@azure/msal-common 7.2.0 → 7.4.1

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v7.2.0 2022-07-18 */
+/*! @azure/msal-common v7.4.1 2022-09-12 */
 'use strict';
 'use strict';
 
@@ -139,7 +139,7 @@ var Constants = {
     KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
     TOKEN_RESPONSE_TYPE: "token",
     ID_TOKEN_RESPONSE_TYPE: "id_token",
-    SHR_NONCE_VALIDITY: 240,
+    SHR_NONCE_VALIDITY: 240
 };
 var OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
@@ -152,14 +152,14 @@ var OIDC_SCOPES = __spreadArrays(OIDC_DEFAULT_SCOPES, [
 /**
  * Request header names
  */
-var HeaderNames;
+exports.HeaderNames = void 0;
 (function (HeaderNames) {
     HeaderNames["CONTENT_TYPE"] = "Content-Type";
     HeaderNames["RETRY_AFTER"] = "Retry-After";
     HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
     HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
     HeaderNames["AuthenticationInfo"] = "Authentication-Info";
-})(HeaderNames || (HeaderNames = {}));
+})(exports.HeaderNames || (exports.HeaderNames = {}));
 /**
  * Persistent cache keys MSAL which stay while user is logged in.
  */
@@ -185,7 +185,7 @@ var AADAuthorityConstants;
 /**
  * Keys in the hashParams sent by AAD Server
  */
-var AADServerParamKeys;
+exports.AADServerParamKeys = void 0;
 (function (AADServerParamKeys) {
     AADServerParamKeys["CLIENT_ID"] = "client_id";
     AADServerParamKeys["REDIRECT_URI"] = "redirect_uri";
@@ -235,15 +235,15 @@ var AADServerParamKeys;
     AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
     AADServerParamKeys["NATIVE_BROKER"] = "nativebroker";
     AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
-})(AADServerParamKeys || (AADServerParamKeys = {}));
+})(exports.AADServerParamKeys || (exports.AADServerParamKeys = {}));
 /**
  * Claims request keys
  */
-var ClaimsRequestKeys;
+exports.ClaimsRequestKeys = void 0;
 (function (ClaimsRequestKeys) {
     ClaimsRequestKeys["ACCESS_TOKEN"] = "access_token";
     ClaimsRequestKeys["XMS_CC"] = "xms_cc";
-})(ClaimsRequestKeys || (ClaimsRequestKeys = {}));
+})(exports.ClaimsRequestKeys || (exports.ClaimsRequestKeys = {}));
 /**
  * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
  * prompt values kept changing over past couple of years. There are some undocumented prompt values for some
@@ -259,7 +259,7 @@ var PromptValue = {
 /**
  * SSO Types - generated to populate hints
  */
-var SSOTypes;
+exports.SSOTypes = void 0;
 (function (SSOTypes) {
     SSOTypes["ACCOUNT"] = "account";
     SSOTypes["SID"] = "sid";
@@ -270,13 +270,13 @@ var SSOTypes;
     SSOTypes["CONSUMERS"] = "consumers";
     SSOTypes["ACCOUNT_ID"] = "accountIdentifier";
     SSOTypes["HOMEACCOUNT_ID"] = "homeAccountIdentifier";
-})(SSOTypes || (SSOTypes = {}));
+})(exports.SSOTypes || (exports.SSOTypes = {}));
 /**
  * Disallowed extra query parameters.
  */
 [
-    SSOTypes.SID,
-    SSOTypes.LOGIN_HINT
+    exports.SSOTypes.SID,
+    exports.SSOTypes.LOGIN_HINT
 ];
 /**
  * allowed values for codeVerifier
@@ -285,6 +285,15 @@ var CodeChallengeMethodValues = {
     PLAIN: "plain",
     S256: "S256"
 };
+/**
+ * The method used to encode the code verifier for the code challenge parameter. can be one
+ * of plain or s256. if excluded, code challenge is assumed to be plaintext. for more
+ * information, see the pkce rcf: https://tools.ietf.org/html/rfc7636
+ */
+[
+    CodeChallengeMethodValues.PLAIN,
+    CodeChallengeMethodValues.S256
+];
 /**
  * allowed values for response_mode
  */
@@ -424,11 +433,11 @@ var Errors = {
 /**
  * Password grant parameters
  */
-var PasswordGrantConstants;
+exports.PasswordGrantConstants = void 0;
 (function (PasswordGrantConstants) {
     PasswordGrantConstants["username"] = "username";
     PasswordGrantConstants["password"] = "password";
-})(PasswordGrantConstants || (PasswordGrantConstants = {}));
+})(exports.PasswordGrantConstants || (exports.PasswordGrantConstants = {}));
 /**
  * Response codes
  */
@@ -483,6 +492,10 @@ var AuthErrorMessage = {
     unexpectedError: {
         code: "unexpected_error",
         desc: "Unexpected error in authentication."
+    },
+    postRequestFailed: {
+        code: "post_request_failed",
+        desc: "Post request failed from the network, could be a 4xx/5xx or a network unavailability. Please check the exact error code for details."
     }
 };
 /**
@@ -511,6 +524,14 @@ var AuthError = /** @class */ (function (_super) {
     AuthError.createUnexpectedError = function (errDesc) {
         return new AuthError(AuthErrorMessage.unexpectedError.code, AuthErrorMessage.unexpectedError.desc + ": " + errDesc);
     };
+    /**
+     * Creates an error for post request failures.
