@azure/msal-browser 2.28.2 → 2.29.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.28.2 2022-09-06 */
+/*! @azure/msal-browser v2.29.0 2022-10-03 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -119,7 +119,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -206,7 +206,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -223,6 +223,7 @@
         DEFAULT_COMMON_TENANT: "common",
         // ADFS String
         ADFS: "adfs",
+        DSTS: "dstsv2",
         // Default AAD Instance Discovery Endpoint
         AAD_INSTANCE_DISCOVERY_ENDPT: "https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",
         // Resource delimiter - used for certain cache entries
@@ -254,6 +255,7 @@
         IMDS_TIMEOUT: 2000,
         AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
         REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
+        REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
         KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
         TOKEN_RESPONSE_TYPE: "token",
         ID_TOKEN_RESPONSE_TYPE: "id_token",
@@ -277,6 +279,7 @@
         HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
         HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
         HeaderNames["AuthenticationInfo"] = "Authentication-Info";
+        HeaderNames["X_MS_REQUEST_ID"] = "x-ms-request-id";
     })(HeaderNames || (HeaderNames = {}));
     /**
      * Persistent cache keys MSAL which stay while user is logged in.
@@ -372,7 +375,8 @@
         SELECT_ACCOUNT: "select_account",
         CONSENT: "consent",
         NONE: "none",
-        CREATE: "create"
+        CREATE: "create",
+        NO_SESSION: "no_session"
     };
     /**
      * SSO Types - generated to populate hints
@@ -583,7 +587,7 @@
         JsonTypes["Jwk"] = "JWK";
     })(JsonTypes || (JsonTypes = {}));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -639,7 +643,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -714,7 +718,7 @@
         }
     };
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -780,6 +784,16 @@
             code: "nonce_not_found",
             desc: "nonce not found"
         },
+        authTimeNotFoundError: {
+            code: "auth_time_not_found",
+            desc: "Max Age was requested and the ID token is missing the auth_time variable." +
+                " auth_time is an optional claim and is not enabled by default - it must be enabled." +
+                " See https://aka.ms/msaljs/optional-claims for more information."
+        },
+        maxAgeTranspiredError: {
+            code: "max_age_transpired",
+            desc: "Max Age is set to 0, or too much time has elapsed since the last end-user authentication."
+        },
         noTokensFoundError: {
             code: "no_tokens_found",
             desc: "No tokens were found for the given scopes, and no authorization code was passed to acquireToken. You must retrieve an authorization code before making a call to acquireToken()."
@@ -1000,6 +1014,19 @@
         ClientAuthError.createNonceMismatchError = function () {
             return new ClientAuthError(ClientAuthErrorMessage.nonceMismatchError.code, ClientAuthErrorMessage.nonceMismatchError.desc);
         };
+        /**
+         * Creates an error thrown when max_age was provided in the request, but auth_time is not in the token claims
+         * @param missingNonce
+         */
+        ClientAuthError.createAuthTimeNotFoundError = function () {
+            return new ClientAuthError(ClientAuthErrorMessage.authTimeNotFoundError.code, ClientAuthErrorMessage.authTimeNotFoundError.desc);
+        };
+        /**
+         * Creates an error thrown when too much time has elapsed since the last end-user authentication
+         */
+        ClientAuthError.createMaxAgeTranspiredError = function () {
+            return new ClientAuthError(ClientAuthErrorMessage.maxAgeTranspiredError.code, ClientAuthErrorMessage.maxAgeTranspiredError.desc);
+        };
         /**
          * Creates an error thrown when the mnonce is not present
          * @param missingNonce
@@ -1186,7 +1213,7 @@
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1311,7 +1338,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1491,12 +1518,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "7.4.0";
+    var version$1 = "7.5.0";
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1517,7 +1544,7 @@
         AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
     })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1676,7 +1703,7 @@
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1724,7 +1751,7 @@
         },
         invalidPrompt: {
             code: "invalid_prompt_value",
-            desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create' and 'none'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
+            desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create', 'none' and 'no_session'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
         },
         invalidClaimsRequest: {
             code: "invalid_claims",
@@ -1931,7 +1958,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2115,7 +2142,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2153,7 +2180,7 @@
         };
     }
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2165,9 +2192,10 @@
     (function (AuthorityType) {
         AuthorityType[AuthorityType["Default"] = 0] = "Default";
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
+        AuthorityType[AuthorityType["Dsts"] = 2] = "Dsts";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2289,10 +2317,13 @@
                 // How do you account for MSA CID here?
                 account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || Constants.EMPTY_STRING;
                 /*
-                 * In B2C scenarios the emails claim is used instead of preferred_username and it is an array. In most cases it will contain a single email.
-                 * This field should not be relied upon if a custom policy is configured to return more than 1 email.
+                 * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+                 * In most cases it will contain a single email. This field should not be relied upon if a custom
+                 * policy is configured to return more than 1 email.
                  */
-                account.username = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username) || (((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : Constants.EMPTY_STRING);
+                var preferredUsername = (_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username;
+                var email = ((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : null;
+                account.username = preferredUsername || email || Constants.EMPTY_STRING;
                 account.name = (_f = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _f === void 0 ? void 0 : _f.name;
             }
             account.cloudGraphHostName = cloudGraphHostName;
@@ -2307,7 +2338,8 @@
         AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
             var _a, _b, _c, _d;
             var account = new AccountEntity();
-            account.authorityType = (authority && authority.authorityType === AuthorityType.Adfs) ? CacheAccountType.ADFS_ACCOUNT_TYPE : CacheAccountType.GENERIC_ACCOUNT_TYPE;
+            account.authorityType = (authority &&
+                authority.authorityType === AuthorityType.Adfs) ? CacheAccountType.ADFS_ACCOUNT_TYPE : CacheAccountType.GENERIC_ACCOUNT_TYPE;
             account.homeAccountId = homeAccountId;
             // non AAD scenarios can have empty realm
             account.realm = Constants.EMPTY_STRING;
@@ -2341,7 +2373,7 @@
             var _a;
             var accountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.sub) ? idToken.claims.sub : Constants.EMPTY_STRING;
             // since ADFS does not have tid and does not set client_info
-            if (authType === AuthorityType.Adfs) {
+            if (authType === AuthorityType.Adfs || authType === AuthorityType.Dsts) {
                 return accountId;
             }
             // for cases where there is clientInfo
@@ -2402,7 +2434,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2437,10 +2469,24 @@
                 throw ClientAuthError.createTokenParsingError(err);
             }
         };
+        /**
+         * Determine if the token's max_age has transpired
+         */
+        AuthToken.checkMaxAge = function (authTime, maxAge) {
+            /*
+             * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+             * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
+             * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
+             */
+            var fiveMinuteSkew = 300000; // five minutes in milliseconds
+            if ((maxAge === 0) || ((Date.now() - fiveMinuteSkew) > (authTime + maxAge))) {
+                throw ClientAuthError.createMaxAgeTranspiredError();
+            }
+        };
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3315,7 +3361,7 @@
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3409,7 +3455,7 @@
         return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS, skipAuthorityMetadataCache: false }, authOptions);
     }
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3429,7 +3475,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3525,7 +3571,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3574,7 +3620,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3585,7 +3631,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3676,7 +3722,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3762,7 +3808,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4140,7 +4186,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4204,7 +4250,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4254,7 +4300,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4368,7 +4414,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4435,7 +4481,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4510,7 +4556,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4526,7 +4572,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4597,7 +4643,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4831,7 +4877,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4932,7 +4978,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5002,7 +5048,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5038,7 +5084,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5099,9 +5145,9 @@
          * @param serverTokenResponse
          * @param authority
          */
-        ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse) {
+        ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
             return __awaiter(this, void 0, void 0, function () {
-                var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
+                var idTokenObj, authTime, requestStateObj, cacheRecord, cacheContext, key, account;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -5113,6 +5159,14 @@
                                         throw ClientAuthError.createNonceMismatchError();
                                     }
                                 }
+                                // token max_age check
+                                if (request.maxAge || (request.maxAge === 0)) {
+                                    authTime = idTokenObj.claims.auth_time;
+                                    if (!authTime) {
+                                        throw ClientAuthError.createAuthTimeNotFoundError();
+                                    }
+                                    AuthToken.checkMaxAge(authTime, request.maxAge);
+                                }
                             }
                             // generate homeAccountId
                             this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
@@ -5144,7 +5198,7 @@
                                 account = this.cacheStorage.getAccount(key);
                                 if (!account) {
                                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                                    return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined)];
+                                    return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId)];
                                 }
                             }
                             return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
@@ -5159,7 +5213,7 @@
                             _a.sent();
                             _a.label = 7;
                         case 7: return [7 /*endfinally*/];
-                        case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
+                        case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code, serverRequestId)];
                     }
                 });
             });
@@ -5245,7 +5299,7 @@
          * @param fromTokenCache
          * @param stateString
          */
-        ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
+        ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code, requestId) {
             var _a, _b, _c;
             return __awaiter(this, void 0, void 0, function () {
                 var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
@@ -5293,6 +5347,7 @@
                                     fromCache: fromTokenCache,
                                     expiresOn: expiresOn,
                                     correlationId: request.correlationId,
+                                    requestId: requestId || Constants.EMPTY_STRING,
                                     extExpiresOn: extExpiresOn,
                                     familyId: familyId,
                                     tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
@@ -5309,7 +5364,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5355,10 +5410,11 @@
          * @param request
          */
         AuthorizationCodeClient.prototype.acquireToken = function (request, authCodePayload) {
+            var _a;
             return __awaiter(this, void 0, void 0, function () {
-                var reqTimestamp, response, responseHandler;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var reqTimestamp, response, requestId, responseHandler;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             this.logger.info("in acquireToken call");
                             if (!request || StringUtils.isEmpty(request.code)) {
@@ -5367,12 +5423,13 @@
                             reqTimestamp = TimeUtils.nowSeconds();
                             return [4 /*yield*/, this.executeTokenRequest(this.authority, request)];
                         case 1:
-                            response = _a.sent();
+                            response = _b.sent();
+                            requestId = (_a = response.headers) === null || _a === void 0 ? void 0 : _a[HeaderNames.X_MS_REQUEST_ID];
                             responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                             // Validate response. This function throws a server error if an error is returned by the server.
