@azure/msal-browser 2.24.0 → 2.27.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.24.0 2022-05-02 */
+/*! @azure/msal-browser v2.27.0 2022-07-05 */
 'use strict';
 'use strict';
 
@@ -105,7 +105,7 @@ function __spread() {
     return ar;
 }
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*! *****************************************************************************
 Copyright (c) Microsoft Corporation.
 
@@ -192,7 +192,7 @@ function __spreadArrays() {
     return r;
 }
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -476,6 +476,7 @@ var AuthorityMetadataSource;
     AuthorityMetadataSource["CONFIG"] = "config";
     AuthorityMetadataSource["CACHE"] = "cache";
     AuthorityMetadataSource["NETWORK"] = "network";
+    AuthorityMetadataSource["HARDCODED_VALUES"] = "hardcoded_values";
 })(AuthorityMetadataSource || (AuthorityMetadataSource = {}));
 var SERVER_TELEM_CONSTANTS = {
     SCHEMA_VERSION: 5,
@@ -559,9 +560,14 @@ var CacheOutcome;
     CacheOutcome["NO_CACHED_ACCESS_TOKEN"] = "2";
     CacheOutcome["CACHED_ACCESS_TOKEN_EXPIRED"] = "3";
     CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
-})(CacheOutcome || (CacheOutcome = {}));
+})(CacheOutcome || (CacheOutcome = {}));
+var JsonTypes;
+(function (JsonTypes) {
+    JsonTypes["Jwt"] = "JWT";
+    JsonTypes["Jwk"] = "JWK";
+})(JsonTypes || (JsonTypes = {}));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -605,7 +611,7 @@ var AuthError = /** @class */ (function (_super) {
     return AuthError;
 }(Error));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -680,7 +686,7 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
     }
 };
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -870,6 +876,10 @@ var ClientAuthErrorMessage = {
     logoutNotSupported: {
         code: "end_session_endpoint_not_supported",
         desc: "Provided authority does not support logout."
+    },
+    keyIdMissing: {
+        code: "key_id_missing",
+        desc: "A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key."
     }
 };
 /**
@@ -1139,10 +1149,16 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createLogoutNotSupportedError = function () {
         return new ClientAuthError(ClientAuthErrorMessage.logoutNotSupported.code, ClientAuthErrorMessage.logoutNotSupported.desc);
     };
+    /**
+     * Create an error when kid attribute is missing from a PoP token's cache record
+     */
+    ClientAuthError.createKeyIdMissingError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.keyIdMissing.code, ClientAuthErrorMessage.keyIdMissing.desc);
+    };
     return ClientAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1267,7 +1283,7 @@ var StringUtils = /** @class */ (function () {
     return StringUtils;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1447,12 +1463,12 @@ var Logger = /** @class */ (function () {
     return Logger;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /* eslint-disable header/header */
 var name$1 = "@azure/msal-common";
-var version$1 = "6.3.0";
+var version$1 = "7.1.0";
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1473,7 +1489,7 @@ exports.AzureCloudInstance = void 0;
     AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
 })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1496,9 +1512,9 @@ exports.AzureCloudInstance = void 0;
  *      familyId: Family ID identifier, usually only used for refresh tokens
  *      realm: Full tenant or organizational identifier that the account belongs to
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      oboAssertion: access token passed in as part of OBO request
  *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
  *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
+ *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -1632,7 +1648,7 @@ var CredentialEntity = /** @class */ (function () {
     return CredentialEntity;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1887,7 +1903,7 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     return ClientConfigurationError;
 }(ClientAuthError));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2071,7 +2087,7 @@ var ScopeSet = /** @class */ (function () {
     return ScopeSet;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2109,7 +2125,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2123,7 +2139,7 @@ var AuthorityType;
     AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
 })(AuthorityType || (AuthorityType = {}));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2148,7 +2164,6 @@ var AuthorityType;
  *      clientInfo: Full base64 encoded client info received from ESTS
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
- *      oboAssertion: access token passed in as part of OBO request
  *      idTokenClaims: Object containing claims parsed from ID token
  *      nativeAccountId: Account identifier on the native device
  * }
@@ -2227,7 +2242,7 @@ var AccountEntity = /** @class */ (function () {
      * @param idToken
      * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
+    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
         var _a, _b, _c, _d, _e, _f;
         var account = new AccountEntity();
         account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
@@ -2241,7 +2256,6 @@ var AccountEntity = /** @class */ (function () {
         account.environment = env;
         // non AAD scenarios can have empty realm
         account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || Constants.EMPTY_STRING;
-        account.oboAssertion = oboAssertion;
         if (idToken) {
             account.idTokenClaims = idToken.claims;
             // How do you account for MSA CID here?
@@ -2262,14 +2276,13 @@ var AccountEntity = /** @class */ (function () {
      * @param authority
      * @param idToken
      */
-    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
         var _a, _b, _c, _d;
         var account = new AccountEntity();
         account.authorityType = (authority && authority.authorityType === AuthorityType.Adfs) ? CacheAccountType.ADFS_ACCOUNT_TYPE : CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
         account.realm = Constants.EMPTY_STRING;
-        account.oboAssertion = oboAssertion;
         var env = environment || authority && authority.getPreferredCache();
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -2361,7 +2374,7 @@ var AccountEntity = /** @class */ (function () {
     return AccountEntity;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2399,7 +2412,7 @@ var AuthToken = /** @class */ (function () {
     return AuthToken;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2562,7 +2575,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.userAssertionHash, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
     };
     /**
      * Support function to help match credentials
@@ -2572,10 +2585,10 @@ var CacheManager = /** @class */ (function () {
      * @param clientId
      * @param realm
      * @param target
-     * @param oboAssertion
+     * @param userAssertionHash
      * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, userAssertionHash, tokenType, keyId, requestedClaimsHash) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2594,7 +2607,7 @@ var CacheManager = /** @class */ (function () {
             if (!entity) {
                 return;
             }
-            if (!!oboAssertion && !_this.matchOboAssertion(entity, oboAssertion)) {
+            if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
                 return;
             }
             if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
@@ -2925,7 +2938,7 @@ var CacheManager = /** @class */ (function () {
             target: scopes.printScopesLowerCase(),
             tokenType: authScheme,
             keyId: request.sshKid,
-            requestedClaimsHash: request.requestedClaimsHash
+            requestedClaimsHash: request.requestedClaimsHash,
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -2951,7 +2964,7 @@ var CacheManager = /** @class */ (function () {
             environment: account.environment,
             credentialType: CredentialType.REFRESH_TOKEN,
             clientId: clientId,
-            familyId: id
+            familyId: id,
         };
         var credentialCache = this.getCredentialsFilteredBy(refreshTokenFilter);
         var refreshTokens = Object.keys(credentialCache.refreshTokens).map(function (key) { return credentialCache.refreshTokens[key]; });
@@ -3003,8 +3016,8 @@ var CacheManager = /** @class */ (function () {
      * @param value
      * @param oboAssertion
      */
-    CacheManager.prototype.matchOboAssertion = function (entity, oboAssertion) {
-        return !!(entity.oboAssertion && oboAssertion === entity.oboAssertion);
+    CacheManager.prototype.matchUserAssertionHash = function (entity, userAssertionHash) {
+        return !!(entity.userAssertionHash && userAssertionHash === entity.userAssertionHash);
     };
     /**
      * helper to match environment
@@ -3241,7 +3254,7 @@ var DefaultStorageClass = /** @class */ (function (_super) {
     return DefaultStorageClass;
 }(CacheManager));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3332,10 +3345,10 @@ function buildClientConfiguration(_a) {
  * @param authOptions
  */
 function buildAuthOptions(authOptions) {
-    return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS }, authOptions);
+    return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS, skipAuthorityMetadataCache: false }, authOptions);
 }
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3355,7 +3368,7 @@ var ServerError = /** @class */ (function (_super) {
     return ServerError;
 }(AuthError));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3451,7 +3464,7 @@ var ThrottlingUtils = /** @class */ (function () {
     return ThrottlingUtils;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3500,7 +3513,7 @@ var NetworkManager = /** @class */ (function () {
     return NetworkManager;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3511,7 +3524,7 @@ var CcsCredentialType;
     CcsCredentialType["UPN"] = "UPN";
 })(CcsCredentialType || (CcsCredentialType = {}));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3600,7 +3613,7 @@ var BaseClient = /** @class */ (function () {
     return BaseClient;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3686,7 +3699,7 @@ var RequestValidator = /** @class */ (function () {
     return RequestValidator;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3920,14 +3933,18 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param clientAssertion
      */
     RequestParameterBuilder.prototype.addClientAssertion = function (clientAssertion) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+        if (!StringUtils.isEmpty(clientAssertion)) {
+            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+        }
     };
     /**
      * add clientAssertionType for confidential client flows
      * @param clientAssertionType
      */
     RequestParameterBuilder.prototype.addClientAssertionType = function (clientAssertionType) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+        if (!StringUtils.isEmpty(clientAssertionType)) {
+            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+        }
     };
     /**
      * add OBO assertion for confidential client flows
@@ -3999,14 +4016,14 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param username
      */
     RequestParameterBuilder.prototype.addUsername = function (username) {
-        this.parameters.set(PasswordGrantConstants.username, username);
+        this.parameters.set(PasswordGrantConstants.username, encodeURIComponent(username));
     };
     /**
      * adds `password` for Password Grant flow
      * @param password
      */
     RequestParameterBuilder.prototype.addPassword = function (password) {
-        this.parameters.set(PasswordGrantConstants.password, password);
+        this.parameters.set(PasswordGrantConstants.password, encodeURIComponent(password));
     };
     /**
      * add pop_jwk to query params
@@ -4060,7 +4077,7 @@ var RequestParameterBuilder = /** @class */ (function () {
     return RequestParameterBuilder;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4095,7 +4112,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
      * @param clientId
      * @param authority
      */
-    IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId, oboAssertion) {
+    IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId) {
         var idTokenEntity = new IdTokenEntity();
         idTokenEntity.credentialType = CredentialType.ID_TOKEN;
         idTokenEntity.homeAccountId = homeAccountId;
@@ -4103,7 +4120,6 @@ var IdTokenEntity = /** @class */ (function (_super) {
         idTokenEntity.clientId = clientId;
         idTokenEntity.secret = idToken;
         idTokenEntity.realm = tenantId;
-        idTokenEntity.oboAssertion = oboAssertion;
         return idTokenEntity;
     };
     /**
@@ -4125,7 +4141,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
     return IdTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4175,7 +4191,7 @@ var TimeUtils = /** @class */ (function () {
     return TimeUtils;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4221,7 +4237,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, userAssertionHash, keyId, requestedClaims, requestedClaimsHash) {
         var _a, _b;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
@@ -4242,7 +4258,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.clientId = clientId;
         atEntity.realm = tenantId;
         atEntity.target = scopes;
-        atEntity.oboAssertion = oboAssertion;
+        atEntity.userAssertionHash = userAssertionHash;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
         if (requestedClaims) {
             atEntity.requestedClaims = requestedClaims;
@@ -4289,7 +4305,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
     return AccessTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4326,14 +4342,14 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
      * @param clientId
      * @param authority
      */
-    RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, oboAssertion) {
+    RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash) {
         var rtEntity = new RefreshTokenEntity();
         rtEntity.clientId = clientId;
         rtEntity.credentialType = CredentialType.REFRESH_TOKEN;
         rtEntity.environment = environment;
         rtEntity.homeAccountId = homeAccountId;
         rtEntity.secret = refreshToken;
-        rtEntity.oboAssertion = oboAssertion;
+        rtEntity.userAssertionHash = userAssertionHash;
         if (familyId)
             rtEntity.familyId = familyId;
         return rtEntity;
@@ -4356,7 +4372,7 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
     return RefreshTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4384,6 +4400,10 @@ var InteractionRequiredAuthErrorMessage = {
     noTokensFoundError: {
         code: "no_tokens_found",
         desc: "No refresh token found in the cache. Please sign-in."
+    },
+    native_account_unavailable: {
+        code: "native_account_unavailable",
+        desc: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API."
