@azure/msal-browser 4.13.1 → 4.14.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v4.13.1 2025-06-10 */
+/*! @azure/msal-browser v4.14.0 2025-07-01 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -151,7 +151,6 @@
      */
     const OAuthResponseType = {
         CODE: "code",
-        IDTOKEN_TOKEN: "id_token token",
         IDTOKEN_TOKEN_REFRESHTOKEN: "id_token token refresh_token",
     };
     /**
@@ -166,29 +165,19 @@
      * allowed values for response_mode
      */
     const ResponseMode = {
-        QUERY: "query",
-        FRAGMENT: "fragment",
-        FORM_POST: "form_post",
-    };
+        QUERY: "query"};
     /**
      * allowed grant_type
      */
     const GrantType = {
-        IMPLICIT_GRANT: "implicit",
         AUTHORIZATION_CODE_GRANT: "authorization_code",
-        CLIENT_CREDENTIALS_GRANT: "client_credentials",
-        RESOURCE_OWNER_PASSWORD_GRANT: "password",
-        REFRESH_TOKEN_GRANT: "refresh_token",
-        DEVICE_CODE_GRANT: "device_code",
-        JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-    };
+        REFRESH_TOKEN_GRANT: "refresh_token"};
     /**
      * Account types in Cache
      */
     const CacheAccountType = {
         MSSTS_ACCOUNT_TYPE: "MSSTS",
         ADFS_ACCOUNT_TYPE: "ADFS",
-        MSAV1_ACCOUNT_TYPE: "MSA",
         GENERIC_ACCOUNT_TYPE: "Generic", // NTLM, Kerberos, FBA, Basic etc
     };
     /**
@@ -225,7 +214,6 @@
     };
     const SERVER_TELEM_CONSTANTS = {
         SCHEMA_VERSION: 5,
-        MAX_CUR_HEADER_BYTES: 80,
         MAX_LAST_HEADER_BYTES: 330,
         MAX_CACHED_ERRORS: 50,
         CACHE_KEY: "server-telemetry",
@@ -273,9 +261,7 @@
      * Region Discovery Outcomes
      */
     const RegionDiscoveryOutcomes = {
-        CONFIGURED_MATCHES_DETECTED: "1",
         CONFIGURED_NO_AUTO_DETECTION: "2",
-        CONFIGURED_NOT_DETECTED: "3",
         AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
         AUTO_DETECTION_REQUESTED_FAILED: "5",
     };
@@ -302,7 +288,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -319,7 +305,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -368,7 +354,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -466,7 +452,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -718,7 +704,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -757,7 +743,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -948,12 +934,12 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "15.7.0";
+    const version$1 = "15.8.0";
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -973,7 +959,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1034,7 +1020,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1089,7 +1075,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1416,7 +1402,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1470,7 +1456,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1608,7 +1594,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1705,7 +1691,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1896,7 +1882,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1936,7 +1922,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2015,7 +2001,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2030,7 +2016,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2052,7 +2038,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2076,7 +2062,7 @@
         EAR: "EAR",
     };
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2319,7 +2305,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2384,7 +2370,7 @@
         return queryParameterArray.join("&");
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2548,7 +2534,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2579,7 +2565,6 @@
             },
         },
         instanceDiscoveryMetadata: {
-            tenant_discovery_endpoint: "https://{canonicalAuthority}/v2.0/.well-known/openid-configuration",
             metadata: [
                 {
                     preferred_network: "login.microsoftonline.com",
@@ -2688,42 +2673,60 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
-    const cacheUnknownErrorCode = "cache_error_unknown";
+    const cacheQuotaExceeded = "cache_quota_exceeded";
+    const cacheErrorUnknown = "cache_error_unknown";
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     const CacheErrorMessages = {
-        [cacheQuotaExceededErrorCode]: "Exceeded cache storage capacity.",
-        [cacheUnknownErrorCode]: "Unexpected error occurred when using cache storage.",
+        [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
+        [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
     };
     /**
      * Error thrown when there is an error with the cache
      */
-    class CacheError extends Error {
+    class CacheError extends AuthError {
         constructor(errorCode, errorMessage) {
             const message = errorMessage ||
                 (CacheErrorMessages[errorCode]
                     ? CacheErrorMessages[errorCode]
-                    : CacheErrorMessages[cacheUnknownErrorCode]);
