@azure/msal-browser 2.28.3 → 2.30.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.28.3 2022-09-12 */
+/*! @azure/msal-browser v2.30.0 2022-10-10 */
 'use strict';
 'use strict';
 
@@ -117,7 +117,7 @@ function __spread() {
     return ar;
 }
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*! *****************************************************************************
 Copyright (c) Microsoft Corporation.
 
@@ -204,7 +204,7 @@ function __spreadArrays() {
     return r;
 }
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -221,6 +221,7 @@ var Constants = {
     DEFAULT_COMMON_TENANT: "common",
     // ADFS String
     ADFS: "adfs",
+    DSTS: "dstsv2",
     // Default AAD Instance Discovery Endpoint
     AAD_INSTANCE_DISCOVERY_ENDPT: "https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",
     // Resource delimiter - used for certain cache entries
@@ -252,6 +253,7 @@ var Constants = {
     IMDS_TIMEOUT: 2000,
     AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
+    REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
     KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
     TOKEN_RESPONSE_TYPE: "token",
     ID_TOKEN_RESPONSE_TYPE: "id_token",
@@ -275,6 +277,7 @@ var HeaderNames;
     HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
     HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
     HeaderNames["AuthenticationInfo"] = "Authentication-Info";
+    HeaderNames["X_MS_REQUEST_ID"] = "x-ms-request-id";
 })(HeaderNames || (HeaderNames = {}));
 /**
  * Persistent cache keys MSAL which stay while user is logged in.
@@ -370,7 +373,8 @@ var PromptValue = {
     SELECT_ACCOUNT: "select_account",
     CONSENT: "consent",
     NONE: "none",
-    CREATE: "create"
+    CREATE: "create",
+    NO_SESSION: "no_session"
 };
 /**
  * SSO Types - generated to populate hints
@@ -581,7 +585,7 @@ var JsonTypes;
     JsonTypes["Jwk"] = "JWK";
 })(JsonTypes || (JsonTypes = {}));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -637,7 +641,7 @@ var AuthError = /** @class */ (function (_super) {
     return AuthError;
 }(Error));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -712,7 +716,7 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
     }
 };
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -778,6 +782,16 @@ var ClientAuthErrorMessage = {
         code: "nonce_not_found",
         desc: "nonce not found"
     },
+    authTimeNotFoundError: {
+        code: "auth_time_not_found",
+        desc: "Max Age was requested and the ID token is missing the auth_time variable." +
+            " auth_time is an optional claim and is not enabled by default - it must be enabled." +
+            " See https://aka.ms/msaljs/optional-claims for more information."
+    },
+    maxAgeTranspiredError: {
+        code: "max_age_transpired",
+        desc: "Max Age is set to 0, or too much time has elapsed since the last end-user authentication."
+    },
     noTokensFoundError: {
         code: "no_tokens_found",
         desc: "No tokens were found for the given scopes, and no authorization code was passed to acquireToken. You must retrieve an authorization code before making a call to acquireToken()."
@@ -998,6 +1012,19 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createNonceMismatchError = function () {
         return new ClientAuthError(ClientAuthErrorMessage.nonceMismatchError.code, ClientAuthErrorMessage.nonceMismatchError.desc);
     };
+    /**
+     * Creates an error thrown when max_age was provided in the request, but auth_time is not in the token claims
+     * @param missingNonce
+     */
+    ClientAuthError.createAuthTimeNotFoundError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.authTimeNotFoundError.code, ClientAuthErrorMessage.authTimeNotFoundError.desc);
+    };
+    /**
+     * Creates an error thrown when too much time has elapsed since the last end-user authentication
+     */
+    ClientAuthError.createMaxAgeTranspiredError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.maxAgeTranspiredError.code, ClientAuthErrorMessage.maxAgeTranspiredError.desc);
+    };
     /**
      * Creates an error thrown when the mnonce is not present
      * @param missingNonce
@@ -1184,7 +1211,7 @@ var ClientAuthError = /** @class */ (function (_super) {
     return ClientAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1309,7 +1336,7 @@ var StringUtils = /** @class */ (function () {
     return StringUtils;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1489,12 +1516,12 @@ var Logger = /** @class */ (function () {
     return Logger;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /* eslint-disable header/header */
 var name$1 = "@azure/msal-common";
-var version$1 = "7.4.1";
+var version$1 = "7.6.0";
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1515,7 +1542,7 @@ exports.AzureCloudInstance = void 0;
     AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
 })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1674,7 +1701,7 @@ var CredentialEntity = /** @class */ (function () {
     return CredentialEntity;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1722,7 +1749,7 @@ var ClientConfigurationErrorMessage = {
     },
     invalidPrompt: {
         code: "invalid_prompt_value",
-        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create' and 'none'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
+        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create', 'none' and 'no_session'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
     },
     invalidClaimsRequest: {
         code: "invalid_claims",
@@ -1929,7 +1956,7 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     return ClientConfigurationError;
 }(ClientAuthError));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2113,7 +2140,7 @@ var ScopeSet = /** @class */ (function () {
     return ScopeSet;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2151,7 +2178,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2163,9 +2190,10 @@ var AuthorityType;
 (function (AuthorityType) {
     AuthorityType[AuthorityType["Default"] = 0] = "Default";
     AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
+    AuthorityType[AuthorityType["Dsts"] = 2] = "Dsts";
 })(AuthorityType || (AuthorityType = {}));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2287,10 +2315,13 @@ var AccountEntity = /** @class */ (function () {
             // How do you account for MSA CID here?
             account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || Constants.EMPTY_STRING;
             /*
-             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array. In most cases it will contain a single email.
-             * This field should not be relied upon if a custom policy is configured to return more than 1 email.
+             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+             * In most cases it will contain a single email. This field should not be relied upon if a custom
+             * policy is configured to return more than 1 email.
              */
-            account.username = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username) || (((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : Constants.EMPTY_STRING);
+            var preferredUsername = (_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username;
+            var email = ((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : null;
+            account.username = preferredUsername || email || Constants.EMPTY_STRING;
             account.name = (_f = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _f === void 0 ? void 0 : _f.name;
         }
         account.cloudGraphHostName = cloudGraphHostName;
@@ -2305,7 +2336,8 @@ var AccountEntity = /** @class */ (function () {
     AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
         var _a, _b, _c, _d;
         var account = new AccountEntity();
-        account.authorityType = (authority && authority.authorityType === AuthorityType.Adfs) ? CacheAccountType.ADFS_ACCOUNT_TYPE : CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.authorityType = (authority &&
+            authority.authorityType === AuthorityType.Adfs) ? CacheAccountType.ADFS_ACCOUNT_TYPE : CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
         account.realm = Constants.EMPTY_STRING;
@@ -2339,7 +2371,7 @@ var AccountEntity = /** @class */ (function () {
         var _a;
         var accountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.sub) ? idToken.claims.sub : Constants.EMPTY_STRING;
         // since ADFS does not have tid and does not set client_info
-        if (authType === AuthorityType.Adfs) {
+        if (authType === AuthorityType.Adfs || authType === AuthorityType.Dsts) {
             return accountId;
         }
         // for cases where there is clientInfo
@@ -2400,7 +2432,7 @@ var AccountEntity = /** @class */ (function () {
     return AccountEntity;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2435,10 +2467,24 @@ var AuthToken = /** @class */ (function () {
             throw ClientAuthError.createTokenParsingError(err);
         }
     };
+    /**
+     * Determine if the token's max_age has transpired
+     */
+    AuthToken.checkMaxAge = function (authTime, maxAge) {
+        /*
+         * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+         * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
+         * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
+         */
+        var fiveMinuteSkew = 300000; // five minutes in milliseconds
+        if ((maxAge === 0) || ((Date.now() - fiveMinuteSkew) > (authTime + maxAge))) {
+            throw ClientAuthError.createMaxAgeTranspiredError();
+        }
+    };
     return AuthToken;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2640,7 +2686,11 @@ var CacheManager = /** @class */ (function () {
             if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
                 return;
             }
-            if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
+            /*
+             * homeAccountId can undefined, and we want to filter out cached items that have a homeAccountId of ""
+             * because we don't want a client_credential request to return a cached token that has a homeAccountId
+             */
+            if ((typeof homeAccountId === "string") && !_this.matchHomeAccountId(entity, homeAccountId)) {
                 return;
             }
             if (!!environment && !_this.matchEnvironment(entity, environment)) {
@@ -3059,7 +3109,7 @@ var CacheManager = /** @class */ (function () {
      * @param homeAccountId
      */
     CacheManager.prototype.matchHomeAccountId = function (entity, homeAccountId) {
-        return !!(entity.homeAccountId && homeAccountId === entity.homeAccountId);
+        return !!((typeof entity.homeAccountId === "string") && (homeAccountId === entity.homeAccountId));
     };
     /**
      * helper to match assertion
@@ -3313,7 +3363,7 @@ var DefaultStorageClass = /** @class */ (function (_super) {
     return DefaultStorageClass;
 }(CacheManager));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3407,7 +3457,7 @@ function buildAuthOptions(authOptions) {
     return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS, skipAuthorityMetadataCache: false }, authOptions);
 }
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3427,7 +3477,7 @@ var ServerError = /** @class */ (function (_super) {
     return ServerError;
 }(AuthError));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3523,7 +3573,7 @@ var ThrottlingUtils = /** @class */ (function () {
     return ThrottlingUtils;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3572,7 +3622,7 @@ var NetworkManager = /** @class */ (function () {
     return NetworkManager;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3583,7 +3633,7 @@ var CcsCredentialType;
     CcsCredentialType["UPN"] = "UPN";
 })(CcsCredentialType || (CcsCredentialType = {}));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3674,7 +3724,7 @@ var BaseClient = /** @class */ (function () {
     return BaseClient;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3760,7 +3810,7 @@ var RequestValidator = /** @class */ (function () {
     return RequestValidator;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4138,7 +4188,7 @@ var RequestParameterBuilder = /** @class */ (function () {
     return RequestParameterBuilder;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4202,7 +4252,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
     return IdTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4252,7 +4302,7 @@ var TimeUtils = /** @class */ (function () {
     return TimeUtils;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4366,7 +4416,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
     return AccessTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4433,7 +4483,7 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
     return RefreshTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4508,7 +4558,7 @@ var InteractionRequiredAuthError = /** @class */ (function (_super) {
     return InteractionRequiredAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4524,7 +4574,7 @@ var CacheRecord = /** @class */ (function () {
     return CacheRecord;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4595,7 +4645,7 @@ var ProtocolUtils = /** @class */ (function () {
     return ProtocolUtils;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4829,7 +4879,7 @@ var UrlString = /** @class */ (function () {
     return UrlString;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4930,7 +4980,7 @@ var PopTokenGenerator = /** @class */ (function () {
     return PopTokenGenerator;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5000,7 +5050,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return AppMetadataEntity;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5036,7 +5086,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return TokenCacheContext;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5097,9 +5147,9 @@ var ResponseHandler = /** @class */ (function () {
