@azure/msal-common 5.2.0 → 6.2.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.2.0 2022-04-04 */
 'use strict';
 'use strict';
 
@@ -102,6 +102,7 @@ var Constants = {
     // default authority
     DEFAULT_AUTHORITY: "https://login.microsoftonline.com/common/",
     DEFAULT_AUTHORITY_HOST: "login.microsoftonline.com",
+    DEFAULT_COMMON_TENANT: "common",
     // ADFS String
     ADFS: "adfs",
     // Default AAD Instance Discovery Endpoint
@@ -212,6 +213,8 @@ var AADServerParamKeys;
     AADServerParamKeys["X_CLIENT_CURR_TELEM"] = "x-client-current-telemetry";
     AADServerParamKeys["X_CLIENT_LAST_TELEM"] = "x-client-last-telemetry";
     AADServerParamKeys["X_MS_LIB_CAPABILITY"] = "x-ms-lib-capability";
+    AADServerParamKeys["X_APP_NAME"] = "x-app-name";
+    AADServerParamKeys["X_APP_VER"] = "x-app-ver";
     AADServerParamKeys["POST_LOGOUT_URI"] = "post_logout_redirect_uri";
     AADServerParamKeys["ID_TOKEN_HINT"] = "id_token_hint";
     AADServerParamKeys["DEVICE_CODE"] = "device_code";
@@ -226,6 +229,7 @@ var AADServerParamKeys;
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
     AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
+    AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
  * Claims request keys
@@ -481,8 +485,8 @@ var AuthError = /** @class */ (function (_super) {
         _this = _super.call(this, errorString) || this;
         Object.setPrototypeOf(_this, AuthError.prototype);
         _this.errorCode = errorCode || Constants.EMPTY_STRING;
-        _this.errorMessage = errorMessage || "";
-        _this.subError = suberror || "";
+        _this.errorMessage = errorMessage || Constants.EMPTY_STRING;
+        _this.subError = suberror || Constants.EMPTY_STRING;
         _this.name = "AuthError";
         return _this;
     }
@@ -560,6 +564,15 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
                 throw AuthError.createUnexpectedError(notImplErr);
             });
         });
+    },
+    hashString: function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var notImplErr;
+            return __generator(this, function (_a) {
+                notImplErr = "Crypto interface - hashString() has not been implemented";
+                throw AuthError.createUnexpectedError(notImplErr);
+            });
+        });
     }
 };
 
@@ -1174,7 +1187,7 @@ var Logger = /** @class */ (function () {
         this.localCallback = loggerOptions.loggerCallback || defaultLoggerCallback;
         this.piiLoggingEnabled = loggerOptions.piiLoggingEnabled || false;
         this.level = typeof (loggerOptions.logLevel) === "number" ? loggerOptions.logLevel : exports.LogLevel.Info;
-        this.correlationId = loggerOptions.correlationId || "";
+        this.correlationId = loggerOptions.correlationId || Constants.EMPTY_STRING;
         this.packageName = packageName || Constants.EMPTY_STRING;
         this.packageVersion = packageVersion || Constants.EMPTY_STRING;
     }
@@ -1204,7 +1217,7 @@ var Logger = /** @class */ (function () {
             logHeader = "[" + timestamp + "]";
         }
         var log = logHeader + " : " + this.packageName + "@" + this.packageVersion + " : " + exports.LogLevel[options.logLevel] + " - " + logMessage;
-        // debug(`msal:${LogLevel[options.logLevel]}${options.containsPii ? "-Pii": ""}${options.context ? `:${options.context}` : ""}`)(logMessage);
+        // debug(`msal:${LogLevel[options.logLevel]}${options.containsPii ? "-Pii": Constants.EMPTY_STRING}${options.context ? `:${options.context}` : Constants.EMPTY_STRING}`)(logMessage);
         this.executeCallback(options.logLevel, log, options.containsPii || false);
     };
     /**
@@ -1222,7 +1235,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Error,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1232,7 +1245,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Error,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1242,7 +1255,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Warning,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1252,7 +1265,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Warning,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1262,7 +1275,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Info,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1272,7 +1285,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Info,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1282,7 +1295,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Verbose,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1292,7 +1305,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Verbose,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1302,7 +1315,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Trace,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1312,7 +1325,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Trace,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1326,7 +1339,27 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "5.2.0";
+var version = "6.2.0";
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+exports.AzureCloudInstance = void 0;
+(function (AzureCloudInstance) {
+    // AzureCloudInstance is not specified.
+    AzureCloudInstance[AzureCloudInstance["None"] = 0] = "None";
+    // Microsoft Azure public cloud
+    AzureCloudInstance["AzurePublic"] = "https://login.microsoftonline.com";
+    // Microsoft PPE
+    AzureCloudInstance["AzurePpe"] = "https://login.windows-ppe.net";
+    // Microsoft Chinese national cloud
+    AzureCloudInstance["AzureChina"] = "https://login.chinacloudapi.cn";
+    // Microsoft German national cloud ("Black Forest")
+    AzureCloudInstance["AzureGermany"] = "https://login.microsoftonline.de";
+    // US Government cloud
+    AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
+})(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1337,7 +1370,7 @@ var version = "5.2.0";
  *
  * Key:Value Schema:
  *
- * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme>
+ * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
  *
  * Value Schema:
  * {
@@ -1351,6 +1384,7 @@ var version = "5.2.0";
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
  *      oboAssertion: access token passed in as part of OBO request
  *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+ *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -1378,7 +1412,7 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      */
     CredentialEntity.prototype.generateCredentialKey = function () {
-        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType);
+        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
     };
     /**
      * returns the type of the cache (in this case credential)
@@ -1422,16 +1456,14 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
      */
-    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType) {
+    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
         var credentialKey = [
             this.generateAccountIdForCacheKey(homeAccountId, environment),
             this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-            this.generateTargetForCacheKey(target)
+            this.generateTargetForCacheKey(target),
+            this.generateClaimsHashForCacheKey(requestedClaimsHash),
+            this.generateSchemeForCacheKey(tokenType)
         ];
-        // PoP Tokens and SSH certs include scheme in cache key
-        if (tokenType && tokenType !== exports.AuthenticationScheme.BEARER) {
-            credentialKey.push(tokenType.toLowerCase());
-        }
         return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
     /**
@@ -1457,7 +1489,7 @@ var CredentialEntity = /** @class */ (function () {
         var credentialId = [
             credentialType,
             clientOrFamilyId,
-            realm || "",
+            realm || Constants.EMPTY_STRING,
         ];
         return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
@@ -1465,7 +1497,23 @@ var CredentialEntity = /** @class */ (function () {
      * Generate target key component as per schema: <target>
      */
     CredentialEntity.generateTargetForCacheKey = function (scopes) {
-        return (scopes || "").toLowerCase();
+        return (scopes || Constants.EMPTY_STRING).toLowerCase();
+    };
+    /**
+     * Generate requested claims key component as per schema: <requestedClaims>
+     */
+    CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
+        return (requestedClaimsHash || Constants.EMPTY_STRING).toLowerCase();
+    };
+    /**
+     * Generate scheme key componenet as per schema: <scheme>
+     */
+    CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
+        /*
+         * PoP Tokens and SSH certs include scheme in cache key
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : Constants.EMPTY_STRING;
     };
     return CredentialEntity;
 }());
@@ -1550,6 +1598,10 @@ var ClientConfigurationErrorMessage = {
         code: "untrusted_authority",
         desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter."
     },
+    invalidAzureCloudInstance: {
+        code: "invalid_azure_cloud_instance",
+        desc: "Invalid AzureCloudInstance provided. Please refer MSAL JS docs: aks.ms/msaljs/azure_cloud_instance for valid values"
+    },
     missingSshJwk: {
         code: "missing_ssh_jwk",
         desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme."
