken: response.id_token,
+                            idTokenClaims: idTokenObj.claims,
+                            accessToken: responseAccessToken,
+                            fromCache: false,
+                            expiresOn: new Date(Number(reqTimestamp + response.expires_in) * 1000),
+                            tokenType: responseTokenType,
+                            correlationId: this.correlationId,
+                            state: response.state,
+                            fromNativeBroker: true
+                        };
+                        // Remove any existing cached tokens for this account
+                        this.browserStorage.removeAccountContext(accountEntity).catch(function (e) {
+                            _this.logger.error("Error occurred while removing account context from browser storage. " + e);
+                        });
+                        return [2 /*return*/, result];
+                }
+            });
+        });
+    };
+    /**
+     * Validates native platform response before processing
+     * @param response
+     */
+    NativeInteractionClient.prototype.validateNativeResponse = function (response) {
+        if (response.hasOwnProperty("access_token") &&
+            response.hasOwnProperty("id_token") &&
+            response.hasOwnProperty("client_info") &&
+            response.hasOwnProperty("account") &&
+            response.hasOwnProperty("scopes") &&
+            response.hasOwnProperty("expires_in")) {
+            return response;
+        }
+        else {
+            throw NativeAuthError.createUnexpectedError("Response missing expected properties.");
+        }
+    };
+    /**
+     * Translates developer provided request object into NativeRequest object
+     * @param request
+     */
+    NativeInteractionClient.prototype.initializeNativeRequest = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var authority, canonicalAuthority, scopes, scopeSet, instanceAware, validatedRequest, shrParameters, popTokenGenerator, cnf, _a;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.trace("NativeInteractionClient - initializeNativeRequest called");
+                        authority = request.authority || this.config.auth.authority;
+                        canonicalAuthority = new UrlString(authority);
+                        canonicalAuthority.validateAsUri();
+                        scopes = request && request.scopes || [];
+                        scopeSet = new ScopeSet(scopes);
+                        scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
+                        if (request.prompt) {
+                            switch (request.prompt) {
+                                case PromptValue.NONE:
+                                case PromptValue.CONSENT:
+                                    this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
+                                    break;
+                                default:
+                                    this.logger.trace("initializeNativeRequest: prompt = " + request.prompt + " is not compatible with native flow");
+                                    throw BrowserAuthError.createNativePromptParameterNotSupportedError();
+                            }
+                        }
+                        instanceAware = !!(request.extraQueryParameters && request.extraQueryParameters.instance_aware);
+                        validatedRequest = __assign$1(__assign$1({}, request), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scopes: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), correlationId: this.correlationId, instance_aware: instanceAware, token_type: request.authenticationScheme, extraParameters: __assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), extendedExpiryToken: false // Make this configurable?
+                         });
+                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                        shrParameters = {
+                            resourceRequestUri: request.resourceRequestUri,
+                            resourceRequestMethod: request.resourceRequestMethod,
+                            shrClaims: request.shrClaims,
+                            shrNonce: request.shrNonce
+                        };
+                        popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+                        return [4 /*yield*/, popTokenGenerator.generateCnf(shrParameters)];
+                    case 1:
+                        cnf = _b.sent();
+                        // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
+                        _a = validatedRequest;
+                        return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
+                    case 2:
+                        // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
+                        _a.req_cnf = _b.sent();
+                        _b.label = 3;
+                    case 3:
+                        if (this.apiId === exports.ApiId.ssoSilent || this.apiId === exports.ApiId.acquireTokenSilent_silentFlow) {
+                            validatedRequest.prompt = PromptValue.NONE;
+                        }
+                        return [2 /*return*/, validatedRequest];
+                }
+            });
+        });
+    };
+    return NativeInteractionClient;
+}(BaseInteractionClient));
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var NativeMessageHandler = /** @class */ (function () {
+    function NativeMessageHandler(logger, handshakeTimeoutMs, extensionId) {
+        this.logger = logger;
+        this.handshakeTimeoutMs = handshakeTimeoutMs;
+        this.extensionId = extensionId;
+        this.resolvers = new Map(); // Used for non-handshake messages
+        this.handshakeResolvers = new Map(); // Used for handshake messages
+        this.responseId = 0;
+        this.messageChannel = new MessageChannel();
+        this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
+    }
+    /**
+     * Sends a given message to the extension and resolves with the extension response
+     * @param body
+     */
+    NativeMessageHandler.prototype.sendMessage = function (body) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var req;
+            var _this = this;
+            return __generator$1(this, function (_a) {
+                this.logger.trace("NativeMessageHandler - sendMessage called.");
+                req = {
+                    channel: NativeConstants.CHANNEL_ID,
+                    extensionId: this.extensionId,
+                    responseId: this.responseId++,
+                    body: body
+                };
+                this.logger.trace("NativeMessageHandler - Sending request to browser extension");
+                this.logger.tracePii("NativeMessageHandler - Sending request to browser extension: " + JSON.stringify(req));
+                this.messageChannel.port1.postMessage(req);
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        _this.resolvers.set(req.responseId, { resolve: resolve, reject: reject });
+                    })];
+            });
+        });
+    };
+    /**
+     * Returns an instance of the MessageHandler that has successfully established a connection with an extension
+     * @param logger
+     * @param handshakeTimeoutMs
+     */
+    NativeMessageHandler.createProvider = function (logger, handshakeTimeoutMs) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var preferredProvider, backupProvider;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        logger.trace("NativeMessageHandler - createProvider called.");
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 5]);
+                        preferredProvider = new NativeMessageHandler(logger, handshakeTimeoutMs, NativeConstants.PREFERRED_EXTENSION_ID);
+                        return [4 /*yield*/, preferredProvider.sendHandshakeRequest()];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/, preferredProvider];
+                    case 3:
+                        _a.sent();
+                        backupProvider = new NativeMessageHandler(logger, handshakeTimeoutMs);
+                        return [4 /*yield*/, backupProvider.sendHandshakeRequest()];
+                    case 4:
+                        _a.sent();
+                        return [2 /*return*/, backupProvider];
+                    case 5: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Send handshake request helper.
+     */
+    NativeMessageHandler.prototype.sendHandshakeRequest = function () {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var req;
+            var _this = this;
+            return __generator$1(this, function (_a) {
+                this.logger.trace("NativeMessageHandler - sendHandshakeRequest called.");
+                // Register this event listener before sending handshake
+                window.addEventListener("message", this.windowListener, false); // false is important, because content script message processing should work first
+                req = {
+                    channel: NativeConstants.CHANNEL_ID,
+                    extensionId: this.extensionId,
+                    responseId: this.responseId++,
+                    body: {
+                        method: NativeExtensionMethod.HandshakeRequest
+                    }
+                };
+                this.messageChannel.port1.onmessage = function (event) {
+                    _this.onChannelMessage(event);
+                };
+                window.postMessage(req, window.origin, [this.messageChannel.port2]);
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        _this.handshakeResolvers.set(req.responseId, { resolve: resolve, reject: reject });
+                        _this.timeoutId = window.setTimeout(function () {
+                            /*
+                             * Throw an error if neither HandshakeResponse nor original Handshake request are received in a reasonable timeframe.