+                    : CacheErrorMessages[cacheErrorUnknown]);
             super(`${errorCode}: ${message}`);
             Object.setPrototypeOf(this, CacheError.prototype);
             this.name = "CacheError";
             this.errorCode = errorCode;
             this.errorMessage = message;
         }
+    }
+    /**
+     * Helper function to wrap browser errors in a CacheError object
+     * @param e
+     * @returns
+     */
+    function createCacheError(e) {
+        if (!(e instanceof Error)) {
+            return new CacheError(cacheErrorUnknown);
+        }
+        if (e.name === "QuotaExceededError" ||
+            e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+            e.message.includes("exceeded the quota")) {
+            return new CacheError(cacheQuotaExceeded);
+        }
+        else {
+            return new CacheError(e.name, e.message);
+        }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2734,25 +2737,26 @@
      * @internal
      */
     class CacheManager {
-        constructor(clientId, cryptoImpl, logger, staticAuthorityOptions) {
+        constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
             this.clientId = clientId;
             this.cryptoImpl = cryptoImpl;
             this.commonLogger = logger.clone(name$1, version$1);
             this.staticAuthorityOptions = staticAuthorityOptions;
+            this.performanceClient = performanceClient;
         }
         /**
          * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
          * @param accountFilter - (Optional) filter to narrow down the accounts returned
          * @returns Array of AccountInfo objects in cache
          */
-        getAllAccounts(accountFilter) {
-            return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}), accountFilter);
+        getAllAccounts(accountFilter, correlationId) {
+            return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
         }
         /**
          * Gets first tenanted AccountInfo object found based on provided filters
          */
-        getAccountInfoFilteredBy(accountFilter) {
-            const allAccounts = this.getAllAccounts(accountFilter);
+        getAccountInfoFilteredBy(accountFilter, correlationId) {
+            const allAccounts = this.getAllAccounts(accountFilter, correlationId);
             if (allAccounts.length > 1) {
                 // If one or more accounts are found, prioritize accounts that have an ID token
                 const sortedAccounts = allAccounts.sort((account) => {
@@ -2773,8 +2777,8 @@
          * @param accountFilter
          * @returns
          */
-        getBaseAccountInfo(accountFilter) {
-            const accountEntities = this.getAccountsFilteredBy(accountFilter);
+        getBaseAccountInfo(accountFilter, correlationId) {
+            const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
             if (accountEntities.length > 0) {
                 return accountEntities[0].getAccountInfo();
             }
@@ -2789,12 +2793,12 @@
          * @param accountFilter
          * @returns Array of AccountInfo objects that match account and tenant profile filters
          */
-        buildTenantProfiles(cachedAccounts, accountFilter) {
+        buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
             return cachedAccounts.flatMap((accountEntity) => {
-                return this.getTenantProfilesFromAccountEntity(accountEntity, accountFilter?.tenantId, accountFilter);
+                return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
             });
         }
-        getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter) {
+        getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
             let tenantedAccountInfo = null;
             let idTokenClaims;
             if (tenantProfileFilter) {
@@ -2802,7 +2806,7 @@
                     return null;
                 }
             }
-            const idToken = this.getIdToken(accountInfo, tokenKeys, tenantProfile.tenantId);
+            const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
             if (idToken) {
                 idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
                 if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
@@ -2814,7 +2818,7 @@
             tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
             return tenantedAccountInfo;
         }
-        getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {
+        getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
             const accountInfo = accountEntity.getAccountInfo();
             let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
             const tokenKeys = this.getTokenKeys();
@@ -2834,7 +2838,7 @@
             }
             const matchingTenantProfiles = [];
             searchTenantProfiles.forEach((tenantProfile) => {
-                const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter);