@@ -1686,7 +1738,13 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     ClientConfigurationError.createUntrustedAuthorityError = function () {
         return new ClientConfigurationError(ClientConfigurationErrorMessage.untrustedAuthority.code, ClientConfigurationErrorMessage.untrustedAuthority.desc);
     };
-    /*
+    /**
+     * Throws error when the AzureCloudInstance is set to an invalid value
+     */
+    ClientConfigurationError.createInvalidAzureCloudInstanceError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAzureCloudInstance.code, ClientConfigurationErrorMessage.invalidAzureCloudInstance.desc);
+    };
+    /**
      * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
      */
     ClientConfigurationError.createMissingSshJwkError = function () {
@@ -1740,7 +1798,7 @@ var ScopeSet = /** @class */ (function () {
      * @param scopesRequired
      */
     ScopeSet.fromString = function (inputScopeString) {
-        var scopeString = inputScopeString || "";
+        var scopeString = inputScopeString || Constants.EMPTY_STRING;
         var inputScopes = scopeString.split(" ");
         return new ScopeSet(inputScopes);
     };
@@ -1884,7 +1942,7 @@ var ScopeSet = /** @class */ (function () {
             var scopeArr = this.asArray();
             return scopeArr.join(" ");
         }
-        return "";
+        return Constants.EMPTY_STRING;
     };
     /**
      * Prints scopes into a space-delimited lower-case string (used for caching)
@@ -2032,8 +2090,8 @@ var AccountEntity = /** @class */ (function () {
     AccountEntity.generateAccountCacheKey = function (accountInterface) {
         var accountKey = [
             accountInterface.homeAccountId,
-            accountInterface.environment || "",
-            accountInterface.tenantId || "",
+            accountInterface.environment || Constants.EMPTY_STRING,
+            accountInterface.tenantId || Constants.EMPTY_STRING,
         ];
         return accountKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
@@ -2056,17 +2114,17 @@ var AccountEntity = /** @class */ (function () {
         }
         account.environment = env;
         // non AAD scenarios can have empty realm
-        account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || "";
+        account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || Constants.EMPTY_STRING;
         account.oboAssertion = oboAssertion;
         if (idToken) {
             account.idTokenClaims = idToken.claims;
             // How do you account for MSA CID here?
-            account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || "";
+            account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || Constants.EMPTY_STRING;
             /*
              * In B2C scenarios the emails claim is used instead of preferred_username and it is an array. In most cases it will contain a single email.
              * This field should not be relied upon if a custom policy is configured to return more than 1 email.
              */
-            account.username = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username) || (((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : "");
+            account.username = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username) || (((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : Constants.EMPTY_STRING);
             account.name = (_f = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _f === void 0 ? void 0 : _f.name;
         }
         account.cloudGraphHostName = cloudGraphHostName;
@@ -2084,7 +2142,7 @@ var AccountEntity = /** @class */ (function () {
         account.authorityType = (authority && authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
-        account.realm = "";
+        account.realm = Constants.EMPTY_STRING;
         account.oboAssertion = oboAssertion;
         var env = environment || authority && authority.getPreferredCache();
         if (!env) {
@@ -2092,10 +2150,10 @@ var AccountEntity = /** @class */ (function () {
         }
         if (idToken) {
             // How do you account for MSA CID here?
-            account.localAccountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.oid) || ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.sub) || "";
+            account.localAccountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.oid) || ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.sub) || Constants.EMPTY_STRING;
             // upn claim for most ADFS scenarios
-            account.username = ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.upn) || "";
-            account.name = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.name) || "";
+            account.username = ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.upn) || Constants.EMPTY_STRING;
+            account.name = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.name) || Constants.EMPTY_STRING;
             account.idTokenClaims = idToken === null || idToken === void 0 ? void 0 : idToken.claims;
         }
         account.environment = env;
@@ -2300,7 +2358,8 @@ var CacheManager = /** @class */ (function () {
                             environment: credential.environment,
                             homeAccountId: credential.homeAccountId,
                             realm: credential.realm,
-                            tokenType: credential.tokenType
+                            tokenType: credential.tokenType,
+                            requestedClaimsHash: credential.requestedClaimsHash
                         });
                         currentScopes = ScopeSet.fromString(credential.target);
                         currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
@@ -2331,7 +2390,7 @@ var CacheManager = /** @class */ (function () {
      * @param realm
      */
     CacheManager.prototype.getAccountsFilteredBy = function (accountFilter) {
-        return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : "", accountFilter ? accountFilter.environment : "", accountFilter ? accountFilter.realm : "");
+        return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING);
     };
     /**
      * retrieve accounts matching all provided filters; if no filter is set, get all accounts
@@ -2372,7 +2431,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
     };
     /**
      * Support function to help match credentials
@@ -2385,7 +2444,7 @@ var CacheManager = /** @class */ (function () {
      * @param oboAssertion
      * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2432,38 +2491,37 @@ var CacheManager = /** @class */ (function () {
             if (!!target && !_this.matchTarget(entity, target)) {
                 return;
             }
+            // If request OR cached entity has requested Claims Hash, check if they match
+            if (requestedClaimsHash || entity.requestedClaimsHash) {
+                // Don't match if either is undefined or they are different
+                if (entity.requestedClaimsHash !== requestedClaimsHash) {
+                    return;
+                }
+            }
             // Access Token with Auth Scheme specific matching
             if (credentialType === exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
                 if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
                     return;
                 }
-                switch (tokenType) {
-                    case exports.AuthenticationScheme.POP:
-                        // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
-                        if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
-                            // AccessToken_With_AuthScheme that doesn't have "-pop" in the key is outdated and needs to be removed
-                            _this.removeItem(cacheKey, exports.CacheSchemaType.CREDENTIAL);
-                            return;
-                        }
-                        break;
-                    case exports.AuthenticationScheme.SSH:
-                        // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-                        if (keyId && !_this.matchKeyId(entity, keyId)) {
-                            return;
-                        }
-                        break;
+                // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                if (tokenType === exports.AuthenticationScheme.SSH) {
+                    if (keyId && !_this.matchKeyId(entity, keyId)) {
+                        return;
+                    }
                 }
             }
+            // At this point, the entity matches the request, update cache key if key schema has changed
+            var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
             switch (credType) {
                 case exports.CredentialType.ID_TOKEN:
-                    matchingCredentials.idTokens[cacheKey] = entity;
+                    matchingCredentials.idTokens[updatedCacheKey] = entity;
                     break;
                 case exports.CredentialType.ACCESS_TOKEN:
                 case exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                    matchingCredentials.accessTokens[cacheKey] = entity;
+                    matchingCredentials.accessTokens[updatedCacheKey] = entity;
                     break;
                 case exports.CredentialType.REFRESH_TOKEN:
-                    matchingCredentials.refreshTokens[cacheKey] = entity;
+                    matchingCredentials.refreshTokens[updatedCacheKey] = entity;
                     break;
             }
         });
@@ -2662,10 +2720,10 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param authScheme
      */
-    CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme, keyId) {
+    CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
         var cachedAccount = this.readAccountFromCache(account);
         var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme, keyId);
+        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
         var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
         var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
         if (cachedAccount && cachedIdToken) {
@@ -2719,9 +2777,14 @@ var CacheManager = /** @class */ (function () {
      * @param scopes
      * @param authScheme
      */
-    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme, keyId) {
-        // Distinguish between Bearer and PoP/SSH token cache types
