@azure/msal-common 6.1.0 → 6.3.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v6.1.0 2022-02-08 */
+/*! @azure/msal-common v6.3.0 2022-05-02 */
 'use strict';
 'use strict';
 
@@ -136,7 +136,9 @@ var Constants = {
     IMDS_TIMEOUT: 2000,
     AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
-    KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"]
+    KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
+    TOKEN_RESPONSE_TYPE: "token",
+    ID_TOKEN_RESPONSE_TYPE: "id_token"
 };
 var OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
@@ -213,6 +215,8 @@ var AADServerParamKeys;
     AADServerParamKeys["X_CLIENT_CURR_TELEM"] = "x-client-current-telemetry";
     AADServerParamKeys["X_CLIENT_LAST_TELEM"] = "x-client-last-telemetry";
     AADServerParamKeys["X_MS_LIB_CAPABILITY"] = "x-ms-lib-capability";
+    AADServerParamKeys["X_APP_NAME"] = "x-app-name";
+    AADServerParamKeys["X_APP_VER"] = "x-app-ver";
     AADServerParamKeys["POST_LOGOUT_URI"] = "post_logout_redirect_uri";
     AADServerParamKeys["ID_TOKEN_HINT"] = "id_token_hint";
     AADServerParamKeys["DEVICE_CODE"] = "device_code";
@@ -227,6 +231,7 @@ var AADServerParamKeys;
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
     AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
+    AADServerParamKeys["NATIVE_BROKER"] = "nativebroker";
     AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
@@ -483,8 +488,8 @@ var AuthError = /** @class */ (function (_super) {
         _this = _super.call(this, errorString) || this;
         Object.setPrototypeOf(_this, AuthError.prototype);
         _this.errorCode = errorCode || Constants.EMPTY_STRING;
-        _this.errorMessage = errorMessage || "";
-        _this.subError = suberror || "";
+        _this.errorMessage = errorMessage || Constants.EMPTY_STRING;
+        _this.subError = suberror || Constants.EMPTY_STRING;
         _this.name = "AuthError";
         return _this;
     }
@@ -1185,7 +1190,7 @@ var Logger = /** @class */ (function () {
         this.localCallback = loggerOptions.loggerCallback || defaultLoggerCallback;
         this.piiLoggingEnabled = loggerOptions.piiLoggingEnabled || false;
         this.level = typeof (loggerOptions.logLevel) === "number" ? loggerOptions.logLevel : exports.LogLevel.Info;
-        this.correlationId = loggerOptions.correlationId || "";
+        this.correlationId = loggerOptions.correlationId || Constants.EMPTY_STRING;
         this.packageName = packageName || Constants.EMPTY_STRING;
         this.packageVersion = packageVersion || Constants.EMPTY_STRING;
     }
@@ -1215,7 +1220,7 @@ var Logger = /** @class */ (function () {
             logHeader = "[" + timestamp + "]";
         }
         var log = logHeader + " : " + this.packageName + "@" + this.packageVersion + " : " + exports.LogLevel[options.logLevel] + " - " + logMessage;
-        // debug(`msal:${LogLevel[options.logLevel]}${options.containsPii ? "-Pii": ""}${options.context ? `:${options.context}` : ""}`)(logMessage);
+        // debug(`msal:${LogLevel[options.logLevel]}${options.containsPii ? "-Pii": Constants.EMPTY_STRING}${options.context ? `:${options.context}` : Constants.EMPTY_STRING}`)(logMessage);
         this.executeCallback(options.logLevel, log, options.containsPii || false);
     };
     /**
@@ -1233,7 +1238,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Error,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1243,7 +1248,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Error,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1253,7 +1258,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Warning,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1263,7 +1268,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Warning,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1273,7 +1278,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Info,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1283,7 +1288,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Info,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1293,7 +1298,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Verbose,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1303,7 +1308,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Verbose,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1313,7 +1318,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Trace,
             containsPii: false,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1323,7 +1328,7 @@ var Logger = /** @class */ (function () {
         this.logMessage(message, {
             logLevel: exports.LogLevel.Trace,
             containsPii: true,
-            correlationId: correlationId || ""
+            correlationId: correlationId || Constants.EMPTY_STRING
         });
     };
     /**
@@ -1337,7 +1342,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "6.1.0";
+var version = "6.3.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1349,6 +1354,8 @@ exports.AzureCloudInstance = void 0;
     AzureCloudInstance[AzureCloudInstance["None"] = 0] = "None";
     // Microsoft Azure public cloud
     AzureCloudInstance["AzurePublic"] = "https://login.microsoftonline.com";
+    // Microsoft PPE
+    AzureCloudInstance["AzurePpe"] = "https://login.windows-ppe.net";
     // Microsoft Chinese national cloud
     AzureCloudInstance["AzureChina"] = "https://login.chinacloudapi.cn";
     // Microsoft German national cloud ("Black Forest")
@@ -1485,7 +1492,7 @@ var CredentialEntity = /** @class */ (function () {
         var credentialId = [
             credentialType,
             clientOrFamilyId,
-            realm || "",
+            realm || Constants.EMPTY_STRING,
         ];
         return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
@@ -1493,13 +1500,13 @@ var CredentialEntity = /** @class */ (function () {
      * Generate target key component as per schema: <target>
      */
     CredentialEntity.generateTargetForCacheKey = function (scopes) {
-        return (scopes || "").toLowerCase();
+        return (scopes || Constants.EMPTY_STRING).toLowerCase();
     };
     /**
      * Generate requested claims key component as per schema: <requestedClaims>
      */
     CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
-        return (requestedClaimsHash || "").toLowerCase();
+        return (requestedClaimsHash || Constants.EMPTY_STRING).toLowerCase();
     };
     /**
      * Generate scheme key componenet as per schema: <scheme>
@@ -1509,7 +1516,7 @@ var CredentialEntity = /** @class */ (function () {
          * PoP Tokens and SSH certs include scheme in cache key
          * Cast to lowercase to handle "bearer" from ADFS
          */
-        return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : "";
+        return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : Constants.EMPTY_STRING;
     };
     return CredentialEntity;
 }());
@@ -1794,7 +1801,7 @@ var ScopeSet = /** @class */ (function () {
      * @param scopesRequired
      */
     ScopeSet.fromString = function (inputScopeString) {
-        var scopeString = inputScopeString || "";
+        var scopeString = inputScopeString || Constants.EMPTY_STRING;
         var inputScopes = scopeString.split(" ");
         return new ScopeSet(inputScopes);
     };
@@ -1938,7 +1945,7 @@ var ScopeSet = /** @class */ (function () {
             var scopeArr = this.asArray();
             return scopeArr.join(" ");