+                const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter);
                 if (tenantedAccountInfo) {
                     matchingTenantProfiles.push(tenantedAccountInfo);
                 }
@@ -2908,26 +2912,16 @@
                     await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
                 }
                 if (!!cacheRecord.appMetadata) {
-                    this.setAppMetadata(cacheRecord.appMetadata);
+                    this.setAppMetadata(cacheRecord.appMetadata, correlationId);
                 }
             }
             catch (e) {
                 this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);
-                if (e instanceof Error) {
-                    this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e.message}`, correlationId);
-                    if (e.name === "QuotaExceededError" ||
-                        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
-                        e.message.includes("exceeded the quota")) {
-                        this.commonLogger?.error(`CacheManager.saveCacheRecord: exceeded storage quota`, correlationId);
-                        throw new CacheError(cacheQuotaExceededErrorCode);
-                    }
-                    else {
-                        throw new CacheError(e.name, e.message);
-                    }
+                if (e instanceof AuthError) {
+                    throw e;
                 }
                 else {
-                    this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e}`, correlationId);
-                    throw new CacheError(cacheUnknownErrorCode);
+                    throw createCacheError(e);
                 }
             }
         }
@@ -2947,21 +2941,19 @@
             };
             const tokenKeys = this.getTokenKeys();
             const currentScopes = ScopeSet.fromString(credential.target);
-            const removedAccessTokens = [];
             tokenKeys.accessToken.forEach((key) => {
                 if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                     return;
                 }
-                const tokenEntity = this.getAccessTokenCredential(key);
+                const tokenEntity = this.getAccessTokenCredential(key, correlationId);
                 if (tokenEntity &&
                     this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
                     const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
                     if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                        removedAccessTokens.push(this.removeAccessToken(key));
+                        this.removeAccessToken(key, correlationId);
                     }
                 }
             });
-            await Promise.all(removedAccessTokens);
             await this.setAccessTokenCredential(credential, correlationId);
         }
         /**
@@ -2969,7 +2961,7 @@
          * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
          * @param accountFilter - An object containing Account properties to filter by
          */
-        getAccountsFilteredBy(accountFilter) {
+        getAccountsFilteredBy(accountFilter, correlationId) {
             const allAccountKeys = this.getAccountKeys();
             const matchingAccounts = [];
             allAccountKeys.forEach((cacheKey) => {
@@ -2977,7 +2969,7 @@
                     // Don't parse value if the key doesn't match the account filters
                     return;
                 }
-                const entity = this.getAccount(cacheKey, this.commonLogger);
+                const entity = this.getAccount(cacheKey, correlationId);
                 // Match base account fields
                 if (!entity) {
                     return;
@@ -3203,86 +3195,80 @@
         /**
          * Removes all accounts and related tokens from cache.
          */
-        async removeAllAccounts() {
+        removeAllAccounts(correlationId) {
             const allAccountKeys = this.getAccountKeys();
-            const removedAccounts = [];
             allAccountKeys.forEach((cacheKey) => {
-                removedAccounts.push(this.removeAccount(cacheKey));
+                this.removeAccount(cacheKey, correlationId);
             });
-            await Promise.all(removedAccounts);
         }
         /**
          * Removes the account and related tokens for a given account key
          * @param account
          */
-        async removeAccount(accountKey) {
-            const account = this.getAccount(accountKey, this.commonLogger);
+        removeAccount(accountKey, correlationId) {
+            const account = this.getAccount(accountKey, correlationId);
             if (!account) {
                 return;
             }
-            await this.removeAccountContext(account);
-            this.removeItem(accountKey);
+            this.removeAccountContext(account, correlationId);
+            this.removeItem(accountKey, correlationId);
         }
         /**