-        var credentialType = (authScheme && authScheme !== exports.AuthenticationScheme.BEARER) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
+    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
+        var scopes = new ScopeSet(request.scopes || []);
+        var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+        /*
+         * Distinguish between Bearer and PoP/SSH token cache types
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
         var accessTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -2730,7 +2793,8 @@ var CacheManager = /** @class */ (function () {
             realm: account.tenantId,
             target: scopes.printScopesLowerCase(),
             tokenType: authScheme,
-            keyId: keyId
+            keyId: request.sshKid,
+            requestedClaimsHash: request.requestedClaimsHash
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -3039,6 +3103,10 @@ var DefaultStorageClass = /** @class */ (function (_super) {
             });
         });
     };
+    DefaultStorageClass.prototype.updateCredentialCacheKey = function () {
+        var notImplErr = "Storage interface - updateCredentialCacheKey() has not been implemented for the cacheStorage interface.";
+        throw AuthError.createUnexpectedError(notImplErr);
+    };
     return DefaultStorageClass;
 }(CacheManager));
 
@@ -3050,7 +3118,8 @@ var DefaultStorageClass = /** @class */ (function (_super) {
 var DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 var DEFAULT_SYSTEM_OPTIONS = {
     tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
-    preventCorsPreflight: false
+    preventCorsPreflight: false,
+    proxyUrl: Constants.EMPTY_STRING
 };
 var DEFAULT_LOGGER_IMPLEMENTATION = {
     loggerCallback: function () {
@@ -3058,7 +3127,7 @@ var DEFAULT_LOGGER_IMPLEMENTATION = {
     },
     piiLoggingEnabled: false,
     logLevel: exports.LogLevel.Info,
-    correlationId: ""
+    correlationId: Constants.EMPTY_STRING
 };
 var DEFAULT_NETWORK_IMPLEMENTATION = {
     sendGetRequestAsync: function () {
@@ -3083,13 +3152,23 @@ var DEFAULT_NETWORK_IMPLEMENTATION = {
 var DEFAULT_LIBRARY_INFO = {
     sku: Constants.SKU,
     version: version,
-    cpu: "",
-    os: ""
+    cpu: Constants.EMPTY_STRING,
+    os: Constants.EMPTY_STRING
 };
 var DEFAULT_CLIENT_CREDENTIALS = {
-    clientSecret: "",
+    clientSecret: Constants.EMPTY_STRING,
     clientAssertion: undefined
 };
+var DEFAULT_AZURE_CLOUD_OPTIONS = {
+    azureCloudInstance: exports.AzureCloudInstance.None,
+    tenant: "" + Constants.DEFAULT_COMMON_TENANT
+};
+var DEFAULT_TELEMETRY_OPTIONS = {
+    application: {
+        appName: "",
+        appVersion: ""
+    }
+};
 /**
  * Function that sets the default options when not explicitly configured from app developer
  *
@@ -3098,7 +3177,7 @@ var DEFAULT_CLIENT_CREDENTIALS = {
  * @returns Configuration
  */
 function buildClientConfiguration(_a) {
-    var userAuthOptions = _a.authOptions, userSystemOptions = _a.systemOptions, userLoggerOption = _a.loggerOptions, storageImplementation = _a.storageInterface, networkImplementation = _a.networkInterface, cryptoImplementation = _a.cryptoInterface, clientCredentials = _a.clientCredentials, libraryInfo = _a.libraryInfo, serverTelemetryManager = _a.serverTelemetryManager, persistencePlugin = _a.persistencePlugin, serializableCache = _a.serializableCache;
+    var userAuthOptions = _a.authOptions, userSystemOptions = _a.systemOptions, userLoggerOption = _a.loggerOptions, storageImplementation = _a.storageInterface, networkImplementation = _a.networkInterface, cryptoImplementation = _a.cryptoInterface, clientCredentials = _a.clientCredentials, libraryInfo = _a.libraryInfo, telemetry = _a.telemetry, serverTelemetryManager = _a.serverTelemetryManager, persistencePlugin = _a.persistencePlugin, serializableCache = _a.serializableCache;
     var loggerOptions = __assign(__assign({}, DEFAULT_LOGGER_IMPLEMENTATION), userLoggerOption);
     return {
         authOptions: buildAuthOptions(userAuthOptions),
@@ -3109,6 +3188,7 @@ function buildClientConfiguration(_a) {
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
         libraryInfo: __assign(__assign({}, DEFAULT_LIBRARY_INFO), libraryInfo),
+        telemetry: __assign(__assign({}, DEFAULT_TELEMETRY_OPTIONS), telemetry),
         serverTelemetryManager: serverTelemetryManager || null,
         persistencePlugin: persistencePlugin || null,
         serializableCache: serializableCache || null
@@ -3119,7 +3199,7 @@ function buildClientConfiguration(_a) {
  * @param authOptions
  */
 function buildAuthOptions(authOptions) {
-    return __assign({ clientCapabilities: [] }, authOptions);
+    return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS }, authOptions);
 }
 
 /*
@@ -3221,11 +3301,11 @@ var ThrottlingUtils = /** @class */ (function () {
             authority: request.authority,
             scopes: request.scopes,
             homeAccountIdentifier: homeAccountIdentifier,
+            claims: request.claims,
             authenticationScheme: request.authenticationScheme,
             resourceRequestMethod: request.resourceRequestMethod,
             resourceRequestUri: request.resourceRequestUri,
             shrClaims: request.shrClaims,
-            sshJwk: request.sshJwk,
             sshKid: request.sshKid
         };
         var key = this.generateThrottlingStorageKey(thumbprint);
@@ -3353,7 +3433,7 @@ var BaseClient = /** @class */ (function () {
             var response;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers })];
+                    case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers, proxyUrl: this.config.systemOptions.proxyUrl })];
                     case 1:
                         response = _a.sent();
                         if (this.config.serverTelemetryManager && response.status < 500 && response.status !== 429) {
@@ -3583,8 +3663,24 @@ var RequestParameterBuilder = /** @class */ (function () {
         // Telemetry Info
         this.parameters.set(AADServerParamKeys.X_CLIENT_SKU, libraryInfo.sku);
         this.parameters.set(AADServerParamKeys.X_CLIENT_VER, libraryInfo.version);
-        this.parameters.set(AADServerParamKeys.X_CLIENT_OS, libraryInfo.os);
-        this.parameters.set(AADServerParamKeys.X_CLIENT_CPU, libraryInfo.cpu);
+        if (libraryInfo.os) {
+            this.parameters.set(AADServerParamKeys.X_CLIENT_OS, libraryInfo.os);
+        }
+        if (libraryInfo.cpu) {
+            this.parameters.set(AADServerParamKeys.X_CLIENT_CPU, libraryInfo.cpu);
+        }
+    };
+    /**
+     * Add client telemetry parameters
+     * @param appTelemetry
+     */
+    RequestParameterBuilder.prototype.addApplicationTelemetry = function (appTelemetry) {
+        if (appTelemetry === null || appTelemetry === void 0 ? void 0 : appTelemetry.appName) {
+            this.parameters.set(AADServerParamKeys.X_APP_NAME, appTelemetry.appName);
+        }
+        if (appTelemetry === null || appTelemetry === void 0 ? void 0 : appTelemetry.appVersion) {
+            this.parameters.set(AADServerParamKeys.X_APP_VER, appTelemetry.appVersion);
+        }
     };
     /**
      * add prompt
@@ -3787,6 +3883,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addThrottling = function () {
         this.parameters.set(AADServerParamKeys.X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
     };
+    /**
+     * Adds logout_hint parameter for "silent" logout which prevent server account picker
+     */
+    RequestParameterBuilder.prototype.addLogoutHint = function (logoutHint) {
+        this.parameters.set(AADServerParamKeys.LOGOUT_HINT, encodeURIComponent(logoutHint));
+    };
     /**
      * Utility to create a URL from the params map
      */
@@ -3956,8 +4058,8 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId) {
-        var _a;
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+        var _a, _b;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
         atEntity.credentialType = exports.CredentialType.ACCESS_TOKEN;
@@ -3979,14 +4081,21 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.target = scopes;
         atEntity.oboAssertion = oboAssertion;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
-        // Create Access Token With Auth Scheme instead of regular access token
-        if (atEntity.tokenType !== exports.AuthenticationScheme.BEARER) {
+        if (requestedClaims) {
+            atEntity.requestedClaims = requestedClaims;
+            atEntity.requestedClaimsHash = requestedClaimsHash;
+        }
+        /*
+         * Create Access Token With Auth Scheme instead of regular access token
+         * Cast to lower to handle "bearer" from ADFS
+         */
+        if (((_a = atEntity.tokenType) === null || _a === void 0 ? void 0 : _a.toLowerCase()) !== exports.AuthenticationScheme.BEARER.toLowerCase()) {
             atEntity.credentialType = exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
             switch (atEntity.tokenType) {
                 case exports.AuthenticationScheme.POP:
                     // Make sure keyId is present and add it to credential
                     var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-                    if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
+                    if (!((_b = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _b === void 0 ? void 0 : _b.kid)) {
                         throw ClientAuthError.createTokenClaimsRequiredError();
                     }
                     atEntity.keyId = tokenClaims.cnf.kid;
@@ -4213,11 +4322,11 @@ var ProtocolUtils = /** @class */ (function () {
             // Split the state between library state and user passed state and decode them separately
             var splitState = state.split(Constants.RESOURCE_DELIM);
             var libraryState = splitState[0];
-            var userState = splitState.length > 1 ? splitState.slice(1).join(Constants.RESOURCE_DELIM) : "";
+            var userState = splitState.length > 1 ? splitState.slice(1).join(Constants.RESOURCE_DELIM) : Constants.EMPTY_STRING;
             var libraryStateString = cryptoObj.base64Decode(libraryState);
             var libraryStateObj = JSON.parse(libraryStateString);
             return {
-                userRequestState: !StringUtils.isEmpty(userState) ? userState : "",
+                userRequestState: !StringUtils.isEmpty(userState) ? userState : Constants.EMPTY_STRING,