                             responseHandler.validateTokenResponse(response.body);
-                            return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload)];
-                        case 2: return [2 /*return*/, _a.sent()];
+                            return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)];
+                        case 2: return [2 /*return*/, _b.sent()];
                     }
                 });
             });
@@ -5760,7 +5817,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5843,10 +5900,6 @@
          * Used to acquire a token from Native component when native brokering is enabled.
          */
         PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
-        /**
-         * Time spent on the network for refresh token acquisition
-         */
-        PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
         /**
          * Time spent creating default headers for requests to token endpoint
          */
@@ -5860,10 +5913,21 @@
          */
         PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
         /**
-         * acquireToken API in BrokerClientApplication.
-         * Used to acquire a token on behalf of the embedded application (PW-Broker).
+         * Time taken for token acquisition by broker
          */
         PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
+        /**
+         * Time spent on the network for refresh token acquisition
+         */
+        PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
+        /**
+         * Time taken for acquiring refresh token , records RT size
+         */
+        PerformanceEvents["RefreshTokenClientAcquireToken"] = "refreshTokenClientAcquireToken";
+        /**
+         * Time taken for acquiring cached refresh token
+         */
+        PerformanceEvents["RefreshTokenClientAcquireTokenWithCachedRefreshToken"] = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
     })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
     /**
      * State of the performance event.
@@ -5878,7 +5942,7 @@
         PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
     })(PerformanceEventStatus || (PerformanceEventStatus = {}));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5893,18 +5957,40 @@
             return _super.call(this, configuration, performanceClient) || this;
         }
         RefreshTokenClient.prototype.acquireToken = function (request) {
+            var _a, _b;
             return __awaiter(this, void 0, void 0, function () {
-                var reqTimestamp, response, responseHandler;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var atsMeasurement, reqTimestamp, response, requestId, responseHandler;
+                var _this = this;
+                return __generator(this, function (_c) {
+                    switch (_c.label) {
                         case 0:
+                            atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
+                            this.logger.verbose("RefreshTokenClientAcquireToken called", request.correlationId);
                             reqTimestamp = TimeUtils.nowSeconds();
                             return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
                         case 1:
-                            response = _a.sent();
+                            response = _c.sent();
+                            requestId = (_b = response.headers) === null || _b === void 0 ? void 0 : _b[HeaderNames.X_MS_REQUEST_ID];
                             responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                             responseHandler.validateTokenResponse(response.body);
-                            return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache)];
+                            return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId).then(function (result) {
+                                    var _a;
+                                    atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                        success: true,
+                                        refreshTokenSize: ((_a = response.body.refresh_token) === null || _a === void 0 ? void 0 : _a.length) || 0
+                                    });
+                                    return result;
+                                })
+                                    .catch(function (error) {
+                                    _this.logger.verbose("Error in fetching refresh token", request.correlationId);
+                                    atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                        errorCode: error.errorCode,
+                                        subErrorCode: error.subError,
+                                        success: false,
+                                        refreshTokenSize: undefined
+                                    });
+                                    throw error;
+                                })];
                     }
                 });
             });
@@ -5954,14 +6040,21 @@
          * @param request
          */
         RefreshTokenClient.prototype.acquireTokenWithCachedRefreshToken = function (request, foci) {
+            var _a;
             return __awaiter(this, void 0, void 0, function () {
-                var refreshToken, refreshTokenRequest;
-                return __generator(this, function (_a) {
+                var atsMeasurement, refreshToken, refreshTokenRequest;
+                return __generator(this, function (_b) {
+                    atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
+                    this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
                     refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
-                    // no refresh Token
                     if (!refreshToken) {
+                        atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.discardMeasurement();
                         throw InteractionRequiredAuthError.createNoTokensFoundError();
                     }
+                    // attach cached RT size to the current measurement
+                    atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                        success: true
+                    });
                     refreshTokenRequest = __assign(__assign({}, request), { refreshToken: refreshToken.secret, authenticationScheme: request.authenticationScheme || exports.AuthenticationScheme.BEARER, ccsCredential: {
                             credential: request.account.homeAccountId,
                             type: CcsCredentialType.HOME_ACCOUNT_ID
@@ -6114,7 +6207,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6214,13 +6307,21 @@
          */
         SilentFlowClient.prototype.generateResultFromCacheRecord = function (cacheRecord, request) {
             return __awaiter(this, void 0, void 0, function () {
-                var idTokenObj;
+                var idTokenObj, authTime;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             if (cacheRecord.idToken) {
                                 idTokenObj = new AuthToken(cacheRecord.idToken.secret, this.config.cryptoInterface);
                             }
+                            // token max_age check
+                            if (request.maxAge || (request.maxAge === 0)) {
+                                authTime = idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.auth_time;
+                                if (!authTime) {
+                                    throw ClientAuthError.createAuthTimeNotFoundError();
+                                }
+                                AuthToken.checkMaxAge(authTime, request.maxAge);
+                            }
                             return [4 /*yield*/, ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenObj)];
                         case 1: return [2 /*return*/, _a.sent()];
                     }
@@ -6230,7 +6331,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6242,7 +6343,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6251,7 +6352,7 @@
     var EndpointMetadata = rawMetdataJSON.endpointMetadata;
     var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6265,7 +6366,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6342,7 +6443,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6352,7 +6453,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6474,7 +6575,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6499,8 +6600,13 @@
             // See above for AuthorityType
             get: function () {
                 var pathSegments = this.canonicalAuthorityUrlComponents.PathSegments;
-                if (pathSegments.length && pathSegments[0].toLowerCase() === Constants.ADFS) {
-                    return AuthorityType.Adfs;
+                if (pathSegments.length) {
+                    switch (pathSegments[0].toLowerCase()) {
+                        case Constants.ADFS:
+                            return AuthorityType.Adfs;
+                        case Constants.DSTS:
+                            return AuthorityType.Dsts;
+                    }
                 }
                 return AuthorityType.Default;
             },
@@ -6704,7 +6810,9 @@
              * The default open id configuration endpoint for any canonical authority.