          * Removes credentials associated with the provided account
          * @param account
          */
-        async removeAccountContext(account) {
+        removeAccountContext(account, correlationId) {
             const allTokenKeys = this.getTokenKeys();
             const accountId = account.generateAccountId();
-            const removedCredentials = [];
             allTokenKeys.idToken.forEach((key) => {
                 if (key.indexOf(accountId) === 0) {
-                    this.removeIdToken(key);
+                    this.removeIdToken(key, correlationId);
                 }
             });
             allTokenKeys.accessToken.forEach((key) => {
                 if (key.indexOf(accountId) === 0) {
-                    removedCredentials.push(this.removeAccessToken(key));
+                    this.removeAccessToken(key, correlationId);
                 }
             });
             allTokenKeys.refreshToken.forEach((key) => {
                 if (key.indexOf(accountId) === 0) {
-                    this.removeRefreshToken(key);
+                    this.removeRefreshToken(key, correlationId);
                 }
             });
-            await Promise.all(removedCredentials);
         }
         /**
-         * returns a boolean if the given credential is removed
-         * @param credential
+         * Removes accessToken from the cache
+         * @param key
+         * @param correlationId
          */
-        async removeAccessToken(key) {
-            const credential = this.getAccessTokenCredential(key);
-            if (!credential) {
+        removeAccessToken(key, correlationId) {
+            const credential = this.getAccessTokenCredential(key, correlationId);
+            this.removeItem(key, correlationId);
+            this.performanceClient.incrementFields({ accessTokensRemoved: 1 }, correlationId);
+            if (!credential ||
+                credential.credentialType.toLowerCase() !==
+                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase() ||
+                credential.tokenType !== AuthenticationScheme.POP) {
+                // If the credential is not a PoP token, we can return
                 return;
             }
             // Remove Token Binding Key from key store for PoP Tokens Credentials
-            if (credential.credentialType.toLowerCase() ===
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
-                if (credential.tokenType === AuthenticationScheme.POP) {
-                    const accessTokenWithAuthSchemeEntity = credential;
-                    const kid = accessTokenWithAuthSchemeEntity.keyId;
-                    if (kid) {
-                        try {
-                            await this.cryptoImpl.removeTokenBindingKey(kid);
-                        }
-                        catch (error) {
-                            throw createClientAuthError(bindingKeyNotRemoved);
-                        }
-                    }
-                }
+            const kid = credential.keyId;
+            if (kid) {
+                void this.cryptoImpl.removeTokenBindingKey(kid).catch(() => {
+                    this.commonLogger.error(`Failed to remove token binding key ${kid}`, correlationId);
+                    this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
+                });
             }
-            return this.removeItem(key);
         }
         /**
          * Removes all app metadata objects from cache.
          */
-        removeAppMetadata() {
+        removeAppMetadata(correlationId) {
             const allCacheKeys = this.getKeys();
             allCacheKeys.forEach((cacheKey) => {
                 if (this.isAppMetadata(cacheKey)) {
-                    this.removeItem(cacheKey);
+                    this.removeItem(cacheKey, correlationId);
                 }
             });
             return true;
@@ -3291,9 +3277,9 @@
          * Retrieve AccountEntity from cache
          * @param account
          */
-        readAccountFromCache(account) {
+        readAccountFromCache(account, correlationId) {
             const accountKey = AccountEntity.generateAccountCacheKey(account);
-            return this.getAccount(accountKey, this.commonLogger);
+            return this.getAccount(accountKey, correlationId);
         }
         /**
          * Retrieve IdTokenEntity from cache
@@ -3303,7 +3289,7 @@
          * @param performanceClient {?IPerformanceClient}
          * @param correlationId {?string}
          */
-        getIdToken(account, tokenKeys, targetRealm, performanceClient, correlationId) {
+        getIdToken(account, correlationId, tokenKeys, targetRealm, performanceClient) {
             this.commonLogger.trace("CacheManager - getIdToken called");
             const idTokenFilter = {
                 homeAccountId: account.homeAccountId,
@@ -3312,7 +3298,7 @@
                 clientId: this.clientId,
                 realm: targetRealm,
             };
