@azure/msal-browser 2.27.0 → 2.28.2

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.27.0 2022-07-05 */
+/*! @azure/msal-browser v2.28.2 2022-09-06 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -46,6 +46,18 @@
         return __assign$1.apply(this, arguments);
     };
 
+    function __rest(s, e) {
+        var t = {};
+        for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+            t[p] = s[p];
+        if (s != null && typeof Object.getOwnPropertySymbols === "function")
+            for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+                if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                    t[p[i]] = s[p[i]];
+            }
+        return t;
+    }
+
     function __awaiter$1(thisArg, _arguments, P, generator) {
         function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
         return new (P || (P = Promise))(function (resolve, reject) {
@@ -107,7 +119,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -194,7 +206,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -244,7 +256,8 @@
         REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
         KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
         TOKEN_RESPONSE_TYPE: "token",
-        ID_TOKEN_RESPONSE_TYPE: "id_token"
+        ID_TOKEN_RESPONSE_TYPE: "id_token",
+        SHR_NONCE_VALIDITY: 240
     };
     var OIDC_DEFAULT_SCOPES = [
         Constants.OPENID_SCOPE,
@@ -276,6 +289,7 @@
         PersistentCacheKeys["ERROR"] = "error";
         PersistentCacheKeys["ERROR_DESC"] = "error.description";
         PersistentCacheKeys["ACTIVE_ACCOUNT"] = "active-account";
+        PersistentCacheKeys["ACTIVE_ACCOUNT_FILTERS"] = "active-account-filters"; // new cache entry for active_account for a more robust version for browser
     })(PersistentCacheKeys || (PersistentCacheKeys = {}));
     /**
      * String constants related to AAD Authority
@@ -569,7 +583,7 @@
         JsonTypes["Jwk"] = "JWK";
     })(JsonTypes || (JsonTypes = {}));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -582,6 +596,10 @@
         unexpectedError: {
             code: "unexpected_error",
             desc: "Unexpected error in authentication."
+        },
+        postRequestFailed: {
+            code: "post_request_failed",
+            desc: "Post request failed from the network, could be a 4xx/5xx or a network unavailability. Please check the exact error code for details."
         }
     };
     /**
@@ -610,10 +628,18 @@
         AuthError.createUnexpectedError = function (errDesc) {
             return new AuthError(AuthErrorMessage.unexpectedError.code, AuthErrorMessage.unexpectedError.desc + ": " + errDesc);
         };
+        /**
+         * Creates an error for post request failures.
+         * @param errDesc
+         * @returns
+         */
+        AuthError.createPostRequestFailed = function (errDesc) {
+            return new AuthError(AuthErrorMessage.postRequestFailed.code, AuthErrorMessage.postRequestFailed.desc + ": " + errDesc);
+        };
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -688,7 +714,7 @@
         }
     };
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1160,7 +1186,7 @@
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1285,7 +1311,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1465,12 +1491,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "7.1.0";
+    var version$1 = "7.4.0";
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1491,7 +1517,7 @@
         AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
     })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1650,7 +1676,7 @@
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1905,7 +1931,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2089,7 +2115,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2109,7 +2135,7 @@
             return JSON.parse(decodedClientInfo);
         }
         catch (e) {
-            throw ClientAuthError.createClientInfoDecodingError(e);
+            throw ClientAuthError.createClientInfoDecodingError(e.message);
         }
     }
     /**
@@ -2127,7 +2153,7 @@
         };
     }
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2141,7 +2167,7 @@
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2376,7 +2402,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2414,7 +2440,7 @@
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2445,6 +2471,7 @@
                     var accountInfo = accountEntity.getAccountInfo();
                     var idToken = _this.readIdTokenFromCache(_this.clientId, accountInfo);
                     if (idToken && !accountInfo.idTokenClaims) {
+                        accountInfo.idToken = idToken.secret;
                         accountInfo.idTokenClaims = new AuthToken(idToken.secret, _this.cryptoImpl).claims;
                     }
                     return accountInfo;
@@ -2536,7 +2563,7 @@
          * @param realm
          */
         CacheManager.prototype.getAccountsFilteredBy = function (accountFilter) {
-            return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING);
+            return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING, accountFilter ? accountFilter.nativeAccountId : Constants.EMPTY_STRING);
         };
         /**
          * retrieve accounts matching all provided filters; if no filter is set, get all accounts
@@ -2545,7 +2572,7 @@
          * @param environment
          * @param realm
          */
-        CacheManager.prototype.getAccountsFilteredByInternal = function (homeAccountId, environment, realm) {
+        CacheManager.prototype.getAccountsFilteredByInternal = function (homeAccountId, environment, realm, nativeAccountId) {
             var _this = this;
             var allCacheKeys = this.getKeys();
             var matchingAccounts = {};
@@ -2563,6 +2590,9 @@
                 if (!!realm && !_this.matchRealm(entity, realm)) {
                     return;
                 }
+                if (!!nativeAccountId && !_this.matchNativeAccountId(entity, nativeAccountId)) {
+                    return;
+                }
                 matchingAccounts[cacheKey] = entity;
             });
             return matchingAccounts;
@@ -2891,6 +2921,26 @@
             var accountKey = AccountEntity.generateAccountCacheKey(account);
             return this.getAccount(accountKey);
         };
+        /**
+         * Retrieve AccountEntity from cache
+         * @param nativeAccountId
+         * @returns AccountEntity or Null
+         */
+        CacheManager.prototype.readAccountFromCacheWithNativeAccountId = function (nativeAccountId) {
+            // fetch account from memory
+            var accountFilter = {
+                nativeAccountId: nativeAccountId
+            };
+            var accountCache = this.getAccountsFilteredBy(accountFilter);
+            var accounts = Object.keys(accountCache).map(function (key) { return accountCache[key]; });
+            if (accounts.length < 1) {
+                return null;
+            }
+            else if (accounts.length > 1) {
+                throw ClientAuthError.createMultipleMatchingAccountsInCacheError();
+            }
+            return accountCache[0];
+        };
         /**
          * Retrieve IdTokenEntity from cache
          * @param clientId
@@ -3065,6 +3115,15 @@
         CacheManager.prototype.matchRealm = function (entity, realm) {
             return !!(entity.realm && realm === entity.realm);
         };
+        /**
+         * helper to match nativeAccountId
+         * @param entity
+         * @param nativeAccountId
+         * @returns boolean indicating the match result
+         */
+        CacheManager.prototype.matchNativeAccountId = function (entity, nativeAccountId) {
+            return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
+        };
         /**
          * Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.
          * @param entity
@@ -3256,7 +3315,7 @@
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3339,7 +3398,7 @@
             telemetry: __assign(__assign({}, DEFAULT_TELEMETRY_OPTIONS), telemetry),
             serverTelemetryManager: serverTelemetryManager || null,
             persistencePlugin: persistencePlugin || null,
-            serializableCache: serializableCache || null
+            serializableCache: serializableCache || null,
         };
     }
     /**
@@ -3350,7 +3409,7 @@
         return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS, skipAuthorityMetadataCache: false }, authOptions);
     }
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3370,7 +3429,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3466,7 +3525,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3515,7 +3574,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3526,7 +3585,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3536,7 +3595,7 @@
      * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
      */
     var BaseClient = /** @class */ (function () {
-        function BaseClient(configuration) {
+        function BaseClient(configuration, performanceClient) {
             // Set the configuration
             this.config = buildClientConfiguration(configuration);
             // Initialize the logger
@@ -3553,6 +3612,8 @@
             this.serverTelemetryManager = this.config.serverTelemetryManager;
             // set Authority
             this.authority = this.config.authOptions.authority;
+            // set performance telemetry client
+            this.performanceClient = performanceClient;
         }
         /**
          * Creates default headers for requests to token endpoint
@@ -3615,7 +3676,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3701,7 +3762,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4079,7 +4140,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4143,7 +4204,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4193,7 +4254,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4307,7 +4368,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4374,7 +4435,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4449,7 +4510,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4465,7 +4526,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4536,7 +4597,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4699,6 +4760,21 @@
             }
             return Constants.EMPTY_STRING;
         };
+        /**
+         * Parses query string from given string. Returns empty string if no query symbol is found.
