@azure/msal-common 7.4.0 → 7.5.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v7.4.0 2022-09-06 */
+/*! @azure/msal-common v7.5.0 2022-10-03 */
 'use strict';
 'use strict';
 
@@ -105,6 +105,7 @@ var Constants = {
     DEFAULT_COMMON_TENANT: "common",
     // ADFS String
     ADFS: "adfs",
+    DSTS: "dstsv2",
     // Default AAD Instance Discovery Endpoint
     AAD_INSTANCE_DISCOVERY_ENDPT: "https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",
     // Resource delimiter - used for certain cache entries
@@ -136,6 +137,7 @@ var Constants = {
     IMDS_TIMEOUT: 2000,
     AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
+    REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
     KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
     TOKEN_RESPONSE_TYPE: "token",
     ID_TOKEN_RESPONSE_TYPE: "id_token",
@@ -152,14 +154,15 @@ var OIDC_SCOPES = __spreadArrays(OIDC_DEFAULT_SCOPES, [
 /**
  * Request header names
  */
-var HeaderNames;
+exports.HeaderNames = void 0;
 (function (HeaderNames) {
     HeaderNames["CONTENT_TYPE"] = "Content-Type";
     HeaderNames["RETRY_AFTER"] = "Retry-After";
     HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
     HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
     HeaderNames["AuthenticationInfo"] = "Authentication-Info";
-})(HeaderNames || (HeaderNames = {}));
+    HeaderNames["X_MS_REQUEST_ID"] = "x-ms-request-id";
+})(exports.HeaderNames || (exports.HeaderNames = {}));
 /**
  * Persistent cache keys MSAL which stay while user is logged in.
  */
@@ -185,7 +188,7 @@ var AADAuthorityConstants;
 /**
  * Keys in the hashParams sent by AAD Server
  */
-var AADServerParamKeys;
+exports.AADServerParamKeys = void 0;
 (function (AADServerParamKeys) {
     AADServerParamKeys["CLIENT_ID"] = "client_id";
     AADServerParamKeys["REDIRECT_URI"] = "redirect_uri";
@@ -235,15 +238,15 @@ var AADServerParamKeys;
     AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
     AADServerParamKeys["NATIVE_BROKER"] = "nativebroker";
     AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
-})(AADServerParamKeys || (AADServerParamKeys = {}));
+})(exports.AADServerParamKeys || (exports.AADServerParamKeys = {}));
 /**
  * Claims request keys
  */
-var ClaimsRequestKeys;
+exports.ClaimsRequestKeys = void 0;
 (function (ClaimsRequestKeys) {
     ClaimsRequestKeys["ACCESS_TOKEN"] = "access_token";
     ClaimsRequestKeys["XMS_CC"] = "xms_cc";
-})(ClaimsRequestKeys || (ClaimsRequestKeys = {}));
+})(exports.ClaimsRequestKeys || (exports.ClaimsRequestKeys = {}));
 /**
  * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
  * prompt values kept changing over past couple of years. There are some undocumented prompt values for some
@@ -254,12 +257,13 @@ var PromptValue = {
     SELECT_ACCOUNT: "select_account",
     CONSENT: "consent",
     NONE: "none",
-    CREATE: "create"
+    CREATE: "create",
+    NO_SESSION: "no_session"
 };
 /**
  * SSO Types - generated to populate hints
  */
-var SSOTypes;
+exports.SSOTypes = void 0;
 (function (SSOTypes) {
     SSOTypes["ACCOUNT"] = "account";
     SSOTypes["SID"] = "sid";
@@ -270,13 +274,13 @@ var SSOTypes;
     SSOTypes["CONSUMERS"] = "consumers";
     SSOTypes["ACCOUNT_ID"] = "accountIdentifier";
     SSOTypes["HOMEACCOUNT_ID"] = "homeAccountIdentifier";
-})(SSOTypes || (SSOTypes = {}));
+})(exports.SSOTypes || (exports.SSOTypes = {}));
 /**
  * Disallowed extra query parameters.
  */
 [
-    SSOTypes.SID,
-    SSOTypes.LOGIN_HINT
+    exports.SSOTypes.SID,
+    exports.SSOTypes.LOGIN_HINT
 ];
 /**
  * allowed values for codeVerifier
@@ -433,11 +437,11 @@ var Errors = {
 /**
  * Password grant parameters
  */
-var PasswordGrantConstants;
+exports.PasswordGrantConstants = void 0;
 (function (PasswordGrantConstants) {
     PasswordGrantConstants["username"] = "username";
     PasswordGrantConstants["password"] = "password";
-})(PasswordGrantConstants || (PasswordGrantConstants = {}));
+})(exports.PasswordGrantConstants || (exports.PasswordGrantConstants = {}));
 /**
  * Response codes
  */
@@ -479,7 +483,8 @@ var JsonTypes;
 (function (JsonTypes) {
     JsonTypes["Jwt"] = "JWT";
     JsonTypes["Jwk"] = "JWK";
-})(JsonTypes || (JsonTypes = {}));
+})(JsonTypes || (JsonTypes = {}));
+var ONE_DAY_IN_MS = 86400000;
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -672,6 +677,16 @@ var ClientAuthErrorMessage = {
         code: "nonce_not_found",
         desc: "nonce not found"
     },
+    authTimeNotFoundError: {
+        code: "auth_time_not_found",
+        desc: "Max Age was requested and the ID token is missing the auth_time variable." +
+            " auth_time is an optional claim and is not enabled by default - it must be enabled." +
+            " See https://aka.ms/msaljs/optional-claims for more information."