      * @param serverTokenResponse
      * @param authority
      */
-    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse) {
+    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
         return __awaiter(this, void 0, void 0, function () {
-            var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
+            var idTokenObj, authTime, requestStateObj, cacheRecord, cacheContext, key, account;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -5111,6 +5161,14 @@ var ResponseHandler = /** @class */ (function () {
                                     throw ClientAuthError.createNonceMismatchError();
                                 }
                             }
+                            // token max_age check
+                            if (request.maxAge || (request.maxAge === 0)) {
+                                authTime = idTokenObj.claims.auth_time;
+                                if (!authTime) {
+                                    throw ClientAuthError.createAuthTimeNotFoundError();
+                                }
+                                AuthToken.checkMaxAge(authTime, request.maxAge);
+                            }
                         }
                         // generate homeAccountId
                         this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
@@ -5142,7 +5200,7 @@ var ResponseHandler = /** @class */ (function () {
                             account = this.cacheStorage.getAccount(key);
                             if (!account) {
                                 this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined)];
+                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId)];
                             }
                         }
                         return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
@@ -5157,7 +5215,7 @@ var ResponseHandler = /** @class */ (function () {
                         _a.sent();
                         _a.label = 7;
                     case 7: return [7 /*endfinally*/];
-                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
+                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code, serverRequestId)];
                 }
             });
         });
@@ -5243,7 +5301,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param fromTokenCache
      * @param stateString
      */
-    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
+    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code, requestId) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
             var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
@@ -5291,6 +5349,7 @@ var ResponseHandler = /** @class */ (function () {
                                 fromCache: fromTokenCache,
                                 expiresOn: expiresOn,
                                 correlationId: request.correlationId,
+                                requestId: requestId || Constants.EMPTY_STRING,
                                 extExpiresOn: extExpiresOn,
                                 familyId: familyId,
                                 tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
@@ -5307,7 +5366,7 @@ var ResponseHandler = /** @class */ (function () {
     return ResponseHandler;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5353,10 +5412,11 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      * @param request
      */
     AuthorizationCodeClient.prototype.acquireToken = function (request, authCodePayload) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var reqTimestamp, response, responseHandler;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var reqTimestamp, response, requestId, responseHandler;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         this.logger.info("in acquireToken call");
                         if (!request || StringUtils.isEmpty(request.code)) {
@@ -5365,12 +5425,13 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executeTokenRequest(this.authority, request)];
                     case 1:
-                        response = _a.sent();
+                        response = _b.sent();
+                        requestId = (_a = response.headers) === null || _a === void 0 ? void 0 : _a[HeaderNames.X_MS_REQUEST_ID];
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         // Validate response. This function throws a server error if an error is returned by the server.
                         responseHandler.validateTokenResponse(response.body);
-                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload)];
-                    case 2: return [2 /*return*/, _a.sent()];
+                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)];
+                    case 2: return [2 /*return*/, _b.sent()];
                 }
             });
         });
@@ -5758,7 +5819,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     return AuthorizationCodeClient;
 }(BaseClient));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5841,10 +5902,6 @@ exports.PerformanceEvents = void 0;
      * Used to acquire a token from Native component when native brokering is enabled.
      */
     PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
-    /**
-     * Time spent on the network for refresh token acquisition
-     */
-    PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
     /**
      * Time spent creating default headers for requests to token endpoint
      */
@@ -5858,10 +5915,21 @@ exports.PerformanceEvents = void 0;
      */
     PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
     /**
-     * acquireToken API in BrokerClientApplication.
-     * Used to acquire a token on behalf of the embedded application (PW-Broker).
+     * Time taken for token acquisition by broker
      */
     PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
+    /**
+     * Time spent on the network for refresh token acquisition
+     */
+    PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
+    /**
+     * Time taken for acquiring refresh token , records RT size
+     */
+    PerformanceEvents["RefreshTokenClientAcquireToken"] = "refreshTokenClientAcquireToken";
+    /**
+     * Time taken for acquiring cached refresh token
+     */
+    PerformanceEvents["RefreshTokenClientAcquireTokenWithCachedRefreshToken"] = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
 })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
 /**
  * State of the performance event.
@@ -5876,7 +5944,7 @@ var PerformanceEventStatus;
     PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
 })(PerformanceEventStatus || (PerformanceEventStatus = {}));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5891,18 +5959,40 @@ var RefreshTokenClient = /** @class */ (function (_super) {
         return _super.call(this, configuration, performanceClient) || this;
     }
     RefreshTokenClient.prototype.acquireToken = function (request) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function () {
-            var reqTimestamp, response, responseHandler;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var atsMeasurement, reqTimestamp, response, requestId, responseHandler;
+            var _this = this;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
+                        atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
+                        this.logger.verbose("RefreshTokenClientAcquireToken called", request.correlationId);
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
                     case 1:
-                        response = _a.sent();
+                        response = _c.sent();
+                        requestId = (_b = response.headers) === null || _b === void 0 ? void 0 : _b[HeaderNames.X_MS_REQUEST_ID];
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         responseHandler.validateTokenResponse(response.body);
-                        return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache)];
+                        return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId).then(function (result) {
+                                var _a;
+                                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                    success: true,
+                                    refreshTokenSize: ((_a = response.body.refresh_token) === null || _a === void 0 ? void 0 : _a.length) || 0
+                                });
+                                return result;
+                            })
+                                .catch(function (error) {
+                                _this.logger.verbose("Error in fetching refresh token", request.correlationId);
+                                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                    errorCode: error.errorCode,
+                                    subErrorCode: error.subError,
+                                    success: false,
+                                    refreshTokenSize: undefined
+                                });
+                                throw error;
+                            })];
                 }
             });
         });
@@ -5952,14 +6042,21 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      * @param request
      */
     RefreshTokenClient.prototype.acquireTokenWithCachedRefreshToken = function (request, foci) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var refreshToken, refreshTokenRequest;
-            return __generator(this, function (_a) {
+            var atsMeasurement, refreshToken, refreshTokenRequest;
+            return __generator(this, function (_b) {
+                atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
+                this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
                 refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
-                // no refresh Token
                 if (!refreshToken) {
+                    atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.discardMeasurement();
                     throw InteractionRequiredAuthError.createNoTokensFoundError();
                 }
+                // attach cached RT size to the current measurement
+                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                    success: true
+                });
                 refreshTokenRequest = __assign(__assign({}, request), { refreshToken: refreshToken.secret, authenticationScheme: request.authenticationScheme || exports.AuthenticationScheme.BEARER, ccsCredential: {
                         credential: request.account.homeAccountId,
                         type: CcsCredentialType.HOME_ACCOUNT_ID
@@ -6112,7 +6209,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
     return RefreshTokenClient;
 }(BaseClient));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6212,13 +6309,21 @@ var SilentFlowClient = /** @class */ (function (_super) {
      */
     SilentFlowClient.prototype.generateResultFromCacheRecord = function (cacheRecord, request) {
         return __awaiter(this, void 0, void 0, function () {
-            var idTokenObj;
+            var idTokenObj, authTime;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         if (cacheRecord.idToken) {
                             idTokenObj = new AuthToken(cacheRecord.idToken.secret, this.config.cryptoInterface);
                         }
+                        // token max_age check
+                        if (request.maxAge || (request.maxAge === 0)) {
+                            authTime = idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.auth_time;
+                            if (!authTime) {
+                                throw ClientAuthError.createAuthTimeNotFoundError();
+                            }
+                            AuthToken.checkMaxAge(authTime, request.maxAge);
+                        }
                         return [4 /*yield*/, ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenObj)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
@@ -6228,7 +6333,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     return SilentFlowClient;
 }(BaseClient));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6240,7 +6345,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6249,7 +6354,7 @@ var rawMetdataJSON = { "endpointMetadata": { "https://login.microsoftonline.com/
 var EndpointMetadata = rawMetdataJSON.endpointMetadata;
 var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6263,7 +6368,7 @@ exports.ProtocolMode = void 0;
     ProtocolMode["OIDC"] = "OIDC";
 })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6340,7 +6445,7 @@ var AuthorityMetadataEntity = /** @class */ (function () {
     return AuthorityMetadataEntity;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6350,7 +6455,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6472,7 +6577,7 @@ var RegionDiscovery = /** @class */ (function () {
     return RegionDiscovery;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6497,8 +6602,13 @@ var Authority = /** @class */ (function () {
         // See above for AuthorityType
         get: function () {
             var pathSegments = this.canonicalAuthorityUrlComponents.PathSegments;
-            if (pathSegments.length && pathSegments[0].toLowerCase() === Constants.ADFS) {
-                return AuthorityType.Adfs;
+            if (pathSegments.length) {
+                switch (pathSegments[0].toLowerCase()) {
+                    case Constants.ADFS:
+                        return AuthorityType.Adfs;
+                    case Constants.DSTS:
+                        return AuthorityType.Dsts;
+                }
             }
             return AuthorityType.Default;
         },
@@ -6702,7 +6812,9 @@ var Authority = /** @class */ (function () {
          * The default open id configuration endpoint for any canonical authority.