+         * @param queryString
+         */
+        UrlString.parseQueryString = function (queryString) {
+            var queryIndex1 = queryString.indexOf("?");
+            var queryIndex2 = queryString.indexOf("/?");
+            if (queryIndex2 > -1) {
+                return queryString.substring(queryIndex2 + 2);
+            }
+            else if (queryIndex1 > -1) {
+                return queryString.substring(queryIndex1 + 1);
+            }
+            return Constants.EMPTY_STRING;
+        };
         UrlString.constructAuthorityUriFromObject = function (urlObject) {
             return new UrlString(urlObject.Protocol + "//" + urlObject.HostNameAndPort + "/" + urlObject.PathSegments.join("/"));
         };
@@ -4720,6 +4796,24 @@
             }
             return deserializedHash;
         };
+        /**
+         * Returns URL query string as server auth code response object.
+         */
+        UrlString.getDeserializedQueryString = function (query) {
+            // Check if given query is empty
+            if (StringUtils.isEmpty(query)) {
+                return {};
+            }
+            // Strip the ? symbol if present
+            var parsedQueryString = UrlString.parseQueryString(query);
+            // If ? symbol was not present, above will return empty string, so give original query value
+            var deserializedQueryString = StringUtils.queryStringToObject(StringUtils.isEmpty(parsedQueryString) ? query : parsedQueryString);
+            // Check if deserialization didn't work
+            if (!deserializedQueryString) {
+                throw ClientAuthError.createHashNotDeserializedError(JSON.stringify(deserializedQueryString));
+            }
+            return deserializedQueryString;
+        };
         /**
          * Check if the hash of the URL string contains known properties
          */
@@ -4737,7 +4831,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4838,7 +4932,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4908,7 +5002,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4944,7 +5038,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5005,7 +5099,7 @@
          * @param serverTokenResponse
          * @param authority
          */
-        ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse) {
+        ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse) {
             return __awaiter(this, void 0, void 0, function () {
                 var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
                 return __generator(this, function (_a) {
@@ -5042,14 +5136,15 @@
                             /*
                              * When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.
                              * If not present, we should return null, as it's the case that another application called removeAccount in between
-                             * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal.
+                             * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal, unless explicitly flagged by
+                             * the developer, as in the case of refresh token flow used in ADAL Node to MSAL Node migration.
                              */
-                            if (handlingRefreshTokenResponse && cacheRecord.account) {
+                            if (handlingRefreshTokenResponse && !forceCacheRefreshTokenResponse && cacheRecord.account) {
                                 key = cacheRecord.account.generateAccountKey();
                                 account = this.cacheStorage.getAccount(key);
                                 if (!account) {
                                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                                    return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                                    return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined)];
                                 }
                             }
                             return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
@@ -5214,7 +5309,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5315,7 +5410,7 @@
                 throw ClientConfigurationError.createEmptyLogoutRequestError();
             }
             var queryString = this.createLogoutUrlQueryString(logoutRequest);
-            // Construct logout URI.
+            // Construct logout URI
             return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);
         };
         /**
@@ -5502,7 +5597,7 @@
          */
         AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
             return __awaiter(this, void 0, void 0, function () {
-                var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, reqCnfData;
+                var parameterBuilder, requestScopes, correlationId, accountSid, accountLoginHintClaim, clientInfo, clientInfo, clientInfo, popTokenGenerator, reqCnfData;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -5532,7 +5627,7 @@
                             if (request.domainHint) {
                                 parameterBuilder.addDomainHint(request.domainHint);
                             }
-                            // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
+                            // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
                             if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
                                 // AAD will throw if prompt=select_account is passed with an account hint
                                 if (request.sid && request.prompt === PromptValue.NONE) {
@@ -5542,9 +5637,24 @@
                                 }
                                 else if (request.account) {
                                     accountSid = this.extractAccountSid(request.account);
-                                    // If account and loginHint are provided, we will check account first for sid before adding loginHint
-                                    if (accountSid && request.prompt === PromptValue.NONE) {
-                                        // SessionId is only used in silent calls
+                                    accountLoginHintClaim = this.extractLoginHint(request.account);
+                                    // If login_hint claim is present, use it over sid/username
+                                    if (accountLoginHintClaim) {
+                                        this.logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
+                                        parameterBuilder.addLoginHint(accountLoginHintClaim);
+                                        try {
+                                            clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                            parameterBuilder.addCcsOid(clientInfo);
+                                        }
+                                        catch (e) {
+                                            this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                                        }
+                                    }
+                                    else if (accountSid && request.prompt === PromptValue.NONE) {
+                                        /*
+                                         * If account and loginHint are provided, we will check account first for sid before adding loginHint
+                                         * SessionId is only used in silent calls
+                                         */
                                         this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
                                         parameterBuilder.addSid(accountSid);
                                         try {
@@ -5552,7 +5662,7 @@
                                             parameterBuilder.addCcsOid(clientInfo);
                                         }
                                         catch (e) {
-                                            this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                            this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
                                         }
                                     }
                                     else if (request.loginHint) {
@@ -5569,7 +5679,7 @@
                                             parameterBuilder.addCcsOid(clientInfo);
                                         }
                                         catch (e) {
-                                            this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                            this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
                                         }
                                     }
                                 }
@@ -5640,16 +5750,135 @@
          * @param account
          */
         AuthorizationCodeClient.prototype.extractAccountSid = function (account) {
-            if (account.idTokenClaims) {
-                var tokenClaims = account.idTokenClaims;
-                return tokenClaims.sid || null;
-            }
-            return null;
+            var _a;
+            return ((_a = account.idTokenClaims) === null || _a === void 0 ? void 0 : _a.sid) || null;
+        };
+        AuthorizationCodeClient.prototype.extractLoginHint = function (account) {
+            var _a;
+            return ((_a = account.idTokenClaims) === null || _a === void 0 ? void 0 : _a.login_hint) || null;
         };
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
+     *
+     * @export
+     * @enum {number}
+     */
+    exports.PerformanceEvents = void 0;
+    (function (PerformanceEvents) {
+        /**
+         * acquireTokenByCode API (msal-browser and msal-node).
+         * Used to acquire tokens by trading an authorization code against the token endpoint.
+         */
+        PerformanceEvents["AcquireTokenByCode"] = "acquireTokenByCode";
+        /**
+         * acquireTokenByRefreshToken API (msal-browser and msal-node).
+         * Used to renew an access token using a refresh token against the token endpoint.
+         */
+        PerformanceEvents["AcquireTokenByRefreshToken"] = "acquireTokenByRefreshToken";
+        /**
+         * acquireTokenSilent API (msal-browser and msal-node).
+         * Used to silently acquire a new access token (from the cache or the network).
+         */
+        PerformanceEvents["AcquireTokenSilent"] = "acquireTokenSilent";
+        /**
+         * acquireTokenSilentAsync (msal-browser).
+         * Internal API for acquireTokenSilent.
+         */
+        PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
+        /**
+         * acquireTokenPopup (msal-browser).
