@azure/msal-browser 4.13.1 → 4.14.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.13.1 2025-06-10 */
+/*! @azure/msal-browser v4.14.0 2025-07-01 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -147,7 +147,6 @@ const CodeChallengeMethodValues = {
  */
 const OAuthResponseType = {
     CODE: "code",
-    IDTOKEN_TOKEN: "id_token token",
     IDTOKEN_TOKEN_REFRESHTOKEN: "id_token token refresh_token",
 };
 /**
@@ -162,29 +161,19 @@ const ServerResponseType = {
  * allowed values for response_mode
  */
 const ResponseMode = {
-    QUERY: "query",
-    FRAGMENT: "fragment",
-    FORM_POST: "form_post",
-};
+    QUERY: "query"};
 /**
  * allowed grant_type
  */
 const GrantType = {
-    IMPLICIT_GRANT: "implicit",
     AUTHORIZATION_CODE_GRANT: "authorization_code",
-    CLIENT_CREDENTIALS_GRANT: "client_credentials",
-    RESOURCE_OWNER_PASSWORD_GRANT: "password",
-    REFRESH_TOKEN_GRANT: "refresh_token",
-    DEVICE_CODE_GRANT: "device_code",
-    JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-};
+    REFRESH_TOKEN_GRANT: "refresh_token"};
 /**
  * Account types in Cache
  */
 const CacheAccountType = {
     MSSTS_ACCOUNT_TYPE: "MSSTS",
     ADFS_ACCOUNT_TYPE: "ADFS",
-    MSAV1_ACCOUNT_TYPE: "MSA",
     GENERIC_ACCOUNT_TYPE: "Generic", // NTLM, Kerberos, FBA, Basic etc
 };
 /**
@@ -221,7 +210,6 @@ const AuthorityMetadataSource = {
 };
 const SERVER_TELEM_CONSTANTS = {
     SCHEMA_VERSION: 5,
-    MAX_CUR_HEADER_BYTES: 80,
     MAX_LAST_HEADER_BYTES: 330,
     MAX_CACHED_ERRORS: 50,
     CACHE_KEY: "server-telemetry",
@@ -269,9 +257,7 @@ const RegionDiscoverySources = {
  * Region Discovery Outcomes
  */
 const RegionDiscoveryOutcomes = {
-    CONFIGURED_MATCHES_DETECTED: "1",
     CONFIGURED_NO_AUTO_DETECTION: "2",
-    CONFIGURED_NOT_DETECTED: "3",
     AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
     AUTO_DETECTION_REQUESTED_FAILED: "5",
 };
@@ -298,7 +284,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -315,7 +301,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -364,7 +350,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -462,7 +448,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -714,7 +700,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -753,7 +739,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -944,12 +930,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.7.0";
+const version$1 = "15.8.0";
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -969,7 +955,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1030,7 +1016,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1085,7 +1071,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1412,7 +1398,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1466,7 +1452,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1604,7 +1590,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1701,7 +1687,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1892,7 +1878,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1932,7 +1918,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2011,7 +1997,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2026,7 +2012,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2048,7 +2034,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2072,7 +2058,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2315,7 +2301,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2380,7 +2366,7 @@ function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParame
     return queryParameterArray.join("&");
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2544,7 +2530,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2575,7 +2561,6 @@ const rawMetdataJSON = {
         },
     },
     instanceDiscoveryMetadata: {
-        tenant_discovery_endpoint: "https://{canonicalAuthority}/v2.0/.well-known/openid-configuration",
         metadata: [
             {
                 preferred_network: "login.microsoftonline.com",
@@ -2684,42 +2669,60 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
-const cacheUnknownErrorCode = "cache_error_unknown";
+const cacheQuotaExceeded = "cache_quota_exceeded";
+const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 const CacheErrorMessages = {
-    [cacheQuotaExceededErrorCode]: "Exceeded cache storage capacity.",
-    [cacheUnknownErrorCode]: "Unexpected error occurred when using cache storage.",
+    [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
+    [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
 };
 /**
  * Error thrown when there is an error with the cache
  */
-class CacheError extends Error {
+class CacheError extends AuthError {
     constructor(errorCode, errorMessage) {
         const message = errorMessage ||
             (CacheErrorMessages[errorCode]
                 ? CacheErrorMessages[errorCode]
-                : CacheErrorMessages[cacheUnknownErrorCode]);
+                : CacheErrorMessages[cacheErrorUnknown]);
         super(`${errorCode}: ${message}`);
         Object.setPrototypeOf(this, CacheError.prototype);
         this.name = "CacheError";
         this.errorCode = errorCode;
         this.errorMessage = message;
     }
+}
+/**
+ * Helper function to wrap browser errors in a CacheError object
+ * @param e
+ * @returns
+ */
+function createCacheError(e) {
+    if (!(e instanceof Error)) {
+        return new CacheError(cacheErrorUnknown);
+    }
+    if (e.name === "QuotaExceededError" ||
+        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+        e.message.includes("exceeded the quota")) {
+        return new CacheError(cacheQuotaExceeded);
+    }
+    else {
+        return new CacheError(e.name, e.message);
+    }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2730,25 +2733,26 @@ class CacheError extends Error {
  * @internal
  */
 class CacheManager {
-    constructor(clientId, cryptoImpl, logger, staticAuthorityOptions) {
+    constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
         this.commonLogger = logger.clone(name$1, version$1);
         this.staticAuthorityOptions = staticAuthorityOptions;
+        this.performanceClient = performanceClient;
     }
     /**
      * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
      * @param accountFilter - (Optional) filter to narrow down the accounts returned
      * @returns Array of AccountInfo objects in cache
      */
-    getAllAccounts(accountFilter) {
-        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}), accountFilter);
+    getAllAccounts(accountFilter, correlationId) {
+        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
     }
     /**
      * Gets first tenanted AccountInfo object found based on provided filters
      */
-    getAccountInfoFilteredBy(accountFilter) {
-        const allAccounts = this.getAllAccounts(accountFilter);
+    getAccountInfoFilteredBy(accountFilter, correlationId) {
+        const allAccounts = this.getAllAccounts(accountFilter, correlationId);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
             const sortedAccounts = allAccounts.sort((account) => {
@@ -2769,8 +2773,8 @@ class CacheManager {
      * @param accountFilter
      * @returns
      */
-    getBaseAccountInfo(accountFilter) {
-        const accountEntities = this.getAccountsFilteredBy(accountFilter);
+    getBaseAccountInfo(accountFilter, correlationId) {
+        const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
         if (accountEntities.length > 0) {
             return accountEntities[0].getAccountInfo();
         }
@@ -2785,12 +2789,12 @@ class CacheManager {
      * @param accountFilter
      * @returns Array of AccountInfo objects that match account and tenant profile filters
      */
-    buildTenantProfiles(cachedAccounts, accountFilter) {
+    buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
         return cachedAccounts.flatMap((accountEntity) => {
-            return this.getTenantProfilesFromAccountEntity(accountEntity, accountFilter?.tenantId, accountFilter);
+            return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
         });
     }
-    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter) {
+    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
         let tenantedAccountInfo = null;
         let idTokenClaims;
         if (tenantProfileFilter) {
@@ -2798,7 +2802,7 @@ class CacheManager {
                 return null;
             }
         }
-        const idToken = this.getIdToken(accountInfo, tokenKeys, tenantProfile.tenantId);
+        const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
         if (idToken) {
             idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
             if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
@@ -2810,7 +2814,7 @@ class CacheManager {
         tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
         return tenantedAccountInfo;
     }
-    getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {
+    getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
         const accountInfo = accountEntity.getAccountInfo();
         let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
         const tokenKeys = this.getTokenKeys();
@@ -2830,7 +2834,7 @@ class CacheManager {
         }
         const matchingTenantProfiles = [];
         searchTenantProfiles.forEach((tenantProfile) => {
-            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter);
+            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter);
             if (tenantedAccountInfo) {
                 matchingTenantProfiles.push(tenantedAccountInfo);
             }
@@ -2904,26 +2908,16 @@ class CacheManager {
                 await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
             }
             if (!!cacheRecord.appMetadata) {
-                this.setAppMetadata(cacheRecord.appMetadata);
+                this.setAppMetadata(cacheRecord.appMetadata, correlationId);
             }
         }
         catch (e) {
             this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);
-            if (e instanceof Error) {
-                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e.message}`, correlationId);
-                if (e.name === "QuotaExceededError" ||
-                    e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
-                    e.message.includes("exceeded the quota")) {
-                    this.commonLogger?.error(`CacheManager.saveCacheRecord: exceeded storage quota`, correlationId);
-                    throw new CacheError(cacheQuotaExceededErrorCode);
-                }
-                else {
-                    throw new CacheError(e.name, e.message);
-                }
+            if (e instanceof AuthError) {
+                throw e;
             }
             else {
-                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e}`, correlationId);
-                throw new CacheError(cacheUnknownErrorCode);
+                throw createCacheError(e);
             }
         }
     }
@@ -2943,21 +2937,19 @@ class CacheManager {
         };
         const tokenKeys = this.getTokenKeys();
         const currentScopes = ScopeSet.fromString(credential.target);
-        const removedAccessTokens = [];
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                 return;
             }
-            const tokenEntity = this.getAccessTokenCredential(key);
+            const tokenEntity = this.getAccessTokenCredential(key, correlationId);
             if (tokenEntity &&
                 this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
                 const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                    removedAccessTokens.push(this.removeAccessToken(key));
+                    this.removeAccessToken(key, correlationId);
                 }
             }
         });
-        await Promise.all(removedAccessTokens);
         await this.setAccessTokenCredential(credential, correlationId);
     }
     /**
@@ -2965,7 +2957,7 @@ class CacheManager {
      * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
      * @param accountFilter - An object containing Account properties to filter by
      */
-    getAccountsFilteredBy(accountFilter) {
+    getAccountsFilteredBy(accountFilter, correlationId) {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
@@ -2973,7 +2965,7 @@ class CacheManager {
                 // Don't parse value if the key doesn't match the account filters
                 return;
             }
-            const entity = this.getAccount(cacheKey, this.commonLogger);
+            const entity = this.getAccount(cacheKey, correlationId);
             // Match base account fields
             if (!entity) {
                 return;
@@ -3199,86 +3191,80 @@ class CacheManager {
     /**
      * Removes all accounts and related tokens from cache.
      */
-    async removeAllAccounts() {
+    removeAllAccounts(correlationId) {
         const allAccountKeys = this.getAccountKeys();
-        const removedAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
-            removedAccounts.push(this.removeAccount(cacheKey));
+            this.removeAccount(cacheKey, correlationId);
         });
-        await Promise.all(removedAccounts);
     }
     /**
      * Removes the account and related tokens for a given account key
      * @param account
      */
-    async removeAccount(accountKey) {
-        const account = this.getAccount(accountKey, this.commonLogger);
+    removeAccount(accountKey, correlationId) {
+        const account = this.getAccount(accountKey, correlationId);
         if (!account) {
             return;
         }
-        await this.removeAccountContext(account);
-        this.removeItem(accountKey);
+        this.removeAccountContext(account, correlationId);
+        this.removeItem(accountKey, correlationId);
     }
     /**
      * Removes credentials associated with the provided account
      * @param account
      */
-    async removeAccountContext(account) {
+    removeAccountContext(account, correlationId) {
         const allTokenKeys = this.getTokenKeys();
         const accountId = account.generateAccountId();
-        const removedCredentials = [];
         allTokenKeys.idToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             }
         });
         allTokenKeys.accessToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                removedCredentials.push(this.removeAccessToken(key));
+                this.removeAccessToken(key, correlationId);
             }
         });
         allTokenKeys.refreshToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeRefreshToken(key);
+                this.removeRefreshToken(key, correlationId);
             }
         });
-        await Promise.all(removedCredentials);
     }
     /**
-     * returns a boolean if the given credential is removed
-     * @param credential
+     * Removes accessToken from the cache
+     * @param key
+     * @param correlationId
      */
-    async removeAccessToken(key) {
-        const credential = this.getAccessTokenCredential(key);
-        if (!credential) {
+    removeAccessToken(key, correlationId) {
+        const credential = this.getAccessTokenCredential(key, correlationId);
+        this.removeItem(key, correlationId);
+        this.performanceClient.incrementFields({ accessTokensRemoved: 1 }, correlationId);
+        if (!credential ||
+            credential.credentialType.toLowerCase() !==
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase() ||
+            credential.tokenType !== AuthenticationScheme.POP) {
+            // If the credential is not a PoP token, we can return
             return;
         }
         // Remove Token Binding Key from key store for PoP Tokens Credentials
-        if (credential.credentialType.toLowerCase() ===
-            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
-            if (credential.tokenType === AuthenticationScheme.POP) {
-                const accessTokenWithAuthSchemeEntity = credential;
-                const kid = accessTokenWithAuthSchemeEntity.keyId;
-                if (kid) {
-                    try {
-                        await this.cryptoImpl.removeTokenBindingKey(kid);
-                    }
-                    catch (error) {
-                        throw createClientAuthError(bindingKeyNotRemoved);
-                    }
-                }
-            }
+        const kid = credential.keyId;
+        if (kid) {
+            void this.cryptoImpl.removeTokenBindingKey(kid).catch(() => {
+                this.commonLogger.error(`Failed to remove token binding key ${kid}`, correlationId);
+                this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
+            });
         }
-        return this.removeItem(key);
     }
     /**
      * Removes all app metadata objects from cache.
