@azure/msal-browser 2.25.0 → 2.28.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.25.0 2022-06-06 */
+/*! @azure/msal-browser v2.28.0 2022-07-18 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -107,7 +107,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -194,7 +194,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -244,7 +244,8 @@
         REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
         KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
         TOKEN_RESPONSE_TYPE: "token",
-        ID_TOKEN_RESPONSE_TYPE: "id_token"
+        ID_TOKEN_RESPONSE_TYPE: "id_token",
+        SHR_NONCE_VALIDITY: 240,
     };
     var OIDC_DEFAULT_SCOPES = [
         Constants.OPENID_SCOPE,
@@ -276,6 +277,7 @@
         PersistentCacheKeys["ERROR"] = "error";
         PersistentCacheKeys["ERROR_DESC"] = "error.description";
         PersistentCacheKeys["ACTIVE_ACCOUNT"] = "active-account";
+        PersistentCacheKeys["ACTIVE_ACCOUNT_FILTERS"] = "active-account-filters"; // new cache entry for active_account for a more robust version for browser
     })(PersistentCacheKeys || (PersistentCacheKeys = {}));
     /**
      * String constants related to AAD Authority
@@ -478,6 +480,7 @@
         AuthorityMetadataSource["CONFIG"] = "config";
         AuthorityMetadataSource["CACHE"] = "cache";
         AuthorityMetadataSource["NETWORK"] = "network";
+        AuthorityMetadataSource["HARDCODED_VALUES"] = "hardcoded_values";
     })(AuthorityMetadataSource || (AuthorityMetadataSource = {}));
     var SERVER_TELEM_CONSTANTS = {
         SCHEMA_VERSION: 5,
@@ -568,7 +571,7 @@
         JsonTypes["Jwk"] = "JWK";
     })(JsonTypes || (JsonTypes = {}));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -612,7 +615,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -687,7 +690,7 @@
         }
     };
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1159,7 +1162,7 @@
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1284,7 +1287,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1464,12 +1467,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "6.4.0";
+    var version$1 = "7.2.0";
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1490,7 +1493,7 @@
         AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
     })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1513,9 +1516,9 @@
      *      familyId: Family ID identifier, usually only used for refresh tokens
      *      realm: Full tenant or organizational identifier that the account belongs to
      *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
-     *      oboAssertion: access token passed in as part of OBO request
      *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
      *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
+     *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
      * }
      */
     var CredentialEntity = /** @class */ (function () {
@@ -1649,7 +1652,7 @@
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1904,7 +1907,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2088,7 +2091,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2126,7 +2129,7 @@
         };
     }
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2140,7 +2143,7 @@
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2165,7 +2168,6 @@
      *      clientInfo: Full base64 encoded client info received from ESTS
      *      lastModificationTime: last time this entity was modified in the cache
      *      lastModificationApp:
-     *      oboAssertion: access token passed in as part of OBO request
      *      idTokenClaims: Object containing claims parsed from ID token
      *      nativeAccountId: Account identifier on the native device
      * }
@@ -2244,7 +2246,7 @@
          * @param idToken
          * @param policy
          */
-        AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
+        AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
             var _a, _b, _c, _d, _e, _f;
             var account = new AccountEntity();
             account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
@@ -2258,7 +2260,6 @@
             account.environment = env;
             // non AAD scenarios can have empty realm
             account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || Constants.EMPTY_STRING;
-            account.oboAssertion = oboAssertion;
             if (idToken) {
                 account.idTokenClaims = idToken.claims;
                 // How do you account for MSA CID here?
@@ -2279,14 +2280,13 @@
          * @param authority
          * @param idToken
          */
-        AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+        AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
             var _a, _b, _c, _d;
             var account = new AccountEntity();
             account.authorityType = (authority && authority.authorityType === AuthorityType.Adfs) ? CacheAccountType.ADFS_ACCOUNT_TYPE : CacheAccountType.GENERIC_ACCOUNT_TYPE;
             account.homeAccountId = homeAccountId;
             // non AAD scenarios can have empty realm
             account.realm = Constants.EMPTY_STRING;
-            account.oboAssertion = oboAssertion;
             var env = environment || authority && authority.getPreferredCache();
             if (!env) {
                 throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -2378,7 +2378,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2416,7 +2416,7 @@
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2538,7 +2538,7 @@
          * @param realm
          */
         CacheManager.prototype.getAccountsFilteredBy = function (accountFilter) {
-            return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING);
+            return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING, accountFilter ? accountFilter.nativeAccountId : Constants.EMPTY_STRING);
         };
         /**
          * retrieve accounts matching all provided filters; if no filter is set, get all accounts
@@ -2547,7 +2547,7 @@
          * @param environment
          * @param realm
          */
-        CacheManager.prototype.getAccountsFilteredByInternal = function (homeAccountId, environment, realm) {
+        CacheManager.prototype.getAccountsFilteredByInternal = function (homeAccountId, environment, realm, nativeAccountId) {
             var _this = this;
             var allCacheKeys = this.getKeys();
             var matchingAccounts = {};
@@ -2565,6 +2565,9 @@
                 if (!!realm && !_this.matchRealm(entity, realm)) {
                     return;
                 }
+                if (!!nativeAccountId && !_this.matchNativeAccountId(entity, nativeAccountId)) {
+                    return;
+                }
                 matchingAccounts[cacheKey] = entity;
             });
             return matchingAccounts;
@@ -2579,7 +2582,7 @@
          * @param target
          */
         CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-            return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
+            return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.userAssertionHash, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
         };
         /**
          * Support function to help match credentials
@@ -2589,10 +2592,10 @@
          * @param clientId
          * @param realm
          * @param target
-         * @param oboAssertion
+         * @param userAssertionHash
          * @param tokenType
          */
-        CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
+        CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, userAssertionHash, tokenType, keyId, requestedClaimsHash) {
             var _this = this;
             var allCacheKeys = this.getKeys();
             var matchingCredentials = {
@@ -2611,7 +2614,7 @@
                 if (!entity) {
                     return;
                 }
-                if (!!oboAssertion && !_this.matchOboAssertion(entity, oboAssertion)) {
+                if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
                     return;
                 }
                 if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
@@ -2893,6 +2896,26 @@
             var accountKey = AccountEntity.generateAccountCacheKey(account);
             return this.getAccount(accountKey);
         };
+        /**
+         * Retrieve AccountEntity from cache
+         * @param nativeAccountId
+         * @returns AccountEntity or Null
+         */
+        CacheManager.prototype.readAccountFromCacheWithNativeAccountId = function (nativeAccountId) {
+            // fetch account from memory
+            var accountFilter = {
+                nativeAccountId: nativeAccountId
+            };
+            var accountCache = this.getAccountsFilteredBy(accountFilter);
+            var accounts = Object.keys(accountCache).map(function (key) { return accountCache[key]; });
+            if (accounts.length < 1) {
+                return null;
+            }
+            else if (accounts.length > 1) {
+                throw ClientAuthError.createMultipleMatchingAccountsInCacheError();
+            }
+            return accountCache[0];
+        };
         /**
          * Retrieve IdTokenEntity from cache
          * @param clientId
@@ -2942,7 +2965,7 @@
                 target: scopes.printScopesLowerCase(),
                 tokenType: authScheme,
                 keyId: request.sshKid,
-                requestedClaimsHash: request.requestedClaimsHash
+                requestedClaimsHash: request.requestedClaimsHash,
             };
             var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
             var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -2968,7 +2991,7 @@
                 environment: account.environment,
                 credentialType: CredentialType.REFRESH_TOKEN,
                 clientId: clientId,
-                familyId: id
+                familyId: id,
             };
             var credentialCache = this.getCredentialsFilteredBy(refreshTokenFilter);
             var refreshTokens = Object.keys(credentialCache.refreshTokens).map(function (key) { return credentialCache.refreshTokens[key]; });
@@ -3020,8 +3043,8 @@
          * @param value
          * @param oboAssertion
          */
-        CacheManager.prototype.matchOboAssertion = function (entity, oboAssertion) {
-            return !!(entity.oboAssertion && oboAssertion === entity.oboAssertion);
+        CacheManager.prototype.matchUserAssertionHash = function (entity, userAssertionHash) {
+            return !!(entity.userAssertionHash && userAssertionHash === entity.userAssertionHash);
         };
         /**
          * helper to match environment
@@ -3067,6 +3090,15 @@
         CacheManager.prototype.matchRealm = function (entity, realm) {
             return !!(entity.realm && realm === entity.realm);
         };
+        /**
+         * helper to match nativeAccountId
+         * @param entity
+         * @param nativeAccountId
+         * @returns boolean indicating the match result
+         */
+        CacheManager.prototype.matchNativeAccountId = function (entity, nativeAccountId) {
+            return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
+        };
         /**
          * Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.