+         * Used to acquire a new access token interactively through pop ups
+         */
+        PerformanceEvents["AcquireTokenPopup"] = "acquireTokenPopup";
+        /**
+         * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
+         * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
+         */
+        PerformanceEvents["CryptoOptsGetPublicKeyThumbprint"] = "cryptoOptsGetPublicKeyThumbprint";
+        /**
+         * signJwt API in CryptoOpts class (msal-browser).
+         * Used to signed a pop token.
+         */
+        PerformanceEvents["CryptoOptsSignJwt"] = "cryptoOptsSignJwt";
+        /**
+         * acquireToken API in the SilentCacheClient class (msal-browser).
+         * Used to read access tokens from the cache.
+         */
+        PerformanceEvents["SilentCacheClientAcquireToken"] = "silentCacheClientAcquireToken";
+        /**
+         * acquireToken API in the SilentIframeClient class (msal-browser).
+         * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
+         */
+        PerformanceEvents["SilentIframeClientAcquireToken"] = "silentIframeClientAcquireToken";
+        /**
+         * acquireToken API in SilentRereshClient (msal-browser).
+         * Used to acquire a new set of tokens from the token endpoint using a refresh token.
+         */
+        PerformanceEvents["SilentRefreshClientAcquireToken"] = "silentRefreshClientAcquireToken";
+        /**
+         * ssoSilent API (msal-browser).
+         * Used to silently acquire an authorization code and set of tokens using a hidden iframe.
+         */
+        PerformanceEvents["SsoSilent"] = "ssoSilent";
+        /**
+         * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
+         * Used to load authority metadata for a request.
+         */
+        PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
+        /**
+         * acquireToken APIs in msal-browser.
+         * Used to make an /authorize endpoint call with native brokering enabled.
+         */
+        PerformanceEvents["FetchAccountIdWithNativeBroker"] = "fetchAccountIdWithNativeBroker";
+        /**
+         * acquireToken API in NativeInteractionClient class (msal-browser).
+         * Used to acquire a token from Native component when native brokering is enabled.
+         */
+        PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
+        /**
+         * Time spent on the network for refresh token acquisition
+         */
+        PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
+        /**
+         * Time spent creating default headers for requests to token endpoint
+         */
+        PerformanceEvents["BaseClientCreateTokenRequestHeaders"] = "baseClientCreateTokenRequestHeaders";
+        /**
+         * Used to measure the time taken for completing embedded-broker handshake (PW-Broker).
+         */
+        PerformanceEvents["BrokerHandhshake"] = "brokerHandshake";
+        /**
+         * acquireTokenByRefreshToken API in BrokerClientApplication (PW-Broker) .
+         */
+        PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
+        /**
+         * acquireToken API in BrokerClientApplication.
+         * Used to acquire a token on behalf of the embedded application (PW-Broker).
+         */
+        PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
+    })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
+    /**
+     * State of the performance event.
+     *
+     * @export
+     * @enum {number}
+     */
+    var PerformanceEventStatus;
+    (function (PerformanceEventStatus) {
+        PerformanceEventStatus[PerformanceEventStatus["NotStarted"] = 0] = "NotStarted";
+        PerformanceEventStatus[PerformanceEventStatus["InProgress"] = 1] = "InProgress";
+        PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
+    })(PerformanceEventStatus || (PerformanceEventStatus = {}));
+
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5660,8 +5889,8 @@
      */
     var RefreshTokenClient = /** @class */ (function (_super) {
         __extends(RefreshTokenClient, _super);
-        function RefreshTokenClient(configuration) {
-            return _super.call(this, configuration) || this;
+        function RefreshTokenClient(configuration, performanceClient) {
+            return _super.call(this, configuration, performanceClient) || this;
         }
         RefreshTokenClient.prototype.acquireToken = function (request) {
             return __awaiter(this, void 0, void 0, function () {
@@ -5675,7 +5904,7 @@
                             response = _a.sent();
                             responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                             responseHandler.validateTokenResponse(response.body);
-                            return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true)];
+                            return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache)];
                     }
                 });
             });
@@ -5747,13 +5976,16 @@
          * @param authority
          */
         RefreshTokenClient.prototype.executeTokenRequest = function (request, authority) {
+            var _a;
             return __awaiter(this, void 0, void 0, function () {
-                var requestBody, queryParameters, headers, thumbprint, endpoint;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.createTokenRequestBody(request)];
+                var acquireTokenMeasurement, requestBody, queryParameters, headers, thumbprint, endpoint;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            acquireTokenMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
+                            return [4 /*yield*/, this.createTokenRequestBody(request)];
                         case 1:
-                            requestBody = _a.sent();
+                            requestBody = _b.sent();
                             queryParameters = this.createTokenQueryParameters(request);
                             headers = this.createTokenRequestHeaders(request.ccsCredential);
                             thumbprint = {
@@ -5768,7 +6000,19 @@
                                 sshKid: request.sshKid
                             };
                             endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
-                            return [2 /*return*/, this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)];
+                            return [2 /*return*/, this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)
+                                    .then(function (result) {
+                                    acquireTokenMeasurement === null || acquireTokenMeasurement === void 0 ? void 0 : acquireTokenMeasurement.endMeasurement({
+                                        success: true
+                                    });
+                                    return result;
+                                })
+                                    .catch(function (error) {
+                                    acquireTokenMeasurement === null || acquireTokenMeasurement === void 0 ? void 0 : acquireTokenMeasurement.endMeasurement({
+                                        success: false
+                                    });
+                                    throw error;
+                                })];
                     }
                 });
             });
@@ -5789,11 +6033,14 @@
          * @param request
          */
         RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
+            var _a;
             return __awaiter(this, void 0, void 0, function () {
-                var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, reqCnfData, clientInfo;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var correlationId, acquireTokenMeasurement, parameterBuilder, clientAssertion, popTokenGenerator, reqCnfData, clientInfo;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
+                            correlationId = request.correlationId;
+                            acquireTokenMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.BaseClientCreateTokenRequestHeaders, correlationId);
                             parameterBuilder = new RequestParameterBuilder();
                             parameterBuilder.addClientId(this.config.authOptions.clientId);
                             parameterBuilder.addScopes(request.scopes);
@@ -5805,7 +6052,6 @@
                             if (this.serverTelemetryManager) {
                                 parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
                             }
-                            correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
                             parameterBuilder.addCorrelationId(correlationId);
                             parameterBuilder.addRefreshToken(request.refreshToken);
                             if (this.config.clientCredentials.clientSecret) {
@@ -5820,7 +6066,7 @@
                             popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                             return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                         case 1:
-                            reqCnfData = _a.sent();
+                            reqCnfData = _b.sent();
                             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
                             parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                             return [3 /*break*/, 3];
@@ -5830,10 +6076,13 @@
                                     parameterBuilder.addSshJwk(request.sshJwk);
                                 }
                                 else {
+                                    acquireTokenMeasurement === null || acquireTokenMeasurement === void 0 ? void 0 : acquireTokenMeasurement.endMeasurement({
+                                        success: false
+                                    });
                                     throw ClientConfigurationError.createMissingSshJwkError();
                                 }
                             }
-                            _a.label = 3;
+                            _b.label = 3;
                         case 3:
                             if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
                                 parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
@@ -5854,6 +6103,9 @@
                                         break;
                                 }
                             }
+                            acquireTokenMeasurement === null || acquireTokenMeasurement === void 0 ? void 0 : acquireTokenMeasurement.endMeasurement({
+                                success: true
+                            });
                             return [2 /*return*/, parameterBuilder.createQueryString()];
                     }
                 });
@@ -5862,7 +6114,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5870,8 +6122,8 @@
      */
     var SilentFlowClient = /** @class */ (function (_super) {
         __extends(SilentFlowClient, _super);
-        function SilentFlowClient(configuration) {
-            return _super.call(this, configuration) || this;
+        function SilentFlowClient(configuration, performanceClient) {
+            return _super.call(this, configuration, performanceClient) || this;
         }
         /**
          * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
@@ -5890,7 +6142,7 @@
                         case 2:
                             e_1 = _a.sent();
                             if (e_1 instanceof ClientAuthError && e_1.errorCode === ClientAuthErrorMessage.tokenRefreshRequired.code) {
-                                refreshTokenClient = new RefreshTokenClient(this.config);
+                                refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
                                 return [2 /*return*/, refreshTokenClient.acquireTokenByRefreshToken(request)];
                             }
                             else {
@@ -5978,7 +6230,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5990,7 +6242,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5999,7 +6251,7 @@
     var EndpointMetadata = rawMetdataJSON.endpointMetadata;
     var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6013,7 +6265,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6090,7 +6342,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6100,7 +6352,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6222,7 +6474,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6884,7 +7136,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6945,7 +7197,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6976,7 +7228,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7004,7 +7256,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7021,7 +7273,7 @@
         }
     };
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7066,7 +7318,7 @@
         return JoseHeaderError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7106,7 +7358,7 @@
         return JoseHeader;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7165,7 +7417,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7327,138 +7579,41 @@
         return ServerTelemetryManager;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    /**
-     * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
-     *
-     * @export
-     * @enum {number}
-     */
-    exports.PerformanceEvents = void 0;
-    (function (PerformanceEvents) {
-        /**
-         * acquireTokenByCode API (msal-browser and msal-node).