         }
-        return "";
+        return Constants.EMPTY_STRING;
     };
     /**
      * Prints scopes into a space-delimited lower-case string (used for caching)
@@ -2023,6 +2030,7 @@ exports.AuthorityType = void 0;
  *      lastModificationApp:
  *      oboAssertion: access token passed in as part of OBO request
  *      idTokenClaims: Object containing claims parsed from ID token
+ *      nativeAccountId: Account identifier on the native device
  * }
  */
 var AccountEntity = /** @class */ (function () {
@@ -2076,7 +2084,8 @@ var AccountEntity = /** @class */ (function () {
             username: this.username,
             localAccountId: this.localAccountId,
             name: this.name,
-            idTokenClaims: this.idTokenClaims
+            idTokenClaims: this.idTokenClaims,
+            nativeAccountId: this.nativeAccountId
         };
     };
     /**
@@ -2086,8 +2095,8 @@ var AccountEntity = /** @class */ (function () {
     AccountEntity.generateAccountCacheKey = function (accountInterface) {
         var accountKey = [
             accountInterface.homeAccountId,
-            accountInterface.environment || "",
-            accountInterface.tenantId || "",
+            accountInterface.environment || Constants.EMPTY_STRING,
+            accountInterface.tenantId || Constants.EMPTY_STRING,
         ];
         return accountKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
@@ -2098,29 +2107,30 @@ var AccountEntity = /** @class */ (function () {
      * @param idToken
      * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
         var _a, _b, _c, _d, _e, _f;
         var account = new AccountEntity();
         account.authorityType = exports.CacheAccountType.MSSTS_ACCOUNT_TYPE;
         account.clientInfo = clientInfo;
         account.homeAccountId = homeAccountId;
+        account.nativeAccountId = nativeAccountId;
         var env = environment || (authority && authority.getPreferredCache());
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
         }
         account.environment = env;
         // non AAD scenarios can have empty realm
-        account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || "";
+        account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || Constants.EMPTY_STRING;
         account.oboAssertion = oboAssertion;
         if (idToken) {
             account.idTokenClaims = idToken.claims;
             // How do you account for MSA CID here?
-            account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || "";
+            account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || Constants.EMPTY_STRING;
             /*
              * In B2C scenarios the emails claim is used instead of preferred_username and it is an array. In most cases it will contain a single email.
              * This field should not be relied upon if a custom policy is configured to return more than 1 email.
              */
-            account.username = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username) || (((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : "");
+            account.username = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username) || (((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : Constants.EMPTY_STRING);
             account.name = (_f = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _f === void 0 ? void 0 : _f.name;
         }
         account.cloudGraphHostName = cloudGraphHostName;
@@ -2138,7 +2148,7 @@ var AccountEntity = /** @class */ (function () {
         account.authorityType = (authority && authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
-        account.realm = "";
+        account.realm = Constants.EMPTY_STRING;
         account.oboAssertion = oboAssertion;
         var env = environment || authority && authority.getPreferredCache();
         if (!env) {
@@ -2146,10 +2156,10 @@ var AccountEntity = /** @class */ (function () {
         }
         if (idToken) {
             // How do you account for MSA CID here?
-            account.localAccountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.oid) || ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.sub) || "";
+            account.localAccountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.oid) || ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.sub) || Constants.EMPTY_STRING;
             // upn claim for most ADFS scenarios
-            account.username = ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.upn) || "";
-            account.name = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.name) || "";
+            account.username = ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.upn) || Constants.EMPTY_STRING;
+            account.name = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.name) || Constants.EMPTY_STRING;
             account.idTokenClaims = idToken === null || idToken === void 0 ? void 0 : idToken.claims;
         }
         account.environment = env;
@@ -2225,6 +2235,7 @@ var AccountEntity = /** @class */ (function () {
             (accountA.username === accountB.username) &&
             (accountA.tenantId === accountB.tenantId) &&
             (accountA.environment === accountB.environment) &&
+            (accountA.nativeAccountId === accountB.nativeAccountId) &&
             claimsMatch;
     };
     return AccountEntity;
@@ -2386,7 +2397,7 @@ var CacheManager = /** @class */ (function () {
      * @param realm
      */
     CacheManager.prototype.getAccountsFilteredBy = function (accountFilter) {
-        return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : "", accountFilter ? accountFilter.environment : "", accountFilter ? accountFilter.realm : "");
+        return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING);
     };
     /**
      * retrieve accounts matching all provided filters; if no filter is set, get all accounts
@@ -2632,7 +2643,7 @@ var CacheManager = /** @class */ (function () {
         });
     };
     /**
-     * returns a boolean if the given account is removed
+     * Removes credentials associated with the provided account
      * @param account
      */
     CacheManager.prototype.removeAccountContext = function (account) {
@@ -3115,7 +3126,7 @@ var DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 var DEFAULT_SYSTEM_OPTIONS = {
     tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
     preventCorsPreflight: false,
-    proxyUrl: "",
+    proxyUrl: Constants.EMPTY_STRING
 };
 var DEFAULT_LOGGER_IMPLEMENTATION = {
     loggerCallback: function () {
@@ -3123,7 +3134,7 @@ var DEFAULT_LOGGER_IMPLEMENTATION = {
     },
     piiLoggingEnabled: false,
     logLevel: exports.LogLevel.Info,
-    correlationId: ""
+    correlationId: Constants.EMPTY_STRING
 };
 var DEFAULT_NETWORK_IMPLEMENTATION = {
     sendGetRequestAsync: function () {
@@ -3148,17 +3159,23 @@ var DEFAULT_NETWORK_IMPLEMENTATION = {
 var DEFAULT_LIBRARY_INFO = {
     sku: Constants.SKU,
     version: version,
-    cpu: "",
-    os: ""
+    cpu: Constants.EMPTY_STRING,
+    os: Constants.EMPTY_STRING
 };
 var DEFAULT_CLIENT_CREDENTIALS = {
-    clientSecret: "",
+    clientSecret: Constants.EMPTY_STRING,
     clientAssertion: undefined
 };
 var DEFAULT_AZURE_CLOUD_OPTIONS = {
     azureCloudInstance: exports.AzureCloudInstance.None,
     tenant: "" + Constants.DEFAULT_COMMON_TENANT
 };
+var DEFAULT_TELEMETRY_OPTIONS = {