          * @param entity
@@ -3258,7 +3290,7 @@
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3341,7 +3373,7 @@
             telemetry: __assign(__assign({}, DEFAULT_TELEMETRY_OPTIONS), telemetry),
             serverTelemetryManager: serverTelemetryManager || null,
             persistencePlugin: persistencePlugin || null,
-            serializableCache: serializableCache || null
+            serializableCache: serializableCache || null,
         };
     }
     /**
@@ -3349,10 +3381,10 @@
      * @param authOptions
      */
     function buildAuthOptions(authOptions) {
-        return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS }, authOptions);
+        return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS, skipAuthorityMetadataCache: false }, authOptions);
     }
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3372,7 +3404,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3468,7 +3500,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3517,7 +3549,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3528,7 +3560,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3617,7 +3649,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3703,7 +3735,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3937,14 +3969,18 @@
          * @param clientAssertion
          */
         RequestParameterBuilder.prototype.addClientAssertion = function (clientAssertion) {
-            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+            if (!StringUtils.isEmpty(clientAssertion)) {
+                this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+            }
         };
         /**
          * add clientAssertionType for confidential client flows
          * @param clientAssertionType
          */
         RequestParameterBuilder.prototype.addClientAssertionType = function (clientAssertionType) {
-            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+            if (!StringUtils.isEmpty(clientAssertionType)) {
+                this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+            }
         };
         /**
          * add OBO assertion for confidential client flows
@@ -4077,7 +4113,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4112,7 +4148,7 @@
          * @param clientId
          * @param authority
          */
-        IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId, oboAssertion) {
+        IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId) {
             var idTokenEntity = new IdTokenEntity();
             idTokenEntity.credentialType = CredentialType.ID_TOKEN;
             idTokenEntity.homeAccountId = homeAccountId;
@@ -4120,7 +4156,6 @@
             idTokenEntity.clientId = clientId;
             idTokenEntity.secret = idToken;
             idTokenEntity.realm = tenantId;
-            idTokenEntity.oboAssertion = oboAssertion;
             return idTokenEntity;
         };
         /**
@@ -4142,7 +4177,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4192,7 +4227,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4238,7 +4273,7 @@
          * @param expiresOn
          * @param extExpiresOn
          */
-        AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+        AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, userAssertionHash, keyId, requestedClaims, requestedClaimsHash) {
             var _a, _b;
             var atEntity = new AccessTokenEntity();
             atEntity.homeAccountId = homeAccountId;
@@ -4259,7 +4294,7 @@
             atEntity.clientId = clientId;
             atEntity.realm = tenantId;
             atEntity.target = scopes;
-            atEntity.oboAssertion = oboAssertion;
+            atEntity.userAssertionHash = userAssertionHash;
             atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
             if (requestedClaims) {
                 atEntity.requestedClaims = requestedClaims;
@@ -4306,7 +4341,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4343,14 +4378,14 @@
          * @param clientId
          * @param authority
          */
-        RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, oboAssertion) {
+        RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash) {
             var rtEntity = new RefreshTokenEntity();
             rtEntity.clientId = clientId;
             rtEntity.credentialType = CredentialType.REFRESH_TOKEN;
             rtEntity.environment = environment;
             rtEntity.homeAccountId = homeAccountId;
             rtEntity.secret = refreshToken;
-            rtEntity.oboAssertion = oboAssertion;
+            rtEntity.userAssertionHash = userAssertionHash;
             if (familyId)
                 rtEntity.familyId = familyId;
             return rtEntity;
@@ -4373,7 +4408,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4401,6 +4436,10 @@
         noTokensFoundError: {
             code: "no_tokens_found",
             desc: "No refresh token found in the cache. Please sign-in."
+        },
+        native_account_unavailable: {
+            code: "native_account_unavailable",
+            desc: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API."
         }
     };
     /**
@@ -4434,10 +4473,17 @@
         InteractionRequiredAuthError.createNoTokensFoundError = function () {
             return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.noTokensFoundError.code, InteractionRequiredAuthErrorMessage.noTokensFoundError.desc);
         };
+        /**
+         * Creates an error thrown when the native broker returns ACCOUNT_UNAVAILABLE status, indicating that the account was removed and interactive sign-in is required
+         * @returns
+         */
+        InteractionRequiredAuthError.createNativeAccountUnavailableError = function () {
+            return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.native_account_unavailable.code, InteractionRequiredAuthErrorMessage.native_account_unavailable.desc);
+        };
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4453,7 +4499,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4524,7 +4570,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4725,7 +4771,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4826,7 +4872,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4896,7 +4942,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4932,7 +4978,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4993,7 +5039,7 @@
          * @param serverTokenResponse
          * @param authority
          */
-        ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, oboAssertion, handlingRefreshTokenResponse) {
+        ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse) {
             return __awaiter(this, void 0, void 0, function () {
                 var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
                 return __generator(this, function (_a) {
@@ -5015,7 +5061,7 @@
                             }
                             // Add keyId from request to serverTokenResponse if defined
                             serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                            cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
+                            cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload);
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, , 5, 8]);
@@ -5030,14 +5076,15 @@
                             /*
                              * When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.
                              * If not present, we should return null, as it's the case that another application called removeAccount in between
-                             * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal.
+                             * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal, unless explicitly flagged by
+                             * the developer, as in the case of refresh token flow used in ADAL Node to MSAL Node migration.
                              */
-                            if (handlingRefreshTokenResponse && cacheRecord.account) {
+                            if (handlingRefreshTokenResponse && !forceCacheRefreshTokenResponse && cacheRecord.account) {
                                 key = cacheRecord.account.generateAccountKey();
                                 account = this.cacheStorage.getAccount(key);
                                 if (!account) {
                                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                                    return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                                    return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined)];
                                 }
                             }
                             return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
@@ -5063,7 +5110,7 @@
          * @param idTokenObj
          * @param authority
          */
-        ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
+        ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload) {
             var env = authority.getPreferredCache();
             if (StringUtils.isEmpty(env)) {
                 throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -5072,8 +5119,8 @@
             var cachedIdToken;
             var cachedAccount;
             if (!StringUtils.isEmpty(serverTokenResponse.id_token) && !!idTokenObj) {
-                cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING, oboAssertion);
-                cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, oboAssertion, authCodePayload);
+                cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+                cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
             }
             // AccessToken
             var cachedAccessToken = null;
@@ -5091,12 +5138,12 @@
                 var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
                 var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
                 // non AAD scenarios can have empty realm
-                cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
+                cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
             }
             // refreshToken
             var cachedRefreshToken = null;
             if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {
-                cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, oboAssertion);
+                cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, userAssertionHash);
             }
             // appMetadata
             var cachedAppMetadata = null;
@@ -5111,22 +5158,22 @@
          * @param idToken
          * @param authority
          */
-        ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, oboAssertion, authCodePayload) {
+        ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, authCodePayload) {
             var authorityType = authority.authorityType;
             var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : Constants.EMPTY_STRING;
             var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : Constants.EMPTY_STRING;
             // ADFS does not require client_info in the response
             if (authorityType === AuthorityType.Adfs) {
                 this.logger.verbose("Authority type is ADFS, creating ADFS account");
-                return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+                return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
             }
             // This fallback applies to B2C as well as they fall under an AAD account type.
             if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === "AAD") {
                 throw ClientAuthError.createClientInfoEmptyError();
             }
             return serverTokenResponse.client_info ?
-                AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost) :
-                AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+                AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost) :
+                AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
         };
         /**
          * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -5202,7 +5249,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5303,7 +5350,7 @@
                 throw ClientConfigurationError.createEmptyLogoutRequestError();
             }
             var queryString = this.createLogoutUrlQueryString(logoutRequest);
-            // Construct logout URI.