-         * Used to acquire tokens by trading an authorization code against the token endpoint.
-         */
-        PerformanceEvents["AcquireTokenByCode"] = "acquireTokenByCode";
-        /**
-         * acquireTokenByRefreshToken API (msal-browser and msal-node).
-         * Used to renew an access token using a refresh token against the token endpoint.
-         */
-        PerformanceEvents["AcquireTokenByRefreshToken"] = "acquireTokenByRefreshToken";
-        /**
-         * acquireTokenSilent API (msal-browser and msal-node).
-         * Used to silently acquire a new access token (from the cache or the network).
-         */
-        PerformanceEvents["AcquireTokenSilent"] = "acquireTokenSilent";
-        /**
-         * acquireTokenSilentAsync (msal-browser).
-         * Internal API for acquireTokenSilent.
-         */
-        PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
+    var PerformanceClient = /** @class */ (function () {
         /**
-         * acquireTokenPopup (msal-browser).
-         * Used to acquire a new access token interactively through pop ups
+         * Creates an instance of PerformanceClient,
+         * an abstract class containing core performance telemetry logic.
+         *
+         * @constructor
+         * @param {string} clientId Client ID of the application
+         * @param {string} authority Authority used by the application
+         * @param {Logger} logger Logger used by the application
+         * @param {string} libraryName Name of the library
+         * @param {string} libraryVersion Version of the library
          */
-        PerformanceEvents["AcquireTokenPopup"] = "acquireTokenPopup";
+        function PerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
+            this.authority = authority;
+            this.libraryName = libraryName;
+            this.libraryVersion = libraryVersion;
+            this.applicationTelemetry = applicationTelemetry;
+            this.clientId = clientId;
+            this.logger = logger;
+            this.callbacks = new Map();
+            this.eventsByCorrelationId = new Map();
+            this.measurementsById = new Map();
+        }
         /**
-         * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
-         * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
-         */
-        PerformanceEvents["CryptoOptsGetPublicKeyThumbprint"] = "cryptoOptsGetPublicKeyThumbprint";
-        /**
-         * signJwt API in CryptoOpts class (msal-browser).
-         * Used to signed a pop token.
-         */
-        PerformanceEvents["CryptoOptsSignJwt"] = "cryptoOptsSignJwt";
-        /**
-         * acquireToken API in the SilentCacheClient class (msal-browser).
-         * Used to read access tokens from the cache.
-         */
-        PerformanceEvents["SilentCacheClientAcquireToken"] = "silentCacheClientAcquireToken";
-        /**
-         * acquireToken API in the SilentIframeClient class (msal-browser).
-         * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
-         */
-        PerformanceEvents["SilentIframeClientAcquireToken"] = "silentIframeClientAcquireToken";
-        /**
-         * acquireToken API in SilentRereshClient (msal-browser).
-         * Used to acquire a new set of tokens from the token endpoint using a refresh token.
-         */
-        PerformanceEvents["SilentRefreshClientAcquireToken"] = "silentRefreshClientAcquireToken";
-        /**
-         * ssoSilent API (msal-browser).
-         * Used to silently acquire an authorization code and set of tokens using a hidden iframe.
-         */
-        PerformanceEvents["SsoSilent"] = "ssoSilent";
-        /**
-         * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
-         * Used to load authority metadata for a request.
-         */
-        PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
-        /**
-         * acquireToken APIs in msal-browser.
-         * Used to make an /authorize endpoint call with native brokering enabled.
-         */
-        PerformanceEvents["FetchAccountIdWithNativeBroker"] = "fetchAccountIdWithNativeBroker";
-        /**
-         * acquireToken API in NativeInteractionClient class (msal-browser).
-         * Used to acquire a token from Native component when native brokering is enabled.
-         */
-        PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
-    })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
-    /**
-     * State of the performance event.
-     *
-     * @export
-     * @enum {number}
-     */
-    var PerformanceEventStatus;
-    (function (PerformanceEventStatus) {
-        PerformanceEventStatus[PerformanceEventStatus["NotStarted"] = 0] = "NotStarted";
-        PerformanceEventStatus[PerformanceEventStatus["InProgress"] = 1] = "InProgress";
-        PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
-    })(PerformanceEventStatus || (PerformanceEventStatus = {}));
-
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    var PerformanceClient = /** @class */ (function () {
-        /**
-         * Creates an instance of PerformanceClient,
-         * an abstract class containing core performance telemetry logic.
-         *
-         * @constructor
-         * @param {string} clientId Client ID of the application
-         * @param {string} authority Authority used by the application
-         * @param {Logger} logger Logger used by the application
-         * @param {string} libraryName Name of the library
-         * @param {string} libraryVersion Version of the library
-         */
-        function PerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
-            this.authority = authority;
-            this.libraryName = libraryName;
-            this.libraryVersion = libraryVersion;
-            this.applicationTelemetry = applicationTelemetry;
-            this.clientId = clientId;
-            this.logger = logger;
-            this.callbacks = new Map();
-            this.eventsByCorrelationId = new Map();
-            this.measurementsById = new Map();
-        }
-        /**
-         * Starts measuring performance for a given operation. Returns a function that should be used to end the measurement.
-         *
-         * @param {PerformanceEvents} measureName
-         * @param {?string} [correlationId]
-         * @returns {InProgressPerformanceEvent}
+         * Starts measuring performance for a given operation. Returns a function that should be used to end the measurement.