+    application: {
+        appName: "",
+        appVersion: ""
+    }
+};
 /**
  * Function that sets the default options when not explicitly configured from app developer
  *
@@ -3167,7 +3184,7 @@ var DEFAULT_AZURE_CLOUD_OPTIONS = {
  * @returns Configuration
  */
 function buildClientConfiguration(_a) {
-    var userAuthOptions = _a.authOptions, userSystemOptions = _a.systemOptions, userLoggerOption = _a.loggerOptions, storageImplementation = _a.storageInterface, networkImplementation = _a.networkInterface, cryptoImplementation = _a.cryptoInterface, clientCredentials = _a.clientCredentials, libraryInfo = _a.libraryInfo, serverTelemetryManager = _a.serverTelemetryManager, persistencePlugin = _a.persistencePlugin, serializableCache = _a.serializableCache;
+    var userAuthOptions = _a.authOptions, userSystemOptions = _a.systemOptions, userLoggerOption = _a.loggerOptions, storageImplementation = _a.storageInterface, networkImplementation = _a.networkInterface, cryptoImplementation = _a.cryptoInterface, clientCredentials = _a.clientCredentials, libraryInfo = _a.libraryInfo, telemetry = _a.telemetry, serverTelemetryManager = _a.serverTelemetryManager, persistencePlugin = _a.persistencePlugin, serializableCache = _a.serializableCache;
     var loggerOptions = __assign(__assign({}, DEFAULT_LOGGER_IMPLEMENTATION), userLoggerOption);
     return {
         authOptions: buildAuthOptions(userAuthOptions),
@@ -3178,6 +3195,7 @@ function buildClientConfiguration(_a) {
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
         libraryInfo: __assign(__assign({}, DEFAULT_LIBRARY_INFO), libraryInfo),
+        telemetry: __assign(__assign({}, DEFAULT_TELEMETRY_OPTIONS), telemetry),
         serverTelemetryManager: serverTelemetryManager || null,
         persistencePlugin: persistencePlugin || null,
         serializableCache: serializableCache || null
@@ -3545,6 +3563,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addResponseTypeCode = function () {
         this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
     };
+    /**
+     * add response_type = token id_token
+     */
+    RequestParameterBuilder.prototype.addResponseTypeForTokenAndIdToken = function () {
+        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.TOKEN_RESPONSE_TYPE + " " + Constants.ID_TOKEN_RESPONSE_TYPE));
+    };
     /**
      * add response_mode. defaults to query.
      * @param responseMode
@@ -3552,6 +3576,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addResponseMode = function (responseMode) {
         this.parameters.set(AADServerParamKeys.RESPONSE_MODE, encodeURIComponent((responseMode) ? responseMode : exports.ResponseMode.QUERY));
     };
+    /**
+     * Add flag to indicate STS should attempt to use WAM if available
+     */
+    RequestParameterBuilder.prototype.addNativeBroker = function () {
+        this.parameters.set(AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
+    };
     /**
      * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
      * @param scopeSet
@@ -3652,8 +3682,24 @@ var RequestParameterBuilder = /** @class */ (function () {
         // Telemetry Info
         this.parameters.set(AADServerParamKeys.X_CLIENT_SKU, libraryInfo.sku);
         this.parameters.set(AADServerParamKeys.X_CLIENT_VER, libraryInfo.version);
-        this.parameters.set(AADServerParamKeys.X_CLIENT_OS, libraryInfo.os);
-        this.parameters.set(AADServerParamKeys.X_CLIENT_CPU, libraryInfo.cpu);
+        if (libraryInfo.os) {
+            this.parameters.set(AADServerParamKeys.X_CLIENT_OS, libraryInfo.os);
+        }
+        if (libraryInfo.cpu) {
+            this.parameters.set(AADServerParamKeys.X_CLIENT_CPU, libraryInfo.cpu);
+        }
+    };
+    /**
+     * Add client telemetry parameters
+     * @param appTelemetry
+     */
+    RequestParameterBuilder.prototype.addApplicationTelemetry = function (appTelemetry) {
+        if (appTelemetry === null || appTelemetry === void 0 ? void 0 : appTelemetry.appName) {
+            this.parameters.set(AADServerParamKeys.X_APP_NAME, appTelemetry.appName);
+        }
+        if (appTelemetry === null || appTelemetry === void 0 ? void 0 : appTelemetry.appVersion) {
+            this.parameters.set(AADServerParamKeys.X_APP_VER, appTelemetry.appVersion);
+        }
     };
     /**
      * add prompt
@@ -4295,11 +4341,11 @@ var ProtocolUtils = /** @class */ (function () {
             // Split the state between library state and user passed state and decode them separately
             var splitState = state.split(Constants.RESOURCE_DELIM);
             var libraryState = splitState[0];
-            var userState = splitState.length > 1 ? splitState.slice(1).join(Constants.RESOURCE_DELIM) : "";
+            var userState = splitState.length > 1 ? splitState.slice(1).join(Constants.RESOURCE_DELIM) : Constants.EMPTY_STRING;
             var libraryStateString = cryptoObj.base64Decode(libraryState);
             var libraryStateObj = JSON.parse(libraryStateString);
             return {
-                userRequestState: !StringUtils.isEmpty(userState) ? userState : "",
+                userRequestState: !StringUtils.isEmpty(userState) ? userState : Constants.EMPTY_STRING,
                 libraryState: libraryStateObj
             };
         }
@@ -4469,7 +4515,7 @@ var UrlString = /** @class */ (function () {
         else if (hashIndex1 > -1) {
             return hashString.substring(hashIndex1 + 1);
         }
-        return "";
+        return Constants.EMPTY_STRING;
     };
     UrlString.constructAuthorityUriFromObject = function (urlObject) {
         return new UrlString(urlObject.Protocol + "//" + urlObject.HostNameAndPort + "/" + urlObject.PathSegments.join("/"));
@@ -4522,6 +4568,11 @@ var PopTokenGenerator = /** @class */ (function () {
     function PopTokenGenerator(cryptoUtils) {
         this.cryptoUtils = cryptoUtils;
     }
+    /**
+     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.generateCnf = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var reqCnf;
@@ -4535,6 +4586,23 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Generates the hash of the req_cnf
+     * @param cnf
+     * @returns
+     */
+    PopTokenGenerator.prototype.generateCnfHash = function (cnf) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                return [2 /*return*/, this.cryptoUtils.hashString(cnf)];
+            });
+        });
+    };
+    /**
+     * Generates key_id for a SHR token request
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.generateKid = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var kidThumbprint;
@@ -4551,6 +4619,12 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Signs the POP access_token with the local generated key-pair
+     * @param accessToken
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.signPopToken = function (accessToken, request) {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
@@ -4564,6 +4638,14 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Utility function to generate the signed JWT for an access_token
+     * @param payload
+     * @param kid
+     * @param request
+     * @param claims
+     * @returns
+     */
     PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
         return __awaiter(this, void 0, void 0, function () {
             var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
