@azure/msal-browser 3.26.1 → 3.27.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.26.1 2024-10-08 */
+/*! @azure/msal-browser v3.27.0 2024-11-05 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -97,6 +97,7 @@ const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, Constants.EMAIL_SCOPE];
  */
 const HeaderNames = {
     CONTENT_TYPE: "Content-Type",
+    CONTENT_LENGTH: "Content-Length",
     RETRY_AFTER: "Retry-After",
     CCS_HEADER: "X-AnchorMailbox",
     WWWAuthenticate: "WWW-Authenticate",
@@ -311,7 +312,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -328,7 +329,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -377,7 +378,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -475,7 +476,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -727,7 +728,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -766,7 +767,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -957,12 +958,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.15.0";
+const version$1 = "14.16.0";
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -982,7 +983,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1043,7 +1044,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1080,7 +1081,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1407,7 +1408,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1461,7 +1462,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1599,7 +1600,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1696,7 +1697,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1896,7 +1897,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1936,7 +1937,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2015,7 +2016,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2030,7 +2031,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2052,7 +2053,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2065,7 +2066,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2308,7 +2309,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2355,7 +2356,7 @@ function getDeserializedResponse(responseString) {
     return null;
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2519,7 +2520,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2659,7 +2660,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2667,7 +2668,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
 const cacheUnknownErrorCode = "cache_error_unknown";
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2694,7 +2695,7 @@ class CacheError extends Error {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3935,9 +3936,6 @@ class DefaultStorageClass extends CacheManager {
     getTokenKeys() {
         throw createClientAuthError(methodNotImplemented);
     }
-    async clear() {
-        throw createClientAuthError(methodNotImplemented);
-    }
     updateCredentialCacheKey() {
         throw createClientAuthError(methodNotImplemented);
     }
@@ -3946,7 +3944,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4045,161 +4043,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Error thrown when there is an error with the server code, for example, unavailability.
- */
-class ServerError extends AuthError {
-    constructor(errorCode, errorMessage, subError, errorNo, status) {
-        super(errorCode, errorMessage, subError);
-        this.name = "ServerError";
-        this.errorNo = errorNo;
-        this.status = status;
-        Object.setPrototypeOf(this, ServerError.prototype);
-    }
-}
-
-/*! @azure/msal-common v14.15.0 2024-10-08 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class ThrottlingUtils {
-    /**
-     * Prepares a RequestThumbprint to be stored as a key.
-     * @param thumbprint
-     */
-    static generateThrottlingStorageKey(thumbprint) {
-        return `${ThrottlingConstants.THROTTLING_PREFIX}.${JSON.stringify(thumbprint)}`;
-    }
-    /**
-     * Performs necessary throttling checks before a network request.
-     * @param cacheManager
-     * @param thumbprint
-     */
-    static preProcess(cacheManager, thumbprint) {
-        const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
-        const value = cacheManager.getThrottlingCache(key);
-        if (value) {
-            if (value.throttleTime < Date.now()) {
-                cacheManager.removeItem(key);
-                return;
-            }
-            throw new ServerError(value.errorCodes?.join(" ") || Constants.EMPTY_STRING, value.errorMessage, value.subError);
-        }
-    }
-    /**
-     * Performs necessary throttling checks after a network request.
-     * @param cacheManager
-     * @param thumbprint
-     * @param response
-     */
-    static postProcess(cacheManager, thumbprint, response) {
-        if (ThrottlingUtils.checkResponseStatus(response) ||
-            ThrottlingUtils.checkResponseForRetryAfter(response)) {
-            const thumbprintValue = {
-                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
-                error: response.body.error,
-                errorCodes: response.body.error_codes,
-                errorMessage: response.body.error_description,
-                subError: response.body.suberror,
-            };
-            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue);
-        }
-    }
-    /**
-     * Checks a NetworkResponse object's status codes against 429 or 5xx
-     * @param response
-     */
-    static checkResponseStatus(response) {
-        return (response.status === 429 ||
-            (response.status >= 500 && response.status < 600));
-    }
-    /**
-     * Checks a NetworkResponse object's RetryAfter header
-     * @param response
-     */
-    static checkResponseForRetryAfter(response) {
-        if (response.headers) {
-            return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
-                (response.status < 200 || response.status >= 300));
-        }
-        return false;
-    }
-    /**
-     * Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
-     * @param throttleTime
-     */
-    static calculateThrottleTime(throttleTime) {