                 libraryState: libraryStateObj
             };
         }
@@ -4387,7 +4496,7 @@ var UrlString = /** @class */ (function () {
         else if (hashIndex1 > -1) {
             return hashString.substring(hashIndex1 + 1);
         }
-        return "";
+        return Constants.EMPTY_STRING;
     };
     UrlString.constructAuthorityUriFromObject = function (urlObject) {
         return new UrlString(urlObject.Protocol + "//" + urlObject.HostNameAndPort + "/" + urlObject.PathSegments.join("/"));
@@ -4491,7 +4600,7 @@ var PopTokenGenerator = /** @class */ (function () {
                         resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                         resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                         resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
+                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid, request.correlationId)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -4684,7 +4793,7 @@ var ResponseHandler = /** @class */ (function () {
                         }
                         // Add keyId from request to serverTokenResponse if defined
                         serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, , 5, 8]);
@@ -4732,7 +4841,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param idTokenObj
      * @param authority
      */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, idTokenObj, requestScopes, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
         var env = authority.getPreferredCache();
         if (StringUtils.isEmpty(env)) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4748,7 +4857,7 @@ var ResponseHandler = /** @class */ (function () {
         var cachedAccessToken = null;
         if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
             // If scopes not returned in server response, use request scopes
-            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(requestScopes || []);
+            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(request.scopes || []);
             /*
              * Use timestamp calculated before request
              * Server may return timestamps as strings, parse to numbers if so.
@@ -4760,7 +4869,7 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         var cachedRefreshToken = null;
@@ -4782,8 +4891,8 @@ var ResponseHandler = /** @class */ (function () {
      */
     ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, oboAssertion, authCodePayload) {
         var authorityType = authority.authorityType;
-        var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : "";
-        var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : "";
+        var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : Constants.EMPTY_STRING;
+        var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : Constants.EMPTY_STRING;
         // ADFS does not require client_info in the response
         if (authorityType === exports.AuthorityType.Adfs) {
             this.logger.verbose("Authority type is ADFS, creating ADFS account");
@@ -4814,7 +4923,7 @@ var ResponseHandler = /** @class */ (function () {
             return __generator(this, function (_d) {
                 switch (_d.label) {
                     case 0:
-                        accessToken = "";
+                        accessToken = Constants.EMPTY_STRING;
                         responseScopes = [];
                         expiresOn = null;
                         familyId = Constants.EMPTY_STRING;
@@ -4979,11 +5088,11 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.createTokenRequestBody(request)];
@@ -5052,6 +5161,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         parameterBuilder.addAuthorizationCode(request.code);
                         // Add library metadata
                         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+                        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
                         parameterBuilder.addThrottling();
                         if (this.serverTelemetryManager) {
                             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -5160,6 +5270,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
         parameterBuilder.addResponseTypeCode();
         // add library info parameters
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         // add client_info=1
         parameterBuilder.addClientInfo();
         if (request.codeChallenge && request.codeChallengeMethod) {
@@ -5253,6 +5364,9 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
         if (request.state) {
             parameterBuilder.addState(request.state);
         }
+        if (request.logoutHint) {
+            parameterBuilder.addLogoutHint(request.logoutHint);
+        }
         if (request.extraQueryParameters) {
             parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
         }
@@ -5325,11 +5439,11 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                     clientId: this.config.authOptions.clientId,
                     authority: request.authority,
                     scopes: request.scopes,
+                    claims: request.claims,
                     authenticationScheme: request.authenticationScheme,
                     resourceRequestMethod: request.resourceRequestMethod,
                     resourceRequestUri: request.resourceRequestUri,
                     shrClaims: request.shrClaims,
-                    sshJwk: request.sshJwk,
                     sshKid: request.sshKid
                 };
                 return [2 /*return*/, this.executePostRequestToDeviceCodeEndpoint(this.authority.deviceCodeEndpoint, queryString, headers, thumbprint)];
@@ -5349,7 +5463,8 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                 switch (_b.label) {
                     case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, deviceCodeEndpoint, {
                             body: queryString,
-                            headers: headers
+                            headers: headers,
+                            proxyUrl: this.config.systemOptions.proxyUrl
                         })];
                     case 1:
                         _a = (_b.sent()).body, userCode = _a.user_code, deviceCode = _a.device_code, verificationUri = _a.verification_uri, expiresIn = _a.expires_in, interval = _a.interval, message = _a.message;
@@ -5424,11 +5539,11 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.executePostToTokenEndpoint(this.authority.tokenEndpoint, requestBody, headers, thumbprint)];
@@ -5471,6 +5586,7 @@ var DeviceCodeClient = /** @class */ (function (_super) {
         requestParameters.addCorrelationId(correlationId);
         requestParameters.addClientInfo();
         requestParameters.addLibraryInfo(this.config.libraryInfo);
+        requestParameters.addApplicationTelemetry(this.config.telemetry.application);
         requestParameters.addThrottling();
         if (this.serverTelemetryManager) {
             requestParameters.addServerTelemetry(this.serverTelemetryManager);
@@ -5592,11 +5708,11 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
@@ -5632,6 +5748,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
                         parameterBuilder.addClientInfo();
                         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+                        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
                         parameterBuilder.addThrottling();
                         if (this.serverTelemetryManager) {
                             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -5766,7 +5883,7 @@ var ClientCredentialClient = /** @class */ (function (_super) {
      */
     ClientCredentialClient.prototype.readAccessTokenFromCache = function () {
         var accessTokenFilter = {
-            homeAccountId: "",
+            homeAccountId: Constants.EMPTY_STRING,
             environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,
             credentialType: exports.CredentialType.ACCESS_TOKEN,
             clientId: this.config.authOptions.clientId,
@@ -5800,11 +5917,11 @@ var ClientCredentialClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         reqTimestamp = TimeUtils.nowSeconds();
@@ -5831,6 +5948,7 @@ var ClientCredentialClient = /** @class */ (function (_super) {
         parameterBuilder.addScopes(request.scopes, false);
         parameterBuilder.addGrantType(GrantType.CLIENT_CREDENTIALS_GRANT);
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
         if (this.serverTelemetryManager) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -5918,7 +6036,7 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                                 environment: cachedIdToken.environment,
                                 tenantId: cachedIdToken.realm,
                                 username: Constants.EMPTY_STRING,
-                                localAccountId: localAccountId || ""
+                                localAccountId: localAccountId || Constants.EMPTY_STRING
                             };
                             cachedAccount = this.readAccountFromCache(accountInfo);
                         }
@@ -6001,11 +6119,11 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         reqTimestamp = TimeUtils.nowSeconds();
@@ -6033,6 +6151,7 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         parameterBuilder.addGrantType(GrantType.JWT_BEARER);
         parameterBuilder.addClientInfo();
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
         if (this.serverTelemetryManager) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -6098,7 +6217,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     SilentFlowClient.prototype.acquireCachedToken = function (request) {
         var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function () {
-            var requestScopes, environment, authScheme, cacheRecord;
+            var environment, cacheRecord;
             return __generator(this, function (_e) {
                 switch (_e.label) {
                     case 0:
@@ -6112,19 +6231,12 @@ var SilentFlowClient = /** @class */ (function (_super) {
                             this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
-                        else if (!StringUtils.isEmptyObj(request.claims)) {
-                            // Must refresh due to request parameters.