+    },
+    maxAgeTranspiredError: {
+        code: "max_age_transpired",
+        desc: "Max Age is set to 0, or too much time has elapsed since the last end-user authentication."
+    },
     noTokensFoundError: {
         code: "no_tokens_found",
         desc: "No tokens were found for the given scopes, and no authorization code was passed to acquireToken. You must retrieve an authorization code before making a call to acquireToken()."
@@ -892,6 +907,19 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createNonceMismatchError = function () {
         return new ClientAuthError(ClientAuthErrorMessage.nonceMismatchError.code, ClientAuthErrorMessage.nonceMismatchError.desc);
     };
+    /**
+     * Creates an error thrown when max_age was provided in the request, but auth_time is not in the token claims
+     * @param missingNonce
+     */
+    ClientAuthError.createAuthTimeNotFoundError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.authTimeNotFoundError.code, ClientAuthErrorMessage.authTimeNotFoundError.desc);
+    };
+    /**
+     * Creates an error thrown when too much time has elapsed since the last end-user authentication
+     */
+    ClientAuthError.createMaxAgeTranspiredError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.maxAgeTranspiredError.code, ClientAuthErrorMessage.maxAgeTranspiredError.desc);
+    };
     /**
      * Creates an error thrown when the mnonce is not present
      * @param missingNonce
@@ -1381,7 +1409,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "7.4.0";
+var version = "7.5.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1606,7 +1634,7 @@ var ClientConfigurationErrorMessage = {
     },
     invalidPrompt: {
         code: "invalid_prompt_value",
-        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create' and 'none'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
+        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create', 'none' and 'no_session'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
     },
     invalidClaimsRequest: {
         code: "invalid_claims",
@@ -2042,6 +2070,7 @@ exports.AuthorityType = void 0;
 (function (AuthorityType) {
     AuthorityType[AuthorityType["Default"] = 0] = "Default";
     AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
+    AuthorityType[AuthorityType["Dsts"] = 2] = "Dsts";
 })(exports.AuthorityType || (exports.AuthorityType = {}));
 
 /*
@@ -2164,10 +2193,13 @@ var AccountEntity = /** @class */ (function () {
             // How do you account for MSA CID here?
             account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || Constants.EMPTY_STRING;
             /*
-             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array. In most cases it will contain a single email.
-             * This field should not be relied upon if a custom policy is configured to return more than 1 email.
+             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+             * In most cases it will contain a single email. This field should not be relied upon if a custom
+             * policy is configured to return more than 1 email.
              */
-            account.username = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username) || (((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : Constants.EMPTY_STRING);
+            var preferredUsername = (_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username;
+            var email = ((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : null;
+            account.username = preferredUsername || email || Constants.EMPTY_STRING;
             account.name = (_f = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _f === void 0 ? void 0 : _f.name;
         }
         account.cloudGraphHostName = cloudGraphHostName;
@@ -2182,7 +2214,8 @@ var AccountEntity = /** @class */ (function () {
     AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
         var _a, _b, _c, _d;
         var account = new AccountEntity();
-        account.authorityType = (authority && authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.authorityType = (authority &&
+            authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
         account.realm = Constants.EMPTY_STRING;
@@ -2216,7 +2249,7 @@ var AccountEntity = /** @class */ (function () {
         var _a;
         var accountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.sub) ? idToken.claims.sub : Constants.EMPTY_STRING;
         // since ADFS does not have tid and does not set client_info
-        if (authType === exports.AuthorityType.Adfs) {
+        if (authType === exports.AuthorityType.Adfs || authType === exports.AuthorityType.Dsts) {
             return accountId;
         }
         // for cases where there is clientInfo
@@ -2310,6 +2343,20 @@ var AuthToken = /** @class */ (function () {
             throw ClientAuthError.createTokenParsingError(err);
         }
     };
+    /**
+     * Determine if the token's max_age has transpired
+     */
+    AuthToken.checkMaxAge = function (authTime, maxAge) {
+        /*
+         * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+         * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
+         * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
+         */
+        var fiveMinuteSkew = 300000; // five minutes in milliseconds
+        if ((maxAge === 0) || ((Date.now() - fiveMinuteSkew) > (authTime + maxAge))) {
+            throw ClientAuthError.createMaxAgeTranspiredError();
+        }
+    };
     return AuthToken;
 }());
 
@@ -3336,7 +3383,7 @@ var ThrottlingUtils = /** @class */ (function () {
     ThrottlingUtils.postProcess = function (cacheManager, thumbprint, response) {
         if (ThrottlingUtils.checkResponseStatus(response) || ThrottlingUtils.checkResponseForRetryAfter(response)) {
             var thumbprintValue = {
-                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
+                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[exports.HeaderNames.RETRY_AFTER])),
                 error: response.body.error,
                 errorCodes: response.body.error_codes,
                 errorMessage: response.body.error_description,
@@ -3358,7 +3405,7 @@ var ThrottlingUtils = /** @class */ (function () {
      */
     ThrottlingUtils.checkResponseForRetryAfter = function (response) {
         if (response.headers) {