+                             * This typically suggests an event handler stopped propagation of the Handshake request but did not respond to it on the MessageChannel port
+                             */
+                            window.removeEventListener("message", _this.windowListener, false);
+                            _this.messageChannel.port1.close();
+                            _this.messageChannel.port2.close();
+                            reject(BrowserAuthError.createNativeHandshakeTimeoutError());
+                            _this.handshakeResolvers.delete(req.responseId);
+                        }, _this.handshakeTimeoutMs); // Use a reasonable timeout in milliseconds here
+                    })];
+            });
+        });
+    };
+    /**
+     * Invoked when a message is posted to the window. If a handshake request is received it means the extension is not installed.
+     * @param event
+     */
+    NativeMessageHandler.prototype.onWindowMessage = function (event) {
+        this.logger.trace("NativeMessageHandler - onWindowMessage called");
+        // We only accept messages from ourselves
+        if (event.source !== window) {
+            return;
+        }
+        var request = event.data;
+        if (!request.channel || request.channel !== NativeConstants.CHANNEL_ID) {
+            return;
+        }
+        if (request.extensionId && request.extensionId !== this.extensionId) {
+            return;
+        }
+        if (request.body.method === NativeExtensionMethod.HandshakeRequest) {
+            // If we receive this message back it means no extension intercepted the request, meaning no extension supporting handshake protocol is installed
+            this.logger.verbose(request.extensionId ? "Extension with id: " + request.extensionId + " not installed" : "No extension installed");
+            clearTimeout(this.timeoutId);
+            this.messageChannel.port1.close();
+            this.messageChannel.port2.close();
+            window.removeEventListener("message", this.windowListener, false);
+            var handshakeResolver = this.handshakeResolvers.get(request.responseId);
+            if (handshakeResolver) {
+                handshakeResolver.reject(BrowserAuthError.createNativeExtensionNotInstalledError());
+            }
+        }
+    };
+    /**
+     * Invoked when a message is received from the extension on the MessageChannel port
+     * @param event
+     */
+    NativeMessageHandler.prototype.onChannelMessage = function (event) {
+        this.logger.trace("NativeMessageHandler - onChannelMessage called.");
+        var request = event.data;
+        var resolver = this.resolvers.get(request.responseId);
+        var handshakeResolver = this.handshakeResolvers.get(request.responseId);
+        try {
+            var method = request.body.method;
+            if (method === NativeExtensionMethod.Response) {
+                if (!resolver) {
+                    return;
+                }
+                var response = request.body.response;
+                this.logger.trace("NativeMessageHandler - Received response from browser extension");
+                this.logger.tracePii("NativeMessageHandler - Received response from browser extension: " + JSON.stringify(response));
+                if (response.status !== "Success") {
+                    resolver.reject(NativeAuthError.createError(response.code, response.description, response.ext));
+                }
+                else if (response.result) {
+                    if (response.result["code"] && response.result["description"]) {
+                        resolver.reject(NativeAuthError.createError(response.result["code"], response.result["description"], response.result["ext"]));
+                    }
+                    else {
+                        resolver.resolve(response.result);
+                    }
+                }
+                else {
+                    throw AuthError.createUnexpectedError("Event does not contain result.");
+                }
+                this.resolvers.delete(request.responseId);
+            }
+            else if (method === NativeExtensionMethod.HandshakeResponse) {
+                if (!handshakeResolver) {
+                    return;
+                }
+                clearTimeout(this.timeoutId); // Clear setTimeout
+                window.removeEventListener("message", this.windowListener, false); // Remove 'No extension' listener
+                this.extensionId = request.extensionId;
+                this.logger.verbose("NativeMessageHandler - Received HandshakeResponse from extension: " + this.extensionId);
+                handshakeResolver.resolve();
+                this.handshakeResolvers.delete(request.responseId);
+            }
+            // Do nothing if method is not Response or HandshakeResponse
+        }
+        catch (err) {
+            this.logger.error("Error parsing response from WAM Extension");
+            this.logger.errorPii("Error parsing response from WAM Extension: " + err.toString());
+            this.logger.errorPii("Unable to parse " + event);
+            if (resolver) {
+                resolver.reject(err);
+            }
+            else if (handshakeResolver) {
+                handshakeResolver.reject(err);
+            }
+        }
+    };
+    /**
+     * Returns boolean indicating whether or not the request should attempt to use native broker
+     * @param logger
+     * @param config
+     * @param nativeExtensionProvider
+     * @param authenticationScheme
+     */
+    NativeMessageHandler.isNativeAvailable = function (config, logger, nativeExtensionProvider, authenticationScheme) {
+        logger.trace("isNativeAvailable called");
+        if (!config.system.allowNativeBroker) {
+            logger.trace("isNativeAvailable: allowNativeBroker is not enabled, returning false");
+            // Developer disabled WAM
+            return false;
+        }
+        if (!nativeExtensionProvider) {
+            logger.trace("isNativeAvailable: WAM extension provider is not initialized, returning false");
+            // Extension is not available
+            return false;
+        }
+        if (authenticationScheme) {
+            switch (authenticationScheme) {
+                case exports.AuthenticationScheme.BEARER:
+                case exports.AuthenticationScheme.POP:
+                    logger.trace("isNativeAvailable: authenticationScheme is supported, returning true");
+                    return true;
+                default:
+                    logger.trace("isNativeAvailable: authenticationScheme is not supported, returning false");
+                    return false;
+            }
+        }
+        return true;
+    };
+    return NativeMessageHandler;
+}());
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var PopupClient = /** @class */ (function (_super) {
+    __extends$1(PopupClient, _super);
+    function PopupClient() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    /**
+     * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
+     * @param request
+     */
+    PopupClient.prototype.acquireToken = function (request) {
+        try {
+            var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority, this.correlationId);
+            var popupWindowAttributes = request.popupWindowAttributes || {};
+            // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
+            if (this.config.system.asyncPopups) {
+                this.logger.verbose("asyncPopups set to true, acquiring token");
+                // Passes on popup position and dimensions if in request
+                return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes);
+            }
+            else {
+                // asyncPopups flag is set to false. Opens popup before acquiring token.
+                this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
+                var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
+                return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes, popup);
+            }
+        }
+        catch (e) {
+            return Promise.reject(e);
+        }
+    };
+    /**
+     * Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
+     * @param logoutRequest
+     */
+    PopupClient.prototype.logout = function (logoutRequest) {
+        try {
+            this.logger.verbose("logoutPopup called");
+            var validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
+            var popupName = PopupUtils.generateLogoutPopupName(this.config.auth.clientId, validLogoutRequest);
+            var authority = logoutRequest && logoutRequest.authority;
+            var mainWindowRedirectUri = logoutRequest && logoutRequest.mainWindowRedirectUri;
+            var popupWindowAttributes = (logoutRequest === null || logoutRequest === void 0 ? void 0 : logoutRequest.popupWindowAttributes) || {};
+            // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
+            if (this.config.system.asyncPopups) {
+                this.logger.verbose("asyncPopups set to true");
+                // Passes on popup position and dimensions if in request
+                return this.logoutPopupAsync(validLogoutRequest, popupName, popupWindowAttributes, authority, undefined, mainWindowRedirectUri);
+            }
+            else {
+                // asyncPopups flag is set to false. Opens popup before logging out.