     }
 };
 /**
@@ -4417,10 +4437,17 @@ var InteractionRequiredAuthError = /** @class */ (function (_super) {
     InteractionRequiredAuthError.createNoTokensFoundError = function () {
         return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.noTokensFoundError.code, InteractionRequiredAuthErrorMessage.noTokensFoundError.desc);
     };
+    /**
+     * Creates an error thrown when the native broker returns ACCOUNT_UNAVAILABLE status, indicating that the account was removed and interactive sign-in is required
+     * @returns
+     */
+    InteractionRequiredAuthError.createNativeAccountUnavailableError = function () {
+        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.native_account_unavailable.code, InteractionRequiredAuthErrorMessage.native_account_unavailable.desc);
+    };
     return InteractionRequiredAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4436,7 +4463,7 @@ var CacheRecord = /** @class */ (function () {
     return CacheRecord;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4507,7 +4534,7 @@ var ProtocolUtils = /** @class */ (function () {
     return ProtocolUtils;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4708,7 +4735,7 @@ var UrlString = /** @class */ (function () {
     return UrlString;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4725,34 +4752,30 @@ var PopTokenGenerator = /** @class */ (function () {
     }
     /**
      * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
      * @param request
      * @returns
      */
     PopTokenGenerator.prototype.generateCnf = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var reqCnf;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var reqCnf, reqCnfString, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0: return [4 /*yield*/, this.generateKid(request)];
                     case 1:
-                        reqCnf = _a.sent();
-                        return [2 /*return*/, this.cryptoUtils.base64Encode(JSON.stringify(reqCnf))];
+                        reqCnf = _b.sent();
+                        reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+                        _a = {
+                            kid: reqCnf.kid,
+                            reqCnfString: reqCnfString
+                        };
+                        return [4 /*yield*/, this.cryptoUtils.hashString(reqCnfString)];
+                    case 2: return [2 /*return*/, (_a.reqCnfHash = _b.sent(),
+                            _a)];
                 }
             });
         });
     };
-    /**
-     * Generates the hash of the req_cnf
-     * @param cnf
-     * @returns
-     */
-    PopTokenGenerator.prototype.generateCnfHash = function (cnf) {
-        return __awaiter(this, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                return [2 /*return*/, this.cryptoUtils.hashString(cnf)];
-            });
-        });
-    };
     /**
      * Generates key_id for a SHR token request
      * @param request
@@ -4780,16 +4803,10 @@ var PopTokenGenerator = /** @class */ (function () {
      * @param request
      * @returns
      */
-    PopTokenGenerator.prototype.signPopToken = function (accessToken, request) {
-        var _a;
+    PopTokenGenerator.prototype.signPopToken = function (accessToken, keyId, request) {
         return __awaiter(this, void 0, void 0, function () {
-            var tokenClaims;
-            return __generator(this, function (_b) {
-                tokenClaims = AuthToken.extractTokenClaims(accessToken, this.cryptoUtils);
-                if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
-                    throw ClientAuthError.createTokenClaimsRequiredError();
-                }
-                return [2 /*return*/, this.signPayload(accessToken, tokenClaims.cnf.kid, request)];
+            return __generator(this, function (_a) {
+                return [2 /*return*/, this.signPayload(accessToken, keyId, request)];
             });
         });
     };
@@ -4801,7 +4818,7 @@ var PopTokenGenerator = /** @class */ (function () {
      * @param claims
      * @returns
      */
-    PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
+    PopTokenGenerator.prototype.signPayload = function (payload, keyId, request, claims) {
         return __awaiter(this, void 0, void 0, function () {
             var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
             return __generator(this, function (_a) {
@@ -4810,7 +4827,7 @@ var PopTokenGenerator = /** @class */ (function () {
                         resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                         resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                         resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid, request.correlationId)];
+                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), keyId, request.correlationId)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -4819,7 +4836,7 @@ var PopTokenGenerator = /** @class */ (function () {
     return PopTokenGenerator;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4889,7 +4906,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return AppMetadataEntity;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4925,7 +4942,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return TokenCacheContext;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4986,7 +5003,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param serverTokenResponse
      * @param authority
      */
-    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, oboAssertion, handlingRefreshTokenResponse) {
+    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse) {
         return __awaiter(this, void 0, void 0, function () {
             var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
             return __generator(this, function (_a) {
@@ -5008,7 +5025,7 @@ var ResponseHandler = /** @class */ (function () {
                         }
                         // Add keyId from request to serverTokenResponse if defined
                         serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, , 5, 8]);
@@ -5056,7 +5073,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param idTokenObj
      * @param authority
      */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload) {
         var env = authority.getPreferredCache();
         if (StringUtils.isEmpty(env)) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -5065,8 +5082,8 @@ var ResponseHandler = /** @class */ (function () {
         var cachedIdToken;
         var cachedAccount;
         if (!StringUtils.isEmpty(serverTokenResponse.id_token) && !!idTokenObj) {
-            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING, oboAssertion);
-            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, oboAssertion, authCodePayload);
+            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
         }
         // AccessToken
         var cachedAccessToken = null;
@@ -5084,12 +5101,12 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         var cachedRefreshToken = null;
         if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {
-            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, oboAssertion);
+            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, userAssertionHash);
         }
         // appMetadata
         var cachedAppMetadata = null;
@@ -5104,22 +5121,22 @@ var ResponseHandler = /** @class */ (function () {
      * @param idToken
      * @param authority
      */
-    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, authCodePayload) {
         var authorityType = authority.authorityType;
         var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : Constants.EMPTY_STRING;
         var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : Constants.EMPTY_STRING;
         // ADFS does not require client_info in the response
         if (authorityType === AuthorityType.Adfs) {
             this.logger.verbose("Authority type is ADFS, creating ADFS account");
-            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
         }
         // This fallback applies to B2C as well as they fall under an AAD account type.
         if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === "AAD") {
             throw ClientAuthError.createClientInfoEmptyError();
         }
         return serverTokenResponse.client_info ?
-            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost) :
-            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost) :
+            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
     };
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -5134,9 +5151,9 @@ var ResponseHandler = /** @class */ (function () {
     ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
-            var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
-            return __generator(this, function (_d) {
-                switch (_d.label) {
+            var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
                     case 0:
                         accessToken = Constants.EMPTY_STRING;
                         responseScopes = [];
@@ -5145,18 +5162,22 @@ var ResponseHandler = /** @class */ (function () {
                         if (!cacheRecord.accessToken) return [3 /*break*/, 4];
                         if (!(cacheRecord.accessToken.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         popTokenGenerator = new PopTokenGenerator(cryptoObj);
-                        return [4 /*yield*/, popTokenGenerator.signPopToken(cacheRecord.accessToken.secret, request)];
+                        _d = cacheRecord.accessToken, secret = _d.secret, keyId = _d.keyId;
+                        if (!keyId) {
+                            throw ClientAuthError.createKeyIdMissingError();
+                        }
+                        return [4 /*yield*/, popTokenGenerator.signPopToken(secret, keyId, request)];
                     case 1:
-                        accessToken = _d.sent();
+                        accessToken = _e.sent();
                         return [3 /*break*/, 3];
                     case 2:
                         accessToken = cacheRecord.accessToken.secret;
-                        _d.label = 3;
+                        _e.label = 3;
                     case 3:
                         responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
                         expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
                         extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
-                        _d.label = 4;
+                        _e.label = 4;
                     case 4:
                         if (cacheRecord.appMetadata) {
                             familyId = cacheRecord.appMetadata.familyId === THE_FAMILY_ID ? THE_FAMILY_ID : Constants.EMPTY_STRING;
@@ -5191,7 +5212,7 @@ var ResponseHandler = /** @class */ (function () {
     return ResponseHandler;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5358,7 +5379,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      */
     AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
+            var parameterBuilder, clientAssertion, popTokenGenerator, reqCnfData, correlationId, ccsCred, clientInfo, clientInfo;
             var _a;
             return __generator(this, function (_b) {
                 switch (_b.label) {
@@ -5406,8 +5427,9 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _b.sent();
-                        parameterBuilder.addPopToken(cnfString);
+                        reqCnfData = _b.sent();
+                        // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                         return [3 /*break*/, 3];
                     case 2:
                         if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
@@ -5478,7 +5500,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      */
     AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, cnf, cnfHash;
+            var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, reqCnfData;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -5570,20 +5592,17 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         if (request.extraQueryParameters) {
                             parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
                         }
-                        if (!request.nativeBroker) return [3 /*break*/, 3];
+                        if (!request.nativeBroker) return [3 /*break*/, 2];
                         // signal ests that this is a WAM call
                         parameterBuilder.addNativeBroker();
-                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnf = _a.sent();
-                        return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
-                    case 2:
-                        cnfHash = _a.sent();
-                        parameterBuilder.addPopToken(cnfHash);
-                        _a.label = 3;
-                    case 3: return [2 /*return*/, parameterBuilder.createQueryString()];
+                        reqCnfData = _a.sent();
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                        _a.label = 2;
+                    case 2: return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
             });
         });
@@ -5628,7 +5647,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     return AuthorizationCodeClient;
 }(BaseClient));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5769,7 +5788,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      */
     RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, cnfString, clientInfo;
+            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, reqCnfData, clientInfo;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -5799,8 +5818,9 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _a.sent();
-                        parameterBuilder.addPopToken(cnfString);
+                        reqCnfData = _a.sent();
+                        // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                         return [3 /*break*/, 3];
                     case 2:
                         if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
@@ -5840,7 +5860,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
     return RefreshTokenClient;
 }(BaseClient));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5956,7 +5976,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     return SilentFlowClient;
 }(BaseClient));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5964,10 +5984,20 @@ var SilentFlowClient = /** @class */ (function (_super) {
 function isOpenIdConfigResponse(response) {
     return (response.hasOwnProperty("authorization_endpoint") &&
         response.hasOwnProperty("token_endpoint") &&
-        response.hasOwnProperty("issuer"));
+        response.hasOwnProperty("issuer") &&
+        response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var rawMetdataJSON = { "endpointMetadata": { "https://login.microsoftonline.com/common/": { "token_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.com/common/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.com/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.com/common/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.com", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pas.windows.net" }, "https://login.chinacloudapi.cn/common/": { "token_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.chinacloudapi.cn/common/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.partner.microsoftonline.cn/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://microsoftgraph.chinacloudapi.cn/oidc/userinfo", "authorization_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.chinacloudapi.cn/common/kerberos", "tenant_region_scope": null, "cloud_instance_name": "partner.microsoftonline.cn", "cloud_graph_host_name": "graph.chinacloudapi.cn", "msgraph_host": "microsoftgraph.chinacloudapi.cn", "rbac_url": "https://pas.chinacloudapi.cn" }, "https://login.microsoftonline.us/common/": { "token_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.us/common/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.us/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.us/common/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.us", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pasff.usgovcloudapi.net" }, "https://login.microsoftonline.com/consumers/": { "token_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.com/consumers/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.com/consumers/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.com", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pas.windows.net" }, "https://login.chinacloudapi.cn/consumers/": { "token_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.chinacloudapi.cn/consumers/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.partner.microsoftonline.cn/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://microsoftgraph.chinacloudapi.cn/oidc/userinfo", "authorization_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.chinacloudapi.cn/consumers/kerberos", "tenant_region_scope": null, "cloud_instance_name": "partner.microsoftonline.cn", "cloud_graph_host_name": "graph.chinacloudapi.cn", "msgraph_host": "microsoftgraph.chinacloudapi.cn", "rbac_url": "https://pas.chinacloudapi.cn" }, "https://login.microsoftonline.us/consumers/": { "token_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.us/consumers/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.us/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.us/consumers/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.us", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pasff.usgovcloudapi.net" }, "https://login.microsoftonline.com/organizations/": { "token_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.com/organizations/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.com/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.com/organizations/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.com", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pas.windows.net" }, "https://login.chinacloudapi.cn/organizations/": { "token_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.chinacloudapi.cn/organizations/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.partner.microsoftonline.cn/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://microsoftgraph.chinacloudapi.cn/oidc/userinfo", "authorization_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.chinacloudapi.cn/organizations/kerberos", "tenant_region_scope": null, "cloud_instance_name": "partner.microsoftonline.cn", "cloud_graph_host_name": "graph.chinacloudapi.cn", "msgraph_host": "microsoftgraph.chinacloudapi.cn", "rbac_url": "https://pas.chinacloudapi.cn" }, "https://login.microsoftonline.us/organizations/": { "token_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.us/organizations/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.us/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.us/organizations/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.us", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pasff.usgovcloudapi.net" } }, "instanceDiscoveryMetadata": { "https://login.microsoftonline.com/common/": { "tenant_discovery_endpoint": "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.chinacloudapi.cn/common/": { "tenant_discovery_endpoint": "https://login.chinacloudapi.cn/common/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.us/common/": { "tenant_discovery_endpoint": "https://login.microsoftonline.us/common/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.com/consumers/": { "tenant_discovery_endpoint": "https://login.microsoftonline.com/consumers/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.chinacloudapi.cn/consumers/": { "tenant_discovery_endpoint": "https://login.chinacloudapi.cn/consumers/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.us/consumers/": { "tenant_discovery_endpoint": "https://login.microsoftonline.us/consumers/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.com/organizations/": { "tenant_discovery_endpoint": "https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.chinacloudapi.cn/organizations/": { "tenant_discovery_endpoint": "https://login.chinacloudapi.cn/organizations/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.us/organizations/": { "tenant_discovery_endpoint": "https://login.microsoftonline.us/organizations/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] } } };
+var EndpointMetadata = rawMetdataJSON.endpointMetadata;
+var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
+
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5981,7 +6011,7 @@ exports.ProtocolMode = void 0;
     ProtocolMode["OIDC"] = "OIDC";
 })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6013,6 +6043,7 @@ var AuthorityMetadataEntity = /** @class */ (function () {
         this.end_session_endpoint = metadata.end_session_endpoint;
         this.issuer = metadata.issuer;
         this.endpointsFromNetwork = fromNetwork;
+        this.jwks_uri = metadata.jwks_uri;
     };
     /**
      * Save the authority that was used to create this cache entry
@@ -6051,12 +6082,13 @@ var AuthorityMetadataEntity = /** @class */ (function () {
             entity.hasOwnProperty("issuer") &&
             entity.hasOwnProperty("aliasesFromNetwork") &&
             entity.hasOwnProperty("endpointsFromNetwork") &&
-            entity.hasOwnProperty("expiresAt"));
+            entity.hasOwnProperty("expiresAt") &&
+            entity.hasOwnProperty("jwks_uri"));
     };
     return AuthorityMetadataEntity;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6066,7 +6098,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6188,7 +6220,7 @@ var RegionDiscovery = /** @class */ (function () {
     return RegionDiscovery;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6373,6 +6405,22 @@ var Authority = /** @class */ (function () {
         enumerable: false,
         configurable: true
     });
+    Object.defineProperty(Authority.prototype, "jwksUri", {
+        /**
+         * Jwks_uri for token signing keys
+         */
+        get: function () {
+            if (this.discoveryComplete()) {
+                var endpoint = this.replacePath(this.metadata.jwks_uri);
+                return this.replaceTenant(endpoint);
+            }
+            else {
+                throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            }
+        },
+        enumerable: false,
+        configurable: true
+    });
     /**
      * Replaces tenant in url path with current tenant. Defaults to common.