@@ -4573,7 +4655,7 @@ var PopTokenGenerator = /** @class */ (function () {
                         resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                         resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                         resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
+                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid, request.correlationId)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -4864,8 +4946,8 @@ var ResponseHandler = /** @class */ (function () {
      */
     ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, oboAssertion, authCodePayload) {
         var authorityType = authority.authorityType;
-        var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : "";
-        var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : "";
+        var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : Constants.EMPTY_STRING;
+        var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : Constants.EMPTY_STRING;
         // ADFS does not require client_info in the response
         if (authorityType === exports.AuthorityType.Adfs) {
             this.logger.verbose("Authority type is ADFS, creating ADFS account");
@@ -4896,7 +4978,7 @@ var ResponseHandler = /** @class */ (function () {
             return __generator(this, function (_d) {
                 switch (_d.label) {
                     case 0:
-                        accessToken = "";
+                        accessToken = Constants.EMPTY_STRING;
                         responseScopes = [];
                         expiresOn = null;
                         familyId = Constants.EMPTY_STRING;
@@ -4939,7 +5021,8 @@ var ResponseHandler = /** @class */ (function () {
                                 state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
                                 msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
-                                code: code
+                                code: code,
+                                fromNativeBroker: false
                             }];
                 }
             });
@@ -4977,8 +5060,12 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
         return __awaiter(this, void 0, void 0, function () {
             var queryString;
             return __generator(this, function (_a) {
-                queryString = this.createAuthCodeUrlQueryString(request);
-                return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.createAuthCodeUrlQueryString(request)];
+                    case 1:
+                        queryString = _a.sent();
+                        return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                }
             });
         });
     };
@@ -5134,6 +5221,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         parameterBuilder.addAuthorizationCode(request.code);
                         // Add library metadata
                         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+                        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
                         parameterBuilder.addThrottling();
                         if (this.serverTelemetryManager) {
                             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -5227,95 +5315,116 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      * @param request
      */
     AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
-        var parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(this.config.authOptions.clientId);
-        var requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
-        parameterBuilder.addScopes(requestScopes);
-        // validate the redirectUri (to be a non null value)
-        parameterBuilder.addRedirectUri(request.redirectUri);
-        // generate the correlationId if not set by the user and add
-        var correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
-        parameterBuilder.addCorrelationId(correlationId);
-        // add response_mode. If not passed in it defaults to query.
-        parameterBuilder.addResponseMode(request.responseMode);
-        // add response_type = code
-        parameterBuilder.addResponseTypeCode();
-        // add library info parameters
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        // add client_info=1
-        parameterBuilder.addClientInfo();
-        if (request.codeChallenge && request.codeChallengeMethod) {
-            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
-        }
-        if (request.prompt) {
-            parameterBuilder.addPrompt(request.prompt);
-        }
-        if (request.domainHint) {
-            parameterBuilder.addDomainHint(request.domainHint);
-        }
-        // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
-        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
-            // AAD will throw if prompt=select_account is passed with an account hint
-            if (request.sid && request.prompt === PromptValue.NONE) {
-                // SessionID is only used in silent calls
-                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
-                parameterBuilder.addSid(request.sid);
-            }
-            else if (request.account) {
-                var accountSid = this.extractAccountSid(request.account);
-                // If account and loginHint are provided, we will check account first for sid before adding loginHint
-                if (accountSid && request.prompt === PromptValue.NONE) {
-                    // SessionId is only used in silent calls
-                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
-                    parameterBuilder.addSid(accountSid);
-                    try {
-                        var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                    }
-                }
-                else if (request.loginHint) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
-                    parameterBuilder.addLoginHint(request.loginHint);
-                    parameterBuilder.addCcsUpn(request.loginHint);
-                }
-                else if (request.account.username) {
-                    // Fallback to account username if provided
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
-                    parameterBuilder.addLoginHint(request.account.username);
-                    try {
-                        var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                    }
+        return __awaiter(this, void 0, void 0, function () {
+            var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, cnf, cnfHash;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        parameterBuilder = new RequestParameterBuilder();
+                        parameterBuilder.addClientId(this.config.authOptions.clientId);
+                        requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
+                        parameterBuilder.addScopes(requestScopes);
+                        // validate the redirectUri (to be a non null value)
+                        parameterBuilder.addRedirectUri(request.redirectUri);
+                        correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
+                        parameterBuilder.addCorrelationId(correlationId);
+                        // add response_mode. If not passed in it defaults to query.