                 this.logger.verbose("asyncPopup set to false, opening popup");
                 var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
                 return this.logoutPopupAsync(validLogoutRequest, popupName, popupWindowAttributes, authority, popup, mainWindowRedirectUri);
@@ -12021,7 +12927,8 @@ var PopupClient = /** @class */ (function (_super) {
      */
     PopupClient.prototype.acquireTokenPopupAsync = function (request, popupName, popupWindowAttributes, popup) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var serverTelemetryManager, validRequest, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_1;
+            var serverTelemetryManager, validRequest, authCodeRequest, authClient, isNativeBroker, fetchNativeAccountIdMeasurement, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, serverParams, state_1, nativeInteractionClient, userRequestState, result, e_1;
+            var _this = this;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -12041,7 +12948,12 @@ var PopupClient = /** @class */ (function (_super) {
                     case 4:
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
-                        return [4 /*yield*/, authClient.getAuthCodeUrl(validRequest)];
+                        isNativeBroker = NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme);
+                        fetchNativeAccountIdMeasurement = void 0;
+                        if (isNativeBroker) {
+                            fetchNativeAccountIdMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.FetchAccountIdWithNativeBroker, request.correlationId);
+                        }
+                        return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, validRequest), { nativeBroker: isNativeBroker }))];
                     case 5:
                         navigateUrl = _a.sent();
                         interactionHandler = new PopupHandler(authClient, this.browserStorage, authCodeRequest, this.logger);
@@ -12055,10 +12967,30 @@ var PopupClient = /** @class */ (function (_super) {
                         return [4 /*yield*/, interactionHandler.monitorPopupForHash(popupWindow)];
                     case 6:
                         hash = _a.sent();
-                        state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Popup, validRequest.correlationId);
+                        serverParams = UrlString.getDeserializedHash(hash);
+                        state_1 = this.validateAndExtractStateFromHash(serverParams, exports.InteractionType.Popup, validRequest.correlationId);
                         // Remove throttle if it exists
                         ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
-                        return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
+                        if (serverParams.accountId) {
+                            this.logger.verbose("Account id found in hash, calling WAM for token");
+                            // end measurement for server call with native brokering enabled
+                            if (fetchNativeAccountIdMeasurement) {
+                                fetchNativeAccountIdMeasurement.endMeasurement({
+                                    success: true,
+                                    isNativeBroker: true
+                                });
+                            }
+                            if (!this.nativeMessageHandler) {
+                                throw BrowserAuthError.createNativeConnectionNotEstablishedError();
+                            }
+                            nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, validRequest.correlationId);
+                            userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state_1).userRequestState;
+                            return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, validRequest), { state: userRequestState, prompt: undefined // Server should handle the prompt, ideally native broker can do this part silently
+                                 })).finally(function () {
+                                    _this.browserStorage.cleanRequestByState(state_1);
+                                })];
+                        }
+                        return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state_1, authClient.authority, this.networkClient)];
                     case 7:
                         result = _a.sent();
                         return [2 /*return*/, result];
@@ -12240,7 +13172,7 @@ var RedirectHandler = /** @class */ (function (_super) {
      * Handle authorization code response in the window.
      * @param hash
      */
-    RedirectHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule, clientId) {
+    RedirectHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule) {
         return __awaiter$1(this, void 0, void 0, function () {
             var stateKey, requestState, authCodeResponse, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
             return __generator$1(this, function (_a) {
@@ -12258,7 +13190,18 @@ var RedirectHandler = /** @class */ (function (_super) {
                         if (!requestState) {
                             throw ClientAuthError.createStateNotFoundError("Cached State");
                         }
-                        authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                        try {
+                            authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                        }
+                        catch (e) {
+                            if (e instanceof ServerError && e.subError === BrowserAuthErrorMessage.userCancelledError.code) {
+                                // Translate server error caused by user closing native prompt to corresponding first class MSAL error
+                                throw BrowserAuthError.createUserCancelledError();
+                            }
+                            else {
+                                throw e;
+                            }
+                        }
                         nonceKey = this.browserStorage.generateNonceKey(requestState);
                         cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
                         // Assign code to request
@@ -12281,10 +13224,6 @@ var RedirectHandler = /** @class */ (function (_super) {
                                 this.authCodeRequest.ccsCredential = cachedCcsCred;
                             }
                         }
-                        // Remove throttle if it exists
-                        if (clientId) {
-                            ThrottlingUtils.removeThrottle(this.browserStorage, clientId, this.authCodeRequest);
-                        }
                         return [4 /*yield*/, this.authModule.acquireToken(this.authCodeRequest, authCodeResponse)];
                     case 3:
                         tokenResponse = _a.sent();
@@ -12339,7 +13278,7 @@ var RedirectClient = /** @class */ (function (_super) {
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
                         interactionHandler = new RedirectHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.browserCrypto);
-                        return [4 /*yield*/, authClient.getAuthCodeUrl(validRequest)];
+                        return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, validRequest), { nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, request.authenticationScheme) }))];
                     case 5:
                         navigateUrl = _a.sent();
                         redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
@@ -12377,7 +13316,7 @@ var RedirectClient = /** @class */ (function (_super) {
      */
     RedirectClient.prototype.handleRedirectPromise = function (hash) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var serverTelemetryManager, responseHash, state, loginRequestUrl, loginRequestUrlNormalized, currentUrlNormalized, handleHashResult, navigationOptions, processHashOnRedirect, homepage, e_2;
+            var serverTelemetryManager, responseHash, state, serverParams, loginRequestUrl, loginRequestUrlNormalized, currentUrlNormalized, handleHashResult, navigationOptions, processHashOnRedirect, homepage, e_2;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -12398,7 +13337,8 @@ var RedirectClient = /** @class */ (function (_super) {
                         }
                         state = void 0;
                         try {
-                            state = this.validateAndExtractStateFromHash(responseHash, exports.InteractionType.Redirect);
+                            serverParams = UrlString.getDeserializedHash(responseHash);
+                            state = this.validateAndExtractStateFromHash(serverParams, exports.InteractionType.Redirect);
                             this.logger.verbose("State extracted from hash");
                         }
                         catch (e) {
@@ -12499,12 +13439,26 @@ var RedirectClient = /** @class */ (function (_super) {
      */
     RedirectClient.prototype.handleHash = function (hash, state, serverTelemetryManager) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var cachedRequest, currentAuthority, authClient, interactionHandler;
+            var cachedRequest, serverParams, nativeInteractionClient, userRequestState, currentAuthority, authClient, interactionHandler;
+            var _this = this;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         cachedRequest = this.browserStorage.getCachedRequest(state, this.browserCrypto);
                         this.logger.verbose("handleHash called, retrieved cached request");
+                        serverParams = UrlString.getDeserializedHash(hash);
+                        if (serverParams.accountId) {
+                            this.logger.verbose("Account id found in hash, calling WAM for token");
+                            if (!this.nativeMessageHandler) {
+                                throw BrowserAuthError.createNativeConnectionNotEstablishedError();
+                            }
+                            nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, cachedRequest.correlationId);
+                            userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
+                            return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, cachedRequest), { state: userRequestState, prompt: undefined // Server should handle the prompt, ideally native broker can do this part silently
+                                 })).finally(function () {
+                                    _this.browserStorage.cleanRequestByState(state);
+                                })];
+                        }
                         currentAuthority = this.browserStorage.getCachedAuthority(state);
                         if (!currentAuthority) {
                             throw BrowserAuthError.createNoCachedAuthorityError();
@@ -12513,8 +13467,9 @@ var RedirectClient = /** @class */ (function (_super) {
                     case 1:
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
+                        ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, cachedRequest);