          */
         get: function () {
-            if (this.authorityType === AuthorityType.Adfs || this.protocolMode === exports.ProtocolMode.OIDC) {
+            if (this.authorityType === AuthorityType.Adfs ||
+                this.authorityType === AuthorityType.Dsts ||
+                this.protocolMode === exports.ProtocolMode.OIDC) {
                 return this.canonicalAuthority + ".well-known/openid-configuration";
             }
             return this.canonicalAuthority + "v2.0/.well-known/openid-configuration";
@@ -6800,8 +6912,9 @@ var Authority = /** @class */ (function () {
         });
     };
     /**
-     * Compares the number of url components after the domain to determine if the cached authority metadata can be used for the requested authority
-     * Protects against same domain different authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
+     * Compares the number of url components after the domain to determine if the cached
+     * authority metadata can be used for the requested authority. Protects against same domain different
+     * authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
      * @param metadataEntity
      */
     Authority.prototype.isAuthoritySameType = function (metadataEntity) {
@@ -6841,7 +6954,8 @@ var Authority = /** @class */ (function () {
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
-                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
+                        return [4 /*yield*/, this.networkInterface.
+                                sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
                     case 2:
                         response = _a.sent();
                         return [2 /*return*/, isOpenIdConfigResponse(response.body) ? response.body : null];
@@ -6902,7 +7016,8 @@ var Authority = /** @class */ (function () {
         });
     };
     /**
-     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from
+     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
+     * and returns where the information was retrieved from
      * @param cachedMetadata
      * @param newMetadata
      */
@@ -7125,7 +7240,7 @@ var Authority = /** @class */ (function () {
     Authority.replaceWithRegionalInformation = function (metadata, azureRegion) {
         metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
         // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
-        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
+        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
         if (metadata.end_session_endpoint) {
             metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
         }
@@ -7134,7 +7249,7 @@ var Authority = /** @class */ (function () {
     return Authority;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7195,7 +7310,7 @@ var AuthorityFactory = /** @class */ (function () {
     return AuthorityFactory;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7226,7 +7341,7 @@ var ServerTelemetryEntity = /** @class */ (function () {
     return ServerTelemetryEntity;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7254,7 +7369,7 @@ var ThrottlingEntity = /** @class */ (function () {
     return ThrottlingEntity;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7271,7 +7386,7 @@ var StubbedNetworkModule = {
     }
 };
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7316,7 +7431,7 @@ var JoseHeaderError = /** @class */ (function (_super) {
     return JoseHeaderError;
 }(AuthError));
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7356,7 +7471,7 @@ var JoseHeader = /** @class */ (function () {
     return JoseHeader;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7415,7 +7530,7 @@ var AuthenticationHeaderParser = /** @class */ (function () {
     return AuthenticationHeaderParser;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7577,7 +7692,7 @@ var ServerTelemetryManager = /** @class */ (function () {
     return ServerTelemetryManager;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7786,6 +7901,9 @@ var PerformanceClient = /** @class */ (function () {
                         if (current.idTokenSize) {
                             previous.idTokenSize = current.idTokenSize;
                         }
+                        if (current.refreshTokenSize) {
+                            previous.refreshTokenSize = current.refreshTokenSize;
+                        }
                     }
                     return previous;
                 }, topLevelEvent);
@@ -7853,7 +7971,7 @@ var PerformanceClient = /** @class */ (function () {
     return PerformanceClient;
 }());
 
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.6.0 2022-10-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7979,7 +8097,7 @@ var BrowserAuthErrorMessage = {
     },
     silentPromptValueError: {
         code: "silent_prompt_value_error",
-        desc: "The value given for the prompt value is not valid for silent requests - must be set to 'none'."
+        desc: "The value given for the prompt value is not valid for silent requests - must be set to 'none' or 'no_session'."
     },
     noTokenRequestCacheError: {
         code: "no_token_request_cache_error",
@@ -8391,7 +8509,7 @@ var BrowserConstants = {
     /**
      * Default popup monitor poll interval in milliseconds
      */
-    POLL_INTERVAL_MS: 50,
+    DEFAULT_POLL_INTERVAL_MS: 30,
     /**
      * Msal-browser SKU
      */
@@ -8530,7 +8648,44 @@ exports.WrapperSKU = void 0;
 // DatabaseStorage Constants
 var DB_NAME = "msal.db";
 var DB_VERSION = 1;
-var DB_TABLE_NAME = DB_NAME + ".keys";
+var DB_TABLE_NAME = DB_NAME + ".keys";
+exports.CacheLookupPolicy = void 0;
+(function (CacheLookupPolicy) {
+    /*
+     * acquireTokenSilent will attempt to retrieve an access token from the cache. If the access token is expired
+     * or cannot be found the refresh token will be used to acquire a new one. Finally, if the refresh token
+     * is expired acquireTokenSilent will attempt to acquire new access and refresh tokens.
+     */
+    CacheLookupPolicy[CacheLookupPolicy["Default"] = 0] = "Default";
+    /*
+     * acquireTokenSilent will only look for access tokens in the cache. It will not attempt to renew access or
+     * refresh tokens.
+     */
+    CacheLookupPolicy[CacheLookupPolicy["AccessToken"] = 1] = "AccessToken";
+    /*
+     * acquireTokenSilent will attempt to retrieve an access token from the cache. If the access token is expired or
+     * cannot be found, the refresh token will be used to acquire a new one. If the refresh token is expired, it
+     * will not be renewed and acquireTokenSilent will fail.
+     */
+    CacheLookupPolicy[CacheLookupPolicy["AccessTokenAndRefreshToken"] = 2] = "AccessTokenAndRefreshToken";
+    /*
+     * acquireTokenSilent will not attempt to retrieve access tokens from the cache and will instead attempt to
+     * exchange the cached refresh token for a new access token. If the refresh token is expired, it will not be
+     * renewed and acquireTokenSilent will fail.
+     */
+    CacheLookupPolicy[CacheLookupPolicy["RefreshToken"] = 3] = "RefreshToken";
+    /*
+     * acquireTokenSilent will not look in the cache for the access token. It will go directly to network with the
+     * cached refresh token. If the refresh token is expired an attempt will be made to renew it. This is equivalent to
+     * setting "forceRefresh: true".
+     */
+    CacheLookupPolicy[CacheLookupPolicy["RefreshTokenAndNetwork"] = 4] = "RefreshTokenAndNetwork";
+    /*
+     * acquireTokenSilent will attempt to renew both access and refresh tokens. It will not look in the cache. This will
+     * always fail if 3rd party cookies are blocked by the browser.
+     */
+    CacheLookupPolicy[CacheLookupPolicy["Skip"] = 5] = "Skip";
+})(exports.CacheLookupPolicy || (exports.CacheLookupPolicy = {}));
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8569,6 +8724,10 @@ var BrowserConfigurationAuthErrorMessage = {
     inMemRedirectUnavailable: {
         code: "in_mem_redirect_unavailable",
         desc: "Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true."
+    },
+    entropyNotProvided: {
+        code: "entropy_not_provided",
+        desc: "The available browser crypto interface requires entropy set via system.cryptoOptions.entropy configuration option."
     }
 };
 /**
@@ -8619,6 +8778,12 @@ var BrowserConfigurationAuthError = /** @class */ (function (_super) {
     BrowserConfigurationAuthError.createInMemoryRedirectUnavailableError = function () {
         return new BrowserConfigurationAuthError(BrowserConfigurationAuthErrorMessage.inMemRedirectUnavailable.code, BrowserConfigurationAuthErrorMessage.inMemRedirectUnavailable.desc);
     };
+    /**
+     * Creates an error thrown when a crypto interface that requires entropy is initialized without entropy
+     */
+    BrowserConfigurationAuthError.createEntropyNotProvided = function () {
+        return new BrowserConfigurationAuthError(BrowserConfigurationAuthErrorMessage.entropyNotProvided.code, BrowserConfigurationAuthErrorMessage.entropyNotProvided.desc);
+    };
     return BrowserConfigurationAuthError;
 }(AuthError));
 
@@ -9681,7 +9846,7 @@ var DEFAULT_BROWSER_CACHE_MANAGER = function (clientId, logger) {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-browser";
-var version = "2.28.3";
+var version = "2.30.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11084,7 +11249,8 @@ var NativeInteractionClient = /** @class */ (function (_super) {
                                 .then(function (result) {
                                 nativeATMeasurement.endMeasurement({
                                     success: true,
-                                    isNativeBroker: true
+                                    isNativeBroker: true,
+                                    requestId: result.requestId
                                 });
                                 return result;
                             })
@@ -12300,7 +12466,7 @@ var PopupClient = /** @class */ (function (_super) {
              * Polling for popups needs to be tick-based,
              * since a non-trivial amount of time can be spent on interaction (which should not count against the timeout).