+     * @param errDesc
+     * @returns
+     */
+    AuthError.createPostRequestFailed = function (errDesc) {
+        return new AuthError(AuthErrorMessage.postRequestFailed.code, AuthErrorMessage.postRequestFailed.desc + ": " + errDesc);
+    };
     return AuthError;
 }(Error));
 
@@ -1360,7 +1381,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "7.2.0";
+var version = "7.4.1";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1992,7 +2013,7 @@ function buildClientInfo(rawClientInfo, crypto) {
         return JSON.parse(decodedClientInfo);
     }
     catch (e) {
-        throw ClientAuthError.createClientInfoDecodingError(e);
+        throw ClientAuthError.createClientInfoDecodingError(e.message);
     }
 }
 /**
@@ -2321,6 +2342,7 @@ var CacheManager = /** @class */ (function () {
                 var accountInfo = accountEntity.getAccountInfo();
                 var idToken = _this.readIdTokenFromCache(_this.clientId, accountInfo);
                 if (idToken && !accountInfo.idTokenClaims) {
+                    accountInfo.idToken = idToken.secret;
                     accountInfo.idTokenClaims = new AuthToken(idToken.secret, _this.cryptoImpl).claims;
                 }
                 return accountInfo;
@@ -3314,7 +3336,7 @@ var ThrottlingUtils = /** @class */ (function () {
     ThrottlingUtils.postProcess = function (cacheManager, thumbprint, response) {
         if (ThrottlingUtils.checkResponseStatus(response) || ThrottlingUtils.checkResponseForRetryAfter(response)) {
             var thumbprintValue = {
-                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
+                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[exports.HeaderNames.RETRY_AFTER])),
                 error: response.body.error,
                 errorCodes: response.body.error_codes,
                 errorMessage: response.body.error_description,
@@ -3336,7 +3358,7 @@ var ThrottlingUtils = /** @class */ (function () {
      */
     ThrottlingUtils.checkResponseForRetryAfter = function (response) {
         if (response.headers) {
-            return response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) && (response.status < 200 || response.status >= 300);
+            return response.headers.hasOwnProperty(exports.HeaderNames.RETRY_AFTER) && (response.status < 200 || response.status >= 300);
         }
         return false;
     };
@@ -3433,7 +3455,7 @@ exports.CcsCredentialType = void 0;
  * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
  */
 var BaseClient = /** @class */ (function () {
-    function BaseClient(configuration) {
+    function BaseClient(configuration, performanceClient) {
         // Set the configuration
         this.config = buildClientConfiguration(configuration);
         // Initialize the logger
@@ -3450,26 +3472,28 @@ var BaseClient = /** @class */ (function () {
         this.serverTelemetryManager = this.config.serverTelemetryManager;
         // set Authority
         this.authority = this.config.authOptions.authority;
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
     }
     /**
      * Creates default headers for requests to token endpoint
      */
     BaseClient.prototype.createTokenRequestHeaders = function (ccsCred) {
         var headers = {};
-        headers[HeaderNames.CONTENT_TYPE] = Constants.URL_FORM_CONTENT_TYPE;
+        headers[exports.HeaderNames.CONTENT_TYPE] = Constants.URL_FORM_CONTENT_TYPE;
         if (!this.config.systemOptions.preventCorsPreflight && ccsCred) {
             switch (ccsCred.type) {
                 case exports.CcsCredentialType.HOME_ACCOUNT_ID:
                     try {
                         var clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
-                        headers[HeaderNames.CCS_HEADER] = "Oid:" + clientInfo.uid + "@" + clientInfo.utid;
+                        headers[exports.HeaderNames.CCS_HEADER] = "Oid:" + clientInfo.uid + "@" + clientInfo.utid;
                     }
                     catch (e) {
                         this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
                     }
                     break;
                 case exports.CcsCredentialType.UPN:
-                    headers[HeaderNames.CCS_HEADER] = "UPN: " + ccsCred.credential;
+                    headers[exports.HeaderNames.CCS_HEADER] = "UPN: " + ccsCred.credential;
                     break;
             }
         }
@@ -3608,26 +3632,26 @@ var RequestParameterBuilder = /** @class */ (function () {
      * add response_type = code
      */
     RequestParameterBuilder.prototype.addResponseTypeCode = function () {
-        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
+        this.parameters.set(exports.AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
     };
     /**
      * add response_type = token id_token
      */
     RequestParameterBuilder.prototype.addResponseTypeForTokenAndIdToken = function () {
-        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.TOKEN_RESPONSE_TYPE + " " + Constants.ID_TOKEN_RESPONSE_TYPE));
+        this.parameters.set(exports.AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.TOKEN_RESPONSE_TYPE + " " + Constants.ID_TOKEN_RESPONSE_TYPE));
     };
     /**
      * add response_mode. defaults to query.
      * @param responseMode
      */
     RequestParameterBuilder.prototype.addResponseMode = function (responseMode) {
-        this.parameters.set(AADServerParamKeys.RESPONSE_MODE, encodeURIComponent((responseMode) ? responseMode : exports.ResponseMode.QUERY));
+        this.parameters.set(exports.AADServerParamKeys.RESPONSE_MODE, encodeURIComponent((responseMode) ? responseMode : exports.ResponseMode.QUERY));
     };
     /**
      * Add flag to indicate STS should attempt to use WAM if available
      */
     RequestParameterBuilder.prototype.addNativeBroker = function () {
-        this.parameters.set(AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
+        this.parameters.set(exports.AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
     };
     /**
      * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
@@ -3638,14 +3662,14 @@ var RequestParameterBuilder = /** @class */ (function () {
         if (addOidcScopes === void 0) { addOidcScopes = true; }
         var requestScopes = addOidcScopes ? __spreadArrays(scopes || [], OIDC_DEFAULT_SCOPES) : scopes || [];
         var scopeSet = new ScopeSet(requestScopes);
-        this.parameters.set(AADServerParamKeys.SCOPE, encodeURIComponent(scopeSet.printScopes()));
+        this.parameters.set(exports.AADServerParamKeys.SCOPE, encodeURIComponent(scopeSet.printScopes()));
     };
     /**
      * add clientId
      * @param clientId
      */
     RequestParameterBuilder.prototype.addClientId = function (clientId) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ID, encodeURIComponent(clientId));
+        this.parameters.set(exports.AADServerParamKeys.CLIENT_ID, encodeURIComponent(clientId));
     };
     /**
      * add redirect_uri
@@ -3653,7 +3677,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addRedirectUri = function (redirectUri) {
         RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(AADServerParamKeys.REDIRECT_URI, encodeURIComponent(redirectUri));
+        this.parameters.set(exports.AADServerParamKeys.REDIRECT_URI, encodeURIComponent(redirectUri));
     };
     /**
      * add post logout redirectUri
@@ -3661,49 +3685,49 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addPostLogoutRedirectUri = function (redirectUri) {
         RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(AADServerParamKeys.POST_LOGOUT_URI, encodeURIComponent(redirectUri));