-            return response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) && (response.status < 200 || response.status >= 300);
+            return response.headers.hasOwnProperty(exports.HeaderNames.RETRY_AFTER) && (response.status < 200 || response.status >= 300);
         }
         return false;
     };
@@ -3480,20 +3527,20 @@ var BaseClient = /** @class */ (function () {
      */
     BaseClient.prototype.createTokenRequestHeaders = function (ccsCred) {
         var headers = {};
-        headers[HeaderNames.CONTENT_TYPE] = Constants.URL_FORM_CONTENT_TYPE;
+        headers[exports.HeaderNames.CONTENT_TYPE] = Constants.URL_FORM_CONTENT_TYPE;
         if (!this.config.systemOptions.preventCorsPreflight && ccsCred) {
             switch (ccsCred.type) {
                 case exports.CcsCredentialType.HOME_ACCOUNT_ID:
                     try {
                         var clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
-                        headers[HeaderNames.CCS_HEADER] = "Oid:" + clientInfo.uid + "@" + clientInfo.utid;
+                        headers[exports.HeaderNames.CCS_HEADER] = "Oid:" + clientInfo.uid + "@" + clientInfo.utid;
                     }
                     catch (e) {
                         this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
                     }
                     break;
                 case exports.CcsCredentialType.UPN:
-                    headers[HeaderNames.CCS_HEADER] = "UPN: " + ccsCred.credential;
+                    headers[exports.HeaderNames.CCS_HEADER] = "UPN: " + ccsCred.credential;
                     break;
             }
         }
@@ -3632,26 +3679,26 @@ var RequestParameterBuilder = /** @class */ (function () {
      * add response_type = code
      */
     RequestParameterBuilder.prototype.addResponseTypeCode = function () {
-        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
+        this.parameters.set(exports.AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
     };
     /**
      * add response_type = token id_token
      */
     RequestParameterBuilder.prototype.addResponseTypeForTokenAndIdToken = function () {
-        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.TOKEN_RESPONSE_TYPE + " " + Constants.ID_TOKEN_RESPONSE_TYPE));
+        this.parameters.set(exports.AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.TOKEN_RESPONSE_TYPE + " " + Constants.ID_TOKEN_RESPONSE_TYPE));
     };
     /**
      * add response_mode. defaults to query.
      * @param responseMode
      */
     RequestParameterBuilder.prototype.addResponseMode = function (responseMode) {
-        this.parameters.set(AADServerParamKeys.RESPONSE_MODE, encodeURIComponent((responseMode) ? responseMode : exports.ResponseMode.QUERY));
+        this.parameters.set(exports.AADServerParamKeys.RESPONSE_MODE, encodeURIComponent((responseMode) ? responseMode : exports.ResponseMode.QUERY));
     };
     /**
      * Add flag to indicate STS should attempt to use WAM if available
      */
     RequestParameterBuilder.prototype.addNativeBroker = function () {
-        this.parameters.set(AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
+        this.parameters.set(exports.AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
     };
     /**
      * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
@@ -3662,14 +3709,14 @@ var RequestParameterBuilder = /** @class */ (function () {
         if (addOidcScopes === void 0) { addOidcScopes = true; }
         var requestScopes = addOidcScopes ? __spreadArrays(scopes || [], OIDC_DEFAULT_SCOPES) : scopes || [];
         var scopeSet = new ScopeSet(requestScopes);
-        this.parameters.set(AADServerParamKeys.SCOPE, encodeURIComponent(scopeSet.printScopes()));
+        this.parameters.set(exports.AADServerParamKeys.SCOPE, encodeURIComponent(scopeSet.printScopes()));
     };
     /**
      * add clientId
      * @param clientId
      */
     RequestParameterBuilder.prototype.addClientId = function (clientId) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ID, encodeURIComponent(clientId));
+        this.parameters.set(exports.AADServerParamKeys.CLIENT_ID, encodeURIComponent(clientId));
     };
     /**
      * add redirect_uri
@@ -3677,7 +3724,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addRedirectUri = function (redirectUri) {
         RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(AADServerParamKeys.REDIRECT_URI, encodeURIComponent(redirectUri));
+        this.parameters.set(exports.AADServerParamKeys.REDIRECT_URI, encodeURIComponent(redirectUri));
     };
     /**
      * add post logout redirectUri
@@ -3685,49 +3732,49 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addPostLogoutRedirectUri = function (redirectUri) {
         RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(AADServerParamKeys.POST_LOGOUT_URI, encodeURIComponent(redirectUri));
+        this.parameters.set(exports.AADServerParamKeys.POST_LOGOUT_URI, encodeURIComponent(redirectUri));
     };
     /**
      * add id_token_hint to logout request
      * @param idTokenHint
      */
     RequestParameterBuilder.prototype.addIdTokenHint = function (idTokenHint) {
-        this.parameters.set(AADServerParamKeys.ID_TOKEN_HINT, encodeURIComponent(idTokenHint));
+        this.parameters.set(exports.AADServerParamKeys.ID_TOKEN_HINT, encodeURIComponent(idTokenHint));
     };
     /**
      * add domain_hint
      * @param domainHint
      */
     RequestParameterBuilder.prototype.addDomainHint = function (domainHint) {
-        this.parameters.set(SSOTypes.DOMAIN_HINT, encodeURIComponent(domainHint));
+        this.parameters.set(exports.SSOTypes.DOMAIN_HINT, encodeURIComponent(domainHint));
     };
     /**
      * add login_hint
      * @param loginHint
      */
     RequestParameterBuilder.prototype.addLoginHint = function (loginHint) {
-        this.parameters.set(SSOTypes.LOGIN_HINT, encodeURIComponent(loginHint));
+        this.parameters.set(exports.SSOTypes.LOGIN_HINT, encodeURIComponent(loginHint));
     };
     /**
      * Adds the CCS (Cache Credential Service) query parameter for login_hint
      * @param loginHint
      */
     RequestParameterBuilder.prototype.addCcsUpn = function (loginHint) {
-        this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent("UPN:" + loginHint));
+        this.parameters.set(exports.HeaderNames.CCS_HEADER, encodeURIComponent("UPN:" + loginHint));
     };
     /**