+         *
+         * @param {PerformanceEvents} measureName
+         * @param {?string} [correlationId]
+         * @returns {InProgressPerformanceEvent}
          */
         PerformanceClient.prototype.startMeasurement = function (measureName, correlationId) {
             var _this = this;
@@ -7482,7 +7637,7 @@
                 clientId: this.clientId,
                 name: measureName,
                 startTimeMs: Date.now(),
-                correlationId: eventCorrelationId
+                correlationId: eventCorrelationId,
             };
             // Store in progress events so they can be discarded if not ended properly
             this.cacheEventByCorrelationId(inProgressEvent);
@@ -7627,6 +7782,12 @@
                             else {
                                 _this.logger.verbose("PerformanceClient: Submeasurement for " + measureName + " already exists for " + current.name + ", ignoring", correlationId);
                             }
+                            if (current.accessTokenSize) {
+                                previous.accessTokenSize = current.accessTokenSize;
+                            }
+                            if (current.idTokenSize) {
+                                previous.idTokenSize = current.idTokenSize;
+                            }
                         }
                         return previous;
                     }, topLevelEvent);
@@ -7694,7 +7855,7 @@
         return PerformanceClient;
     }());
 
-    /*! @azure/msal-common v7.1.0 2022-07-05 */
+    /*! @azure/msal-common v7.4.0 2022-09-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8914,26 +9075,57 @@
          * Gets the active account
          */
         BrowserCacheManager.prototype.getActiveAccount = function () {
-            var activeAccountIdKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
-            var activeAccountId = this.browserStorage.getItem(activeAccountIdKey);
-            if (!activeAccountId) {
+            var activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
+            var activeAccountValueFilters = this.getItem(activeAccountKeyFilters);
+            if (!activeAccountValueFilters) {
+                // if new active account cache type isn't found, it's an old version, so look for that instead
+                this.logger.trace("No active account filters cache schema found, looking for legacy schema");
+                var activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
+                var activeAccountValueLocal = this.getItem(activeAccountKeyLocal);
+                if (!activeAccountValueLocal) {
+                    this.logger.trace("No active account found");
+                    return null;
+                }
+                var activeAccount = this.getAccountInfoByFilter({ localAccountId: activeAccountValueLocal })[0] || null;
+                if (activeAccount) {
+                    this.logger.trace("Legacy active account cache schema found");
+                    this.logger.trace("Adding active account filters cache schema");
+                    this.setActiveAccount(activeAccount);
+                    return activeAccount;
+                }
                 return null;
             }
-            return this.getAccountInfoByFilter({ localAccountId: activeAccountId })[0] || null;
+            var activeAccountValueObj = this.validateAndParseJson(activeAccountValueFilters);
+            if (activeAccountValueObj) {
+                this.logger.trace("Active account filters schema found");
+                return this.getAccountInfoByFilter({
+                    homeAccountId: activeAccountValueObj.homeAccountId,
+                    localAccountId: activeAccountValueObj.localAccountId
+                })[0] || null;
+            }
+            this.logger.trace("No active account found");
+            return null;
         };
         /**
          * Sets the active account's localAccountId in cache
          * @param account
          */
         BrowserCacheManager.prototype.setActiveAccount = function (account) {
-            var activeAccountIdKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
+            var activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
+            var activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
             if (account) {
                 this.logger.verbose("setActiveAccount: Active account set");
-                this.browserStorage.setItem(activeAccountIdKey, account.localAccountId);
+                var activeAccountValue = {
+                    homeAccountId: account.homeAccountId,
+                    localAccountId: account.localAccountId
+                };
+                this.browserStorage.setItem(activeAccountKey, JSON.stringify(activeAccountValue));
+                this.browserStorage.setItem(activeAccountKeyLocal, account.localAccountId);
             }
             else {
                 this.logger.verbose("setActiveAccount: No account passed, active account not set");
-                this.browserStorage.removeItem(activeAccountIdKey);
+                this.browserStorage.removeItem(activeAccountKey);
+                this.browserStorage.removeItem(activeAccountKeyLocal);
             }
         };
         /**
@@ -9491,7 +9683,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.27.0";
+    var version = "2.28.2";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10040,8 +10232,7 @@
                                 protocolMode: this.config.auth.protocolMode,
                                 knownAuthorities: this.config.auth.knownAuthorities,
                                 cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-                                authorityMetadata: this.config.auth.authorityMetadata,
-                                skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
+                                authorityMetadata: this.config.auth.authorityMetadata
                             };
                             if (!requestAuthority) return [3 /*break*/, 2];
                             this.logger.verbose("Creating discovered authority with request authority");
@@ -10673,6 +10864,10 @@
         userSwitch: {
             code: "user_switch",
             desc: "User attempted to switch accounts in the native broker, which is not allowed. All new accounts must sign-in through the standard web flow first, please try again."
+        },
+        tokensNotFoundInCache: {
+            code: "tokens_not_found_in_internal_memory_cache",
+            desc: "Tokens not cached in MSAL JS internal memory, please make the WAM request"
         }
     };
     var NativeAuthError = /** @class */ (function (_super) {
@@ -10727,20 +10922,122 @@
         NativeAuthError.createUserSwitchError = function () {
             return new NativeAuthError(NativeAuthErrorMessage.userSwitch.code, NativeAuthErrorMessage.userSwitch.desc);
         };
+        /**
+         * Creates a tokens not found error when the internal cache look up fails
+         * @returns NativeAuthError: tokensNotFoundInCache
+         */
+        NativeAuthError.createTokensNotFoundInCacheError = function () {
+            return new NativeAuthError(NativeAuthErrorMessage.tokensNotFoundInCache.code, NativeAuthErrorMessage.tokensNotFoundInCache.desc);
+        };
         return NativeAuthError;
     }(AuthError));
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var SilentCacheClient = /** @class */ (function (_super) {
+        __extends$1(SilentCacheClient, _super);
+        function SilentCacheClient() {
+            return _super !== null && _super.apply(this, arguments) || this;
+        }
+        /**
+         * Returns unexpired tokens from the cache, if available
+         * @param silentRequest
+         */
+        SilentCacheClient.prototype.acquireToken = function (silentRequest) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var acquireTokenMeasurement, serverTelemetryManager, silentAuthClient, cachedToken, error_1;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            acquireTokenMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
+                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
+                            return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
+                        case 1:
+                            silentAuthClient = _a.sent();
+                            this.logger.verbose("Silent auth client created");
+                            _a.label = 2;
+                        case 2:
+                            _a.trys.push([2, 4, , 5]);
+                            return [4 /*yield*/, silentAuthClient.acquireCachedToken(silentRequest)];
+                        case 3:
+                            cachedToken = _a.sent();
+                            acquireTokenMeasurement.endMeasurement({
+                                success: true,
+                                fromCache: true
+                            });
+                            return [2 /*return*/, cachedToken];
+                        case 4:
+                            error_1 = _a.sent();
+                            if (error_1 instanceof BrowserAuthError && error_1.errorCode === BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
+                                this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
+                            }
+                            acquireTokenMeasurement.endMeasurement({
+                                errorCode: error_1 instanceof AuthError && error_1.errorCode || undefined,
+                                subErrorCode: error_1 instanceof AuthError && error_1.subError || undefined,
+                                success: false
+                            });
+                            throw error_1;
+                        case 5: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Currently Unsupported
+         */
+        SilentCacheClient.prototype.logout = function () {
+            // Synchronous so we must reject
+            return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
+        };
+        /**
+         * Creates an Silent Flow Client with the given authority, or the default authority.