-            const idTokenMap = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
+            const idTokenMap = this.getIdTokensByFilter(idTokenFilter, correlationId, tokenKeys);
             const numIdTokens = idTokenMap.size;
             if (numIdTokens < 1) {
                 this.commonLogger.info("CacheManager:getIdToken - No token found");
@@ -3345,7 +3331,7 @@
                 // Multiple tokens for a single tenant profile, remove all and return null
                 this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them");
                 tokensToBeRemoved.forEach((idToken, key) => {
-                    this.removeIdToken(key);
+                    this.removeIdToken(key, correlationId);
                 });
                 if (performanceClient && correlationId) {
                     performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
@@ -3360,7 +3346,7 @@
          * @param filter
          * @returns
          */
-        getIdTokensByFilter(filter, tokenKeys) {
+        getIdTokensByFilter(filter, correlationId, tokenKeys) {
             const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;
             const idTokens = new Map();
             idTokenKeys.forEach((key) => {
@@ -3370,7 +3356,7 @@
                 })) {
                     return;
                 }
-                const idToken = this.getIdTokenCredential(key);
+                const idToken = this.getIdTokenCredential(key, correlationId);
                 if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                     idTokens.set(key, idToken);
                 }
@@ -3399,26 +3385,27 @@
          * Removes idToken from the cache
          * @param key
          */
-        removeIdToken(key) {
-            this.removeItem(key);
+        removeIdToken(key, correlationId) {
+            this.removeItem(key, correlationId);
         }
         /**
          * Removes refresh token from the cache
          * @param key
          */
-        removeRefreshToken(key) {
-            this.removeItem(key);
+        removeRefreshToken(key, correlationId) {
+            this.removeItem(key, correlationId);
         }
         /**
          * Retrieve AccessTokenEntity from cache
          * @param account {AccountInfo}
          * @param request {BaseAuthRequest}
+         * @param correlationId {?string}
          * @param tokenKeys {?TokenKeys}
          * @param performanceClient {?IPerformanceClient}
-         * @param correlationId {?string}
          */
-        getAccessToken(account, request, tokenKeys, targetRealm, performanceClient, correlationId) {
-            this.commonLogger.trace("CacheManager - getAccessToken called");
+        getAccessToken(account, request, tokenKeys, targetRealm) {
+            const correlationId = request.correlationId;
+            this.commonLogger.trace("CacheManager - getAccessToken called", correlationId);
             const scopes = ScopeSet.createSearchScopes(request.scopes);
             const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
             /*
@@ -3447,7 +3434,7 @@
             accessTokenKeys.forEach((key) => {
                 // Validate key
                 if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
-                    const accessToken = this.getAccessTokenCredential(key);
+                    const accessToken = this.getAccessTokenCredential(key, correlationId);
                     // Validate value
                     if (accessToken &&
                         this.credentialMatchesFilter(accessToken, accessTokenFilter)) {
@@ -3457,20 +3444,18 @@
             });
             const numAccessTokens = accessTokens.length;
             if (numAccessTokens < 1) {
-                this.commonLogger.info("CacheManager:getAccessToken - No token found");
+                this.commonLogger.info("CacheManager:getAccessToken - No token found", correlationId);
                 return null;
             }
             else if (numAccessTokens > 1) {
-                this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them");
+                this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them", correlationId);
                 accessTokens.forEach((accessToken) => {
-                    void this.removeAccessToken(generateCredentialKey(accessToken));
+                    this.removeAccessToken(generateCredentialKey(accessToken), correlationId);
                 });
-                if (performanceClient && correlationId) {
-                    performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
-                }
+                this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
                 return null;
             }
-            this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
+            this.commonLogger.info("CacheManager:getAccessToken - Returning access token", correlationId);
             return accessTokens[0];
         }
         /**
@@ -3519,14 +3504,14 @@
          * @param filter
          * @returns