      * Adds the CCS (Cache Credential Service) query parameter for account object
      * @param loginHint
      */
     RequestParameterBuilder.prototype.addCcsOid = function (clientInfo) {
-        this.parameters.set(HeaderNames.CCS_HEADER, encodeURIComponent("Oid:" + clientInfo.uid + "@" + clientInfo.utid));
+        this.parameters.set(exports.HeaderNames.CCS_HEADER, encodeURIComponent("Oid:" + clientInfo.uid + "@" + clientInfo.utid));
     };
     /**
      * add sid
      * @param sid
      */
     RequestParameterBuilder.prototype.addSid = function (sid) {
-        this.parameters.set(SSOTypes.SID, encodeURIComponent(sid));
+        this.parameters.set(exports.SSOTypes.SID, encodeURIComponent(sid));
     };
     /**
      * add claims
@@ -3736,14 +3783,14 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addClaims = function (claims, clientCapabilities) {
         var mergedClaims = this.addClientCapabilitiesToClaims(claims, clientCapabilities);
         RequestValidator.validateClaims(mergedClaims);
-        this.parameters.set(AADServerParamKeys.CLAIMS, encodeURIComponent(mergedClaims));
+        this.parameters.set(exports.AADServerParamKeys.CLAIMS, encodeURIComponent(mergedClaims));
     };
     /**
      * add correlationId
      * @param correlationId
      */
     RequestParameterBuilder.prototype.addCorrelationId = function (correlationId) {
-        this.parameters.set(AADServerParamKeys.CLIENT_REQUEST_ID, encodeURIComponent(correlationId));
+        this.parameters.set(exports.AADServerParamKeys.CLIENT_REQUEST_ID, encodeURIComponent(correlationId));
     };
     /**
      * add library info query params
@@ -3751,13 +3798,13 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addLibraryInfo = function (libraryInfo) {
         // Telemetry Info
-        this.parameters.set(AADServerParamKeys.X_CLIENT_SKU, libraryInfo.sku);
-        this.parameters.set(AADServerParamKeys.X_CLIENT_VER, libraryInfo.version);
+        this.parameters.set(exports.AADServerParamKeys.X_CLIENT_SKU, libraryInfo.sku);
+        this.parameters.set(exports.AADServerParamKeys.X_CLIENT_VER, libraryInfo.version);
         if (libraryInfo.os) {
-            this.parameters.set(AADServerParamKeys.X_CLIENT_OS, libraryInfo.os);
+            this.parameters.set(exports.AADServerParamKeys.X_CLIENT_OS, libraryInfo.os);
         }
         if (libraryInfo.cpu) {
-            this.parameters.set(AADServerParamKeys.X_CLIENT_CPU, libraryInfo.cpu);
+            this.parameters.set(exports.AADServerParamKeys.X_CLIENT_CPU, libraryInfo.cpu);
         }
     };
     /**
@@ -3766,10 +3813,10 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addApplicationTelemetry = function (appTelemetry) {
         if (appTelemetry === null || appTelemetry === void 0 ? void 0 : appTelemetry.appName) {
-            this.parameters.set(AADServerParamKeys.X_APP_NAME, appTelemetry.appName);
+            this.parameters.set(exports.AADServerParamKeys.X_APP_NAME, appTelemetry.appName);
         }
         if (appTelemetry === null || appTelemetry === void 0 ? void 0 : appTelemetry.appVersion) {
-            this.parameters.set(AADServerParamKeys.X_APP_VER, appTelemetry.appVersion);
+            this.parameters.set(exports.AADServerParamKeys.X_APP_VER, appTelemetry.appVersion);
         }
     };
     /**
@@ -3778,7 +3825,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addPrompt = function (prompt) {
         RequestValidator.validatePrompt(prompt);
-        this.parameters.set("" + AADServerParamKeys.PROMPT, encodeURIComponent(prompt));
+        this.parameters.set("" + exports.AADServerParamKeys.PROMPT, encodeURIComponent(prompt));
     };
     /**
      * add state
@@ -3786,7 +3833,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addState = function (state) {
         if (!StringUtils.isEmpty(state)) {
-            this.parameters.set(AADServerParamKeys.STATE, encodeURIComponent(state));
+            this.parameters.set(exports.AADServerParamKeys.STATE, encodeURIComponent(state));
         }
     };
     /**
@@ -3794,7 +3841,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param nonce
      */
     RequestParameterBuilder.prototype.addNonce = function (nonce) {
-        this.parameters.set(AADServerParamKeys.NONCE, encodeURIComponent(nonce));
+        this.parameters.set(exports.AADServerParamKeys.NONCE, encodeURIComponent(nonce));
     };
     /**
      * add code_challenge and code_challenge_method
@@ -3805,8 +3852,8 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addCodeChallengeParams = function (codeChallenge, codeChallengeMethod) {
         RequestValidator.validateCodeChallengeParams(codeChallenge, codeChallengeMethod);
         if (codeChallenge && codeChallengeMethod) {
-            this.parameters.set(AADServerParamKeys.CODE_CHALLENGE, encodeURIComponent(codeChallenge));
-            this.parameters.set(AADServerParamKeys.CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
+            this.parameters.set(exports.AADServerParamKeys.CODE_CHALLENGE, encodeURIComponent(codeChallenge));
+            this.parameters.set(exports.AADServerParamKeys.CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
         }
         else {
             throw ClientConfigurationError.createInvalidCodeChallengeParamsError();
@@ -3817,35 +3864,35 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param code
      */
     RequestParameterBuilder.prototype.addAuthorizationCode = function (code) {
-        this.parameters.set(AADServerParamKeys.CODE, encodeURIComponent(code));
+        this.parameters.set(exports.AADServerParamKeys.CODE, encodeURIComponent(code));
     };
     /**
      * add the `authorization_code` passed by the user to exchange for a token
      * @param code
      */
     RequestParameterBuilder.prototype.addDeviceCode = function (code) {
-        this.parameters.set(AADServerParamKeys.DEVICE_CODE, encodeURIComponent(code));
+        this.parameters.set(exports.AADServerParamKeys.DEVICE_CODE, encodeURIComponent(code));
     };
     /**
      * add the `refreshToken` passed by the user
      * @param refreshToken
      */
     RequestParameterBuilder.prototype.addRefreshToken = function (refreshToken) {
-        this.parameters.set(AADServerParamKeys.REFRESH_TOKEN, encodeURIComponent(refreshToken));
+        this.parameters.set(exports.AADServerParamKeys.REFRESH_TOKEN, encodeURIComponent(refreshToken));
     };
     /**