              */
             get: function () {
-                if (this.authorityType === AuthorityType.Adfs || this.protocolMode === exports.ProtocolMode.OIDC) {
+                if (this.authorityType === AuthorityType.Adfs ||
+                    this.authorityType === AuthorityType.Dsts ||
+                    this.protocolMode === exports.ProtocolMode.OIDC) {
                     return this.canonicalAuthority + ".well-known/openid-configuration";
                 }
                 return this.canonicalAuthority + "v2.0/.well-known/openid-configuration";
@@ -6802,8 +6910,9 @@
             });
         };
         /**
-         * Compares the number of url components after the domain to determine if the cached authority metadata can be used for the requested authority
-         * Protects against same domain different authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
+         * Compares the number of url components after the domain to determine if the cached
+         * authority metadata can be used for the requested authority. Protects against same domain different
+         * authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
          * @param metadataEntity
          */
         Authority.prototype.isAuthoritySameType = function (metadataEntity) {
@@ -6843,7 +6952,8 @@
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, 3, , 4]);
-                            return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
+                            return [4 /*yield*/, this.networkInterface.
+                                    sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
                         case 2:
                             response = _a.sent();
                             return [2 /*return*/, isOpenIdConfigResponse(response.body) ? response.body : null];
@@ -6904,7 +7014,8 @@
             });
         };
         /**
-         * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from
+         * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
+         * and returns where the information was retrieved from
          * @param cachedMetadata
          * @param newMetadata
          */
@@ -7127,7 +7238,7 @@
         Authority.replaceWithRegionalInformation = function (metadata, azureRegion) {
             metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
             // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
-            metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
+            metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
             if (metadata.end_session_endpoint) {
                 metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
             }
@@ -7136,7 +7247,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7197,7 +7308,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7228,7 +7339,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7256,7 +7367,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7273,7 +7384,7 @@
         }
     };
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7318,7 +7429,7 @@
         return JoseHeaderError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7358,7 +7469,7 @@
         return JoseHeader;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7417,7 +7528,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7579,7 +7690,7 @@
         return ServerTelemetryManager;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7788,6 +7899,9 @@
                             if (current.idTokenSize) {
                                 previous.idTokenSize = current.idTokenSize;
                             }
+                            if (current.refreshTokenSize) {
+                                previous.refreshTokenSize = current.refreshTokenSize;
+                            }
                         }
                         return previous;
                     }, topLevelEvent);
@@ -7855,7 +7969,7 @@
         return PerformanceClient;
     }());
 
-    /*! @azure/msal-common v7.4.0 2022-09-06 */
+    /*! @azure/msal-common v7.5.0 2022-10-03 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7981,7 +8095,7 @@
         },
         silentPromptValueError: {
             code: "silent_prompt_value_error",
-            desc: "The value given for the prompt value is not valid for silent requests - must be set to 'none'."
+            desc: "The value given for the prompt value is not valid for silent requests - must be set to 'none' or 'no_session'."
         },
         noTokenRequestCacheError: {
             code: "no_token_request_cache_error",
@@ -8532,7 +8646,44 @@
     // DatabaseStorage Constants
     var DB_NAME = "msal.db";
     var DB_VERSION = 1;
-    var DB_TABLE_NAME = DB_NAME + ".keys";
+    var DB_TABLE_NAME = DB_NAME + ".keys";
+    exports.CacheLookupPolicy = void 0;
+    (function (CacheLookupPolicy) {
+        /*
+         * acquireTokenSilent will attempt to retrieve an access token from the cache. If the access token is expired
+         * or cannot be found the refresh token will be used to acquire a new one. Finally, if the refresh token
+         * is expired acquireTokenSilent will attempt to acquire new access and refresh tokens.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["Default"] = 0] = "Default";
+        /*
+         * acquireTokenSilent will only look for access tokens in the cache. It will not attempt to renew access or
+         * refresh tokens.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["AccessToken"] = 1] = "AccessToken";
+        /*
+         * acquireTokenSilent will attempt to retrieve an access token from the cache. If the access token is expired or
+         * cannot be found, the refresh token will be used to acquire a new one. If the refresh token is expired, it
+         * will not be renewed and acquireTokenSilent will fail.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["AccessTokenAndRefreshToken"] = 2] = "AccessTokenAndRefreshToken";
+        /*
+         * acquireTokenSilent will not attempt to retrieve access tokens from the cache and will instead attempt to
+         * exchange the cached refresh token for a new access token. If the refresh token is expired, it will not be
+         * renewed and acquireTokenSilent will fail.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["RefreshToken"] = 3] = "RefreshToken";
+        /*
+         * acquireTokenSilent will not look in the cache for the access token. It will go directly to network with the
+         * cached refresh token. If the refresh token is expired an attempt will be made to renew it. This is equivalent to
+         * setting "forceRefresh: true".
+         */
+        CacheLookupPolicy[CacheLookupPolicy["RefreshTokenAndNetwork"] = 4] = "RefreshTokenAndNetwork";
+        /*
+         * acquireTokenSilent will attempt to renew both access and refresh tokens. It will not look in the cache. This will
+         * always fail if 3rd party cookies are blocked by the browser.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["Skip"] = 5] = "Skip";
+    })(exports.CacheLookupPolicy || (exports.CacheLookupPolicy = {}));
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8571,6 +8722,10 @@
         inMemRedirectUnavailable: {
             code: "in_mem_redirect_unavailable",
             desc: "Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true."
+        },
+        entropyNotProvided: {
+            code: "entropy_not_provided",
+            desc: "The available browser crypto interface requires entropy set via system.cryptoOptions.entropy configuration option."
         }
     };
     /**
@@ -8621,6 +8776,12 @@
         BrowserConfigurationAuthError.createInMemoryRedirectUnavailableError = function () {
             return new BrowserConfigurationAuthError(BrowserConfigurationAuthErrorMessage.inMemRedirectUnavailable.code, BrowserConfigurationAuthErrorMessage.inMemRedirectUnavailable.desc);
         };
+        /**
+         * Creates an error thrown when a crypto interface that requires entropy is initialized without entropy
+         */
+        BrowserConfigurationAuthError.createEntropyNotProvided = function () {
+            return new BrowserConfigurationAuthError(BrowserConfigurationAuthErrorMessage.entropyNotProvided.code, BrowserConfigurationAuthErrorMessage.entropyNotProvided.desc);
+        };
         return BrowserConfigurationAuthError;
     }(AuthError));
 
@@ -9683,7 +9844,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.28.2";
+    var version = "2.29.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11086,7 +11247,8 @@
                                     .then(function (result) {
                                     nativeATMeasurement.endMeasurement({
                                         success: true,
-                                        isNativeBroker: true
+                                        isNativeBroker: true,
+                                        requestId: result.requestId
                                     });
                                     return result;
                                 })
@@ -12626,7 +12788,10 @@
         // Default system options for browser
         var DEFAULT_BROWSER_SYSTEM_OPTIONS = __assign$1(__assign$1({}, DEFAULT_SYSTEM_OPTIONS), { loggerOptions: DEFAULT_LOGGER_OPTIONS, networkClient: isBrowserEnvironment ? BrowserUtils.getBrowserNetworkClient() : StubbedNetworkModule, navigationClient: new NavigationClient(), loadFrameTimeout: 0, 
             // If loadFrameTimeout is provided, use that as default.
-            windowHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false, allowNativeBroker: false, nativeBrokerHandshakeTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.nativeBrokerHandshakeTimeout) || DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS });
+            windowHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false, allowNativeBroker: false, nativeBrokerHandshakeTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.nativeBrokerHandshakeTimeout) || DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS, cryptoOptions: {
+                useMsrCrypto: false,
+                entropy: undefined
+            } });
         var DEFAULT_TELEMETRY_OPTIONS = {
             application: {
                 appName: Constants.EMPTY_STRING,
@@ -12807,7 +12972,7 @@
             return _this;
         }
         /**
-         * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none
+         * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none or prompt=no_session
          * @param request
          */
         SilentIframeClient.prototype.acquireToken = function (request) {
@@ -12822,14 +12987,14 @@
                             if (StringUtils.isEmpty(request.loginHint) && StringUtils.isEmpty(request.sid) && (!request.account || StringUtils.isEmpty(request.account.username))) {
                                 this.logger.warning("No user hint provided. The authorization server may need more information to complete this request.");
                             }
-                            // Check that prompt is set to none, throw error if it is set to anything else.