      * @param urlString
@@ -6456,11 +6504,11 @@ var Authority = /** @class */ (function () {
      * @param metadataEntity
      */
     Authority.prototype.updateEndpointMetadata = function (metadataEntity) {
-        var _a;
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function () {
-            var metadata, autodetectedRegionName, azureRegion;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            var metadata, harcodedMetadata;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
                         metadata = this.getEndpointMetadataFromConfig();
                         if (metadata) {
@@ -6471,41 +6519,30 @@ var Authority = /** @class */ (function () {
                             // No need to update
                             return [2 /*return*/, AuthorityMetadataSource.CACHE];
                         }
+                        harcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
                         return [4 /*yield*/, this.getEndpointMetadataFromNetwork()];
                     case 1:
-                        metadata = _b.sent();
+                        metadata = _c.sent();
                         if (!metadata) return [3 /*break*/, 4];
                         if (!((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.azureRegion)) return [3 /*break*/, 3];
-                        return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata, this.proxyUrl)];
+                        return [4 /*yield*/, this.updateMetadataWithRegionalInformation(metadata)];
                     case 2:
-                        autodetectedRegionName = _b.sent();
-                        azureRegion = this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
-                            ? autodetectedRegionName
-                            : this.authorityOptions.azureRegionConfiguration.azureRegion;
-                        if (this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
-                            this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName ?
-                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL :
-                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
-                        }
-                        else {
-                            if (autodetectedRegionName) {
-                                this.regionDiscoveryMetadata.region_outcome = (this.authorityOptions.azureRegionConfiguration.azureRegion === autodetectedRegionName) ?
-                                    RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED :
-                                    RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;
-                            }
-                            else {
-                                this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
-                            }
-                        }
-                        if (azureRegion) {
-                            this.regionDiscoveryMetadata.region_used = azureRegion;
-                            metadata = Authority.replaceWithRegionalInformation(metadata, azureRegion);
-                        }
-                        _b.label = 3;
+                        metadata = _c.sent();
+                        _c.label = 3;
                     case 3:
                         metadataEntity.updateEndpointMetadata(metadata, true);
                         return [2 /*return*/, AuthorityMetadataSource.NETWORK];
-                    case 4: throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
+                    case 4:
+                        if (!(harcodedMetadata && !this.authorityOptions.skipAuthorityMetadataCache)) return [3 /*break*/, 7];
+                        if (!((_b = this.authorityOptions.azureRegionConfiguration) === null || _b === void 0 ? void 0 : _b.azureRegion)) return [3 /*break*/, 6];
+                        return [4 /*yield*/, this.updateMetadataWithRegionalInformation(harcodedMetadata)];
+                    case 5:
+                        harcodedMetadata = _c.sent();
+                        _c.label = 6;
+                    case 6:
+                        metadataEntity.updateEndpointMetadata(harcodedMetadata, false);
+                        return [2 /*return*/, AuthorityMetadataSource.HARDCODED_VALUES];
+                    case 7: throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
                 }
             });
         });
@@ -6536,6 +6573,8 @@ var Authority = /** @class */ (function () {
     };
     /**
      * Gets OAuth endpoints from the given OpenID configuration endpoint.
+     *
+     * @param hasHardcodedMetadata boolean
      */
     Authority.prototype.getEndpointMetadataFromNetwork = function () {
         return __awaiter(this, void 0, void 0, function () {
@@ -6562,6 +6601,54 @@ var Authority = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Get OAuth endpoints for common authorities.
+     */
+    Authority.prototype.getEndpointMetadataFromHardcodedValues = function () {
+        if (this.canonicalAuthority in EndpointMetadata) {
+            return EndpointMetadata[this.canonicalAuthority];
+        }
+        return null;
+    };
+    /**
+     * Update the retrieved metadata with regional information.
+     */
+    Authority.prototype.updateMetadataWithRegionalInformation = function (metadata) {
+        var _a, _b, _c, _d, _e;
+        return __awaiter(this, void 0, void 0, function () {
+            var autodetectedRegionName, azureRegion;
+            return __generator(this, function (_f) {
+                switch (_f.label) {
+                    case 0: return [4 /*yield*/, this.regionDiscovery.detectRegion((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.environmentRegion, this.regionDiscoveryMetadata, this.proxyUrl)];
+                    case 1:
+                        autodetectedRegionName = _f.sent();
+                        azureRegion = ((_b = this.authorityOptions.azureRegionConfiguration) === null || _b === void 0 ? void 0 : _b.azureRegion) === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
+                            ? autodetectedRegionName
+                            : (_c = this.authorityOptions.azureRegionConfiguration) === null || _c === void 0 ? void 0 : _c.azureRegion;
+                        if (((_d = this.authorityOptions.azureRegionConfiguration) === null || _d === void 0 ? void 0 : _d.azureRegion) === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
+                            this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName ?
+                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL :
+                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
+                        }
+                        else {
+                            if (autodetectedRegionName) {
+                                this.regionDiscoveryMetadata.region_outcome = (((_e = this.authorityOptions.azureRegionConfiguration) === null || _e === void 0 ? void 0 : _e.azureRegion) === autodetectedRegionName) ?
+                                    RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED :
+                                    RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;
+                            }
+                            else {
+                                this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                            }
+                        }
+                        if (azureRegion) {
+                            this.regionDiscoveryMetadata.region_used = azureRegion;
+                            return [2 /*return*/, Authority.replaceWithRegionalInformation(metadata, azureRegion)];
+                        }
+                        return [2 /*return*/, metadata];
+                }
+            });
+        });
+    };
     /**
      * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from
      * @param cachedMetadata
@@ -6569,7 +6656,7 @@ var Authority = /** @class */ (function () {
      */
     Authority.prototype.updateCloudDiscoveryMetadata = function (metadataEntity) {
         return __awaiter(this, void 0, void 0, function () {
-            var metadata;
+            var metadata, harcodedMetadata;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -6583,6 +6670,7 @@ var Authority = /** @class */ (function () {
                             // No need to update
                             return [2 /*return*/, AuthorityMetadataSource.CACHE];
                         }
+                        harcodedMetadata = this.getCloudDiscoveryMetadataFromHarcodedValues();
                         return [4 /*yield*/, this.getCloudDiscoveryMetadataFromNetwork()];
                     case 1:
                         metadata = _a.sent();
@@ -6590,6 +6678,10 @@ var Authority = /** @class */ (function () {
                             metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
                             return [2 /*return*/, AuthorityMetadataSource.NETWORK];
                         }
+                        if (harcodedMetadata && !this.options.skipAuthorityMetadataCache) {
+                            metadataEntity.updateCloudDiscoveryMetadata(harcodedMetadata, false);
+                            return [2 /*return*/, AuthorityMetadataSource.HARDCODED_VALUES];
+                        }
                         else {
                             // Metadata could not be obtained from config, cache or network
                             throw ClientConfigurationError.createUntrustedAuthorityError();
@@ -6623,7 +6715,8 @@ var Authority = /** @class */ (function () {
     };
     /**
      * Called to get metadata from network if CloudDiscoveryMetadata was not populated by config
-     * @param networkInterface
+     *
+     * @param hasHardcodedMetadata boolean
      */
     Authority.prototype.getCloudDiscoveryMetadataFromNetwork = function () {
         return __awaiter(this, void 0, void 0, function () {
@@ -6643,7 +6736,9 @@ var Authority = /** @class */ (function () {
                         return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options)];
                     case 2:
                         response = _a.sent();
-                        metadata = isCloudInstanceDiscoveryResponse(response.body) ? response.body.metadata : [];
+                        metadata = isCloudInstanceDiscoveryResponse(response.body)
+                            ? response.body.metadata
+                            : [];
                         if (metadata.length === 0) {
                             // If no metadata is returned, authority is untrusted
                             return [2 /*return*/, null];
@@ -6663,6 +6758,15 @@ var Authority = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Get cloud discovery metadata for common authorities
+     */
+    Authority.prototype.getCloudDiscoveryMetadataFromHarcodedValues = function () {
+        if (this.canonicalAuthority in InstanceDiscoveryMetadata) {
+            return InstanceDiscoveryMetadata[this.canonicalAuthority];
+        }
+        return null;
+    };
     /**
      * Helper function to determine if this host is included in the knownAuthorities config option
      */
@@ -6778,7 +6882,7 @@ var Authority = /** @class */ (function () {
     return Authority;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6839,7 +6943,7 @@ var AuthorityFactory = /** @class */ (function () {
     return AuthorityFactory;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6870,7 +6974,7 @@ var ServerTelemetryEntity = /** @class */ (function () {
     return ServerTelemetryEntity;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6898,7 +7002,7 @@ var ThrottlingEntity = /** @class */ (function () {
     return ThrottlingEntity;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6915,7 +7019,92 @@ var StubbedNetworkModule = {
     }
 };
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * ClientAuthErrorMessage class containing string constants used by error codes and messages.
+ */
+var JoseHeaderErrorMessage = {
+    missingKidError: {
+        code: "missing_kid_error",
+        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided."
+    },
+    missingAlgError: {
+        code: "missing_alg_error",
+        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided."
+    },
+};
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+var JoseHeaderError = /** @class */ (function (_super) {
+    __extends(JoseHeaderError, _super);
+    function JoseHeaderError(errorCode, errorMessage) {
+        var _this = _super.call(this, errorCode, errorMessage) || this;
+        _this.name = "JoseHeaderError";
+        Object.setPrototypeOf(_this, JoseHeaderError.prototype);
+        return _this;
+    }
+    /**
+     * Creates an error thrown when keyId isn't set on JOSE header.
+     */
+    JoseHeaderError.createMissingKidError = function () {
+        return new JoseHeaderError(JoseHeaderErrorMessage.missingKidError.code, JoseHeaderErrorMessage.missingKidError.desc);
+    };
+    /**
+     * Creates an error thrown when algorithm isn't set on JOSE header.
+     */
+    JoseHeaderError.createMissingAlgError = function () {
+        return new JoseHeaderError(JoseHeaderErrorMessage.missingAlgError.code, JoseHeaderErrorMessage.missingAlgError.desc);
+    };
+    return JoseHeaderError;
+}(AuthError));
+
+/*! @azure/msal-common v7.1.0 2022-07-05 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var JoseHeader = /** @class */ (function () {
+    function JoseHeader(options) {
+        this.typ = options.typ;
+        this.alg = options.alg;
+        this.kid = options.kid;
+    }
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object and returns
+     * the stringified header object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @returns
+     */
+    JoseHeader.getShrHeaderString = function (shrHeaderOptions) {
+        // KeyID is required on the SHR header
+        if (!shrHeaderOptions.kid) {
+            throw JoseHeaderError.createMissingKidError();
+        }
+        // Alg is required on the SHR header
+        if (!shrHeaderOptions.alg) {
+            throw JoseHeaderError.createMissingAlgError();
+        }
+        var shrHeader = new JoseHeader({
+            // Access Token PoP headers must have type JWT, but the type header can be overriden for special cases
+            typ: shrHeaderOptions.typ || JsonTypes.Jwt,
+            kid: shrHeaderOptions.kid,
+            alg: shrHeaderOptions.alg
+        });
+        return JSON.stringify(shrHeader);
+    };
+    return JoseHeader;
+}());
+
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6974,7 +7163,7 @@ var AuthenticationHeaderParser = /** @class */ (function () {
     return AuthenticationHeaderParser;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7136,7 +7325,7 @@ var ServerTelemetryManager = /** @class */ (function () {
     return ServerTelemetryManager;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7233,7 +7422,7 @@ var PerformanceEventStatus;
     PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
 })(PerformanceEventStatus || (PerformanceEventStatus = {}));
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7503,7 +7692,7 @@ var PerformanceClient = /** @class */ (function () {
     return PerformanceClient;
 }());
 
-/*! @azure/msal-common v6.3.0 2022-05-02 */
+/*! @azure/msal-common v7.1.0 2022-07-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7561,7 +7750,7 @@ var BrowserAuthErrorMessage = {
     },
     hashEmptyError: {
         code: "hash_empty_error",
-        desc: "Hash value cannot be processed because it is empty. Please verify that your redirectUri is not clearing the hash."