      * add the `code_verifier` passed by the user to exchange for a token
      * @param codeVerifier
      */
     RequestParameterBuilder.prototype.addCodeVerifier = function (codeVerifier) {
-        this.parameters.set(AADServerParamKeys.CODE_VERIFIER, encodeURIComponent(codeVerifier));
+        this.parameters.set(exports.AADServerParamKeys.CODE_VERIFIER, encodeURIComponent(codeVerifier));
     };
     /**
      * add client_secret
      * @param clientSecret
      */
     RequestParameterBuilder.prototype.addClientSecret = function (clientSecret) {
-        this.parameters.set(AADServerParamKeys.CLIENT_SECRET, encodeURIComponent(clientSecret));
+        this.parameters.set(exports.AADServerParamKeys.CLIENT_SECRET, encodeURIComponent(clientSecret));
     };
     /**
      * add clientAssertion for confidential client flows
@@ -3853,7 +3900,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addClientAssertion = function (clientAssertion) {
         if (!StringUtils.isEmpty(clientAssertion)) {
-            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+            this.parameters.set(exports.AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
         }
     };
     /**
@@ -3862,7 +3909,7 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addClientAssertionType = function (clientAssertionType) {
         if (!StringUtils.isEmpty(clientAssertionType)) {
-            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+            this.parameters.set(exports.AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
         }
     };
     /**
@@ -3870,21 +3917,21 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param clientAssertion
      */
     RequestParameterBuilder.prototype.addOboAssertion = function (oboAssertion) {
-        this.parameters.set(AADServerParamKeys.OBO_ASSERTION, encodeURIComponent(oboAssertion));
+        this.parameters.set(exports.AADServerParamKeys.OBO_ASSERTION, encodeURIComponent(oboAssertion));
     };
     /**
      * add grant type
      * @param grantType
      */
     RequestParameterBuilder.prototype.addRequestTokenUse = function (tokenUse) {
-        this.parameters.set(AADServerParamKeys.REQUESTED_TOKEN_USE, encodeURIComponent(tokenUse));
+        this.parameters.set(exports.AADServerParamKeys.REQUESTED_TOKEN_USE, encodeURIComponent(tokenUse));
     };
     /**
      * add grant type
      * @param grantType
      */
     RequestParameterBuilder.prototype.addGrantType = function (grantType) {
-        this.parameters.set(AADServerParamKeys.GRANT_TYPE, encodeURIComponent(grantType));
+        this.parameters.set(exports.AADServerParamKeys.GRANT_TYPE, encodeURIComponent(grantType));
     };
     /**
      * add client info
@@ -3919,12 +3966,12 @@ var RequestParameterBuilder = /** @class */ (function () {
             }
         }
         if (clientCapabilities && clientCapabilities.length > 0) {
-            if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+            if (!mergedClaims.hasOwnProperty(exports.ClaimsRequestKeys.ACCESS_TOKEN)) {
                 // Add access_token key to claims object
-                mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
+                mergedClaims[exports.ClaimsRequestKeys.ACCESS_TOKEN] = {};
             }
             // Add xms_cc claim with provided clientCapabilities to access_token key
-            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] = {
+            mergedClaims[exports.ClaimsRequestKeys.ACCESS_TOKEN][exports.ClaimsRequestKeys.XMS_CC] = {
                 values: clientCapabilities
             };
         }
@@ -3935,14 +3982,14 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param username
      */
     RequestParameterBuilder.prototype.addUsername = function (username) {
-        this.parameters.set(PasswordGrantConstants.username, encodeURIComponent(username));
+        this.parameters.set(exports.PasswordGrantConstants.username, encodeURIComponent(username));
     };
     /**
      * adds `password` for Password Grant flow
      * @param password
      */
     RequestParameterBuilder.prototype.addPassword = function (password) {
-        this.parameters.set(PasswordGrantConstants.password, encodeURIComponent(password));
+        this.parameters.set(exports.PasswordGrantConstants.password, encodeURIComponent(password));
     };
     /**
      * add pop_jwk to query params
@@ -3950,8 +3997,8 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addPopToken = function (cnfString) {
         if (!StringUtils.isEmpty(cnfString)) {
-            this.parameters.set(AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.POP);
-            this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
+            this.parameters.set(exports.AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.POP);
+            this.parameters.set(exports.AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
         }
     };
     /**
@@ -3959,8 +4006,8 @@ var RequestParameterBuilder = /** @class */ (function () {
      */
     RequestParameterBuilder.prototype.addSshJwk = function (sshJwkString) {
         if (!StringUtils.isEmpty(sshJwkString)) {
-            this.parameters.set(AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.SSH);
-            this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
+            this.parameters.set(exports.AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.SSH);
+            this.parameters.set(exports.AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
         }
     };
     /**
@@ -3968,20 +4015,20 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param serverTelemetryManager
      */
     RequestParameterBuilder.prototype.addServerTelemetry = function (serverTelemetryManager) {
-        this.parameters.set(AADServerParamKeys.X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-        this.parameters.set(AADServerParamKeys.X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+        this.parameters.set(exports.AADServerParamKeys.X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+        this.parameters.set(exports.AADServerParamKeys.X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
     };
     /**
      * Adds parameter that indicates to the server that throttling is supported
      */
     RequestParameterBuilder.prototype.addThrottling = function () {