+                        parameterBuilder.addResponseMode(request.responseMode);
+                        // add response_type = code
+                        parameterBuilder.addResponseTypeCode();
+                        // add library info parameters
+                        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+                        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+                        // add client_info=1
+                        parameterBuilder.addClientInfo();
+                        if (request.codeChallenge && request.codeChallengeMethod) {
+                            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
+                        }
+                        if (request.prompt) {
+                            parameterBuilder.addPrompt(request.prompt);
+                        }
+                        if (request.domainHint) {
+                            parameterBuilder.addDomainHint(request.domainHint);
+                        }
+                        // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
+                        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+                            // AAD will throw if prompt=select_account is passed with an account hint
+                            if (request.sid && request.prompt === PromptValue.NONE) {
+                                // SessionID is only used in silent calls
+                                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
+                                parameterBuilder.addSid(request.sid);
+                            }
+                            else if (request.account) {
+                                accountSid = this.extractAccountSid(request.account);
+                                // If account and loginHint are provided, we will check account first for sid before adding loginHint
+                                if (accountSid && request.prompt === PromptValue.NONE) {
+                                    // SessionId is only used in silent calls
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
+                                    parameterBuilder.addSid(accountSid);
+                                    try {
+                                        clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                        parameterBuilder.addCcsOid(clientInfo);
+                                    }
+                                    catch (e) {
+                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                    }
+                                }
+                                else if (request.loginHint) {
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
+                                    parameterBuilder.addLoginHint(request.loginHint);
+                                    parameterBuilder.addCcsUpn(request.loginHint);
+                                }
+                                else if (request.account.username) {
+                                    // Fallback to account username if provided
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
+                                    parameterBuilder.addLoginHint(request.account.username);
+                                    try {
+                                        clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                        parameterBuilder.addCcsOid(clientInfo);
+                                    }
+                                    catch (e) {
+                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                    }
+                                }
+                            }
+                            else if (request.loginHint) {
+                                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
+                                parameterBuilder.addLoginHint(request.loginHint);
+                                parameterBuilder.addCcsUpn(request.loginHint);
+                            }
+                        }
+                        else {
+                            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
+                        }
+                        if (request.nonce) {
+                            parameterBuilder.addNonce(request.nonce);
+                        }
+                        if (request.state) {
+                            parameterBuilder.addState(request.state);
+                        }
+                        if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
+                            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+                        }
+                        if (request.extraQueryParameters) {
+                            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+                        }
+                        if (!request.nativeBroker) return [3 /*break*/, 3];
+                        // signal ests that this is a WAM call
+                        parameterBuilder.addNativeBroker();
+                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                        popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
+                        return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
+                    case 1:
+                        cnf = _a.sent();
+                        return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
+                    case 2:
+                        cnfHash = _a.sent();
+                        parameterBuilder.addPopToken(cnfHash);
+                        _a.label = 3;
+                    case 3: return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
-            }
-            else if (request.loginHint) {
-                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
-                parameterBuilder.addLoginHint(request.loginHint);
-                parameterBuilder.addCcsUpn(request.loginHint);
-            }
-        }
-        else {
-            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
-        }
-        if (request.nonce) {
-            parameterBuilder.addNonce(request.nonce);
-        }
-        if (request.state) {
-            parameterBuilder.addState(request.state);
-        }
-        if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
-        }
-        if (request.extraQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
-        }
-        return parameterBuilder.createQueryString();
+            });
+        });
     };
     /**
      * This API validates the `EndSessionRequest` and creates a URL
@@ -5557,6 +5666,7 @@ var DeviceCodeClient = /** @class */ (function (_super) {
         requestParameters.addCorrelationId(correlationId);
         requestParameters.addClientInfo();
         requestParameters.addLibraryInfo(this.config.libraryInfo);
+        requestParameters.addApplicationTelemetry(this.config.telemetry.application);
         requestParameters.addThrottling();
         if (this.serverTelemetryManager) {
             requestParameters.addServerTelemetry(this.serverTelemetryManager);
@@ -5718,6 +5828,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
                         parameterBuilder.addClientInfo();
                         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+                        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
                         parameterBuilder.addThrottling();
                         if (this.serverTelemetryManager) {
                             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -5852,7 +5963,7 @@ var ClientCredentialClient = /** @class */ (function (_super) {
      */
     ClientCredentialClient.prototype.readAccessTokenFromCache = function () {
         var accessTokenFilter = {
-            homeAccountId: "",
+            homeAccountId: Constants.EMPTY_STRING,
             environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,
             credentialType: exports.CredentialType.ACCESS_TOKEN,
             clientId: this.config.authOptions.clientId,
@@ -5917,6 +6028,7 @@ var ClientCredentialClient = /** @class */ (function (_super) {
         parameterBuilder.addScopes(request.scopes, false);
         parameterBuilder.addGrantType(GrantType.CLIENT_CREDENTIALS_GRANT);
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
         if (this.serverTelemetryManager) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -6004,7 +6116,7 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                                 environment: cachedIdToken.environment,
                                 tenantId: cachedIdToken.realm,
                                 username: Constants.EMPTY_STRING,
-                                localAccountId: localAccountId || ""
+                                localAccountId: localAccountId || Constants.EMPTY_STRING
                             };
                             cachedAccount = this.readAccountFromCache(accountInfo);
                         }
@@ -6119,6 +6231,7 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         parameterBuilder.addGrantType(GrantType.JWT_BEARER);
         parameterBuilder.addClientInfo();
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
         if (this.serverTelemetryManager) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -6331,9 +6444,11 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
         parameterBuilder.addUsername(request.username);
         parameterBuilder.addPassword(request.password);
         parameterBuilder.addScopes(request.scopes);
+        parameterBuilder.addResponseTypeForTokenAndIdToken();
         parameterBuilder.addGrantType(GrantType.RESOURCE_OWNER_PASSWORD_GRANT);
         parameterBuilder.addClientInfo();
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
         parameterBuilder.addThrottling();
         if (this.serverTelemetryManager) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
@@ -7351,7 +7466,7 @@ var AuthenticationHeaderParser = /** @class */ (function () {
         challenges.forEach(function (challenge) {
             var _a = challenge.split("="), key = _a[0], value = _a[1];
             // Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
-            challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
+            challengeMap[key] = unescape(value.replace(/['"]+/g, Constants.EMPTY_STRING));
         });
         return challengeMap;
     };
@@ -7493,9 +7608,9 @@ var ServerTelemetryManager = /** @class */ (function () {
      */
     ServerTelemetryManager.prototype.getRegionDiscoveryFields = function () {
         var regionDiscoveryFields = [];
-        regionDiscoveryFields.push(this.regionUsed || "");
-        regionDiscoveryFields.push(this.regionSource || "");
-        regionDiscoveryFields.push(this.regionOutcome || "");
+        regionDiscoveryFields.push(this.regionUsed || Constants.EMPTY_STRING);
+        regionDiscoveryFields.push(this.regionSource || Constants.EMPTY_STRING);
+        regionDiscoveryFields.push(this.regionOutcome || Constants.EMPTY_STRING);
         return regionDiscoveryFields.join(",");
     };
     /**
@@ -7518,6 +7633,400 @@ var ServerTelemetryManager = /** @class */ (function () {
     return ServerTelemetryManager;
 }());
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
+ *
+ * @export
+ * @enum {number}
+ */
+exports.PerformanceEvents = void 0;
+(function (PerformanceEvents) {
+    /**
+     * acquireTokenByCode API (msal-browser and msal-node).