                         interactionHandler = new RedirectHandler(authClient, this.browserStorage, cachedRequest, this.logger, this.browserCrypto);
-                        return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient, this.config.auth.clientId)];
+                        return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                     case 2: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -12756,8 +13711,8 @@ var SilentHandler = /** @class */ (function (_super) {
  */
 var SilentIframeClient = /** @class */ (function (_super) {
     __extends$1(SilentIframeClient, _super);
-    function SilentIframeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, correlationId) {
-        var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId) || this;
+    function SilentIframeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeMessageHandler, correlationId) {
+        var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
         _this.apiId = apiId;
         return _this;
     }
@@ -12767,7 +13722,7 @@ var SilentIframeClient = /** @class */ (function (_super) {
      */
     SilentIframeClient.prototype.acquireToken = function (request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var acquireTokenMeasurement, silentRequest, serverTelemetryManager, authCodeRequest, authClient, navigateUrl, e_1;
+            var acquireTokenMeasurement, silentRequest, serverTelemetryManager, authClient, e_1;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -12791,27 +13746,20 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
                         _a.label = 2;
                     case 2:
-                        _a.trys.push([2, 7, , 8]);
-                        return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
-                    case 3:
-                        authCodeRequest = _a.sent();
+                        _a.trys.push([2, 5, , 6]);
                         return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
-                    case 4:
+                    case 3:
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
-                        return [4 /*yield*/, authClient.getAuthCodeUrl(silentRequest)];
-                    case 5:
-                        navigateUrl = _a.sent();
-                        return [4 /*yield*/, this.silentTokenHelper(navigateUrl, authCodeRequest, authClient, this.logger)
-                                .then(function (result) {
+                        return [4 /*yield*/, this.silentTokenHelper(authClient, silentRequest).then(function (result) {
                                 acquireTokenMeasurement.endMeasurement({
                                     success: true,
                                     fromCache: false
                                 });
                                 return result;
                             })];
-                    case 6: return [2 /*return*/, _a.sent()];
-                    case 7:
+                    case 4: return [2 /*return*/, _a.sent()];
+                    case 5:
                         e_1 = _a.sent();
                         if (e_1 instanceof AuthError) {
                             e_1.setCorrelationId(this.correlationId);
@@ -12822,7 +13770,7 @@ var SilentIframeClient = /** @class */ (function (_super) {
                             success: false
                         });
                         throw e_1;
-                    case 8: return [2 /*return*/];
+                    case 6: return [2 /*return*/];
                 }
             });
         });
@@ -12840,20 +13788,38 @@ var SilentIframeClient = /** @class */ (function (_super) {
      * @param navigateUrl
      * @param userRequestScopes
      */
-    SilentIframeClient.prototype.silentTokenHelper = function (navigateUrl, authCodeRequest, authClient, browserRequestLogger) {
+    SilentIframeClient.prototype.silentTokenHelper = function (authClient, silentRequest) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var silentHandler, msalFrame, hash, state;
+            var authCodeRequest, navigateUrl, silentHandler, msalFrame, hash, serverParams, state, nativeInteractionClient, userRequestState;
+            var _this = this;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, browserRequestLogger, this.config.system.navigateFrameWait);
-                        return [4 /*yield*/, silentHandler.initiateAuthRequest(navigateUrl)];
+                    case 0: return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
                     case 1:
+                        authCodeRequest = _a.sent();
+                        return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, silentRequest), { nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme) }))];
+                    case 2:
+                        navigateUrl = _a.sent();
+                        silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system.navigateFrameWait);
+                        return [4 /*yield*/, silentHandler.initiateAuthRequest(navigateUrl)];
+                    case 3:
                         msalFrame = _a.sent();
                         return [4 /*yield*/, silentHandler.monitorIframeForHash(msalFrame, this.config.system.iframeHashTimeout)];
-                    case 2:
+                    case 4:
                         hash = _a.sent();
-                        state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Silent, authCodeRequest.correlationId);
+                        serverParams = UrlString.getDeserializedHash(hash);
+                        state = this.validateAndExtractStateFromHash(serverParams, exports.InteractionType.Silent, authCodeRequest.correlationId);
+                        if (serverParams.accountId) {
+                            this.logger.verbose("Account id found in hash, calling WAM for token");
+                            if (!this.nativeMessageHandler) {
+                                throw BrowserAuthError.createNativeConnectionNotEstablishedError();
+                            }
+                            nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.correlationId);
+                            userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
+                            return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: PromptValue.NONE })).finally(function () {
+                                    _this.browserStorage.cleanRequestByState(state);
+                                })];
+                        }
                         // Handle response from hash string
                         return [2 /*return*/, silentHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                 }
@@ -13062,6 +14028,97 @@ var TokenCache = /** @class */ (function () {
     return TokenCache;
 }());
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var SilentCacheClient = /** @class */ (function (_super) {
+    __extends$1(SilentCacheClient, _super);
+    function SilentCacheClient() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    /**
+     * Returns unexpired tokens from the cache, if available
+     * @param silentRequest
+     */
+    SilentCacheClient.prototype.acquireToken = function (silentRequest) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var acquireTokenMeasurement, serverTelemetryManager, silentAuthClient, cachedToken, error_1;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        acquireTokenMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
+                        serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
+                        return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
+                    case 1:
+                        silentAuthClient = _a.sent();
+                        this.logger.verbose("Silent auth client created");
+                        _a.label = 2;
+                    case 2:
+                        _a.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, silentAuthClient.acquireCachedToken(silentRequest)];
+                    case 3:
+                        cachedToken = _a.sent();
+                        acquireTokenMeasurement.endMeasurement({
+                            success: true,
+                            fromCache: true
+                        });
+                        return [2 /*return*/, cachedToken];
+                    case 4:
+                        error_1 = _a.sent();
+                        if (error_1 instanceof BrowserAuthError && error_1.errorCode === BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
+                            this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
+                        }
+                        acquireTokenMeasurement.endMeasurement({
+                            success: false
+                        });
+                        throw error_1;
+                    case 5: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Currently Unsupported
+     */
+    SilentCacheClient.prototype.logout = function () {
+        // Synchronous so we must reject
+        return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
+    };
+    /**
+     * Creates an Silent Flow Client with the given authority, or the default authority.
+     * @param serverTelemetryManager
+     * @param authorityUrl
+     */
+    SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var clientConfig;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
+                    case 1:
+                        clientConfig = _a.sent();
+                        return [2 /*return*/, new SilentFlowClient(clientConfig)];
+                }
+            });
+        });
+    };
+    SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var _a;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        _a = [__assign$1({}, request)];
+                        return [4 /*yield*/, this.initializeBaseRequest(request)];
+                    case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
+                }
+            });
+        });
+    };
+    return SilentCacheClient;
+}(StandardInteractionClient));
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -13082,8 +14139,8 @@ var HybridSpaAuthorizationCodeClient = /** @class */ (function (_super) {
  */
 var SilentAuthCodeClient = /** @class */ (function (_super) {
     __extends$1(SilentAuthCodeClient, _super);
-    function SilentAuthCodeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, correlationId) {
-        var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId) || this;
+    function SilentAuthCodeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeMessageHandler, correlationId) {
+        var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
         _this.apiId = apiId;
         return _this;
     }
@@ -13286,6 +14343,7 @@ var ClientApplication = /** @class */ (function () {
         this.isBrowserEnvironment = typeof window !== "undefined";
         // Set the configuration.
         this.config = buildConfiguration(configuration, this.isBrowserEnvironment);
+        this.initialized = false;
         // Initialize logger
         this.logger = new Logger(this.config.system.loggerOptions, name, version);
         // Initialize the network module class.