-                            if (request.prompt && request.prompt !== PromptValue.NONE) {
+                            // Check that prompt is set to none or no_session, throw error if it is set to anything else.
+                            if (request.prompt && (request.prompt !== PromptValue.NONE) && (request.prompt !== PromptValue.NO_SESSION)) {
                                 acquireTokenMeasurement.endMeasurement({
                                     success: false
                                 });
                                 throw BrowserAuthError.createSilentPromptValueError(request.prompt);
                             }
-                            return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent)];
+                            return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: request.prompt || PromptValue.NONE }), exports.InteractionType.Silent)];
                         case 1:
                             silentRequest = _a.sent();
                             this.browserStorage.updateCacheEntries(silentRequest.state, silentRequest.nonce, silentRequest.authority, silentRequest.loginHint || Constants.EMPTY_STRING, silentRequest.account || null);
@@ -12844,7 +13009,8 @@
                             return [4 /*yield*/, this.silentTokenHelper(authClient, silentRequest).then(function (result) {
                                     acquireTokenMeasurement.endMeasurement({
                                         success: true,
-                                        fromCache: false
+                                        fromCache: false,
+                                        requestId: result.requestId
                                     });
                                     return result;
                                 })];
@@ -12908,7 +13074,7 @@
                                 }
                                 nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.browserStorage, this.correlationId);
                                 userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
-                                return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: PromptValue.NONE })).finally(function () {
+                                return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: silentRequest.prompt || PromptValue.NONE })).finally(function () {
                                         _this.browserStorage.cleanRequestByState(state);
                                     })];
                             }
@@ -12956,7 +13122,8 @@
                                     .then(function (result) {
                                     acquireTokenMeasurement.endMeasurement({
                                         success: true,
-                                        fromCache: result.fromCache
+                                        fromCache: result.fromCache,
+                                        requestId: result.requestId
                                     });
                                     return result;
                                 })
@@ -13362,6 +13529,13 @@
             }
             return sView;
         };
+        /**
+         * Returns stringified jwk.
+         * @param jwk
+         */
+        BrowserStringUtils.getSortedObjectString = function (obj) {
+            return JSON.stringify(obj, Object.keys(obj).sort());
+        };
         return BrowserStringUtils;
     }());
 
@@ -13604,178 +13778,117 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    /**
-     * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
-     */
-    // RSA KeyGen Algorithm
-    var PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
-    // SHA-256 hashing algorithm
-    var S256_HASH_ALG = "SHA-256";
-    // MOD length for PoP tokens
-    var MODULUS_LENGTH = 2048;
-    // Public Exponent
-    var PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
-    /**
-     * This class implements functions used by the browser library to perform cryptography operations such as
-     * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
-     */
-    var BrowserCrypto = /** @class */ (function () {
-        function BrowserCrypto(logger) {
-            this.logger = logger;
-            if (!(this.hasCryptoAPI())) {
-                throw BrowserAuthError.createCryptoNotAvailableError("Browser crypto or msCrypto object not available.");
-            }
-            this._keygenAlgorithmOptions = {
-                name: PKCS1_V15_KEYGEN_ALG,
-                hash: S256_HASH_ALG,
-                modulusLength: MODULUS_LENGTH,
-                publicExponent: PUBLIC_EXPONENT
-            };
+    var ModernBrowserCrypto = /** @class */ (function () {
+        function ModernBrowserCrypto() {
         }
-        /**
-         * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
-         * @param dataString
-         */
-        BrowserCrypto.prototype.sha256Digest = function (dataString) {
+        ModernBrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+            return window.crypto.getRandomValues(dataBuffer);
+        };
+        ModernBrowserCrypto.prototype.generateKey = function (algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var data;
                 return __generator$1(this, function (_a) {
-                    data = BrowserStringUtils.stringToUtf8Arr(dataString);
-                    return [2 /*return*/, this.hasIECrypto() ? this.getMSCryptoDigest(S256_HASH_ALG, data) : this.getSubtleCryptoDigest(S256_HASH_ALG, data)];
+                    return [2 /*return*/, window.crypto.subtle.generateKey(algorithm, extractable, keyUsages)];
                 });
             });
         };
-        /**
-         * Populates buffer with cryptographically random values.
-         * @param dataBuffer
-         */
-        BrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
-            var cryptoObj = window["msCrypto"] || window.crypto;
-            if (!cryptoObj.getRandomValues) {
-                throw BrowserAuthError.createCryptoNotAvailableError("getRandomValues does not exist.");
-            }
-            cryptoObj.getRandomValues(dataBuffer);
-        };
-        /**
-         * Generates a keypair based on current keygen algorithm config.
-         * @param extractable
-         * @param usages
-         */
-        BrowserCrypto.prototype.generateKeyPair = function (extractable, usages) {
+        ModernBrowserCrypto.prototype.exportKey = function (key) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, (this.hasIECrypto() ?
-                            this.msCryptoGenerateKey(extractable, usages)
-                            : window.crypto.subtle.generateKey(this._keygenAlgorithmOptions, extractable, usages))];
+                    return [2 /*return*/, window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key)];
                 });
             });
         };
-        /**
-         * Export key as Json Web Key (JWK)
-         * @param key
-         * @param format
-         */
-        BrowserCrypto.prototype.exportJwk = function (key) {
+        ModernBrowserCrypto.prototype.importKey = function (keyData, algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, this.hasIECrypto() ? this.msCryptoExportJwk(key) : window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key)];
+                    return [2 /*return*/, window.crypto.subtle.importKey(KEY_FORMAT_JWK, keyData, algorithm, extractable, keyUsages)];
                 });
             });
         };
-        /**
-         * Imports key as Json Web Key (JWK), can set extractable and usages.
-         * @param key
-         * @param format
-         * @param extractable
-         * @param usages
-         */
-        BrowserCrypto.prototype.importJwk = function (key, extractable, usages) {
+        ModernBrowserCrypto.prototype.sign = function (algorithm, key, data) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var keyString, keyBuffer;
                 return __generator$1(this, function (_a) {
-                    keyString = BrowserCrypto.getJwkString(key);
-                    keyBuffer = BrowserStringUtils.stringToArrayBuffer(keyString);
-                    return [2 /*return*/, this.hasIECrypto() ?
-                            this.msCryptoImportKey(keyBuffer, extractable, usages)
-                            : window.crypto.subtle.importKey(KEY_FORMAT_JWK, key, this._keygenAlgorithmOptions, extractable, usages)];
+                    return [2 /*return*/, window.crypto.subtle.sign(algorithm, key, data)];
                 });
             });
         };
-        /**
-         * Signs given data with given key
-         * @param key
-         * @param data
-         */
-        BrowserCrypto.prototype.sign = function (key, data) {
+        ModernBrowserCrypto.prototype.digest = function (algorithm, data) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, this.hasIECrypto() ?
-                            this.msCryptoSign(key, data)
-                            : window.crypto.subtle.sign(this._keygenAlgorithmOptions, key, data)];
+                    return [2 /*return*/, window.crypto.subtle.digest(algorithm, data)];
                 });
             });
         };
-        /**
-         * Check whether IE crypto or other browser cryptography is available.
-         */
-        BrowserCrypto.prototype.hasCryptoAPI = function () {
-            return this.hasIECrypto() || this.hasBrowserCrypto();
+        return ModernBrowserCrypto;
+    }());
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var MsrBrowserCrypto = /** @class */ (function () {
+        function MsrBrowserCrypto() {
+        }
+        MsrBrowserCrypto.prototype.initPrng = function (entropy) {
+            // Turn into array, as initPrng seems to not always like Uint8Array (even though it should support both)
+            return window.msrCrypto.initPrng(__spread(entropy));
         };
-        /**
-         * Checks whether IE crypto (AKA msCrypto) is available.