+         * @param serverTelemetryManager
+         * @param authorityUrl
+         */
+        SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var clientConfig;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
+                        case 1:
+                            clientConfig = _a.sent();
+                            return [2 /*return*/, new SilentFlowClient(clientConfig, this.performanceClient)];
+                    }
+                });
+            });
+        };
+        SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var _a;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            _a = [__assign$1({}, request)];
+                            return [4 /*yield*/, this.initializeBaseRequest(request)];
+                        case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
+                    }
+                });
+            });
+        };
+        return SilentCacheClient;
+    }(StandardInteractionClient));
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     var NativeInteractionClient = /** @class */ (function (_super) {
         __extends$1(NativeInteractionClient, _super);
-        function NativeInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, correlationId) {
+        function NativeInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, nativeStorageImpl, correlationId) {
             var _this = _super.call(this, config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId) || this;
             _this.apiId = apiId;
             _this.accountId = accountId;
             _this.nativeMessageHandler = provider;
+            _this.nativeStorageManager = nativeStorageImpl;
+            _this.silentCacheClient = new SilentCacheClient(config, _this.nativeStorageManager, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
             return _this;
         }
         /**
@@ -10749,22 +11046,40 @@
          */
         NativeInteractionClient.prototype.acquireToken = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var nativeATMeasurement, nativeRequest, messageBody, reqTimestamp, response, validatedResponse;
+                var nativeATMeasurement, reqTimestamp, nativeRequest, result, messageBody, response, validatedResponse;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             this.logger.trace("NativeInteractionClient - acquireToken called.");
                             nativeATMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.NativeInteractionClientAcquireToken, request.correlationId);
+                            reqTimestamp = TimeUtils.nowSeconds();
                             return [4 /*yield*/, this.initializeNativeRequest(request)];
                         case 1:
                             nativeRequest = _a.sent();
+                            _a.label = 2;
+                        case 2:
+                            _a.trys.push([2, 4, , 5]);
+                            return [4 /*yield*/, this.acquireTokensFromCache(this.accountId, nativeRequest)];
+                        case 3:
+                            result = _a.sent();
+                            nativeATMeasurement.endMeasurement({
+                                success: true,
+                                isNativeBroker: true,
+                                fromCache: true
+                            });
+                            return [2 /*return*/, result];
+                        case 4:
+                            _a.sent();
+                            // continue with a native call for any and all errors
+                            this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
+                            return [3 /*break*/, 5];
+                        case 5:
                             messageBody = {
                                 method: NativeExtensionMethod.GetToken,
                                 request: nativeRequest
                             };
-                            reqTimestamp = TimeUtils.nowSeconds();
                             return [4 /*yield*/, this.nativeMessageHandler.sendMessage(messageBody)];
-                        case 2:
+                        case 6:
                             response = _a.sent();
                             validatedResponse = this.validateNativeResponse(response);
                             return [2 /*return*/, this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp)
@@ -10788,13 +11103,61 @@
                 });
             });
         };
+        /**
+         * Creates silent flow request
+         * @param request
+         * @param cachedAccount
+         * @returns CommonSilentFlowRequest
+         */
+        NativeInteractionClient.prototype.createSilentCacheRequest = function (request, cachedAccount) {
+            return {
+                authority: request.authority,
+                correlationId: this.correlationId,
+                scopes: ScopeSet.fromString(request.scope).asArray(),
+                account: cachedAccount,
+                forceRefresh: false,
+            };
+        };
+        /**
+         * Fetches the tokens from the cache if un-expired
+         * @param nativeAccountId
+         * @param request
+         * @returns authenticationResult
+         */
+        NativeInteractionClient.prototype.acquireTokensFromCache = function (nativeAccountId, request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var accountEntity, account, silentRequest, result, e_2;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            accountEntity = this.browserStorage.readAccountFromCacheWithNativeAccountId(nativeAccountId);
+                            if (!accountEntity) {
+                                throw ClientAuthError.createNoAccountFoundError();
+                            }
+                            account = accountEntity.getAccountInfo();
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            silentRequest = this.createSilentCacheRequest(request, account);
+                            return [4 /*yield*/, this.silentCacheClient.acquireToken(silentRequest)];
+                        case 2:
+                            result = _a.sent();
+                            return [2 /*return*/, result];
+                        case 3:
+                            e_2 = _a.sent();
+                            throw e_2;
+                        case 4: return [2 /*return*/];
+                    }
+                });
+            });
+        };
         /**
          * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
          * @param request
          */
         NativeInteractionClient.prototype.acquireTokenRedirect = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var nativeRequest, messageBody, response, e_1, navigationOptions, redirectUri;
+                var nativeRequest, messageBody, response, e_3, navigationOptions, redirectUri;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -10815,10 +11178,10 @@
                             this.validateNativeResponse(response);
                             return [3 /*break*/, 5];
                         case 4:
-                            e_1 = _a.sent();
+                            e_3 = _a.sent();
                             // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
-                            if (e_1 instanceof NativeAuthError && e_1.isFatal()) {
-                                throw e_1;
+                            if (e_3 instanceof NativeAuthError && e_3.isFatal()) {
+                                throw e_3;
                             }
                             return [3 /*break*/, 5];
                         case 5:
@@ -10842,7 +11205,7 @@
          */
         NativeInteractionClient.prototype.handleRedirectPromise = function () {
             return __awaiter$1(this, void 0, void 0, function () {
-                var cachedRequest, messageBody, reqTimestamp, response, result, e_2;
+                var cachedRequest, messageBody, reqTimestamp, response, result, e_4;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -10874,9 +11237,9 @@
                             this.browserStorage.setInteractionInProgress(false);
                             return [2 /*return*/, result];
                         case 3:
-                            e_2 = _a.sent();
+                            e_4 = _a.sent();
                             this.browserStorage.setInteractionInProgress(false);
-                            throw e_2;
+                            throw e_4;
                         case 4: return [2 /*return*/];
                     }
                 });
@@ -10898,7 +11261,7 @@
          */
         NativeInteractionClient.prototype.handleNativeResponse = function (response, request, reqTimestamp) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var idTokenObj, authority, authorityPreferredCache, homeAccountIdentifier, accountEntity, responseScopes, accountProperties, uid, tid, responseAccessToken, responseTokenType, _a, popTokenGenerator, shrParameters, mats, result;
+                var idTokenObj, authority, authorityPreferredCache, homeAccountIdentifier, accountEntity, responseScopes, accountProperties, uid, tid, responseAccessToken, responseTokenType, _a, popTokenGenerator, shrParameters, mats, result, idTokenEntity, expiresIn, tokenExpirationSeconds, accessTokenEntity;
                 var _this = this;
                 return __generator$1(this, function (_b) {
                     switch (_b.label) {
@@ -10916,7 +11279,7 @@
                             homeAccountIdentifier = AccountEntity.generateHomeAccountId(response.client_info || Constants.EMPTY_STRING, AuthorityType.Default, this.logger, this.browserCrypto, idTokenObj);
                             accountEntity = AccountEntity.createAccount(response.client_info, homeAccountIdentifier, idTokenObj, undefined, undefined, undefined, authorityPreferredCache, response.account.id);
                             this.browserStorage.setAccount(accountEntity);
-                            responseScopes = response.scopes ? ScopeSet.fromString(response.scopes) : ScopeSet.fromString(request.scopes);
+                            responseScopes = response.scope ? ScopeSet.fromString(response.scope) : ScopeSet.fromString(request.scope);
                             accountProperties = response.account.properties || {};
                             uid = accountProperties["UID"] || idTokenObj.claims.oid || idTokenObj.claims.sub || Constants.EMPTY_STRING;
                             tid = accountProperties["TenantId"] || idTokenObj.claims.tid || Constants.EMPTY_STRING;
@@ -10976,7 +11339,17 @@
                                 state: response.state,
                                 fromNativeBroker: true
                             };
-                            // Remove any existing cached tokens for this account
+                            idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || Constants.EMPTY_STRING, request.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+                            this.nativeStorageManager.setIdTokenCredential(idTokenEntity);
+                            expiresIn = (responseTokenType === exports.AuthenticationScheme.POP)
+                                ? Constants.SHR_NONCE_VALIDITY
+                                : (typeof response.expires_in === "string"
+                                    ? parseInt(response.expires_in, 10)
+                                    : response.expires_in) || 0;
+                            tokenExpirationSeconds = reqTimestamp + expiresIn;
+                            accessTokenEntity = AccessTokenEntity.createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, tid, responseScopes.printScopes(), tokenExpirationSeconds, 0, this.browserCrypto);
+                            this.nativeStorageManager.setAccessTokenCredential(accessTokenEntity);
+                            // Remove any existing cached tokens for this account in browser storage
                             this.browserStorage.removeAccountContext(accountEntity).catch(function (e) {
                                 _this.logger.error("Error occurred while removing account context from browser storage. " + e);
                             });
@@ -10994,7 +11367,7 @@
                 response.hasOwnProperty("id_token") &&
                 response.hasOwnProperty("client_info") &&
                 response.hasOwnProperty("account") &&
-                response.hasOwnProperty("scopes") &&
+                response.hasOwnProperty("scope") &&
                 response.hasOwnProperty("expires_in")) {
                 return response;
             }
@@ -11036,7 +11409,7 @@
          */
         NativeInteractionClient.prototype.initializeNativeRequest = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var authority, canonicalAuthority, scopes, scopeSet, getPrompt, validatedRequest, shrParameters, popTokenGenerator, reqCnfData;
+                var authority, canonicalAuthority, scopes, remainingProperties, scopeSet, getPrompt, validatedRequest, shrParameters, popTokenGenerator, reqCnfData;
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
@@ -11045,8 +11418,8 @@
                             authority = request.authority || this.config.auth.authority;
                             canonicalAuthority = new UrlString(authority);
                             canonicalAuthority.validateAsUri();
-                            scopes = request && request.scopes || [];
-                            scopeSet = new ScopeSet(scopes);
+                            scopes = request.scopes, remainingProperties = __rest(request, ["scopes"]);
+                            scopeSet = new ScopeSet(scopes || []);
                             scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
                             getPrompt = function () {
                                 // If request is silent, prompt is always none
@@ -11073,7 +11446,7 @@
                                         throw BrowserAuthError.createNativePromptParameterNotSupportedError();
                                 }
                             };
-                            validatedRequest = __assign$1(__assign$1({}, request), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scopes: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), prompt: getPrompt(), correlationId: this.correlationId, tokenType: request.authenticationScheme, windowTitleSubstring: document.title, extraParameters: __assign$1(__assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), { telemetry: NativeConstants.MATS_TELEMETRY }), extendedExpiryToken: false // Make this configurable?