@@ -13310,6 +14368,42 @@ var ClientApplication = /** @class */ (function () {
         // Initialize the token cache
         this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto);
     }
+    /**
+     * Initializer function to perform async startup tasks such as connecting to WAM extension
+     */
+    ClientApplication.prototype.initialize = function () {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var _a, e_1;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.trace("initialize called");
+                        if (this.initialized) {
+                            this.logger.warning("initialize has already been called. This function only needs to be run once.");
+                            return [2 /*return*/];
+                        }
+                        this.eventHandler.emitEvent(exports.EventType.INITIALIZE_START);
+                        if (!this.config.system.allowNativeBroker) return [3 /*break*/, 4];
+                        _b.label = 1;
+                    case 1:
+                        _b.trys.push([1, 3, , 4]);
+                        _a = this;
+                        return [4 /*yield*/, NativeMessageHandler.createProvider(this.logger, this.config.system.nativeBrokerHandshakeTimeout)];
+                    case 2:
+                        _a.nativeExtensionProvider = _b.sent();
+                        return [3 /*break*/, 4];
+                    case 3:
+                        e_1 = _b.sent();
+                        this.logger.verbose(e_1);
+                        return [3 /*break*/, 4];
+                    case 4:
+                        this.initialized = true;
+                        this.eventHandler.emitEvent(exports.EventType.INITIALIZE_END);
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
     // #region Redirect Flow
     /**
      * Event handler function which allows users to fire events after the PublicClientApplication object
@@ -13320,10 +14414,12 @@ var ClientApplication = /** @class */ (function () {
      */
     ClientApplication.prototype.handleRedirectPromise = function (hash) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var loggedInAccounts, redirectResponseKey, response, correlationId, redirectClient;
+            var loggedInAccounts, redirectResponseKey, response, request, redirectResponse, nativeClient, correlationId, redirectClient;
             var _this = this;
             return __generator$1(this, function (_a) {
                 this.logger.verbose("handleRedirectPromise called");
+                // Block token acquisition before initialize has been called if native brokering is enabled
+                BrowserUtils.blockNativeBrokerCalledBeforeInitialized(this.config.system.allowNativeBroker, this.initialized);
                 loggedInAccounts = this.getAllAccounts();
                 if (this.isBrowserEnvironment) {
                     redirectResponseKey = hash || Constants.EMPTY_STRING;
@@ -13331,10 +14427,20 @@ var ClientApplication = /** @class */ (function () {
                     if (typeof response === "undefined") {
                         this.eventHandler.emitEvent(exports.EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
                         this.logger.verbose("handleRedirectPromise has been called for the first time, storing the promise");
-                        correlationId = this.browserStorage.getTemporaryCache(exports.TemporaryCacheKeys.CORRELATION_ID, true) || Constants.EMPTY_STRING;
-                        redirectClient = new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-                        response = redirectClient.handleRedirectPromise(hash)
-                            .then(function (result) {
+                        request = this.browserStorage.getCachedNativeRequest();
+                        redirectResponse = void 0;
+                        if (request && NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) && this.nativeExtensionProvider && !hash) {
+                            this.logger.trace("handleRedirectPromise - acquiring token from native platform");
+                            nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, request.correlationId);
+                            redirectResponse = nativeClient.handleRedirectPromise();
+                        }
+                        else {
+                            this.logger.trace("handleRedirectPromise - acquiring token from web flow");
+                            correlationId = this.browserStorage.getTemporaryCache(exports.TemporaryCacheKeys.CORRELATION_ID, true) || Constants.EMPTY_STRING;
+                            redirectClient = this.createRedirectClient(correlationId);
+                            redirectResponse = redirectClient.handleRedirectPromise(hash);
+                        }
+                        response = redirectResponse.then(function (result) {
                             if (result) {
                                 // Emit login event if number of accounts change
                                 var isLoggingIn = loggedInAccounts.length < _this.getAllAccounts().length;
@@ -13349,8 +14455,7 @@ var ClientApplication = /** @class */ (function () {
                             }
                             _this.eventHandler.emitEvent(exports.EventType.HANDLE_REDIRECT_END, exports.InteractionType.Redirect);
                             return result;
-                        })
-                            .catch(function (e) {
+                        }).catch(function (e) {
                             // Emit login event if there is an account
                             if (loggedInAccounts.length > 0) {
                                 _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Redirect, null, e);
@@ -13384,7 +14489,7 @@ var ClientApplication = /** @class */ (function () {
      */
     ClientApplication.prototype.acquireTokenRedirect = function (request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var correlationId, isLoggedIn, redirectClient;
+            var correlationId, isLoggedIn, result, nativeClient, redirectClient;
             var _this = this;
             return __generator$1(this, function (_a) {
                 correlationId = this.getRequestCorrelationId(request);
@@ -13397,8 +14502,22 @@ var ClientApplication = /** @class */ (function () {
                 else {
                     this.eventHandler.emitEvent(exports.EventType.LOGIN_START, exports.InteractionType.Redirect, request);
                 }
-                redirectClient = new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-                return [2 /*return*/, redirectClient.acquireToken(__assign$1(__assign$1({}, request), { correlationId: correlationId })).catch(function (e) {
+                if (this.nativeExtensionProvider && this.canUseNative(request)) {
+                    nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), request.correlationId);
+                    result = nativeClient.acquireTokenRedirect(request).catch(function (e) {
+                        if (e instanceof NativeAuthError && e.isFatal()) {
+                            _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                            var redirectClient = _this.createRedirectClient(request.correlationId);
+                            return redirectClient.acquireToken(request);
+                        }
+                        throw e;
+                    });
+                }
+                else {
+                    redirectClient = this.createRedirectClient(request.correlationId);
+                    result = redirectClient.acquireToken(request);
+                }
+                return [2 /*return*/, result.catch(function (e) {
                         // If logged in, emit acquire token events
                         if (isLoggedIn) {
                             _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Redirect, null, e);
@@ -13423,6 +14542,7 @@ var ClientApplication = /** @class */ (function () {
     ClientApplication.prototype.acquireTokenPopup = function (request) {
         var _this = this;
         var correlationId = this.getRequestCorrelationId(request);
+        var atPopupMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenPopup, correlationId);
         try {
             this.logger.verbose("acquireTokenPopup called", correlationId);
             this.preflightBrowserEnvironmentCheck(exports.InteractionType.Popup);
@@ -13439,8 +14559,30 @@ var ClientApplication = /** @class */ (function () {
         else {
             this.eventHandler.emitEvent(exports.EventType.LOGIN_START, exports.InteractionType.Popup, request);
         }
-        var popupClient = new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-        return popupClient.acquireToken(__assign$1(__assign$1({}, request), { correlationId: correlationId })).then(function (result) {
+        var result;
+        if (this.canUseNative(request)) {
+            result = this.acquireTokenNative(request, exports.ApiId.acquireTokenPopup).then(function (response) {
+                _this.browserStorage.setInteractionInProgress(false);
+                atPopupMeasurement.endMeasurement({
+                    success: true,
+                    isNativeBroker: true
+                });
+                atPopupMeasurement.flushMeasurement();
+                return response;
+            }).catch(function (e) {
+                if (e instanceof NativeAuthError && e.isFatal()) {
+                    _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    var popupClient = _this.createPopupClient(request.correlationId);
+                    return popupClient.acquireToken(request);
+                }
+                throw e;
+            });
+        }
+        else {
+            var popupClient = this.createPopupClient(request.correlationId);
+            result = popupClient.acquireToken(request);
+        }
+        return result.then(function (result) {
             // If logged in, emit acquire token events
             var isLoggingIn = loggedInAccounts.length < _this.getAllAccounts().length;
             if (isLoggingIn) {
@@ -13449,6 +14591,10 @@ var ClientApplication = /** @class */ (function () {
             else {