      */
-    removeAppMetadata() {
+    removeAppMetadata(correlationId) {
         const allCacheKeys = this.getKeys();
         allCacheKeys.forEach((cacheKey) => {
             if (this.isAppMetadata(cacheKey)) {
-                this.removeItem(cacheKey);
+                this.removeItem(cacheKey, correlationId);
             }
         });
         return true;
@@ -3287,9 +3273,9 @@ class CacheManager {
      * Retrieve AccountEntity from cache
      * @param account
      */
-    readAccountFromCache(account) {
+    readAccountFromCache(account, correlationId) {
         const accountKey = AccountEntity.generateAccountCacheKey(account);
-        return this.getAccount(accountKey, this.commonLogger);
+        return this.getAccount(accountKey, correlationId);
     }
     /**
      * Retrieve IdTokenEntity from cache
@@ -3299,7 +3285,7 @@ class CacheManager {
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getIdToken(account, tokenKeys, targetRealm, performanceClient, correlationId) {
+    getIdToken(account, correlationId, tokenKeys, targetRealm, performanceClient) {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter = {
             homeAccountId: account.homeAccountId,
@@ -3308,7 +3294,7 @@ class CacheManager {
             clientId: this.clientId,
             realm: targetRealm,
         };
-        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
+        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, correlationId, tokenKeys);
         const numIdTokens = idTokenMap.size;
         if (numIdTokens < 1) {
             this.commonLogger.info("CacheManager:getIdToken - No token found");
@@ -3341,7 +3327,7 @@ class CacheManager {
             // Multiple tokens for a single tenant profile, remove all and return null
             this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them");
             tokensToBeRemoved.forEach((idToken, key) => {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             });
             if (performanceClient && correlationId) {
                 performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
@@ -3356,7 +3342,7 @@ class CacheManager {
      * @param filter
      * @returns
      */
-    getIdTokensByFilter(filter, tokenKeys) {
+    getIdTokensByFilter(filter, correlationId, tokenKeys) {
         const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;
         const idTokens = new Map();
         idTokenKeys.forEach((key) => {
@@ -3366,7 +3352,7 @@ class CacheManager {
             })) {
                 return;
             }
-            const idToken = this.getIdTokenCredential(key);
+            const idToken = this.getIdTokenCredential(key, correlationId);
             if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                 idTokens.set(key, idToken);
             }
@@ -3395,26 +3381,27 @@ class CacheManager {
      * Removes idToken from the cache
      * @param key
      */
-    removeIdToken(key) {
-        this.removeItem(key);
+    removeIdToken(key, correlationId) {
+        this.removeItem(key, correlationId);
     }
     /**
      * Removes refresh token from the cache
      * @param key
      */
-    removeRefreshToken(key) {
-        this.removeItem(key);
+    removeRefreshToken(key, correlationId) {
+        this.removeItem(key, correlationId);
     }
     /**
      * Retrieve AccessTokenEntity from cache
      * @param account {AccountInfo}
      * @param request {BaseAuthRequest}
+     * @param correlationId {?string}
      * @param tokenKeys {?TokenKeys}
      * @param performanceClient {?IPerformanceClient}
-     * @param correlationId {?string}
      */
-    getAccessToken(account, request, tokenKeys, targetRealm, performanceClient, correlationId) {
-        this.commonLogger.trace("CacheManager - getAccessToken called");
+    getAccessToken(account, request, tokenKeys, targetRealm) {
+        const correlationId = request.correlationId;
+        this.commonLogger.trace("CacheManager - getAccessToken called", correlationId);
         const scopes = ScopeSet.createSearchScopes(request.scopes);
         const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
         /*
@@ -3443,7 +3430,7 @@ class CacheManager {
         accessTokenKeys.forEach((key) => {
             // Validate key
             if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
-                const accessToken = this.getAccessTokenCredential(key);
+                const accessToken = this.getAccessTokenCredential(key, correlationId);
                 // Validate value
                 if (accessToken &&
                     this.credentialMatchesFilter(accessToken, accessTokenFilter)) {
@@ -3453,20 +3440,18 @@ class CacheManager {
         });
         const numAccessTokens = accessTokens.length;
         if (numAccessTokens < 1) {
-            this.commonLogger.info("CacheManager:getAccessToken - No token found");
+            this.commonLogger.info("CacheManager:getAccessToken - No token found", correlationId);
             return null;
         }
         else if (numAccessTokens > 1) {
-            this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them");
+            this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them", correlationId);
             accessTokens.forEach((accessToken) => {
-                void this.removeAccessToken(generateCredentialKey(accessToken));
+                this.removeAccessToken(generateCredentialKey(accessToken), correlationId);
             });
-            if (performanceClient && correlationId) {
-                performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
-            }
+            this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
             return null;
         }
-        this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
+        this.commonLogger.info("CacheManager:getAccessToken - Returning access token", correlationId);
         return accessTokens[0];
     }
     /**
@@ -3515,14 +3500,14 @@ class CacheManager {
      * @param filter
      * @returns
      */
-    getAccessTokensByFilter(filter) {
+    getAccessTokensByFilter(filter, correlationId) {
         const tokenKeys = this.getTokenKeys();
         const accessTokens = [];
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, filter, true)) {
                 return;
             }
-            const accessToken = this.getAccessTokenCredential(key);
+            const accessToken = this.getAccessTokenCredential(key, correlationId);
             if (accessToken &&
                 this.credentialMatchesFilter(accessToken, filter)) {
                 accessTokens.push(accessToken);
@@ -3534,11 +3519,11 @@ class CacheManager {
      * Helper to retrieve the appropriate refresh token from cache
      * @param account {AccountInfo}
      * @param familyRT {boolean}
+     * @param correlationId {?string}
      * @param tokenKeys {?TokenKeys}
      * @param performanceClient {?IPerformanceClient}
-     * @param correlationId {?string}
      */
-    getRefreshToken(account, familyRT, tokenKeys, performanceClient, correlationId) {
+    getRefreshToken(account, familyRT, correlationId, tokenKeys, performanceClient) {
         this.commonLogger.trace("CacheManager - getRefreshToken called");
         const id = familyRT ? THE_FAMILY_ID : undefined;
         const refreshTokenFilter = {
@@ -3554,7 +3539,7 @@ class CacheManager {
         refreshTokenKeys.forEach((key) => {
             // Validate key
             if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
-                const refreshToken = this.getRefreshTokenCredential(key);
+                const refreshToken = this.getRefreshTokenCredential(key, correlationId);
                 // Validate value
                 if (refreshToken &&
                     this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {
@@ -3904,576 +3889,16 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
-
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-const DEFAULT_SYSTEM_OPTIONS = {
-    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
-    preventCorsPreflight: false,
-};
-const DEFAULT_LOGGER_IMPLEMENTATION = {
-    loggerCallback: () => {
-        // allow users to not set loggerCallback
-    },
-    piiLoggingEnabled: false,
-    logLevel: exports.LogLevel.Info,
-    correlationId: Constants.EMPTY_STRING,
-};
-const DEFAULT_CACHE_OPTIONS = {
-    claimsBasedCachingEnabled: false,
-};
-const DEFAULT_NETWORK_IMPLEMENTATION = {
-    async sendGetRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
-    },
-    async sendPostRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
-    },
-};
-const DEFAULT_LIBRARY_INFO = {
-    sku: Constants.SKU,
-    version: version$1,
-    cpu: Constants.EMPTY_STRING,
-    os: Constants.EMPTY_STRING,
-};
-const DEFAULT_CLIENT_CREDENTIALS = {
-    clientSecret: Constants.EMPTY_STRING,
-    clientAssertion: undefined,
-};
-const DEFAULT_AZURE_CLOUD_OPTIONS = {
-    azureCloudInstance: AzureCloudInstance.None,
-    tenant: `${Constants.DEFAULT_COMMON_TENANT}`,
-};
-const DEFAULT_TELEMETRY_OPTIONS = {
-    application: {
-        appName: "",
-        appVersion: "",
-    },
-};
 /**
- * Function that sets the default options when not explicitly configured from app developer
- *
- * @param Configuration
+ * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
  *
- * @returns Configuration
- */
-function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, cacheOptions: userCacheOptions, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
-    const loggerOptions = {
-        ...DEFAULT_LOGGER_IMPLEMENTATION,
-        ...userLoggerOption,
-    };
-    return {
-        authOptions: buildAuthOptions(userAuthOptions),
-        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
-        loggerOptions: loggerOptions,
-        cacheOptions: { ...DEFAULT_CACHE_OPTIONS, ...userCacheOptions },
-        storageInterface: storageImplementation ||
-            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),
-        networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
-        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
-        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
-        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
-        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
-        serverTelemetryManager: serverTelemetryManager || null,
-        persistencePlugin: persistencePlugin || null,
-        serializableCache: serializableCache || null,
-    };
-}
-/**
- * Construct authoptions from the client and platform passed values
- * @param authOptions
- */
-function buildAuthOptions(authOptions) {
-    return {
-        clientCapabilities: [],
-        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
-        skipAuthorityMetadataCache: false,
-        instanceAware: false,
-        encodeExtraQueryParams: false,
-        ...authOptions,
-    };
-}
-/**
- * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
- * @param ClientConfiguration
- */
-function isOidcProtocolMode(config) {
-    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
-}
-
-/*! @azure/msal-common v15.7.0 2025-06-10 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CcsCredentialType = {
-    HOME_ACCOUNT_ID: "home_account_id",
-    UPN: "UPN",
-};
-
-/*! @azure/msal-common v15.7.0 2025-06-10 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CLIENT_ID = "client_id";
-const REDIRECT_URI = "redirect_uri";
-const RESPONSE_TYPE = "response_type";
-const RESPONSE_MODE = "response_mode";
-const GRANT_TYPE = "grant_type";
-const CLAIMS = "claims";
-const SCOPE = "scope";
-const REFRESH_TOKEN = "refresh_token";
-const STATE = "state";
-const NONCE = "nonce";
-const PROMPT = "prompt";
-const CODE = "code";
-const CODE_CHALLENGE = "code_challenge";
-const CODE_CHALLENGE_METHOD = "code_challenge_method";
-const CODE_VERIFIER = "code_verifier";
-const CLIENT_REQUEST_ID = "client-request-id";
-const X_CLIENT_SKU = "x-client-SKU";
-const X_CLIENT_VER = "x-client-VER";
-const X_CLIENT_OS = "x-client-OS";
-const X_CLIENT_CPU = "x-client-CPU";
-const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
-const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
-const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
-const X_APP_NAME = "x-app-name";
-const X_APP_VER = "x-app-ver";
-const POST_LOGOUT_URI = "post_logout_redirect_uri";
-const ID_TOKEN_HINT = "id_token_hint";
-const CLIENT_SECRET = "client_secret";
-const CLIENT_ASSERTION = "client_assertion";
-const CLIENT_ASSERTION_TYPE = "client_assertion_type";
-const TOKEN_TYPE = "token_type";
-const REQ_CNF = "req_cnf";
-const RETURN_SPA_CODE = "return_spa_code";
-const NATIVE_BROKER = "nativebroker";
-const LOGOUT_HINT = "logout_hint";
-const SID = "sid";
-const LOGIN_HINT = "login_hint";
-const DOMAIN_HINT = "domain_hint";
-const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
-const BROKER_CLIENT_ID = "brk_client_id";
-const BROKER_REDIRECT_URI = "brk_redirect_uri";
-const INSTANCE_AWARE = "instance_aware";
-const EAR_JWK = "ear_jwk";
-const EAR_JWE_CRYPTO = "ear_jwe_crypto";
-
-/*! @azure/msal-common v15.7.0 2025-06-10 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-function instrumentBrokerParams(parameters, correlationId, performanceClient) {
-    if (!correlationId) {
-        return;
-    }
-    const clientId = parameters.get(CLIENT_ID);
-    if (clientId && parameters.has(BROKER_CLIENT_ID)) {
-        performanceClient?.addFields({
-            embeddedClientId: clientId,
-            embeddedRedirectUri: parameters.get(REDIRECT_URI),
-        }, correlationId);
-    }
-}
-/**
- * Add the given response_type
- * @param parameters
- * @param responseType
- */
-function addResponseType(parameters, responseType) {
-    parameters.set(RESPONSE_TYPE, responseType);
-}
-/**
- * add response_mode. defaults to query.