+     * Used to acquire tokens by trading an authorization code against the token endpoint.
+     */
+    PerformanceEvents["AcquireTokenByCode"] = "acquireTokenByCode";
+    /**
+     * acquireTokenByRefreshToken API (msal-browser and msal-node).
+     * Used to renew an access token using a refresh token against the token endpoint.
+     */
+    PerformanceEvents["AcquireTokenByRefreshToken"] = "acquireTokenByRefreshToken";
+    /**
+     * acquireTokenSilent API (msal-browser and msal-node).
+     * Used to silently acquire a new access token (from the cache or the network).
+     */
+    PerformanceEvents["AcquireTokenSilent"] = "acquireTokenSilent";
+    /**
+     * acquireTokenSilentAsync (msal-browser).
+     * Internal API for acquireTokenSilent.
+     */
+    PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
+    /**
+     * acquireTokenPopup (msal-browser).
+     * Used to acquire a new access token interactively through pop ups
+     */
+    PerformanceEvents["AcquireTokenPopup"] = "acquireTokenPopup";
+    /**
+     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
+     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
+     */
+    PerformanceEvents["CryptoOptsGetPublicKeyThumbprint"] = "cryptoOptsGetPublicKeyThumbprint";
+    /**
+     * signJwt API in CryptoOpts class (msal-browser).
+     * Used to signed a pop token.
+     */
+    PerformanceEvents["CryptoOptsSignJwt"] = "cryptoOptsSignJwt";
+    /**
+     * acquireToken API in the SilentCacheClient class (msal-browser).
+     * Used to read access tokens from the cache.
+     */
+    PerformanceEvents["SilentCacheClientAcquireToken"] = "silentCacheClientAcquireToken";
+    /**
+     * acquireToken API in the SilentIframeClient class (msal-browser).
+     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
+     */
+    PerformanceEvents["SilentIframeClientAcquireToken"] = "silentIframeClientAcquireToken";
+    /**
+     * acquireToken API in SilentRereshClient (msal-browser).
+     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
+     */
+    PerformanceEvents["SilentRefreshClientAcquireToken"] = "silentRefreshClientAcquireToken";
+    /**
+     * ssoSilent API (msal-browser).
+     * Used to silently acquire an authorization code and set of tokens using a hidden iframe.
+     */
+    PerformanceEvents["SsoSilent"] = "ssoSilent";
+    /**
+     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
+     * Used to load authority metadata for a request.
+     */
+    PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
+    /**
+     * acquireToken APIs in msal-browser.
+     * Used to make an /authorize endpoint call with native brokering enabled.
+     */
+    PerformanceEvents["FetchAccountIdWithNativeBroker"] = "fetchAccountIdWithNativeBroker";
+    /**
+     * acquireToken API in NativeInteractionClient class (msal-browser).
+     * Used to acquire a token from Native component when native brokering is enabled.
+     */
+    PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
+})(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
+/**
+ * State of the performance event.
+ *
+ * @export
+ * @enum {number}
+ */
+exports.PerformanceEventStatus = void 0;
+(function (PerformanceEventStatus) {
+    PerformanceEventStatus[PerformanceEventStatus["NotStarted"] = 0] = "NotStarted";
+    PerformanceEventStatus[PerformanceEventStatus["InProgress"] = 1] = "InProgress";
+    PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
+})(exports.PerformanceEventStatus || (exports.PerformanceEventStatus = {}));
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var PerformanceClient = /** @class */ (function () {
+    /**
+     * Creates an instance of PerformanceClient,
+     * an abstract class containing core performance telemetry logic.
+     *
+     * @constructor
+     * @param {string} clientId Client ID of the application
+     * @param {string} authority Authority used by the application
+     * @param {Logger} logger Logger used by the application
+     * @param {string} libraryName Name of the library
+     * @param {string} libraryVersion Version of the library
+     */
+    function PerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
+        this.authority = authority;
+        this.libraryName = libraryName;
+        this.libraryVersion = libraryVersion;
+        this.applicationTelemetry = applicationTelemetry;
+        this.clientId = clientId;
+        this.logger = logger;
+        this.callbacks = new Map();
+        this.eventsByCorrelationId = new Map();
+        this.measurementsById = new Map();
+    }
+    /**
+     * Starts measuring performance for a given operation. Returns a function that should be used to end the measurement.