+        this.parameters.set(exports.AADServerParamKeys.POST_LOGOUT_URI, encodeURIComponent(redirectUri));
     };
     /**
      * add id_token_hint to logout request
      * @param idTokenHint
      */
     RequestParameterBuilder.prototype.addIdTokenHint = function (idTokenHint) {
-        this.parameters.set(AADServerParamKeys.ID_TOKEN_HINT, encodeURIComponent(idTokenHint));
+        this.parameters.set(exports.AADServerParamKeys.ID_TOKEN_HINT, encodeURIComponent(idTokenHint));
     };
     /**
      * add domain_hint
      * @param domainHint
      */
     RequestParameterBuilder.prototype.addDomainHint = function (domainHint) {
-        this.parameters.set(SSOTypes.DOMAIN_HINT, encodeURIComponent(domainHint));
+        this.parameters.set(exports.SSOTypes.DOMAIN_HINT, encodeURIComponent(domainHint));
     };
     /**
      * add login_hint
      * @param loginHint
      */
     RequestParameterBuilder.prototype.addLoginHint = function (loginHint) {
-        this.parameters.set(SSOTypes.LOGIN_HINT, encodeURIComponent(loginHint));
+        this.parameters.set(exports.SSOTypes.LOGIN_HINT, encodeURIComponent(loginHint));
     };
     /**
      * Adds the CCS (Cache Credential Service) query parameter for login_hint
      * @param loginHint
      */
     RequestParameterBuilder.prototype.addCcsUpn = function (loginHint) {
-        this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent("UPN:" + loginHint));
+        this.parameters.set(exports.HeaderNames.CCS_HEADER, encodeURIComponent("UPN:" + loginHint));
     };
     /**
      * Adds the CCS (Cache Credential Service) query parameter for account object
      * @param loginHint
      */
     RequestParameterBuilder.prototype.addCcsOid = function (clientInfo) {
-        this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent("Oid:" + clientInfo.uid + "@" + clientInfo.utid));
+        this.parameters.set(exports.HeaderNames.CCS_HEADER, encodeURIComponent("Oid:" + clientInfo.uid + "@" + clientInfo.utid));
     };
     /**
      * add sid
      * @param sid
      */
     RequestParameterBuilder.prototype.addSid = function (sid) {
-        this.parameters.set(SSOTypes.SID, encodeURIComponent(sid));
+        this.parameters.set(exports.SSOTypes.SID, encodeURIComponent(sid));
     };
     /**
      * add claims
@@ -3712,14 +3736,14 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addClaims = function (claims, clientCapabilities) {
         var mergedClaims = this.addClientCapabilitiesToClaims(claims, clientCapabilities);
         RequestValidator.validateClaims(mergedClaims);
-        this.parameters.set(AADServerParamKeys.CLAIMS, encodeURIComponent(mergedClaims));
+        this.parameters.set(exports.AADServerParamKeys.CLAIMS, encodeURIComponent(mergedClaims));
     };
     /**
      * add correlationId
      * @param correlationId
      */
     RequestParameterBuilder.prototype.addCorrelationId = function (correlationId) {
-        this.parameters.set(AADServerParamKeys.CLIENT_REQUEST_ID, encodeURIComponent(correlationId));
+        this.parameters.set(exports.AADServerParamKeys.CLIENT_REQUEST_ID, encodeURIComponent(correlationId));
     };
     /**
      * add library info query params
@@ -3727,13 +3751,13 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addLibraryInfo = function (libraryInfo) {
         // Telemetry Info
-        this.parameters.set(AADServerParamKeys.X_CLIENT_SKU, libraryInfo.sku);
-        this.parameters.set(AADServerParamKeys.X_CLIENT_VER, libraryInfo.version);
+        this.parameters.set(exports.AADServerParamKeys.X_CLIENT_SKU, libraryInfo.sku);
+        this.parameters.set(exports.AADServerParamKeys.X_CLIENT_VER, libraryInfo.version);
         if (libraryInfo.os) {
-            this.parameters.set(AADServerParamKeys.X_CLIENT_OS, libraryInfo.os);
+            this.parameters.set(exports.AADServerParamKeys.X_CLIENT_OS, libraryInfo.os);
         }
         if (libraryInfo.cpu) {
-            this.parameters.set(AADServerParamKeys.X_CLIENT_CPU, libraryInfo.cpu);
+            this.parameters.set(exports.AADServerParamKeys.X_CLIENT_CPU, libraryInfo.cpu);
         }
     };
     /**
@@ -3742,10 +3766,10 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addApplicationTelemetry = function (appTelemetry) {
         if (appTelemetry === null || appTelemetry === void 0 ? void 0 : appTelemetry.appName) {
-            this.parameters.set(AADServerParamKeys.X_APP_NAME, appTelemetry.appName);
+            this.parameters.set(exports.AADServerParamKeys.X_APP_NAME, appTelemetry.appName);
         }
         if (appTelemetry === null || appTelemetry === void 0 ? void 0 : appTelemetry.appVersion) {
-            this.parameters.set(AADServerParamKeys.X_APP_VER, appTelemetry.appVersion);
+            this.parameters.set(exports.AADServerParamKeys.X_APP_VER, appTelemetry.appVersion);
         }
     };
     /**
@@ -3754,7 +3778,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addPrompt = function (prompt) {
         RequestValidator.validatePrompt(prompt);
-        this.parameters.set("" + AADServerParamKeys.PROMPT, encodeURIComponent(prompt));
+        this.parameters.set("" + exports.AADServerParamKeys.PROMPT, encodeURIComponent(prompt));
     };
     /**
      * add state
@@ -3762,7 +3786,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addState = function (state) {
         if (!StringUtils.isEmpty(state)) {
-            this.parameters.set(AADServerParamKeys.STATE, encodeURIComponent(state));
+            this.parameters.set(exports.AADServerParamKeys.STATE, encodeURIComponent(state));
         }
     };
     /**
@@ -3770,7 +3794,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param nonce
      */
     RequestParameterBuilder.prototype.addNonce = function (nonce) {
-        this.parameters.set(AADServerParamKeys.NONCE, encodeURIComponent(nonce));
+        this.parameters.set(exports.AADServerParamKeys.NONCE, encodeURIComponent(nonce));
     };
     /**
      * add code_challenge and code_challenge_method
@@ -3781,8 +3805,8 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addCodeChallengeParams = function (codeChallenge, codeChallengeMethod) {
         RequestValidator.validateCodeChallengeParams(codeChallenge, codeChallengeMethod);
         if (codeChallenge && codeChallengeMethod) {
-            this.parameters.set(AADServerParamKeys.CODE_CHALLENGE, encodeURIComponent(codeChallenge));
-            this.parameters.set(AADServerParamKeys.CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
+            this.parameters.set(exports.AADServerParamKeys.CODE_CHALLENGE, encodeURIComponent(codeChallenge));
+            this.parameters.set(exports.AADServerParamKeys.CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
         }
         else {
             throw ClientConfigurationError.createInvalidCodeChallengeParamsError();
@@ -3793,35 +3817,35 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param code
      */
     RequestParameterBuilder.prototype.addAuthorizationCode = function (code) {
-        this.parameters.set(AADServerParamKeys.CODE, encodeURIComponent(code));
+        this.parameters.set(exports.AADServerParamKeys.CODE, encodeURIComponent(code));
     };
     /**
      * add the `authorization_code` passed by the user to exchange for a token
      * @param code
      */
     RequestParameterBuilder.prototype.addDeviceCode = function (code) {
-        this.parameters.set(AADServerParamKeys.DEVICE_CODE, encodeURIComponent(code));
+        this.parameters.set(exports.AADServerParamKeys.DEVICE_CODE, encodeURIComponent(code));