- * @param responseMode
- */
-function addResponseMode(parameters, responseMode) {
-    parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
-}
-/**
- * Add flag to indicate STS should attempt to use WAM if available
- */
-function addNativeBroker(parameters) {
-    parameters.set(NATIVE_BROKER, "1");
-}
-/**
- * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
- * @param scopeSet
- * @param addOidcScopes
- */
-function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
-    // Always add openid to the scopes when adding OIDC scopes
-    if (addOidcScopes &&
-        !defaultScopes.includes("openid") &&
-        !scopes.includes("openid")) {
-        defaultScopes.push("openid");
-    }
-    const requestScopes = addOidcScopes
-        ? [...(scopes || []), ...defaultScopes]
-        : scopes || [];
-    const scopeSet = new ScopeSet(requestScopes);
-    parameters.set(SCOPE, scopeSet.printScopes());
-}
-/**
- * add clientId
- * @param clientId
- */
-function addClientId(parameters, clientId) {
-    parameters.set(CLIENT_ID, clientId);
-}
-/**
- * add redirect_uri
- * @param redirectUri
- */
-function addRedirectUri(parameters, redirectUri) {
-    parameters.set(REDIRECT_URI, redirectUri);
-}
-/**
- * add post logout redirectUri
- * @param redirectUri
- */
-function addPostLogoutRedirectUri(parameters, redirectUri) {
-    parameters.set(POST_LOGOUT_URI, redirectUri);
-}
-/**
- * add id_token_hint to logout request
- * @param idTokenHint
- */
-function addIdTokenHint(parameters, idTokenHint) {
-    parameters.set(ID_TOKEN_HINT, idTokenHint);
-}
-/**
- * add domain_hint
- * @param domainHint
- */
-function addDomainHint(parameters, domainHint) {
-    parameters.set(DOMAIN_HINT, domainHint);
-}
-/**
- * add login_hint
- * @param loginHint
- */
-function addLoginHint(parameters, loginHint) {
-    parameters.set(LOGIN_HINT, loginHint);
-}
-/**
- * Adds the CCS (Cache Credential Service) query parameter for login_hint
- * @param loginHint
- */
-function addCcsUpn(parameters, loginHint) {
-    parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
-}
-/**
- * Adds the CCS (Cache Credential Service) query parameter for account object
- * @param loginHint
- */
-function addCcsOid(parameters, clientInfo) {
-    parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
-}
-/**
- * add sid
- * @param sid
- */
-function addSid(parameters, sid) {
-    parameters.set(SID, sid);
-}
-/**
- * add claims
- * @param claims
- */
-function addClaims(parameters, claims, clientCapabilities) {
-    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
-    try {
-        JSON.parse(mergedClaims);
-    }
-    catch (e) {
-        throw createClientConfigurationError(invalidClaims);
-    }
-    parameters.set(CLAIMS, mergedClaims);
-}
-/**
- * add correlationId
- * @param correlationId
- */
-function addCorrelationId(parameters, correlationId) {
-    parameters.set(CLIENT_REQUEST_ID, correlationId);
-}
-/**
- * add library info query params
- * @param libraryInfo
- */
-function addLibraryInfo(parameters, libraryInfo) {
-    // Telemetry Info
-    parameters.set(X_CLIENT_SKU, libraryInfo.sku);
-    parameters.set(X_CLIENT_VER, libraryInfo.version);
-    if (libraryInfo.os) {
-        parameters.set(X_CLIENT_OS, libraryInfo.os);
-    }
-    if (libraryInfo.cpu) {
-        parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
-    }
-}
-/**
- * Add client telemetry parameters
- * @param appTelemetry
- */
-function addApplicationTelemetry(parameters, appTelemetry) {
-    if (appTelemetry?.appName) {
-        parameters.set(X_APP_NAME, appTelemetry.appName);
-    }
-    if (appTelemetry?.appVersion) {
-        parameters.set(X_APP_VER, appTelemetry.appVersion);
-    }
-}
-/**
- * add prompt
- * @param prompt
- */
-function addPrompt(parameters, prompt) {
-    parameters.set(PROMPT, prompt);
-}
-/**
- * add state
- * @param state
- */
-function addState(parameters, state) {
-    if (state) {
-        parameters.set(STATE, state);
-    }
-}
-/**
- * add nonce
- * @param nonce
- */
-function addNonce(parameters, nonce) {
-    parameters.set(NONCE, nonce);
-}
-/**
- * add code_challenge and code_challenge_method
- * - throw if either of them are not passed
- * @param codeChallenge
- * @param codeChallengeMethod
- */
-function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
-    if (codeChallenge && codeChallengeMethod) {
-        parameters.set(CODE_CHALLENGE, codeChallenge);
-        parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
-    }
-    else {
-        throw createClientConfigurationError(pkceParamsMissing);
-    }
-}
-/**
- * add the `authorization_code` passed by the user to exchange for a token
- * @param code
- */
-function addAuthorizationCode(parameters, code) {
-    parameters.set(CODE, code);
-}
-/**
- * add the `refreshToken` passed by the user
- * @param refreshToken
- */
-function addRefreshToken(parameters, refreshToken) {
-    parameters.set(REFRESH_TOKEN, refreshToken);
-}
-/**
- * add the `code_verifier` passed by the user to exchange for a token
- * @param codeVerifier
- */
-function addCodeVerifier(parameters, codeVerifier) {
-    parameters.set(CODE_VERIFIER, codeVerifier);
-}
-/**
- * add client_secret
- * @param clientSecret
- */
-function addClientSecret(parameters, clientSecret) {
-    parameters.set(CLIENT_SECRET, clientSecret);
-}
-/**
- * add clientAssertion for confidential client flows
- * @param clientAssertion
- */
-function addClientAssertion(parameters, clientAssertion) {
-    if (clientAssertion) {
-        parameters.set(CLIENT_ASSERTION, clientAssertion);
-    }
-}
-/**
- * add clientAssertionType for confidential client flows
- * @param clientAssertionType
- */
-function addClientAssertionType(parameters, clientAssertionType) {
-    if (clientAssertionType) {
-        parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
-    }
-}
-/**
- * add grant type
- * @param grantType
- */
-function addGrantType(parameters, grantType) {
-    parameters.set(GRANT_TYPE, grantType);
-}
-/**
- * add client info
- *
- */
-function addClientInfo(parameters) {
-    parameters.set(CLIENT_INFO, "1");
-}
-function addInstanceAware(parameters) {
-    if (!parameters.has(INSTANCE_AWARE)) {
-        parameters.set(INSTANCE_AWARE, "true");
-    }
-}
-/**
- * add extraQueryParams
- * @param eQParams
- */
-function addExtraQueryParameters(parameters, eQParams) {
-    Object.entries(eQParams).forEach(([key, value]) => {
-        if (!parameters.has(key) && value) {
-            parameters.set(key, value);
-        }
-    });
-}
-function addClientCapabilitiesToClaims(claims, clientCapabilities) {
-    let mergedClaims;
-    // Parse provided claims into JSON object or initialize empty object
-    if (!claims) {
-        mergedClaims = {};
-    }
-    else {
-        try {
-            mergedClaims = JSON.parse(claims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-    }
-    if (clientCapabilities && clientCapabilities.length > 0) {
-        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
-            // Add access_token key to claims object
-            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
-        }
-        // Add xms_cc claim with provided clientCapabilities to access_token key
-        mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
-            {
-                values: clientCapabilities,
-            };
-    }
-    return JSON.stringify(mergedClaims);
-}
-/**
- * add pop_jwk to query params
- * @param cnfString
- */
-function addPopToken(parameters, cnfString) {
-    if (cnfString) {
-        parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
-        parameters.set(REQ_CNF, cnfString);
-    }
-}
-/**
- * add SSH JWK and key ID to query params
- */
-function addSshJwk(parameters, sshJwkString) {
-    if (sshJwkString) {
-        parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
-        parameters.set(REQ_CNF, sshJwkString);
-    }
-}
-/**
- * add server telemetry fields
- * @param serverTelemetryManager
- */
-function addServerTelemetry(parameters, serverTelemetryManager) {
-    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
-}
-/**
- * Adds parameter that indicates to the server that throttling is supported
- */
-function addThrottling(parameters) {
-    parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
-}
-/**
- * Adds logout_hint parameter for "silent" logout which prevent server account picker
- */
-function addLogoutHint(parameters, logoutHint) {
-    parameters.set(LOGOUT_HINT, logoutHint);
-}
-function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
-    if (!parameters.has(BROKER_CLIENT_ID)) {
-        parameters.set(BROKER_CLIENT_ID, brokerClientId);
-    }
-    if (!parameters.has(BROKER_REDIRECT_URI)) {
-        parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
-    }
-}
-/**
- * Add EAR (Encrypted Authorize Response) request parameters
- * @param parameters
- * @param jwk
- */
-function addEARParameters(parameters, jwk) {
-    parameters.set(EAR_JWK, encodeURIComponent(jwk));
-    // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
-    const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
-    parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
-}
-
-/*! @azure/msal-common v15.7.0 2025-06-10 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-function isOpenIdConfigResponse(response) {
-    return (response.hasOwnProperty("authorization_endpoint") &&
-        response.hasOwnProperty("token_endpoint") &&
-        response.hasOwnProperty("issuer") &&
-        response.hasOwnProperty("jwks_uri"));
-}
-
-/*! @azure/msal-common v15.7.0 2025-06-10 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-function isCloudInstanceDiscoveryResponse(response) {
-    return (response.hasOwnProperty("tenant_discovery_endpoint") &&
-        response.hasOwnProperty("metadata"));
-}
-
-/*! @azure/msal-common v15.7.0 2025-06-10 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-function isCloudInstanceDiscoveryErrorResponse(response) {
-    return (response.hasOwnProperty("error") &&
-        response.hasOwnProperty("error_description"));
-}
-
-/*! @azure/msal-common v15.7.0 2025-06-10 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
- *
- * @export
- * @enum {number}
+ * @export
+ * @enum {number}
  */
 const PerformanceEvents = {
     /**
@@ -4950,34 +4375,672 @@ const PerformanceEventAbbreviations = new Map([
     [PerformanceEvents.DecryptEarResponse, "decryptEarResp"],
 ]);
 /**
- * State of the performance event.
+ * State of the performance event.
+ *
+ * @export
+ * @enum {number}
+ */
+const PerformanceEventStatus = {
+    InProgress: 1,
+    Completed: 2,
+};
+const IntFields = new Set([
+    "accessTokenSize",
+    "durationMs",
+    "idTokenSize",
+    "matsSilentStatus",
+    "matsHttpStatus",
+    "refreshTokenSize",
+    "queuedTimeMs",
+    "startTimeMs",
+    "status",
+    "multiMatchedAT",
+    "multiMatchedID",
+    "multiMatchedRT",
+    "unencryptedCacheCount",
+    "encryptedCacheExpiredCount",
+]);
+
+/*! @azure/msal-common v15.8.0 2025-07-01 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+class StubPerformanceMeasurement {
+    startMeasurement() {
+        return;
+    }
+    endMeasurement() {
+        return;
+    }
+    flushMeasurement() {
+        return null;
+    }
+}
+class StubPerformanceClient {
+    generateId() {
+        return "callback-id";
+    }
+    startMeasurement(measureName, correlationId) {
+        return {
+            end: () => null,
+            discard: () => { },
+            add: () => { },
+            increment: () => { },
+            event: {
+                eventId: this.generateId(),
+                status: PerformanceEventStatus.InProgress,
+                authority: "",
+                libraryName: "",
+                libraryVersion: "",
+                clientId: "",
+                name: measureName,
+                startTimeMs: Date.now(),
+                correlationId: correlationId || "",
+            },
+            measurement: new StubPerformanceMeasurement(),
+        };
+    }
+    startPerformanceMeasurement() {
+        return new StubPerformanceMeasurement();
+    }
+    calculateQueuedTime() {
+        return 0;
+    }
+    addQueueMeasurement() {
+        return;
+    }
+    setPreQueueTime() {
+        return;
+    }
+    endMeasurement() {
+        return null;
+    }
+    discardMeasurements() {
+        return;
+    }
+    removePerformanceCallback() {
+        return true;
+    }
+    addPerformanceCallback() {
+        return "";
+    }
+    emitEvents() {
+        return;
+    }
+    addFields() {
+        return;
+    }
+    incrementFields() {
+        return;
+    }
+    cacheEventByCorrelationId() {
+        return;
+    }
+}
+
+/*! @azure/msal-common v15.8.0 2025-07-01 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_SYSTEM_OPTIONS = {
+    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+    preventCorsPreflight: false,
+};
+const DEFAULT_LOGGER_IMPLEMENTATION = {
+    loggerCallback: () => {
+        // allow users to not set loggerCallback
+    },
+    piiLoggingEnabled: false,
+    logLevel: exports.LogLevel.Info,
+    correlationId: Constants.EMPTY_STRING,
+};
+const DEFAULT_CACHE_OPTIONS = {
+    claimsBasedCachingEnabled: false,
+};
+const DEFAULT_NETWORK_IMPLEMENTATION = {
+    async sendGetRequestAsync() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async sendPostRequestAsync() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+};
+const DEFAULT_LIBRARY_INFO = {
+    sku: Constants.SKU,
+    version: version$1,
+    cpu: Constants.EMPTY_STRING,
+    os: Constants.EMPTY_STRING,
+};
+const DEFAULT_CLIENT_CREDENTIALS = {
+    clientSecret: Constants.EMPTY_STRING,
+    clientAssertion: undefined,
+};
+const DEFAULT_AZURE_CLOUD_OPTIONS = {
+    azureCloudInstance: AzureCloudInstance.None,
+    tenant: `${Constants.DEFAULT_COMMON_TENANT}`,
+};
+const DEFAULT_TELEMETRY_OPTIONS = {
+    application: {
+        appName: "",
+        appVersion: "",
+    },
+};
+/**
+ * Function that sets the default options when not explicitly configured from app developer
+ *
+ * @param Configuration
+ *
+ * @returns Configuration
+ */
+function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, cacheOptions: userCacheOptions, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
+    const loggerOptions = {
+        ...DEFAULT_LOGGER_IMPLEMENTATION,
+        ...userLoggerOption,
+    };
+    return {
+        authOptions: buildAuthOptions(userAuthOptions),
+        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
+        loggerOptions: loggerOptions,
+        cacheOptions: { ...DEFAULT_CACHE_OPTIONS, ...userCacheOptions },
+        storageInterface: storageImplementation ||
+            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
+        networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
+        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
+        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
+        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
+        serverTelemetryManager: serverTelemetryManager || null,
+        persistencePlugin: persistencePlugin || null,
+        serializableCache: serializableCache || null,
+    };
+}
+/**
+ * Construct authoptions from the client and platform passed values
+ * @param authOptions
+ */
+function buildAuthOptions(authOptions) {
+    return {
+        clientCapabilities: [],
+        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
+        skipAuthorityMetadataCache: false,
+        instanceAware: false,
+        encodeExtraQueryParams: false,
+        ...authOptions,
+    };
+}
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+function isOidcProtocolMode(config) {
+    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+}
+
+/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CcsCredentialType = {
+    HOME_ACCOUNT_ID: "home_account_id",
+    UPN: "UPN",
+};
+
+/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CLIENT_ID = "client_id";
+const REDIRECT_URI = "redirect_uri";
+const RESPONSE_TYPE = "response_type";
+const RESPONSE_MODE = "response_mode";
+const GRANT_TYPE = "grant_type";
+const CLAIMS = "claims";
+const SCOPE = "scope";
+const REFRESH_TOKEN = "refresh_token";
+const STATE = "state";
+const NONCE = "nonce";
+const PROMPT = "prompt";
+const CODE = "code";
+const CODE_CHALLENGE = "code_challenge";
+const CODE_CHALLENGE_METHOD = "code_challenge_method";
+const CODE_VERIFIER = "code_verifier";
+const CLIENT_REQUEST_ID = "client-request-id";
+const X_CLIENT_SKU = "x-client-SKU";
+const X_CLIENT_VER = "x-client-VER";
+const X_CLIENT_OS = "x-client-OS";
+const X_CLIENT_CPU = "x-client-CPU";
+const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
+const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
+const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
+const X_APP_NAME = "x-app-name";
+const X_APP_VER = "x-app-ver";
+const POST_LOGOUT_URI = "post_logout_redirect_uri";
+const ID_TOKEN_HINT = "id_token_hint";
+const CLIENT_SECRET = "client_secret";
+const CLIENT_ASSERTION = "client_assertion";
+const CLIENT_ASSERTION_TYPE = "client_assertion_type";
+const TOKEN_TYPE = "token_type";
+const REQ_CNF = "req_cnf";
+const RETURN_SPA_CODE = "return_spa_code";
+const NATIVE_BROKER = "nativebroker";
+const LOGOUT_HINT = "logout_hint";
+const SID = "sid";
+const LOGIN_HINT = "login_hint";
+const DOMAIN_HINT = "domain_hint";
+const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+const BROKER_CLIENT_ID = "brk_client_id";
+const BROKER_REDIRECT_URI = "brk_redirect_uri";
+const INSTANCE_AWARE = "instance_aware";
+const EAR_JWK = "ear_jwk";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+
+/*! @azure/msal-common v15.8.0 2025-07-01 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function instrumentBrokerParams(parameters, correlationId, performanceClient) {
+    if (!correlationId) {
+        return;
+    }
+    const clientId = parameters.get(CLIENT_ID);
+    if (clientId && parameters.has(BROKER_CLIENT_ID)) {
+        performanceClient?.addFields({
+            embeddedClientId: clientId,
+            embeddedRedirectUri: parameters.get(REDIRECT_URI),
+        }, correlationId);
+    }
+}
+/**
+ * Add the given response_type
+ * @param parameters
+ * @param responseType
+ */
+function addResponseType(parameters, responseType) {
+    parameters.set(RESPONSE_TYPE, responseType);
+}
+/**
+ * add response_mode. defaults to query.