+                            validatedRequest = __assign$1(__assign$1({}, remainingProperties), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scope: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), prompt: getPrompt(), correlationId: this.correlationId, tokenType: request.authenticationScheme, windowTitleSubstring: document.title, extraParameters: __assign$1(__assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), { telemetry: NativeConstants.MATS_TELEMETRY }), extendedExpiryToken: false // Make this configurable?
                              });
                             if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                             shrParameters = {
@@ -11340,8 +11713,10 @@
      */
     var RedirectClient = /** @class */ (function (_super) {
         __extends$1(RedirectClient, _super);
-        function RedirectClient() {
-            return _super !== null && _super.apply(this, arguments) || this;
+        function RedirectClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, nativeMessageHandler, correlationId) {
+            var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
+            _this.nativeStorage = nativeStorageImpl;
+            return _this;
         }
         /**
          * Redirects the page to the /authorize endpoint of the IDP
@@ -11550,7 +11925,7 @@
                                 if (!this.nativeMessageHandler) {
                                     throw BrowserAuthError.createNativeConnectionNotEstablishedError();
                                 }
-                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, cachedRequest.correlationId);
+                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.browserStorage, cachedRequest.correlationId);
                                 userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
                                 return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, cachedRequest), { state: userRequestState, prompt: undefined // Server should handle the prompt, ideally native broker can do this part silently
                                      })).finally(function () {
@@ -11668,10 +12043,11 @@
      */
     var PopupClient = /** @class */ (function (_super) {
         __extends$1(PopupClient, _super);
-        function PopupClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) {
+        function PopupClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, nativeMessageHandler, correlationId) {
             var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
             // Properly sets this reference for the unload event.
             _this.unloadWindow = _this.unloadWindow.bind(_this);
+            _this.nativeStorage = nativeStorageImpl;
             return _this;
         }
         /**
@@ -11796,7 +12172,7 @@
                                 if (!this.nativeMessageHandler) {
                                     throw BrowserAuthError.createNativeConnectionNotEstablishedError();
                                 }
-                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, validRequest.correlationId);
+                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenPopup, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.nativeStorage, validRequest.correlationId);
                                 userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state_1).userRequestState;
                                 return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, validRequest), { state: userRequestState, prompt: undefined // Server should handle the prompt, ideally native broker can do this part silently
                                      })).finally(function () {
@@ -12424,9 +12800,10 @@
      */
     var SilentIframeClient = /** @class */ (function (_super) {
         __extends$1(SilentIframeClient, _super);
-        function SilentIframeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeMessageHandler, correlationId) {
+        function SilentIframeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, nativeMessageHandler, correlationId) {
             var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
             _this.apiId = apiId;
+            _this.nativeStorage = nativeStorageImpl;
             return _this;
         }
         /**
@@ -12529,7 +12906,7 @@
                                 if (!this.nativeMessageHandler) {
                                     throw BrowserAuthError.createNativeConnectionNotEstablishedError();
                                 }
-                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.correlationId);
+                                nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.browserStorage, this.correlationId);
                                 userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
                                 return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: PromptValue.NONE })).finally(function () {
                                         _this.browserStorage.cleanRequestByState(state);
@@ -12544,99 +12921,6 @@
         return SilentIframeClient;
     }(StandardInteractionClient));
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    var SilentCacheClient = /** @class */ (function (_super) {
-        __extends$1(SilentCacheClient, _super);
-        function SilentCacheClient() {
-            return _super !== null && _super.apply(this, arguments) || this;
-        }
-        /**
-         * Returns unexpired tokens from the cache, if available
-         * @param silentRequest
-         */
-        SilentCacheClient.prototype.acquireToken = function (silentRequest) {
-            return __awaiter$1(this, void 0, void 0, function () {
-                var acquireTokenMeasurement, serverTelemetryManager, silentAuthClient, cachedToken, error_1;
-                return __generator$1(this, function (_a) {
-                    switch (_a.label) {
-                        case 0:
-                            acquireTokenMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SilentCacheClientAcquireToken, silentRequest.correlationId);
-                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
-                            return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
-                        case 1:
-                            silentAuthClient = _a.sent();
-                            this.logger.verbose("Silent auth client created");
-                            _a.label = 2;
-                        case 2:
-                            _a.trys.push([2, 4, , 5]);
-                            return [4 /*yield*/, silentAuthClient.acquireCachedToken(silentRequest)];
-                        case 3:
-                            cachedToken = _a.sent();
-                            acquireTokenMeasurement.endMeasurement({
-                                success: true,
-                                fromCache: true
-                            });
-                            return [2 /*return*/, cachedToken];
-                        case 4:
-                            error_1 = _a.sent();
-                            if (error_1 instanceof BrowserAuthError && error_1.errorCode === BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code) {
-                                this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair.");
-                            }
-                            acquireTokenMeasurement.endMeasurement({
-                                errorCode: error_1 instanceof AuthError && error_1.errorCode || undefined,
-                                subErrorCode: error_1 instanceof AuthError && error_1.subError || undefined,
-                                success: false
-                            });
-                            throw error_1;
-                        case 5: return [2 /*return*/];
-                    }
-                });
-            });
-        };
-        /**
-         * Currently Unsupported
-         */
-        SilentCacheClient.prototype.logout = function () {
-            // Synchronous so we must reject
-            return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
-        };
-        /**
-         * Creates an Silent Flow Client with the given authority, or the default authority.