              */
-            var maxTicks = _this.config.system.windowHashTimeout / BrowserConstants.POLL_INTERVAL_MS;
+            var maxTicks = _this.config.system.windowHashTimeout / _this.config.system.pollIntervalMilliseconds;
             var ticks = 0;
             _this.logger.verbose("PopupHandler.monitorPopupForHash - polling started");
             var intervalId = setInterval(function () {
@@ -12353,7 +12519,7 @@ var PopupClient = /** @class */ (function (_super) {
                     clearInterval(intervalId);
                     reject(BrowserAuthError.createMonitorPopupTimeoutError());
                 }
-            }, BrowserConstants.POLL_INTERVAL_MS);
+            }, _this.config.system.pollIntervalMilliseconds);
         });
     };
     /**
@@ -12391,7 +12557,7 @@ var PopupClient = /** @class */ (function (_super) {
                 clearInterval(intervalId);
                 _this.cleanPopup(popupWindow);
                 resolve();
-            }, BrowserConstants.POLL_INTERVAL_MS);
+            }, _this.config.system.pollIntervalMilliseconds);
         });
     };
     /**
@@ -12624,7 +12790,10 @@ function buildConfiguration(_a, isBrowserEnvironment) {
     // Default system options for browser
     var DEFAULT_BROWSER_SYSTEM_OPTIONS = __assign$1(__assign$1({}, DEFAULT_SYSTEM_OPTIONS), { loggerOptions: DEFAULT_LOGGER_OPTIONS, networkClient: isBrowserEnvironment ? BrowserUtils.getBrowserNetworkClient() : StubbedNetworkModule, navigationClient: new NavigationClient(), loadFrameTimeout: 0, 
         // If loadFrameTimeout is provided, use that as default.
-        windowHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false, allowNativeBroker: false, nativeBrokerHandshakeTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.nativeBrokerHandshakeTimeout) || DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS });
+        windowHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false, allowNativeBroker: false, nativeBrokerHandshakeTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.nativeBrokerHandshakeTimeout) || DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS, pollIntervalMilliseconds: BrowserConstants.DEFAULT_POLL_INTERVAL_MS, cryptoOptions: {
+            useMsrCrypto: false,
+            entropy: undefined
+        } });
     var DEFAULT_TELEMETRY_OPTIONS = {
         application: {
             appName: Constants.EMPTY_STRING,
@@ -12646,9 +12815,10 @@ function buildConfiguration(_a, isBrowserEnvironment) {
  */
 var SilentHandler = /** @class */ (function (_super) {
     __extends$1(SilentHandler, _super);
-    function SilentHandler(authCodeModule, storageImpl, authCodeRequest, logger, navigateFrameWait) {
+    function SilentHandler(authCodeModule, storageImpl, authCodeRequest, logger, systemOptions) {
         var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, logger) || this;
-        _this.navigateFrameWait = navigateFrameWait;
+        _this.navigateFrameWait = systemOptions.navigateFrameWait;
+        _this.pollIntervalMilliseconds = systemOptions.pollIntervalMilliseconds;
         return _this;
     }
     /**
@@ -12726,7 +12896,7 @@ var SilentHandler = /** @class */ (function (_super) {
                     resolve(contentHash);
                     return;
                 }
-            }, BrowserConstants.POLL_INTERVAL_MS);
+            }, _this.pollIntervalMilliseconds);
         });
     };
     /**
@@ -12805,7 +12975,7 @@ var SilentIframeClient = /** @class */ (function (_super) {
         return _this;
     }
     /**
-     * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none
+     * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none or prompt=no_session
      * @param request
      */
     SilentIframeClient.prototype.acquireToken = function (request) {
@@ -12820,14 +12990,14 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         if (StringUtils.isEmpty(request.loginHint) && StringUtils.isEmpty(request.sid) && (!request.account || StringUtils.isEmpty(request.account.username))) {
                             this.logger.warning("No user hint provided. The authorization server may need more information to complete this request.");
                         }
-                        // Check that prompt is set to none, throw error if it is set to anything else.
-                        if (request.prompt && request.prompt !== PromptValue.NONE) {
+                        // Check that prompt is set to none or no_session, throw error if it is set to anything else.
+                        if (request.prompt && (request.prompt !== PromptValue.NONE) && (request.prompt !== PromptValue.NO_SESSION)) {
                             acquireTokenMeasurement.endMeasurement({
                                 success: false
                             });
                             throw BrowserAuthError.createSilentPromptValueError(request.prompt);
                         }
-                        return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent)];
+                        return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: request.prompt || PromptValue.NONE }), exports.InteractionType.Silent)];
                     case 1:
                         silentRequest = _a.sent();
                         this.browserStorage.updateCacheEntries(silentRequest.state, silentRequest.nonce, silentRequest.authority, silentRequest.loginHint || Constants.EMPTY_STRING, silentRequest.account || null);
@@ -12842,7 +13012,8 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         return [4 /*yield*/, this.silentTokenHelper(authClient, silentRequest).then(function (result) {
                                 acquireTokenMeasurement.endMeasurement({
                                     success: true,
-                                    fromCache: false
+                                    fromCache: false,
+                                    requestId: result.requestId
                                 });
                                 return result;
                             })];
@@ -12890,7 +13061,7 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, silentRequest), { nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme) }))];
                     case 2:
                         navigateUrl = _a.sent();
-                        silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system.navigateFrameWait);
+                        silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system);
                         return [4 /*yield*/, silentHandler.initiateAuthRequest(navigateUrl)];
                     case 3:
                         msalFrame = _a.sent();
@@ -12906,7 +13077,7 @@ var SilentIframeClient = /** @class */ (function (_super) {
                             }
                             nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.browserStorage, this.correlationId);
                             userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
-                            return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: PromptValue.NONE })).finally(function () {
+                            return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: silentRequest.prompt || PromptValue.NONE })).finally(function () {
                                     _this.browserStorage.cleanRequestByState(state);
                                 })];
                         }
@@ -12954,7 +13125,8 @@ var SilentRefreshClient = /** @class */ (function (_super) {
                                 .then(function (result) {
                                 acquireTokenMeasurement.endMeasurement({
                                     success: true,
-                                    fromCache: result.fromCache
+                                    fromCache: result.fromCache,
+                                    requestId: result.requestId
                                 });
                                 return result;
                             })
@@ -13360,6 +13532,13 @@ var BrowserStringUtils = /** @class */ (function () {
         }
         return sView;
     };
+    /**
+     * Returns stringified jwk.
+     * @param jwk
+     */
+    BrowserStringUtils.getSortedObjectString = function (obj) {
+        return JSON.stringify(obj, Object.keys(obj).sort());
+    };
     return BrowserStringUtils;
 }());
 
@@ -13602,178 +13781,117 @@ var PkceGenerator = /** @class */ (function () {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-/**
- * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
- */
-// RSA KeyGen Algorithm
-var PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
-// SHA-256 hashing algorithm
-var S256_HASH_ALG = "SHA-256";
-// MOD length for PoP tokens
-var MODULUS_LENGTH = 2048;
-// Public Exponent
-var PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
-/**
- * This class implements functions used by the browser library to perform cryptography operations such as
- * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
- */
-var BrowserCrypto = /** @class */ (function () {
-    function BrowserCrypto(logger) {
-        this.logger = logger;
-        if (!(this.hasCryptoAPI())) {
-            throw BrowserAuthError.createCryptoNotAvailableError("Browser crypto or msCrypto object not available.");
-        }
-        this._keygenAlgorithmOptions = {
-            name: PKCS1_V15_KEYGEN_ALG,
-            hash: S256_HASH_ALG,
-            modulusLength: MODULUS_LENGTH,
-            publicExponent: PUBLIC_EXPONENT
-        };
+var ModernBrowserCrypto = /** @class */ (function () {
+    function ModernBrowserCrypto() {
     }
-    /**
-     * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
-     * @param dataString
-     */
-    BrowserCrypto.prototype.sha256Digest = function (dataString) {
+    ModernBrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+        return window.crypto.getRandomValues(dataBuffer);
+    };
+    ModernBrowserCrypto.prototype.generateKey = function (algorithm, extractable, keyUsages) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var data;
             return __generator$1(this, function (_a) {
-                data = BrowserStringUtils.stringToUtf8Arr(dataString);
-                return [2 /*return*/, this.hasIECrypto() ? this.getMSCryptoDigest(S256_HASH_ALG, data) : this.getSubtleCryptoDigest(S256_HASH_ALG, data)];
+                return [2 /*return*/, window.crypto.subtle.generateKey(algorithm, extractable, keyUsages)];
             });
         });
     };
-    /**
-     * Populates buffer with cryptographically random values.
-     * @param dataBuffer
-     */
-    BrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
-        var cryptoObj = window["msCrypto"] || window.crypto;
-        if (!cryptoObj.getRandomValues) {
-            throw BrowserAuthError.createCryptoNotAvailableError("getRandomValues does not exist.");
-        }
-        cryptoObj.getRandomValues(dataBuffer);
-    };
-    /**
-     * Generates a keypair based on current keygen algorithm config.
-     * @param extractable
-     * @param usages
-     */
-    BrowserCrypto.prototype.generateKeyPair = function (extractable, usages) {
+    ModernBrowserCrypto.prototype.exportKey = function (key) {
         return __awaiter$1(this, void 0, void 0, function () {
             return __generator$1(this, function (_a) {
-                return [2 /*return*/, (this.hasIECrypto() ?
-                        this.msCryptoGenerateKey(extractable, usages)
-                        : window.crypto.subtle.generateKey(this._keygenAlgorithmOptions, extractable, usages))];
+                return [2 /*return*/, window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key)];
             });
         });
     };
-    /**
-     * Export key as Json Web Key (JWK)
-     * @param key
-     * @param format
-     */
-    BrowserCrypto.prototype.exportJwk = function (key) {
+    ModernBrowserCrypto.prototype.importKey = function (keyData, algorithm, extractable, keyUsages) {
         return __awaiter$1(this, void 0, void 0, function () {
             return __generator$1(this, function (_a) {
-                return [2 /*return*/, this.hasIECrypto() ? this.msCryptoExportJwk(key) : window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key)];
+                return [2 /*return*/, window.crypto.subtle.importKey(KEY_FORMAT_JWK, keyData, algorithm, extractable, keyUsages)];
             });
         });
     };
-    /**
-     * Imports key as Json Web Key (JWK), can set extractable and usages.