+ * @param responseMode
+ */
+function addResponseMode(parameters, responseMode) {
+    parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
+}
+/**
+ * Add flag to indicate STS should attempt to use WAM if available
+ */
+function addNativeBroker(parameters) {
+    parameters.set(NATIVE_BROKER, "1");
+}
+/**
+ * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
+ * @param scopeSet
+ * @param addOidcScopes
+ */
+function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+    // Always add openid to the scopes when adding OIDC scopes
+    if (addOidcScopes &&
+        !defaultScopes.includes("openid") &&
+        !scopes.includes("openid")) {
+        defaultScopes.push("openid");
+    }
+    const requestScopes = addOidcScopes
+        ? [...(scopes || []), ...defaultScopes]
+        : scopes || [];
+    const scopeSet = new ScopeSet(requestScopes);
+    parameters.set(SCOPE, scopeSet.printScopes());
+}
+/**
+ * add clientId
+ * @param clientId
+ */
+function addClientId(parameters, clientId) {
+    parameters.set(CLIENT_ID, clientId);
+}
+/**
+ * add redirect_uri
+ * @param redirectUri
+ */
+function addRedirectUri(parameters, redirectUri) {
+    parameters.set(REDIRECT_URI, redirectUri);
+}
+/**
+ * add post logout redirectUri
+ * @param redirectUri
+ */
+function addPostLogoutRedirectUri(parameters, redirectUri) {
+    parameters.set(POST_LOGOUT_URI, redirectUri);
+}
+/**
+ * add id_token_hint to logout request
+ * @param idTokenHint
+ */
+function addIdTokenHint(parameters, idTokenHint) {
+    parameters.set(ID_TOKEN_HINT, idTokenHint);
+}
+/**
+ * add domain_hint
+ * @param domainHint
+ */
+function addDomainHint(parameters, domainHint) {
+    parameters.set(DOMAIN_HINT, domainHint);
+}
+/**
+ * add login_hint
+ * @param loginHint
+ */
+function addLoginHint(parameters, loginHint) {
+    parameters.set(LOGIN_HINT, loginHint);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for login_hint
+ * @param loginHint
+ */
+function addCcsUpn(parameters, loginHint) {
+    parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for account object
+ * @param loginHint
+ */
+function addCcsOid(parameters, clientInfo) {
+    parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
+}
+/**
+ * add sid
+ * @param sid
+ */
+function addSid(parameters, sid) {
+    parameters.set(SID, sid);
+}
+/**
+ * add claims
+ * @param claims
+ */
+function addClaims(parameters, claims, clientCapabilities) {
+    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
+    try {
+        JSON.parse(mergedClaims);
+    }
+    catch (e) {
+        throw createClientConfigurationError(invalidClaims);
+    }
+    parameters.set(CLAIMS, mergedClaims);
+}
+/**
+ * add correlationId
+ * @param correlationId
+ */
+function addCorrelationId(parameters, correlationId) {
+    parameters.set(CLIENT_REQUEST_ID, correlationId);
+}
+/**
+ * add library info query params
+ * @param libraryInfo
+ */
+function addLibraryInfo(parameters, libraryInfo) {
+    // Telemetry Info
+    parameters.set(X_CLIENT_SKU, libraryInfo.sku);
+    parameters.set(X_CLIENT_VER, libraryInfo.version);
+    if (libraryInfo.os) {
+        parameters.set(X_CLIENT_OS, libraryInfo.os);
+    }
+    if (libraryInfo.cpu) {
+        parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
+    }
+}
+/**
+ * Add client telemetry parameters
+ * @param appTelemetry
+ */
+function addApplicationTelemetry(parameters, appTelemetry) {
+    if (appTelemetry?.appName) {
+        parameters.set(X_APP_NAME, appTelemetry.appName);
+    }
+    if (appTelemetry?.appVersion) {
+        parameters.set(X_APP_VER, appTelemetry.appVersion);
+    }
+}
+/**
+ * add prompt
+ * @param prompt
+ */
+function addPrompt(parameters, prompt) {
+    parameters.set(PROMPT, prompt);
+}
+/**
+ * add state
+ * @param state
+ */
+function addState(parameters, state) {
+    if (state) {
+        parameters.set(STATE, state);
+    }
+}
+/**
+ * add nonce
+ * @param nonce
+ */
+function addNonce(parameters, nonce) {
+    parameters.set(NONCE, nonce);
+}
+/**
+ * add code_challenge and code_challenge_method
+ * - throw if either of them are not passed
+ * @param codeChallenge
+ * @param codeChallengeMethod
+ */
+function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
+    if (codeChallenge && codeChallengeMethod) {
+        parameters.set(CODE_CHALLENGE, codeChallenge);
+        parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
+    }
+    else {
+        throw createClientConfigurationError(pkceParamsMissing);
+    }
+}
+/**
+ * add the `authorization_code` passed by the user to exchange for a token
+ * @param code
+ */
+function addAuthorizationCode(parameters, code) {
+    parameters.set(CODE, code);
+}
+/**
+ * add the `refreshToken` passed by the user
+ * @param refreshToken
+ */
+function addRefreshToken(parameters, refreshToken) {
+    parameters.set(REFRESH_TOKEN, refreshToken);
+}
+/**
+ * add the `code_verifier` passed by the user to exchange for a token
+ * @param codeVerifier
+ */
+function addCodeVerifier(parameters, codeVerifier) {
+    parameters.set(CODE_VERIFIER, codeVerifier);
+}
+/**
+ * add client_secret
+ * @param clientSecret
+ */
+function addClientSecret(parameters, clientSecret) {
+    parameters.set(CLIENT_SECRET, clientSecret);
+}
+/**
+ * add clientAssertion for confidential client flows
+ * @param clientAssertion
+ */
+function addClientAssertion(parameters, clientAssertion) {
+    if (clientAssertion) {
+        parameters.set(CLIENT_ASSERTION, clientAssertion);
+    }
+}
+/**
+ * add clientAssertionType for confidential client flows
+ * @param clientAssertionType
+ */
+function addClientAssertionType(parameters, clientAssertionType) {
+    if (clientAssertionType) {
+        parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
+    }
+}
+/**
+ * add grant type
+ * @param grantType
+ */
+function addGrantType(parameters, grantType) {
+    parameters.set(GRANT_TYPE, grantType);
+}
+/**
+ * add client info
  *
- * @export
- * @enum {number}
  */
-const PerformanceEventStatus = {
-    NotStarted: 0,
-    InProgress: 1,
-    Completed: 2,
-};
-const IntFields = new Set([
-    "accessTokenSize",
-    "durationMs",
-    "idTokenSize",
-    "matsSilentStatus",
-    "matsHttpStatus",
-    "refreshTokenSize",
-    "queuedTimeMs",
-    "startTimeMs",
-    "status",
-    "multiMatchedAT",
-    "multiMatchedID",
-    "multiMatchedRT",
-    "unencryptedCacheCount",
-    "encryptedCacheExpiredCount",
-]);
+function addClientInfo(parameters) {
+    parameters.set(CLIENT_INFO, "1");
+}
+function addInstanceAware(parameters) {
+    if (!parameters.has(INSTANCE_AWARE)) {
+        parameters.set(INSTANCE_AWARE, "true");
+    }
+}
+/**
+ * add extraQueryParams
+ * @param eQParams
+ */
+function addExtraQueryParameters(parameters, eQParams) {
+    Object.entries(eQParams).forEach(([key, value]) => {
+        if (!parameters.has(key) && value) {
+            parameters.set(key, value);
+        }
+    });
+}
+function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+    let mergedClaims;
+    // Parse provided claims into JSON object or initialize empty object
+    if (!claims) {
+        mergedClaims = {};
+    }
+    else {
+        try {
+            mergedClaims = JSON.parse(claims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+    }
+    if (clientCapabilities && clientCapabilities.length > 0) {
+        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+            // Add access_token key to claims object
+            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
+        }
+        // Add xms_cc claim with provided clientCapabilities to access_token key
+        mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
+            {
+                values: clientCapabilities,
+            };
+    }
+    return JSON.stringify(mergedClaims);
+}
+/**
+ * add pop_jwk to query params
+ * @param cnfString
+ */
+function addPopToken(parameters, cnfString) {
+    if (cnfString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
+        parameters.set(REQ_CNF, cnfString);
+    }
+}
+/**
+ * add SSH JWK and key ID to query params
+ */
+function addSshJwk(parameters, sshJwkString) {
+    if (sshJwkString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
+        parameters.set(REQ_CNF, sshJwkString);
+    }
+}
+/**
+ * add server telemetry fields
+ * @param serverTelemetryManager
+ */
+function addServerTelemetry(parameters, serverTelemetryManager) {
+    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+}
+/**
+ * Adds parameter that indicates to the server that throttling is supported
+ */
+function addThrottling(parameters) {
+    parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+}
+/**
+ * Adds logout_hint parameter for "silent" logout which prevent server account picker
+ */
+function addLogoutHint(parameters, logoutHint) {
+    parameters.set(LOGOUT_HINT, logoutHint);
+}
+function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
+    if (!parameters.has(BROKER_CLIENT_ID)) {
+        parameters.set(BROKER_CLIENT_ID, brokerClientId);
+    }
+    if (!parameters.has(BROKER_REDIRECT_URI)) {
+        parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
+    }
+}
+/**
+ * Add EAR (Encrypted Authorize Response) request parameters
+ * @param parameters
+ * @param jwk
+ */
+function addEARParameters(parameters, jwk) {
+    parameters.set(EAR_JWK, encodeURIComponent(jwk));
+    // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
+    const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
+    parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+
+/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isOpenIdConfigResponse(response) {
+    return (response.hasOwnProperty("authorization_endpoint") &&
+        response.hasOwnProperty("token_endpoint") &&
+        response.hasOwnProperty("issuer") &&
+        response.hasOwnProperty("jwks_uri"));
+}
+
+/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isCloudInstanceDiscoveryResponse(response) {
+    return (response.hasOwnProperty("tenant_discovery_endpoint") &&
+        response.hasOwnProperty("metadata"));
+}
+
+/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isCloudInstanceDiscoveryErrorResponse(response) {
+    return (response.hasOwnProperty("error") &&
+        response.hasOwnProperty("error_description"));
+}
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5073,7 +5136,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5179,7 +5242,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6018,7 +6081,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6049,7 +6112,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6068,7 +6131,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6089,7 +6152,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6109,12 +6172,12 @@ class ThrottlingUtils {
      * @param cacheManager
      * @param thumbprint
      */
-    static preProcess(cacheManager, thumbprint) {
+    static preProcess(cacheManager, thumbprint, correlationId) {
         const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
         const value = cacheManager.getThrottlingCache(key);
         if (value) {
             if (value.throttleTime < Date.now()) {
-                cacheManager.removeItem(key);
+                cacheManager.removeItem(key, correlationId);
                 return;
             }
             throw new ServerError(value.errorCodes?.join(" ") || Constants.EMPTY_STRING, value.errorMessage, value.subError);
@@ -6126,7 +6189,7 @@ class ThrottlingUtils {
      * @param thumbprint
      * @param response
      */
-    static postProcess(cacheManager, thumbprint, response) {
+    static postProcess(cacheManager, thumbprint, response, correlationId) {
         if (ThrottlingUtils.checkResponseStatus(response) ||
             ThrottlingUtils.checkResponseForRetryAfter(response)) {
             const thumbprintValue = {
@@ -6136,7 +6199,7 @@ class ThrottlingUtils {
                 errorMessage: response.body.error_description,
                 subError: response.body.suberror,
             };
-            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue);
+            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
         }
     }
     /**
@@ -6172,11 +6235,11 @@ class ThrottlingUtils {
     static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
         const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
         const key = this.generateThrottlingStorageKey(thumbprint);
-        cacheManager.removeItem(key);
+        cacheManager.removeItem(key, request.correlationId);
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6207,7 +6270,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6289,7 +6352,7 @@ class BaseClient {
      * @param correlationId - CorrelationId for telemetry
      */
     async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
-        ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
+        ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
         let response;
         try {
             response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
@@ -6324,7 +6387,7 @@ class BaseClient {
                 throw createClientAuthError(networkError);
             }
         }
-        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
+        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
         return response;
     }
     /**
@@ -6355,7 +6418,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6364,6 +6427,7 @@ class BaseClient {
 const noTokensFound = "no_tokens_found";
 const nativeAccountUnavailable = "native_account_unavailable";
 const refreshTokenExpired = "refresh_token_expired";
+const uxNotAllowed = "ux_not_allowed";
 // Codes potentially returned by server
 const interactionRequired = "interaction_required";
 const consentRequired = "consent_required";
@@ -6378,10 +6442,11 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     loginRequired: loginRequired,
     nativeAccountUnavailable: nativeAccountUnavailable,
     noTokensFound: noTokensFound,
-    refreshTokenExpired: refreshTokenExpired
+    refreshTokenExpired: refreshTokenExpired,
+    uxNotAllowed: uxNotAllowed
 });
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6395,6 +6460,7 @@ const InteractionRequiredServerErrorMessage = [
     consentRequired,
     loginRequired,
     badToken,
+    uxNotAllowed,
 ];
 const InteractionRequiredAuthSubErrorMessage = [
     "message_only",
@@ -6409,6 +6475,7 @@ const InteractionRequiredAuthErrorMessages = {
     [nativeAccountUnavailable]: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
     [refreshTokenExpired]: "Refresh token has expired.",
     [badToken]: "Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",
+    [uxNotAllowed]: "`canShowUI` flag in Edge was set to false. User interaction required on web page. Please invoke an interactive API to resolve.",
 };
 /**
  * Interaction required errors defined by the SDK
@@ -6469,7 +6536,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6541,16 +6608,14 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 const KeyLocation = {
-    SW: "sw",
-    UHW: "uhw",
-};
+    SW: "sw"};
 /** @internal */
 class PopTokenGenerator {
     constructor(cryptoUtils, performanceClient) {
@@ -6625,7 +6690,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6652,7 +6717,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6765,7 +6830,7 @@ class ResponseHandler {
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key);
+                const account = this.cacheStorage.getAccount(key, request.correlationId);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
@@ -6800,7 +6865,7 @@ class ResponseHandler {
         let cachedAccount;
         if (serverTokenResponse.id_token && !!idTokenClaims) {
             cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
-            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
             this.logger);
         }
         // AccessToken
@@ -6949,7 +7014,7 @@ class ResponseHandler {
         };
     }
 }
-function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
     logger?.verbose("setCachedAccount called");
     // Check if base account is already cached