-        const time = throttleTime <= 0 ? 0 : throttleTime;
-        const currentSeconds = Date.now() / 1000;
-        return Math.floor(Math.min(currentSeconds +
-            (time || ThrottlingConstants.DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds +
-            ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
-    }
-    static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
-        const thumbprint = {
-            clientId: clientId,
-            authority: request.authority,
-            scopes: request.scopes,
-            homeAccountIdentifier: homeAccountIdentifier,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-        };
-        const key = this.generateThrottlingStorageKey(thumbprint);
-        cacheManager.removeItem(key);
-    }
-}
-
-/*! @azure/msal-common v14.15.0 2024-10-08 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class NetworkManager {
-    constructor(networkClient, cacheManager) {
-        this.networkClient = networkClient;
-        this.cacheManager = cacheManager;
-    }
-    /**
-     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
-     * @param thumbprint
-     * @param tokenEndpoint
-     * @param options
-     */
-    async sendPostRequest(thumbprint, tokenEndpoint, options) {
-        ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
-        let response;
-        try {
-            response = await this.networkClient.sendPostRequestAsync(tokenEndpoint, options);
-        }
-        catch (e) {
-            if (e instanceof AuthError) {
-                throw e;
-            }
-            else {
-                throw createClientAuthError(networkError);
-            }
-        }
-        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
-        return response;
-    }
-}
-
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4209,7 +4053,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4255,9 +4099,11 @@ const LOGOUT_HINT = "logout_hint";
 const SID = "sid";
 const LOGIN_HINT = "login_hint";
 const DOMAIN_HINT = "domain_hint";
-const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+const BROKER_CLIENT_ID = "brk_client_id";
+const BROKER_REDIRECT_URI = "brk_redirect_uri";
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4324,16 +4170,30 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+function instrumentBrokerParams(parameters, correlationId, performanceClient) {
+    if (!correlationId) {
+        return;
+    }
+    const clientId = parameters.get(CLIENT_ID);
+    if (clientId && parameters.has(BROKER_CLIENT_ID)) {
+        performanceClient?.addFields({
+            embeddedClientId: clientId,
+            embeddedRedirectUri: parameters.get(REDIRECT_URI),
+        }, correlationId);
+    }
+}
 /** @internal */
 class RequestParameterBuilder {
-    constructor() {
+    constructor(correlationId, performanceClient) {
         this.parameters = new Map();
+        this.performanceClient = performanceClient;
+        this.correlationId = correlationId;
     }
     /**
      * add response_type = code
@@ -4697,6 +4557,14 @@ class RequestParameterBuilder {
     addLogoutHint(logoutHint) {
         this.parameters.set(LOGOUT_HINT, encodeURIComponent(logoutHint));
     }
+    addBrokerParameters(params) {
+        const brokerParams = {};
+        brokerParams[BROKER_CLIENT_ID] =
+            params.brokerClientId;
+        brokerParams[BROKER_REDIRECT_URI] =
+            params.brokerRedirectUri;
+        this.addExtraQueryParameters(brokerParams);
+    }
     /**
      * Utility to create a URL from the params map
      */
@@ -4705,11 +4573,12 @@ class RequestParameterBuilder {
         this.parameters.forEach((value, key) => {
             queryParameterArray.push(`${key}=${value}`);
         });
+        instrumentBrokerParams(this.parameters, this.correlationId, this.performanceClient);
         return queryParameterArray.join("&");
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4721,7 +4590,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4731,7 +4600,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4741,7 +4610,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4843,6 +4712,7 @@ const PerformanceEvents = {
     /**
      * Time spent sending/waiting for the response of a request to the token endpoint
      */
+    NetworkClientSendPostRequestAsync: "networkClientSendPostRequestAsync",
     RefreshTokenClientExecutePostToTokenEndpoint: "refreshTokenClientExecutePostToTokenEndpoint",
     AuthorizationCodeClientExecutePostToTokenEndpoint: "authorizationCodeClientExecutePostToTokenEndpoint",
     /**
@@ -5016,6 +4886,10 @@ const PerformanceEventAbbreviations = new Map([
         PerformanceEvents.BaseClientCreateTokenRequestHeaders,
         "BaseClientCreateTReqHead",
     ],
+    [
+        PerformanceEvents.NetworkClientSendPostRequestAsync,
+        "NetClientSendPost",
+    ],
     [
         PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint,
         "RTClientExecPost",
@@ -5223,7 +5097,7 @@ const IntFields = new Set([
     "multiMatchedRT",
 ]);
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5319,7 +5193,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5428,7 +5302,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6267,7 +6141,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6298,7 +6172,154 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Error thrown when there is an error with the server code, for example, unavailability.
+ */
+class ServerError extends AuthError {
+    constructor(errorCode, errorMessage, subError, errorNo, status) {
+        super(errorCode, errorMessage, subError);
+        this.name = "ServerError";
+        this.errorNo = errorNo;
+        this.status = status;
+        Object.setPrototypeOf(this, ServerError.prototype);
+    }
+}
+
+/*! @azure/msal-common v14.16.0 2024-11-05 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class ThrottlingUtils {
+    /**
+     * Prepares a RequestThumbprint to be stored as a key.