-         */
-        BrowserCrypto.prototype.hasIECrypto = function () {
-            return "msCrypto" in window;
+        MsrBrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+            return window.msrCrypto.getRandomValues(dataBuffer);
         };
-        /**
-         * Check whether browser crypto is available.
-         */
-        BrowserCrypto.prototype.hasBrowserCrypto = function () {
-            return "crypto" in window;
+        MsrBrowserCrypto.prototype.generateKey = function (algorithm, extractable, keyUsages) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, window.msrCrypto.subtle.generateKey(algorithm, extractable, keyUsages)];
+                });
+            });
         };
-        /**
-         * Helper function for SHA digest.
-         * @param algorithm
-         * @param data
-         */
-        BrowserCrypto.prototype.getSubtleCryptoDigest = function (algorithm, data) {
+        MsrBrowserCrypto.prototype.exportKey = function (key) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, window.crypto.subtle.digest(algorithm, data)];
+                    return [2 /*return*/, window.msrCrypto.subtle.exportKey(KEY_FORMAT_JWK, key)];
                 });
             });
         };
-        /**
-         * IE Helper function for SHA digest.
-         * @param algorithm
-         * @param data
-         */
-        BrowserCrypto.prototype.getMSCryptoDigest = function (algorithm, data) {
+        MsrBrowserCrypto.prototype.importKey = function (keyData, algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, new Promise(function (resolve, reject) {
-                            var digestOperation = window["msCrypto"].subtle.digest(algorithm, data.buffer);
-                            digestOperation.addEventListener("complete", function (e) {
-                                resolve(e.target.result);
-                            });
-                            digestOperation.addEventListener("error", function (error) {
-                                reject(error);
-                            });
-                        })];
+                    return [2 /*return*/, window.msrCrypto.subtle.importKey(KEY_FORMAT_JWK, keyData, algorithm, extractable, keyUsages)];
                 });
             });
         };
-        /**
-         * IE Helper function for generating a keypair
-         * @param extractable
-         * @param usages
-         */
-        BrowserCrypto.prototype.msCryptoGenerateKey = function (extractable, usages) {
+        MsrBrowserCrypto.prototype.sign = function (algorithm, key, data) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, window.msrCrypto.subtle.sign(algorithm, key, data)];
+                });
+            });
+        };
+        MsrBrowserCrypto.prototype.digest = function (algorithm, data) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, window.msrCrypto.subtle.digest(algorithm, data)];
+                });
+            });
+        };
+        return MsrBrowserCrypto;
+    }());
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var MsBrowserCrypto = /** @class */ (function () {
+        function MsBrowserCrypto() {
+        }
+        MsBrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+            return window["msCrypto"].getRandomValues(dataBuffer);
+        };
+        MsBrowserCrypto.prototype.generateKey = function (algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var _this = this;
                 return __generator$1(this, function (_a) {
                     return [2 /*return*/, new Promise(function (resolve, reject) {
-                            var msGenerateKey = window["msCrypto"].subtle.generateKey(_this._keygenAlgorithmOptions, extractable, usages);
+                            var msGenerateKey = window["msCrypto"].subtle.generateKey(algorithm, extractable, keyUsages);
                             msGenerateKey.addEventListener("complete", function (e) {
                                 resolve(e.target.result);
                             });
@@ -13786,12 +13899,7 @@
                 });
             });
         };
-        /**
-         * IE Helper function for exportKey
-         * @param key
-         * @param format
-         */
-        BrowserCrypto.prototype.msCryptoExportJwk = function (key) {
+        MsBrowserCrypto.prototype.exportKey = function (key) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
                     return [2 /*return*/, new Promise(function (resolve, reject) {
@@ -13818,19 +13926,14 @@
                 });
             });
         };
-        /**
-         * IE Helper function for importKey
-         * @param key
-         * @param format
-         * @param extractable
-         * @param usages
-         */
-        BrowserCrypto.prototype.msCryptoImportKey = function (keyBuffer, extractable, usages) {
+        MsBrowserCrypto.prototype.importKey = function (keyData, algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var _this = this;
+                var keyString, keyBuffer;
                 return __generator$1(this, function (_a) {
+                    keyString = BrowserStringUtils.getSortedObjectString(keyData);
+                    keyBuffer = BrowserStringUtils.stringToArrayBuffer(keyString);
                     return [2 /*return*/, new Promise(function (resolve, reject) {
-                            var msImportKey = window["msCrypto"].subtle.importKey(KEY_FORMAT_JWK, keyBuffer, _this._keygenAlgorithmOptions, extractable, usages);
+                            var msImportKey = window["msCrypto"].subtle.importKey(KEY_FORMAT_JWK, keyBuffer, algorithm, extractable, keyUsages);
                             msImportKey.addEventListener("complete", function (e) {
                                 resolve(e.target.result);
                             });
@@ -13841,17 +13944,11 @@
                 });
             });
         };
-        /**
-         * IE Helper function for sign JWT
-         * @param key
-         * @param data
-         */
-        BrowserCrypto.prototype.msCryptoSign = function (key, data) {
+        MsBrowserCrypto.prototype.sign = function (algorithm, key, data) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var _this = this;
                 return __generator$1(this, function (_a) {
                     return [2 /*return*/, new Promise(function (resolve, reject) {
-                            var msSign = window["msCrypto"].subtle.sign(_this._keygenAlgorithmOptions, key, data);
+                            var msSign = window["msCrypto"].subtle.sign(algorithm, key, data);
                             msSign.addEventListener("complete", function (e) {
                                 resolve(e.target.result);
                             });
@@ -13862,12 +13959,175 @@
                 });
             });
         };
+        MsBrowserCrypto.prototype.digest = function (algorithm, data) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, new Promise(function (resolve, reject) {
+                            var digestOperation = window["msCrypto"].subtle.digest(algorithm, data.buffer);
+                            digestOperation.addEventListener("complete", function (e) {
+                                resolve(e.target.result);
+                            });
+                            digestOperation.addEventListener("error", function (error) {
+                                reject(error);
+                            });
+                        })];
+                });
+            });
+        };
+        return MsBrowserCrypto;
+    }());
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
+     */
+    // RSA KeyGen Algorithm
+    var PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+    // SHA-256 hashing algorithm
+    var S256_HASH_ALG = "SHA-256";
+    // MOD length for PoP tokens
+    var MODULUS_LENGTH = 2048;
+    // Public Exponent
+    var PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
+    /**
+     * This class implements functions used by the browser library to perform cryptography operations such as
+     * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
+     */
+    var BrowserCrypto = /** @class */ (function () {
+        function BrowserCrypto(logger, cryptoOptions) {
+            var _a, _b;
+            this.logger = logger;
+            this.cryptoOptions = cryptoOptions;
+            if (this.hasBrowserCrypto()) {
+                // Use standard modern web crypto if available
+                this.logger.verbose("BrowserCrypto: modern crypto interface available");
+                this.subtleCrypto = new ModernBrowserCrypto();
+            }
+            else if (this.hasIECrypto()) {
+                // For IE11, use msCrypto interface
+                this.logger.verbose("BrowserCrypto: MS crypto interface available");
+                this.subtleCrypto = new MsBrowserCrypto();
+            }
+            else if (this.hasMsrCrypto() && ((_a = this.cryptoOptions) === null || _a === void 0 ? void 0 : _a.useMsrCrypto)) {
+                // For other browsers, use MSR Crypto if found
+                this.logger.verbose("BrowserCrypto: MSR crypto interface available");
+                this.subtleCrypto = new MsrBrowserCrypto();
+            }
+            else {
+                if (this.hasMsrCrypto()) {
+                    this.logger.info("BrowserCrypto: MSR Crypto interface available but system.cryptoOptions.useMsrCrypto not enabled");
+                }
+                this.logger.error("BrowserCrypto: No crypto interfaces available.");
+                throw BrowserAuthError.createCryptoNotAvailableError("Browser crypto, msCrypto, or msrCrypto interfaces not available.");
+            }
+            // Mainly needed for MSR Crypto: https://github.com/microsoft/MSR-JavaScript-Crypto#random-number-generator-prng
+            if (this.subtleCrypto.initPrng) {
+                this.logger.verbose("BrowserCrypto: Interface requires entropy");
+                if (!((_b = this.cryptoOptions) === null || _b === void 0 ? void 0 : _b.entropy)) {
+                    this.logger.error("BrowserCrypto: Interface requires entropy but none provided.");
+                    throw BrowserConfigurationAuthError.createEntropyNotProvided();
+                }
+                this.logger.verbose("BrowserCrypto: Entropy provided");
+                this.subtleCrypto.initPrng(this.cryptoOptions.entropy);
+            }
+            this.keygenAlgorithmOptions = {
+                name: PKCS1_V15_KEYGEN_ALG,
+                hash: S256_HASH_ALG,
+                modulusLength: MODULUS_LENGTH,
+                publicExponent: PUBLIC_EXPONENT
+            };
+        }
         /**
-         * Returns stringified jwk.