     const accountKeys = cacheStorage.getAccountKeys();
@@ -6958,7 +7023,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     });
     let cachedAccount = null;
     if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey);
+        cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId);
     }
     const baseAccount = cachedAccount ||
         AccountEntity.createAccount({
@@ -6983,7 +7048,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7050,7 +7115,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7068,7 +7133,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7301,7 +7366,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7374,7 +7439,7 @@ class RefreshTokenClient extends BaseClient {
     async acquireTokenWithCachedRefreshToken(request, foci) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
         // fetches family RT or application RT based on FOCI value
-        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
+        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined, this.performanceClient);
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(noTokensFound);
         }
@@ -7404,7 +7469,7 @@ class RefreshTokenClient extends BaseClient {
                     // Remove bad refresh token from cache
                     this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
                     const badRefreshTokenKey = generateCredentialKey(refreshToken);
-                    this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+                    this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
                 }
             }
             throw e;
@@ -7510,7 +7575,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7542,7 +7607,7 @@ class SilentFlowClient extends BaseClient {
         const requestTenantId = request.account.tenantId ||
             getTenantFromAuthorityString(request.authority);
         const tokenKeys = this.cacheManager.getTokenKeys();
-        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);
+        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
         if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
@@ -7562,9 +7627,9 @@ class SilentFlowClient extends BaseClient {
         }
         const environment = request.authority || this.authority.getPreferredCache();
         const cacheRecord = {
-            account: this.cacheManager.readAccountFromCache(request.account),
+            account: this.cacheManager.readAccountFromCache(request.account, request.correlationId),
             accessToken: cachedAccessToken,
-            idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),
+            idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId, this.performanceClient),
             refreshToken: null,
             appMetadata: this.cacheManager.readAppMetadataFromCache(environment),
         };
@@ -7608,7 +7673,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7623,7 +7688,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7847,7 +7912,7 @@ function extractLoginHint(account) {
     return account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7905,7 +7970,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8044,7 +8109,7 @@ class ServerTelemetryManager {
         else {
             lastRequests.errors.push(SERVER_TELEM_CONSTANTS.UNKNOWN_ERROR);
         }
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return;
     }
     /**
@@ -8053,7 +8118,7 @@ class ServerTelemetryManager {
     incrementCacheHits() {
         const lastRequests = this.getLastRequests();
         lastRequests.cacheHits += 1;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return lastRequests.cacheHits;
     }
     /**
@@ -8077,7 +8142,7 @@ class ServerTelemetryManager {
         const errorCount = lastRequests.errors.length;
         if (numErrorsFlushed === errorCount) {
             // All errors were sent on last request, clear Telemetry cache
-            this.cacheManager.removeItem(this.telemetryCacheKey);
+            this.cacheManager.removeItem(this.telemetryCacheKey, this.correlationId);
         }
         else {
             // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
@@ -8086,7 +8151,7 @@ class ServerTelemetryManager {
                 errors: lastRequests.errors.slice(numErrorsFlushed),
                 cacheHits: 0,
             };
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity, this.correlationId);
         }
     }
     /**
@@ -8153,7 +8218,7 @@ class ServerTelemetryManager {
     setNativeBrokerErrorCode(errorCode) {
         const lastRequests = this.getLastRequests();
         lastRequests.nativeBrokerErrorCode = errorCode;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
     }
     getNativeBrokerErrorCode() {
         return this.getLastRequests().nativeBrokerErrorCode;
@@ -8161,14 +8226,14 @@ class ServerTelemetryManager {
     clearNativeBrokerErrorCode() {
         const lastRequests = this.getLastRequests();
         delete lastRequests.nativeBrokerErrorCode;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
     }
     static makeExtraSkuString(params) {
         return makeExtraSkuString(params);
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8176,7 +8241,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8201,7 +8266,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8241,86 +8306,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v15.7.0 2025-06-10 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class StubPerformanceMeasurement {
-    startMeasurement() {
-        return;
-    }
-    endMeasurement() {
-        return;
-    }
-    flushMeasurement() {
-        return null;
-    }
-}
-class StubPerformanceClient {
-    generateId() {
-        return "callback-id";
-    }
-    startMeasurement(measureName, correlationId) {
-        return {
-            end: () => null,
-            discard: () => { },
-            add: () => { },
-            increment: () => { },
-            event: {
-                eventId: this.generateId(),
-                status: PerformanceEventStatus.InProgress,
-                authority: "",
-                libraryName: "",
-                libraryVersion: "",
-                clientId: "",
-                name: measureName,
-                startTimeMs: Date.now(),
-                correlationId: correlationId || "",
-            },
-            measurement: new StubPerformanceMeasurement(),
-        };
-    }
-    startPerformanceMeasurement() {
-        return new StubPerformanceMeasurement();
-    }
-    calculateQueuedTime() {
-        return 0;
-    }
-    addQueueMeasurement() {
-        return;
-    }
-    setPreQueueTime() {
-        return;
-    }
-    endMeasurement() {
-        return null;
-    }
-    discardMeasurements() {
-        return;
-    }
-    removePerformanceCallback() {
-        return true;
-    }
-    addPerformanceCallback() {
-        return "";
-    }
-    emitEvents() {
-        return;
-    }
-    addFields() {
-        return;
-    }
-    incrementFields() {
-        return;
-    }
-    cacheEventByCorrelationId() {
-        return;
-    }
-}
-
-/*! @azure/msal-common v15.7.0 2025-06-10 */
+/*! @azure/msal-common v15.8.0 2025-07-01 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8982,7 +8968,8 @@ const invalidBase64String = "invalid_base64_string";
 const invalidPopTokenRequest = "invalid_pop_token_request";
 const failedToBuildHeaders = "failed_to_build_headers";
 const failedToParseHeaders = "failed_to_parse_headers";
-const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
+const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
+const timedOut = "timed_out";
 
 var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -9030,6 +9017,7 @@ var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     silentPromptValueError: silentPromptValueError,
     spaCodeAndNativeAccountIdPresent: spaCodeAndNativeAccountIdPresent,
     stateInteractionTypeMismatch: stateInteractionTypeMismatch,
+    timedOut: timedOut,
     unableToAcquireTokenFromNativePlatform: unableToAcquireTokenFromNativePlatform,
     unableToLoadToken: unableToLoadToken,
     unableToParseState: unableToParseState,
@@ -9097,6 +9085,7 @@ const BrowserAuthErrorMessages = {
     [failedToBuildHeaders]: "Failed to build request headers object.",
     [failedToParseHeaders]: "Failed to parse response headers",
     [failedToDecryptEarResponse]: "Failed to decrypt ear response",
+    [timedOut]: "The request timed out.",
 };
 /**
  * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9310,10 +9299,6 @@ function createBrowserAuthError(errorCode, subError) {
  * Constants
  */
 const BrowserConstants = {
-    /**
-     * Interaction in progress cache value
-     */
-    INTERACTION_IN_PROGRESS_VALUE: "interaction_in_progress",
     /**
      * Invalid grant error code
      */
@@ -10165,9 +10150,9 @@ class NavigationClient {
         else {
             window.location.assign(url); // CodeQL [SM03712] Application owner controls the URL. User can't change it.
         }
-        return new Promise((resolve) => {
+        return new Promise((resolve, reject) => {
             setTimeout(() => {
-                resolve(true);
+                reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
             }, options.timeout);
         });
     }
@@ -10425,7 +10410,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.13.1";
+const version = "4.14.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11269,7 +11254,9 @@ class CryptoOps {
     async removeTokenBindingKey(kid) {
         await this.cache.removeItem(kid);
         const keyFound = await this.cache.containsKey(kid);
-        return !keyFound;
+        if (keyFound) {
+            throw createClientAuthError(bindingKeyNotRemoved);
+        }
     }
     /**
      * Removes all cryptographic keys from IndexedDB storage
@@ -11536,7 +11523,7 @@ class LocalStorage {
     setItem(key, value) {
         window.localStorage.setItem(key, value);
     }
-    async setUserData(key, value, correlationId) {
+    async setUserData(key, value, correlationId, timestamp) {
         if (!this.initialized || !this.encryptionCookie) {
             throw createBrowserAuthError(uninitializedPublicClientApplication);
         }
@@ -11545,6 +11532,7 @@ class LocalStorage {
             id: this.encryptionCookie.id,
             nonce: nonce,
             data: data,
+            lastUpdatedAt: timestamp,
         };
         this.memoryStorage.setItem(key, value);
         this.setItem(key, JSON.stringify(encryptedData));
@@ -11791,14 +11779,13 @@ const EventType = {
  */
 class BrowserCacheManager extends CacheManager {
     constructor(clientId, cacheConfig, cryptoImpl, logger, performanceClient, eventHandler, staticAuthorityOptions) {
-        super(clientId, cryptoImpl, logger, staticAuthorityOptions);
+        super(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions);
         this.cacheConfig = cacheConfig;
         this.logger = logger;
         this.internalStorage = new MemoryStorage();
         this.browserStorage = getStorageImplementation(clientId, cacheConfig.cacheLocation, logger, performanceClient);
         this.temporaryCacheStorage = getStorageImplementation(clientId, cacheConfig.temporaryCacheLocation, logger, performanceClient);
         this.cookieStorage = new CookieStorage();
-        this.performanceClient = performanceClient;
         this.eventHandler = eventHandler;
     }
     async initialize(correlationId) {
@@ -11815,7 +11802,7 @@ class BrowserCacheManager extends CacheManager {
             this.performanceClient.addFields({ previousLibraryVersion: previousVersion }, correlationId);
         }
         if (previousVersion !== version) {
-            this.browserStorage.setItem(StaticCacheKeys.VERSION, version);
+            this.setItem(StaticCacheKeys.VERSION, version, correlationId);
         }
     }
     /**
@@ -11839,22 +11826,111 @@ class BrowserCacheManager extends CacheManager {
             return null;
         }
     }
+    /**
+     * Helper to setItem in browser storage, with cleanup in case of quota errors
+     * @param key
+     * @param value
+     */
+    setItem(key, value, correlationId) {
+        let accessTokenKeys = [];
+        const maxRetries = 20;
+        for (let i = 0; i <= maxRetries; i++) {
+            try {
+                this.browserStorage.setItem(key, value);
+                if (i > 0) {
+                    // Finally update the token keys array with the tokens removed
+                    this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId);
+                }
+                break; // If setItem succeeds, exit the loop
+            }
+            catch (e) {
+                const cacheError = createCacheError(e);
+                if (cacheError.errorCode ===
+                    cacheQuotaExceeded &&
+                    i < maxRetries) {
+                    if (!accessTokenKeys.length) {
+                        if (key ===
+                            `${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`) {
+                            // If we are currently trying to set the token keys, use the value we're trying to set
+                            accessTokenKeys = JSON.parse(value)
+                                .accessToken;
+                        }
+                        else {
+                            // If token keys have not been initialized, get them
+                            accessTokenKeys = this.getTokenKeys().accessToken;
+                        }
+                    }
+                    if (accessTokenKeys.length <= i) {
+                        // Nothing to remove, rethrow the error
+                        throw cacheError;
+                    }
+                    // When cache quota is exceeded, start removing access tokens until we can successfully set the item
+                    this.removeAccessToken(accessTokenKeys[i], correlationId, false // Don't save token keys yet, do it at the end
+                    );
+                }
+                else {
+                    // If the error is not a quota exceeded error, rethrow it
+                    throw cacheError;
+                }
+            }
+        }
+    }
+    /**
+     * Helper to setUserData in browser storage, with cleanup in case of quota errors
+     * @param key
+     * @param value
+     * @param correlationId
+     */
+    async setUserData(key, value, correlationId, timestamp) {
+        let accessTokenKeys = [];
+        const maxRetries = 20;
+        for (let i = 0; i <= maxRetries; i++) {
+            try {
+                await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, value, correlationId, timestamp);
+                if (i > 0) {
+                    // Finally update the token keys array with the tokens removed
+                    this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId);
+                }
+                break; // If setItem succeeds, exit the loop
+            }
+            catch (e) {
+                const cacheError = createCacheError(e);
+                if (cacheError.errorCode ===
+                    cacheQuotaExceeded &&
+                    i < maxRetries) {
+                    if (!accessTokenKeys.length) {
+                        accessTokenKeys = this.getTokenKeys().accessToken;
+                    }
+                    if (accessTokenKeys.length <= i) {
+                        // Nothing left to remove, rethrow the error
+                        throw cacheError;
+                    }
+                    // When cache quota is exceeded, start removing access tokens until we can successfully set the item
+                    this.removeAccessToken(accessTokenKeys[i], correlationId, false // Don't save token keys yet, do it at the end
+                    );
+                }
+                else {
+                    // If the error is not a quota exceeded error, rethrow it
+                    throw cacheError;
+                }
+            }
+        }
+    }
     /**
      * Reads account from cache, deserializes it into an account entity and returns it.