     };
     /**
      * add the `refreshToken` passed by the user
      * @param refreshToken
      */
     RequestParameterBuilder.prototype.addRefreshToken = function (refreshToken) {
-        this.parameters.set(AADServerParamKeys.REFRESH_TOKEN, encodeURIComponent(refreshToken));
+        this.parameters.set(exports.AADServerParamKeys.REFRESH_TOKEN, encodeURIComponent(refreshToken));
     };
     /**
      * add the `code_verifier` passed by the user to exchange for a token
      * @param codeVerifier
      */
     RequestParameterBuilder.prototype.addCodeVerifier = function (codeVerifier) {
-        this.parameters.set(AADServerParamKeys.CODE_VERIFIER, encodeURIComponent(codeVerifier));
+        this.parameters.set(exports.AADServerParamKeys.CODE_VERIFIER, encodeURIComponent(codeVerifier));
     };
     /**
      * add client_secret
      * @param clientSecret
      */
     RequestParameterBuilder.prototype.addClientSecret = function (clientSecret) {
-        this.parameters.set(AADServerParamKeys.CLIENT_SECRET, encodeURIComponent(clientSecret));
+        this.parameters.set(exports.AADServerParamKeys.CLIENT_SECRET, encodeURIComponent(clientSecret));
     };
     /**
      * add clientAssertion for confidential client flows
@@ -3829,7 +3853,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addClientAssertion = function (clientAssertion) {
         if (!StringUtils.isEmpty(clientAssertion)) {
-            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+            this.parameters.set(exports.AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
         }
     };
     /**
@@ -3838,7 +3862,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addClientAssertionType = function (clientAssertionType) {
         if (!StringUtils.isEmpty(clientAssertionType)) {
-            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+            this.parameters.set(exports.AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
         }
     };
     /**
@@ -3846,21 +3870,21 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param clientAssertion
      */
     RequestParameterBuilder.prototype.addOboAssertion = function (oboAssertion) {
-        this.parameters.set(AADServerParamKeys.OBO_ASSERTION, encodeURIComponent(oboAssertion));
+        this.parameters.set(exports.AADServerParamKeys.OBO_ASSERTION, encodeURIComponent(oboAssertion));
     };
     /**
      * add grant type
      * @param grantType
      */
     RequestParameterBuilder.prototype.addRequestTokenUse = function (tokenUse) {
-        this.parameters.set(AADServerParamKeys.REQUESTED_TOKEN_USE, encodeURIComponent(tokenUse));
+        this.parameters.set(exports.AADServerParamKeys.REQUESTED_TOKEN_USE, encodeURIComponent(tokenUse));
     };
     /**
      * add grant type
      * @param grantType
      */
     RequestParameterBuilder.prototype.addGrantType = function (grantType) {
-        this.parameters.set(AADServerParamKeys.GRANT_TYPE, encodeURIComponent(grantType));
+        this.parameters.set(exports.AADServerParamKeys.GRANT_TYPE, encodeURIComponent(grantType));
     };
     /**
      * add client info
@@ -3895,12 +3919,12 @@ var RequestParameterBuilder = /** @class */ (function () {
             }
         }
         if (clientCapabilities && clientCapabilities.length > 0) {
-            if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+            if (!mergedClaims.hasOwnProperty(exports.ClaimsRequestKeys.ACCESS_TOKEN)) {
                 // Add access_token key to claims object
-                mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
+                mergedClaims[exports.ClaimsRequestKeys.ACCESS_TOKEN] = {};
             }
             // Add xms_cc claim with provided clientCapabilities to access_token key
-            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] = {
+            mergedClaims[exports.ClaimsRequestKeys.ACCESS_TOKEN][exports.ClaimsRequestKeys.XMS_CC] = {
                 values: clientCapabilities
             };
         }
@@ -3911,14 +3935,14 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param username
      */
     RequestParameterBuilder.prototype.addUsername = function (username) {
-        this.parameters.set(PasswordGrantConstants.username, encodeURIComponent(username));
+        this.parameters.set(exports.PasswordGrantConstants.username, encodeURIComponent(username));
     };
     /**
      * adds `password` for Password Grant flow
      * @param password
      */
     RequestParameterBuilder.prototype.addPassword = function (password) {
-        this.parameters.set(PasswordGrantConstants.password, encodeURIComponent(password));
+        this.parameters.set(exports.PasswordGrantConstants.password, encodeURIComponent(password));
     };
     /**
      * add pop_jwk to query params
@@ -3926,8 +3950,8 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addPopToken = function (cnfString) {
         if (!StringUtils.isEmpty(cnfString)) {
-            this.parameters.set(AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.POP);
-            this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
+            this.parameters.set(exports.AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.POP);
+            this.parameters.set(exports.AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
         }
     };
     /**
@@ -3935,8 +3959,8 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addSshJwk = function (sshJwkString) {
         if (!StringUtils.isEmpty(sshJwkString)) {
-            this.parameters.set(AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.SSH);
-            this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
+            this.parameters.set(exports.AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.SSH);
+            this.parameters.set(exports.AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
         }
     };
     /**
@@ -3944,20 +3968,20 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param serverTelemetryManager
      */
     RequestParameterBuilder.prototype.addServerTelemetry = function (serverTelemetryManager) {
-        this.parameters.set(AADServerParamKeys.X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-        this.parameters.set(AADServerParamKeys.X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+        this.parameters.set(exports.AADServerParamKeys.X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+        this.parameters.set(exports.AADServerParamKeys.X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
     };
     /**
      * Adds parameter that indicates to the server that throttling is supported
      */
     RequestParameterBuilder.prototype.addThrottling = function () {
-        this.parameters.set(AADServerParamKeys.X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+        this.parameters.set(exports.AADServerParamKeys.X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
     };
     /**
      * Adds logout_hint parameter for "silent" logout which prevent server account picker
      */
     RequestParameterBuilder.prototype.addLogoutHint = function (logoutHint) {
-        this.parameters.set(AADServerParamKeys.LOGOUT_HINT, encodeURIComponent(logoutHint));
+        this.parameters.set(exports.AADServerParamKeys.LOGOUT_HINT, encodeURIComponent(logoutHint));
     };
     /**
      * Utility to create a URL from the params map
@@ -4578,6 +4602,21 @@ var UrlString = /** @class */ (function () {
         }
         return Constants.EMPTY_STRING;
     };
+    /**
+     * Parses query string from given string. Returns empty string if no query symbol is found.