          */
-        getAccessTokensByFilter(filter) {
+        getAccessTokensByFilter(filter, correlationId) {
             const tokenKeys = this.getTokenKeys();
             const accessTokens = [];
             tokenKeys.accessToken.forEach((key) => {
                 if (!this.accessTokenKeyMatchesFilter(key, filter, true)) {
                     return;
                 }
-                const accessToken = this.getAccessTokenCredential(key);
+                const accessToken = this.getAccessTokenCredential(key, correlationId);
                 if (accessToken &&
                     this.credentialMatchesFilter(accessToken, filter)) {
                     accessTokens.push(accessToken);
@@ -3538,11 +3523,11 @@
          * Helper to retrieve the appropriate refresh token from cache
          * @param account {AccountInfo}
          * @param familyRT {boolean}
+         * @param correlationId {?string}
          * @param tokenKeys {?TokenKeys}
          * @param performanceClient {?IPerformanceClient}
-         * @param correlationId {?string}
          */
-        getRefreshToken(account, familyRT, tokenKeys, performanceClient, correlationId) {
+        getRefreshToken(account, familyRT, correlationId, tokenKeys, performanceClient) {
             this.commonLogger.trace("CacheManager - getRefreshToken called");
             const id = familyRT ? THE_FAMILY_ID : undefined;
             const refreshTokenFilter = {
@@ -3558,7 +3543,7 @@
             refreshTokenKeys.forEach((key) => {
                 // Validate key
                 if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
-                    const refreshToken = this.getRefreshTokenCredential(key);
+                    const refreshToken = this.getRefreshTokenCredential(key, correlationId);
                     // Validate value
                     if (refreshToken &&
                         this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {
@@ -3908,576 +3893,16 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
-
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    const DEFAULT_SYSTEM_OPTIONS = {
-        tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
-        preventCorsPreflight: false,
-    };
-    const DEFAULT_LOGGER_IMPLEMENTATION = {
-        loggerCallback: () => {
-            // allow users to not set loggerCallback
-        },
-        piiLoggingEnabled: false,
-        logLevel: exports.LogLevel.Info,
-        correlationId: Constants.EMPTY_STRING,
-    };
-    const DEFAULT_CACHE_OPTIONS = {
-        claimsBasedCachingEnabled: false,
-    };
-    const DEFAULT_NETWORK_IMPLEMENTATION = {
-        async sendGetRequestAsync() {
-            throw createClientAuthError(methodNotImplemented);
-        },
-        async sendPostRequestAsync() {
-            throw createClientAuthError(methodNotImplemented);
-        },
-    };
-    const DEFAULT_LIBRARY_INFO = {
-        sku: Constants.SKU,
-        version: version$1,
-        cpu: Constants.EMPTY_STRING,
-        os: Constants.EMPTY_STRING,
-    };
-    const DEFAULT_CLIENT_CREDENTIALS = {
-        clientSecret: Constants.EMPTY_STRING,
-        clientAssertion: undefined,
-    };
-    const DEFAULT_AZURE_CLOUD_OPTIONS = {
-        azureCloudInstance: AzureCloudInstance.None,
-        tenant: `${Constants.DEFAULT_COMMON_TENANT}`,
-    };
-    const DEFAULT_TELEMETRY_OPTIONS = {
-        application: {
-            appName: "",
-            appVersion: "",
-        },
-    };
     /**
-     * Function that sets the default options when not explicitly configured from app developer
-     *
-     * @param Configuration
+     * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
      *
-     * @returns Configuration
-     */
-    function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, cacheOptions: userCacheOptions, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
-        const loggerOptions = {
-            ...DEFAULT_LOGGER_IMPLEMENTATION,
-            ...userLoggerOption,
-        };
-        return {
-            authOptions: buildAuthOptions(userAuthOptions),
-            systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
-            loggerOptions: loggerOptions,
-            cacheOptions: { ...DEFAULT_CACHE_OPTIONS, ...userCacheOptions },
-            storageInterface: storageImplementation ||
-                new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),
-            networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
-            cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
-            clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
-            libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
-            telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
-            serverTelemetryManager: serverTelemetryManager || null,
-            persistencePlugin: persistencePlugin || null,
-            serializableCache: serializableCache || null,
-        };
-    }
-    /**