+     * @param thumbprint
+     */
+    static generateThrottlingStorageKey(thumbprint) {
+        return `${ThrottlingConstants.THROTTLING_PREFIX}.${JSON.stringify(thumbprint)}`;
+    }
+    /**
+     * Performs necessary throttling checks before a network request.
+     * @param cacheManager
+     * @param thumbprint
+     */
+    static preProcess(cacheManager, thumbprint) {
+        const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
+        const value = cacheManager.getThrottlingCache(key);
+        if (value) {
+            if (value.throttleTime < Date.now()) {
+                cacheManager.removeItem(key);
+                return;
+            }
+            throw new ServerError(value.errorCodes?.join(" ") || Constants.EMPTY_STRING, value.errorMessage, value.subError);
+        }
+    }
+    /**
+     * Performs necessary throttling checks after a network request.
+     * @param cacheManager
+     * @param thumbprint
+     * @param response
+     */
+    static postProcess(cacheManager, thumbprint, response) {
+        if (ThrottlingUtils.checkResponseStatus(response) ||
+            ThrottlingUtils.checkResponseForRetryAfter(response)) {
+            const thumbprintValue = {
+                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
+                error: response.body.error,
+                errorCodes: response.body.error_codes,
+                errorMessage: response.body.error_description,
+                subError: response.body.suberror,
+            };
+            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue);
+        }
+    }
+    /**
+     * Checks a NetworkResponse object's status codes against 429 or 5xx
+     * @param response
+     */
+    static checkResponseStatus(response) {
+        return (response.status === 429 ||
+            (response.status >= 500 && response.status < 600));
+    }
+    /**
+     * Checks a NetworkResponse object's RetryAfter header
+     * @param response
+     */
+    static checkResponseForRetryAfter(response) {
+        if (response.headers) {
+            return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
+                (response.status < 200 || response.status >= 300));
+        }
+        return false;
+    }
+    /**
+     * Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
+     * @param throttleTime
+     */
+    static calculateThrottleTime(throttleTime) {
+        const time = throttleTime <= 0 ? 0 : throttleTime;
+        const currentSeconds = Date.now() / 1000;
+        return Math.floor(Math.min(currentSeconds +
+            (time || ThrottlingConstants.DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds +
+            ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
+    }
+    static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
+        const thumbprint = {
+            clientId: clientId,
+            authority: request.authority,
+            scopes: request.scopes,
+            homeAccountIdentifier: homeAccountIdentifier,
+            claims: request.claims,
+            authenticationScheme: request.authenticationScheme,
+            resourceRequestMethod: request.resourceRequestMethod,
+            resourceRequestUri: request.resourceRequestUri,
+            shrClaims: request.shrClaims,
+            sshKid: request.sshKid,
+        };
+        const key = this.generateThrottlingStorageKey(thumbprint);
+        cacheManager.removeItem(key);
+    }
+}
+
+/*! @azure/msal-common v14.16.0 2024-11-05 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Represents network related errors
+ */
+class NetworkError extends AuthError {
+    constructor(error, httpStatus, responseHeaders) {
+        super(error.errorCode, error.errorMessage, error.subError);
+        Object.setPrototypeOf(this, NetworkError.prototype);
+        this.name = "NetworkError";
+        this.error = error;
+        this.httpStatus = httpStatus;
+        this.responseHeaders = responseHeaders;
+    }
+}
+/**
+ * Creates NetworkError object for a failed network request
+ * @param error - Error to be thrown back to the caller
+ * @param httpStatus - Status code of the network request
+ * @param responseHeaders - Response headers of the network request, when available
+ * @returns NetworkError object
+ */
+function createNetworkError(error, httpStatus, responseHeaders) {
+    return new NetworkError(error, httpStatus, responseHeaders);
+}
+
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6320,8 +6341,6 @@ class BaseClient {
         this.cacheManager = this.config.storageInterface;
         // Set the network interface
         this.networkClient = this.config.networkInterface;
-        // Set the NetworkManager
-        this.networkManager = new NetworkManager(this.networkClient, this.cacheManager);
         // Set TelemetryManager
         this.serverTelemetryManager = this.config.serverTelemetryManager;
         // set Authority
@@ -6365,11 +6384,7 @@ class BaseClient {
         if (queuedEvent) {
             this.performanceClient?.addQueueMeasurement(queuedEvent, correlationId);
         }
-        const response = await this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers });
-        this.performanceClient?.addFields({
-            refreshTokenSize: response.body.refresh_token?.length || 0,
-            httpVerToken: response.headers?.[HeaderNames.X_MS_HTTP_VERSION] || "",
-        }, correlationId);
+        const response = await this.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId);
         if (this.config.serverTelemetryManager &&
             response.status < 500 &&
             response.status !== 429) {
@@ -6378,6 +6393,52 @@ class BaseClient {