+     * @param queryString
+     */
+    UrlString.parseQueryString = function (queryString) {
+        var queryIndex1 = queryString.indexOf("?");
+        var queryIndex2 = queryString.indexOf("/?");
+        if (queryIndex2 > -1) {
+            return queryString.substring(queryIndex2 + 2);
+        }
+        else if (queryIndex1 > -1) {
+            return queryString.substring(queryIndex1 + 1);
+        }
+        return Constants.EMPTY_STRING;
+    };
     UrlString.constructAuthorityUriFromObject = function (urlObject) {
         return new UrlString(urlObject.Protocol + "//" + urlObject.HostNameAndPort + "/" + urlObject.PathSegments.join("/"));
     };
@@ -4599,6 +4638,24 @@ var UrlString = /** @class */ (function () {
         }
         return deserializedHash;
     };
+    /**
+     * Returns URL query string as server auth code response object.
+     */
+    UrlString.getDeserializedQueryString = function (query) {
+        // Check if given query is empty
+        if (StringUtils.isEmpty(query)) {
+            return {};
+        }
+        // Strip the ? symbol if present
+        var parsedQueryString = UrlString.parseQueryString(query);
+        // If ? symbol was not present, above will return empty string, so give original query value
+        var deserializedQueryString = StringUtils.queryStringToObject(StringUtils.isEmpty(parsedQueryString) ? query : parsedQueryString);
+        // Check if deserialization didn't work
+        if (!deserializedQueryString) {
+            throw ClientAuthError.createHashNotDeserializedError(JSON.stringify(deserializedQueryString));
+        }
+        return deserializedQueryString;
+    };
     /**
      * Check if the hash of the URL string contains known properties
      */
@@ -5357,9 +5414,9 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                             parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
                         }
                         // Add hybrid spa parameters if not already provided
-                        if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[AADServerParamKeys.RETURN_SPA_CODE])) {
+                        if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[exports.AADServerParamKeys.RETURN_SPA_CODE])) {
                             parameterBuilder.addExtraQueryParameters((_a = {},
-                                _a[AADServerParamKeys.RETURN_SPA_CODE] = "1",
+                                _a[exports.AADServerParamKeys.RETURN_SPA_CODE] = "1",
                                 _a));
                         }
                         return [2 /*return*/, parameterBuilder.createQueryString()];
@@ -5373,7 +5430,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      */
     AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, reqCnfData;
+            var parameterBuilder, requestScopes, correlationId, accountSid, accountLoginHintClaim, clientInfo, clientInfo, clientInfo, popTokenGenerator, reqCnfData;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -5403,7 +5460,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         if (request.domainHint) {
                             parameterBuilder.addDomainHint(request.domainHint);
                         }
-                        // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
+                        // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
                         if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
                             // AAD will throw if prompt=select_account is passed with an account hint
                             if (request.sid && request.prompt === PromptValue.NONE) {
@@ -5413,9 +5470,24 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                             }
                             else if (request.account) {
                                 accountSid = this.extractAccountSid(request.account);
-                                // If account and loginHint are provided, we will check account first for sid before adding loginHint
-                                if (accountSid && request.prompt === PromptValue.NONE) {
-                                    // SessionId is only used in silent calls
+                                accountLoginHintClaim = this.extractLoginHint(request.account);
+                                // If login_hint claim is present, use it over sid/username
+                                if (accountLoginHintClaim) {
+                                    this.logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
+                                    parameterBuilder.addLoginHint(accountLoginHintClaim);
+                                    try {
+                                        clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                        parameterBuilder.addCcsOid(clientInfo);
+                                    }
+                                    catch (e) {
+                                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
+                                    }
+                                }
+                                else if (accountSid && request.prompt === PromptValue.NONE) {
+                                    /*
+                                     * If account and loginHint are provided, we will check account first for sid before adding loginHint
+                                     * SessionId is only used in silent calls
+                                     */
                                     this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
                                     parameterBuilder.addSid(accountSid);
                                     try {
@@ -5423,7 +5495,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                                         parameterBuilder.addCcsOid(clientInfo);
                                     }
                                     catch (e) {
-                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
                                     }
                                 }
                                 else if (request.loginHint) {
@@ -5440,7 +5512,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                                         parameterBuilder.addCcsOid(clientInfo);
                                     }
                                     catch (e) {
-                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
                                     }
                                 }
                             }
@@ -5511,11 +5583,12 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      * @param account
      */
     AuthorizationCodeClient.prototype.extractAccountSid = function (account) {
-        if (account.idTokenClaims) {
-            var tokenClaims = account.idTokenClaims;
-            return tokenClaims.sid || null;
-        }
-        return null;
+        var _a;
+        return ((_a = account.idTokenClaims) === null || _a === void 0 ? void 0 : _a.sid) || null;
+    };
+    AuthorizationCodeClient.prototype.extractLoginHint = function (account) {
+        var _a;