                 _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Popup, result);
             }
+            atPopupMeasurement.endMeasurement({
+                success: true
+            });
+            atPopupMeasurement.flushMeasurement();
             return result;
         }).catch(function (e) {
             if (loggedInAccounts.length > 0) {
@@ -13457,6 +14603,10 @@ var ClientApplication = /** @class */ (function () {
             else {
                 _this.eventHandler.emitEvent(exports.EventType.LOGIN_FAILURE, exports.InteractionType.Popup, null, e);
             }
+            atPopupMeasurement.endMeasurement({
+                success: false
+            });
+            atPopupMeasurement.flushMeasurement();
             // Since this function is syncronous we need to reject
             return Promise.reject(e);
         });
@@ -13480,38 +14630,45 @@ var ClientApplication = /** @class */ (function () {
      */
     ClientApplication.prototype.ssoSilent = function (request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var correlationId, ssoSilentMeasurement, silentIframeClient, silentTokenResult, e_1;
+            var correlationId, validRequest, ssoSilentMeasurement, result, silentIframeClient;
+            var _this = this;
             return __generator$1(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        correlationId = this.getRequestCorrelationId(request);
-                        this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
-                        ssoSilentMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SsoSilent, correlationId);
-                        this.logger.verbose("ssoSilent called", correlationId);
-                        this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_START, exports.InteractionType.Silent, request);
-                        _a.label = 1;
-                    case 1:
-                        _a.trys.push([1, 3, , 4]);
-                        silentIframeClient = new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.ssoSilent, this.performanceClient, correlationId);
-                        return [4 /*yield*/, silentIframeClient.acquireToken(__assign$1(__assign$1({}, request), { correlationId: correlationId }))];
-                    case 2:
-                        silentTokenResult = _a.sent();
-                        this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, silentTokenResult);
+                correlationId = this.getRequestCorrelationId(request);
+                validRequest = __assign$1(__assign$1({}, request), { prompt: PromptValue.NONE, correlationId: correlationId });
+                this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
+                ssoSilentMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SsoSilent, correlationId);
+                this.logger.verbose("ssoSilent called", correlationId);
+                this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_START, exports.InteractionType.Silent, validRequest);
+                if (this.canUseNative(validRequest)) {
+                    result = this.acquireTokenNative(validRequest, exports.ApiId.ssoSilent).catch(function (e) {
+                        // If native token acquisition fails for availability reasons fallback to standard flow
+                        if (e instanceof NativeAuthError && e.isFatal()) {
+                            _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                            var silentIframeClient = _this.createSilentIframeClient(validRequest.correlationId);
+                            return silentIframeClient.acquireToken(validRequest);
+                        }
+                        throw e;
+                    });
+                }
+                else {
+                    silentIframeClient = this.createSilentIframeClient(validRequest.correlationId);
+                    result = silentIframeClient.acquireToken(validRequest);
+                }
+                return [2 /*return*/, result.then(function (response) {
+                        _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, response);
                         ssoSilentMeasurement.endMeasurement({
                             success: true
                         });
                         ssoSilentMeasurement.flushMeasurement();
-                        return [2 /*return*/, silentTokenResult];
-                    case 3:
-                        e_1 = _a.sent();
-                        this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e_1);
+                        return response;
+                    }).catch(function (e) {
+                        _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e);
                         ssoSilentMeasurement.endMeasurement({
                             success: false
                         });
                         ssoSilentMeasurement.flushMeasurement();
-                        throw e_1;
-                    case 4: return [2 /*return*/];
-                }
+                        throw e;
+                    })];
             });
         });
     };
@@ -13527,7 +14684,7 @@ var ClientApplication = /** @class */ (function () {
      */
     ClientApplication.prototype.acquireTokenByCode = function (request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var correlationId, atbcMeasurement, response;
+            var correlationId, atbcMeasurement, hybridAuthCode_1, response;
             var _this = this;
             return __generator$1(this, function (_a) {
                 correlationId = this.getRequestCorrelationId(request);
@@ -13536,41 +14693,58 @@ var ClientApplication = /** @class */ (function () {
                 this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_START, exports.InteractionType.Silent, request);
                 atbcMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenByCode, request.correlationId);
                 try {
-                    if (!request.code) {
-                        throw BrowserAuthError.createAuthCodeRequiredError();
-                    }
-                    response = this.hybridAuthCodeResponses.get(request.code);
-                    if (!response) {
-                        this.logger.verbose("Initiating new acquireTokenByCode request", correlationId);
-                        response = this.acquireTokenByCodeAsync(__assign$1(__assign$1({}, request), { correlationId: correlationId }))
-                            .then(function (result) {
-                            _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
-                            _this.hybridAuthCodeResponses.delete(request.code);
-                            atbcMeasurement.endMeasurement({
-                                success: true
+                    if (request.code) {
+                        hybridAuthCode_1 = request.code;
+                        response = this.hybridAuthCodeResponses.get(hybridAuthCode_1);
+                        if (!response) {
+                            this.logger.verbose("Initiating new acquireTokenByCode request", correlationId);
+                            response = this.acquireTokenByCodeAsync(__assign$1(__assign$1({}, request), { correlationId: correlationId }))
+                                .then(function (result) {
+                                _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
+                                _this.hybridAuthCodeResponses.delete(hybridAuthCode_1);
+                                atbcMeasurement.endMeasurement({
+                                    success: true
+                                });
+                                atbcMeasurement.flushMeasurement();
+                                return result;
+                            })
+                                .catch(function (error) {
+                                _this.hybridAuthCodeResponses.delete(hybridAuthCode_1);
+                                _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, error);
+                                atbcMeasurement.endMeasurement({
+                                    success: false
+                                });
+                                atbcMeasurement.flushMeasurement();
+                                throw error;
                             });
-                            atbcMeasurement.flushMeasurement();
-                            return result;
-                        })
-                            .catch(function (error) {
-                            _this.hybridAuthCodeResponses.delete(request.code);
-                            _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, error);
+                            this.hybridAuthCodeResponses.set(hybridAuthCode_1, response);
+                        }
+                        else {
+                            this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
                             atbcMeasurement.endMeasurement({
-                                success: false
+                                success: true
                             });
-                            atbcMeasurement.flushMeasurement();
-                            throw error;
-                        });
-                        this.hybridAuthCodeResponses.set(request.code, response);
+                            atbcMeasurement.discardMeasurement();
+                        }
+                        return [2 /*return*/, response];
+                    }
+                    else if (request.nativeAccountId) {
+                        if (this.canUseNative(request, request.nativeAccountId)) {
+                            return [2 /*return*/, this.acquireTokenNative(request, exports.ApiId.acquireTokenByCode, request.nativeAccountId).catch(function (e) {
+                                    // If native token acquisition fails for availability reasons fallback to standard flow
+                                    if (e instanceof NativeAuthError && e.isFatal()) {
+                                        _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                                    }
+                                    throw e;
+                                })];