-                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims are requested.");
-                            throw ClientAuthError.createRefreshRequiredError();
-                        }
                         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
                         if (!request.account) {
                             throw ClientAuthError.createNoAccountInSilentRequestError();
                         }
-                        requestScopes = new ScopeSet(request.scopes || []);
                         environment = request.authority || this.authority.getPreferredCache();
-                        authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
-                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme, request.sshKid);
+                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, request, environment);
                         if (!cacheRecord.accessToken) {
                             // Must refresh due to non-existent access_token.
                             (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
@@ -6226,11 +6338,11 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
                     clientId: this.config.authOptions.clientId,
                     authority: authority.canonicalAuthority,
                     scopes: request.scopes,
+                    claims: request.claims,
                     authenticationScheme: request.authenticationScheme,
                     resourceRequestMethod: request.resourceRequestMethod,
                     resourceRequestUri: request.resourceRequestUri,
                     shrClaims: request.shrClaims,
-                    sshJwk: request.sshJwk,
                     sshKid: request.sshKid
                 };
                 requestBody = this.createTokenRequestBody(request);
@@ -6255,6 +6367,7 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
         parameterBuilder.addGrantType(GrantType.RESOURCE_OWNER_PASSWORD_GRANT);
         parameterBuilder.addClientInfo();
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
         if (this.serverTelemetryManager) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -6398,18 +6511,22 @@ var RegionDiscovery = /** @class */ (function () {
      *
      * @returns Promise<string | null>
      */
-    RegionDiscovery.prototype.detectRegion = function (environmentRegion, regionDiscoveryMetadata) {
+    RegionDiscovery.prototype.detectRegion = function (environmentRegion, regionDiscoveryMetadata, proxyUrl) {
         return __awaiter(this, void 0, void 0, function () {
-            var autodetectedRegionName, localIMDSVersionResponse, currentIMDSVersion, currentIMDSVersionResponse;
+            var autodetectedRegionName, options, localIMDSVersionResponse, currentIMDSVersion, currentIMDSVersionResponse;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         autodetectedRegionName = environmentRegion;
                         if (!!autodetectedRegionName) return [3 /*break*/, 8];
+                        options = RegionDiscovery.IMDS_OPTIONS;
+                        if (proxyUrl) {
+                            options.proxyUrl = proxyUrl;
+                        }
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 6, , 7]);
-                        return [4 /*yield*/, this.getRegionFromIMDS(Constants.IMDS_VERSION)];
+                        return [4 /*yield*/, this.getRegionFromIMDS(Constants.IMDS_VERSION, options)];
                     case 2:
                         localIMDSVersionResponse = _a.sent();
                         if (localIMDSVersionResponse.status === ResponseCodes.httpSuccess) {
@@ -6417,14 +6534,14 @@ var RegionDiscovery = /** @class */ (function () {
                             regionDiscoveryMetadata.region_source = RegionDiscoverySources.IMDS;
                         }
                         if (!(localIMDSVersionResponse.status === ResponseCodes.httpBadRequest)) return [3 /*break*/, 5];
-                        return [4 /*yield*/, this.getCurrentVersion()];
+                        return [4 /*yield*/, this.getCurrentVersion(options)];
                     case 3:
                         currentIMDSVersion = _a.sent();
                         if (!currentIMDSVersion) {
                             regionDiscoveryMetadata.region_source = RegionDiscoverySources.FAILED_AUTO_DETECTION;
                             return [2 /*return*/, null];
                         }
-                        return [4 /*yield*/, this.getRegionFromIMDS(currentIMDSVersion)];
+                        return [4 /*yield*/, this.getRegionFromIMDS(currentIMDSVersion, options)];
                     case 4:
                         currentIMDSVersionResponse = _a.sent();
                         if (currentIMDSVersionResponse.status === ResponseCodes.httpSuccess) {
@@ -6457,10 +6574,10 @@ var RegionDiscovery = /** @class */ (function () {
      * @param imdsEndpointUrl
      * @returns Promise<NetworkResponse<string>>
      */
-    RegionDiscovery.prototype.getRegionFromIMDS = function (version) {
+    RegionDiscovery.prototype.getRegionFromIMDS = function (version, options) {
         return __awaiter(this, void 0, void 0, function () {
             return __generator(this, function (_a) {
-                return [2 /*return*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?api-version=" + version + "&format=text", RegionDiscovery.IMDS_OPTIONS, Constants.IMDS_TIMEOUT)];
+                return [2 /*return*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?api-version=" + version + "&format=text", options, Constants.IMDS_TIMEOUT)];
             });
         });
     };
@@ -6469,14 +6586,14 @@ var RegionDiscovery = /** @class */ (function () {
      *
      * @returns Promise<string | null>
      */
-    RegionDiscovery.prototype.getCurrentVersion = function () {
+    RegionDiscovery.prototype.getCurrentVersion = function (options) {
         return __awaiter(this, void 0, void 0, function () {
             var response;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         _a.trys.push([0, 2, , 3]);
-                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?format=json", RegionDiscovery.IMDS_OPTIONS)];
+                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?format=json", options)];
                     case 1:
                         response = _a.sent();
                         // When IMDS endpoint is called without the api version query param, bad request response comes back with latest version.
@@ -6493,7 +6610,11 @@ var RegionDiscovery = /** @class */ (function () {
         });
     };
     // Options for the IMDS endpoint request
-    RegionDiscovery.IMDS_OPTIONS = { headers: { "Metadata": "true" } };
+    RegionDiscovery.IMDS_OPTIONS = {
+        headers: {
+            Metadata: "true",
+        },
+    };
     return RegionDiscovery;
 }());
 
@@ -6506,7 +6627,7 @@ var RegionDiscovery = /** @class */ (function () {
  * endpoint. It will store the pertinent config data in this object for use during token calls.