      * If account is not found from the key, returns null and removes key from map.
      * @param accountKey
      * @returns
      */
-    getAccount(accountKey) {
+    getAccount(accountKey, correlationId) {
         this.logger.trace("BrowserCacheManager.getAccount called");
         const serializedAccount = this.browserStorage.getUserData(accountKey);
         if (!serializedAccount) {
-            this.removeAccountKeyFromMap(accountKey);
+            this.removeAccountKeyFromMap(accountKey, correlationId);
             return null;
         }
         const parsedAccount = this.validateAndParseJson(serializedAccount);
         if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
-            this.removeAccountKeyFromMap(accountKey);
             return null;
         }
         return CacheManager.toObject(new AccountEntity(), parsedAccount);
@@ -11866,8 +11942,10 @@ class BrowserCacheManager extends CacheManager {
     async setAccount(account, correlationId) {
         this.logger.trace("BrowserCacheManager.setAccount called");
         const key = account.generateAccountKey();
-        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, JSON.stringify(account), correlationId);
-        const wasAdded = this.addAccountKeyToMap(key);
+        const timestamp = Date.now().toString();
+        account.lastUpdatedAt = timestamp;
+        await this.setUserData(key, JSON.stringify(account), correlationId, timestamp);
+        const wasAdded = this.addAccountKeyToMap(key, correlationId);
         /**
          * @deprecated - Remove this in next major version in favor of more consistent LOGIN event
          */
@@ -11888,14 +11966,14 @@ class BrowserCacheManager extends CacheManager {
      * Add a new account to the key map
      * @param key
      */
-    addAccountKeyToMap(key) {
+    addAccountKeyToMap(key, correlationId) {
         this.logger.trace("BrowserCacheManager.addAccountKeyToMap called");
         this.logger.tracePii(`BrowserCacheManager.addAccountKeyToMap called with key: ${key}`);
         const accountKeys = this.getAccountKeys();
         if (accountKeys.indexOf(key) === -1) {
             // Only add key if it does not already exist in the map
             accountKeys.push(key);
-            this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
             this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
             return true;
         }
@@ -11908,14 +11986,21 @@ class BrowserCacheManager extends CacheManager {
      * Remove an account from the key map
      * @param key
      */
-    removeAccountKeyFromMap(key) {
+    removeAccountKeyFromMap(key, correlationId) {
         this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called");
         this.logger.tracePii(`BrowserCacheManager.removeAccountKeyFromMap called with key: ${key}`);
         const accountKeys = this.getAccountKeys();
         const removalIndex = accountKeys.indexOf(key);
         if (removalIndex > -1) {
             accountKeys.splice(removalIndex, 1);
-            this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            if (accountKeys.length === 0) {
+                // If no keys left, remove the map
+                this.removeItem(StaticCacheKeys.ACCOUNT_KEYS);
+                return;
+            }
+            else {
+                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
+            }
             this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
         }
         else {
@@ -11926,16 +12011,16 @@ class BrowserCacheManager extends CacheManager {
      * Extends inherited removeAccount function to include removal of the account key from the map
      * @param key
      */
-    async removeAccount(key) {
-        void super.removeAccount(key);
-        this.removeAccountKeyFromMap(key);
+    removeAccount(key, correlationId) {
+        super.removeAccount(key, correlationId);
+        this.removeAccountKeyFromMap(key, correlationId);
     }
     /**
      * Removes credentials associated with the provided account
      * @param account
      */
-    async removeAccountContext(account) {
-        await super.removeAccountContext(account);
+    removeAccountContext(account, correlationId) {
+        super.removeAccountContext(account, correlationId);
         /**
          * @deprecated - Remove this in next major version in favor of more consistent LOGOUT event
          */
@@ -11947,25 +12032,60 @@ class BrowserCacheManager extends CacheManager {
      * Removes given idToken from the cache and from the key map
      * @param key
      */
-    removeIdToken(key) {
-        super.removeIdToken(key);
-        this.removeTokenKey(key, CredentialType.ID_TOKEN);
+    removeIdToken(key, correlationId) {
+        super.removeIdToken(key, correlationId);
+        const tokenKeys = this.getTokenKeys();
+        const idRemoval = tokenKeys.idToken.indexOf(key);
+        if (idRemoval > -1) {
+            this.logger.info("idToken removed from tokenKeys map");
+            tokenKeys.idToken.splice(idRemoval, 1);
+            this.setTokenKeys(tokenKeys, correlationId);
+        }
     }
     /**
      * Removes given accessToken from the cache and from the key map
      * @param key
      */
-    async removeAccessToken(key) {
-        void super.removeAccessToken(key);
-        this.removeTokenKey(key, CredentialType.ACCESS_TOKEN);
+    removeAccessToken(key, correlationId, updateTokenKeys = true) {
+        super.removeAccessToken(key, correlationId);
+        updateTokenKeys && this.removeAccessTokenKeys([key], correlationId);
+    }
+    /**
+     * Remove access token key from the key map
+     * @param key
+     * @param correlationId
+     * @param tokenKeys
+     */
+    removeAccessTokenKeys(keys, correlationId) {
+        this.logger.trace("removeAccessTokenKey called");
+        const tokenKeys = this.getTokenKeys();
+        let keysRemoved = 0;
+        keys.forEach((key) => {
+            const accessRemoval = tokenKeys.accessToken.indexOf(key);
+            if (accessRemoval > -1) {
+                tokenKeys.accessToken.splice(accessRemoval, 1);
+                keysRemoved++;
+            }
+        });
+        if (keysRemoved > 0) {
+            this.logger.info(`removed ${keysRemoved} accessToken keys from tokenKeys map`);
+            this.setTokenKeys(tokenKeys, correlationId);
+            return;
+        }
     }
     /**
      * Removes given refreshToken from the cache and from the key map
      * @param key
      */
-    removeRefreshToken(key) {
-        super.removeRefreshToken(key);
-        this.removeTokenKey(key, CredentialType.REFRESH_TOKEN);
+    removeRefreshToken(key, correlationId) {
+        super.removeRefreshToken(key, correlationId);
+        const tokenKeys = this.getTokenKeys();
+        const refreshRemoval = tokenKeys.refreshToken.indexOf(key);
+        if (refreshRemoval > -1) {
+            this.logger.info("refreshToken removed from tokenKeys map");
+            tokenKeys.refreshToken.splice(refreshRemoval, 1);
+            this.setTokenKeys(tokenKeys, correlationId);
+        }
     }
     /**
      * Gets the keys for the cached tokens associated with this clientId
@@ -11975,101 +12095,37 @@ class BrowserCacheManager extends CacheManager {
         return getTokenKeys(this.clientId, this.browserStorage);
     }
     /**
-     * Adds the given key to the token key map
-     * @param key
-     * @param type
+     * Stores the token keys in the cache
+     * @param tokenKeys
+     * @param correlationId
+     * @returns
      */
-    addTokenKey(key, type) {
-        this.logger.trace("BrowserCacheManager addTokenKey called");
-        const tokenKeys = this.getTokenKeys();
-        switch (type) {
-            case CredentialType.ID_TOKEN:
-                if (tokenKeys.idToken.indexOf(key) === -1) {
-                    this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
-                    tokenKeys.idToken.push(key);
-                }
-                break;
-            case CredentialType.ACCESS_TOKEN:
-                if (tokenKeys.accessToken.indexOf(key) === -1) {
-                    this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map");
-                    tokenKeys.accessToken.push(key);
-                }
-                break;
-            case CredentialType.REFRESH_TOKEN:
-                if (tokenKeys.refreshToken.indexOf(key) === -1) {
-                    this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
-                    tokenKeys.refreshToken.push(key);
-                }
-                break;
-            default:
-                this.logger.error(`BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
-                throw createClientAuthError(unexpectedCredentialType);
+    setTokenKeys(tokenKeys, correlationId) {
+        if (tokenKeys.idToken.length === 0 &&
+            tokenKeys.accessToken.length === 0 &&
+            tokenKeys.refreshToken.length === 0) {
+            // If no keys left, remove the map
+            this.removeItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
+            return;
         }
-        this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
-    }
-    /**
-     * Removes the given key from the token key map
-     * @param key
-     * @param type
-     */
-    removeTokenKey(key, type) {
-        this.logger.trace("BrowserCacheManager removeTokenKey called");
-        const tokenKeys = this.getTokenKeys();
-        switch (type) {
-            case CredentialType.ID_TOKEN:
-                this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: ${key} from map`);
-                const idRemoval = tokenKeys.idToken.indexOf(key);
-                if (idRemoval > -1) {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - idToken removed from map");
-                    tokenKeys.idToken.splice(idRemoval, 1);
-                }
-                else {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - idToken does not exist in map. Either it was previously removed or it was never added.");
-                }
-                break;
-            case CredentialType.ACCESS_TOKEN:
-                this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove accessToken with key: ${key} from map`);
-                const accessRemoval = tokenKeys.accessToken.indexOf(key);
-                if (accessRemoval > -1) {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - accessToken removed from map");
-                    tokenKeys.accessToken.splice(accessRemoval, 1);
-                }
-                else {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - accessToken does not exist in map. Either it was previously removed or it was never added.");
-                }
-                break;
-            case CredentialType.REFRESH_TOKEN:
-                this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove refreshToken with key: ${key} from map`);
-                const refreshRemoval = tokenKeys.refreshToken.indexOf(key);
-                if (refreshRemoval > -1) {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken removed from map");
-                    tokenKeys.refreshToken.splice(refreshRemoval, 1);
-                }
-                else {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken does not exist in map. Either it was previously removed or it was never added.");
-                }
-                break;
-            default:
-                this.logger.error(`BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
-                throw createClientAuthError(unexpectedCredentialType);
+        else {
+            this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys), correlationId);
         }
-        this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
     }
     /**
      * generates idToken entity from a string
      * @param idTokenKey
      */
-    getIdTokenCredential(idTokenKey) {
+    getIdTokenCredential(idTokenKey, correlationId) {
         const value = this.browserStorage.getUserData(idTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+            this.removeIdToken(idTokenKey, correlationId);
             return null;
         }
         const parsedIdToken = this.validateAndParseJson(value);
         if (!parsedIdToken || !isIdTokenEntity(parsedIdToken)) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit");
@@ -12082,25 +12138,31 @@ class BrowserCacheManager extends CacheManager {
     async setIdTokenCredential(idToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
         const idTokenKey = generateCredentialKey(idToken);
-        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(idTokenKey, JSON.stringify(idToken), correlationId);
-        this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+        const timestamp = Date.now().toString();
+        idToken.lastUpdatedAt = timestamp;
+        await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp);
+        const tokenKeys = this.getTokenKeys();
+        if (tokenKeys.idToken.indexOf(idTokenKey) === -1) {
+            this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
+            tokenKeys.idToken.push(idTokenKey);
+            this.setTokenKeys(tokenKeys, correlationId);
+        }
     }
     /**
      * generates accessToken entity from a string
      * @param key
      */
-    getAccessTokenCredential(accessTokenKey) {
+    getAccessTokenCredential(accessTokenKey, correlationId) {
         const value = this.browserStorage.getUserData(accessTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+            this.removeAccessTokenKeys([accessTokenKey], correlationId);
             return null;
         }
         const parsedAccessToken = this.validateAndParseJson(value);
         if (!parsedAccessToken ||
             !isAccessTokenEntity(parsedAccessToken)) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit");
@@ -12113,25 +12175,33 @@ class BrowserCacheManager extends CacheManager {
     async setAccessTokenCredential(accessToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
         const accessTokenKey = generateCredentialKey(accessToken);