+        return ((_a = account.idTokenClaims) === null || _a === void 0 ? void 0 : _a.login_hint) || null;
     };
     return AuthorizationCodeClient;
 }(BaseClient));
@@ -5668,7 +5741,7 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                         pollingIntervalMilli = deviceCodeResponse.interval * 1000;
                         _a.label = 1;
                     case 1:
-                        if (!this.continuePolling(deviceCodeExpirationTime, userSpecifiedTimeout, request.cancel)) return [3 /*break*/, 6];
+                        if (!this.continuePolling(deviceCodeExpirationTime, userSpecifiedTimeout, request.cancel)) return [3 /*break*/, 8];
                         thumbprint = {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
@@ -5683,18 +5756,23 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                         return [4 /*yield*/, this.executePostToTokenEndpoint(this.authority.tokenEndpoint, requestBody, headers, thumbprint)];
                     case 2:
                         response = _a.sent();
-                        if (!(response.body && response.body.error === Constants.AUTHORIZATION_PENDING)) return [3 /*break*/, 4];
-                        // user authorization is pending. Sleep for polling interval and try again
-                        this.logger.info(response.body.error_description || "Authorization pending. Continue polling.");
+                        if (!(response.body && response.body.error)) return [3 /*break*/, 6];
+                        if (!(response.body.error === Constants.AUTHORIZATION_PENDING)) return [3 /*break*/, 4];
+                        this.logger.info("Authorization pending. Continue polling.");
                         return [4 /*yield*/, TimeUtils.delay(pollingIntervalMilli)];
                     case 3:
                         _a.sent();
                         return [3 /*break*/, 5];
                     case 4:
+                        // for any other error, throw
+                        this.logger.info("Unexpected error in polling from the server");
+                        throw ServerError.createPostRequestFailed(response.body.error);
+                    case 5: return [3 /*break*/, 7];
+                    case 6:
                         this.logger.verbose("Authorization completed successfully. Polling stopped.");
                         return [2 /*return*/, response.body];
-                    case 5: return [3 /*break*/, 1];
-                    case 6:
+                    case 7: return [3 /*break*/, 1];
+                    case 8:
                         /*
                          * The above code should've thrown by this point, but to satisfy TypeScript,
                          * and in the rare case the conditionals in continuePolling() may not catch everything...
@@ -5733,6 +5811,123 @@ var DeviceCodeClient = /** @class */ (function (_super) {
     return DeviceCodeClient;
 }(BaseClient));
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
+ *
+ * @export
+ * @enum {number}
+ */
+exports.PerformanceEvents = void 0;
+(function (PerformanceEvents) {
+    /**
+     * acquireTokenByCode API (msal-browser and msal-node).
+     * Used to acquire tokens by trading an authorization code against the token endpoint.
+     */
+    PerformanceEvents["AcquireTokenByCode"] = "acquireTokenByCode";
+    /**
+     * acquireTokenByRefreshToken API (msal-browser and msal-node).
+     * Used to renew an access token using a refresh token against the token endpoint.
+     */
+    PerformanceEvents["AcquireTokenByRefreshToken"] = "acquireTokenByRefreshToken";
+    /**
+     * acquireTokenSilent API (msal-browser and msal-node).
+     * Used to silently acquire a new access token (from the cache or the network).
+     */
+    PerformanceEvents["AcquireTokenSilent"] = "acquireTokenSilent";
+    /**
+     * acquireTokenSilentAsync (msal-browser).
+     * Internal API for acquireTokenSilent.
+     */
+    PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
+    /**
+     * acquireTokenPopup (msal-browser).
+     * Used to acquire a new access token interactively through pop ups
+     */
+    PerformanceEvents["AcquireTokenPopup"] = "acquireTokenPopup";
+    /**
+     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
+     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
+     */
+    PerformanceEvents["CryptoOptsGetPublicKeyThumbprint"] = "cryptoOptsGetPublicKeyThumbprint";
+    /**
+     * signJwt API in CryptoOpts class (msal-browser).
+     * Used to signed a pop token.
+     */
+    PerformanceEvents["CryptoOptsSignJwt"] = "cryptoOptsSignJwt";
+    /**
+     * acquireToken API in the SilentCacheClient class (msal-browser).
+     * Used to read access tokens from the cache.
+     */
+    PerformanceEvents["SilentCacheClientAcquireToken"] = "silentCacheClientAcquireToken";
+    /**
+     * acquireToken API in the SilentIframeClient class (msal-browser).
+     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
+     */
+    PerformanceEvents["SilentIframeClientAcquireToken"] = "silentIframeClientAcquireToken";
+    /**
+     * acquireToken API in SilentRereshClient (msal-browser).
+     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
+     */
+    PerformanceEvents["SilentRefreshClientAcquireToken"] = "silentRefreshClientAcquireToken";
+    /**
+     * ssoSilent API (msal-browser).
+     * Used to silently acquire an authorization code and set of tokens using a hidden iframe.
+     */
+    PerformanceEvents["SsoSilent"] = "ssoSilent";
+    /**
+     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
+     * Used to load authority metadata for a request.
+     */
+    PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
+    /**
+     * acquireToken APIs in msal-browser.
+     * Used to make an /authorize endpoint call with native brokering enabled.
+     */
+    PerformanceEvents["FetchAccountIdWithNativeBroker"] = "fetchAccountIdWithNativeBroker";
+    /**
+     * acquireToken API in NativeInteractionClient class (msal-browser).
+     * Used to acquire a token from Native component when native brokering is enabled.
+     */
+    PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
+    /**
+     * Time spent on the network for refresh token acquisition
+     */
+    PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
+    /**
+     * Time spent creating default headers for requests to token endpoint
+     */
+    PerformanceEvents["BaseClientCreateTokenRequestHeaders"] = "baseClientCreateTokenRequestHeaders";
+    /**
+     * Used to measure the time taken for completing embedded-broker handshake (PW-Broker).
+     */
+    PerformanceEvents["BrokerHandhshake"] = "brokerHandshake";
+    /**
+     * acquireTokenByRefreshToken API in BrokerClientApplication (PW-Broker) .
+     */
+    PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
+    /**
+     * acquireToken API in BrokerClientApplication.
+     * Used to acquire a token on behalf of the embedded application (PW-Broker).
+     */
+    PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
+})(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
+/**
+ * State of the performance event.