  */
 var Authority = /** @class */ (function () {
-    function Authority(authority, networkInterface, cacheManager, authorityOptions) {
+    function Authority(authority, networkInterface, cacheManager, authorityOptions, proxyUrl) {
         this.canonicalAuthority = authority;
         this._canonicalAuthority.validateAsUri();
         this.networkInterface = networkInterface;
@@ -6514,6 +6635,7 @@ var Authority = /** @class */ (function () {
         this.authorityOptions = authorityOptions;
         this.regionDiscovery = new RegionDiscovery(networkInterface);
         this.regionDiscoveryMetadata = { region_used: undefined, region_source: undefined, region_outcome: undefined };
+        this.proxyUrl = proxyUrl || Constants.EMPTY_STRING;
     }
     Object.defineProperty(Authority.prototype, "authorityType", {
         // See above for AuthorityType
@@ -6782,7 +6904,7 @@ var Authority = /** @class */ (function () {
                         metadata = _b.sent();
                         if (!metadata) return [3 /*break*/, 4];
                         if (!((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.azureRegion)) return [3 /*break*/, 3];
-                        return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata)];
+                        return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata, this.proxyUrl)];
                     case 2:
                         autodetectedRegionName = _b.sent();
                         azureRegion = this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
@@ -6845,19 +6967,25 @@ var Authority = /** @class */ (function () {
      */
     Authority.prototype.getEndpointMetadataFromNetwork = function () {
         return __awaiter(this, void 0, void 0, function () {
-            var response;
+            var options, response;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        _a.trys.push([0, 2, , 3]);
-                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint)];
+                        options = {};
+                        if (this.proxyUrl) {
+                            options.proxyUrl = this.proxyUrl;
+                        }
+                        _a.label = 1;
                     case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
+                    case 2:
                         response = _a.sent();
                         return [2 /*return*/, isOpenIdConfigResponse(response.body) ? response.body : null];
-                    case 2:
+                    case 3:
                         _a.sent();
                         return [2 /*return*/, null];
-                    case 3: return [2 /*return*/];
+                    case 4: return [2 /*return*/];
                 }
             });
         });
@@ -6927,16 +7055,20 @@ var Authority = /** @class */ (function () {
      */
     Authority.prototype.getCloudDiscoveryMetadataFromNetwork = function () {
         return __awaiter(this, void 0, void 0, function () {
-            var instanceDiscoveryEndpoint, match, response, metadata;
+            var instanceDiscoveryEndpoint, options, match, response, metadata;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         instanceDiscoveryEndpoint = "" + Constants.AAD_INSTANCE_DISCOVERY_ENDPT + this.canonicalAuthority + "oauth2/v2.0/authorize";
+                        options = {};
+                        if (this.proxyUrl) {
+                            options.proxyUrl = this.proxyUrl;
+                        }
                         match = null;
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
-                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint)];
+                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options)];
                     case 2:
                         response = _a.sent();
                         metadata = isCloudInstanceDiscoveryResponse(response.body) ? response.body.metadata : [];
@@ -6951,7 +7083,7 @@ var Authority = /** @class */ (function () {
                         return [2 /*return*/, null];
                     case 4:
                         if (!match) {
-                            // Custom Domain scenario, host is trusted because Instance Discovery call succeeded 
+                            // Custom Domain scenario, host is trusted because Instance Discovery call succeeded
                             match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
                         }
                         return [2 /*return*/, match];
@@ -6969,6 +7101,19 @@ var Authority = /** @class */ (function () {
         });
         return matches.length > 0;
     };
+    /**
+     * helper function to populate the authority based on azureCloudOptions
+     * @param authorityString
+     * @param azureCloudOptions
+     */
+    Authority.generateAuthority = function (authorityString, azureCloudOptions) {
+        var authorityAzureCloudInstance;
+        if (azureCloudOptions && azureCloudOptions.azureCloudInstance !== exports.AzureCloudInstance.None) {
+            var tenant = azureCloudOptions.tenant ? azureCloudOptions.tenant : Constants.DEFAULT_COMMON_TENANT;
+            authorityAzureCloudInstance = azureCloudOptions.azureCloudInstance + "/" + tenant + "/";
+        }
+        return authorityAzureCloudInstance ? authorityAzureCloudInstance : authorityString;
+    };
     /**
      * Creates cloud discovery metadata object from a given host
      * @param host
@@ -7078,13 +7223,13 @@ var AuthorityFactory = /** @class */ (function () {
      * @param networkClient
      * @param protocolMode
      */
-    AuthorityFactory.createDiscoveredInstance = function (authorityUri, networkClient, cacheManager, authorityOptions) {
+    AuthorityFactory.createDiscoveredInstance = function (authorityUri, networkClient, cacheManager, authorityOptions, proxyUrl) {
         return __awaiter(this, void 0, void 0, function () {
             var acquireTokenAuthority, e_1;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        acquireTokenAuthority = AuthorityFactory.createInstance(authorityUri, networkClient, cacheManager, authorityOptions);
+                        acquireTokenAuthority = AuthorityFactory.createInstance(authorityUri, networkClient, cacheManager, authorityOptions, proxyUrl);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
@@ -7110,12 +7255,12 @@ var AuthorityFactory = /** @class */ (function () {
      * @param networkInterface
      * @param protocolMode
      */
-    AuthorityFactory.createInstance = function (authorityUrl, networkInterface, cacheManager, authorityOptions) {
+    AuthorityFactory.createInstance = function (authorityUrl, networkInterface, cacheManager, authorityOptions, proxyUrl) {
         // Throw error if authority url is empty
         if (StringUtils.isEmpty(authorityUrl)) {
             throw ClientConfigurationError.createUrlEmptyError();
         }
-        return new Authority(authorityUrl, networkInterface, cacheManager, authorityOptions);
+        return new Authority(authorityUrl, networkInterface, cacheManager, authorityOptions, proxyUrl);
     };
     return AuthorityFactory;
 }());
@@ -7240,7 +7385,7 @@ var AuthenticationHeaderParser = /** @class */ (function () {
         challenges.forEach(function (challenge) {
             var _a = challenge.split("="), key = _a[0], value = _a[1];
             // Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
-            challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
+            challengeMap[key] = unescape(value.replace(/['"]+/g, Constants.EMPTY_STRING));
         });
         return challengeMap;
     };
@@ -7382,9 +7527,9 @@ var ServerTelemetryManager = /** @class */ (function () {
      */
     ServerTelemetryManager.prototype.getRegionDiscoveryFields = function () {
         var regionDiscoveryFields = [];
-        regionDiscoveryFields.push(this.regionUsed || "");
-        regionDiscoveryFields.push(this.regionSource || "");
-        regionDiscoveryFields.push(this.regionOutcome || "");
+        regionDiscoveryFields.push(this.regionUsed || Constants.EMPTY_STRING);
+        regionDiscoveryFields.push(this.regionSource || Constants.EMPTY_STRING);
+        regionDiscoveryFields.push(this.regionOutcome || Constants.EMPTY_STRING);
         return regionDiscoveryFields.join(",");
     };
     /**
@@ -7407,6 +7552,385 @@ var ServerTelemetryManager = /** @class */ (function () {
     return ServerTelemetryManager;
 }());
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
+ *
+ * @export
+ * @enum {number}
+ */
+exports.PerformanceEvents = void 0;
+(function (PerformanceEvents) {
+    /**
+     * acquireTokenByCode API (msal-browser and msal-node).
+     * Used to acquire tokens by trading an authorization code against the token endpoint.
+     */
+    PerformanceEvents["AcquireTokenByCode"] = "acquireTokenByCode";
+    /**
+     * acquireTokenByRefreshToken API (msal-browser and msal-node).
+     * Used to renew an access token using a refresh token against the token endpoint.
+     */
+    PerformanceEvents["AcquireTokenByRefreshToken"] = "acquireTokenByRefreshToken";
+    /**
+     * acquireTokenSilent API (msal-browser and msal-node).
+     * Used to silently acquire a new access token (from the cache or the network).
+     */
+    PerformanceEvents["AcquireTokenSilent"] = "acquireTokenSilent";
+    /**
+     * acquireTokenSilentAsync (msal-browser).
+     * Internal API for acquireTokenSilent.