-        this.parameters.set(AADServerParamKeys.X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+        this.parameters.set(exports.AADServerParamKeys.X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
     };
     /**
      * Adds logout_hint parameter for "silent" logout which prevent server account picker
      */
     RequestParameterBuilder.prototype.addLogoutHint = function (logoutHint) {
-        this.parameters.set(AADServerParamKeys.LOGOUT_HINT, encodeURIComponent(logoutHint));
+        this.parameters.set(exports.AADServerParamKeys.LOGOUT_HINT, encodeURIComponent(logoutHint));
     };
     /**
      * Utility to create a URL from the params map
@@ -4934,9 +4981,9 @@ var ResponseHandler = /** @class */ (function () {
      * @param serverTokenResponse
      * @param authority
      */
-    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse) {
+    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
         return __awaiter(this, void 0, void 0, function () {
-            var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
+            var idTokenObj, authTime, requestStateObj, cacheRecord, cacheContext, key, account;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -4948,6 +4995,14 @@ var ResponseHandler = /** @class */ (function () {
                                     throw ClientAuthError.createNonceMismatchError();
                                 }
                             }
+                            // token max_age check
+                            if (request.maxAge || (request.maxAge === 0)) {
+                                authTime = idTokenObj.claims.auth_time;
+                                if (!authTime) {
+                                    throw ClientAuthError.createAuthTimeNotFoundError();
+                                }
+                                AuthToken.checkMaxAge(authTime, request.maxAge);
+                            }
                         }
                         // generate homeAccountId
                         this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
@@ -4979,7 +5034,7 @@ var ResponseHandler = /** @class */ (function () {
                             account = this.cacheStorage.getAccount(key);
                             if (!account) {
                                 this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined)];
+                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId)];
                             }
                         }
                         return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
@@ -4994,7 +5049,7 @@ var ResponseHandler = /** @class */ (function () {
                         _a.sent();
                         _a.label = 7;
                     case 7: return [7 /*endfinally*/];
-                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
+                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code, serverRequestId)];
                 }
             });
         });
@@ -5080,7 +5135,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param fromTokenCache
      * @param stateString
      */
-    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
+    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code, requestId) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
             var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
@@ -5128,6 +5183,7 @@ var ResponseHandler = /** @class */ (function () {
                                 fromCache: fromTokenCache,
                                 expiresOn: expiresOn,
                                 correlationId: request.correlationId,
+                                requestId: requestId || Constants.EMPTY_STRING,
                                 extExpiresOn: extExpiresOn,
                                 familyId: familyId,
                                 tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
@@ -5188,10 +5244,11 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      * @param request
      */
     AuthorizationCodeClient.prototype.acquireToken = function (request, authCodePayload) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var reqTimestamp, response, responseHandler;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var reqTimestamp, response, requestId, responseHandler;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         this.logger.info("in acquireToken call");
                         if (!request || StringUtils.isEmpty(request.code)) {
@@ -5200,12 +5257,13 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executeTokenRequest(this.authority, request)];
                     case 1:
-                        response = _a.sent();
+                        response = _b.sent();
+                        requestId = (_a = response.headers) === null || _a === void 0 ? void 0 : _a[exports.HeaderNames.X_MS_REQUEST_ID];
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         // Validate response. This function throws a server error if an error is returned by the server.
                         responseHandler.validateTokenResponse(response.body);
-                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload)];
-                    case 2: return [2 /*return*/, _a.sent()];
+                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)];
+                    case 2: return [2 /*return*/, _b.sent()];
                 }
             });
         });
@@ -5414,9 +5472,9 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                             parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
                         }
                         // Add hybrid spa parameters if not already provided
-                        if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[AADServerParamKeys.RETURN_SPA_CODE])) {
+                        if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[exports.AADServerParamKeys.RETURN_SPA_CODE])) {
                             parameterBuilder.addExtraQueryParameters((_a = {},
-                                _a[AADServerParamKeys.RETURN_SPA_CODE] = "1",
+                                _a[exports.AADServerParamKeys.RETURN_SPA_CODE] = "1",
                                 _a));
                         }
                         return [2 /*return*/, parameterBuilder.createQueryString()];
@@ -5893,10 +5951,6 @@ exports.PerformanceEvents = void 0;
      * Used to acquire a token from Native component when native brokering is enabled.