-         * @param jwk
+         * Check whether IE crypto or other browser cryptography is available.
+         */
+        BrowserCrypto.prototype.hasIECrypto = function () {
+            return "msCrypto" in window;
+        };
+        /**
+         * Check whether browser crypto is available.
          */
-        BrowserCrypto.getJwkString = function (jwk) {
-            return JSON.stringify(jwk, Object.keys(jwk).sort());
+        BrowserCrypto.prototype.hasBrowserCrypto = function () {
+            return "crypto" in window;
+        };
+        /**
+         * Check whether MSR crypto polyfill is available
+         */
+        BrowserCrypto.prototype.hasMsrCrypto = function () {
+            return "msrCrypto" in window;
+        };
+        /**
+         * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
+         * @param dataString
+         */
+        BrowserCrypto.prototype.sha256Digest = function (dataString) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var data;
+                return __generator$1(this, function (_a) {
+                    data = BrowserStringUtils.stringToUtf8Arr(dataString);
+                    // MSR Crypto wants object with name property, instead of string
+                    return [2 /*return*/, this.subtleCrypto.digest({ name: S256_HASH_ALG }, data)];
+                });
+            });
+        };
+        /**
+         * Populates buffer with cryptographically random values.
+         * @param dataBuffer
+         */
+        BrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+            return this.subtleCrypto.getRandomValues(dataBuffer);
+        };
+        /**
+         * Generates a keypair based on current keygen algorithm config.
+         * @param extractable
+         * @param usages
+         */
+        BrowserCrypto.prototype.generateKeyPair = function (extractable, usages) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, this.subtleCrypto.generateKey(this.keygenAlgorithmOptions, extractable, usages)];
+                });
+            });
+        };
+        /**
+         * Export key as Json Web Key (JWK)
+         * @param key
+         * @param format
+         */
+        BrowserCrypto.prototype.exportJwk = function (key) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, this.subtleCrypto.exportKey(key)];
+                });
+            });
+        };
+        /**
+         * Imports key as Json Web Key (JWK), can set extractable and usages.
+         * @param key
+         * @param format
+         * @param extractable
+         * @param usages
+         */
+        BrowserCrypto.prototype.importJwk = function (key, extractable, usages) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, this.subtleCrypto.importKey(key, this.keygenAlgorithmOptions, extractable, usages)];
+                });
+            });
+        };
+        /**
+         * Signs given data with given key
+         * @param key
+         * @param data
+         */
+        BrowserCrypto.prototype.sign = function (key, data) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, this.subtleCrypto.sign(this.keygenAlgorithmOptions, key, data)];
+                });
+            });
         };
         return BrowserCrypto;
     }());
@@ -14109,29 +14369,17 @@
          */
         DatabaseStorage.prototype.deleteDatabase = function () {
             return __awaiter$1(this, void 0, void 0, function () {
-                var existingDatabases, database;
                 return __generator$1(this, function (_a) {
-                    switch (_a.label) {
-                        case 0:
-                            // Check if database being deleted exists
-                            if (this.db && this.dbOpen) {
-                                this.closeConnection();
-                            }
-                            return [4 /*yield*/, window.indexedDB.databases()];
-                        case 1:
-                            existingDatabases = _a.sent();
-                            database = existingDatabases.find(function (database) { return database.name === DB_NAME; });
-                            // If database exists, delete it
-                            if (database) {
-                                return [2 /*return*/, new Promise(function (resolve, reject) {
-                                        var deleteDbRequest = window.indexedDB.deleteDatabase(DB_NAME);
-                                        deleteDbRequest.addEventListener("success", function () { return resolve(true); });
-                                        deleteDbRequest.addEventListener("error", function () { return reject(false); });
-                                    })];
-                            }
-                            // Database doesn't exist, return true
-                            return [2 /*return*/, true];
+                    // Check if database being deleted exists
+                    if (this.db && this.dbOpen) {
+                        this.closeConnection();
                     }
+                    return [2 /*return*/, new Promise(function (resolve, reject) {
+                            var deleteDbRequest = window.indexedDB.deleteDatabase(DB_NAME);
+                            deleteDbRequest.addEventListener("success", function () { return resolve(true); });
+                            deleteDbRequest.addEventListener("blocked", function () { return resolve(true); });
+                            deleteDbRequest.addEventListener("error", function () { return reject(false); });
+                        })];
                 });
             });
         };
@@ -14300,34 +14548,38 @@
             });
         };
         /**
-         * Clears in-memory Map and tries to delete the IndexedDB database.
+         * Clears in-memory Map
+         */
+        AsyncMemoryStorage.prototype.clearInMemory = function () {
+            // InMemory cache is a Map instance, clear is straightforward
+            this.logger.verbose("Deleting in-memory keystore " + this.storeName);
+            this.inMemoryCache.clear();
+            this.logger.verbose("In-memory keystore " + this.storeName + " deleted");
+        };
+        /**
+         * Tries to delete the IndexedDB database
+         * @returns
          */
-        AsyncMemoryStorage.prototype.clear = function () {
+        AsyncMemoryStorage.prototype.clearPersistent = function () {
             return __awaiter$1(this, void 0, void 0, function () {
                 var dbDeleted, e_6;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            // InMemory cache is a Map instance, clear is straightforward
-                            this.logger.verbose("Deleting in-memory keystore " + this.storeName);
-                            this.inMemoryCache.clear();
-                            this.logger.verbose("In-memory keystore " + this.storeName + " deleted");
-                            this.logger.verbose("Deleting persistent keystore " + this.storeName);
-                            _a.label = 1;
-                        case 1:
-                            _a.trys.push([1, 3, , 4]);
+                            _a.trys.push([0, 2, , 3]);
+                            this.logger.verbose("Deleting persistent keystore");
                             return [4 /*yield*/, this.indexedDBCache.deleteDatabase()];
-                        case 2:
+                        case 1:
                             dbDeleted = _a.sent();
                             if (dbDeleted) {
-                                this.logger.verbose("Persistent keystore " + this.storeName + " deleted");
+                                this.logger.verbose("Persistent keystore deleted");
                             }
                             return [2 /*return*/, dbDeleted];
-                        case 3:
+                        case 2:
                             e_6 = _a.sent();
                             this.handleDatabaseAccessError(e_6);
                             return [2 /*return*/, false];
-                        case 4: return [2 /*return*/];
+                        case 3: return [2 /*return*/];
                     }
                 });
             });
@@ -14344,23 +14596,66 @@
         CryptoKeyStoreNames["asymmetricKeys"] = "asymmetricKeys";
         CryptoKeyStoreNames["symmetricKeys"] = "symmetricKeys";
     })(CryptoKeyStoreNames || (CryptoKeyStoreNames = {}));
+    /**
+     * MSAL CryptoKeyStore DB Version 2
+     */
+    var CryptoKeyStore = /** @class */ (function () {
+        function CryptoKeyStore(logger) {
+            this.logger = logger;
+            this.asymmetricKeys = new AsyncMemoryStorage(this.logger, CryptoKeyStoreNames.asymmetricKeys);
+            this.symmetricKeys = new AsyncMemoryStorage(this.logger, CryptoKeyStoreNames.symmetricKeys);
+        }
+        CryptoKeyStore.prototype.clear = function () {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var e_1;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            // Delete in-memory keystores
+                            this.asymmetricKeys.clearInMemory();
+                            this.symmetricKeys.clearInMemory();
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            return [4 /*yield*/, this.asymmetricKeys.clearPersistent()];
+                        case 2:
+                            _a.sent();
+                            return [2 /*return*/, true];
+                        case 3:
+                            e_1 = _a.sent();
+                            if (e_1 instanceof Error) {
+                                this.logger.error("Clearing keystore failed with error: " + e_1.message);
+                            }
+                            else {
+                                this.logger.error("Clearing keystore failed with unknown error");
+                            }
+                            return [2 /*return*/, false];
+                        case 4: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        return CryptoKeyStore;
+    }());
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
     /**
      * This class implements MSAL's crypto interface, which allows it to perform base64 encoding and decoding, generating cryptographically random GUIDs and
      * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
      */
     var CryptoOps = /** @class */ (function () {
-        function CryptoOps(logger, performanceClient) {
+        function CryptoOps(logger, performanceClient, cryptoConfig) {
             this.logger = logger;
             // Browser crypto needs to be validated first before any other classes can be set.