+     *
+     * @param {PerformanceEvents} measureName
+     * @param {?string} [correlationId]
+     * @returns {InProgressPerformanceEvent}
+     */
+    PerformanceClient.prototype.startMeasurement = function (measureName, correlationId) {
+        var _this = this;
+        var _a, _b;
+        // Generate a placeholder correlation if the request does not provide one
+        var eventCorrelationId = correlationId || this.generateId();
+        if (!correlationId) {
+            this.logger.info("PerformanceClient: No correlation id provided for " + measureName + ", generating", eventCorrelationId);
+        }
+        this.logger.trace("PerformanceClient: Performance measurement started for " + measureName, eventCorrelationId);
+        var performanceMeasurement = this.startPerformanceMeasuremeant(measureName, eventCorrelationId);
+        performanceMeasurement.startMeasurement();
+        var inProgressEvent = {
+            eventId: this.generateId(),
+            status: exports.PerformanceEventStatus.InProgress,
+            authority: this.authority,
+            libraryName: this.libraryName,
+            libraryVersion: this.libraryVersion,
+            appName: (_a = this.applicationTelemetry) === null || _a === void 0 ? void 0 : _a.appName,
+            appVersion: (_b = this.applicationTelemetry) === null || _b === void 0 ? void 0 : _b.appVersion,
+            clientId: this.clientId,
+            name: measureName,
+            startTimeMs: Date.now(),
+            correlationId: eventCorrelationId
+        };
+        // Store in progress events so they can be discarded if not ended properly
+        this.cacheEventByCorrelationId(inProgressEvent);
+        this.cacheMeasurement(inProgressEvent, performanceMeasurement);
+        // Return the event and functions the caller can use to properly end/flush the measurement
+        return {
+            endMeasurement: function (event) {
+                var completedEvent = _this.endMeasurement(__assign(__assign({}, inProgressEvent), event));
+                if (completedEvent) {
+                    // Cache event so that submeasurements can be added downstream
+                    _this.cacheEventByCorrelationId(completedEvent);
+                }
+                return completedEvent;
+            },
+            flushMeasurement: function () {
+                return _this.flushMeasurements(inProgressEvent.name, inProgressEvent.correlationId);
+            },
+            discardMeasurement: function () {
+                return _this.discardMeasurements(inProgressEvent.correlationId);
+            },
+            measurement: performanceMeasurement,
+            event: inProgressEvent
+        };
+    };
+    /**
+     * Stops measuring the performance for an operation. Should only be called directly by PerformanceClient classes,
+     * as consumers should instead use the function returned by startMeasurement.
+     *
+     * @param {PerformanceEvent} event
+     * @returns {(PerformanceEvent | null)}
+     */
+    PerformanceClient.prototype.endMeasurement = function (event) {
+        var performanceMeasurement = this.measurementsById.get(event.eventId);
+        if (performanceMeasurement) {
+            // Immediately delete so that the same event isnt ended twice
+            this.measurementsById.delete(event.eventId);
+            performanceMeasurement.endMeasurement();
+            var durationMs = performanceMeasurement.flushMeasurement();
+            // null indicates no measurement was taken (e.g. needed performance APIs not present)
+            if (durationMs !== null) {
+                this.logger.trace("PerformanceClient: Performance measurement ended for " + event.name + ": " + durationMs + " ms", event.correlationId);
+                var completedEvent = __assign(__assign({ 
+                    // Allow duration to be overwritten when event ends (e.g. testing), but not status
+                    durationMs: Math.round(durationMs) }, event), { status: exports.PerformanceEventStatus.Completed });
+                return completedEvent;
+            }
+            else {
+                this.logger.trace("PerformanceClient: Performance measurement not taken", event.correlationId);
+            }
+        }
+        else {
+            this.logger.trace("PerformanceClient: Measurement not found for " + event.eventId, event.correlationId);
+        }
+        return null;
+    };
+    /**
+     * Upserts event into event cache.
+     * First key is the correlation id, second key is the event id.
+     * Allows for events to be grouped by correlation id,
+     * and to easily allow for properties on them to be updated.
+     *
+     * @private
+     * @param {PerformanceEvent} event
+     */
+    PerformanceClient.prototype.cacheEventByCorrelationId = function (event) {
+        var existingEvents = this.eventsByCorrelationId.get(event.correlationId);
+        if (existingEvents) {
+            this.logger.trace("PerformanceClient: Performance measurement for " + event.name + " added/updated", event.correlationId);
+            existingEvents.set(event.eventId, event);
+        }
+        else {
+            this.logger.trace("PerformanceClient: Performance measurement for " + event.name + " started", event.correlationId);
+            this.eventsByCorrelationId.set(event.correlationId, new Map().set(event.eventId, event));
+        }
+    };
+    /**
+     * Cache measurements by their id.
+     *
+     * @private
+     * @param {PerformanceEvent} event
+     * @param {IPerformanceMeasurement} measurement
+     */
+    PerformanceClient.prototype.cacheMeasurement = function (event, measurement) {
+        this.measurementsById.set(event.eventId, measurement);
+    };
+    /**
+     * Gathers and emits performance events for measurements taked for the given top-level API and correlation ID.
+     *
+     * @param {PerformanceEvents} measureName
+     * @param {string} correlationId
+     */
+    PerformanceClient.prototype.flushMeasurements = function (measureName, correlationId) {
+        var _this = this;
+        this.logger.trace("PerformanceClient: Performance measurements flushed for " + measureName, correlationId);
+        var eventsForCorrelationId = this.eventsByCorrelationId.get(correlationId);
+        if (eventsForCorrelationId) {
+            this.discardMeasurements(correlationId);
+            /*
+             * Manually end incomplete submeasurements to ensure there arent orphaned/never ending events.
+             * Incomplete submeasurements are likely an instrumentation bug that should be fixed.
+             * IE only supports Map.forEach.
+             */
+            var completedEvents_1 = [];
+            eventsForCorrelationId.forEach(function (event) {
+                if (event.name !== measureName && event.status !== exports.PerformanceEventStatus.Completed) {
+                    _this.logger.trace("PerformanceClient: Incomplete submeasurement " + event.name + " found for " + measureName, correlationId);
+                    var completedEvent = _this.endMeasurement(event);
+                    if (completedEvent) {
+                        completedEvents_1.push(completedEvent);
+                    }
+                }
+                completedEvents_1.push(event);
+            });
+            // Sort events by start time (earliest first)
+            var sortedCompletedEvents = completedEvents_1.sort(function (eventA, eventB) { return eventA.startTimeMs - eventB.startTimeMs; });
+            // Take completed top level event and add completed submeasurements durations as properties
+            var topLevelEvents = sortedCompletedEvents.filter(function (event) { return event.name === measureName && event.status === exports.PerformanceEventStatus.Completed; });
+            if (topLevelEvents.length > 0) {
+                /*
+                 * Only take the first top-level event if there are multiple events with the same correlation id.