      */
     PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
-    /**
-     * Time spent on the network for refresh token acquisition
-     */
-    PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
     /**
      * Time spent creating default headers for requests to token endpoint
      */
@@ -5910,10 +5964,21 @@ exports.PerformanceEvents = void 0;
      */
     PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
     /**
-     * acquireToken API in BrokerClientApplication.
-     * Used to acquire a token on behalf of the embedded application (PW-Broker).
+     * Time taken for token acquisition by broker
      */
     PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
+    /**
+     * Time spent on the network for refresh token acquisition
+     */
+    PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
+    /**
+     * Time taken for acquiring refresh token , records RT size
+     */
+    PerformanceEvents["RefreshTokenClientAcquireToken"] = "refreshTokenClientAcquireToken";
+    /**
+     * Time taken for acquiring cached refresh token
+     */
+    PerformanceEvents["RefreshTokenClientAcquireTokenWithCachedRefreshToken"] = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
 })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
 /**
  * State of the performance event.
@@ -5941,18 +6006,40 @@ var RefreshTokenClient = /** @class */ (function (_super) {
         return _super.call(this, configuration, performanceClient) || this;
     }
     RefreshTokenClient.prototype.acquireToken = function (request) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function () {
-            var reqTimestamp, response, responseHandler;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var atsMeasurement, reqTimestamp, response, requestId, responseHandler;
+            var _this = this;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
+                        atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
+                        this.logger.verbose("RefreshTokenClientAcquireToken called", request.correlationId);
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
                     case 1:
-                        response = _a.sent();
+                        response = _c.sent();
+                        requestId = (_b = response.headers) === null || _b === void 0 ? void 0 : _b[exports.HeaderNames.X_MS_REQUEST_ID];
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         responseHandler.validateTokenResponse(response.body);
-                        return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache)];
+                        return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId).then(function (result) {
+                                var _a;
+                                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                    success: true,
+                                    refreshTokenSize: ((_a = response.body.refresh_token) === null || _a === void 0 ? void 0 : _a.length) || 0
+                                });
+                                return result;
+                            })
+                                .catch(function (error) {
+                                _this.logger.verbose("Error in fetching refresh token", request.correlationId);
+                                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                    errorCode: error.errorCode,
+                                    subErrorCode: error.subError,
+                                    success: false,
+                                    refreshTokenSize: undefined
+                                });
+                                throw error;
+                            })];
                 }
             });
         });
@@ -6002,14 +6089,21 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      * @param request
      */
     RefreshTokenClient.prototype.acquireTokenWithCachedRefreshToken = function (request, foci) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var refreshToken, refreshTokenRequest;
-            return __generator(this, function (_a) {
+            var atsMeasurement, refreshToken, refreshTokenRequest;
+            return __generator(this, function (_b) {
+                atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
+                this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
                 refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
-                // no refresh Token
                 if (!refreshToken) {
+                    atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.discardMeasurement();
                     throw InteractionRequiredAuthError.createNoTokensFoundError();
                 }
+                // attach cached RT size to the current measurement
+                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                    success: true
+                });
                 refreshTokenRequest = __assign(__assign({}, request), { refreshToken: refreshToken.secret, authenticationScheme: request.authenticationScheme || exports.AuthenticationScheme.BEARER, ccsCredential: {
                         credential: request.account.homeAccountId,
                         type: exports.CcsCredentialType.HOME_ACCOUNT_ID
@@ -6565,7 +6659,7 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         }
         var correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
         parameterBuilder.addCorrelationId(correlationId);
-        parameterBuilder.addRequestTokenUse(AADServerParamKeys.ON_BEHALF_OF);
+        parameterBuilder.addRequestTokenUse(exports.AADServerParamKeys.ON_BEHALF_OF);
         parameterBuilder.addOboAssertion(request.oboAssertion);
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
@@ -6678,13 +6772,21 @@ var SilentFlowClient = /** @class */ (function (_super) {
      */
     SilentFlowClient.prototype.generateResultFromCacheRecord = function (cacheRecord, request) {
         return __awaiter(this, void 0, void 0, function () {
-            var idTokenObj;
+            var idTokenObj, authTime;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         if (cacheRecord.idToken) {
                             idTokenObj = new AuthToken(cacheRecord.idToken.secret, this.config.cryptoInterface);
                         }
+                        // token max_age check
+                        if (request.maxAge || (request.maxAge === 0)) {
+                            authTime = idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.auth_time;
+                            if (!authTime) {
+                                throw ClientAuthError.createAuthTimeNotFoundError();
+                            }
+                            AuthToken.checkMaxAge(authTime, request.maxAge);
+                        }
                         return [4 /*yield*/, ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenObj)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
@@ -7060,8 +7162,13 @@ var Authority = /** @class */ (function () {
         // See above for AuthorityType
         get: function () {
             var pathSegments = this.canonicalAuthorityUrlComponents.PathSegments;
-            if (pathSegments.length && pathSegments[0].toLowerCase() === Constants.ADFS) {
-                return exports.AuthorityType.Adfs;
+            if (pathSegments.length) {
+                switch (pathSegments[0].toLowerCase()) {
+                    case Constants.ADFS:
+                        return exports.AuthorityType.Adfs;
+                    case Constants.DSTS:
+                        return exports.AuthorityType.Dsts;
+                }
             }
             return exports.AuthorityType.Default;
         },
@@ -7265,7 +7372,9 @@ var Authority = /** @class */ (function () {
          * The default open id configuration endpoint for any canonical authority.