-            this.browserCrypto = new BrowserCrypto(this.logger);
+            this.browserCrypto = new BrowserCrypto(this.logger, cryptoConfig);
             this.b64Encode = new Base64Encode();
             this.b64Decode = new Base64Decode();
             this.guidGenerator = new GuidGenerator(this.browserCrypto);
             this.pkceGenerator = new PkceGenerator(this.browserCrypto);
-            this.cache = {
-                asymmetricKeys: new AsyncMemoryStorage(this.logger, CryptoKeyStoreNames.asymmetricKeys),
-                symmetricKeys: new AsyncMemoryStorage(this.logger, CryptoKeyStoreNames.symmetricKeys)
-            };
+            this.cache = new CryptoKeyStore(this.logger);
             this.performanceClient = performanceClient;
         }
         /**
@@ -14417,7 +14712,7 @@
                                 kty: publicKeyJwk.kty,
                                 n: publicKeyJwk.n
                             };
-                            publicJwkString = BrowserCrypto.getJwkString(pubKeyThumprintObj);
+                            publicJwkString = BrowserStringUtils.getSortedObjectString(pubKeyThumprintObj);
                             return [4 /*yield*/, this.hashString(publicJwkString)];
                         case 3:
                             publicJwkHash = _b.sent();
@@ -14472,32 +14767,10 @@
          */
         CryptoOps.prototype.clearKeystore = function () {
             return __awaiter$1(this, void 0, void 0, function () {
-                var e_1;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0:
-                            _a.trys.push([0, 3, , 4]);
-                            this.logger.verbose("Deleting in-memory and persistent asymmetric key stores");
-                            return [4 /*yield*/, this.cache.asymmetricKeys.clear()];
-                        case 1:
-                            _a.sent();
-                            this.logger.verbose("Successfully deleted asymmetric key stores");
-                            this.logger.verbose("Deleting in-memory and persistent symmetric key stores");
-                            return [4 /*yield*/, this.cache.symmetricKeys.clear()];
-                        case 2:
-                            _a.sent();
-                            this.logger.verbose("Successfully deleted symmetric key stores");
-                            return [2 /*return*/, true];
-                        case 3:
-                            e_1 = _a.sent();
-                            if (e_1 instanceof Error) {
-                                this.logger.error("Clearing keystore failed with error: " + e_1.message);
-                            }
-                            else {
-                                this.logger.error("Clearing keystore failed with unknown error");
-                            }
-                            return [2 /*return*/, false];
-                        case 4: return [2 /*return*/];
+                        case 0: return [4 /*yield*/, this.cache.clear()];
+                        case 1: return [2 /*return*/, _a.sent()];
                     }
                 });
             });
@@ -14524,7 +14797,7 @@
                             return [4 /*yield*/, this.browserCrypto.exportJwk(cachedKeyPair.publicKey)];
                         case 2:
                             publicKeyJwk = _b.sent();
-                            publicKeyJwkString = BrowserCrypto.getJwkString(publicKeyJwk);
+                            publicKeyJwkString = BrowserStringUtils.getSortedObjectString(publicKeyJwk);
                             encodedKeyIdThumbprint = this.b64Encode.urlEncode(JSON.stringify({ kid: kid }));
                             shrHeader = JoseHeader.getShrHeaderString({ kid: encodedKeyIdThumbprint, alg: publicKeyJwk.alg });
                             encodedShrHeader = this.b64Encode.urlEncode(shrHeader);
@@ -14845,9 +15118,9 @@
      */
     var BrowserPerformanceClient = /** @class */ (function (_super) {
         __extends$1(BrowserPerformanceClient, _super);
-        function BrowserPerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
+        function BrowserPerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry, cryptoOptions) {
             var _this = _super.call(this, clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) || this;
-            _this.browserCrypto = new BrowserCrypto(_this.logger);
+            _this.browserCrypto = new BrowserCrypto(_this.logger, cryptoOptions);
             _this.guidGenerator = new GuidGenerator(_this.browserCrypto);
             return _this;
         }
@@ -14929,10 +15202,10 @@
             this.hybridAuthCodeResponses = new Map();
             // Initialize performance client
             this.performanceClient = this.isBrowserEnvironment ?
-                new BrowserPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application) :
+                new BrowserPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application, this.config.system.cryptoOptions) :
                 new StubPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application);
             // Initialize the crypto class.
-            this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger, this.performanceClient) : DEFAULT_CRYPTO_IMPLEMENTATION;
+            this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger, this.performanceClient, this.config.system.cryptoOptions) : DEFAULT_CRYPTO_IMPLEMENTATION;
             this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
             // Initialize the browser storage class.
             this.browserStorage = this.isBrowserEnvironment ?
@@ -15154,6 +15427,7 @@
                         isNativeBroker: true,
                         accessTokenSize: response.accessToken.length,
                         idTokenSize: response.idToken.length,
+                        requestId: response.requestId
                     });
                     atPopupMeasurement.flushMeasurement();
                     return response;
@@ -15191,6 +15465,7 @@
                     success: true,
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
+                    requestId: result.requestId
                 });
                 atPopupMeasurement.flushMeasurement();
                 return result;
@@ -15234,7 +15509,9 @@
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     correlationId = this.getRequestCorrelationId(request);
-                    validRequest = __assign$1(__assign$1({}, request), { prompt: PromptValue.NONE, correlationId: correlationId });
+                    validRequest = __assign$1(__assign$1({}, request), { 
+                        // will be PromptValue.NONE or PromptValue.NO_SESSION
+                        prompt: request.prompt, correlationId: correlationId });
                     this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
                     ssoSilentMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SsoSilent, correlationId);
                     this.logger.verbose("ssoSilent called", correlationId);
@@ -15260,7 +15537,8 @@
                                 success: true,
                                 isNativeBroker: response.fromNativeBroker,
                                 accessTokenSize: response.accessToken.length,
-                                idTokenSize: response.idToken.length
+                                idTokenSize: response.idToken.length,
+                                requestId: response.requestId
                             });
                             ssoSilentMeasurement.flushMeasurement();
                             return response;
@@ -15311,7 +15589,8 @@
                                         success: true,
                                         accessTokenSize: result.accessToken.length,
                                         idTokenSize: result.idToken.length,
-                                        isNativeBroker: result.fromNativeBroker
+                                        isNativeBroker: result.fromNativeBroker,
+                                        requestId: result.requestId
                                     });
                                     atbcMeasurement.flushMeasurement();
                                     return result;
@@ -15391,67 +15670,62 @@
             });
         };
         /**
-         * Use this function to obtain a token before every call to the API / resource provider
-         *
-         * MSAL return's a cached token when available
-         * Or it send's a request to the STS to obtain a new token using a refresh token.