-     * @param key
-     * @param format
-     * @param extractable
-     * @param usages
-     */
-    BrowserCrypto.prototype.importJwk = function (key, extractable, usages) {
+    ModernBrowserCrypto.prototype.sign = function (algorithm, key, data) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var keyString, keyBuffer;
             return __generator$1(this, function (_a) {
-                keyString = BrowserCrypto.getJwkString(key);
-                keyBuffer = BrowserStringUtils.stringToArrayBuffer(keyString);
-                return [2 /*return*/, this.hasIECrypto() ?
-                        this.msCryptoImportKey(keyBuffer, extractable, usages)
-                        : window.crypto.subtle.importKey(KEY_FORMAT_JWK, key, this._keygenAlgorithmOptions, extractable, usages)];
+                return [2 /*return*/, window.crypto.subtle.sign(algorithm, key, data)];
             });
         });
     };
-    /**
-     * Signs given data with given key
-     * @param key
-     * @param data
-     */
-    BrowserCrypto.prototype.sign = function (key, data) {
+    ModernBrowserCrypto.prototype.digest = function (algorithm, data) {
         return __awaiter$1(this, void 0, void 0, function () {
             return __generator$1(this, function (_a) {
-                return [2 /*return*/, this.hasIECrypto() ?
-                        this.msCryptoSign(key, data)
-                        : window.crypto.subtle.sign(this._keygenAlgorithmOptions, key, data)];
+                return [2 /*return*/, window.crypto.subtle.digest(algorithm, data)];
             });
         });
     };
-    /**
-     * Check whether IE crypto or other browser cryptography is available.
-     */
-    BrowserCrypto.prototype.hasCryptoAPI = function () {
-        return this.hasIECrypto() || this.hasBrowserCrypto();
+    return ModernBrowserCrypto;
+}());
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var MsrBrowserCrypto = /** @class */ (function () {
+    function MsrBrowserCrypto() {
+    }
+    MsrBrowserCrypto.prototype.initPrng = function (entropy) {
+        // Turn into array, as initPrng seems to not always like Uint8Array (even though it should support both)
+        return window.msrCrypto.initPrng(__spread(entropy));
     };
-    /**
-     * Checks whether IE crypto (AKA msCrypto) is available.
-     */
-    BrowserCrypto.prototype.hasIECrypto = function () {
-        return "msCrypto" in window;
+    MsrBrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+        return window.msrCrypto.getRandomValues(dataBuffer);
     };
-    /**
-     * Check whether browser crypto is available.
-     */
-    BrowserCrypto.prototype.hasBrowserCrypto = function () {
-        return "crypto" in window;
+    MsrBrowserCrypto.prototype.generateKey = function (algorithm, extractable, keyUsages) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                return [2 /*return*/, window.msrCrypto.subtle.generateKey(algorithm, extractable, keyUsages)];
+            });
+        });
     };
-    /**
-     * Helper function for SHA digest.
-     * @param algorithm
-     * @param data
-     */
-    BrowserCrypto.prototype.getSubtleCryptoDigest = function (algorithm, data) {
+    MsrBrowserCrypto.prototype.exportKey = function (key) {
         return __awaiter$1(this, void 0, void 0, function () {
             return __generator$1(this, function (_a) {
-                return [2 /*return*/, window.crypto.subtle.digest(algorithm, data)];
+                return [2 /*return*/, window.msrCrypto.subtle.exportKey(KEY_FORMAT_JWK, key)];
             });
         });
     };
-    /**
-     * IE Helper function for SHA digest.
-     * @param algorithm
-     * @param data
-     */
-    BrowserCrypto.prototype.getMSCryptoDigest = function (algorithm, data) {
+    MsrBrowserCrypto.prototype.importKey = function (keyData, algorithm, extractable, keyUsages) {
         return __awaiter$1(this, void 0, void 0, function () {
             return __generator$1(this, function (_a) {
-                return [2 /*return*/, new Promise(function (resolve, reject) {
-                        var digestOperation = window["msCrypto"].subtle.digest(algorithm, data.buffer);
-                        digestOperation.addEventListener("complete", function (e) {
-                            resolve(e.target.result);
-                        });
-                        digestOperation.addEventListener("error", function (error) {
-                            reject(error);
-                        });
-                    })];
+                return [2 /*return*/, window.msrCrypto.subtle.importKey(KEY_FORMAT_JWK, keyData, algorithm, extractable, keyUsages)];
             });
         });
     };
-    /**
-     * IE Helper function for generating a keypair
-     * @param extractable
-     * @param usages
-     */
-    BrowserCrypto.prototype.msCryptoGenerateKey = function (extractable, usages) {
+    MsrBrowserCrypto.prototype.sign = function (algorithm, key, data) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                return [2 /*return*/, window.msrCrypto.subtle.sign(algorithm, key, data)];
+            });
+        });
+    };
+    MsrBrowserCrypto.prototype.digest = function (algorithm, data) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                return [2 /*return*/, window.msrCrypto.subtle.digest(algorithm, data)];
+            });
+        });
+    };
+    return MsrBrowserCrypto;
+}());
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var MsBrowserCrypto = /** @class */ (function () {
+    function MsBrowserCrypto() {
+    }
+    MsBrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+        return window["msCrypto"].getRandomValues(dataBuffer);
+    };
+    MsBrowserCrypto.prototype.generateKey = function (algorithm, extractable, keyUsages) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var _this = this;
             return __generator$1(this, function (_a) {
                 return [2 /*return*/, new Promise(function (resolve, reject) {
-                        var msGenerateKey = window["msCrypto"].subtle.generateKey(_this._keygenAlgorithmOptions, extractable, usages);
+                        var msGenerateKey = window["msCrypto"].subtle.generateKey(algorithm, extractable, keyUsages);
                         msGenerateKey.addEventListener("complete", function (e) {
                             resolve(e.target.result);
                         });
@@ -13784,12 +13902,7 @@ var BrowserCrypto = /** @class */ (function () {
             });
         });
     };
-    /**
-     * IE Helper function for exportKey
-     * @param key
-     * @param format
-     */
-    BrowserCrypto.prototype.msCryptoExportJwk = function (key) {
+    MsBrowserCrypto.prototype.exportKey = function (key) {
         return __awaiter$1(this, void 0, void 0, function () {
             return __generator$1(this, function (_a) {
                 return [2 /*return*/, new Promise(function (resolve, reject) {
@@ -13816,19 +13929,14 @@ var BrowserCrypto = /** @class */ (function () {
             });
         });
     };
-    /**
-     * IE Helper function for importKey
-     * @param key
-     * @param format
-     * @param extractable
-     * @param usages
-     */
-    BrowserCrypto.prototype.msCryptoImportKey = function (keyBuffer, extractable, usages) {
+    MsBrowserCrypto.prototype.importKey = function (keyData, algorithm, extractable, keyUsages) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var _this = this;
+            var keyString, keyBuffer;
             return __generator$1(this, function (_a) {
+                keyString = BrowserStringUtils.getSortedObjectString(keyData);
+                keyBuffer = BrowserStringUtils.stringToArrayBuffer(keyString);
                 return [2 /*return*/, new Promise(function (resolve, reject) {
-                        var msImportKey = window["msCrypto"].subtle.importKey(KEY_FORMAT_JWK, keyBuffer, _this._keygenAlgorithmOptions, extractable, usages);
+                        var msImportKey = window["msCrypto"].subtle.importKey(KEY_FORMAT_JWK, keyBuffer, algorithm, extractable, keyUsages);
                         msImportKey.addEventListener("complete", function (e) {
                             resolve(e.target.result);
                         });
@@ -13839,17 +13947,11 @@ var BrowserCrypto = /** @class */ (function () {
             });
         });
     };
-    /**
-     * IE Helper function for sign JWT
-     * @param key
-     * @param data
-     */
-    BrowserCrypto.prototype.msCryptoSign = function (key, data) {
+    MsBrowserCrypto.prototype.sign = function (algorithm, key, data) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var _this = this;
             return __generator$1(this, function (_a) {
                 return [2 /*return*/, new Promise(function (resolve, reject) {
-                        var msSign = window["msCrypto"].subtle.sign(_this._keygenAlgorithmOptions, key, data);
+                        var msSign = window["msCrypto"].subtle.sign(algorithm, key, data);
                         msSign.addEventListener("complete", function (e) {
                             resolve(e.target.result);
                         });
@@ -13860,12 +13962,175 @@ var BrowserCrypto = /** @class */ (function () {
             });
         });
     };
+    MsBrowserCrypto.prototype.digest = function (algorithm, data) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        var digestOperation = window["msCrypto"].subtle.digest(algorithm, data.buffer);
+                        digestOperation.addEventListener("complete", function (e) {
+                            resolve(e.target.result);
+                        });
+                        digestOperation.addEventListener("error", function (error) {
+                            reject(error);
+                        });
+                    })];
+            });
+        });
+    };
+    return MsBrowserCrypto;
+}());
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
+ */
+// RSA KeyGen Algorithm
+var PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+// SHA-256 hashing algorithm
+var S256_HASH_ALG = "SHA-256";
+// MOD length for PoP tokens
+var MODULUS_LENGTH = 2048;
+// Public Exponent
+var PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
+/**
+ * This class implements functions used by the browser library to perform cryptography operations such as
+ * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
+ */
+var BrowserCrypto = /** @class */ (function () {
+    function BrowserCrypto(logger, cryptoOptions) {
+        var _a, _b;
+        this.logger = logger;
+        this.cryptoOptions = cryptoOptions;
+        if (this.hasBrowserCrypto()) {
+            // Use standard modern web crypto if available
+            this.logger.verbose("BrowserCrypto: modern crypto interface available");
+            this.subtleCrypto = new ModernBrowserCrypto();
+        }
+        else if (this.hasIECrypto()) {
+            // For IE11, use msCrypto interface
+            this.logger.verbose("BrowserCrypto: MS crypto interface available");
+            this.subtleCrypto = new MsBrowserCrypto();
+        }
+        else if (this.hasMsrCrypto() && ((_a = this.cryptoOptions) === null || _a === void 0 ? void 0 : _a.useMsrCrypto)) {
+            // For other browsers, use MSR Crypto if found
+            this.logger.verbose("BrowserCrypto: MSR crypto interface available");
+            this.subtleCrypto = new MsrBrowserCrypto();
+        }
+        else {
+            if (this.hasMsrCrypto()) {
+                this.logger.info("BrowserCrypto: MSR Crypto interface available but system.cryptoOptions.useMsrCrypto not enabled");
+            }
+            this.logger.error("BrowserCrypto: No crypto interfaces available.");
+            throw BrowserAuthError.createCryptoNotAvailableError("Browser crypto, msCrypto, or msrCrypto interfaces not available.");
+        }
+        // Mainly needed for MSR Crypto: https://github.com/microsoft/MSR-JavaScript-Crypto#random-number-generator-prng
+        if (this.subtleCrypto.initPrng) {
+            this.logger.verbose("BrowserCrypto: Interface requires entropy");
+            if (!((_b = this.cryptoOptions) === null || _b === void 0 ? void 0 : _b.entropy)) {
+                this.logger.error("BrowserCrypto: Interface requires entropy but none provided.");
+                throw BrowserConfigurationAuthError.createEntropyNotProvided();
+            }
+            this.logger.verbose("BrowserCrypto: Entropy provided");
+            this.subtleCrypto.initPrng(this.cryptoOptions.entropy);
+        }
+        this.keygenAlgorithmOptions = {
+            name: PKCS1_V15_KEYGEN_ALG,
+            hash: S256_HASH_ALG,
+            modulusLength: MODULUS_LENGTH,
+            publicExponent: PUBLIC_EXPONENT
+        };
+    }
     /**
-     * Returns stringified jwk.