         }
         return response;
     }
+    /**
+     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+     * @param thumbprint - Request thumbprint for throttling
+     * @param tokenEndpoint - Endpoint to make the POST to
+     * @param options - Body and Headers to include on the POST request
+     * @param correlationId - CorrelationId for telemetry
+     */
+    async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
+        ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
+        let response;
+        try {
+            response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
+            const responseHeaders = response.headers || {};
+            this.performanceClient?.addFields({
+                refreshTokenSize: response.body.refresh_token?.length || 0,
+                httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+            }, correlationId);
+        }
+        catch (e) {
+            if (e instanceof NetworkError) {
+                const responseHeaders = e.responseHeaders;
+                if (responseHeaders) {
+                    this.performanceClient?.addFields({
+                        httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                        requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
+                            "",
+                        contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                            undefined,
+                        contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                            undefined,
+                        httpStatus: e.httpStatus,
+                    }, correlationId);
+                }
+                throw e.error;
+            }
+            if (e instanceof AuthError) {
+                throw e;
+            }
+            else {
+                throw createClientAuthError(networkError);
+            }
+        }
+        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
+        return response;
+    }
     /**
      * Updates the authority object of the client. Endpoint discovery must be completed.
      * @param updatedAuthority
@@ -6393,15 +6454,22 @@ class BaseClient {
      * @param request
      */
     createTokenQueryParameters(request) {
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
         if (request.tokenQueryParameters) {
             parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);
         }
+        parameterBuilder.addCorrelationId(request.correlationId);
         return parameterBuilder.createQueryString();
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6427,7 +6495,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6515,7 +6583,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6587,7 +6655,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6671,7 +6739,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6698,7 +6766,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7075,7 +7143,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7093,7 +7161,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7219,8 +7287,9 @@ class AuthorizationCodeClient extends BaseClient {
      */
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);
-        const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(request.tokenBodyParameters?.[CLIENT_ID] ||
+        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+        parameterBuilder.addClientId(request.embeddedClientId ||
+            request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         /*
          * For hybrid spa flow, there will be a code but no verifier
@@ -7280,9 +7349,6 @@ class AuthorizationCodeClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        const correlationId = request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
-        parameterBuilder.addCorrelationId(correlationId);
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
@@ -7322,6 +7388,12 @@ class AuthorizationCodeClient extends BaseClient {
                     break;
             }
         }
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
         if (request.tokenBodyParameters) {
             parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
         }
@@ -7340,9 +7412,13 @@ class AuthorizationCodeClient extends BaseClient {
      * @param request
      */
     async createAuthCodeUrlQueryString(request) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, request.correlationId);
-        const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(request.extraQueryParameters?.[CLIENT_ID] ||
+        // generate the correlationId if not set by the user and add
+        const correlationId = request.correlationId ||
+            this.config.cryptoInterface.createNewGuid();
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, correlationId);
+        const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
+        parameterBuilder.addClientId(request.embeddedClientId ||
+            request.extraQueryParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         const requestScopes = [
             ...(request.scopes || []),
@@ -7351,9 +7427,6 @@ class AuthorizationCodeClient extends BaseClient {
         parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);
         // validate the redirectUri (to be a non null value)
         parameterBuilder.addRedirectUri(request.redirectUri);
-        // generate the correlationId if not set by the user and add
-        const correlationId = request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
         parameterBuilder.addCorrelationId(correlationId);
         // add response_mode. If not passed in it defaults to query.