+ *
+ * @export
+ * @enum {number}
+ */
+exports.PerformanceEventStatus = void 0;
+(function (PerformanceEventStatus) {
+    PerformanceEventStatus[PerformanceEventStatus["NotStarted"] = 0] = "NotStarted";
+    PerformanceEventStatus[PerformanceEventStatus["InProgress"] = 1] = "InProgress";
+    PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
+})(exports.PerformanceEventStatus || (exports.PerformanceEventStatus = {}));
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5742,8 +5937,8 @@ var DeviceCodeClient = /** @class */ (function (_super) {
  */
 var RefreshTokenClient = /** @class */ (function (_super) {
     __extends(RefreshTokenClient, _super);
-    function RefreshTokenClient(configuration) {
-        return _super.call(this, configuration) || this;
+    function RefreshTokenClient(configuration, performanceClient) {
+        return _super.call(this, configuration, performanceClient) || this;
     }
     RefreshTokenClient.prototype.acquireToken = function (request) {
         return __awaiter(this, void 0, void 0, function () {
@@ -5829,13 +6024,16 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      * @param authority
      */
     RefreshTokenClient.prototype.executeTokenRequest = function (request, authority) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var requestBody, queryParameters, headers, thumbprint, endpoint;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, this.createTokenRequestBody(request)];
+            var acquireTokenMeasurement, requestBody, queryParameters, headers, thumbprint, endpoint;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        acquireTokenMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
+                        return [4 /*yield*/, this.createTokenRequestBody(request)];
                     case 1:
-                        requestBody = _a.sent();
+                        requestBody = _b.sent();
                         queryParameters = this.createTokenQueryParameters(request);
                         headers = this.createTokenRequestHeaders(request.ccsCredential);
                         thumbprint = {
@@ -5850,7 +6048,19 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                             sshKid: request.sshKid
                         };
                         endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
-                        return [2 /*return*/, this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)];
+                        return [2 /*return*/, this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)
+                                .then(function (result) {
+                                acquireTokenMeasurement === null || acquireTokenMeasurement === void 0 ? void 0 : acquireTokenMeasurement.endMeasurement({
+                                    success: true
+                                });
+                                return result;
+                            })
+                                .catch(function (error) {
+                                acquireTokenMeasurement === null || acquireTokenMeasurement === void 0 ? void 0 : acquireTokenMeasurement.endMeasurement({
+                                    success: false
+                                });
+                                throw error;
+                            })];
                 }
             });
         });
@@ -5871,11 +6081,14 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      * @param request
      */
     RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, reqCnfData, clientInfo;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var correlationId, acquireTokenMeasurement, parameterBuilder, clientAssertion, popTokenGenerator, reqCnfData, clientInfo;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
+                        correlationId = request.correlationId;
+                        acquireTokenMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.BaseClientCreateTokenRequestHeaders, correlationId);
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
                         parameterBuilder.addScopes(request.scopes);
@@ -5887,7 +6100,6 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         if (this.serverTelemetryManager) {
                             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
                         }
-                        correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
                         parameterBuilder.addCorrelationId(correlationId);
                         parameterBuilder.addRefreshToken(request.refreshToken);
                         if (this.config.clientCredentials.clientSecret) {
@@ -5902,7 +6114,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        reqCnfData = _a.sent();
+                        reqCnfData = _b.sent();
                         // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
                         parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                         return [3 /*break*/, 3];
@@ -5912,10 +6124,13 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                                 parameterBuilder.addSshJwk(request.sshJwk);
                             }
                             else {
+                                acquireTokenMeasurement === null || acquireTokenMeasurement === void 0 ? void 0 : acquireTokenMeasurement.endMeasurement({
+                                    success: false
+                                });
                                 throw ClientConfigurationError.createMissingSshJwkError();
                             }
                         }
-                        _a.label = 3;
+                        _b.label = 3;
                     case 3:
                         if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
                             parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
@@ -5936,6 +6151,9 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                                     break;
                             }
                         }
+                        acquireTokenMeasurement === null || acquireTokenMeasurement === void 0 ? void 0 : acquireTokenMeasurement.endMeasurement({
+                            success: true
+                        });
                         return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
             });
@@ -6347,7 +6565,7 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         }
         var correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
         parameterBuilder.addCorrelationId(correlationId);
-        parameterBuilder.addRequestTokenUse(AADServerParamKeys.ON_BEHALF_OF);
+        parameterBuilder.addRequestTokenUse(exports.AADServerParamKeys.ON_BEHALF_OF);
         parameterBuilder.addOboAssertion(request.oboAssertion);
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
@@ -6368,8 +6586,8 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
  */
 var SilentFlowClient = /** @class */ (function (_super) {
     __extends(SilentFlowClient, _super);
-    function SilentFlowClient(configuration) {
-        return _super.call(this, configuration) || this;
+    function SilentFlowClient(configuration, performanceClient) {
+        return _super.call(this, configuration, performanceClient) || this;
     }
     /**
      * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
@@ -6388,7 +6606,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
                     case 2:
                         e_1 = _a.sent();
                         if (e_1 instanceof ClientAuthError && e_1.errorCode === ClientAuthErrorMessage.tokenRefreshRequired.code) {
-                            refreshTokenClient = new RefreshTokenClient(this.config);
+                            refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
                             return [2 /*return*/, refreshTokenClient.acquireTokenByRefreshToken(request)];
                         }
                         else {
@@ -7707,22 +7925,22 @@ var AuthenticationHeaderParser = /** @class */ (function () {
      */
     AuthenticationHeaderParser.prototype.getShrNonce = function () {
         // Attempt to parse nonce from Authentiacation-Info
-        var authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+        var authenticationInfo = this.headers[exports.HeaderNames.AuthenticationInfo];
         if (authenticationInfo) {
             var authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
             if (authenticationInfoChallenges.nextnonce) {
                 return authenticationInfoChallenges.nextnonce;
             }
-            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.AuthenticationInfo, "nextnonce challenge is missing.");
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(exports.HeaderNames.AuthenticationInfo, "nextnonce challenge is missing.");
         }
         // Attempt to parse nonce from WWW-Authenticate
-        var wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+        var wwwAuthenticate = this.headers[exports.HeaderNames.WWWAuthenticate];
         if (wwwAuthenticate) {
             var wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
             if (wwwAuthenticateChallenges.nonce) {
                 return wwwAuthenticateChallenges.nonce;
             }
-            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.WWWAuthenticate, "nonce challenge is missing.");
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(exports.HeaderNames.WWWAuthenticate, "nonce challenge is missing.");
         }
         // If neither header is present, throw missing headers error
         throw ClientConfigurationError.createMissingNonceAuthenticationHeadersError();
@@ -7906,115 +8124,6 @@ var ServerTelemetryManager = /** @class */ (function () {
     return ServerTelemetryManager;
 }());
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
- *
- * @export
- * @enum {number}
- */
-exports.PerformanceEvents = void 0;
-(function (PerformanceEvents) {
-    /**
-     * acquireTokenByCode API (msal-browser and msal-node).