-         *
-         * @param {@link SilentRequest}
-         *
-         * To renew idToken, please pass clientId as the only scope in the Authentication Parameters
-         * @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
+         * Attempt to acquire an access token from the cache
+         * @param silentCacheClient SilentCacheClient
+         * @param commonRequest CommonSilentFlowRequest
+         * @param silentRequest SilentRequest
+         * @returns A promise that, when resolved, returns the access token
          */
-        ClientApplication.prototype.acquireTokenByRefreshToken = function (request) {
+        ClientApplication.prototype.acquireTokenFromCache = function (silentCacheClient, commonRequest, silentRequest) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var atbrtMeasurement, silentRefreshClient;
-                var _this = this;
                 return __generator$1(this, function (_a) {
-                    // block the reload if it occurred inside a hidden iframe
-                    BrowserUtils.blockReloadInHiddenIframes();
-                    atbrtMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenByRefreshToken, request.correlationId);
-                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, request);
-                    silentRefreshClient = this.createSilentRefreshClient(request.correlationId);
-                    return [2 /*return*/, silentRefreshClient.acquireToken(request)
-                            .then(function (result) {
-                            atbrtMeasurement.endMeasurement({
-                                success: true,
-                                fromCache: result.fromCache,
-                                accessTokenSize: result.accessToken.length,
-                                idTokenSize: result.idToken.length,
-                            });
-                            return result;
-                        })
-                            .catch(function (e) {
-                            var isServerError = e instanceof ServerError;
-                            var isInteractionRequiredError = e instanceof InteractionRequiredAuthError;
-                            var isInvalidGrantError = (e.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
-                            if (isServerError && isInvalidGrantError && !isInteractionRequiredError) {
-                                _this.logger.verbose("Refresh token expired or invalid, attempting acquire token by iframe", request.correlationId);
-                                var silentIframeClient = _this.createSilentIframeClient(request.correlationId);
-                                return silentIframeClient.acquireToken(request)
-                                    .then(function (result) {
-                                    atbrtMeasurement.endMeasurement({
-                                        success: true,
-                                        fromCache: result.fromCache,
-                                        accessTokenSize: result.accessToken.length,
-                                        idTokenSize: result.idToken.length,
-                                    });
-                                    return result;
-                                })
-                                    .catch(function (error) {
-                                    atbrtMeasurement.endMeasurement({
-                                        errorCode: error.errorCode,
-                                        subErrorCode: error.subError,
-                                        success: false
-                                    });
-                                    throw error;
-                                });
-                            }
-                            atbrtMeasurement.endMeasurement({
-                                success: false
-                            });
-                            throw e;
-                        })];
+                    switch (silentRequest.cacheLookupPolicy) {
+                        case exports.CacheLookupPolicy.Default:
+                        case exports.CacheLookupPolicy.AccessToken:
+                        case exports.CacheLookupPolicy.AccessTokenAndRefreshToken:
+                            return [2 /*return*/, silentCacheClient.acquireToken(commonRequest)];
+                        default:
+                            throw ClientAuthError.createRefreshRequiredError();
+                    }
+                    return [2 /*return*/];
+                });
+            });
+        };
+        /**
+         * Attempt to acquire an access token via a refresh token
+         * @param commonRequest CommonSilentFlowRequest
+         * @param silentRequest SilentRequest
+         * @returns A promise that, when resolved, returns the access token
+         */
+        ClientApplication.prototype.acquireTokenByRefreshToken = function (commonRequest, silentRequest) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var silentRefreshClient;
+                return __generator$1(this, function (_a) {
+                    switch (silentRequest.cacheLookupPolicy) {
+                        case exports.CacheLookupPolicy.Default:
+                        case exports.CacheLookupPolicy.AccessTokenAndRefreshToken:
+                        case exports.CacheLookupPolicy.RefreshToken:
+                        case exports.CacheLookupPolicy.RefreshTokenAndNetwork:
+                            silentRefreshClient = this.createSilentRefreshClient(commonRequest.correlationId);
+                            return [2 /*return*/, silentRefreshClient.acquireToken(commonRequest)];
+                        default:
+                            throw ClientAuthError.createRefreshRequiredError();
+                    }
+                    return [2 /*return*/];
+                });
+            });
+        };
+        /**
+         * Attempt to acquire an access token via an iframe
+         * @param request CommonSilentFlowRequest
+         * @returns A promise that, when resolved, returns the access token
+         */
+        ClientApplication.prototype.acquireTokenBySilentIframe = function (request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var silentIframeClient;
+                return __generator$1(this, function (_a) {
+                    silentIframeClient = this.createSilentIframeClient(request.correlationId);
+                    return [2 /*return*/, silentIframeClient.acquireToken(request)];
                 });
             });
         };
@@ -15945,7 +16219,9 @@
                                 fromCache: result.fromCache,
                                 accessTokenSize: result.accessToken.length,
                                 idTokenSize: result.idToken.length,
-                                isNativeBroker: result.fromNativeBroker
+                                isNativeBroker: result.fromNativeBroker,
+                                cacheLookupPolicy: request.cacheLookupPolicy,
+                                requestId: result.requestId
                             });
                             atsMeasurement.flushMeasurement();
                             return result;
@@ -15953,6 +16229,8 @@
                             .catch(function (error) {
                             _this.activeSilentTokenRequests.delete(silentRequestKey);
                             atsMeasurement.endMeasurement({
+                                errorCode: error.errorCode,
+                                subErrorCode: error.subError,
                                 success: false
                             });
                             atsMeasurement.flushMeasurement();
@@ -15981,7 +16259,7 @@
          */
         PublicClientApplication.prototype.acquireTokenSilentAsync = function (request, account) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var astsAsyncMeasurement, result, silentRequest, silentCacheClient, silentRequest_1;
+                var astsAsyncMeasurement, result, silentRequest, silentCacheClient, silentRequest_1, requestWithCLP_1;
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
@@ -16011,11 +16289,32 @@
                             return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
                         case 2:
                             silentRequest_1 = _a.sent();
-                            result = silentCacheClient.acquireToken(silentRequest_1).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
-                                return __generator$1(this, function (_a) {
-                                    return [2 /*return*/, this.acquireTokenByRefreshToken(silentRequest_1)];
+                            requestWithCLP_1 = __assign$1(__assign$1({}, request), { 
+                                // set the request's CacheLookupPolicy to Default if it was not optionally passed in
+                                cacheLookupPolicy: request.cacheLookupPolicy || exports.CacheLookupPolicy.Default });
+                            result = this.acquireTokenFromCache(silentCacheClient, silentRequest_1, requestWithCLP_1).catch(function (cacheError) {
+                                if (requestWithCLP_1.cacheLookupPolicy === exports.CacheLookupPolicy.AccessToken) {
+                                    throw cacheError;
+                                }
+                                // block the reload if it occurred inside a hidden iframe
+                                BrowserUtils.blockReloadInHiddenIframes();
+                                _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, silentRequest_1);
+                                return _this.acquireTokenByRefreshToken(silentRequest_1, requestWithCLP_1).catch(function (refreshTokenError) {
+                                    var isServerError = refreshTokenError instanceof ServerError;
+                                    var isInteractionRequiredError = refreshTokenError instanceof InteractionRequiredAuthError;
+                                    var isInvalidGrantError = (refreshTokenError.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
+                                    if ((!isServerError ||
+                                        !isInvalidGrantError ||
+                                        isInteractionRequiredError ||
+                                        requestWithCLP_1.cacheLookupPolicy === exports.CacheLookupPolicy.AccessTokenAndRefreshToken ||
+                                        requestWithCLP_1.cacheLookupPolicy === exports.CacheLookupPolicy.RefreshToken)
+                                        && (requestWithCLP_1.cacheLookupPolicy !== exports.CacheLookupPolicy.Skip)) {
+                                        throw refreshTokenError;
+                                    }
+                                    _this.logger.verbose("Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.", request.correlationId);
+                                    return _this.acquireTokenBySilentIframe(silentRequest_1);
                                 });
-                            }); });
+                            });
                             _a.label = 3;
                         case 3: return [2 /*return*/, result.then(function (response) {
                                 _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
@@ -16024,7 +16323,8 @@
                                     fromCache: response.fromCache,
                                     accessTokenSize: response.accessToken.length,
                                     idTokenSize: response.idToken.length,
-                                    isNativeBroker: response.fromNativeBroker
+                                    isNativeBroker: response.fromNativeBroker,
+                                    requestId: response.requestId
                                 });
                                 return response;
                             }).catch(function (tokenRenewalError) {