+     */
+    PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
+    /**
+     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
+     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
+     */
+    PerformanceEvents["CryptoOptsGetPublicKeyThumbprint"] = "cryptoOptsGetPublicKeyThumbprint";
+    /**
+     * signJwt API in CryptoOpts class (msal-browser).
+     * Used to signed a pop token.
+     */
+    PerformanceEvents["CryptoOptsSignJwt"] = "cryptoOptsSignJwt";
+    /**
+     * acquireToken API in the SilentCacheClient class (msal-browser).
+     * Used to read access tokens from the cache.
+     */
+    PerformanceEvents["SilentCacheClientAcquireToken"] = "silentCacheClientAcquireToken";
+    /**
+     * acquireToken API in the SilentIframeClient class (msal-browser).
+     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
+     */
+    PerformanceEvents["SilentIframeClientAcquireToken"] = "silentIframeClientAcquireToken";
+    /**
+     * acquireToken API in SilentRereshClient (msal-browser).
+     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
+     */
+    PerformanceEvents["SilentRefreshClientAcquireToken"] = "silentRefreshClientAcquireToken";
+    /**
+     * ssoSilent API (msal-browser).
+     * Used to silently acquire an authorization code and set of tokens using a hidden iframe.
+     */
+    PerformanceEvents["SsoSilent"] = "ssoSilent";
+    /**
+     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
+     * Used to load authority metadata for a request.
+     */
+    PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
+})(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
+/**
+ * State of the performance event.
+ *
+ * @export
+ * @enum {number}
+ */
+exports.PerformanceEventStatus = void 0;
+(function (PerformanceEventStatus) {
+    PerformanceEventStatus[PerformanceEventStatus["NotStarted"] = 0] = "NotStarted";
+    PerformanceEventStatus[PerformanceEventStatus["InProgress"] = 1] = "InProgress";
+    PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
+})(exports.PerformanceEventStatus || (exports.PerformanceEventStatus = {}));
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var PerformanceClient = /** @class */ (function () {
+    /**
+     * Creates an instance of PerformanceClient,
+     * an abstract class containing core performance telemetry logic.
+     *
+     * @constructor
+     * @param {string} clientId Client ID of the application
+     * @param {string} authority Authority used by the application
+     * @param {Logger} logger Logger used by the application
+     * @param {string} libraryName Name of the library
+     * @param {string} libraryVersion Version of the library
+     */
+    function PerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
+        this.authority = authority;
+        this.libraryName = libraryName;
+        this.libraryVersion = libraryVersion;
+        this.applicationTelemetry = applicationTelemetry;
+        this.clientId = clientId;
+        this.logger = logger;
+        this.callbacks = new Map();
+        this.eventsByCorrelationId = new Map();
+        this.measurementsById = new Map();
+    }
+    /**
+     * Starts measuring performance for a given operation. Returns a function that should be used to end the measurement.
+     *
+     * @param {PerformanceEvents} measureName
+     * @param {?string} [correlationId]
+     * @returns {InProgressPerformanceEvent}
+     */
+    PerformanceClient.prototype.startMeasurement = function (measureName, correlationId) {
+        var _this = this;
+        var _a, _b;
+        // Generate a placeholder correlation if the request does not provide one
+        var eventCorrelationId = correlationId || this.generateId();
+        if (!correlationId) {
+            this.logger.info("PerformanceClient: No correlation id provided for " + measureName + ", generating", eventCorrelationId);
+        }
+        this.logger.trace("PerformanceClient: Performance measurement started for " + measureName, eventCorrelationId);
+        var performanceMeasurement = this.startPerformanceMeasuremeant(measureName, eventCorrelationId);
+        performanceMeasurement.startMeasurement();
+        var inProgressEvent = {
+            eventId: this.generateId(),
+            status: exports.PerformanceEventStatus.InProgress,
+            authority: this.authority,
+            libraryName: this.libraryName,
+            libraryVersion: this.libraryVersion,
+            appName: (_a = this.applicationTelemetry) === null || _a === void 0 ? void 0 : _a.appName,
+            appVersion: (_b = this.applicationTelemetry) === null || _b === void 0 ? void 0 : _b.appVersion,
+            clientId: this.clientId,
+            name: measureName,
+            startTimeMs: Date.now(),
+            correlationId: eventCorrelationId
+        };
+        // Store in progress events so they can be discarded if not ended properly
+        this.cacheEventByCorrelationId(inProgressEvent);
+        this.cacheMeasurement(inProgressEvent, performanceMeasurement);
+        // Return the event and functions the caller can use to properly end/flush the measurement
+        return {
+            endMeasurement: function (event) {
+                var completedEvent = _this.endMeasurement(__assign(__assign({}, inProgressEvent), event));
+                if (completedEvent) {
+                    // Cache event so that submeasurements can be added downstream
+                    _this.cacheEventByCorrelationId(completedEvent);
+                }
+                return completedEvent;
+            },
+            flushMeasurement: function () {
+                return _this.flushMeasurements(inProgressEvent.name, inProgressEvent.correlationId);
+            },
+            discardMeasurement: function () {
+                return _this.discardMeasurements(inProgressEvent.correlationId);
+            },
+            measurement: performanceMeasurement,
+            event: inProgressEvent
+        };
+    };
+    /**
+     * Stops measuring the performance for an operation. Should only be called directly by PerformanceClient classes,
+     * as consumers should instead use the function returned by startMeasurement.
+     *
+     * @param {PerformanceEvent} event
+     * @returns {(PerformanceEvent | null)}
+     */
+    PerformanceClient.prototype.endMeasurement = function (event) {
+        var performanceMeasurement = this.measurementsById.get(event.eventId);
+        if (performanceMeasurement) {
+            // Immediately delete so that the same event isnt ended twice
+            this.measurementsById.delete(event.eventId);
+            performanceMeasurement.endMeasurement();
+            var durationMs = performanceMeasurement.flushMeasurement();
+            // null indicates no measurement was taken (e.g. needed performance APIs not present)
+            if (durationMs !== null) {
+                this.logger.trace("PerformanceClient: Performance measurement ended for " + event.name + ": " + durationMs + " ms", event.correlationId);
+                var completedEvent = __assign(__assign({ 
+                    // Allow duration to be overwritten when event ends (e.g. testing), but not status
+                    durationMs: Math.round(durationMs) }, event), { status: exports.PerformanceEventStatus.Completed });
+                return completedEvent;
+            }
+            else {
+                this.logger.trace("PerformanceClient: Performance measurement not taken", event.correlationId);
+            }
+        }
+        else {
+            this.logger.trace("PerformanceClient: Measurement not found for " + event.eventId, event.correlationId);
+        }
+        return null;
+    };
+    /**
+     * Upserts event into event cache.
+     * First key is the correlation id, second key is the event id.
+     * Allows for events to be grouped by correlation id,
+     * and to easily allow for properties on them to be updated.
+     *
+     * @private
+     * @param {PerformanceEvent} event
+     */
+    PerformanceClient.prototype.cacheEventByCorrelationId = function (event) {
+        var existingEvents = this.eventsByCorrelationId.get(event.correlationId);
+        if (existingEvents) {
+            this.logger.trace("PerformanceClient: Performance measurement for " + event.name + " added/updated", event.correlationId);
+            existingEvents.set(event.eventId, event);
+        }
+        else {
+            this.logger.trace("PerformanceClient: Performance measurement for " + event.name + " started", event.correlationId);
+            this.eventsByCorrelationId.set(event.correlationId, new Map().set(event.eventId, event));
+        }
+    };
+    /**
+     * Cache measurements by their id.
+     *
+     * @private
+     * @param {PerformanceEvent} event
+     * @param {IPerformanceMeasurement} measurement
+     */
+    PerformanceClient.prototype.cacheMeasurement = function (event, measurement) {
+        this.measurementsById.set(event.eventId, measurement);
+    };
+    /**
+     * Gathers and emits performance events for measurements taked for the given top-level API and correlation ID.