         parameterBuilder.addResponseMode(request.responseMode);
@@ -7455,6 +7528,12 @@ class AuthorizationCodeClient extends BaseClient {
                 this.config.authOptions.clientCapabilities.length > 0)) {
             parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
         }
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
         this.addExtraQueryParams(request, parameterBuilder);
         if (request.nativeBroker) {
             // signal ests that this is a WAM call
@@ -7481,7 +7560,7 @@ class AuthorizationCodeClient extends BaseClient {
      * @param request
      */
     createLogoutUrlQueryString(request) {
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
         if (request.postLogoutRedirectUri) {
             parameterBuilder.addPostLogoutRedirectUri(request.postLogoutRedirectUri);
         }
@@ -7524,7 +7603,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7662,8 +7741,9 @@ class RefreshTokenClient extends BaseClient {
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);
         const correlationId = request.correlationId;
-        const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(request.tokenBodyParameters?.[CLIENT_ID] ||
+        const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
+        parameterBuilder.addClientId(request.embeddedClientId ||
+            request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         if (request.redirectUri) {
             parameterBuilder.addRedirectUri(request.redirectUri);
@@ -7677,7 +7757,6 @@ class RefreshTokenClient extends BaseClient {
         if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
         }
-        parameterBuilder.addCorrelationId(correlationId);
         parameterBuilder.addRefreshToken(request.refreshToken);
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
@@ -7731,6 +7810,12 @@ class RefreshTokenClient extends BaseClient {
                     break;
             }
         }
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
         if (request.tokenBodyParameters) {
             parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
         }
@@ -7738,7 +7823,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7874,7 +7959,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7889,7 +7974,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7947,7 +8032,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8210,7 +8295,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8218,7 +8303,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8243,7 +8328,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8283,7 +8368,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8362,7 +8447,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.15.0 2024-10-08 */
+/*! @azure/msal-common v14.16.0 2024-11-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8494,18 +8579,30 @@ function compactStack(stack, stackMaxSize) {
         return [];
     }
     const stackArr = stack.split("\n") || [];
-    if (stackArr.length < 2) {
-        return [];
-    }
     const res = [];
+    // Check for a handful of known, common runtime errors and log them (with redaction where applicable).
+    const firstLine = stackArr[0];
+    if (firstLine.startsWith("TypeError: Cannot read property") ||
+        firstLine.startsWith("TypeError: Cannot read properties of") ||
+        firstLine.startsWith("TypeError: Cannot set property") ||
+        firstLine.startsWith("TypeError: Cannot set properties of") ||
+        firstLine.endsWith("is not a function")) {
+        // These types of errors are not at risk of leaking PII. They will indicate unavailable APIs
+        res.push(compactStackLine(firstLine));
+    }
+    else if (firstLine.startsWith("SyntaxError") ||
+        firstLine.startsWith("TypeError")) {
+        // Prevent unintentional leaking of arbitrary info by redacting contents between both single and double quotes
+        res.push(compactStackLine(
+        // Example: SyntaxError: Unexpected token 'e', "test" is not valid JSON -> SyntaxError: Unexpected token <redacted>, <redacted> is not valid JSON
+        firstLine.replace(/['].*[']|["].*["]/g, "<redacted>")));
+    }
     // Get top N stack lines
-    for (
-    // Skip first line as it may contain PII data
-    let ix = Math.max(stackArr.length - stackMaxSize - 1, 1); ix < stackArr.length; ix++) {
-        const line = stackArr[ix];
+    for (let ix = 1; ix < stackArr.length; ix++) {
         if (res.length >= stackMaxSize) {
             break;
         }
+        const line = stackArr[ix];
         res.push(compactStackLine(line));
     }
     return res;
@@ -8752,13 +8849,20 @@ class PerformanceClient {
             rootEvent.incompleteSubMeasurements?.delete(event.eventId);
         }
         this.logger.trace(`PerformanceClient: Performance measurement ended for ${event.name}: ${event.durationMs} ms`, event.correlationId);
+        if (error) {
+            addError(error, this.logger, rootEvent);
+        }
         // Add sub-measurement attribute to root event.
         if (!isRoot) {
             rootEvent[event.name + "DurationMs"] = Math.floor(event.durationMs);
             return { ...rootEvent };
         }
-        if (error) {
-            addError(error, this.logger, rootEvent);
+        if (isRoot &&
+            !error &&
+            (rootEvent.errorCode || rootEvent.subErrorCode)) {