-     * @param jwk
+     * Check whether IE crypto or other browser cryptography is available.
+     */
+    BrowserCrypto.prototype.hasIECrypto = function () {
+        return "msCrypto" in window;
+    };
+    /**
+     * Check whether browser crypto is available.
+     */
+    BrowserCrypto.prototype.hasBrowserCrypto = function () {
+        return "crypto" in window;
+    };
+    /**
+     * Check whether MSR crypto polyfill is available
+     */
+    BrowserCrypto.prototype.hasMsrCrypto = function () {
+        return "msrCrypto" in window;
+    };
+    /**
+     * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
+     * @param dataString
+     */
+    BrowserCrypto.prototype.sha256Digest = function (dataString) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var data;
+            return __generator$1(this, function (_a) {
+                data = BrowserStringUtils.stringToUtf8Arr(dataString);
+                // MSR Crypto wants object with name property, instead of string
+                return [2 /*return*/, this.subtleCrypto.digest({ name: S256_HASH_ALG }, data)];
+            });
+        });
+    };
+    /**
+     * Populates buffer with cryptographically random values.
+     * @param dataBuffer
+     */
+    BrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+        return this.subtleCrypto.getRandomValues(dataBuffer);
+    };
+    /**
+     * Generates a keypair based on current keygen algorithm config.
+     * @param extractable
+     * @param usages
+     */
+    BrowserCrypto.prototype.generateKeyPair = function (extractable, usages) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                return [2 /*return*/, this.subtleCrypto.generateKey(this.keygenAlgorithmOptions, extractable, usages)];
+            });
+        });
+    };
+    /**
+     * Export key as Json Web Key (JWK)
+     * @param key
+     * @param format
+     */
+    BrowserCrypto.prototype.exportJwk = function (key) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                return [2 /*return*/, this.subtleCrypto.exportKey(key)];
+            });
+        });
+    };
+    /**
+     * Imports key as Json Web Key (JWK), can set extractable and usages.
+     * @param key
+     * @param format
+     * @param extractable
+     * @param usages
+     */
+    BrowserCrypto.prototype.importJwk = function (key, extractable, usages) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                return [2 /*return*/, this.subtleCrypto.importKey(key, this.keygenAlgorithmOptions, extractable, usages)];
+            });
+        });
+    };
+    /**
+     * Signs given data with given key
+     * @param key
+     * @param data
      */
-    BrowserCrypto.getJwkString = function (jwk) {
-        return JSON.stringify(jwk, Object.keys(jwk).sort());
+    BrowserCrypto.prototype.sign = function (key, data) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                return [2 /*return*/, this.subtleCrypto.sign(this.keygenAlgorithmOptions, key, data)];
+            });
+        });
     };
     return BrowserCrypto;
 }());
@@ -14385,10 +14650,10 @@ var CryptoKeyStore = /** @class */ (function () {
  * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
  */
 var CryptoOps = /** @class */ (function () {
-    function CryptoOps(logger, performanceClient) {
+    function CryptoOps(logger, performanceClient, cryptoConfig) {
         this.logger = logger;
         // Browser crypto needs to be validated first before any other classes can be set.
-        this.browserCrypto = new BrowserCrypto(this.logger);
+        this.browserCrypto = new BrowserCrypto(this.logger, cryptoConfig);
         this.b64Encode = new Base64Encode();
         this.b64Decode = new Base64Decode();
         this.guidGenerator = new GuidGenerator(this.browserCrypto);
@@ -14450,7 +14715,7 @@ var CryptoOps = /** @class */ (function () {
                             kty: publicKeyJwk.kty,
                             n: publicKeyJwk.n
                         };
-                        publicJwkString = BrowserCrypto.getJwkString(pubKeyThumprintObj);
+                        publicJwkString = BrowserStringUtils.getSortedObjectString(pubKeyThumprintObj);
                         return [4 /*yield*/, this.hashString(publicJwkString)];
                     case 3:
                         publicJwkHash = _b.sent();
@@ -14535,7 +14800,7 @@ var CryptoOps = /** @class */ (function () {
                         return [4 /*yield*/, this.browserCrypto.exportJwk(cachedKeyPair.publicKey)];
                     case 2:
                         publicKeyJwk = _b.sent();
-                        publicKeyJwkString = BrowserCrypto.getJwkString(publicKeyJwk);
+                        publicKeyJwkString = BrowserStringUtils.getSortedObjectString(publicKeyJwk);
                         encodedKeyIdThumbprint = this.b64Encode.urlEncode(JSON.stringify({ kid: kid }));
                         shrHeader = JoseHeader.getShrHeaderString({ kid: encodedKeyIdThumbprint, alg: publicKeyJwk.alg });
                         encodedShrHeader = this.b64Encode.urlEncode(shrHeader);
@@ -14605,15 +14870,19 @@ var TokenCache = /** @class */ (function () {
      * @param request
      * @param response
      * @param options
+     * @returns `AuthenticationResult` for the response that was loaded.
      */
     TokenCache.prototype.loadExternalTokens = function (request, response, options) {
         this.logger.info("TokenCache - loadExternalTokens called");
         if (!response.id_token) {
             throw BrowserAuthError.createUnableToLoadTokenError("Please ensure server response includes id token.");
         }
+        var idToken = new AuthToken(response.id_token, this.cryptoObj);
+        var cacheRecord;
+        var authority;
         if (request.account) {
-            this.loadIdToken(response.id_token, request.account.homeAccountId, request.account.environment, request.account.tenantId, options);
-            this.loadAccessToken(request, response, request.account.homeAccountId, request.account.environment, request.account.tenantId, options);
+            var cacheRecordAccount = this.loadAccount(idToken, request.account.environment, undefined, undefined, request.account.homeAccountId);
+            cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment));
         }
         else if (request.authority) {
             var authorityUrl = Authority.generateAuthority(request.authority, request.azureCloudOptions);
@@ -14624,17 +14893,17 @@ var TokenCache = /** @class */ (function () {
                 authorityMetadata: this.config.auth.authorityMetadata,
                 skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
             };
-            var authority = new Authority(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions);
+            authority = new Authority(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions);
             // "clientInfo" from options takes precedence over "clientInfo" in response
             if (options.clientInfo) {
                 this.logger.trace("TokenCache - homeAccountId from options");
-                this.loadIdToken(response.id_token, options.clientInfo, authority.hostnameAndPort, authority.tenant, options);
-                this.loadAccessToken(request, response, options.clientInfo, authority.hostnameAndPort, authority.tenant, options);
+                var cacheRecordAccount = this.loadAccount(idToken, authority.hostnameAndPort, options.clientInfo, authority.authorityType);
+                cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
             }
             else if (response.client_info) {
                 this.logger.trace("TokenCache - homeAccountId from response");
-                this.loadIdToken(response.id_token, response.client_info, authority.hostnameAndPort, authority.tenant, options);
-                this.loadAccessToken(request, response, response.client_info, authority.hostnameAndPort, authority.tenant, options);
+                var cacheRecordAccount = this.loadAccount(idToken, authority.hostnameAndPort, response.client_info, authority.authorityType);
+                cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
             }
             else {
                 throw BrowserAuthError.createUnableToLoadTokenError("Please provide clientInfo in the response or options.");
@@ -14643,6 +14912,39 @@ var TokenCache = /** @class */ (function () {
         else {
             throw BrowserAuthError.createUnableToLoadTokenError("Please provide a request with an account or a request with authority.");
         }
+        return this.generateAuthenticationResult(request, idToken, cacheRecord, authority);
+    };
+    /**
+     * Helper function to load account to msal-browser cache
+     * @param idToken
+     * @param environment
+     * @param clientInfo
+     * @param authorityType
+     * @param requestHomeAccountId
+     * @returns `AccountEntity`
+     */
+    TokenCache.prototype.loadAccount = function (idToken, environment, clientInfo, authorityType, requestHomeAccountId) {
+        var homeAccountId;
+        if (requestHomeAccountId) {
+            homeAccountId = requestHomeAccountId;
+        }
+        else if (authorityType !== undefined && clientInfo) {
+            homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authorityType, this.logger, this.cryptoObj, idToken);
+        }
+        if (!homeAccountId) {
+            throw BrowserAuthError.createUnableToLoadTokenError("Unexpected missing homeAccountId");
+        }
+        var accountEntity = clientInfo ?