-        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(accessTokenKey, JSON.stringify(accessToken), correlationId);
-        this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+        const timestamp = Date.now().toString();
+        accessToken.lastUpdatedAt = timestamp;
+        await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp);
+        const tokenKeys = this.getTokenKeys();
+        const index = tokenKeys.accessToken.indexOf(accessTokenKey);
+        if (index !== -1) {
+            tokenKeys.accessToken.splice(index, 1); // Remove existing key before pushing to the end
+        }
+        this.logger.trace(`access token ${index === -1 ? "added to" : "updated in"} map`);
+        tokenKeys.accessToken.push(accessTokenKey);
+        this.setTokenKeys(tokenKeys, correlationId);
     }
     /**
      * generates refreshToken entity from a string
      * @param refreshTokenKey
      */
-    getRefreshTokenCredential(refreshTokenKey) {
+    getRefreshTokenCredential(refreshTokenKey, correlationId) {
         const value = this.browserStorage.getUserData(refreshTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+            this.removeRefreshToken(refreshTokenKey, correlationId);
             return null;
         }
         const parsedRefreshToken = this.validateAndParseJson(value);
         if (!parsedRefreshToken ||
             !isRefreshTokenEntity(parsedRefreshToken)) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit");
@@ -12144,8 +12214,15 @@ class BrowserCacheManager extends CacheManager {
     async setRefreshTokenCredential(refreshToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
         const refreshTokenKey = generateCredentialKey(refreshToken);
-        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(refreshTokenKey, JSON.stringify(refreshToken), correlationId);
-        this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+        const timestamp = Date.now().toString();
+        refreshToken.lastUpdatedAt = timestamp;
+        await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp);
+        const tokenKeys = this.getTokenKeys();
+        if (tokenKeys.refreshToken.indexOf(refreshTokenKey) === -1) {
+            this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
+            tokenKeys.refreshToken.push(refreshTokenKey);
+            this.setTokenKeys(tokenKeys, correlationId);
+        }
     }
     /**
      * fetch appMetadata entity from the platform cache
@@ -12170,10 +12247,10 @@ class BrowserCacheManager extends CacheManager {
      * set appMetadata entity to the platform cache
      * @param appMetadata
      */
-    setAppMetadata(appMetadata) {
+    setAppMetadata(appMetadata, correlationId) {
         this.logger.trace("BrowserCacheManager.setAppMetadata called");
         const appMetadataKey = generateAppMetadataKey(appMetadata);
-        this.browserStorage.setItem(appMetadataKey, JSON.stringify(appMetadata));
+        this.setItem(appMetadataKey, JSON.stringify(appMetadata), correlationId);
     }
     /**
      * fetch server telemetry entity from the platform cache
@@ -12199,9 +12276,9 @@ class BrowserCacheManager extends CacheManager {
      * @param serverTelemetryKey
      * @param serverTelemetry
      */
-    setServerTelemetry(serverTelemetryKey, serverTelemetry) {
+    setServerTelemetry(serverTelemetryKey, serverTelemetry, correlationId) {
         this.logger.trace("BrowserCacheManager.setServerTelemetry called");
-        this.browserStorage.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry));
+        this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry), correlationId);
     }
     /**
      *
@@ -12259,7 +12336,7 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Gets the active account
      */
-    getActiveAccount() {
+    getActiveAccount(correlationId) {
         const activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
         const activeAccountValueFilters = this.browserStorage.getItem(activeAccountKeyFilters);
         if (!activeAccountValueFilters) {
@@ -12273,7 +12350,7 @@ class BrowserCacheManager extends CacheManager {
                 homeAccountId: activeAccountValueObj.homeAccountId,
                 localAccountId: activeAccountValueObj.localAccountId,
                 tenantId: activeAccountValueObj.tenantId,
-            });
+            }, correlationId);
         }
         this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found");
         return null;
@@ -12282,7 +12359,7 @@ class BrowserCacheManager extends CacheManager {
      * Sets the active account's localAccountId in cache
      * @param account
      */
-    setActiveAccount(account) {
+    setActiveAccount(account, correlationId) {
         const activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
         if (account) {
             this.logger.verbose("setActiveAccount: Active account set");
@@ -12290,8 +12367,9 @@ class BrowserCacheManager extends CacheManager {
                 homeAccountId: account.homeAccountId,
                 localAccountId: account.localAccountId,
                 tenantId: account.tenantId,
+                lastUpdatedAt: nowSeconds().toString(),
             };
-            this.browserStorage.setItem(activeAccountKey, JSON.stringify(activeAccountValue));
+            this.setItem(activeAccountKey, JSON.stringify(activeAccountValue), correlationId);
         }
         else {
             this.logger.verbose("setActiveAccount: No account passed, active account not set");
@@ -12323,9 +12401,9 @@ class BrowserCacheManager extends CacheManager {
      * @param throttlingCacheKey
      * @param throttlingCache
      */
-    setThrottlingCache(throttlingCacheKey, throttlingCache) {
+    setThrottlingCache(throttlingCacheKey, throttlingCache, correlationId) {
         this.logger.trace("BrowserCacheManager.setThrottlingCache called");
-        this.browserStorage.setItem(throttlingCacheKey, JSON.stringify(throttlingCache));
+        this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache), correlationId);
     }
     /**
      * Gets cache item with given key.
@@ -12401,10 +12479,10 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Clears all cache entries created by MSAL.
      */
-    async clear() {
+    clear(correlationId) {
         // Removes all accounts and their credentials
-        await this.removeAllAccounts();
-        this.removeAppMetadata();
+        this.removeAllAccounts(correlationId);
+        this.removeAppMetadata(correlationId);
         // Remove temp storage first to make sure any cookies are cleared
         this.temporaryCacheStorage.getKeys().forEach((cacheKey) => {
             if (cacheKey.indexOf(Constants.CACHE_PREFIX) !== -1 ||
@@ -12427,22 +12505,22 @@ class BrowserCacheManager extends CacheManager {
      * @param correlationId {string} correlation id
      * @returns
      */
-    async clearTokensAndKeysWithClaims(performanceClient, correlationId) {
-        performanceClient.addQueueMeasurement(PerformanceEvents.ClearTokensAndKeysWithClaims, correlationId);
+    clearTokensAndKeysWithClaims(correlationId) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.ClearTokensAndKeysWithClaims, correlationId);
         const tokenKeys = this.getTokenKeys();
-        const removedAccessTokens = [];
+        let removedAccessTokens = 0;
         tokenKeys.accessToken.forEach((key) => {
             // if the access token has claims in its key, remove the token key and the token
-            const credential = this.getAccessTokenCredential(key);
+            const credential = this.getAccessTokenCredential(key, correlationId);
             if (credential?.requestedClaimsHash &&
                 key.includes(credential.requestedClaimsHash.toLowerCase())) {
-                removedAccessTokens.push(this.removeAccessToken(key));
+                this.removeAccessToken(key, correlationId);
+                removedAccessTokens++;
             }
         });
-        await Promise.all(removedAccessTokens);
         // warn if any access tokens are removed
-        if (removedAccessTokens.length > 0) {
-            this.logger.warning(`${removedAccessTokens.length} access tokens with claims in the cache keys have been removed from the cache.`);
+        if (removedAccessTokens > 0) {
+            this.logger.warning(`${removedAccessTokens} access tokens with claims in the cache keys have been removed from the cache.`);
         }
     }
     /**
@@ -12669,22 +12747,24 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient, even
  * @param accountFilter - (Optional) filter to narrow down the accounts returned
  * @returns Array of AccountInfo objects in cache
  */
-function getAllAccounts(logger, browserStorage, isInBrowser, accountFilter) {
+function getAllAccounts(logger, browserStorage, isInBrowser, correlationId, accountFilter) {
     logger.verbose("getAllAccounts called");
-    return isInBrowser ? browserStorage.getAllAccounts(accountFilter) : [];
+    return isInBrowser
+        ? browserStorage.getAllAccounts(accountFilter || {}, correlationId)
+        : [];
 }
 /**
  * Returns the first account found in the cache that matches the account filter passed in.
  * @param accountFilter
  * @returns The first account found in the cache matching the provided filter or null if no account could be found.
  */
-function getAccount(accountFilter, logger, browserStorage) {
+function getAccount(accountFilter, logger, browserStorage, correlationId) {
     logger.trace("getAccount called");
     if (Object.keys(accountFilter).length === 0) {
         logger.warning("getAccount: No accountFilter provided");
         return null;
     }
-    const account = browserStorage.getAccountInfoFilteredBy(accountFilter);
+    const account = browserStorage.getAccountInfoFilteredBy(accountFilter, correlationId);
     if (account) {
         logger.verbose("getAccount: Account matching provided filter found, returning");
         return account;
@@ -12702,7 +12782,7 @@ function getAccount(accountFilter, logger, browserStorage) {
  * @param username
  * @returns The account object stored in MSAL
  */
-function getAccountByUsername(username, logger, browserStorage) {
+function getAccountByUsername(username, logger, browserStorage, correlationId) {
     logger.trace("getAccountByUsername called");
     if (!username) {
         logger.warning("getAccountByUsername: No username provided");
@@ -12710,7 +12790,7 @@ function getAccountByUsername(username, logger, browserStorage) {
     }
     const account = browserStorage.getAccountInfoFilteredBy({
         username,
-    });
+    }, correlationId);
     if (account) {
         logger.verbose("getAccountByUsername: Account matching username found, returning");
         logger.verbosePii(`getAccountByUsername: Returning signed-in accounts matching username: ${username}`);
@@ -12728,7 +12808,7 @@ function getAccountByUsername(username, logger, browserStorage) {
  * @param homeAccountId
  * @returns The account object stored in MSAL
  */
-function getAccountByHomeId(homeAccountId, logger, browserStorage) {
+function getAccountByHomeId(homeAccountId, logger, browserStorage, correlationId) {
     logger.trace("getAccountByHomeId called");
     if (!homeAccountId) {
         logger.warning("getAccountByHomeId: No homeAccountId provided");
@@ -12736,7 +12816,7 @@ function getAccountByHomeId(homeAccountId, logger, browserStorage) {
     }
     const account = browserStorage.getAccountInfoFilteredBy({
         homeAccountId,
-    });
+    }, correlationId);
     if (account) {
         logger.verbose("getAccountByHomeId: Account matching homeAccountId found, returning");
         logger.verbosePii(`getAccountByHomeId: Returning signed-in accounts matching homeAccountId: ${homeAccountId}`);
@@ -12754,7 +12834,7 @@ function getAccountByHomeId(homeAccountId, logger, browserStorage) {
  * @param localAccountId
  * @returns The account object stored in MSAL
  */
-function getAccountByLocalId(localAccountId, logger, browserStorage) {
+function getAccountByLocalId(localAccountId, logger, browserStorage, correlationId) {
     logger.trace("getAccountByLocalId called");
     if (!localAccountId) {
         logger.warning("getAccountByLocalId: No localAccountId provided");
@@ -12762,7 +12842,7 @@ function getAccountByLocalId(localAccountId, logger, browserStorage) {
     }
     const account = browserStorage.getAccountInfoFilteredBy({
         localAccountId,
-    });
+    }, correlationId);
     if (account) {
         logger.verbose("getAccountByLocalId: Account matching localAccountId found, returning");
         logger.verbosePii(`getAccountByLocalId: Returning signed-in accounts matching localAccountId: ${localAccountId}`);
@@ -12777,14 +12857,14 @@ function getAccountByLocalId(localAccountId, logger, browserStorage) {
  * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
  * @param account
  */
-function setActiveAccount(account, browserStorage) {
-    browserStorage.setActiveAccount(account);
+function setActiveAccount(account, browserStorage, correlationId) {
+    browserStorage.setActiveAccount(account, correlationId);
 }
 /**
  * Gets the currently active account
  */
-function getActiveAccount(browserStorage) {
-    return browserStorage.getActiveAccount();
+function getActiveAccount(browserStorage, correlationId) {
+    return browserStorage.getActiveAccount(correlationId);
 }
 
 /*
@@ -12908,15 +12988,15 @@ class BaseInteractionClient {
         this.logger = logger.clone(BrowserConstants.MSAL_SKU, version, this.correlationId);
         this.performanceClient = performanceClient;
     }
-    async clearCacheOnLogout(account) {
+    async clearCacheOnLogout(correlationId, account) {
         if (account) {
-            if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(), false)) {
+            if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(correlationId), false)) {
                 this.logger.verbose("Setting active account to null");
-                this.browserStorage.setActiveAccount(null);
+                this.browserStorage.setActiveAccount(null, correlationId);
             }
             // Clear given account.