+            // Construct logout URI
             return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);
         };
         /**
@@ -5406,8 +5453,8 @@
                             if (this.config.clientCredentials.clientSecret) {
                                 parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                             }
-                            clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-                            if (clientAssertion) {
+                            if (this.config.clientCredentials.clientAssertion) {
+                                clientAssertion = this.config.clientCredentials.clientAssertion;
                                 parameterBuilder.addClientAssertion(clientAssertion.assertion);
                                 parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                             }
@@ -5637,7 +5684,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5663,7 +5710,7 @@
                             response = _a.sent();
                             responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                             responseHandler.validateTokenResponse(response.body);
-                            return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true)];
+                            return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache)];
                     }
                 });
             });
@@ -5799,8 +5846,8 @@
                             if (this.config.clientCredentials.clientSecret) {
                                 parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                             }
-                            clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-                            if (clientAssertion) {
+                            if (this.config.clientCredentials.clientAssertion) {
+                                clientAssertion = this.config.clientCredentials.clientAssertion;
                                 parameterBuilder.addClientAssertion(clientAssertion.assertion);
                                 parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                             }
@@ -5850,7 +5897,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5966,7 +6013,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5974,10 +6021,20 @@
     function isOpenIdConfigResponse(response) {
         return (response.hasOwnProperty("authorization_endpoint") &&
             response.hasOwnProperty("token_endpoint") &&
-            response.hasOwnProperty("issuer"));
+            response.hasOwnProperty("issuer") &&
+            response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var rawMetdataJSON = { "endpointMetadata": { "https://login.microsoftonline.com/common/": { "token_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.com/common/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.com/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.com/common/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.com", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pas.windows.net" }, "https://login.chinacloudapi.cn/common/": { "token_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.chinacloudapi.cn/common/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.partner.microsoftonline.cn/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://microsoftgraph.chinacloudapi.cn/oidc/userinfo", "authorization_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.chinacloudapi.cn/common/kerberos", "tenant_region_scope": null, "cloud_instance_name": "partner.microsoftonline.cn", "cloud_graph_host_name": "graph.chinacloudapi.cn", "msgraph_host": "microsoftgraph.chinacloudapi.cn", "rbac_url": "https://pas.chinacloudapi.cn" }, "https://login.microsoftonline.us/common/": { "token_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.us/common/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.us/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.us/common/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.us", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pasff.usgovcloudapi.net" }, "https://login.microsoftonline.com/consumers/": { "token_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.com/consumers/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.com/consumers/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.com", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pas.windows.net" }, "https://login.chinacloudapi.cn/consumers/": { "token_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.chinacloudapi.cn/consumers/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.partner.microsoftonline.cn/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://microsoftgraph.chinacloudapi.cn/oidc/userinfo", "authorization_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.chinacloudapi.cn/consumers/kerberos", "tenant_region_scope": null, "cloud_instance_name": "partner.microsoftonline.cn", "cloud_graph_host_name": "graph.chinacloudapi.cn", "msgraph_host": "microsoftgraph.chinacloudapi.cn", "rbac_url": "https://pas.chinacloudapi.cn" }, "https://login.microsoftonline.us/consumers/": { "token_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.us/consumers/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.us/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.us/consumers/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.us", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pasff.usgovcloudapi.net" }, "https://login.microsoftonline.com/organizations/": { "token_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.com/organizations/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.com/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.com/organizations/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.com", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pas.windows.net" }, "https://login.chinacloudapi.cn/organizations/": { "token_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.chinacloudapi.cn/organizations/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.partner.microsoftonline.cn/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://microsoftgraph.chinacloudapi.cn/oidc/userinfo", "authorization_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.chinacloudapi.cn/organizations/kerberos", "tenant_region_scope": null, "cloud_instance_name": "partner.microsoftonline.cn", "cloud_graph_host_name": "graph.chinacloudapi.cn", "msgraph_host": "microsoftgraph.chinacloudapi.cn", "rbac_url": "https://pas.chinacloudapi.cn" }, "https://login.microsoftonline.us/organizations/": { "token_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.us/organizations/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.us/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.us/organizations/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.us", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pasff.usgovcloudapi.net" } }, "instanceDiscoveryMetadata": { "https://login.microsoftonline.com/common/": { "tenant_discovery_endpoint": "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.chinacloudapi.cn/common/": { "tenant_discovery_endpoint": "https://login.chinacloudapi.cn/common/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.us/common/": { "tenant_discovery_endpoint": "https://login.microsoftonline.us/common/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.com/consumers/": { "tenant_discovery_endpoint": "https://login.microsoftonline.com/consumers/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.chinacloudapi.cn/consumers/": { "tenant_discovery_endpoint": "https://login.chinacloudapi.cn/consumers/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.us/consumers/": { "tenant_discovery_endpoint": "https://login.microsoftonline.us/consumers/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.com/organizations/": { "tenant_discovery_endpoint": "https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.chinacloudapi.cn/organizations/": { "tenant_discovery_endpoint": "https://login.chinacloudapi.cn/organizations/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.us/organizations/": { "tenant_discovery_endpoint": "https://login.microsoftonline.us/organizations/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] } } };
+    var EndpointMetadata = rawMetdataJSON.endpointMetadata;
+    var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
+
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5991,7 +6048,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6023,6 +6080,7 @@
             this.end_session_endpoint = metadata.end_session_endpoint;
             this.issuer = metadata.issuer;
             this.endpointsFromNetwork = fromNetwork;
+            this.jwks_uri = metadata.jwks_uri;
         };
         /**
          * Save the authority that was used to create this cache entry
@@ -6061,12 +6119,13 @@
                 entity.hasOwnProperty("issuer") &&
                 entity.hasOwnProperty("aliasesFromNetwork") &&
                 entity.hasOwnProperty("endpointsFromNetwork") &&
-                entity.hasOwnProperty("expiresAt"));
+                entity.hasOwnProperty("expiresAt") &&
+                entity.hasOwnProperty("jwks_uri"));
         };
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6076,7 +6135,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6198,7 +6257,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6383,6 +6442,22 @@
             enumerable: false,
             configurable: true
         });
+        Object.defineProperty(Authority.prototype, "jwksUri", {
+            /**
+             * Jwks_uri for token signing keys
+             */
+            get: function () {
+                if (this.discoveryComplete()) {
+                    var endpoint = this.replacePath(this.metadata.jwks_uri);
+                    return this.replaceTenant(endpoint);
+                }
+                else {
+                    throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+                }
+            },
+            enumerable: false,
+            configurable: true
+        });
         /**
          * Replaces tenant in url path with current tenant. Defaults to common.
          * @param urlString
@@ -6466,11 +6541,11 @@
          * @param metadataEntity
          */
         Authority.prototype.updateEndpointMetadata = function (metadataEntity) {
-            var _a;
+            var _a, _b;
             return __awaiter(this, void 0, void 0, function () {
-                var metadata, autodetectedRegionName, azureRegion;
-                return __generator(this, function (_b) {
-                    switch (_b.label) {
+                var metadata, harcodedMetadata;
+                return __generator(this, function (_c) {
+                    switch (_c.label) {
                         case 0:
                             metadata = this.getEndpointMetadataFromConfig();
                             if (metadata) {
@@ -6481,41 +6556,30 @@
                                 // No need to update
                                 return [2 /*return*/, AuthorityMetadataSource.CACHE];
                             }
+                            harcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
                             return [4 /*yield*/, this.getEndpointMetadataFromNetwork()];
                         case 1:
-                            metadata = _b.sent();
+                            metadata = _c.sent();
                             if (!metadata) return [3 /*break*/, 4];
                             if (!((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.azureRegion)) return [3 /*break*/, 3];
-                            return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata, this.proxyUrl)];
+                            return [4 /*yield*/, this.updateMetadataWithRegionalInformation(metadata)];
                         case 2:
-                            autodetectedRegionName = _b.sent();
-                            azureRegion = this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
-                                ? autodetectedRegionName
-                                : this.authorityOptions.azureRegionConfiguration.azureRegion;
-                            if (this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
-                                this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName ?
-                                    RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL :
-                                    RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
-                            }
-                            else {
-                                if (autodetectedRegionName) {
-                                    this.regionDiscoveryMetadata.region_outcome = (this.authorityOptions.azureRegionConfiguration.azureRegion === autodetectedRegionName) ?
-                                        RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED :
-                                        RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;
-                                }
-                                else {
-                                    this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
-                                }
-                            }
-                            if (azureRegion) {
-                                this.regionDiscoveryMetadata.region_used = azureRegion;
-                                metadata = Authority.replaceWithRegionalInformation(metadata, azureRegion);
-                            }
-                            _b.label = 3;
+                            metadata = _c.sent();
+                            _c.label = 3;
                         case 3:
                             metadataEntity.updateEndpointMetadata(metadata, true);
                             return [2 /*return*/, AuthorityMetadataSource.NETWORK];
-                        case 4: throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
+                        case 4:
+                            if (!(harcodedMetadata && !this.authorityOptions.skipAuthorityMetadataCache)) return [3 /*break*/, 7];
+                            if (!((_b = this.authorityOptions.azureRegionConfiguration) === null || _b === void 0 ? void 0 : _b.azureRegion)) return [3 /*break*/, 6];
+                            return [4 /*yield*/, this.updateMetadataWithRegionalInformation(harcodedMetadata)];
+                        case 5:
+                            harcodedMetadata = _c.sent();
+                            _c.label = 6;
+                        case 6:
+                            metadataEntity.updateEndpointMetadata(harcodedMetadata, false);
+                            return [2 /*return*/, AuthorityMetadataSource.HARDCODED_VALUES];
+                        case 7: throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
                     }
                 });
             });
@@ -6546,6 +6610,8 @@
         };
         /**
          * Gets OAuth endpoints from the given OpenID configuration endpoint.
+         *
+         * @param hasHardcodedMetadata boolean
          */
         Authority.prototype.getEndpointMetadataFromNetwork = function () {
             return __awaiter(this, void 0, void 0, function () {
@@ -6572,6 +6638,54 @@
                 });
             });
         };
+        /**
+         * Get OAuth endpoints for common authorities.
+         */
+        Authority.prototype.getEndpointMetadataFromHardcodedValues = function () {
+            if (this.canonicalAuthority in EndpointMetadata) {
+                return EndpointMetadata[this.canonicalAuthority];
+            }
+            return null;
+        };
+        /**
+         * Update the retrieved metadata with regional information.
+         */
+        Authority.prototype.updateMetadataWithRegionalInformation = function (metadata) {
+            var _a, _b, _c, _d, _e;
+            return __awaiter(this, void 0, void 0, function () {
+                var autodetectedRegionName, azureRegion;
+                return __generator(this, function (_f) {
+                    switch (_f.label) {
+                        case 0: return [4 /*yield*/, this.regionDiscovery.detectRegion((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.environmentRegion, this.regionDiscoveryMetadata, this.proxyUrl)];
+                        case 1:
+                            autodetectedRegionName = _f.sent();
+                            azureRegion = ((_b = this.authorityOptions.azureRegionConfiguration) === null || _b === void 0 ? void 0 : _b.azureRegion) === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
+                                ? autodetectedRegionName
+                                : (_c = this.authorityOptions.azureRegionConfiguration) === null || _c === void 0 ? void 0 : _c.azureRegion;
+                            if (((_d = this.authorityOptions.azureRegionConfiguration) === null || _d === void 0 ? void 0 : _d.azureRegion) === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
+                                this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName ?
+                                    RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL :
+                                    RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
+                            }
+                            else {
+                                if (autodetectedRegionName) {
+                                    this.regionDiscoveryMetadata.region_outcome = (((_e = this.authorityOptions.azureRegionConfiguration) === null || _e === void 0 ? void 0 : _e.azureRegion) === autodetectedRegionName) ?