+            AccountEntity.createAccount(clientInfo, homeAccountId, idToken, undefined, undefined, undefined, environment) :
+            AccountEntity.createGenericAccount(homeAccountId, idToken, undefined, undefined, undefined, environment);
+        if (this.isBrowserEnvironment) {
+            this.logger.verbose("TokenCache - loading account");
+            this.storage.setAccount(accountEntity);
+            return accountEntity;
+        }
+        else {
+            throw BrowserAuthError.createUnableToLoadTokenError("loadExternalTokens is designed to work in browser environments only.");
+        }
     };
     /**
      * Helper function to load id tokens to msal-browser cache
@@ -14650,18 +14952,14 @@ var TokenCache = /** @class */ (function () {
      * @param homeAccountId
      * @param environment
      * @param tenantId
-     * @param options
+     * @returns `IdTokenEntity`
      */
-    TokenCache.prototype.loadIdToken = function (idToken, homeAccountId, environment, tenantId, options) {
-        var idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountId, environment, idToken, this.config.auth.clientId, tenantId);
-        var idAuthToken = new AuthToken(idToken, this.cryptoObj);
-        var accountEntity = options.clientInfo ?
-            AccountEntity.createAccount(options.clientInfo, homeAccountId, idAuthToken, undefined, undefined, undefined, environment) :
-            AccountEntity.createGenericAccount(homeAccountId, idAuthToken, undefined, undefined, undefined, environment);
+    TokenCache.prototype.loadIdToken = function (idToken, homeAccountId, environment, tenantId) {
+        var idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountId, environment, idToken.rawToken, this.config.auth.clientId, tenantId);
         if (this.isBrowserEnvironment) {
             this.logger.verbose("TokenCache - loading id token");
-            this.storage.setAccount(accountEntity);
             this.storage.setIdTokenCredential(idTokenEntity);
+            return idTokenEntity;
         }
         else {
             throw BrowserAuthError.createUnableToLoadTokenError("loadExternalTokens is designed to work in browser environments only.");
@@ -14671,16 +14969,15 @@ var TokenCache = /** @class */ (function () {
      * Helper function to load access tokens to msal-browser cache
      * @param request
      * @param response
-     * @param options
      * @param homeAccountId
      * @param environment
      * @param tenantId
-     * @returns
+     * @returns `AccessTokenEntity`
      */
     TokenCache.prototype.loadAccessToken = function (request, response, homeAccountId, environment, tenantId, options) {
         if (!response.access_token) {
             this.logger.verbose("TokenCache - No access token provided for caching");
-            return;
+            return null;
         }
         if (!response.expires_in) {
             throw BrowserAuthError.createUnableToLoadTokenError("Please ensure server response includes expires_in value.");
@@ -14695,11 +14992,80 @@ var TokenCache = /** @class */ (function () {
         if (this.isBrowserEnvironment) {
             this.logger.verbose("TokenCache - loading access token");
             this.storage.setAccessTokenCredential(accessTokenEntity);
+            return accessTokenEntity;
         }
         else {
             throw BrowserAuthError.createUnableToLoadTokenError("loadExternalTokens is designed to work in browser environments only.");
         }
     };
+    /**
+     * Helper function to load refresh tokens to msal-browser cache
+     * @param request
+     * @param response
+     * @param homeAccountId
+     * @param environment
+     * @returns `RefreshTokenEntity`
+     */
+    TokenCache.prototype.loadRefreshToken = function (request, response, homeAccountId, environment) {
+        if (!response.refresh_token) {
+            this.logger.verbose("TokenCache - No refresh token provided for caching");
+            return null;
+        }
+        var refreshTokenEntity = RefreshTokenEntity.createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId);
+        if (this.isBrowserEnvironment) {
+            this.logger.verbose("TokenCache - loading refresh token");
+            this.storage.setRefreshTokenCredential(refreshTokenEntity);
+            return refreshTokenEntity;
+        }
+        else {
+            throw BrowserAuthError.createUnableToLoadTokenError("loadExternalTokens is designed to work in browser environments only.");
+        }
+    };
+    /**
+     * Helper function to generate an `AuthenticationResult` for the result.
+     * @param request
+     * @param idTokenObj
+     * @param cacheRecord
+     * @param authority
+     * @returns `AuthenticationResult`
+     */
+    TokenCache.prototype.generateAuthenticationResult = function (request, idTokenObj, cacheRecord, authority) {
+        var _a, _b, _c;
+        var accessToken = Constants.EMPTY_STRING;
+        var responseScopes = [];
+        var expiresOn = null;
+        var extExpiresOn;
+        if (cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.accessToken) {
+            accessToken = cacheRecord.accessToken.secret;
+            responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
+            expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
+            extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+        }
+        var uid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.oid) || (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.sub) || Constants.EMPTY_STRING;
+        var tid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.tid) || Constants.EMPTY_STRING;
+        return {
+            authority: authority ? authority.canonicalAuthority : Constants.EMPTY_STRING,
+            uniqueId: uid,
+            tenantId: tid,
+            scopes: responseScopes,
+            account: (cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.account) ? cacheRecord.account.getAccountInfo() : null,
+            idToken: idTokenObj ? idTokenObj.rawToken : Constants.EMPTY_STRING,
+            idTokenClaims: idTokenObj ? idTokenObj.claims : {},
+            accessToken: accessToken,
+            fromCache: true,
+            expiresOn: expiresOn,
+            correlationId: request.correlationId || Constants.EMPTY_STRING,
+            requestId: Constants.EMPTY_STRING,
+            extExpiresOn: extExpiresOn,
+            familyId: Constants.EMPTY_STRING,
+            tokenType: ((_a = cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
+            state: Constants.EMPTY_STRING,
+            cloudGraphHostName: ((_b = cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
+            msGraphHost: ((_c = cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
+            code: undefined,
+            fromNativeBroker: false
+        };
+    };
     return TokenCache;
 }());
 
@@ -14757,7 +15123,7 @@ var SilentAuthCodeClient = /** @class */ (function (_super) {
                         clientConfig = _a.sent();
                         authClient = new HybridSpaAuthorizationCodeClient(clientConfig);
                         this.logger.verbose("Auth code client created");
-                        silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system.navigateFrameWait);
+                        silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system);
                         // Handle auth code parameters from request
                         return [2 /*return*/, silentHandler.handleCodeResponseFromServer({
                                 code: request.code,
@@ -14856,9 +15222,9 @@ var BrowserPerformanceMeasurement = /** @class */ (function () {
  */
 var BrowserPerformanceClient = /** @class */ (function (_super) {
     __extends$1(BrowserPerformanceClient, _super);
-    function BrowserPerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
+    function BrowserPerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry, cryptoOptions) {
         var _this = _super.call(this, clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) || this;
-        _this.browserCrypto = new BrowserCrypto(_this.logger);
+        _this.browserCrypto = new BrowserCrypto(_this.logger, cryptoOptions);
         _this.guidGenerator = new GuidGenerator(_this.browserCrypto);
         return _this;
     }
@@ -14940,10 +15306,10 @@ var ClientApplication = /** @class */ (function () {
         this.hybridAuthCodeResponses = new Map();
         // Initialize performance client
         this.performanceClient = this.isBrowserEnvironment ?
-            new BrowserPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application) :
+            new BrowserPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application, this.config.system.cryptoOptions) :
             new StubPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application);
         // Initialize the crypto class.
-        this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger, this.performanceClient) : DEFAULT_CRYPTO_IMPLEMENTATION;
+        this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger, this.performanceClient, this.config.system.cryptoOptions) : DEFAULT_CRYPTO_IMPLEMENTATION;
         this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
         // Initialize the browser storage class.
         this.browserStorage = this.isBrowserEnvironment ?