             try {
-                await this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account));
+                this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account), correlationId);
                 this.logger.verbose("Cleared cache items belonging to the account provided in the logout request.");
             }
             catch (error) {
@@ -12927,7 +13007,7 @@ class BaseInteractionClient {
             try {
                 this.logger.verbose("No account provided in logout request, clearing all cache items.", this.correlationId);
                 // Clear all accounts and tokens
-                await this.browserStorage.clear();
+                this.browserStorage.clear(correlationId);
                 // Clear any stray keys from IndexedDB
                 await this.browserCrypto.clearKeystore();
             }
@@ -13249,7 +13329,8 @@ class StandardInteractionClient extends BaseInteractionClient {
         if (request.loginHint || request.sid) {
             return validatedRequest;
         }
-        const account = request.account || this.browserStorage.getActiveAccount();
+        const account = request.account ||
+            this.browserStorage.getActiveAccount(this.correlationId);
         if (account) {
             this.logger.verbose("Setting validated request account", this.correlationId);
             this.logger.verbosePii(`Setting validated request account: ${account.homeAccountId}`, this.correlationId);
@@ -13429,7 +13510,8 @@ const USER_CANCEL = "USER_CANCEL";
 const NO_NETWORK = "NO_NETWORK";
 const PERSISTENT_ERROR = "PERSISTENT_ERROR";
 const DISABLED = "DISABLED";
-const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
+const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
+const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13487,6 +13569,8 @@ function createNativeAuthError(code, description, ext) {
                 return createBrowserAuthError(userCancelled);
             case NO_NETWORK:
                 return createBrowserAuthError(noNetworkConnectivity);
+            case UX_NOT_ALLOWED:
+                return createInteractionRequiredAuthError(uxNotAllowed);
         }
     }
     return new NativeAuthError(code, NativeAuthErrorMessages[code] || description, ext);
@@ -13536,7 +13620,7 @@ class SilentCacheClient extends StandardInteractionClient {
     logout(logoutRequest) {
         this.logger.verbose("logoutRedirect called");
         const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-        return this.clearCacheOnLogout(validLogoutRequest?.account);
+        return this.clearCacheOnLogout(validLogoutRequest.correlationId, validLogoutRequest?.account);
     }
 }
 
@@ -13660,7 +13744,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // fetch the account from browser cache
         const account = this.browserStorage.getBaseAccountInfo({
             nativeAccountId,
-        });
+        }, this.correlationId);
         if (!account) {
             throw createClientAuthError(noAccountFound);
         }
@@ -13776,7 +13860,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
         const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
             nativeAccountId: request.accountId,
-        })?.homeAccountId;
+        }, this.correlationId)?.homeAccountId;
         // add exception for double brokering, please note this is temporary and will be fortified in future
         if (request.extraParameters?.child_client_id &&
             response.account.id !== request.accountId) {
@@ -13791,7 +13875,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const authority = await this.getDiscoveredAuthority({
             requestAuthority: request.authority,
         });
-        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
+        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, undefined, // environment
         idTokenClaims.tid, undefined, // auth code payload
         response.account.id, this.logger);
         // Ensure expires_in is in number format
@@ -13799,7 +13883,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
-        await this.cacheAccount(baseAccount);
+        await this.cacheAccount(baseAccount, this.correlationId);
         await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
         return result;
     }
@@ -13923,13 +14007,11 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * cache the account entity in browser storage
      * @param accountEntity
      */
-    async cacheAccount(accountEntity) {
+    async cacheAccount(accountEntity, correlationId) {
         // Store the account info and hence `nativeAccountId` in browser cache
         await this.browserStorage.setAccount(accountEntity, this.correlationId);
         // Remove any existing cached tokens for this account in browser storage
-        this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
-            this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
-        });
+        this.browserStorage.removeAccountContext(accountEntity, correlationId);
     }
     /**
      * Stores the access_token and id_token in inmemory storage
@@ -14885,14 +14967,14 @@ function isDomEnabledForPlatformAuth() {
  * @param authenticationScheme
  */
 function isPlatformAuthAllowed(config, logger, platformAuthProvider, authenticationScheme) {
-    logger.trace("isBrokerAvailable called");
+    logger.trace("isPlatformAuthAllowed called");
     if (!config.system.allowPlatformBroker) {
-        logger.trace("isBrokerAvailable: allowPlatformBroker is not enabled, returning false");
+        logger.trace("isPlatformAuthAllowed: allowPlatformBroker is not enabled, returning false");
         // Developer disabled WAM
         return false;
     }
     if (!platformAuthProvider) {
-        logger.trace("isBrokerAvailable: Platform auth provider is not initialized, returning false");
+        logger.trace("isPlatformAuthAllowed: Platform auth provider is not initialized, returning false");
         // Platform broker auth providers are not available
         return false;
     }
@@ -14900,10 +14982,10 @@ function isPlatformAuthAllowed(config, logger, platformAuthProvider, authenticat
         switch (authenticationScheme) {
             case AuthenticationScheme.BEARER:
             case AuthenticationScheme.POP:
-                logger.trace("isBrokerAvailable: authenticationScheme is supported, returning true");
+                logger.trace("isPlatformAuthAllowed: authenticationScheme is supported, returning true");
                 return true;
             default:
-                logger.trace("isBrokerAvailable: authenticationScheme is not supported, returning false");
+                logger.trace("isPlatformAuthAllowed: authenticationScheme is not supported, returning false");
                 return false;
         }
     }
@@ -15099,7 +15181,7 @@ class PopupClient extends StandardInteractionClient {
         const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.logoutPopup);
         try {
             // Clear cache on logout
-            await this.clearCacheOnLogout(validRequest.account);
+            await this.clearCacheOnLogout(this.correlationId, validRequest.account);
             // Initialize the client
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
                 serverTelemetryManager,
@@ -15113,7 +15195,7 @@ class PopupClient extends StandardInteractionClient {
                 if (validRequest.account?.homeAccountId &&
                     validRequest.postLogoutRedirectUri &&
                     authClient.authority.protocolMode === ProtocolMode.OIDC) {
-                    void this.browserStorage.removeAccount(validRequest.account?.homeAccountId);
+                    this.browserStorage.removeAccount(validRequest.account?.homeAccountId, this.correlationId);
                     this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
                     if (mainWindowRedirectUri) {
                         const navigationOptions = {
@@ -15477,6 +15559,11 @@ class RedirectClient extends StandardInteractionClient {
         this.browserStorage.cacheAuthorizeRequest(redirectRequest);
         const form = await getEARForm(document, this.config, discoveredAuthority, redirectRequest, this.logger, this.performanceClient);
         form.submit();
+        return new Promise((resolve, reject) => {
+            setTimeout(() => {
+                reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
+            }, this.config.system.redirectNavigationTimeout);
+        });
     }
     /**
      * Checks if navigateToLoginRequestUrl is set, and:
@@ -15691,7 +15778,7 @@ class RedirectClient extends StandardInteractionClient {
         try {
             this.eventHandler.emitEvent(EventType.LOGOUT_START, exports.InteractionType.Redirect, logoutRequest);
             // Clear cache on logout
-            await this.clearCacheOnLogout(validLogoutRequest.account);
+            await this.clearCacheOnLogout(this.correlationId, validLogoutRequest.account);
             const navigationOptions = {
                 apiId: ApiId.logout,
                 timeout: this.config.system.redirectNavigationTimeout,
@@ -15709,7 +15796,7 @@ class RedirectClient extends StandardInteractionClient {
                 }
                 catch {
                     if (validLogoutRequest.account?.homeAccountId) {
-                        void this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId);
+                        this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId, this.correlationId);
                         this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Redirect, validLogoutRequest);
                         return;
                     }
@@ -16186,7 +16273,7 @@ class TokenCache {
         }
         const homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
         const claimsTenantId = idTokenClaims?.tid;
-        const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
+        const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
         undefined, // nativeAccountId
         this.logger);
         await this.storage.setAccount(cachedAccount, correlationId);
@@ -16549,7 +16636,7 @@ class StandardController {
         }
         if (!this.config.cache.claimsBasedCachingEnabled) {
             this.logger.verbose("Claims-based caching is disabled. Clearing the previous cache with claims");
-            await invokeAsync(this.browserStorage.clearTokensAndKeysWithClaims.bind(this.browserStorage), PerformanceEvents.ClearTokensAndKeysWithClaims, this.logger, this.performanceClient, initCorrelationId)(this.performanceClient, initCorrelationId);
+            invoke(this.browserStorage.clearTokensAndKeysWithClaims.bind(this.browserStorage), PerformanceEvents.ClearTokensAndKeysWithClaims, this.logger, this.performanceClient, initCorrelationId)(initCorrelationId);
         }
         this.config.system.asyncPopups &&
             (await this.preGeneratePkceCodes(initCorrelationId));
@@ -17224,7 +17311,8 @@ class StandardController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter) {
-        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, accountFilter);
+        const correlationId = this.getRequestCorrelationId();
+        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, correlationId, accountFilter);
     }
     /**
      * Returns the first account found in the cache that matches the account filter passed in.
@@ -17232,7 +17320,8 @@ class StandardController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter) {
-        return getAccount(accountFilter, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching username.
@@ -17243,7 +17332,8 @@ class StandardController {
      * @returns The account object stored in MSAL
      */
     getAccountByUsername(username) {
-        return getAccountByUsername(username, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching homeAccountId.
@@ -17253,7 +17343,8 @@ class StandardController {
      * @returns The account object stored in MSAL
      */
     getAccountByHomeId(homeAccountId) {
-        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching localAccountId.
@@ -17263,20 +17354,23 @@ class StandardController {
      * @returns The account object stored in MSAL
      */
     getAccountByLocalId(localAccountId) {
-        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
      * @param account
      */
     setActiveAccount(account) {
-        setActiveAccount(account, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        setActiveAccount(account, this.browserStorage, correlationId);
     }
     /**
      * Gets the currently active account
      */
     getActiveAccount() {
-        return getActiveAccount(this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getActiveAccount(this.browserStorage, correlationId);
     }
     // #endregion
     /**
@@ -17616,9 +17710,7 @@ class StandardController {
     async acquireTokenSilentDeduped(request, account, correlationId) {
         const thumbprint = getRequestThumbprint(this.config.auth.clientId, {
             ...request,
-            authority: request.authority || this.config.auth.authority,
-            correlationId: correlationId,
-        }, account.homeAccountId);
+            authority: request.authority || this.config.auth.authority}, account.homeAccountId);
         const silentRequestKey = JSON.stringify(thumbprint);
         const inProgressRequest = this.activeSilentTokenRequests.get(silentRequestKey);
         if (typeof inProgressRequest === "undefined") {
@@ -18280,8 +18372,9 @@ class NestedAppAuthController {
         // always prioritize the account context from the bridge
         const accountContext = this.bridgeProxy.getAccountContext() || this.currentAccountContext;
         let currentAccount = null;
+        const correlationId = request.correlationId || this.browserCrypto.createNewGuid();
         if (accountContext) {
-            currentAccount = getAccount(accountContext, this.logger, this.browserStorage);
+            currentAccount = getAccount(accountContext, this.logger, this.browserStorage, correlationId);
         }
         // fall back to brokering if no cached account is found
         if (!currentAccount) {
@@ -18299,7 +18392,7 @@ class NestedAppAuthController {
         };
         // fetch access token and check for expiry
         const tokenKeys = this.browserStorage.getTokenKeys();
-        const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+        const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId);
         // If there is no access token, log it and return null
         if (!cachedAccessToken) {
             this.logger.verbose("No cached access token found");
@@ -18310,7 +18403,7 @@ class NestedAppAuthController {
             this.logger.verbose("Cached access token has expired");
             return Promise.resolve(null);
         }
-        const cachedIdToken = this.browserStorage.getIdToken(currentAccount, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+        const cachedIdToken = this.browserStorage.getIdToken(currentAccount, authRequest.correlationId, tokenKeys, currentAccount.tenantId, this.performanceClient);
         if (!cachedIdToken) {
             this.logger.verbose("No cached id token found");
             return Promise.resolve(null);
@@ -18407,7 +18500,8 @@ class NestedAppAuthController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter) {
-        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), accountFilter);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), correlationId, accountFilter);
     }
     /**
      * Returns the first account found in the cache that matches the account filter passed in.
@@ -18415,7 +18509,8 @@ class NestedAppAuthController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter) {
-        return getAccount(accountFilter, this.logger, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching username.
@@ -18426,7 +18521,8 @@ class NestedAppAuthController {
      * @returns The account object stored in MSAL
      */
     getAccountByUsername(username) {
-        return getAccountByUsername(username, this.logger, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching homeAccountId.
@@ -18436,7 +18532,8 @@ class NestedAppAuthController {
      * @returns The account object stored in MSAL
      */
     getAccountByHomeId(homeAccountId) {
-        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching localAccountId.
@@ -18446,7 +18543,8 @@ class NestedAppAuthController {
      * @returns The account object stored in MSAL
      */
     getAccountByLocalId(localAccountId) {
-        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
@@ -18457,13 +18555,15 @@ class NestedAppAuthController {
          * StandardController uses this to allow the developer to set the active account
          * in the nested app auth scenario the active account is controlled by the app hosting the nested app
          */
-        return setActiveAccount(account, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return setActiveAccount(account, this.browserStorage, correlationId);
     }
     /**
      * Gets the currently active account
      */
     getActiveAccount() {
-        return getActiveAccount(this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getActiveAccount(this.browserStorage, correlationId);
     }
     // #endregion
     handleRedirectPromise(hash // eslint-disable-line @typescript-eslint/no-unused-vars
@@ -19812,7 +19912,20 @@ class SignedHttpRequest {
      * @returns If keys are properly deleted
      */
     async removeKeys(publicKeyThumbprint) {
-        return this.cryptoOps.removeTokenBindingKey(publicKeyThumbprint);
+        return this.cryptoOps
+            .removeTokenBindingKey(publicKeyThumbprint)
+            .then(() => true)
+            .catch((error) => {
+            /*
+             * @deprecated - To maintain public API signature, we return false if the error is due to the key still being present in indexedDB.
+             */
+            if (error instanceof ClientAuthError &&
+                error.errorCode ===
+                    bindingKeyNotRemoved) {
+                return false;
+            }
+            throw error;
+        });
     }
 }