-         * @param serverTelemetryManager
-         * @param authorityUrl
-         */
-        SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
-            return __awaiter$1(this, void 0, void 0, function () {
-                var clientConfig;
-                return __generator$1(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
-                        case 1:
-                            clientConfig = _a.sent();
-                            return [2 /*return*/, new SilentFlowClient(clientConfig)];
-                    }
-                });
-            });
-        };
-        SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
-            return __awaiter$1(this, void 0, void 0, function () {
-                var _a;
-                return __generator$1(this, function (_b) {
-                    switch (_b.label) {
-                        case 0:
-                            _a = [__assign$1({}, request)];
-                            return [4 /*yield*/, this.initializeBaseRequest(request)];
-                        case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
-                    }
-                });
-            });
-        };
-        return SilentCacheClient;
-    }(StandardInteractionClient));
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -12712,7 +12996,7 @@
                         case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
                         case 1:
                             clientConfig = _a.sent();
-                            return [2 /*return*/, new RefreshTokenClient(clientConfig)];
+                            return [2 /*return*/, new RefreshTokenClient(clientConfig, this.performanceClient)];
                     }
                 });
             });
@@ -14654,6 +14938,13 @@
             this.browserStorage = this.isBrowserEnvironment ?
                 new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger) :
                 DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
+            // initialize in memory storage for native flows
+            var nativeCacheOptions = {
+                cacheLocation: exports.BrowserCacheLocation.MemoryStorage,
+                storeAuthStateInCookie: false,
+                secureCookies: false
+            };
+            this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger);
             // Initialize the token cache
             this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto);
         }
@@ -14720,7 +15011,7 @@
                             redirectResponse = void 0;
                             if (request && NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) && this.nativeExtensionProvider && !hash) {
                                 this.logger.trace("handleRedirectPromise - acquiring token from native platform");
-                                nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, request.correlationId);
+                                nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, this.nativeInternalStorage, request.correlationId);
                                 redirectResponse = nativeClient.handleRedirectPromise();
                             }
                             else {
@@ -14792,7 +15083,7 @@
                         this.eventHandler.emitEvent(exports.EventType.LOGIN_START, exports.InteractionType.Redirect, request);
                     }
                     if (this.nativeExtensionProvider && this.canUseNative(request)) {
-                        nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), request.correlationId);
+                        nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
                         result = nativeClient.acquireTokenRedirect(request).catch(function (e) {
                             if (e instanceof NativeAuthError && e.isFatal()) {
                                 _this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
@@ -14860,7 +15151,9 @@
                     _this.browserStorage.setInteractionInProgress(false);
                     atPopupMeasurement.endMeasurement({
                         success: true,
-                        isNativeBroker: true
+                        isNativeBroker: true,
+                        accessTokenSize: response.accessToken.length,
+                        idTokenSize: response.idToken.length,
                     });
                     atPopupMeasurement.flushMeasurement();
                     return response;
@@ -14884,7 +15177,9 @@
                 result = popupClient.acquireToken(request);
             }
             return result.then(function (result) {
-                // If logged in, emit acquire token events
+                /*
+                 *  If logged in, emit acquire token events
+                 */
                 var isLoggingIn = loggedInAccounts.length < _this.getAllAccounts().length;
                 if (isLoggingIn) {
                     _this.eventHandler.emitEvent(exports.EventType.LOGIN_SUCCESS, exports.InteractionType.Popup, result);
@@ -14893,7 +15188,9 @@
                     _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Popup, result);
                 }
                 atPopupMeasurement.endMeasurement({
-                    success: true
+                    success: true,
+                    accessTokenSize: result.accessToken.length,
+                    idTokenSize: result.idToken.length,
                 });
                 atPopupMeasurement.flushMeasurement();
                 return result;
@@ -14961,7 +15258,9 @@
                             _this.eventHandler.emitEvent(exports.EventType.SSO_SILENT_SUCCESS, exports.InteractionType.Silent, response);
                             ssoSilentMeasurement.endMeasurement({
                                 success: true,
-                                isNativeBroker: response.fromNativeBroker
+                                isNativeBroker: response.fromNativeBroker,
+                                accessTokenSize: response.accessToken.length,
+                                idTokenSize: response.idToken.length
                             });
                             ssoSilentMeasurement.flushMeasurement();
                             return response;
@@ -15010,6 +15309,8 @@
                                     _this.hybridAuthCodeResponses.delete(hybridAuthCode_1);
                                     atbcMeasurement.endMeasurement({
                                         success: true,
+                                        accessTokenSize: result.accessToken.length,
+                                        idTokenSize: result.idToken.length,
                                         isNativeBroker: result.fromNativeBroker
                                     });
                                     atbcMeasurement.flushMeasurement();
@@ -15114,7 +15415,9 @@
                             .then(function (result) {
                             atbrtMeasurement.endMeasurement({
                                 success: true,
-                                fromCache: result.fromCache
+                                fromCache: result.fromCache,
+                                accessTokenSize: result.accessToken.length,
+                                idTokenSize: result.idToken.length,
                             });
                             return result;
                         })
@@ -15129,7 +15432,9 @@
                                     .then(function (result) {
                                     atbrtMeasurement.endMeasurement({
                                         success: true,
-                                        fromCache: result.fromCache
+                                        fromCache: result.fromCache,
+                                        accessTokenSize: result.accessToken.length,
+                                        idTokenSize: result.idToken.length,
                                     });
                                     return result;
                                 })
@@ -15341,7 +15646,7 @@
                     if (!this.nativeExtensionProvider) {
                         throw BrowserAuthError.createNativeConnectionNotEstablishedError();
                     }
-                    nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.nativeExtensionProvider, accountId || this.getNativeAccountId(request), request.correlationId);
+                    nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.nativeExtensionProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
                     return [2 /*return*/, nativeClient.acquireToken(request)];
                 });
             });
@@ -15388,21 +15693,21 @@
          * @param correlationId
          */
         ClientApplication.prototype.createPopupClient = function (correlationId) {
-            return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+            return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, this.nativeExtensionProvider, correlationId);
         };
         /**
          * Returns new instance of the Redirect Interaction Client
          * @param correlationId
          */
         ClientApplication.prototype.createRedirectClient = function (correlationId) {
-            return new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeExtensionProvider, correlationId);
+            return new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, this.nativeExtensionProvider, correlationId);
         };
         /**
          * Returns new instance of the Silent Iframe Interaction Client
          * @param correlationId
          */
         ClientApplication.prototype.createSilentIframeClient = function (correlationId) {
-            return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.ssoSilent, this.performanceClient, this.nativeExtensionProvider, correlationId);
+            return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, this.nativeExtensionProvider, correlationId);
         };
         /**
          * Returns new instance of the Silent Cache Interaction Client
@@ -15638,6 +15943,8 @@
                             atsMeasurement.endMeasurement({
                                 success: true,
                                 fromCache: result.fromCache,
+                                accessTokenSize: result.accessToken.length,
+                                idTokenSize: result.idToken.length,
                                 isNativeBroker: result.fromNativeBroker
                             });
                             atsMeasurement.flushMeasurement();
@@ -15646,8 +15953,6 @@
                             .catch(function (error) {
                             _this.activeSilentTokenRequests.delete(silentRequestKey);
                             atsMeasurement.endMeasurement({
-                                errorCode: error.errorCode,
-                                subErrorCode: error.subError,
                                 success: false
                             });
                             atsMeasurement.flushMeasurement();
@@ -15717,6 +16022,8 @@
                                 astsAsyncMeasurement.endMeasurement({
                                     success: true,
                                     fromCache: response.fromCache,
+                                    accessTokenSize: response.accessToken.length,
+                                    idTokenSize: response.idToken.length,
                                     isNativeBroker: response.fromNativeBroker
                                 });
                                 return response;