+                                        RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED :
+                                        RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;
+                                }
+                                else {
+                                    this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                                }
+                            }
+                            if (azureRegion) {
+                                this.regionDiscoveryMetadata.region_used = azureRegion;
+                                return [2 /*return*/, Authority.replaceWithRegionalInformation(metadata, azureRegion)];
+                            }
+                            return [2 /*return*/, metadata];
+                    }
+                });
+            });
+        };
         /**
          * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from
          * @param cachedMetadata
@@ -6579,7 +6693,7 @@
          */
         Authority.prototype.updateCloudDiscoveryMetadata = function (metadataEntity) {
             return __awaiter(this, void 0, void 0, function () {
-                var metadata;
+                var metadata, harcodedMetadata;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -6593,6 +6707,7 @@
                                 // No need to update
                                 return [2 /*return*/, AuthorityMetadataSource.CACHE];
                             }
+                            harcodedMetadata = this.getCloudDiscoveryMetadataFromHarcodedValues();
                             return [4 /*yield*/, this.getCloudDiscoveryMetadataFromNetwork()];
                         case 1:
                             metadata = _a.sent();
@@ -6600,6 +6715,10 @@
                                 metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
                                 return [2 /*return*/, AuthorityMetadataSource.NETWORK];
                             }
+                            if (harcodedMetadata && !this.options.skipAuthorityMetadataCache) {
+                                metadataEntity.updateCloudDiscoveryMetadata(harcodedMetadata, false);
+                                return [2 /*return*/, AuthorityMetadataSource.HARDCODED_VALUES];
+                            }
                             else {
                                 // Metadata could not be obtained from config, cache or network
                                 throw ClientConfigurationError.createUntrustedAuthorityError();
@@ -6633,7 +6752,8 @@
         };
         /**
          * Called to get metadata from network if CloudDiscoveryMetadata was not populated by config
-         * @param networkInterface
+         *
+         * @param hasHardcodedMetadata boolean
          */
         Authority.prototype.getCloudDiscoveryMetadataFromNetwork = function () {
             return __awaiter(this, void 0, void 0, function () {
@@ -6653,7 +6773,9 @@
                             return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options)];
                         case 2:
                             response = _a.sent();
-                            metadata = isCloudInstanceDiscoveryResponse(response.body) ? response.body.metadata : [];
+                            metadata = isCloudInstanceDiscoveryResponse(response.body)
+                                ? response.body.metadata
+                                : [];
                             if (metadata.length === 0) {
                                 // If no metadata is returned, authority is untrusted
                                 return [2 /*return*/, null];
@@ -6673,6 +6795,15 @@
                 });
             });
         };
+        /**
+         * Get cloud discovery metadata for common authorities
+         */
+        Authority.prototype.getCloudDiscoveryMetadataFromHarcodedValues = function () {
+            if (this.canonicalAuthority in InstanceDiscoveryMetadata) {
+                return InstanceDiscoveryMetadata[this.canonicalAuthority];
+            }
+            return null;
+        };
         /**
          * Helper function to determine if this host is included in the knownAuthorities config option
          */
@@ -6788,7 +6919,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6849,7 +6980,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6880,7 +7011,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6908,7 +7039,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6925,7 +7056,7 @@
         }
     };
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6970,7 +7101,7 @@
         return JoseHeaderError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7010,7 +7141,7 @@
         return JoseHeader;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7069,7 +7200,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7231,7 +7362,7 @@
         return ServerTelemetryManager;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7314,6 +7445,19 @@
          * Used to acquire a token from Native component when native brokering is enabled.
          */
         PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
+        /**
+         * Used to measure the time taken for completing embedded-broker handshake (PW-Broker).
+         */
+        PerformanceEvents["BrokerHandhshake"] = "brokerHandshake";
+        /**
+         * acquireTokenByRefreshToken API in BrokerClientApplication (PW-Broker) .
+         */
+        PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
+        /**
+         * acquireToken API in BrokerClientApplication.
+         * Used to acquire a token on behalf of the embedded application (PW-Broker).
+         */
+        PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
     })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
     /**
      * State of the performance event.
@@ -7328,7 +7472,7 @@
         PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
     })(PerformanceEventStatus || (PerformanceEventStatus = {}));
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7386,7 +7530,7 @@
                 clientId: this.clientId,
                 name: measureName,
                 startTimeMs: Date.now(),
-                correlationId: eventCorrelationId
+                correlationId: eventCorrelationId,
             };
             // Store in progress events so they can be discarded if not ended properly
             this.cacheEventByCorrelationId(inProgressEvent);
@@ -7531,6 +7675,12 @@
                             else {
                                 _this.logger.verbose("PerformanceClient: Submeasurement for " + measureName + " already exists for " + current.name + ", ignoring", correlationId);
                             }
+                            if (current.accessTokenSize) {
+                                previous.accessTokenSize = current.accessTokenSize;
+                            }
+                            if (current.idTokenSize) {
+                                previous.idTokenSize = current.idTokenSize;
+                            }
                         }
                         return previous;
                     }, topLevelEvent);
@@ -7598,7 +7748,7 @@
         return PerformanceClient;
     }());
 
-    /*! @azure/msal-common v6.4.0 2022-06-06 */
+    /*! @azure/msal-common v7.2.0 2022-07-18 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7700,7 +7850,7 @@
         },
         redirectInIframeError: {
             code: "redirect_in_iframe",
-            desc: "Code flow is not supported inside an iframe. Please ensure you are using MSAL.js in a top frame of the window if using the redirect APIs, or use the popup APIs."
+            desc: "Redirects are not supported for iframed or brokered applications. Please ensure you are using MSAL.js in a top frame of the window if using the redirect APIs, or use the popup APIs."
         },
         blockTokenRequestsInHiddenIframeError: {
             code: "block_iframe_reload",
@@ -7925,7 +8075,7 @@
             return new BrowserAuthError(BrowserAuthErrorMessage.monitorIframeTimeoutError.code, BrowserAuthErrorMessage.monitorIframeTimeoutError.desc);
         };
         /**
-         * Creates an error thrown when navigateWindow is called inside an iframe.
+         * Creates an error thrown when navigateWindow is called inside an iframe or brokered applications.
          * @param windowParentCheck
          */
         BrowserAuthError.createRedirectInIframeError = function (windowParentCheck) {
@@ -8144,7 +8294,8 @@
     };
     var NativeConstants = {
         CHANNEL_ID: "53ee284d-920a-4b59-9d30-a60315b26836",
-        PREFERRED_EXTENSION_ID: "ppnbnpeolgkicgegkbkbjmhlideopiji"
+        PREFERRED_EXTENSION_ID: "ppnbnpeolgkicgegkbkbjmhlideopiji",
+        MATS_TELEMETRY: "MATS"
     };
     var NativeExtensionMethod;
     (function (NativeExtensionMethod) {
@@ -8817,26 +8968,57 @@
          * Gets the active account
          */
         BrowserCacheManager.prototype.getActiveAccount = function () {
-            var activeAccountIdKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
-            var activeAccountId = this.browserStorage.getItem(activeAccountIdKey);
-            if (!activeAccountId) {
+            var activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
+            var activeAccountValueFilters = this.getItem(activeAccountKeyFilters);
+            if (!activeAccountValueFilters) {
+                // if new active account cache type isn't found, it's an old version, so look for that instead
+                this.logger.trace("No active account filters cache schema found, looking for legacy schema");
+                var activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
+                var activeAccountValueLocal = this.getItem(activeAccountKeyLocal);
+                if (!activeAccountValueLocal) {
+                    this.logger.trace("No active account found");
+                    return null;
+                }
+                var activeAccount = this.getAccountInfoByFilter({ localAccountId: activeAccountValueLocal })[0] || null;
+                if (activeAccount) {
+                    this.logger.trace("Legacy active account cache schema found");
+                    this.logger.trace("Adding active account filters cache schema");
+                    this.setActiveAccount(activeAccount);
+                    return activeAccount;
+                }
                 return null;
             }
-            return this.getAccountInfoByFilter({ localAccountId: activeAccountId })[0] || null;
+            var activeAccountValueObj = this.validateAndParseJson(activeAccountValueFilters);
+            if (activeAccountValueObj) {
+                this.logger.trace("Active account filters schema found");
+                return this.getAccountInfoByFilter({
+                    homeAccountId: activeAccountValueObj.homeAccountId,
+                    localAccountId: activeAccountValueObj.localAccountId
+                })[0] || null;
+            }
+            this.logger.trace("No active account found");
+            return null;
         };
         /**
          * Sets the active account's localAccountId in cache
          * @param account
          */
         BrowserCacheManager.prototype.setActiveAccount = function (account) {
-            var activeAccountIdKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
+            var activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
+            var activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
             if (account) {
                 this.logger.verbose("setActiveAccount: Active account set");
-                this.browserStorage.setItem(activeAccountIdKey, account.localAccountId);
+                var activeAccountValue = {
+                    homeAccountId: account.homeAccountId,
+                    localAccountId: account.localAccountId
+                };
+                this.browserStorage.setItem(activeAccountKey, JSON.stringify(activeAccountValue));
+                this.browserStorage.setItem(activeAccountKeyLocal, account.localAccountId);
             }
             else {
                 this.logger.verbose("setActiveAccount: No account passed, active account not set");
-                this.browserStorage.removeItem(activeAccountIdKey);
+                this.browserStorage.removeItem(activeAccountKey);
+                this.browserStorage.removeItem(activeAccountKeyLocal);
             }
         };
         /**
@@ -9022,7 +9204,7 @@
          * @param expires
          */
         BrowserCacheManager.prototype.setItemCookie = function (cookieName, cookieValue, expires) {
-            var cookieStr = encodeURIComponent(cookieName) + "=" + encodeURIComponent(cookieValue) + ";path=/;";
+            var cookieStr = encodeURIComponent(cookieName) + "=" + encodeURIComponent(cookieValue) + ";path=/;SameSite=Lax;";
             if (expires) {
                 var expireTime = this.getCookieExpirationTime(expires);
                 cookieStr += "expires=" + expireTime + ";";
@@ -9394,7 +9576,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.25.0";
+    var version = "2.28.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10175,6 +10357,7 @@
                                 knownAuthorities: this.config.auth.knownAuthorities,
                                 cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
                                 authorityMetadata: this.config.auth.authorityMetadata,
+                                skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache
                             };
                             userAuthority = requestAuthority ? requestAuthority : this.config.auth.authority;
                             builtAuthority = Authority.generateAuthority(userAuthority, requestAzureCloudOptions || this.config.auth.azureCloudOptions);
@@ -10188,6 +10371,8 @@
                                 })
                                     .catch(function (error) {
                                     getAuthorityMeasurement.endMeasurement({
+                                        errorCode: error.errorCode,
+                                        subErrorCode: error.subError,
                                         success: false
                                     });
                                     throw error;
@@ -10563,6 +10748,7 @@
         NativeStatusCode["TRANSIENT_ERROR"] = "TRANSIENT_ERROR";
         NativeStatusCode["PERSISTENT_ERROR"] = "PERSISTENT_ERROR";
         NativeStatusCode["DISABLED"] = "DISABLED";
+        NativeStatusCode["ACCOUNT_UNAVAILABLE"] = "ACCOUNT_UNAVAILABLE";
     })(NativeStatusCode || (NativeStatusCode = {}));
     var NativeAuthErrorMessage = {
         extensionError: {
@@ -10571,6 +10757,10 @@
         userSwitch: {
             code: "user_switch",
             desc: "User attempted to switch accounts in the native broker, which is not allowed. All new accounts must sign-in through the standard web flow first, please try again."