+            this.logger.trace(`PerformanceClient: Remove error and sub-error codes for root event ${event.name} as intermediate error was successfully handled`, event.correlationId);
+            rootEvent.errorCode = undefined;
+            rootEvent.subErrorCode = undefined;
         }
         let finalEvent = { ...rootEvent, ...event };
         let incompleteSubsCount = 0;
@@ -9001,7 +9105,9 @@ const nativeConnectionNotEstablished = "native_connection_not_established";
 const uninitializedPublicClientApplication = "uninitialized_public_client_application";
 const nativePromptNotSupported = "native_prompt_not_supported";
 const invalidBase64String = "invalid_base64_string";
-const invalidPopTokenRequest = "invalid_pop_token_request";
+const invalidPopTokenRequest = "invalid_pop_token_request";
+const failedToBuildHeaders = "failed_to_build_headers";
+const failedToParseHeaders = "failed_to_parse_headers";
 
 var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -9016,6 +9122,8 @@ var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     databaseUnavailable: databaseUnavailable,
     emptyNavigateUri: emptyNavigateUri,
     emptyWindowError: emptyWindowError,
+    failedToBuildHeaders: failedToBuildHeaders,
+    failedToParseHeaders: failedToParseHeaders,
     failedToParseResponse: failedToParseResponse,
     getRequestFailed: getRequestFailed,
     hashDoesNotContainKnownProperties: hashDoesNotContainKnownProperties,
@@ -9108,6 +9216,8 @@ const BrowserAuthErrorMessages = {
     [nativePromptNotSupported]: "The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",
     [invalidBase64String]: "Invalid base64 encoded string.",
     [invalidPopTokenRequest]: "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
+    [failedToBuildHeaders]: "Failed to build request headers object.",
+    [failedToParseHeaders]: "Failed to parse response headers",
 };
 /**
  * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9307,14 +9417,14 @@ const BrowserAuthErrorMessage = {
  * Browser library error class thrown by the MSAL.js library for SPAs
  */
 class BrowserAuthError extends AuthError {
-    constructor(errorCode) {
-        super(errorCode, BrowserAuthErrorMessages[errorCode]);
+    constructor(errorCode, subError) {
+        super(errorCode, BrowserAuthErrorMessages[errorCode], subError);
         Object.setPrototypeOf(this, BrowserAuthError.prototype);
         this.name = "BrowserAuthError";
     }
 }
-function createBrowserAuthError(errorCode) {
-    return new BrowserAuthError(errorCode);
+function createBrowserAuthError(errorCode, subError) {
+    return new BrowserAuthError(errorCode, subError);
 }
 
 /*
@@ -9597,6 +9707,7 @@ const PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
 const UUID_CHARS = "0123456789abcdef";
 // Array to store UINT32 random value
 const UINT32_ARR = new Uint32Array(1);
+const SUBTLE_SUBERROR = "crypto_subtle_undefined";
 const keygenAlgorithmOptions = {
     name: PKCS1_V15_KEYGEN_ALG,
     hash: S256_HASH_ALG,
@@ -9606,14 +9717,16 @@ const keygenAlgorithmOptions = {
 /**
  * Check whether browser crypto is available.
  */
-function validateCryptoAvailable(logger) {
-    if ("crypto" in window) {
-        logger.verbose("BrowserCrypto: modern crypto interface available");
+function validateCryptoAvailable() {
+    if (!window) {
+        throw createBrowserAuthError(nonBrowserEnvironment);
     }
-    else {
-        logger.error("BrowserCrypto: crypto interface is unavailable");
+    if (!window.crypto) {
         throw createBrowserAuthError(cryptoNonExistent);
     }
+    if (!window.crypto.subtle) {
+        throw createBrowserAuthError(cryptoNonExistent, SUBTLE_SUBERROR);
+    }
 }
 /**
  * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
@@ -10018,29 +10131,31 @@ class FetchClient {
      */
     async sendGetRequestAsync(url, options) {
         let response;
+        let responseHeaders = {};
+        let responseStatus = 0;
+        const reqHeaders = getFetchHeaders(options);
         try {
             response = await fetch(url, {
                 method: HTTP_REQUEST_TYPE.GET,
-                headers: this.getFetchHeaders(options),
+                headers: reqHeaders,
             });
         }
         catch (e) {
-            if (window.navigator.onLine) {
-                throw createBrowserAuthError(getRequestFailed);
-            }
-            else {
-                throw createBrowserAuthError(noNetworkConnectivity);
-            }
+            throw createBrowserAuthError(window.navigator.onLine
+                ? getRequestFailed
+                : noNetworkConnectivity);
         }
+        responseHeaders = getHeaderDict(response.headers);
         try {
+            responseStatus = response.status;
             return {
-                headers: this.getHeaderDict(response.headers),
+                headers: responseHeaders,
                 body: (await response.json()),
-                status: response.status,
+                status: responseStatus,
             };
         }
         catch (e) {
-            throw createBrowserAuthError(failedToParseResponse);
+            throw createNetworkError(createBrowserAuthError(failedToParseResponse), responseStatus, responseHeaders);
         }
     }
     /**
@@ -10050,56 +10165,73 @@ class FetchClient {
      * @param body
      */
     async sendPostRequestAsync(url, options) {
-        const reqBody = (options && options.body) || Constants.EMPTY_STRING;
+        const reqBody = (options && options.body) || "";