+        desc: "Hash value cannot be processed because it is empty. Please verify that your redirectUri is not clearing the hash. For more visit: aka.ms/msaljs/browser-errors."
     },
     hashDoesNotContainStateError: {
         code: "no_state_in_hash",
@@ -7569,7 +7758,7 @@ var BrowserAuthErrorMessage = {
     },
     hashDoesNotContainKnownPropertiesError: {
         code: "hash_does_not_contain_known_properties",
-        desc: "Hash does not contain known properites. Please verify that your redirectUri is not changing the hash."
+        desc: "Hash does not contain known properites. Please verify that your redirectUri is not changing the hash. For more visit: aka.ms/msaljs/browser-errors."
     },
     unableToParseStateError: {
         code: "unable_to_parse_state",
@@ -7605,7 +7794,7 @@ var BrowserAuthErrorMessage = {
     },
     redirectInIframeError: {
         code: "redirect_in_iframe",
-        desc: "Code flow is not supported inside an iframe. Please ensure you are using MSAL.js in a top frame of the window if using the redirect APIs, or use the popup APIs."
+        desc: "Redirects are not supported for iframed or brokered applications. Please ensure you are using MSAL.js in a top frame of the window if using the redirect APIs, or use the popup APIs."
     },
     blockTokenRequestsInHiddenIframeError: {
         code: "block_iframe_reload",
@@ -7830,7 +8019,7 @@ var BrowserAuthError = /** @class */ (function (_super) {
         return new BrowserAuthError(BrowserAuthErrorMessage.monitorIframeTimeoutError.code, BrowserAuthErrorMessage.monitorIframeTimeoutError.desc);
     };
     /**
-     * Creates an error thrown when navigateWindow is called inside an iframe.
+     * Creates an error thrown when navigateWindow is called inside an iframe or brokered applications.
      * @param windowParentCheck
      */
     BrowserAuthError.createRedirectInIframeError = function (windowParentCheck) {
@@ -8049,7 +8238,8 @@ var BrowserConstants = {
 };
 var NativeConstants = {
     CHANNEL_ID: "53ee284d-920a-4b59-9d30-a60315b26836",
-    PREFERRED_EXTENSION_ID: "ppnbnpeolgkicgegkbkbjmhlideopiji"
+    PREFERRED_EXTENSION_ID: "ppnbnpeolgkicgegkbkbjmhlideopiji",
+    MATS_TELEMETRY: "MATS"
 };
 var NativeExtensionMethod;
 (function (NativeExtensionMethod) {
@@ -8927,7 +9117,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
      * @param expires
      */
     BrowserCacheManager.prototype.setItemCookie = function (cookieName, cookieValue, expires) {
-        var cookieStr = encodeURIComponent(cookieName) + "=" + encodeURIComponent(cookieValue) + ";path=/;";
+        var cookieStr = encodeURIComponent(cookieName) + "=" + encodeURIComponent(cookieValue) + ";path=/;SameSite=Lax;";
         if (expires) {
             var expireTime = this.getCookieExpirationTime(expires);
             cookieStr += "expires=" + expireTime + ";";
@@ -9299,7 +9489,7 @@ var DEFAULT_BROWSER_CACHE_MANAGER = function (clientId, logger) {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-browser";
-var version = "2.24.0";
+var version = "2.27.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9848,7 +10038,8 @@ var BaseInteractionClient = /** @class */ (function () {
                             protocolMode: this.config.auth.protocolMode,
                             knownAuthorities: this.config.auth.knownAuthorities,
                             cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-                            authorityMetadata: this.config.auth.authorityMetadata
+                            authorityMetadata: this.config.auth.authorityMetadata,
+                            skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
                         };
                         if (!requestAuthority) return [3 /*break*/, 2];
                         this.logger.verbose("Creating discovered authority with request authority");
@@ -10080,6 +10271,7 @@ var StandardInteractionClient = /** @class */ (function (_super) {
                             knownAuthorities: this.config.auth.knownAuthorities,
                             cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
                             authorityMetadata: this.config.auth.authorityMetadata,
+                            skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache
                         };
                         userAuthority = requestAuthority ? requestAuthority : this.config.auth.authority;
                         builtAuthority = Authority.generateAuthority(userAuthority, requestAzureCloudOptions || this.config.auth.azureCloudOptions);
@@ -10093,6 +10285,8 @@ var StandardInteractionClient = /** @class */ (function (_super) {
                             })
                                 .catch(function (error) {
                                 getAuthorityMeasurement.endMeasurement({
+                                    errorCode: error.errorCode,
+                                    subErrorCode: error.subError,
                                     success: false
                                 });
                                 throw error;
@@ -10152,11 +10346,11 @@ var StandardInteractionClient = /** @class */ (function (_super) {
  * Abstract class which defines operations for a browser interaction handling class.
  */
 var InteractionHandler = /** @class */ (function () {
-    function InteractionHandler(authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) {
+    function InteractionHandler(authCodeModule, storageImpl, authCodeRequest, logger) {
         this.authModule = authCodeModule;
         this.browserStorage = storageImpl;
         this.authCodeRequest = authCodeRequest;
-        this.browserRequestLogger = browserRequestLogger;
+        this.logger = logger;
     }
     /**
      * Function to handle response parameters from hash.
@@ -10166,7 +10360,7 @@ var InteractionHandler = /** @class */ (function () {
         return __awaiter$1(this, void 0, void 0, function () {
             var stateKey, requestState, authCodeResponse;
             return __generator$1(this, function (_a) {
-                this.browserRequestLogger.verbose("InteractionHandler.handleCodeResponse called");
+                this.logger.verbose("InteractionHandler.handleCodeResponse called");
                 // Check that location hash isn't empty.
                 if (StringUtils.isEmpty(locationHash)) {
                     throw BrowserAuthError.createEmptyHashError(locationHash);
@@ -10207,7 +10401,7 @@ var InteractionHandler = /** @class */ (function () {
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        this.browserRequestLogger.trace("InteractionHandler.handleCodeResponseFromServer called");
+                        this.logger.trace("InteractionHandler.handleCodeResponseFromServer called");
                         stateKey = this.browserStorage.generateStateKey(state);
                         requestState = this.browserStorage.getTemporaryCache(stateKey);
                         if (!requestState) {
@@ -10295,8 +10489,8 @@ var InteractionHandler = /** @class */ (function () {
  */
 var RedirectHandler = /** @class */ (function (_super) {
     __extends$1(RedirectHandler, _super);
-    function RedirectHandler(authCodeModule, storageImpl, authCodeRequest, browserRequestLogger, browserCrypto) {
-        var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) || this;
+    function RedirectHandler(authCodeModule, storageImpl, authCodeRequest, logger, browserCrypto) {
+        var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, logger) || this;
         _this.browserCrypto = browserCrypto;
         return _this;
     }
@@ -10310,38 +10504,38 @@ var RedirectHandler = /** @class */ (function (_super) {
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest called");
+                        this.logger.verbose("RedirectHandler.initiateAuthRequest called");
                         if (!!StringUtils.isEmpty(requestUrl)) return [3 /*break*/, 7];
                         // Cache start page, returns to this page after redirectUri if navigateToLoginRequestUrl is true
                         if (params.redirectStartPage) {
-                            this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: redirectStartPage set, caching start page");
+                            this.logger.verbose("RedirectHandler.initiateAuthRequest: redirectStartPage set, caching start page");
                             this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, params.redirectStartPage, true);
                         }
                         // Set interaction status in the library.
                         this.browserStorage.setTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, this.authCodeRequest.correlationId, true);
                         this.browserStorage.cacheCodeRequest(this.authCodeRequest, this.browserCrypto);
-                        this.browserRequestLogger.infoPii("RedirectHandler.initiateAuthRequest: Navigate to: " + requestUrl);
+                        this.logger.infoPii("RedirectHandler.initiateAuthRequest: Navigate to: " + requestUrl);
                         navigationOptions = {
                             apiId: exports.ApiId.acquireTokenRedirect,
                             timeout: params.redirectTimeout,
                             noHistory: false
                         };
                         if (!(typeof params.onRedirectNavigate === "function")) return [3 /*break*/, 4];
-                        this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback");
+                        this.logger.verbose("RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback");
                         navigate = params.onRedirectNavigate(requestUrl);
                         if (!(navigate !== false)) return [3 /*break*/, 2];
-                        this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating");
+                        this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating");
                         return [4 /*yield*/, params.navigationClient.navigateExternal(requestUrl, navigationOptions)];
                     case 1:
                         _a.sent();
                         return [2 /*return*/];
                     case 2:
-                        this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation");
+                        this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation");
                         return [2 /*return*/];
                     case 3: return [3 /*break*/, 6];
                     case 4:
                         // Navigate window to request URL
-                        this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: Navigating window to navigate url");
+                        this.logger.verbose("RedirectHandler.initiateAuthRequest: Navigating window to navigate url");
                         return [4 /*yield*/, params.navigationClient.navigateExternal(requestUrl, navigationOptions)];
                     case 5:
                         _a.sent();
@@ -10349,7 +10543,7 @@ var RedirectHandler = /** @class */ (function (_super) {
                     case 6: return [3 /*break*/, 8];
                     case 7:
                         // Throw error if request URL is empty.
-                        this.browserRequestLogger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty");
+                        this.logger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty");
                         throw BrowserAuthError.createEmptyNavigationUriError();
                     case 8: return [2 /*return*/];
                 }
@@ -10366,7 +10560,7 @@ var RedirectHandler = /** @class */ (function (_super) {
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        this.browserRequestLogger.verbose("RedirectHandler.handleCodeResponse called");
+                        this.logger.verbose("RedirectHandler.handleCodeResponse called");
                         // Check that location hash isn't empty.
                         if (StringUtils.isEmpty(locationHash)) {
                             throw BrowserAuthError.createEmptyHashError(locationHash);
@@ -10467,6 +10661,8 @@ var NativeStatusCode;
     NativeStatusCode["NO_NETWORK"] = "NO_NETWORK";
     NativeStatusCode["TRANSIENT_ERROR"] = "TRANSIENT_ERROR";
     NativeStatusCode["PERSISTENT_ERROR"] = "PERSISTENT_ERROR";
+    NativeStatusCode["DISABLED"] = "DISABLED";
+    NativeStatusCode["ACCOUNT_UNAVAILABLE"] = "ACCOUNT_UNAVAILABLE";
 })(NativeStatusCode || (NativeStatusCode = {}));
 var NativeAuthErrorMessage = {
     extensionError: {
@@ -10490,7 +10686,7 @@ var NativeAuthError = /** @class */ (function (_super) {
      * These errors should result in a fallback to the 'standard' browser based auth flow.