+                 * This greatly simplifies logic for submeasurements.
+                 */
+                if (topLevelEvents.length > 1) {
+                    this.logger.verbose("PerformanceClient: Multiple distinct top-level performance events found, using the first", correlationId);
+                }
+                var topLevelEvent = topLevelEvents[0];
+                this.logger.verbose("PerformanceClient: Measurement found for " + measureName, correlationId);
+                // Build event object with top level and sub measurements
+                var eventToEmit = sortedCompletedEvents.reduce(function (previous, current) {
+                    if (current.name !== measureName) {
+                        _this.logger.trace("PerformanceClient: Complete submeasurement found for " + current.name, correlationId);
+                        // TODO: Emit additional properties for each subMeasurement
+                        var subMeasurementName = current.name + "DurationMs";
+                        /*
+                         * Some code paths, such as resolving an authority, can occur multiple times.
+                         * Only take the first measurement, since the second could be read from the cache,
+                         * or due to the same correlation id being used for two distinct requests.
+                         */
+                        if (!previous[subMeasurementName]) {
+                            previous[subMeasurementName] = current.durationMs;
+                        }
+                        else {
+                            _this.logger.verbose("PerformanceClient: Submeasurement for " + measureName + " already exists for " + current.name + ", ignoring", correlationId);
+                        }
+                    }
+                    return previous;
+                }, topLevelEvent);
+                this.emitEvents([eventToEmit], eventToEmit.correlationId);
+            }
+            else {
+                this.logger.verbose("PerformanceClient: No completed top-level measurements found for " + measureName, correlationId);
+            }
+        }
+        else {
+            this.logger.verbose("PerformanceClient: No measurements found", correlationId);
+        }
+    };
+    /**
+     * Removes measurements for a given correlation id.
+     *
+     * @param {string} correlationId
+     */
+    PerformanceClient.prototype.discardMeasurements = function (correlationId) {
+        this.logger.trace("PerformanceClient: Performance measurements discarded", correlationId);
+        this.eventsByCorrelationId.delete(correlationId);
+    };
+    /**
+     * Registers a callback function to receive performance events.
+     *
+     * @param {PerformanceCallbackFunction} callback
+     * @returns {string}
+     */
+    PerformanceClient.prototype.addPerformanceCallback = function (callback) {
+        var callbackId = this.generateId();
+        this.callbacks.set(callbackId, callback);
+        this.logger.verbose("PerformanceClient: Performance callback registered with id: " + callbackId);
+        return callbackId;
+    };
+    /**
+     * Removes a callback registered with addPerformanceCallback.
+     *
+     * @param {string} callbackId
+     * @returns {boolean}
+     */
+    PerformanceClient.prototype.removePerformanceCallback = function (callbackId) {
+        var result = this.callbacks.delete(callbackId);
+        if (result) {
+            this.logger.verbose("PerformanceClient: Performance callback " + callbackId + " removed.");
+        }
+        else {
+            this.logger.verbose("PerformanceClient: Performance callback " + callbackId + " not removed.");
+        }
+        return result;
+    };
+    /**
+     * Emits events to all registered callbacks.
+     *
+     * @param {PerformanceEvent[]} events
+     * @param {?string} [correlationId]
+     */
+    PerformanceClient.prototype.emitEvents = function (events, correlationId) {
+        var _this = this;
+        this.logger.verbose("PerformanceClient: Emitting performance events", correlationId);
+        this.callbacks.forEach(function (callback, callbackId) {
+            _this.logger.trace("PerformanceClient: Emitting event to callback " + callbackId, correlationId);
+            callback.apply(null, [events]);
+        });
+    };
+    return PerformanceClient;
+}());
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var StubPerformanceMeasurement = /** @class */ (function () {
+    function StubPerformanceMeasurement() {
+    }
+    /* eslint-disable-next-line @typescript-eslint/no-empty-function */
+    StubPerformanceMeasurement.prototype.startMeasurement = function () { };
+    /* eslint-disable-next-line @typescript-eslint/no-empty-function */
+    StubPerformanceMeasurement.prototype.endMeasurement = function () { };
+    StubPerformanceMeasurement.prototype.flushMeasurement = function () {
+        return null;
+    };
+    return StubPerformanceMeasurement;
+}());
+var StubPerformanceClient = /** @class */ (function (_super) {
+    __extends(StubPerformanceClient, _super);
+    function StubPerformanceClient() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    StubPerformanceClient.prototype.generateId = function () {
+        return "callback-id";
+    };
+    StubPerformanceClient.prototype.startPerformanceMeasuremeant = function () {
+        return new StubPerformanceMeasurement();
+    };
+    return StubPerformanceClient;
+}(PerformanceClient));
+
 exports.AccessTokenEntity = AccessTokenEntity;
 exports.AccountEntity = AccountEntity;
 exports.AppMetadataEntity = AppMetadataEntity;
@@ -7549,6 +8058,7 @@ exports.Logger = Logger;
 exports.NetworkManager = NetworkManager;
 exports.OIDC_DEFAULT_SCOPES = OIDC_DEFAULT_SCOPES;
 exports.OnBehalfOfClient = OnBehalfOfClient;
+exports.PerformanceClient = PerformanceClient;
 exports.PopTokenGenerator = PopTokenGenerator;
 exports.PromptValue = PromptValue;
 exports.ProtocolUtils = ProtocolUtils;
@@ -7560,6 +8070,7 @@ exports.ServerTelemetryEntity = ServerTelemetryEntity;
 exports.ServerTelemetryManager = ServerTelemetryManager;
 exports.SilentFlowClient = SilentFlowClient;
 exports.StringUtils = StringUtils;
+exports.StubPerformanceClient = StubPerformanceClient;
 exports.StubbedNetworkModule = StubbedNetworkModule;
 exports.ThrottlingEntity = ThrottlingEntity;
 exports.ThrottlingUtils = ThrottlingUtils;