+        const reqHeaders = getFetchHeaders(options);
         let response;
+        let responseStatus = 0;
+        let responseHeaders = {};
         try {
             response = await fetch(url, {
                 method: HTTP_REQUEST_TYPE.POST,
-                headers: this.getFetchHeaders(options),
+                headers: reqHeaders,
                 body: reqBody,
             });
         }
         catch (e) {
-            if (window.navigator.onLine) {
-                throw createBrowserAuthError(postRequestFailed);
-            }
-            else {
-                throw createBrowserAuthError(noNetworkConnectivity);
-            }
+            throw createBrowserAuthError(window.navigator.onLine
+                ? postRequestFailed
+                : noNetworkConnectivity);
         }
+        responseHeaders = getHeaderDict(response.headers);
         try {
+            responseStatus = response.status;
             return {
-                headers: this.getHeaderDict(response.headers),
+                headers: responseHeaders,
                 body: (await response.json()),
-                status: response.status,
+                status: responseStatus,
             };
         }
         catch (e) {
-            throw createBrowserAuthError(failedToParseResponse);
+            throw createNetworkError(createBrowserAuthError(failedToParseResponse), responseStatus, responseHeaders);
         }
     }
-    /**
-     * Get Fetch API Headers object from string map
-     * @param inputHeaders
-     */
-    getFetchHeaders(options) {
+}
+/**
+ * Get Fetch API Headers object from string map
+ * @param inputHeaders
+ */
+function getFetchHeaders(options) {
+    try {
         const headers = new Headers();
         if (!(options && options.headers)) {
             return headers;
         }
         const optionsHeaders = options.headers;
-        Object.keys(optionsHeaders).forEach((key) => {
-            headers.append(key, optionsHeaders[key]);
+        Object.entries(optionsHeaders).forEach(([key, value]) => {
+            headers.append(key, value);
         });
         return headers;
     }
-    getHeaderDict(headers) {
+    catch (e) {
+        throw createBrowserAuthError(failedToBuildHeaders);
+    }
+}
+/**
+ * Returns object representing response headers
+ * @param headers
+ * @returns
+ */
+function getHeaderDict(headers) {
+    try {
         const headerDict = {};
         headers.forEach((value, key) => {
             headerDict[key] = value;
         });
         return headerDict;
     }
+    catch (e) {
+        throw createBrowserAuthError(failedToParseHeaders);
+    }
 }
 
 /*
@@ -10128,7 +10260,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         knownAuthorities: [],
         cloudDiscoveryMetadata: Constants.EMPTY_STRING,
         authorityMetadata: Constants.EMPTY_STRING,
-        redirectUri: Constants.EMPTY_STRING,
+        redirectUri: typeof window !== "undefined" ? getCurrentUri() : "",
         postLogoutRedirectUri: Constants.EMPTY_STRING,
         navigateToLoginRequestUrl: true,
         clientCapabilities: [],
@@ -10234,7 +10366,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.26.1";
+const version = "3.27.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11024,7 +11156,7 @@ class CryptoOps {
     constructor(logger, performanceClient) {
         this.logger = logger;
         // Browser crypto needs to be validated first before any other classes can be set.
-        validateCryptoAvailable(logger);
+        validateCryptoAvailable();
         this.cache = new AsyncMemoryStorage(this.logger);
         this.performanceClient = performanceClient;
     }
@@ -12817,9 +12949,7 @@ class BaseInteractionClient {
      */
     getRedirectUri(requestRedirectUri) {
         this.logger.verbose("getRedirectUri called");
-        const redirectUri = requestRedirectUri ||
-            this.config.auth.redirectUri ||
-            getCurrentUri();
+        const redirectUri = requestRedirectUri || this.config.auth.redirectUri;
         return UrlString.getAbsoluteUrl(redirectUri, getCurrentUri());
     }
     /**
@@ -13142,6 +13272,7 @@ class StandardInteractionClient extends BaseInteractionClient {
                 clientId: this.config.auth.clientId,
                 authority: discoveredAuthority,
                 clientCapabilities: this.config.auth.clientCapabilities,
+                redirectUri: this.config.auth.redirectUri,
             },
             systemOptions: {
                 tokenRenewalOffsetSeconds: this.config.system.tokenRenewalOffsetSeconds,
@@ -13339,10 +13470,6 @@ class SilentCacheClient extends StandardInteractionClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-const BrokerServerParamKeys = {
-    BROKER_CLIENT_ID: "brk_client_id",
-    BROKER_REDIRECT_URI: "brk_redirect_uri",
-};
 class NativeInteractionClient extends BaseInteractionClient {
     constructor(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, nativeStorageImpl, correlationId) {
         super(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, provider, correlationId);
@@ -13945,21 +14072,33 @@ class NativeInteractionClient extends BaseInteractionClient {
      * @private
      */
     handleExtraBrokerParams(request) {
-        if (!request.extraParameters) {
+        const hasExtraBrokerParams = request.extraParameters &&
+            request.extraParameters.hasOwnProperty(BROKER_CLIENT_ID) &&