+                        }
+                        else {
+                            throw BrowserAuthError.createUnableToAcquireTokenFromNativePlatformError();
+                        }
                     }
                     else {
-                        this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
-                        atbcMeasurement.endMeasurement({
-                            success: true
-                        });
-                        atbcMeasurement.discardMeasurement();
+                        throw BrowserAuthError.createAuthCodeOrNativeAccountIdRequiredError();
                     }
-                    return [2 /*return*/, response];
                 }
                 catch (e) {
                     this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
@@ -13595,7 +14769,7 @@ var ClientApplication = /** @class */ (function () {
                 switch (_a.label) {
                     case 0:
                         this.logger.trace("acquireTokenByCodeAsync called", request.correlationId);
-                        silentAuthCodeClient = new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenByCode, this.performanceClient, request.correlationId);
+                        silentAuthCodeClient = this.createSilentAuthCodeClient(request.correlationId);
                         return [4 /*yield*/, silentAuthCodeClient.acquireToken(request)];
                     case 1:
                         silentTokenResult = _a.sent();
@@ -13624,7 +14798,7 @@ var ClientApplication = /** @class */ (function () {
                 BrowserUtils.blockReloadInHiddenIframes();
                 atbrtMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenByRefreshToken, request.correlationId);
                 this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, request);
-                silentRefreshClient = new SilentRefreshClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, request.correlationId);
+                silentRefreshClient = this.createSilentRefreshClient(request.correlationId);
                 return [2 /*return*/, silentRefreshClient.acquireToken(request)
                         .then(function (result) {
                         atbrtMeasurement.endMeasurement({
@@ -13639,7 +14813,7 @@ var ClientApplication = /** @class */ (function () {
                         var isInvalidGrantError = (e.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
                         if (isServerError && isInvalidGrantError && !isInteractionRequiredError) {
                             _this.logger.verbose("Refresh token expired or invalid, attempting acquire token by iframe", request.correlationId);
-                            var silentIframeClient = new SilentIframeClient(_this.config, _this.browserStorage, _this.browserCrypto, _this.logger, _this.eventHandler, _this.navigationClient, exports.ApiId.acquireTokenSilent_authCode, _this.performanceClient, request.correlationId);
+                            var silentIframeClient = _this.createSilentIframeClient(request.correlationId);
                             return silentIframeClient.acquireToken(request)
                                 .then(function (result) {
                                 atbrtMeasurement.endMeasurement({
@@ -13691,8 +14865,8 @@ var ClientApplication = /** @class */ (function () {
             return __generator$1(this, function (_a) {
                 correlationId = this.getRequestCorrelationId(logoutRequest);
                 this.preflightBrowserEnvironmentCheck(exports.InteractionType.Redirect);
-                redirectClient = new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-                return [2 /*return*/, redirectClient.logout(__assign$1({ correlationId: correlationId }, logoutRequest))];
+                redirectClient = this.createRedirectClient(correlationId);
+                return [2 /*return*/, redirectClient.logout(logoutRequest)];
             });
         });
     };
@@ -13704,8 +14878,8 @@ var ClientApplication = /** @class */ (function () {
         try {
             var correlationId = this.getRequestCorrelationId(logoutRequest);
             this.preflightBrowserEnvironmentCheck(exports.InteractionType.Popup);
-            var popupClient = new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId);
-            return popupClient.logout(__assign$1({ correlationId: correlationId }, logoutRequest));
+            var popupClient = this.createPopupClient(correlationId);
+            return popupClient.logout(logoutRequest);
         }
         catch (e) {
             // Since this function is syncronous we need to reject
@@ -13811,6 +14985,8 @@ var ClientApplication = /** @class */ (function () {
         BrowserUtils.blockReloadInHiddenIframes();
         // Block redirectUri opened in a popup from calling MSAL APIs
         BrowserUtils.blockAcquireTokenInPopups();
+        // Block token acquisition before initialize has been called if native brokering is enabled
+        BrowserUtils.blockNativeBrokerCalledBeforeInitialized(this.config.system.allowNativeBroker, this.initialized);
         // Block redirects if memory storage is enabled but storeAuthStateInCookie is not
         if (interactionType === exports.InteractionType.Redirect &&
             this.config.cache.cacheLocation === exports.BrowserCacheLocation.MemoryStorage &&
@@ -13833,6 +15009,98 @@ var ClientApplication = /** @class */ (function () {
         // Set interaction in progress temporary cache or throw if alread set.
         this.browserStorage.setInteractionInProgress(true);
     };
+    /**
+     * Acquire a token from native device (e.g. WAM)
+     * @param request
+     */
+    ClientApplication.prototype.acquireTokenNative = function (request, apiId, accountId) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var nativeClient;
+            return __generator$1(this, function (_a) {
+                this.logger.trace("acquireTokenNative called");
+                if (!this.nativeExtensionProvider) {
+                    throw BrowserAuthError.createNativeConnectionNotEstablishedError();
+                }
+                nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.nativeExtensionProvider, accountId || this.getNativeAccountId(request), request.correlationId);
+                return [2 /*return*/, nativeClient.acquireToken(request)];
+            });
+        });
+    };
+    /**
+     * Returns boolean indicating if this request can use the native broker
+     * @param request
+     */
+    ClientApplication.prototype.canUseNative = function (request, accountId) {
+        this.logger.trace("canUseNative called");
+        if (!NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme)) {
+            this.logger.trace("canUseNative: isNativeAvailable returned false, returning false");
+            return false;
+        }
+        if (request.prompt) {
+            switch (request.prompt) {
+                case PromptValue.NONE:
+                case PromptValue.CONSENT:
+                    this.logger.trace("canUseNative: prompt is compatible with native flow");
+                    break;
+                default:
+                    this.logger.trace("canUseNative: prompt = " + request.prompt + " is not compatible with native flow, returning false");
+                    return false;
+            }
+        }
+        if (!accountId && !this.getNativeAccountId(request)) {
+            this.logger.trace("canUseNative: nativeAccountId is not available, returning false");
+            return false;
+        }
+        return true;
+    };
+    /**
+     * Get the native accountId from the account
+     * @param request
+     * @returns
+     */
+    ClientApplication.prototype.getNativeAccountId = function (request) {
+        var account = request.account || this.browserStorage.getAccountInfoByHints(request.loginHint, request.sid) || this.getActiveAccount();
+        return account && account.nativeAccountId || "";
+    };
+    /**
+     * Returns new instance of the Popup Interaction Client
+     * @param correlationId
+     */
+    ClientApplication.prototype.createPopupClient = function (correlationId) {
+        return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+    };
+    /**
+     * Returns new instance of the Popup Interaction Client
+     * @param correlationId
+     */
+    ClientApplication.prototype.createRedirectClient = function (correlationId) {
+        return new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+    };
+    /**
+     * Returns new instance of the Silent Iframe Interaction Client
+     * @param correlationId
+     */
+    ClientApplication.prototype.createSilentIframeClient = function (correlationId) {
+        return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.ssoSilent, this.performanceClient, this.nativeExtensionProvider, correlationId);
+    };
+    /**
+     * Returns new instance of the Silent Cache Interaction Client
+     */
+    ClientApplication.prototype.createSilentCacheClient = function (correlationId) {
+        return new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+    };
+    /**
+     * Returns new instance of the Silent Refresh Interaction Client
+     */
+    ClientApplication.prototype.createSilentRefreshClient = function (correlationId) {
+        return new SilentRefreshClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+    };
+    /**
+     * Returns new instance of the Silent AuthCode Interaction Client
+     */
+    ClientApplication.prototype.createSilentAuthCodeClient = function (correlationId) {
+        return new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenByCode, this.performanceClient, this.nativeExtensionProvider, correlationId);
+    };
     /**
      * Adds event callbacks to array
      * @param callback
@@ -13941,98 +15209,6 @@ var ClientApplication = /** @class */ (function () {
     return ClientApplication;
 }());
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-var SilentCacheClient = /** @class */ (function (_super) {
-    __extends$1(SilentCacheClient, _super);
-    function SilentCacheClient() {
-        return _super !== null && _super.apply(this, arguments) || this;
-    }
-    /**
-     * Returns unexpired tokens from the cache, if available