          */
         get: function () {
-            if (this.authorityType === exports.AuthorityType.Adfs || this.protocolMode === exports.ProtocolMode.OIDC) {
+            if (this.authorityType === exports.AuthorityType.Adfs ||
+                this.authorityType === exports.AuthorityType.Dsts ||
+                this.protocolMode === exports.ProtocolMode.OIDC) {
                 return this.canonicalAuthority + ".well-known/openid-configuration";
             }
             return this.canonicalAuthority + "v2.0/.well-known/openid-configuration";
@@ -7363,8 +7472,9 @@ var Authority = /** @class */ (function () {
         });
     };
     /**
-     * Compares the number of url components after the domain to determine if the cached authority metadata can be used for the requested authority
-     * Protects against same domain different authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
+     * Compares the number of url components after the domain to determine if the cached
+     * authority metadata can be used for the requested authority. Protects against same domain different
+     * authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
      * @param metadataEntity
      */
     Authority.prototype.isAuthoritySameType = function (metadataEntity) {
@@ -7404,7 +7514,8 @@ var Authority = /** @class */ (function () {
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
-                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
+                        return [4 /*yield*/, this.networkInterface.
+                                sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
                     case 2:
                         response = _a.sent();
                         return [2 /*return*/, isOpenIdConfigResponse(response.body) ? response.body : null];
@@ -7465,7 +7576,8 @@ var Authority = /** @class */ (function () {
         });
     };
     /**
-     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from
+     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
+     * and returns where the information was retrieved from
      * @param cachedMetadata
      * @param newMetadata
      */
@@ -7688,7 +7800,7 @@ var Authority = /** @class */ (function () {
     Authority.replaceWithRegionalInformation = function (metadata, azureRegion) {
         metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
         // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
-        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
+        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
         if (metadata.end_session_endpoint) {
             metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
         }
@@ -7925,22 +8037,22 @@ var AuthenticationHeaderParser = /** @class */ (function () {
      */
     AuthenticationHeaderParser.prototype.getShrNonce = function () {
         // Attempt to parse nonce from Authentiacation-Info
-        var authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+        var authenticationInfo = this.headers[exports.HeaderNames.AuthenticationInfo];
         if (authenticationInfo) {
             var authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
             if (authenticationInfoChallenges.nextnonce) {
                 return authenticationInfoChallenges.nextnonce;
             }
-            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.AuthenticationInfo, "nextnonce challenge is missing.");
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(exports.HeaderNames.AuthenticationInfo, "nextnonce challenge is missing.");
         }
         // Attempt to parse nonce from WWW-Authenticate
-        var wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+        var wwwAuthenticate = this.headers[exports.HeaderNames.WWWAuthenticate];
         if (wwwAuthenticate) {
             var wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
             if (wwwAuthenticateChallenges.nonce) {
                 return wwwAuthenticateChallenges.nonce;
             }
-            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.WWWAuthenticate, "nonce challenge is missing.");
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(exports.HeaderNames.WWWAuthenticate, "nonce challenge is missing.");
         }
         // If neither header is present, throw missing headers error
         throw ClientConfigurationError.createMissingNonceAuthenticationHeadersError();
@@ -8331,6 +8443,9 @@ var PerformanceClient = /** @class */ (function () {
                         if (current.idTokenSize) {
                             previous.idTokenSize = current.idTokenSize;
                         }
+                        if (current.refreshTokenSize) {
+                            previous.refreshTokenSize = current.refreshTokenSize;
+                        }
                     }
                     return previous;
                 }, topLevelEvent);
@@ -8452,6 +8567,7 @@ exports.DEFAULT_CRYPTO_IMPLEMENTATION = DEFAULT_CRYPTO_IMPLEMENTATION;
 exports.DEFAULT_SYSTEM_OPTIONS = DEFAULT_SYSTEM_OPTIONS;
 exports.DefaultStorageClass = DefaultStorageClass;
 exports.DeviceCodeClient = DeviceCodeClient;
+exports.Errors = Errors;
 exports.IdToken = AuthToken;
 exports.IdTokenEntity = IdTokenEntity;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
@@ -8460,6 +8576,7 @@ exports.JoseHeader = JoseHeader;
 exports.Logger = Logger;
 exports.NetworkManager = NetworkManager;
 exports.OIDC_DEFAULT_SCOPES = OIDC_DEFAULT_SCOPES;
+exports.ONE_DAY_IN_MS = ONE_DAY_IN_MS;
 exports.OnBehalfOfClient = OnBehalfOfClient;
 exports.PerformanceClient = PerformanceClient;
 exports.PopTokenGenerator = PopTokenGenerator;
@@ -8475,6 +8592,8 @@ exports.SilentFlowClient = SilentFlowClient;
 exports.StringUtils = StringUtils;
 exports.StubPerformanceClient = StubPerformanceClient;
 exports.StubbedNetworkModule = StubbedNetworkModule;
+exports.THE_FAMILY_ID = THE_FAMILY_ID;
+exports.ThrottlingConstants = ThrottlingConstants;
 exports.ThrottlingEntity = ThrottlingEntity;
 exports.ThrottlingUtils = ThrottlingUtils;
 exports.TimeUtils = TimeUtils;