+            request.extraParameters.hasOwnProperty(BROKER_REDIRECT_URI) &&
+            request.extraParameters.hasOwnProperty(CLIENT_ID);
+        if (!request.embeddedClientId && !hasExtraBrokerParams) {
             return;
         }
-        if (request.extraParameters.hasOwnProperty(BrokerServerParamKeys.BROKER_CLIENT_ID) &&
-            request.extraParameters.hasOwnProperty(BrokerServerParamKeys.BROKER_REDIRECT_URI) &&
-            request.extraParameters.hasOwnProperty(CLIENT_ID)) {
-            const child_client_id = request.extraParameters[CLIENT_ID];
-            const child_redirect_uri = request.redirectUri;
-            const brk_redirect_uri = request.extraParameters[BrokerServerParamKeys.BROKER_REDIRECT_URI];
-            request.extraParameters = {
-                child_client_id,
-                child_redirect_uri,
-            };
-            request.redirectUri = brk_redirect_uri;
+        let child_client_id = "";
+        const child_redirect_uri = request.redirectUri;
+        if (request.embeddedClientId) {
+            request.redirectUri = this.config.auth.redirectUri;
+            child_client_id = request.embeddedClientId;
+        }
+        else if (request.extraParameters) {
+            request.redirectUri =
+                request.extraParameters[BROKER_REDIRECT_URI];
+            child_client_id =
+                request.extraParameters[CLIENT_ID];
         }
+        request.extraParameters = {
+            child_client_id,
+            child_redirect_uri,
+        };
+        this.performanceClient?.addFields({
+            embeddedClientId: child_client_id,
+            embeddedRedirectUri: child_redirect_uri,
+        }, request.correlationId);
     }
 }
 
@@ -16251,7 +16390,6 @@ class StandardController {
                 atPopupMeasurement.end({
                     success: true,
                     isNativeBroker: true,
-                    requestId: response.requestId,
                     accountType: getAccountType(response.account),
                 });
                 return response;
@@ -16290,7 +16428,6 @@ class StandardController {
             }
             atPopupMeasurement.end({
                 success: true,
-                requestId: result.requestId,
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
                 accountType: getAccountType(result.account),
@@ -16381,7 +16518,6 @@ class StandardController {
             this.ssoSilentMeasurement?.end({
                 success: true,
                 isNativeBroker: response.fromNativeBroker,
-                requestId: response.requestId,
                 accessTokenSize: response.accessToken.length,
                 idTokenSize: response.idToken.length,
                 accountType: getAccountType(response.account),
@@ -16436,7 +16572,6 @@ class StandardController {
                         atbcMeasurement.end({
                             success: true,
                             isNativeBroker: result.fromNativeBroker,
-                            requestId: result.requestId,
                             accessTokenSize: result.accessToken.length,
                             idTokenSize: result.idToken.length,
                             accountType: getAccountType(result.account),
@@ -16515,7 +16650,6 @@ class StandardController {
                 success: true,
                 fromCache: response.fromCache,
                 isNativeBroker: response.fromNativeBroker,
-                requestId: response.requestId,
             });
             return response;
         })
@@ -17066,7 +17200,6 @@ class StandardController {
                     fromCache: result.fromCache,
                     isNativeBroker: result.fromNativeBroker,
                     cacheLookupPolicy: request.cacheLookupPolicy,
-                    requestId: result.requestId,
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
                 });
@@ -17177,7 +17310,6 @@ class StandardController {
                 this.performanceClient.addFields({
                     fromCache: response.fromCache,
                     isNativeBroker: response.fromNativeBroker,
-                    requestId: response.requestId,
                 }, request.correlationId);
             }
             return response;
@@ -17277,7 +17409,8 @@ class NestedAppAuthAdapter {
         else {
             extraParams = new Map(Object.entries(request.extraQueryParameters));
         }
-        const requestBuilder = new RequestParameterBuilder();
+        const correlationId = request.correlationId || this.crypto.createNewGuid();
+        const requestBuilder = new RequestParameterBuilder(correlationId);
         const claims = requestBuilder.addClientCapabilitiesToClaims(request.claims, this.clientCapabilities);
         const scopes = request.scopes || OIDC_DEFAULT_SCOPES;
         const tokenRequest = {
@@ -17285,9 +17418,7 @@ class NestedAppAuthAdapter {
             clientId: this.clientId,
             authority: request.authority,
             scope: scopes.join(" "),
-            correlationId: request.correlationId !== undefined
-                ? request.correlationId
-                : this.crypto.createNewGuid(),
+            correlationId,
             claims: !StringUtils.isEmptyObj(claims) ? claims : undefined,
             state: request.state,
             authenticationScheme: request.authenticationScheme || AuthenticationScheme.BEARER,