      */
     NativeAuthError.prototype.isFatal = function () {
-        if (this.ext && this.ext.status && this.ext.status === NativeStatusCode.PERSISTENT_ERROR) {
+        if (this.ext && this.ext.status && (this.ext.status === NativeStatusCode.PERSISTENT_ERROR || this.ext.status === NativeStatusCode.DISABLED)) {
             return true;
         }
         switch (this.errorCode) {
@@ -10510,6 +10706,8 @@ var NativeAuthError = /** @class */ (function (_super) {
     NativeAuthError.createError = function (code, description, ext) {
         if (ext && ext.status) {
             switch (ext.status) {
+                case NativeStatusCode.ACCOUNT_UNAVAILABLE:
+                    return InteractionRequiredAuthError.createNativeAccountUnavailableError();
                 case NativeStatusCode.USER_INTERACTION_REQUIRED:
                     return new InteractionRequiredAuthError(code, description);
                 case NativeStatusCode.USER_CANCEL:
@@ -10578,6 +10776,8 @@ var NativeInteractionClient = /** @class */ (function (_super) {
                                 .catch(function (error) {
                                 nativeATMeasurement.endMeasurement({
                                     success: false,
+                                    errorCode: error.errorCode,
+                                    subErrorCode: error.subError,
                                     isNativeBroker: true
                                 });
                                 throw error;
@@ -10696,7 +10896,7 @@ var NativeInteractionClient = /** @class */ (function (_super) {
      */
     NativeInteractionClient.prototype.handleNativeResponse = function (response, request, reqTimestamp) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var idTokenObj, authority, authorityPreferredCache, homeAccountIdentifier, accountEntity, responseScopes, accountProperties, uid, tid, responseAccessToken, responseTokenType, _a, popTokenGenerator, shrParameters, result;
+            var idTokenObj, authority, authorityPreferredCache, homeAccountIdentifier, accountEntity, responseScopes, accountProperties, uid, tid, responseAccessToken, responseTokenType, _a, popTokenGenerator, shrParameters, mats, result;
             var _this = this;
             return __generator$1(this, function (_b) {
                 switch (_b.label) {
@@ -10712,14 +10912,14 @@ var NativeInteractionClient = /** @class */ (function (_super) {
                         authority = _b.sent();
                         authorityPreferredCache = authority.getPreferredCache();
                         homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj);
-                        accountEntity = AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, undefined, authorityPreferredCache, response.account.id);
+                        accountEntity = AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, authorityPreferredCache, response.account.id);
                         this.browserStorage.setAccount(accountEntity);
                         responseScopes = response.scopes ? ScopeSet.fromString(response.scopes) : ScopeSet.fromString(request.scopes);
                         accountProperties = response.account.properties || {};
                         uid = accountProperties["UID"] || idTokenObj.claims.oid || idTokenObj.claims.sub || Constants.EMPTY_STRING;
                         tid = accountProperties["TenantId"] || idTokenObj.claims.tid || Constants.EMPTY_STRING;
                         responseTokenType = exports.AuthenticationScheme.BEARER;
-                        _a = request.token_type;
+                        _a = request.tokenType;
                         switch (_a) {
                             case exports.AuthenticationScheme.POP: return [3 /*break*/, 2];
                         }
@@ -10740,7 +10940,14 @@ var NativeInteractionClient = /** @class */ (function (_super) {
                             shrClaims: request.shrClaims,
                             shrNonce: request.shrNonce
                         };
-                        return [4 /*yield*/, popTokenGenerator.signPopToken(response.access_token, shrParameters)];
+                        /**
+                         * KeyID must be present in the native request from when the PoP key was generated in order for
+                         * PopTokenGenerator to query the full key for signing
+                         */
+                        if (!request.keyId) {
+                            throw ClientAuthError.createKeyIdMissingError();
+                        }
+                        return [4 /*yield*/, popTokenGenerator.signPopToken(response.access_token, request.keyId, shrParameters)];
                     case 3:
                         responseAccessToken = _b.sent();
                         return [3 /*break*/, 5];
@@ -10750,6 +10957,7 @@ var NativeInteractionClient = /** @class */ (function (_super) {
                         }
                         _b.label = 5;
                     case 5:
+                        mats = this.getMATSFromResponse(response);
                         result = {
                             authority: authority.canonicalAuthority,
                             uniqueId: uid,
@@ -10759,7 +10967,7 @@ var NativeInteractionClient = /** @class */ (function (_super) {
                             idToken: response.id_token,
                             idTokenClaims: idTokenObj.claims,
                             accessToken: responseAccessToken,
-                            fromCache: false,
+                            fromCache: mats ? this.isResponseFromCache(mats) : false,
                             expiresOn: new Date(Number(reqTimestamp + response.expires_in) * 1000),
                             tokenType: responseTokenType,
                             correlationId: this.correlationId,
@@ -10792,15 +11000,44 @@ var NativeInteractionClient = /** @class */ (function (_super) {
             throw NativeAuthError.createUnexpectedError("Response missing expected properties.");
         }
     };
+    /**
+     * Gets MATS telemetry from native response
+     * @param response
+     * @returns
+     */
+    NativeInteractionClient.prototype.getMATSFromResponse = function (response) {
+        if (response.properties.MATS) {
+            try {
+                return JSON.parse(response.properties.MATS);
+            }
+            catch (e) {
+                this.logger.error("NativeInteractionClient - Error parsing MATS telemetry, returning null instead");
+            }
+        }
+        return null;
+    };
+    /**
+     * Returns whether or not response came from native cache
+     * @param response
+     * @returns
+     */
+    NativeInteractionClient.prototype.isResponseFromCache = function (mats) {
+        if (typeof mats.is_cached === "undefined") {
+            this.logger.verbose("NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false.");
+            return false;
+        }
+        return !!mats.is_cached;
+    };
     /**
      * Translates developer provided request object into NativeRequest object
      * @param request
      */
     NativeInteractionClient.prototype.initializeNativeRequest = function (request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var authority, canonicalAuthority, scopes, scopeSet, instanceAware, validatedRequest, shrParameters, popTokenGenerator, cnf, _a;
-            return __generator$1(this, function (_b) {
-                switch (_b.label) {
+            var authority, canonicalAuthority, scopes, scopeSet, getPrompt, validatedRequest, shrParameters, popTokenGenerator, reqCnfData;
+            var _this = this;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         this.logger.trace("NativeInteractionClient - initializeNativeRequest called");
                         authority = request.authority || this.config.auth.authority;
@@ -10809,21 +11046,34 @@ var NativeInteractionClient = /** @class */ (function (_super) {
                         scopes = request && request.scopes || [];
                         scopeSet = new ScopeSet(scopes);
                         scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
-                        if (request.prompt) {
+                        getPrompt = function () {
+                            // If request is silent, prompt is always none
+                            switch (_this.apiId) {
+                                case exports.ApiId.ssoSilent:
+                                case exports.ApiId.acquireTokenSilent_silentFlow:
+                                    _this.logger.trace("initializeNativeRequest: silent request sets prompt to none");
+                                    return PromptValue.NONE;
+                            }
+                            // Prompt not provided, request may proceed and native broker decides if it needs to prompt
+                            if (!request.prompt) {
+                                _this.logger.trace("initializeNativeRequest: prompt was not provided");
+                                return undefined;
+                            }
+                            // If request is interactive, check if prompt provided is allowed to go directly to native broker
                             switch (request.prompt) {
                                 case PromptValue.NONE:
                                 case PromptValue.CONSENT:
-                                    this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
-                                    break;
+                                case PromptValue.LOGIN:
+                                    _this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
+                                    return request.prompt;
                                 default:
-                                    this.logger.trace("initializeNativeRequest: prompt = " + request.prompt + " is not compatible with native flow");
+                                    _this.logger.trace("initializeNativeRequest: prompt = " + request.prompt + " is not compatible with native flow");
                                     throw BrowserAuthError.createNativePromptParameterNotSupportedError();
                             }
-                        }
-                        instanceAware = !!(request.extraQueryParameters && request.extraQueryParameters.instance_aware);
-                        validatedRequest = __assign$1(__assign$1({}, request), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scopes: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), correlationId: this.correlationId, instance_aware: instanceAware, token_type: request.authenticationScheme, windowTitleSubstring: document.title, extraParameters: __assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), extendedExpiryToken: false // Make this configurable?
+                        };
+                        validatedRequest = __assign$1(__assign$1({}, request), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scopes: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), prompt: getPrompt(), correlationId: this.correlationId, tokenType: request.authenticationScheme, windowTitleSubstring: document.title, extraParameters: __assign$1(__assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), { telemetry: NativeConstants.MATS_TELEMETRY }), extendedExpiryToken: false // Make this configurable?
                          });
-                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         shrParameters = {
                             resourceRequestUri: request.resourceRequestUri,
                             resourceRequestMethod: request.resourceRequestMethod,
@@ -10833,19 +11083,12 @@ var NativeInteractionClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(shrParameters)];
                     case 1:
-                        cnf = _b.sent();
-                        // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                        _a = validatedRequest;
-                        return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
-                    case 2:
+                        reqCnfData = _a.sent();
                         // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                        _a.req_cnf = _b.sent();
-                        _b.label = 3;
-                    case 3:
-                        if (this.apiId === exports.ApiId.ssoSilent || this.apiId === exports.ApiId.acquireTokenSilent_silentFlow) {
-                            validatedRequest.prompt = PromptValue.NONE;
-                        }
-                        return [2 /*return*/, validatedRequest];
+                        validatedRequest.reqCnf = reqCnfData.reqCnfHash;
+                        validatedRequest.keyId = reqCnfData.kid;
+                        _a.label = 2;
+                    case 2: return [2 /*return*/, validatedRequest];
                 }
             });
         });
@@ -11421,269 +11664,37 @@ var RedirectClient = /** @class */ (function (_super) {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-var PopupUtils = /** @class */ (function () {
-    function PopupUtils(storageImpl, logger) {
-        this.browserStorage = storageImpl;
-        this.logger = logger;
+var PopupClient = /** @class */ (function (_super) {
+    __extends$1(PopupClient, _super);
+    function PopupClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) {
+        var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
         // Properly sets this reference for the unload event.
-        this.unloadWindow = this.unloadWindow.bind(this);
+        _this.unloadWindow = _this.unloadWindow.bind(_this);
+        return _this;
     }
     /**
-     * @hidden
-     *
-     * Configures popup window for login.
-     *
-     * @param urlNavigate
-     * @param title
-     * @param popUpWidth
-     * @param popUpHeight
-     * @param popupWindowAttributes
-     * @ignore
-     * @hidden
+     * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
+     * @param request
      */
-    PopupUtils.prototype.openPopup = function (urlNavigate, popupParams) {
+    PopupClient.prototype.acquireToken = function (request) {
         try {
-            var popupWindow = void 0;
-            // Popup window passed in, setting url to navigate to
-            if (popupParams.popup) {
-                popupWindow = popupParams.popup;
-                this.logger.verbosePii("Navigating popup window to: " + urlNavigate);
-                popupWindow.location.assign(urlNavigate);
-            }
-            else if (typeof popupParams.popup === "undefined") {
-                // Popup will be undefined if it was not passed in
-                this.logger.verbosePii("Opening popup window to: " + urlNavigate);
-                popupWindow = PopupUtils.openSizedPopup(urlNavigate, popupParams.popupName, popupParams.popupWindowAttributes, this.logger);
-            }
-            // Popup will be null if popups are blocked
-            if (!popupWindow) {
-                throw BrowserAuthError.createEmptyWindowCreatedError();
+            var popupName = this.generatePopupName(request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority);
+            var popupWindowAttributes = request.popupWindowAttributes || {};
+            // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
+            if (this.config.system.asyncPopups) {
+                this.logger.verbose("asyncPopups set to true, acquiring token");
+                // Passes on popup position and dimensions if in request
+                return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes);
             }
-            if (popupWindow.focus) {
-                popupWindow.focus();
+            else {
+                // asyncPopups flag is set to false. Opens popup before acquiring token.
+                this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
+                var popup = this.openSizedPopup("about:blank", popupName, popupWindowAttributes);
+                return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes, popup);
             }
-            this.currentWindow = popupWindow;
-            window.addEventListener("beforeunload", this.unloadWindow);
-            return popupWindow;
         }
         catch (e) {
-            this.logger.error("error opening popup " + e.message);
-            this.browserStorage.setInteractionInProgress(false);
-            throw BrowserAuthError.createPopupWindowError(e.toString());
-        }
-    };
-    /**
-     * Helper function to set popup window dimensions and position
-     * @param urlNavigate
-     * @param popupName
-     * @param popupWindowAttributes
-     * @returns
-     */
-    PopupUtils.openSizedPopup = function (urlNavigate, popupName, popupWindowAttributes, logger) {
-        var _a, _b, _c, _d;
-        /**
-         * adding winLeft and winTop to account for dual monitor
-         * using screenLeft and screenTop for IE8 and earlier
-         */
-        var winLeft = window.screenLeft ? window.screenLeft : window.screenX;
-        var winTop = window.screenTop ? window.screenTop : window.screenY;
-        /**
-         * window.innerWidth displays browser window"s height and width excluding toolbars
-         * using document.documentElement.clientWidth for IE8 and earlier
-         */
-        var winWidth = window.innerWidth || document.documentElement.clientWidth || document.body.clientWidth;
-        var winHeight = window.innerHeight || document.documentElement.clientHeight || document.body.clientHeight;
-        var width = (_a = popupWindowAttributes.popupSize) === null || _a === void 0 ? void 0 : _a.width;
-        var height = (_b = popupWindowAttributes.popupSize) === null || _b === void 0 ? void 0 : _b.height;
-        var top = (_c = popupWindowAttributes.popupPosition) === null || _c === void 0 ? void 0 : _c.top;
-        var left = (_d = popupWindowAttributes.popupPosition) === null || _d === void 0 ? void 0 : _d.left;
-        if (!width || width < 0 || width > winWidth) {
-            logger.verbose("Default popup window width used. Window width not configured or invalid.");
-            width = BrowserConstants.POPUP_WIDTH;
-        }
-        if (!height || height < 0 || height > winHeight) {
-            logger.verbose("Default popup window height used. Window height not configured or invalid.");
-            height = BrowserConstants.POPUP_HEIGHT;
-        }
-        if (!top || top < 0 || top > winHeight) {
-            logger.verbose("Default popup window top position used. Window top not configured or invalid.");
-            top = Math.max(0, ((winHeight / 2) - (BrowserConstants.POPUP_HEIGHT / 2)) + winTop);
-        }
-        if (!left || left < 0 || left > winWidth) {
-            logger.verbose("Default popup window left position used. Window left not configured or invalid.");
-            left = Math.max(0, ((winWidth / 2) - (BrowserConstants.POPUP_WIDTH / 2)) + winLeft);
-        }
-        return window.open(urlNavigate, popupName, "width=" + width + ", height=" + height + ", top=" + top + ", left=" + left + ", scrollbars=yes");
-    };
-    /**
-     * Event callback to unload main window.