+        },
+        tokensNotFoundInCache: {
+            code: "tokens_not_found_in_internal_memory_cache",
+            desc: "Tokens not cached in MSAL JS internal memory, please make the WAM request"
         }
     };
     var NativeAuthError = /** @class */ (function (_super) {
@@ -10606,6 +10796,8 @@
         NativeAuthError.createError = function (code, description, ext) {
             if (ext && ext.status) {
                 switch (ext.status) {
+                    case NativeStatusCode.ACCOUNT_UNAVAILABLE:
+                        return InteractionRequiredAuthError.createNativeAccountUnavailableError();
                     case NativeStatusCode.USER_INTERACTION_REQUIRED:
                         return new InteractionRequiredAuthError(code, description);
                     case NativeStatusCode.USER_CANCEL:
@@ -10623,20 +10815,122 @@
         NativeAuthError.createUserSwitchError = function () {
             return new NativeAuthError(NativeAuthErrorMessage.userSwitch.code, NativeAuthErrorMessage.userSwitch.desc);
         };
+        /**
+         * Creates a tokens not found error when the internal cache look up fails
+         * @returns NativeAuthError: tokensNotFoundInCache
+         */
+        NativeAuthError.createTokensNotFoundInCacheError = function () {
+            return new NativeAuthError(NativeAuthErrorMessage.tokensNotFoundInCache.code, NativeAuthErrorMessage.tokensNotFoundInCache.desc);
+        };
         return NativeAuthError;
     }(AuthError));
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var SilentCacheClient = /** @class */ (function (_super) {
+        __extends$1(SilentCacheClient, _super);
+        function SilentCacheClient() {
+            return _super !== null && _super.apply(this, arguments) || this;
+        }
+        /**
+         * Returns unexpired tokens from the cache, if available
+         * @param silentRequest
+         */
+        SilentCacheClient.prototype.acquireToken = function (silentRequest) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var acquireTokenMeasurement, serverTelemetryManager, silentAuthClient, cachedToken, error_1;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            acquireTokenMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
+                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
+                            return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
+                        case 1:
+                            silentAuthClient = _a.sent();
+                            this.logger.verbose("Silent auth client created");
+                            _a.label = 2;
+                        case 2:
+                            _a.trys.push([2, 4, , 5]);
+                            return [4 /*yield*/, silentAuthClient.acquireCachedToken(silentRequest)];
+                        case 3:
+                            cachedToken = _a.sent();
+                            acquireTokenMeasurement.endMeasurement({
+                                success: true,
+                                fromCache: true
+                            });
+                            return [2 /*return*/, cachedToken];
+                        case 4:
+                            error_1 = _a.sent();
+                            if (error_1 instanceof BrowserAuthError && error_1.errorCode === BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
+                                this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
+                            }
+                            acquireTokenMeasurement.endMeasurement({
+                                errorCode: error_1 instanceof AuthError && error_1.errorCode || undefined,
+                                subErrorCode: error_1 instanceof AuthError && error_1.subError || undefined,
+                                success: false
+                            });
+                            throw error_1;
+                        case 5: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Currently Unsupported
+         */
+        SilentCacheClient.prototype.logout = function () {
+            // Synchronous so we must reject
+            return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
+        };
+        /**
+         * Creates an Silent Flow Client with the given authority, or the default authority.
+         * @param serverTelemetryManager
+         * @param authorityUrl
+         */
+        SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var clientConfig;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
+                        case 1:
+                            clientConfig = _a.sent();
+                            return [2 /*return*/, new SilentFlowClient(clientConfig)];
+                    }
+                });
+            });
+        };
+        SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var _a;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            _a = [__assign$1({}, request)];
+                            return [4 /*yield*/, this.initializeBaseRequest(request)];
+                        case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
+                    }
+                });
+            });
+        };
+        return SilentCacheClient;
+    }(StandardInteractionClient));
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     var NativeInteractionClient = /** @class */ (function (_super) {
         __extends$1(NativeInteractionClient, _super);
-        function NativeInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, correlationId) {
+        function NativeInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, nativeStorageImpl, correlationId) {
             var _this = _super.call(this, config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId) || this;
             _this.apiId = apiId;
             _this.accountId = accountId;
             _this.nativeMessageHandler = provider;
+            _this.nativeStorageManager = nativeStorageImpl;
+            _this.silentCacheClient = new SilentCacheClient(config, _this.nativeStorageManager, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
             return _this;
         }
         /**
@@ -10645,22 +10939,40 @@
          */
         NativeInteractionClient.prototype.acquireToken = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var nativeATMeasurement, nativeRequest, messageBody, reqTimestamp, response, validatedResponse;
+                var nativeATMeasurement, reqTimestamp, nativeRequest, result, messageBody, response, validatedResponse;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             this.logger.trace("NativeInteractionClient - acquireToken called.");
                             nativeATMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+                            reqTimestamp = TimeUtils.nowSeconds();
                             return [4 /*yield*/, this.initializeNativeRequest(request)];
                         case 1:
                             nativeRequest = _a.sent();
+                            _a.label = 2;
+                        case 2:
+                            _a.trys.push([2, 4, , 5]);
+                            return [4 /*yield*/, this.acquireTokensFromCache(this.accountId, nativeRequest)];
+                        case 3:
+                            result = _a.sent();
+                            nativeATMeasurement.endMeasurement({
+                                success: true,
+                                isNativeBroker: true,
+                                fromCache: true
+                            });
+                            return [2 /*return*/, result];
+                        case 4:
+                            _a.sent();
+                            // continue with a native call for any and all errors
+                            this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
+                            return [3 /*break*/, 5];
+                        case 5:
                             messageBody = {
                                 method: NativeExtensionMethod.GetToken,
                                 request: nativeRequest
                             };
-                            reqTimestamp = TimeUtils.nowSeconds();
                             return [4 /*yield*/, this.nativeMessageHandler.sendMessage(messageBody)];
-                        case 2:
+                        case 6:
                             response = _a.sent();
                             validatedResponse = this.validateNativeResponse(response);
                             return [2 /*return*/, this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
@@ -10674,6 +10986,8 @@
                                     .catch(function (error) {
                                     nativeATMeasurement.endMeasurement({
                                         success: false,
+                                        errorCode: error.errorCode,
+                                        subErrorCode: error.subError,
                                         isNativeBroker: true
                                     });
                                     throw error;
@@ -10682,13 +10996,61 @@
                 });
             });
         };
+        /**
+         * Creates silent flow request
+         * @param request
+         * @param cachedAccount
+         * @returns CommonSilentFlowRequest
+         */
+        NativeInteractionClient.prototype.createSilentCacheRequest = function (request, cachedAccount) {
+            return {
+                authority: request.authority,
+                correlationId: this.correlationId,
+                scopes: ScopeSet.fromString(request.scopes).asArray(),
+                account: cachedAccount,
+                forceRefresh: false,
+            };
+        };
+        /**
+         * Fetches the tokens from the cache if un-expired
+         * @param nativeAccountId
+         * @param request
+         * @returns authenticationResult
+         */
+        NativeInteractionClient.prototype.acquireTokensFromCache = function (nativeAccountId, request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var accountEntity, account, silentRequest, result, e_2;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            accountEntity = this.browserStorage.readAccountFromCacheWithNativeAccountId(nativeAccountId);
+                            if (!accountEntity) {
+                                throw ClientAuthError.createNoAccountFoundError();
+                            }
+                            account = accountEntity.getAccountInfo();
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            silentRequest = this.createSilentCacheRequest(request, account);
+                            return [4 /*yield*/, this.silentCacheClient.acquireToken(silentRequest)];
+                        case 2:
+                            result = _a.sent();
+                            return [2 /*return*/, result];
+                        case 3:
+                            e_2 = _a.sent();
+                            throw e_2;
+                        case 4: return [2 /*return*/];
+                    }
+                });
+            });
+        };
         /**
          * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
          * @param request
          */
         NativeInteractionClient.prototype.acquireTokenRedirect = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var nativeRequest, messageBody, response, e_1, navigationOptions, redirectUri;
+                var nativeRequest, messageBody, response, e_3, navigationOptions, redirectUri;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -10709,10 +11071,10 @@
                             this.validateNativeResponse(response);
                             return [3 /*break*/, 5];
                         case 4:
-                            e_1 = _a.sent();
+                            e_3 = _a.sent();
                             // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
-                            if (e_1 instanceof NativeAuthError && e_1.isFatal()) {
-                                throw e_1;
+                            if (e_3 instanceof NativeAuthError && e_3.isFatal()) {
+                                throw e_3;
                             }
                             return [3 /*break*/, 5];
                         case 5:
@@ -10736,7 +11098,7 @@
          */
         NativeInteractionClient.prototype.handleRedirectPromise = function () {
             return __awaiter$1(this, void 0, void 0, function () {
-                var cachedRequest, messageBody, reqTimestamp, response, result, e_2;
+                var cachedRequest, messageBody, reqTimestamp, response, result, e_4;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -10768,9 +11130,9 @@