+     *
+     * @param {PerformanceEvents} measureName
+     * @param {string} correlationId
+     */
+    PerformanceClient.prototype.flushMeasurements = function (measureName, correlationId) {
+        var _this = this;
+        this.logger.trace("PerformanceClient: Performance measurements flushed for " + measureName, correlationId);
+        var eventsForCorrelationId = this.eventsByCorrelationId.get(correlationId);
+        if (eventsForCorrelationId) {
+            this.discardMeasurements(correlationId);
+            /*
+             * Manually end incomplete submeasurements to ensure there arent orphaned/never ending events.
+             * Incomplete submeasurements are likely an instrumentation bug that should be fixed.
+             * IE only supports Map.forEach.
+             */
+            var completedEvents_1 = [];
+            eventsForCorrelationId.forEach(function (event) {
+                if (event.name !== measureName && event.status !== exports.PerformanceEventStatus.Completed) {
+                    _this.logger.trace("PerformanceClient: Incomplete submeasurement " + event.name + " found for " + measureName, correlationId);
+                    var completedEvent = _this.endMeasurement(event);
+                    if (completedEvent) {
+                        completedEvents_1.push(completedEvent);
+                    }
+                }
+                completedEvents_1.push(event);
+            });
+            // Sort events by start time (earliest first)
+            var sortedCompletedEvents = completedEvents_1.sort(function (eventA, eventB) { return eventA.startTimeMs - eventB.startTimeMs; });
+            // Take completed top level event and add completed submeasurements durations as properties
+            var topLevelEvents = sortedCompletedEvents.filter(function (event) { return event.name === measureName && event.status === exports.PerformanceEventStatus.Completed; });
+            if (topLevelEvents.length > 0) {
+                /*
+                 * Only take the first top-level event if there are multiple events with the same correlation id.
+                 * This greatly simplifies logic for submeasurements.
+                 */
+                if (topLevelEvents.length > 1) {
+                    this.logger.verbose("PerformanceClient: Multiple distinct top-level performance events found, using the first", correlationId);
+                }
+                var topLevelEvent = topLevelEvents[0];
+                this.logger.verbose("PerformanceClient: Measurement found for " + measureName, correlationId);
+                // Build event object with top level and sub measurements
+                var eventToEmit = sortedCompletedEvents.reduce(function (previous, current) {
+                    if (current.name !== measureName) {
+                        _this.logger.trace("PerformanceClient: Complete submeasurement found for " + current.name, correlationId);
+                        // TODO: Emit additional properties for each subMeasurement
+                        var subMeasurementName = current.name + "DurationMs";
+                        /*
+                         * Some code paths, such as resolving an authority, can occur multiple times.
+                         * Only take the first measurement, since the second could be read from the cache,
+                         * or due to the same correlation id being used for two distinct requests.
+                         */
+                        if (!previous[subMeasurementName]) {
+                            previous[subMeasurementName] = current.durationMs;
+                        }
+                        else {
+                            _this.logger.verbose("PerformanceClient: Submeasurement for " + measureName + " already exists for " + current.name + ", ignoring", correlationId);
+                        }
+                    }
+                    return previous;
+                }, topLevelEvent);
+                this.emitEvents([eventToEmit], eventToEmit.correlationId);
+            }
+            else {
+                this.logger.verbose("PerformanceClient: No completed top-level measurements found for " + measureName, correlationId);
+            }
+        }
+        else {
+            this.logger.verbose("PerformanceClient: No measurements found", correlationId);
+        }
+    };
+    /**
+     * Removes measurements for a given correlation id.
+     *
+     * @param {string} correlationId
+     */
+    PerformanceClient.prototype.discardMeasurements = function (correlationId) {
+        this.logger.trace("PerformanceClient: Performance measurements discarded", correlationId);
+        this.eventsByCorrelationId.delete(correlationId);
+    };
+    /**
+     * Registers a callback function to receive performance events.
+     *
+     * @param {PerformanceCallbackFunction} callback
+     * @returns {string}
+     */
+    PerformanceClient.prototype.addPerformanceCallback = function (callback) {
+        var callbackId = this.generateId();
+        this.callbacks.set(callbackId, callback);
+        this.logger.verbose("PerformanceClient: Performance callback registered with id: " + callbackId);
+        return callbackId;
+    };
+    /**
+     * Removes a callback registered with addPerformanceCallback.
+     *
+     * @param {string} callbackId
+     * @returns {boolean}
+     */
+    PerformanceClient.prototype.removePerformanceCallback = function (callbackId) {
+        var result = this.callbacks.delete(callbackId);
+        if (result) {
+            this.logger.verbose("PerformanceClient: Performance callback " + callbackId + " removed.");
+        }
+        else {
+            this.logger.verbose("PerformanceClient: Performance callback " + callbackId + " not removed.");
+        }
+        return result;
+    };
+    /**
+     * Emits events to all registered callbacks.
+     *
+     * @param {PerformanceEvent[]} events
+     * @param {?string} [correlationId]
+     */
+    PerformanceClient.prototype.emitEvents = function (events, correlationId) {
+        var _this = this;
+        this.logger.verbose("PerformanceClient: Emitting performance events", correlationId);
+        this.callbacks.forEach(function (callback, callbackId) {
+            _this.logger.trace("PerformanceClient: Emitting event to callback " + callbackId, correlationId);
+            callback.apply(null, [events]);
+        });
+    };
+    return PerformanceClient;
+}());
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var StubPerformanceMeasurement = /** @class */ (function () {
+    function StubPerformanceMeasurement() {
+    }
+    /* eslint-disable-next-line @typescript-eslint/no-empty-function */
+    StubPerformanceMeasurement.prototype.startMeasurement = function () { };
+    /* eslint-disable-next-line @typescript-eslint/no-empty-function */
+    StubPerformanceMeasurement.prototype.endMeasurement = function () { };
+    StubPerformanceMeasurement.prototype.flushMeasurement = function () {
+        return null;
+    };
+    return StubPerformanceMeasurement;
+}());
+var StubPerformanceClient = /** @class */ (function (_super) {
+    __extends(StubPerformanceClient, _super);
+    function StubPerformanceClient() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    StubPerformanceClient.prototype.generateId = function () {
+        return "callback-id";
+    };
+    StubPerformanceClient.prototype.startPerformanceMeasuremeant = function () {
+        return new StubPerformanceMeasurement();
+    };
+    return StubPerformanceClient;
+}(PerformanceClient));
+
 exports.AccessTokenEntity = AccessTokenEntity;
 exports.AccountEntity = AccountEntity;
 exports.AppMetadataEntity = AppMetadataEntity;
@@ -7438,6 +7962,7 @@ exports.Logger = Logger;
 exports.NetworkManager = NetworkManager;
 exports.OIDC_DEFAULT_SCOPES = OIDC_DEFAULT_SCOPES;
 exports.OnBehalfOfClient = OnBehalfOfClient;
+exports.PerformanceClient = PerformanceClient;
 exports.PopTokenGenerator = PopTokenGenerator;
 exports.PromptValue = PromptValue;
 exports.ProtocolUtils = ProtocolUtils;
@@ -7449,6 +7974,7 @@ exports.ServerTelemetryEntity = ServerTelemetryEntity;
 exports.ServerTelemetryManager = ServerTelemetryManager;
 exports.SilentFlowClient = SilentFlowClient;
 exports.StringUtils = StringUtils;
+exports.StubPerformanceClient = StubPerformanceClient;
 exports.StubbedNetworkModule = StubbedNetworkModule;
 exports.ThrottlingEntity = ThrottlingEntity;
 exports.ThrottlingUtils = ThrottlingUtils;