-     * Used to acquire tokens by trading an authorization code against the token endpoint.
-     */
-    PerformanceEvents["AcquireTokenByCode"] = "acquireTokenByCode";
-    /**
-     * acquireTokenByRefreshToken API (msal-browser and msal-node).
-     * Used to renew an access token using a refresh token against the token endpoint.
-     */
-    PerformanceEvents["AcquireTokenByRefreshToken"] = "acquireTokenByRefreshToken";
-    /**
-     * acquireTokenSilent API (msal-browser and msal-node).
-     * Used to silently acquire a new access token (from the cache or the network).
-     */
-    PerformanceEvents["AcquireTokenSilent"] = "acquireTokenSilent";
-    /**
-     * acquireTokenSilentAsync (msal-browser).
-     * Internal API for acquireTokenSilent.
-     */
-    PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
-    /**
-     * acquireTokenPopup (msal-browser).
-     * Used to acquire a new access token interactively through pop ups
-     */
-    PerformanceEvents["AcquireTokenPopup"] = "acquireTokenPopup";
-    /**
-     * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
-     * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
-     */
-    PerformanceEvents["CryptoOptsGetPublicKeyThumbprint"] = "cryptoOptsGetPublicKeyThumbprint";
-    /**
-     * signJwt API in CryptoOpts class (msal-browser).
-     * Used to signed a pop token.
-     */
-    PerformanceEvents["CryptoOptsSignJwt"] = "cryptoOptsSignJwt";
-    /**
-     * acquireToken API in the SilentCacheClient class (msal-browser).
-     * Used to read access tokens from the cache.
-     */
-    PerformanceEvents["SilentCacheClientAcquireToken"] = "silentCacheClientAcquireToken";
-    /**
-     * acquireToken API in the SilentIframeClient class (msal-browser).
-     * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
-     */
-    PerformanceEvents["SilentIframeClientAcquireToken"] = "silentIframeClientAcquireToken";
-    /**
-     * acquireToken API in SilentRereshClient (msal-browser).
-     * Used to acquire a new set of tokens from the token endpoint using a refresh token.
-     */
-    PerformanceEvents["SilentRefreshClientAcquireToken"] = "silentRefreshClientAcquireToken";
-    /**
-     * ssoSilent API (msal-browser).
-     * Used to silently acquire an authorization code and set of tokens using a hidden iframe.
-     */
-    PerformanceEvents["SsoSilent"] = "ssoSilent";
-    /**
-     * getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
-     * Used to load authority metadata for a request.
-     */
-    PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
-    /**
-     * acquireToken APIs in msal-browser.
-     * Used to make an /authorize endpoint call with native brokering enabled.
-     */
-    PerformanceEvents["FetchAccountIdWithNativeBroker"] = "fetchAccountIdWithNativeBroker";
-    /**
-     * acquireToken API in NativeInteractionClient class (msal-browser).
-     * Used to acquire a token from Native component when native brokering is enabled.
-     */
-    PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
-    /**
-     * Used to measure the time taken for completing embedded-broker handshake (PW-Broker).
-     */
-    PerformanceEvents["BrokerHandhshake"] = "brokerHandshake";
-    /**
-     * acquireTokenByRefreshToken API in BrokerClientApplication (PW-Broker) .
-     */
-    PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
-    /**
-     * acquireToken API in BrokerClientApplication.
-     * Used to acquire a token on behalf of the embedded application (PW-Broker).
-     */
-    PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
-})(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
-/**
- * State of the performance event.
- *
- * @export
- * @enum {number}
- */
-exports.PerformanceEventStatus = void 0;
-(function (PerformanceEventStatus) {
-    PerformanceEventStatus[PerformanceEventStatus["NotStarted"] = 0] = "NotStarted";
-    PerformanceEventStatus[PerformanceEventStatus["InProgress"] = 1] = "InProgress";
-    PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
-})(exports.PerformanceEventStatus || (exports.PerformanceEventStatus = {}));
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8336,12 +8445,14 @@ exports.ClientAuthErrorMessage = ClientAuthErrorMessage;
 exports.ClientConfigurationError = ClientConfigurationError;
 exports.ClientConfigurationErrorMessage = ClientConfigurationErrorMessage;
 exports.ClientCredentialClient = ClientCredentialClient;
+exports.CodeChallengeMethodValues = CodeChallengeMethodValues;
 exports.Constants = Constants;
 exports.CredentialEntity = CredentialEntity;
 exports.DEFAULT_CRYPTO_IMPLEMENTATION = DEFAULT_CRYPTO_IMPLEMENTATION;
 exports.DEFAULT_SYSTEM_OPTIONS = DEFAULT_SYSTEM_OPTIONS;
 exports.DefaultStorageClass = DefaultStorageClass;
 exports.DeviceCodeClient = DeviceCodeClient;
+exports.Errors = Errors;
 exports.IdToken = AuthToken;
 exports.IdTokenEntity = IdTokenEntity;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
@@ -8365,11 +8476,15 @@ exports.SilentFlowClient = SilentFlowClient;
 exports.StringUtils = StringUtils;
 exports.StubPerformanceClient = StubPerformanceClient;
 exports.StubbedNetworkModule = StubbedNetworkModule;
+exports.THE_FAMILY_ID = THE_FAMILY_ID;
+exports.ThrottlingConstants = ThrottlingConstants;
 exports.ThrottlingEntity = ThrottlingEntity;
 exports.ThrottlingUtils = ThrottlingUtils;
 exports.TimeUtils = TimeUtils;
 exports.TokenCacheContext = TokenCacheContext;
 exports.UrlString = UrlString;
 exports.UsernamePasswordClient = UsernamePasswordClient;
+exports.buildClientInfo = buildClientInfo;
+exports.buildClientInfoFromHomeAccountId = buildClientInfoFromHomeAccountId;
 exports.version = version;
 //# sourceMappingURL=index.cjs.js.map