                             this.browserStorage.setInteractionInProgress(false);
                             return [2 /*return*/, result];
                         case 3:
-                            e_2 = _a.sent();
+                            e_4 = _a.sent();
                             this.browserStorage.setInteractionInProgress(false);
-                            throw e_2;
+                            throw e_4;
                         case 4: return [2 /*return*/];
                     }
                 });
@@ -10792,7 +11154,7 @@
          */
         NativeInteractionClient.prototype.handleNativeResponse = function (response, request, reqTimestamp) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var idTokenObj, authority, authorityPreferredCache, homeAccountIdentifier, accountEntity, responseScopes, accountProperties, uid, tid, responseAccessToken, responseTokenType, _a, popTokenGenerator, shrParameters, result;
+                var idTokenObj, authority, authorityPreferredCache, homeAccountIdentifier, accountEntity, responseScopes, accountProperties, uid, tid, responseAccessToken, responseTokenType, _a, popTokenGenerator, shrParameters, mats, result, idTokenEntity, expiresIn, tokenExpirationSeconds, accessTokenEntity;
                 var _this = this;
                 return __generator$1(this, function (_b) {
                     switch (_b.label) {
@@ -10808,7 +11170,7 @@
                             authority = _b.sent();
                             authorityPreferredCache = authority.getPreferredCache();
                             homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj);
-                            accountEntity = AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, undefined, authorityPreferredCache, response.account.id);
+                            accountEntity = AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, authorityPreferredCache, response.account.id);
                             this.browserStorage.setAccount(accountEntity);
                             responseScopes = response.scopes ? ScopeSet.fromString(response.scopes) : ScopeSet.fromString(request.scopes);
                             accountProperties = response.account.properties || {};
@@ -10853,6 +11215,7 @@
                             }
                             _b.label = 5;
                         case 5:
+                            mats = this.getMATSFromResponse(response);
                             result = {
                                 authority: authority.canonicalAuthority,
                                 uniqueId: uid,
@@ -10862,14 +11225,24 @@
                                 idToken: response.id_token,
                                 idTokenClaims: idTokenObj.claims,
                                 accessToken: responseAccessToken,
-                                fromCache: false,
+                                fromCache: mats ? this.isResponseFromCache(mats) : false,
                                 expiresOn: new Date(Number(reqTimestamp + response.expires_in) * 1000),
                                 tokenType: responseTokenType,
                                 correlationId: this.correlationId,
                                 state: response.state,
                                 fromNativeBroker: true
                             };
-                            // Remove any existing cached tokens for this account
+                            idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || Constants.EMPTY_STRING, request.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+                            this.nativeStorageManager.setIdTokenCredential(idTokenEntity);
+                            expiresIn = (responseTokenType === exports.AuthenticationScheme.POP)
+                                ? Constants.SHR_NONCE_VALIDITY
+                                : (typeof response.expires_in === "string"
+                                    ? parseInt(response.expires_in, 10)
+                                    : response.expires_in) || 0;
+                            tokenExpirationSeconds = reqTimestamp + expiresIn;
+                            accessTokenEntity = AccessTokenEntity.createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, tid, responseScopes.printScopes(), tokenExpirationSeconds, 0, this.browserCrypto);
+                            this.nativeStorageManager.setAccessTokenCredential(accessTokenEntity);
+                            // Remove any existing cached tokens for this account in browser storage
                             this.browserStorage.removeAccountContext(accountEntity).catch(function (e) {
                                 _this.logger.error("Error occurred while removing account context from browser storage. " + e);
                             });
@@ -10895,13 +11268,42 @@
                 throw NativeAuthError.createUnexpectedError("Response missing expected properties.");
             }
         };
+        /**
+         * Gets MATS telemetry from native response
+         * @param response
+         * @returns
+         */
+        NativeInteractionClient.prototype.getMATSFromResponse = function (response) {
+            if (response.properties.MATS) {
+                try {
+                    return JSON.parse(response.properties.MATS);
+                }
+                catch (e) {
+                    this.logger.error("NativeInteractionClient - Error parsing MATS telemetry, returning null instead");
+                }
+            }
+            return null;
+        };
+        /**
+         * Returns whether or not response came from native cache
+         * @param response
+         * @returns
+         */
+        NativeInteractionClient.prototype.isResponseFromCache = function (mats) {
+            if (typeof mats.is_cached === "undefined") {
+                this.logger.verbose("NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false.");
+                return false;
+            }
+            return !!mats.is_cached;
+        };
         /**
          * Translates developer provided request object into NativeRequest object
          * @param request
          */
         NativeInteractionClient.prototype.initializeNativeRequest = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var authority, canonicalAuthority, scopes, scopeSet, validatedRequest, shrParameters, popTokenGenerator, reqCnfData;
+                var authority, canonicalAuthority, scopes, scopeSet, getPrompt, validatedRequest, shrParameters, popTokenGenerator, reqCnfData;
+                var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -10912,18 +11314,32 @@
                             scopes = request && request.scopes || [];
                             scopeSet = new ScopeSet(scopes);
                             scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
-                            if (request.prompt) {
+                            getPrompt = function () {
+                                // If request is silent, prompt is always none
+                                switch (_this.apiId) {
+                                    case exports.ApiId.ssoSilent:
+                                    case exports.ApiId.acquireTokenSilent_silentFlow:
+                                        _this.logger.trace("initializeNativeRequest: silent request sets prompt to none");
+                                        return PromptValue.NONE;
+                                }
+                                // Prompt not provided, request may proceed and native broker decides if it needs to prompt
+                                if (!request.prompt) {
+                                    _this.logger.trace("initializeNativeRequest: prompt was not provided");
+                                    return undefined;
+                                }
+                                // If request is interactive, check if prompt provided is allowed to go directly to native broker
                                 switch (request.prompt) {
                                     case PromptValue.NONE:
                                     case PromptValue.CONSENT:
-                                        this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
-                                        break;
+                                    case PromptValue.LOGIN:
+                                        _this.logger.trace("initializeNativeRequest: prompt is compatible with native flow");
+                                        return request.prompt;
                                     default:
-                                        this.logger.trace("initializeNativeRequest: prompt = " + request.prompt + " is not compatible with native flow");
+                                        _this.logger.trace("initializeNativeRequest: prompt = " + request.prompt + " is not compatible with native flow");
                                         throw BrowserAuthError.createNativePromptParameterNotSupportedError();
                                 }
-                            }
-                            validatedRequest = __assign$1(__assign$1({}, request), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scopes: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), correlationId: this.correlationId, tokenType: request.authenticationScheme, windowTitleSubstring: document.title, extraParameters: __assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), extendedExpiryToken: false // Make this configurable?
+                            };
+                            validatedRequest = __assign$1(__assign$1({}, request), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scopes: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), prompt: getPrompt(), correlationId: this.correlationId, tokenType: request.authenticationScheme, windowTitleSubstring: document.title, extraParameters: __assign$1(__assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), { telemetry: NativeConstants.MATS_TELEMETRY }), extendedExpiryToken: false // Make this configurable?
                              });
                             if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                             shrParameters = {
@@ -10940,11 +11356,7 @@
                             validatedRequest.reqCnf = reqCnfData.reqCnfHash;
                             validatedRequest.keyId = reqCnfData.kid;
                             _a.label = 2;
-                        case 2:
-                            if (this.apiId === exports.ApiId.ssoSilent || this.apiId === exports.ApiId.acquireTokenSilent_silentFlow) {
-                                validatedRequest.prompt = PromptValue.NONE;
-                            }
-                            return [2 /*return*/, validatedRequest];
+                        case 2: return [2 /*return*/, validatedRequest];
                     }
                 });
             });
@@ -11194,8 +11606,10 @@
      */
     var RedirectClient = /** @class */ (function (_super) {
         __extends$1(RedirectClient, _super);
-        function RedirectClient() {
-            return _super !== null && _super.apply(this, arguments) || this;
+        function RedirectClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, nativeMessageHandler, correlationId) {
+            var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
+            _this.nativeStorage = nativeStorageImpl;
+            return _this;
         }
         /**
          * Redirects the page to the /authorize endpoint of the IDP
@@ -11404,7 +11818,7 @@
                                 if (!this.nativeMessageHandler) {
                                     throw BrowserAuthError.createNativeConnectionNotEstablishedError();
                                 }
-                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, cachedRequest.correlationId);
+                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.browserStorage, cachedRequest.correlationId);
                                 userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
                                 return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, cachedRequest), { state: userRequestState, prompt: undefined // Server should handle the prompt, ideally native broker can do this part silently
                                      })).finally(function () {
@@ -11522,10 +11936,11 @@
      */
     var PopupClient = /** @class */ (function (_super) {
         __extends$1(PopupClient, _super);
-        function PopupClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) {
+        function PopupClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, nativeMessageHandler, correlationId) {
             var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
             // Properly sets this reference for the unload event.