-     */
-    PopupUtils.prototype.unloadWindow = function (e) {
-        this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Popup);
-        if (this.currentWindow) {
-            this.currentWindow.close();
-        }
-        // Guarantees browser unload will happen, so no other errors will be thrown.
-        e.preventDefault();
-    };
-    /**
-     * Closes popup, removes any state vars created during popup calls.
-     * @param popupWindow
-     */
-    PopupUtils.prototype.cleanPopup = function (popupWindow) {
-        if (popupWindow) {
-            // Close window.
-            popupWindow.close();
-        }
-        // Remove window unload function
-        window.removeEventListener("beforeunload", this.unloadWindow);
-        // Interaction is completed - remove interaction status.
-        this.browserStorage.setInteractionInProgress(false);
-    };
-    /**
-     * Monitors a window until it loads a url with the same origin.
-     * @param popupWindow - window that is being monitored
-     */
-    PopupUtils.prototype.monitorPopupForSameOrigin = function (popupWindow) {
-        var _this = this;
-        return new Promise(function (resolve, reject) {
-            var intervalId = setInterval(function () {
-                if (popupWindow.closed) {
-                    // Window is closed
-                    _this.cleanPopup();
-                    clearInterval(intervalId);
-                    reject(BrowserAuthError.createUserCancelledError());
-                    return;
-                }
-                var href = Constants.EMPTY_STRING;
-                try {
-                    /*
-                     * Will throw if cross origin,
-                     * which should be caught and ignored
-                     * since we need the interval to keep running while on STS UI.
-                     */
-                    href = popupWindow.location.href;
-                }
-                catch (e) { }
-                // Don't process blank pages or cross domain
-                if (StringUtils.isEmpty(href) || href === "about:blank") {
-                    return;
-                }
-                clearInterval(intervalId);
-                resolve();
-            }, BrowserConstants.POLL_INTERVAL_MS);
-        });
-    };
-    /**
-     * Generates the name for the popup based on the client id and request
-     * @param clientId
-     * @param request
-     */
-    PopupUtils.generatePopupName = function (clientId, scopes, authority, correlationId) {
-        return BrowserConstants.POPUP_NAME_PREFIX + "." + clientId + "." + scopes.join("-") + "." + authority + "." + correlationId;
-    };
-    /**
-     * Generates the name for the popup based on the client id and request for logouts
-     * @param clientId
-     * @param request
-     */
-    PopupUtils.generateLogoutPopupName = function (clientId, request) {
-        var homeAccountId = request.account && request.account.homeAccountId;
-        return BrowserConstants.POPUP_NAME_PREFIX + "." + clientId + "." + homeAccountId + "." + request.correlationId;
-    };
-    return PopupUtils;
-}());
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * This class implements the interaction handler base class for browsers. It is written specifically for handling
- * popup window scenarios. It includes functions for monitoring the popup window for a hash.
- */
-var PopupHandler = /** @class */ (function (_super) {
-    __extends$1(PopupHandler, _super);
-    function PopupHandler(authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) {
-        var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) || this;
-        // Properly sets this reference for the unload event.
-        _this.popupUtils = new PopupUtils(storageImpl, browserRequestLogger);
-        return _this;
-    }
-    /**
-     * Opens a popup window with given request Url.
-     * @param requestUrl
-     */
-    PopupHandler.prototype.initiateAuthRequest = function (requestUrl, params) {
-        // Check that request url is not empty.
-        if (!StringUtils.isEmpty(requestUrl)) {
-            this.browserRequestLogger.infoPii("Navigate to: " + requestUrl);
-            // Open the popup window to requestUrl.
-            return this.popupUtils.openPopup(requestUrl, params);
-        }
-        else {
-            // Throw error if request URL is empty.
-            this.browserRequestLogger.error("Navigate url is empty");
-            throw BrowserAuthError.createEmptyNavigationUriError();
-        }
-    };
-    /**
-     * Monitors a window until it loads a url with a known hash, or hits a specified timeout.
-     * @param popupWindow - window that is being monitored
-     * @param timeout - milliseconds until timeout
-     */
-    PopupHandler.prototype.monitorPopupForHash = function (popupWindow) {
-        var _this = this;
-        return this.popupUtils.monitorPopupForSameOrigin(popupWindow).then(function () {
-            var contentHash = popupWindow.location.hash;
-            BrowserUtils.clearHash(popupWindow);
-            _this.popupUtils.cleanPopup(popupWindow);
-            if (!contentHash) {
-                throw BrowserAuthError.createEmptyHashError(popupWindow.location.href);
-            }
-            if (UrlString.hashContainsKnownProperties(contentHash)) {
-                return contentHash;
-            }
-            else {
-                throw BrowserAuthError.createHashDoesNotContainKnownPropertiesError();
-            }
-        });
-    };
-    return PopupHandler;
-}(InteractionHandler));
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-var PopupClient = /** @class */ (function (_super) {
-    __extends$1(PopupClient, _super);
-    function PopupClient() {
-        return _super !== null && _super.apply(this, arguments) || this;
-    }
-    /**
-     * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
-     * @param request
-     */
-    PopupClient.prototype.acquireToken = function (request) {
-        try {
-            var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority, this.correlationId);
-            var popupWindowAttributes = request.popupWindowAttributes || {};
-            // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
-            if (this.config.system.asyncPopups) {
-                this.logger.verbose("asyncPopups set to true, acquiring token");
-                // Passes on popup position and dimensions if in request
-                return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes);
-            }
-            else {
-                // asyncPopups flag is set to false. Opens popup before acquiring token.
-                this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
-                var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
-                return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes, popup);
-            }
-        }
-        catch (e) {
-            return Promise.reject(e);
+            return Promise.reject(e);
         }
     };
     /**
@@ -11694,7 +11705,7 @@ var PopupClient = /** @class */ (function (_super) {
         try {
             this.logger.verbose("logoutPopup called");
             var validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-            var popupName = PopupUtils.generateLogoutPopupName(this.config.auth.clientId, validLogoutRequest);
+            var popupName = this.generateLogoutPopupName(validLogoutRequest);
             var authority = logoutRequest && logoutRequest.authority;
             var mainWindowRedirectUri = logoutRequest && logoutRequest.mainWindowRedirectUri;
             var popupWindowAttributes = (logoutRequest === null || logoutRequest === void 0 ? void 0 : logoutRequest.popupWindowAttributes) || {};
@@ -11707,7 +11718,7 @@ var PopupClient = /** @class */ (function (_super) {
             else {
                 // asyncPopups flag is set to false. Opens popup before logging out.
                 this.logger.verbose("asyncPopup set to false, opening popup");
-                var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
+                var popup = this.openSizedPopup("about:blank", popupName, popupWindowAttributes);
                 return this.logoutPopupAsync(validLogoutRequest, popupName, popupWindowAttributes, authority, popup, mainWindowRedirectUri);
             }
         }
@@ -11756,15 +11767,15 @@ var PopupClient = /** @class */ (function (_super) {
                         return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, validRequest), { nativeBroker: isNativeBroker }))];
                     case 5:
                         navigateUrl = _a.sent();
-                        interactionHandler = new PopupHandler(authClient, this.browserStorage, authCodeRequest, this.logger);
+                        interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger);
                         popupParameters = {
                             popup: popup,
                             popupName: popupName,
                             popupWindowAttributes: popupWindowAttributes
                         };
-                        popupWindow = interactionHandler.initiateAuthRequest(navigateUrl, popupParameters);
+                        popupWindow = this.initiateAuthRequest(navigateUrl, popupParameters);
                         this.eventHandler.emitEvent(exports.EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow: popupWindow }, null);
-                        return [4 /*yield*/, interactionHandler.monitorPopupForHash(popupWindow)];
+                        return [4 /*yield*/, this.monitorPopupForHash(popupWindow)];
                     case 6:
                         hash = _a.sent();
                         serverParams = UrlString.getDeserializedHash(hash);
@@ -11822,7 +11833,7 @@ var PopupClient = /** @class */ (function (_super) {
      */
     PopupClient.prototype.logoutPopupAsync = function (validRequest, popupName, popupWindowAttributes, requestAuthority, popup, mainWindowRedirectUri) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var serverTelemetryManager, authClient, logoutUri, popupUtils, popupWindow, e_2, navigationOptions, absoluteUrl, e_3;
+            var serverTelemetryManager, authClient, logoutUri, popupWindow, navigationOptions, absoluteUrl, e_2;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -11831,7 +11842,7 @@ var PopupClient = /** @class */ (function (_super) {
                         serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.logoutPopup);
                         _a.label = 1;
                     case 1:
-                        _a.trys.push([1, 8, , 9]);
+                        _a.trys.push([1, 5, , 6]);
                         // Clear cache on logout
                         return [4 /*yield*/, this.clearCacheOnLogout(validRequest.account)];
                     case 2:
@@ -11843,25 +11854,11 @@ var PopupClient = /** @class */ (function (_super) {
                         this.logger.verbose("Auth code client created");
                         logoutUri = authClient.getLogoutUri(validRequest);
                         this.eventHandler.emitEvent(exports.EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
-                        popupUtils = new PopupUtils(this.browserStorage, this.logger);
-                        popupWindow = popupUtils.openPopup(logoutUri, { popupName: popupName, popupWindowAttributes: popupWindowAttributes, popup: popup });
+                        popupWindow = this.openPopup(logoutUri, { popupName: popupName, popupWindowAttributes: popupWindowAttributes, popup: popup });
                         this.eventHandler.emitEvent(exports.EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow: popupWindow }, null);
-                        _a.label = 4;
+                        return [4 /*yield*/, this.waitForLogoutPopup(popupWindow)];
                     case 4:
-                        _a.trys.push([4, 6, , 7]);
-                        // Don't care if this throws an error (User Cancelled)
-                        return [4 /*yield*/, popupUtils.monitorPopupForSameOrigin(popupWindow)];
-                    case 5:
-                        // Don't care if this throws an error (User Cancelled)
                         _a.sent();
-                        this.logger.verbose("Popup successfully redirected to postLogoutRedirectUri");
-                        return [3 /*break*/, 7];
-                    case 6:
-                        e_2 = _a.sent();
-                        this.logger.verbose("Error occurred while monitoring popup for same origin. Session on server may remain active. Error: " + e_2);
-                        return [3 /*break*/, 7];
-                    case 7:
-                        popupUtils.cleanPopup(popupWindow);
                         if (mainWindowRedirectUri) {
                             navigationOptions = {
                                 apiId: exports.ApiId.logoutPopup,
@@ -11876,28 +11873,280 @@ var PopupClient = /** @class */ (function (_super) {
                         else {
                             this.logger.verbose("No main window navigation requested");
                         }
-                        return [3 /*break*/, 9];
-                    case 8:
-                        e_3 = _a.sent();
+                        return [3 /*break*/, 6];
+                    case 5:
+                        e_2 = _a.sent();
                         if (popup) {
                             // Close the synchronous popup if an error is thrown before the window unload event is registered
                             popup.close();
                         }
-                        if (e_3 instanceof AuthError) {
-                            e_3.setCorrelationId(this.correlationId);
+                        if (e_2 instanceof AuthError) {
+                            e_2.setCorrelationId(this.correlationId);
                         }
                         this.browserStorage.setInteractionInProgress(false);
-                        this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_3);
+                        this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_2);
                         this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
-                        serverTelemetryManager.cacheFailedRequest(e_3);
-                        throw e_3;
-                    case 9:
+                        serverTelemetryManager.cacheFailedRequest(e_2);
+                        throw e_2;
+                    case 6:
                         this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
                         return [2 /*return*/];
                 }
             });
         });
     };
+    /**
+     * Opens a popup window with given request Url.
+     * @param requestUrl
+     */
+    PopupClient.prototype.initiateAuthRequest = function (requestUrl, params) {
+        // Check that request url is not empty.
+        if (!StringUtils.isEmpty(requestUrl)) {
+            this.logger.infoPii("Navigate to: " + requestUrl);
+            // Open the popup window to requestUrl.
+            return this.openPopup(requestUrl, params);
+        }
+        else {
+            // Throw error if request URL is empty.
+            this.logger.error("Navigate url is empty");
+            throw BrowserAuthError.createEmptyNavigationUriError();
+        }
+    };
+    /**
+     * Monitors a window until it loads a url with the same origin.
+     * @param popupWindow - window that is being monitored
+     * @param timeout - timeout for processing hash once popup is redirected back to application
+     */
+    PopupClient.prototype.monitorPopupForHash = function (popupWindow) {
+        var _this = this;
+        return new Promise(function (resolve, reject) {
+            /*
+             * Polling for popups needs to be tick-based,
+             * since a non-trivial amount of time can be spent on interaction (which should not count against the timeout).