-     * @param silentRequest
-     */
-    SilentCacheClient.prototype.acquireToken = function (silentRequest) {
-        return __awaiter$1(this, void 0, void 0, function () {
-            var acquireTokenMeasurement, serverTelemetryManager, silentAuthClient, cachedToken, error_1;
-            return __generator$1(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        acquireTokenMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
-                        serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
-                        return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
-                    case 1:
-                        silentAuthClient = _a.sent();
-                        this.logger.verbose("Silent auth client created");
-                        _a.label = 2;
-                    case 2:
-                        _a.trys.push([2, 4, , 5]);
-                        return [4 /*yield*/, silentAuthClient.acquireCachedToken(silentRequest)];
-                    case 3:
-                        cachedToken = _a.sent();
-                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, cachedToken);
-                        acquireTokenMeasurement.endMeasurement({
-                            success: true,
-                            fromCache: true
-                        });
-                        return [2 /*return*/, cachedToken];
-                    case 4:
-                        error_1 = _a.sent();
-                        if (error_1 instanceof BrowserAuthError && error_1.errorCode === BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
-                            this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
-                        }
-                        acquireTokenMeasurement.endMeasurement({
-                            success: false
-                        });
-                        throw error_1;
-                    case 5: return [2 /*return*/];
-                }
-            });
-        });
-    };
-    /**
-     * Currently Unsupported
-     */
-    SilentCacheClient.prototype.logout = function () {
-        // Synchronous so we must reject
-        return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
-    };
-    /**
-     * Creates an Silent Flow Client with the given authority, or the default authority.
-     * @param serverTelemetryManager
-     * @param authorityUrl
-     */
-    SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
-        return __awaiter$1(this, void 0, void 0, function () {
-            var clientConfig;
-            return __generator$1(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
-                    case 1:
-                        clientConfig = _a.sent();
-                        return [2 /*return*/, new SilentFlowClient(clientConfig)];
-                }
-            });
-        });
-    };
-    SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
-        return __awaiter$1(this, void 0, void 0, function () {
-            var _a;
-            return __generator$1(this, function (_b) {
-                switch (_b.label) {
-                    case 0:
-                        _a = [__assign$1({}, request)];
-                        return [4 /*yield*/, this.initializeBaseRequest(request)];
-                    case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
-                }
-            });
-        });
-    };
-    return SilentCacheClient;
-}(StandardInteractionClient));
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -14176,51 +15352,56 @@ var PublicClientApplication = /** @class */ (function (_super) {
      */
     PublicClientApplication.prototype.acquireTokenSilentAsync = function (request, account) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var astsAsyncMeasurement, silentCacheClient, silentRequest;
+            var astsAsyncMeasurement, result, silentRequest, silentCacheClient, silentRequest_1;
             var _this = this;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
+                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
                         astsAsyncMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenSilentAsync, request.correlationId);
-                        silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, request.correlationId);
-                        return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
+                        if (!(NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme) && account.nativeAccountId)) return [3 /*break*/, 1];
+                        this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
+                        silentRequest = __assign$1(__assign$1({}, request), { account: account });
+                        result = this.acquireTokenNative(silentRequest, exports.ApiId.acquireTokenSilent_silentFlow).catch(function (e) { return __awaiter$1(_this, void 0, void 0, function () {
+                            var silentIframeClient;
+                            return __generator$1(this, function (_a) {
+                                // If native token acquisition fails for availability reasons fallback to web flow
+                                if (e instanceof NativeAuthError && e.isFatal()) {
+                                    this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow");
+                                    this.nativeExtensionProvider = undefined; // Prevent future requests from continuing to attempt 
+                                    silentIframeClient = this.createSilentIframeClient(request.correlationId);
+                                    return [2 /*return*/, silentIframeClient.acquireToken(request)];
+                                }
+                                throw e;
+                            });
+                        }); });
+                        return [3 /*break*/, 3];
                     case 1:
-                        silentRequest = _a.sent();
-                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
-                        return [2 /*return*/, silentCacheClient.acquireToken(silentRequest)
-                                .then(function (result) {
-                                astsAsyncMeasurement.endMeasurement({
-                                    success: true,
-                                    fromCache: result.fromCache
-                                });
-                                return result;
-                            })
-                                .catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
-                                var tokenRenewalResult, tokenRenewalError_1;
-                                return __generator$1(this, function (_a) {
-                                    switch (_a.label) {
-                                        case 0:
-                                            _a.trys.push([0, 2, , 3]);
-                                            return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
-                                        case 1:
-                                            tokenRenewalResult = _a.sent();
-                                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
-                                            astsAsyncMeasurement.endMeasurement({
-                                                success: true,
-                                                fromCache: tokenRenewalResult.fromCache
-                                            });
-                                            return [2 /*return*/, tokenRenewalResult];
-                                        case 2:
-                                            tokenRenewalError_1 = _a.sent();
-                                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
-                                            astsAsyncMeasurement.endMeasurement({
-                                                success: false
-                                            });
-                                            throw tokenRenewalError_1;
-                                        case 3: return [2 /*return*/];
-                                    }
-                                });
-                            }); })];
+                        this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow");
+                        silentCacheClient = this.createSilentCacheClient(request.correlationId);
+                        return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
+                    case 2:
+                        silentRequest_1 = _a.sent();
+                        result = silentCacheClient.acquireToken(silentRequest_1).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
+                            return __generator$1(this, function (_a) {
+                                return [2 /*return*/, this.acquireTokenByRefreshToken(silentRequest_1)];
+                            });
+                        }); });
+                        _a.label = 3;
+                    case 3: return [2 /*return*/, result.then(function (response) {
+                            _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
+                            astsAsyncMeasurement.endMeasurement({
+                                success: true,
+                                fromCache: response.fromCache
+                            });
+                            return response;
+                        }).catch(function (tokenRenewalError) {
+                            _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError);
+                            astsAsyncMeasurement.endMeasurement({
+                                success: false
+                            });
+                            throw tokenRenewalError;
+                        })];
                 }
             });
         });
@@ -14233,6 +15414,9 @@ var PublicClientApplication = /** @class */ (function (_super) {
  * Licensed under the MIT License.
  */
 var stubbedPublicClientApplication = {
+    initialize: function () {
+        return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
+    },
     acquireTokenPopup: function () {
         return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
     },