             _this.unloadWindow = _this.unloadWindow.bind(_this);
+            _this.nativeStorage = nativeStorageImpl;
             return _this;
         }
         /**
@@ -11650,7 +12065,7 @@
                                 if (!this.nativeMessageHandler) {
                                     throw BrowserAuthError.createNativeConnectionNotEstablishedError();
                                 }
-                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, validRequest.correlationId);
+                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.nativeStorage, validRequest.correlationId);
                                 userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state_1).userRequestState;
                                 return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, validRequest), { state: userRequestState, prompt: undefined // Server should handle the prompt, ideally native broker can do this part silently
                                      })).finally(function () {
@@ -12086,6 +12501,7 @@
                 azureCloudInstance: exports.AzureCloudInstance.None,
                 tenant: Constants.EMPTY_STRING
             },
+            skipAuthorityMetadataCache: false,
         };
         // Default cache options for browser
         var DEFAULT_CACHE_OPTIONS = {
@@ -12277,9 +12693,10 @@
      */
     var SilentIframeClient = /** @class */ (function (_super) {
         __extends$1(SilentIframeClient, _super);
-        function SilentIframeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeMessageHandler, correlationId) {
+        function SilentIframeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, nativeMessageHandler, correlationId) {
             var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
             _this.apiId = apiId;
+            _this.nativeStorage = nativeStorageImpl;
             return _this;
         }
         /**
@@ -12333,6 +12750,8 @@
                             serverTelemetryManager.cacheFailedRequest(e_1);
                             this.browserStorage.cleanRequestByState(silentRequest.state);
                             acquireTokenMeasurement.endMeasurement({
+                                errorCode: e_1 instanceof AuthError && e_1.errorCode || undefined,
+                                subErrorCode: e_1 instanceof AuthError && e_1.subError || undefined,
                                 success: false
                             });
                             throw e_1;
@@ -12380,7 +12799,7 @@
                                 if (!this.nativeMessageHandler) {
                                     throw BrowserAuthError.createNativeConnectionNotEstablishedError();
                                 }
-                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.correlationId);
+                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.browserStorage, this.correlationId);
                                 userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
                                 return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: PromptValue.NONE })).finally(function () {
                                         _this.browserStorage.cleanRequestByState(state);
@@ -12395,97 +12814,6 @@
         return SilentIframeClient;
     }(StandardInteractionClient));
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    var SilentCacheClient = /** @class */ (function (_super) {
-        __extends$1(SilentCacheClient, _super);
-        function SilentCacheClient() {
-            return _super !== null && _super.apply(this, arguments) || this;
-        }
-        /**
-         * Returns unexpired tokens from the cache, if available
-         * @param silentRequest
-         */
-        SilentCacheClient.prototype.acquireToken = function (silentRequest) {
-            return __awaiter$1(this, void 0, void 0, function () {
-                var acquireTokenMeasurement, serverTelemetryManager, silentAuthClient, cachedToken, error_1;
-                return __generator$1(this, function (_a) {
-                    switch (_a.label) {
-                        case 0:
-                            acquireTokenMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
-                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
-                            return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
-                        case 1:
-                            silentAuthClient = _a.sent();
-                            this.logger.verbose("Silent auth client created");
-                            _a.label = 2;
-                        case 2:
-                            _a.trys.push([2, 4, , 5]);
-                            return [4 /*yield*/, silentAuthClient.acquireCachedToken(silentRequest)];
-                        case 3:
-                            cachedToken = _a.sent();
-                            acquireTokenMeasurement.endMeasurement({
-                                success: true,
-                                fromCache: true
-                            });
-                            return [2 /*return*/, cachedToken];
-                        case 4:
-                            error_1 = _a.sent();
-                            if (error_1 instanceof BrowserAuthError && error_1.errorCode === BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
-                                this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
-                            }
-                            acquireTokenMeasurement.endMeasurement({
-                                success: false
-                            });
-                            throw error_1;
-                        case 5: return [2 /*return*/];
-                    }
-                });
-            });
-        };
-        /**
-         * Currently Unsupported
-         */
-        SilentCacheClient.prototype.logout = function () {
-            // Synchronous so we must reject
-            return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
-        };
-        /**
-         * Creates an Silent Flow Client with the given authority, or the default authority.
-         * @param serverTelemetryManager
-         * @param authorityUrl
-         */
-        SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
-            return __awaiter$1(this, void 0, void 0, function () {
-                var clientConfig;
-                return __generator$1(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
-                        case 1:
-                            clientConfig = _a.sent();
-                            return [2 /*return*/, new SilentFlowClient(clientConfig)];
-                    }
-                });
-            });
-        };
-        SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
-            return __awaiter$1(this, void 0, void 0, function () {
-                var _a;
-                return __generator$1(this, function (_b) {
-                    switch (_b.label) {
-                        case 0:
-                            _a = [__assign$1({}, request)];
-                            return [4 /*yield*/, this.initializeBaseRequest(request)];
-                        case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
-                    }
-                });
-            });
-        };
-        return SilentCacheClient;
-    }(StandardInteractionClient));
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -12531,6 +12859,8 @@
                                     }
                                     serverTelemetryManager.cacheFailedRequest(e);
                                     acquireTokenMeasurement.endMeasurement({
+                                        errorCode: e.errorCode,
+                                        subErrorCode: e.subError,
                                         success: false
                                     });
                                     throw e;
@@ -14174,6 +14504,7 @@
                     knownAuthorities: this.config.auth.knownAuthorities,
                     cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
                     authorityMetadata: this.config.auth.authorityMetadata,
+                    skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
                 };
                 var authority = new Authority(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions);
                 // "clientInfo" from options takes precedence over "clientInfo" in response
@@ -14207,8 +14538,8 @@
             var idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountId, environment, idToken, this.config.auth.clientId, tenantId);
             var idAuthToken = new AuthToken(idToken, this.cryptoObj);
             var accountEntity = options.clientInfo ?
-                AccountEntity.createAccount(options.clientInfo, homeAccountId, idAuthToken, undefined, undefined, undefined, undefined, environment) :
-                AccountEntity.createGenericAccount(homeAccountId, idAuthToken, undefined, undefined, undefined, undefined, environment);
+                AccountEntity.createAccount(options.clientInfo, homeAccountId, idAuthToken, undefined, undefined, undefined, environment) :
+                AccountEntity.createGenericAccount(homeAccountId, idAuthToken, undefined, undefined, undefined, environment);
             if (this.isBrowserEnvironment) {
                 this.logger.verbose("TokenCache - loading id token");
                 this.storage.setAccount(accountEntity);
@@ -14500,6 +14831,13 @@
             this.browserStorage = this.isBrowserEnvironment ?