@@ -15165,6 +15531,7 @@ var ClientApplication = /** @class */ (function () {
                     isNativeBroker: true,
                     accessTokenSize: response.accessToken.length,
                     idTokenSize: response.idToken.length,
+                    requestId: response.requestId
                 });
                 atPopupMeasurement.flushMeasurement();
                 return response;
@@ -15202,6 +15569,7 @@ var ClientApplication = /** @class */ (function () {
                 success: true,
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
+                requestId: result.requestId
             });
             atPopupMeasurement.flushMeasurement();
             return result;
@@ -15245,7 +15613,9 @@ var ClientApplication = /** @class */ (function () {
             var _this = this;
             return __generator$1(this, function (_a) {
                 correlationId = this.getRequestCorrelationId(request);
-                validRequest = __assign$1(__assign$1({}, request), { prompt: PromptValue.NONE, correlationId: correlationId });
+                validRequest = __assign$1(__assign$1({}, request), { 
+                    // will be PromptValue.NONE or PromptValue.NO_SESSION
+                    prompt: request.prompt, correlationId: correlationId });
                 this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
                 ssoSilentMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SsoSilent, correlationId);
                 this.logger.verbose("ssoSilent called", correlationId);
@@ -15271,7 +15641,8 @@ var ClientApplication = /** @class */ (function () {
                             success: true,
                             isNativeBroker: response.fromNativeBroker,
                             accessTokenSize: response.accessToken.length,
-                            idTokenSize: response.idToken.length
+                            idTokenSize: response.idToken.length,
+                            requestId: response.requestId
                         });
                         ssoSilentMeasurement.flushMeasurement();
                         return response;
@@ -15322,7 +15693,8 @@ var ClientApplication = /** @class */ (function () {
                                     success: true,
                                     accessTokenSize: result.accessToken.length,
                                     idTokenSize: result.idToken.length,
-                                    isNativeBroker: result.fromNativeBroker
+                                    isNativeBroker: result.fromNativeBroker,
+                                    requestId: result.requestId
                                 });
                                 atbcMeasurement.flushMeasurement();
                                 return result;
@@ -15402,67 +15774,62 @@ var ClientApplication = /** @class */ (function () {
         });
     };
     /**
-     * Use this function to obtain a token before every call to the API / resource provider
-     *
-     * MSAL return's a cached token when available
-     * Or it send's a request to the STS to obtain a new token using a refresh token.
-     *
-     * @param {@link SilentRequest}
-     *
-     * To renew idToken, please pass clientId as the only scope in the Authentication Parameters
-     * @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
+     * Attempt to acquire an access token from the cache
+     * @param silentCacheClient SilentCacheClient
+     * @param commonRequest CommonSilentFlowRequest
+     * @param silentRequest SilentRequest
+     * @returns A promise that, when resolved, returns the access token
      */
-    ClientApplication.prototype.acquireTokenByRefreshToken = function (request) {
+    ClientApplication.prototype.acquireTokenFromCache = function (silentCacheClient, commonRequest, silentRequest) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var atbrtMeasurement, silentRefreshClient;
-            var _this = this;
             return __generator$1(this, function (_a) {
-                // block the reload if it occurred inside a hidden iframe
-                BrowserUtils.blockReloadInHiddenIframes();
-                atbrtMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenByRefreshToken, request.correlationId);
-                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, request);
-                silentRefreshClient = this.createSilentRefreshClient(request.correlationId);
-                return [2 /*return*/, silentRefreshClient.acquireToken(request)
-                        .then(function (result) {
-                        atbrtMeasurement.endMeasurement({
-                            success: true,
-                            fromCache: result.fromCache,
-                            accessTokenSize: result.accessToken.length,
-                            idTokenSize: result.idToken.length,
-                        });
-                        return result;
-                    })
-                        .catch(function (e) {
-                        var isServerError = e instanceof ServerError;
-                        var isInteractionRequiredError = e instanceof InteractionRequiredAuthError;
-                        var isInvalidGrantError = (e.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
-                        if (isServerError && isInvalidGrantError && !isInteractionRequiredError) {
-                            _this.logger.verbose("Refresh token expired or invalid, attempting acquire token by iframe", request.correlationId);
-                            var silentIframeClient = _this.createSilentIframeClient(request.correlationId);
-                            return silentIframeClient.acquireToken(request)
-                                .then(function (result) {
-                                atbrtMeasurement.endMeasurement({
-                                    success: true,
-                                    fromCache: result.fromCache,
-                                    accessTokenSize: result.accessToken.length,
-                                    idTokenSize: result.idToken.length,
-                                });
-                                return result;
-                            })
-                                .catch(function (error) {
-                                atbrtMeasurement.endMeasurement({
-                                    errorCode: error.errorCode,
-                                    subErrorCode: error.subError,
-                                    success: false
-                                });
-                                throw error;
-                            });
-                        }
-                        atbrtMeasurement.endMeasurement({
-                            success: false
-                        });
-                        throw e;
-                    })];
+                switch (silentRequest.cacheLookupPolicy) {
+                    case exports.CacheLookupPolicy.Default:
+                    case exports.CacheLookupPolicy.AccessToken:
+                    case exports.CacheLookupPolicy.AccessTokenAndRefreshToken:
+                        return [2 /*return*/, silentCacheClient.acquireToken(commonRequest)];
+                    default:
+                        throw ClientAuthError.createRefreshRequiredError();
+                }
+                return [2 /*return*/];
+            });
+        });
+    };
+    /**
+     * Attempt to acquire an access token via a refresh token
+     * @param commonRequest CommonSilentFlowRequest
+     * @param silentRequest SilentRequest
+     * @returns A promise that, when resolved, returns the access token
+     */
+    ClientApplication.prototype.acquireTokenByRefreshToken = function (commonRequest, silentRequest) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var silentRefreshClient;
+            return __generator$1(this, function (_a) {
+                switch (silentRequest.cacheLookupPolicy) {
+                    case exports.CacheLookupPolicy.Default:
+                    case exports.CacheLookupPolicy.AccessTokenAndRefreshToken:
+                    case exports.CacheLookupPolicy.RefreshToken:
+                    case exports.CacheLookupPolicy.RefreshTokenAndNetwork:
+                        silentRefreshClient = this.createSilentRefreshClient(commonRequest.correlationId);
+                        return [2 /*return*/, silentRefreshClient.acquireToken(commonRequest)];
+                    default:
+                        throw ClientAuthError.createRefreshRequiredError();
+                }
+                return [2 /*return*/];
+            });
+        });
+    };
+    /**
+     * Attempt to acquire an access token via an iframe
+     * @param request CommonSilentFlowRequest
+     * @returns A promise that, when resolved, returns the access token
+     */
+    ClientApplication.prototype.acquireTokenBySilentIframe = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var silentIframeClient;
+            return __generator$1(this, function (_a) {
+                silentIframeClient = this.createSilentIframeClient(request.correlationId);
+                return [2 /*return*/, silentIframeClient.acquireToken(request)];
             });
         });
     };
@@ -15956,7 +16323,9 @@ var PublicClientApplication = /** @class */ (function (_super) {
                             fromCache: result.fromCache,
                             accessTokenSize: result.accessToken.length,
                             idTokenSize: result.idToken.length,
-                            isNativeBroker: result.fromNativeBroker
+                            isNativeBroker: result.fromNativeBroker,
+                            cacheLookupPolicy: request.cacheLookupPolicy,
+                            requestId: result.requestId
                         });
                         atsMeasurement.flushMeasurement();
                         return result;
@@ -15994,7 +16363,7 @@ var PublicClientApplication = /** @class */ (function (_super) {
      */
     PublicClientApplication.prototype.acquireTokenSilentAsync = function (request, account) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var astsAsyncMeasurement, result, silentRequest, silentCacheClient, silentRequest_1;
+            var astsAsyncMeasurement, result, silentRequest, silentCacheClient, silentRequest_1, requestWithCLP_1;
             var _this = this;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
@@ -16024,11 +16393,32 @@ var PublicClientApplication = /** @class */ (function (_super) {
                         return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
                     case 2:
                         silentRequest_1 = _a.sent();
-                        result = silentCacheClient.acquireToken(silentRequest_1).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
-                            return __generator$1(this, function (_a) {
-                                return [2 /*return*/, this.acquireTokenByRefreshToken(silentRequest_1)];
+                        requestWithCLP_1 = __assign$1(__assign$1({}, request), { 
+                            // set the request's CacheLookupPolicy to Default if it was not optionally passed in
+                            cacheLookupPolicy: request.cacheLookupPolicy || exports.CacheLookupPolicy.Default });
+                        result = this.acquireTokenFromCache(silentCacheClient, silentRequest_1, requestWithCLP_1).catch(function (cacheError) {
+                            if (requestWithCLP_1.cacheLookupPolicy === exports.CacheLookupPolicy.AccessToken) {
+                                throw cacheError;
+                            }
+                            // block the reload if it occurred inside a hidden iframe
+                            BrowserUtils.blockReloadInHiddenIframes();
+                            _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, silentRequest_1);
+                            return _this.acquireTokenByRefreshToken(silentRequest_1, requestWithCLP_1).catch(function (refreshTokenError) {
+                                var isServerError = refreshTokenError instanceof ServerError;
+                                var isInteractionRequiredError = refreshTokenError instanceof InteractionRequiredAuthError;
+                                var isInvalidGrantError = (refreshTokenError.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
+                                if ((!isServerError ||
+                                    !isInvalidGrantError ||
+                                    isInteractionRequiredError ||
+                                    requestWithCLP_1.cacheLookupPolicy === exports.CacheLookupPolicy.AccessTokenAndRefreshToken ||
+                                    requestWithCLP_1.cacheLookupPolicy === exports.CacheLookupPolicy.RefreshToken)
+                                    && (requestWithCLP_1.cacheLookupPolicy !== exports.CacheLookupPolicy.Skip)) {
+                                    throw refreshTokenError;
+                                }
+                                _this.logger.verbose("Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.", request.correlationId);
+                                return _this.acquireTokenBySilentIframe(silentRequest_1);
                             });
-                        }); });
+                        });
                         _a.label = 3;
                     case 3: return [2 /*return*/, result.then(function (response) {
                             _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
@@ -16037,7 +16427,8 @@ var PublicClientApplication = /** @class */ (function (_super) {
                                 fromCache: response.fromCache,
                                 accessTokenSize: response.accessToken.length,
                                 idTokenSize: response.idToken.length,
-                                isNativeBroker: response.fromNativeBroker
+                                isNativeBroker: response.fromNativeBroker,
+                                requestId: response.requestId
                             });
                             return response;
                         }).catch(function (tokenRenewalError) {