+             */
+            var maxTicks = _this.config.system.windowHashTimeout / BrowserConstants.POLL_INTERVAL_MS;
+            var ticks = 0;
+            _this.logger.verbose("PopupHandler.monitorPopupForHash - polling started");
+            var intervalId = setInterval(function () {
+                // Window is closed
+                if (popupWindow.closed) {
+                    _this.logger.error("PopupHandler.monitorPopupForHash - window closed");
+                    _this.cleanPopup();
+                    clearInterval(intervalId);
+                    reject(BrowserAuthError.createUserCancelledError());
+                    return;
+                }
+                var href = Constants.EMPTY_STRING;
+                var hash = Constants.EMPTY_STRING;
+                try {
+                    /*
+                     * Will throw if cross origin,
+                     * which should be caught and ignored
+                     * since we need the interval to keep running while on STS UI.
+                     */
+                    href = popupWindow.location.href;
+                    hash = popupWindow.location.hash;
+                }
+                catch (e) { }
+                // Don't process blank pages or cross domain
+                if (StringUtils.isEmpty(href) || href === "about:blank") {
+                    return;
+                }
+                _this.logger.verbose("PopupHandler.monitorPopupForHash - popup window is on same origin as caller");
+                /*
+                 * Only run clock when we are on same domain for popups
+                 * as popup operations can take a long time.
+                 */
+                ticks++;
+                if (hash) {
+                    _this.logger.verbose("PopupHandler.monitorPopupForHash - found hash in url");
+                    clearInterval(intervalId);
+                    _this.cleanPopup(popupWindow);
+                    if (UrlString.hashContainsKnownProperties(hash)) {
+                        _this.logger.verbose("PopupHandler.monitorPopupForHash - hash contains known properties, returning.");
+                        resolve(hash);
+                    }
+                    else {
+                        _this.logger.error("PopupHandler.monitorPopupForHash - found hash in url but it does not contain known properties. Check that your router is not changing the hash prematurely.");
+                        _this.logger.errorPii("PopupHandler.monitorPopupForHash - hash found: " + hash);
+                        reject(BrowserAuthError.createHashDoesNotContainKnownPropertiesError());
+                    }
+                }
+                else if (ticks > maxTicks) {
+                    _this.logger.error("PopupHandler.monitorPopupForHash - unable to find hash in url, timing out");
+                    clearInterval(intervalId);
+                    reject(BrowserAuthError.createMonitorPopupTimeoutError());
+                }
+            }, BrowserConstants.POLL_INTERVAL_MS);
+        });
+    };
+    /**
+     * Waits for user interaction in logout popup window
+     * @param popupWindow
+     * @returns
+     */
+    PopupClient.prototype.waitForLogoutPopup = function (popupWindow) {
+        var _this = this;
+        return new Promise(function (resolve) {
+            _this.logger.verbose("PopupHandler.waitForLogoutPopup - polling started");
+            var intervalId = setInterval(function () {
+                // Window is closed
+                if (popupWindow.closed) {
+                    _this.logger.error("PopupHandler.waitForLogoutPopup - window closed");
+                    _this.cleanPopup();
+                    clearInterval(intervalId);
+                    resolve();
+                }
+                var href = Constants.EMPTY_STRING;
+                try {
+                    /*
+                     * Will throw if cross origin,
+                     * which should be caught and ignored
+                     * since we need the interval to keep running while on STS UI.
+                     */
+                    href = popupWindow.location.href;
+                }
+                catch (e) { }
+                // Don't process blank pages or cross domain
+                if (StringUtils.isEmpty(href) || href === "about:blank") {
+                    return;
+                }
+                _this.logger.verbose("PopupHandler.waitForLogoutPopup - popup window is on same origin as caller, closing.");
+                clearInterval(intervalId);
+                _this.cleanPopup(popupWindow);
+                resolve();
+            }, BrowserConstants.POLL_INTERVAL_MS);
+        });
+    };
+    /**
+     * @hidden
+     *
+     * Configures popup window for login.
+     *
+     * @param urlNavigate
+     * @param title
+     * @param popUpWidth
+     * @param popUpHeight
+     * @param popupWindowAttributes
+     * @ignore
+     * @hidden
+     */
+    PopupClient.prototype.openPopup = function (urlNavigate, popupParams) {
+        try {
+            var popupWindow = void 0;
+            // Popup window passed in, setting url to navigate to
+            if (popupParams.popup) {
+                popupWindow = popupParams.popup;
+                this.logger.verbosePii("Navigating popup window to: " + urlNavigate);
+                popupWindow.location.assign(urlNavigate);
+            }
+            else if (typeof popupParams.popup === "undefined") {
+                // Popup will be undefined if it was not passed in
+                this.logger.verbosePii("Opening popup window to: " + urlNavigate);
+                popupWindow = this.openSizedPopup(urlNavigate, popupParams.popupName, popupParams.popupWindowAttributes);
+            }
+            // Popup will be null if popups are blocked
+            if (!popupWindow) {
+                throw BrowserAuthError.createEmptyWindowCreatedError();
+            }
+            if (popupWindow.focus) {
+                popupWindow.focus();
+            }
+            this.currentWindow = popupWindow;
+            window.addEventListener("beforeunload", this.unloadWindow);
+            return popupWindow;
+        }
+        catch (e) {
+            this.logger.error("error opening popup " + e.message);
+            this.browserStorage.setInteractionInProgress(false);
+            throw BrowserAuthError.createPopupWindowError(e.toString());
+        }
+    };
+    /**
+     * Helper function to set popup window dimensions and position
+     * @param urlNavigate
+     * @param popupName
+     * @param popupWindowAttributes
+     * @returns
+     */
+    PopupClient.prototype.openSizedPopup = function (urlNavigate, popupName, popupWindowAttributes) {
+        var _a, _b, _c, _d;
+        /**
+         * adding winLeft and winTop to account for dual monitor
+         * using screenLeft and screenTop for IE8 and earlier
+         */
+        var winLeft = window.screenLeft ? window.screenLeft : window.screenX;
+        var winTop = window.screenTop ? window.screenTop : window.screenY;
+        /**
+         * window.innerWidth displays browser window"s height and width excluding toolbars
+         * using document.documentElement.clientWidth for IE8 and earlier
+         */
+        var winWidth = window.innerWidth || document.documentElement.clientWidth || document.body.clientWidth;
+        var winHeight = window.innerHeight || document.documentElement.clientHeight || document.body.clientHeight;
+        var width = (_a = popupWindowAttributes.popupSize) === null || _a === void 0 ? void 0 : _a.width;
+        var height = (_b = popupWindowAttributes.popupSize) === null || _b === void 0 ? void 0 : _b.height;
+        var top = (_c = popupWindowAttributes.popupPosition) === null || _c === void 0 ? void 0 : _c.top;
+        var left = (_d = popupWindowAttributes.popupPosition) === null || _d === void 0 ? void 0 : _d.left;
+        if (!width || width < 0 || width > winWidth) {
+            this.logger.verbose("Default popup window width used. Window width not configured or invalid.");
+            width = BrowserConstants.POPUP_WIDTH;
+        }
+        if (!height || height < 0 || height > winHeight) {
+            this.logger.verbose("Default popup window height used. Window height not configured or invalid.");
+            height = BrowserConstants.POPUP_HEIGHT;
+        }
+        if (!top || top < 0 || top > winHeight) {
+            this.logger.verbose("Default popup window top position used. Window top not configured or invalid.");
+            top = Math.max(0, ((winHeight / 2) - (BrowserConstants.POPUP_HEIGHT / 2)) + winTop);
+        }
+        if (!left || left < 0 || left > winWidth) {
+            this.logger.verbose("Default popup window left position used. Window left not configured or invalid.");
+            left = Math.max(0, ((winWidth / 2) - (BrowserConstants.POPUP_WIDTH / 2)) + winLeft);
+        }
+        return window.open(urlNavigate, popupName, "width=" + width + ", height=" + height + ", top=" + top + ", left=" + left + ", scrollbars=yes");
+    };
+    /**
+     * Event callback to unload main window.
+     */
+    PopupClient.prototype.unloadWindow = function (e) {
+        this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Popup);
+        if (this.currentWindow) {
+            this.currentWindow.close();
+        }
+        // Guarantees browser unload will happen, so no other errors will be thrown.
+        e.preventDefault();
+    };
+    /**
+     * Closes popup, removes any state vars created during popup calls.
+     * @param popupWindow
+     */
+    PopupClient.prototype.cleanPopup = function (popupWindow) {
+        if (popupWindow) {
+            // Close window.
+            popupWindow.close();
+        }
+        // Remove window unload function
+        window.removeEventListener("beforeunload", this.unloadWindow);
+        // Interaction is completed - remove interaction status.
+        this.browserStorage.setInteractionInProgress(false);
+    };
+    /**
+     * Generates the name for the popup based on the client id and request
+     * @param clientId
+     * @param request
+     */
+    PopupClient.prototype.generatePopupName = function (scopes, authority) {
+        return BrowserConstants.POPUP_NAME_PREFIX + "." + this.config.auth.clientId + "." + scopes.join("-") + "." + authority + "." + this.correlationId;
+    };
+    /**
+     * Generates the name for the popup based on the client id and request for logouts
+     * @param clientId
+     * @param request
+     */
+    PopupClient.prototype.generateLogoutPopupName = function (request) {
+        var homeAccountId = request.account && request.account.homeAccountId;
+        return BrowserConstants.POPUP_NAME_PREFIX + "." + this.config.auth.clientId + "." + homeAccountId + "." + this.correlationId;
+    };
     return PopupClient;
 }(StandardInteractionClient));
 
@@ -11981,6 +12230,7 @@ function buildConfiguration(_a, isBrowserEnvironment) {
             azureCloudInstance: exports.AzureCloudInstance.None,
             tenant: Constants.EMPTY_STRING
         },
+        skipAuthorityMetadataCache: false,
     };
     // Default cache options for browser
     var DEFAULT_CACHE_OPTIONS = {
@@ -12020,8 +12270,8 @@ function buildConfiguration(_a, isBrowserEnvironment) {
  */
 var SilentHandler = /** @class */ (function (_super) {
     __extends$1(SilentHandler, _super);
-    function SilentHandler(authCodeModule, storageImpl, authCodeRequest, browserRequestLogger, navigateFrameWait) {
-        var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) || this;
+    function SilentHandler(authCodeModule, storageImpl, authCodeRequest, logger, navigateFrameWait) {
+        var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, logger) || this;
         _this.navigateFrameWait = navigateFrameWait;
         return _this;
     }
@@ -12038,7 +12288,7 @@ var SilentHandler = /** @class */ (function (_super) {
                     case 0:
                         if (StringUtils.isEmpty(requestUrl)) {
                             // Throw error if request URL is empty.