                 new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger) :
                 DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
+            // initialize in memory storage for native flows
+            var nativeCacheOptions = {
+                cacheLocation: exports.BrowserCacheLocation.MemoryStorage,
+                storeAuthStateInCookie: false,
+                secureCookies: false
+            };
+            this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger);
             // Initialize the token cache
             this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto);
         }
@@ -14566,7 +14904,7 @@
                             redirectResponse = void 0;
                             if (request && NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) && this.nativeExtensionProvider && !hash) {
                                 this.logger.trace("handleRedirectPromise - acquiring token from native platform");
-                                nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, request.correlationId);
+                                nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, this.nativeInternalStorage, request.correlationId);
                                 redirectResponse = nativeClient.handleRedirectPromise();
                             }
                             else {
@@ -14638,13 +14976,19 @@
                         this.eventHandler.emitEvent(exports.EventType.LOGIN_START, exports.InteractionType.Redirect, request);
                     }
                     if (this.nativeExtensionProvider && this.canUseNative(request)) {
-                        nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), request.correlationId);
+                        nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
                         result = nativeClient.acquireTokenRedirect(request).catch(function (e) {
                             if (e instanceof NativeAuthError && e.isFatal()) {
                                 _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                                 var redirectClient = _this.createRedirectClient(request.correlationId);
                                 return redirectClient.acquireToken(request);
                             }
+                            else if (e instanceof InteractionRequiredAuthError) {
+                                _this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow");
+                                var redirectClient = _this.createRedirectClient(request.correlationId);
+                                return redirectClient.acquireToken(request);
+                            }
+                            _this.browserStorage.setInteractionInProgress(false);
                             throw e;
                         });
                     }
@@ -14700,7 +15044,9 @@
                     _this.browserStorage.setInteractionInProgress(false);
                     atPopupMeasurement.endMeasurement({
                         success: true,
-                        isNativeBroker: true
+                        isNativeBroker: true,
+                        accessTokenSize: response.accessToken.length,
+                        idTokenSize: response.idToken.length,
                     });
                     atPopupMeasurement.flushMeasurement();
                     return response;
@@ -14710,6 +15056,12 @@
                         var popupClient = _this.createPopupClient(request.correlationId);
                         return popupClient.acquireToken(request);
                     }
+                    else if (e instanceof InteractionRequiredAuthError) {
+                        _this.logger.verbose("acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow");
+                        var popupClient = _this.createPopupClient(request.correlationId);
+                        return popupClient.acquireToken(request);
+                    }
+                    _this.browserStorage.setInteractionInProgress(false);
                     throw e;
                 });
             }
@@ -14718,7 +15070,9 @@
                 result = popupClient.acquireToken(request);
             }
             return result.then(function (result) {
-                // If logged in, emit acquire token events
+                /*
+                 *  If logged in, emit acquire token events
+                 */
                 var isLoggingIn = loggedInAccounts.length < _this.getAllAccounts().length;
                 if (isLoggingIn) {
                     _this.eventHandler.emitEvent(exports.EventType.LOGIN_SUCCESS, exports.InteractionType.Popup, result);
@@ -14727,7 +15081,9 @@
                     _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Popup, result);
                 }
                 atPopupMeasurement.endMeasurement({
-                    success: true
+                    success: true,
+                    accessTokenSize: result.accessToken.length,
+                    idTokenSize: result.idToken.length,
                 });
                 atPopupMeasurement.flushMeasurement();
                 return result;
@@ -14739,6 +15095,8 @@
                     _this.eventHandler.emitEvent(exports.EventType.LOGIN_FAILURE, exports.InteractionType.Popup, null, e);
                 }
                 atPopupMeasurement.endMeasurement({
+                    errorCode: e.errorCode,
+                    subErrorCode: e.subError,
                     success: false
                 });
                 atPopupMeasurement.flushMeasurement();
@@ -14792,13 +15150,18 @@
                     return [2 /*return*/, result.then(function (response) {
                             _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, response);
                             ssoSilentMeasurement.endMeasurement({
-                                success: true
+                                success: true,
+                                isNativeBroker: response.fromNativeBroker,
+                                accessTokenSize: response.accessToken.length,
+                                idTokenSize: response.idToken.length
                             });
                             ssoSilentMeasurement.flushMeasurement();
                             return response;
                         }).catch(function (e) {
                             _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_FAILURE, exports.InteractionType.Silent, null, e);
                             ssoSilentMeasurement.endMeasurement({
+                                errorCode: e.errorCode,
+                                subErrorCode: e.subError,
                                 success: false
                             });
                             ssoSilentMeasurement.flushMeasurement();
@@ -14838,7 +15201,10 @@
                                     _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
                                     _this.hybridAuthCodeResponses.delete(hybridAuthCode_1);
                                     atbcMeasurement.endMeasurement({
-                                        success: true
+                                        success: true,
+                                        accessTokenSize: result.accessToken.length,
+                                        idTokenSize: result.idToken.length,
+                                        isNativeBroker: result.fromNativeBroker
                                     });
                                     atbcMeasurement.flushMeasurement();
                                     return result;
@@ -14847,6 +15213,8 @@
                                     _this.hybridAuthCodeResponses.delete(hybridAuthCode_1);
                                     _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, error);
                                     atbcMeasurement.endMeasurement({
+                                        errorCode: error.errorCode,
+                                        subErrorCode: error.subError,
                                         success: false
                                     });
                                     atbcMeasurement.flushMeasurement();
@@ -14884,6 +15252,8 @@
                     catch (e) {
                         this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
                         atbcMeasurement.endMeasurement({
+                            errorCode: e instanceof AuthError && e.errorCode || undefined,
+                            subErrorCode: e instanceof AuthError && e.subError || undefined,
                             success: false
                         });
                         throw e;
@@ -14938,7 +15308,9 @@
                             .then(function (result) {
                             atbrtMeasurement.endMeasurement({
                                 success: true,
-                                fromCache: result.fromCache
+                                fromCache: result.fromCache,
+                                accessTokenSize: result.accessToken.length,
+                                idTokenSize: result.idToken.length,
                             });
                             return result;
                         })
@@ -14953,12 +15325,16 @@
                                     .then(function (result) {
                                     atbrtMeasurement.endMeasurement({
                                         success: true,
-                                        fromCache: result.fromCache
+                                        fromCache: result.fromCache,
+                                        accessTokenSize: result.accessToken.length,
+                                        idTokenSize: result.idToken.length,
                                     });
                                     return result;
                                 })
                                     .catch(function (error) {
                                     atbrtMeasurement.endMeasurement({
+                                        errorCode: error.errorCode,
+                                        subErrorCode: error.subError,
                                         success: false
                                     });
                                     throw error;
@@ -15108,9 +15484,13 @@
         // #region Helpers
         /**
          * Helper to validate app environment before making an auth request
-         * * @param interactionType
+         *
+         * @protected
+         * @param {InteractionType} interactionType What kind of interaction is being used
+         * @param {boolean} [setInteractionInProgress=true] Whether to set interaction in progress temp cache flag
          */
-        ClientApplication.prototype.preflightBrowserEnvironmentCheck = function (interactionType) {
+        ClientApplication.prototype.preflightBrowserEnvironmentCheck = function (interactionType, setInteractionInProgress) {
+            if (setInteractionInProgress === void 0) { setInteractionInProgress = true; }
             this.logger.verbose("preflightBrowserEnvironmentCheck started");
             // Block request if not in browser environment
             BrowserUtils.blockNonBrowserEnvironment(this.isBrowserEnvironment);
@@ -15129,20 +15509,23 @@
                 throw BrowserConfigurationAuthError.createInMemoryRedirectUnavailableError();
             }
             if (interactionType === exports.InteractionType.Redirect || interactionType === exports.InteractionType.Popup) {
-                this.preflightInteractiveRequest();
+                this.preflightInteractiveRequest(setInteractionInProgress);
             }
         };
         /**
-         * Helper to validate app environment before making a request.
-         * @param request
-         * @param interactionType
+         * Preflight check for interactive requests
+         *
+         * @protected
+         * @param {boolean} setInteractionInProgress Whether to set interaction in progress temp cache flag
          */
-        ClientApplication.prototype.preflightInteractiveRequest = function () {
+        ClientApplication.prototype.preflightInteractiveRequest = function (setInteractionInProgress) {
             this.logger.verbose("preflightInteractiveRequest called, validating app environment");
             // block the reload if it occurred inside a hidden iframe
             BrowserUtils.blockReloadInHiddenIframes();
             // Set interaction in progress temporary cache or throw if alread set.
-            this.browserStorage.setInteractionInProgress(true);
+            if (setInteractionInProgress) {
+                this.browserStorage.setInteractionInProgress(true);
+            }
         };
         /**
          * Acquire a token from native device (e.g. WAM)
@@ -15156,7 +15539,7 @@
                     if (!this.nativeExtensionProvider) {
                         throw BrowserAuthError.createNativeConnectionNotEstablishedError();
                     }
-                    nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.nativeExtensionProvider, accountId || this.getNativeAccountId(request), request.correlationId);
+                    nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.nativeExtensionProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
                     return [2 /*return*/, nativeClient.acquireToken(request)];
                 });
             });
@@ -15175,6 +15558,7 @@
                 switch (request.prompt) {
                     case PromptValue.NONE:
                     case PromptValue.CONSENT:
+                    case PromptValue.LOGIN:
                         this.logger.trace("canUseNative: prompt is compatible with native flow");
                         break;
                     default:
@@ -15202,21 +15586,21 @@
          * @param correlationId
          */
         ClientApplication.prototype.createPopupClient = function (correlationId) {
-            return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+            return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, this.nativeExtensionProvider, correlationId);
         };
         /**
-         * Returns new instance of the Popup Interaction Client
+         * Returns new instance of the Redirect Interaction Client
          * @param correlationId
          */
         ClientApplication.prototype.createRedirectClient = function (correlationId) {
-            return new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+            return new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, this.nativeExtensionProvider, correlationId);
         };
         /**
          * Returns new instance of the Silent Iframe Interaction Client
          * @param correlationId
          */
         ClientApplication.prototype.createSilentIframeClient = function (correlationId) {
-            return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.ssoSilent, this.performanceClient, this.nativeExtensionProvider, correlationId);
+            return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, this.nativeExtensionProvider, correlationId);
         };
         /**
          * Returns new instance of the Silent Cache Interaction Client
@@ -15451,7 +15835,10 @@
                             _this.activeSilentTokenRequests.delete(silentRequestKey);
                             atsMeasurement.endMeasurement({
                                 success: true,
-                                fromCache: result.fromCache
+                                fromCache: result.fromCache,
+                                accessTokenSize: result.accessToken.length,
+                                idTokenSize: result.idToken.length,
+                                isNativeBroker: result.fromNativeBroker
                             });
                             atsMeasurement.flushMeasurement();
                             return result;
@@ -15527,12 +15914,17 @@
                                 _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
                                 astsAsyncMeasurement.endMeasurement({
                                     success: true,
-                                    fromCache: response.fromCache
+                                    fromCache: response.fromCache,
+                                    accessTokenSize: response.accessToken.length,
+                                    idTokenSize: response.idToken.length,
+                                    isNativeBroker: response.fromNativeBroker
                                 });
                                 return response;
                             }).catch(function (tokenRenewalError) {
                                 _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError);
                                 astsAsyncMeasurement.endMeasurement({
+                                    errorCode: tokenRenewalError.errorCode,
+                                    subErrorCode: tokenRenewalError.subError,
                                     success: false
                                 });
                                 throw tokenRenewalError;