-                            this.browserRequestLogger.info("Navigate url is empty");
+                            this.logger.info("Navigate url is empty");
                             throw BrowserAuthError.createEmptyNavigationUriError();
                         }
                         if (!this.navigateFrameWait) return [3 /*break*/, 2];
@@ -12063,7 +12313,7 @@ var SilentHandler = /** @class */ (function (_super) {
         var _this = this;
         return new Promise(function (resolve, reject) {
             if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
-                _this.browserRequestLogger.warning("system.loadFrameTimeout or system.iframeHashTimeout set to lower (" + timeout + "ms) than the default (" + DEFAULT_IFRAME_TIMEOUT_MS + "ms). This may result in timeouts.");
+                _this.logger.warning("system.loadFrameTimeout or system.iframeHashTimeout set to lower (" + timeout + "ms) than the default (" + DEFAULT_IFRAME_TIMEOUT_MS + "ms). This may result in timeouts.");
             }
             /*
              * Polling for iframes can be purely timing based,
@@ -12228,6 +12478,8 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         serverTelemetryManager.cacheFailedRequest(e_1);
                         this.browserStorage.cleanRequestByState(silentRequest.state);
                         acquireTokenMeasurement.endMeasurement({
+                            errorCode: e_1 instanceof AuthError && e_1.errorCode || undefined,
+                            subErrorCode: e_1 instanceof AuthError && e_1.subError || undefined,
                             success: false
                         });
                         throw e_1;
@@ -12332,6 +12584,8 @@ var SilentCacheClient = /** @class */ (function (_super) {
                             this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
                         }
                         acquireTokenMeasurement.endMeasurement({
+                            errorCode: error_1 instanceof AuthError && error_1.errorCode || undefined,
+                            subErrorCode: error_1 instanceof AuthError && error_1.subError || undefined,
                             success: false
                         });
                         throw error_1;
@@ -12426,6 +12680,8 @@ var SilentRefreshClient = /** @class */ (function (_super) {
                                 }
                                 serverTelemetryManager.cacheFailedRequest(e);
                                 acquireTokenMeasurement.endMeasurement({
+                                    errorCode: e.errorCode,
+                                    subErrorCode: e.subError,
                                     success: false
                                 });
                                 throw e;
@@ -12600,8 +12856,7 @@ var internals = /*#__PURE__*/Object.freeze({
     EventHandler: EventHandler,
     NativeMessageHandler: NativeMessageHandler,
     BrowserConstants: BrowserConstants,
-    get TemporaryCacheKeys () { return TemporaryCacheKeys; },
-    PopupUtils: PopupUtils
+    get TemporaryCacheKeys () { return TemporaryCacheKeys; }
 });
 
 /*
@@ -13969,7 +14224,7 @@ var CryptoOps = /** @class */ (function () {
     CryptoOps.prototype.signJwt = function (payload, kid, correlationId) {
         var _a;
         return __awaiter$1(this, void 0, void 0, function () {
-            var signJwtMeasurement, cachedKeyPair, publicKeyJwk, publicKeyJwkString, header, encodedHeader, encodedPayload, tokenString, tokenBuffer, signatureBuffer, encodedSignature, signedJwt;
+            var signJwtMeasurement, cachedKeyPair, publicKeyJwk, publicKeyJwkString, encodedKeyIdThumbprint, shrHeader, encodedShrHeader, encodedPayload, tokenString, tokenBuffer, signatureBuffer, encodedSignature, signedJwt;
             return __generator$1(this, function (_b) {
                 switch (_b.label) {
                     case 0:
@@ -13984,17 +14239,15 @@ var CryptoOps = /** @class */ (function () {
                     case 2:
                         publicKeyJwk = _b.sent();
                         publicKeyJwkString = BrowserCrypto.getJwkString(publicKeyJwk);
-                        header = {
-                            alg: publicKeyJwk.alg,
-                            type: KEY_FORMAT_JWK
-                        };
-                        encodedHeader = this.b64Encode.urlEncode(JSON.stringify(header));
+                        encodedKeyIdThumbprint = this.b64Encode.urlEncode(JSON.stringify({ kid: kid }));
+                        shrHeader = JoseHeader.getShrHeaderString({ kid: encodedKeyIdThumbprint, alg: publicKeyJwk.alg });
+                        encodedShrHeader = this.b64Encode.urlEncode(shrHeader);
                         // Generate payload
                         payload.cnf = {
                             jwk: JSON.parse(publicKeyJwkString)
                         };
                         encodedPayload = this.b64Encode.urlEncode(JSON.stringify(payload));
-                        tokenString = encodedHeader + "." + encodedPayload;
+                        tokenString = encodedShrHeader + "." + encodedPayload;
                         tokenBuffer = BrowserStringUtils.stringToArrayBuffer(tokenString);
                         return [4 /*yield*/, this.browserCrypto.sign(cachedKeyPair.privateKey, tokenBuffer)];
                     case 3:
@@ -14072,6 +14325,7 @@ var TokenCache = /** @class */ (function () {
                 knownAuthorities: this.config.auth.knownAuthorities,
                 cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
                 authorityMetadata: this.config.auth.authorityMetadata,
+                skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
             };
             var authority = new Authority(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions);
             // "clientInfo" from options takes precedence over "clientInfo" in response
@@ -14105,8 +14359,8 @@ var TokenCache = /** @class */ (function () {
         var idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountId, environment, idToken, this.config.auth.clientId, tenantId);
         var idAuthToken = new AuthToken(idToken, this.cryptoObj);
         var accountEntity = options.clientInfo ?
-            AccountEntity.createAccount(options.clientInfo, homeAccountId, idAuthToken, undefined, undefined, undefined, undefined, environment) :
-            AccountEntity.createGenericAccount(homeAccountId, idAuthToken, undefined, undefined, undefined, undefined, environment);
+            AccountEntity.createAccount(options.clientInfo, homeAccountId, idAuthToken, undefined, undefined, undefined, environment) :
+            AccountEntity.createGenericAccount(homeAccountId, idAuthToken, undefined, undefined, undefined, environment);
         if (this.isBrowserEnvironment) {
             this.logger.verbose("TokenCache - loading id token");
             this.storage.setAccount(accountEntity);
@@ -14138,7 +14392,7 @@ var TokenCache = /** @class */ (function () {
             throw BrowserAuthError.createUnableToLoadTokenError("Please provide an extendedExpiresOn value in the options.");
         }
         var scopes = new ScopeSet(request.scopes).printScopes();
-        var expiresOn = response.expires_in;
+        var expiresOn = options.expiresOn || (response.expires_in + new Date().getTime() / 1000);
         var extendedExpiresOn = options.extendedExpiresOn;
         var accessTokenEntity = AccessTokenEntity.createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes, expiresOn, extendedExpiresOn, this.cryptoObj);
         if (this.isBrowserEnvironment) {
@@ -14412,7 +14666,7 @@ var ClientApplication = /** @class */ (function () {
                     case 0:
                         this.logger.trace("initialize called");
                         if (this.initialized) {
-                            this.logger.warning("initialize has already been called. This function only needs to be run once.");
+                            this.logger.info("initialize has already been called, exiting early.");
                             return [2 /*return*/];
                         }
                         this.eventHandler.emitEvent(exports.EventType.INITIALIZE_START);
@@ -14543,6 +14797,12 @@ var ClientApplication = /** @class */ (function () {
                             var redirectClient = _this.createRedirectClient(request.correlationId);
                             return redirectClient.acquireToken(request);
                         }
+                        else if (e instanceof InteractionRequiredAuthError) {
+                            _this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow");
+                            var redirectClient = _this.createRedirectClient(request.correlationId);
+                            return redirectClient.acquireToken(request);
+                        }
+                        _this.browserStorage.setInteractionInProgress(false);
                         throw e;
                     });
                 }
@@ -14608,6 +14868,12 @@ var ClientApplication = /** @class */ (function () {
                     var popupClient = _this.createPopupClient(request.correlationId);
                     return popupClient.acquireToken(request);
                 }
+                else if (e instanceof InteractionRequiredAuthError) {
+                    _this.logger.verbose("acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow");
+                    var popupClient = _this.createPopupClient(request.correlationId);
+                    return popupClient.acquireToken(request);
+                }
+                _this.browserStorage.setInteractionInProgress(false);
                 throw e;
             });
         }
@@ -14637,6 +14903,8 @@ var ClientApplication = /** @class */ (function () {
                 _this.eventHandler.emitEvent(exports.EventType.LOGIN_FAILURE, exports.InteractionType.Popup, null, e);
             }
             atPopupMeasurement.endMeasurement({
+                errorCode: e.errorCode,
+                subErrorCode: e.subError,
                 success: false
             });
             atPopupMeasurement.flushMeasurement();
@@ -14690,13 +14958,16 @@ var ClientApplication = /** @class */ (function () {
                 return [2 /*return*/, result.then(function (response) {
                         _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, response);
                         ssoSilentMeasurement.endMeasurement({
-                            success: true
+                            success: true,
+                            isNativeBroker: response.fromNativeBroker
                         });
                         ssoSilentMeasurement.flushMeasurement();
                         return response;
                     }).catch(function (e) {
                         _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e);
                         ssoSilentMeasurement.endMeasurement({
+                            errorCode: e.errorCode,
+                            subErrorCode: e.subError,
                             success: false
                         });
                         ssoSilentMeasurement.flushMeasurement();
@@ -14736,7 +15007,8 @@ var ClientApplication = /** @class */ (function () {
                                 _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
                                 _this.hybridAuthCodeResponses.delete(hybridAuthCode_1);
                                 atbcMeasurement.endMeasurement({
-                                    success: true
+                                    success: true,
+                                    isNativeBroker: result.fromNativeBroker
                                 });
                                 atbcMeasurement.flushMeasurement();
                                 return result;
@@ -14745,6 +15017,8 @@ var ClientApplication = /** @class */ (function () {
                                 _this.hybridAuthCodeResponses.delete(hybridAuthCode_1);
                                 _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, error);
                                 atbcMeasurement.endMeasurement({
+                                    errorCode: error.errorCode,
+                                    subErrorCode: error.subError,
                                     success: false
                                 });
                                 atbcMeasurement.flushMeasurement();
@@ -14782,6 +15056,8 @@ var ClientApplication = /** @class */ (function () {
                 catch (e) {
                     this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
                     atbcMeasurement.endMeasurement({
+                        errorCode: e instanceof AuthError && e.errorCode || undefined,
+                        subErrorCode: e instanceof AuthError && e.subError || undefined,
                         success: false
                     });
                     throw e;
@@ -14857,6 +15133,8 @@ var ClientApplication = /** @class */ (function () {
                             })
                                 .catch(function (error) {
                                 atbrtMeasurement.endMeasurement({
+                                    errorCode: error.errorCode,
+                                    subErrorCode: error.subError,
                                     success: false
                                 });
                                 throw error;
@@ -15006,9 +15284,13 @@ var ClientApplication = /** @class */ (function () {
     // #region Helpers
     /**
      * Helper to validate app environment before making an auth request
-     * * @param interactionType
+     *
+     * @protected
+     * @param {InteractionType} interactionType What kind of interaction is being used
+     * @param {boolean} [setInteractionInProgress=true] Whether to set interaction in progress temp cache flag
      */
-    ClientApplication.prototype.preflightBrowserEnvironmentCheck = function (interactionType) {
+    ClientApplication.prototype.preflightBrowserEnvironmentCheck = function (interactionType, setInteractionInProgress) {
+        if (setInteractionInProgress === void 0) { setInteractionInProgress = true; }
         this.logger.verbose("preflightBrowserEnvironmentCheck started");
         // Block request if not in browser environment
         BrowserUtils.blockNonBrowserEnvironment(this.isBrowserEnvironment);
@@ -15027,20 +15309,23 @@ var ClientApplication = /** @class */ (function () {
             throw BrowserConfigurationAuthError.createInMemoryRedirectUnavailableError();
         }
         if (interactionType === exports.InteractionType.Redirect || interactionType === exports.InteractionType.Popup) {
-            this.preflightInteractiveRequest();
+            this.preflightInteractiveRequest(setInteractionInProgress);
         }
     };
     /**
-     * Helper to validate app environment before making a request.
-     * @param request
-     * @param interactionType
+     * Preflight check for interactive requests
+     *
+     * @protected
+     * @param {boolean} setInteractionInProgress Whether to set interaction in progress temp cache flag
      */
-    ClientApplication.prototype.preflightInteractiveRequest = function () {
+    ClientApplication.prototype.preflightInteractiveRequest = function (setInteractionInProgress) {
         this.logger.verbose("preflightInteractiveRequest called, validating app environment");
         // block the reload if it occurred inside a hidden iframe
         BrowserUtils.blockReloadInHiddenIframes();
         // Set interaction in progress temporary cache or throw if alread set.
-        this.browserStorage.setInteractionInProgress(true);
+        if (setInteractionInProgress) {
+            this.browserStorage.setInteractionInProgress(true);
+        }
     };
     /**
      * Acquire a token from native device (e.g. WAM)
@@ -15073,6 +15358,7 @@ var ClientApplication = /** @class */ (function () {
             switch (request.prompt) {
                 case PromptValue.NONE:
                 case PromptValue.CONSENT:
+                case PromptValue.LOGIN:
                     this.logger.trace("canUseNative: prompt is compatible with native flow");
                     break;
                 default:
@@ -15103,7 +15389,7 @@ var ClientApplication = /** @class */ (function () {
         return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
     };
     /**
-     * Returns new instance of the Popup Interaction Client
+     * Returns new instance of the Redirect Interaction Client
      * @param correlationId
      */
     ClientApplication.prototype.createRedirectClient = function (correlationId) {
@@ -15349,7 +15635,8 @@ var PublicClientApplication = /** @class */ (function (_super) {
                         _this.activeSilentTokenRequests.delete(silentRequestKey);
                         atsMeasurement.endMeasurement({
                             success: true,
-                            fromCache: result.fromCache
+                            fromCache: result.fromCache,
+                            isNativeBroker: result.fromNativeBroker
                         });
                         atsMeasurement.flushMeasurement();
                         return result;
@@ -15357,6 +15644,8 @@ var PublicClientApplication = /** @class */ (function (_super) {
                         .catch(function (error) {
                         _this.activeSilentTokenRequests.delete(silentRequestKey);
                         atsMeasurement.endMeasurement({
+                            errorCode: error.errorCode,
+                            subErrorCode: error.subError,
                             success: false
                         });
                         atsMeasurement.flushMeasurement();
@@ -15425,12 +15714,15 @@ var PublicClientApplication = /** @class */ (function (_super) {
                             _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
                             astsAsyncMeasurement.endMeasurement({
                                 success: true,
-                                fromCache: response.fromCache
+                                fromCache: response.fromCache,
+                                isNativeBroker: response.fromNativeBroker
                             });
                             return response;
                         }).catch(function (tokenRenewalError) {
                             _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError);
                             astsAsyncMeasurement.endMeasurement({
+                                errorCode: tokenRenewalError.errorCode,
+                                subErrorCode: tokenRenewalError.subError,
                                 success: false
                             });
                             throw tokenRenewalError;