-     * Construct authoptions from the client and platform passed values
-     * @param authOptions
-     */
-    function buildAuthOptions(authOptions) {
-        return {
-            clientCapabilities: [],
-            azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
-            skipAuthorityMetadataCache: false,
-            instanceAware: false,
-            encodeExtraQueryParams: false,
-            ...authOptions,
-        };
-    }
-    /**
-     * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
-     * @param ClientConfiguration
-     */
-    function isOidcProtocolMode(config) {
-        return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
-    }
-
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    const CcsCredentialType = {
-        HOME_ACCOUNT_ID: "home_account_id",
-        UPN: "UPN",
-    };
-
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    const CLIENT_ID = "client_id";
-    const REDIRECT_URI = "redirect_uri";
-    const RESPONSE_TYPE = "response_type";
-    const RESPONSE_MODE = "response_mode";
-    const GRANT_TYPE = "grant_type";
-    const CLAIMS = "claims";
-    const SCOPE = "scope";
-    const REFRESH_TOKEN = "refresh_token";
-    const STATE = "state";
-    const NONCE = "nonce";
-    const PROMPT = "prompt";
-    const CODE = "code";
-    const CODE_CHALLENGE = "code_challenge";
-    const CODE_CHALLENGE_METHOD = "code_challenge_method";
-    const CODE_VERIFIER = "code_verifier";
-    const CLIENT_REQUEST_ID = "client-request-id";
-    const X_CLIENT_SKU = "x-client-SKU";
-    const X_CLIENT_VER = "x-client-VER";
-    const X_CLIENT_OS = "x-client-OS";
-    const X_CLIENT_CPU = "x-client-CPU";
-    const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
-    const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
-    const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
-    const X_APP_NAME = "x-app-name";
-    const X_APP_VER = "x-app-ver";
-    const POST_LOGOUT_URI = "post_logout_redirect_uri";
-    const ID_TOKEN_HINT = "id_token_hint";
-    const CLIENT_SECRET = "client_secret";
-    const CLIENT_ASSERTION = "client_assertion";
-    const CLIENT_ASSERTION_TYPE = "client_assertion_type";
-    const TOKEN_TYPE = "token_type";
-    const REQ_CNF = "req_cnf";
-    const RETURN_SPA_CODE = "return_spa_code";
-    const NATIVE_BROKER = "nativebroker";
-    const LOGOUT_HINT = "logout_hint";
-    const SID = "sid";
-    const LOGIN_HINT = "login_hint";
-    const DOMAIN_HINT = "domain_hint";
-    const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
-    const BROKER_CLIENT_ID = "brk_client_id";
-    const BROKER_REDIRECT_URI = "brk_redirect_uri";
-    const INSTANCE_AWARE = "instance_aware";
-    const EAR_JWK = "ear_jwk";
-    const EAR_JWE_CRYPTO = "ear_jwe_crypto";
-
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    function instrumentBrokerParams(parameters, correlationId, performanceClient) {
-        if (!correlationId) {
-            return;
-        }
-        const clientId = parameters.get(CLIENT_ID);
-        if (clientId && parameters.has(BROKER_CLIENT_ID)) {
-            performanceClient?.addFields({
-                embeddedClientId: clientId,
-                embeddedRedirectUri: parameters.get(REDIRECT_URI),
-            }, correlationId);
-        }
-    }
-    /**
-     * Add the given response_type
-     * @param parameters
-     * @param responseType
-     */
-    function addResponseType(parameters, responseType) {
-        parameters.set(RESPONSE_TYPE, responseType);
-    }
-    /**
-     * add response_mode. defaults to query.
-     * @param responseMode
-     */
-    function addResponseMode(parameters, responseMode) {
-        parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
-    }
-    /**
-     * Add flag to indicate STS should attempt to use WAM if available
-     */
-    function addNativeBroker(parameters) {
-        parameters.set(NATIVE_BROKER, "1");
-    }
-    /**
-     * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
-     * @param scopeSet
-     * @param addOidcScopes
-     */
-    function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
-        // Always add openid to the scopes when adding OIDC scopes
-        if (addOidcScopes &&
-            !defaultScopes.includes("openid") &&
-            !scopes.includes("openid")) {
-            defaultScopes.push("openid");
-        }
-        const requestScopes = addOidcScopes
-            ? [...(scopes || []), ...defaultScopes]
-            : scopes || [];
-        const scopeSet = new ScopeSet(requestScopes);
-        parameters.set(SCOPE, scopeSet.printScopes());
-    }
-    /**
-     * add clientId
-     * @param clientId
-     */
-    function addClientId(parameters, clientId) {
-        parameters.set(CLIENT_ID, clientId);
-    }
-    /**
-     * add redirect_uri
-     * @param redirectUri
-     */
-    function addRedirectUri(parameters, redirectUri) {
-        parameters.set(REDIRECT_URI, redirectUri);
-    }
-    /**
-     * add post logout redirectUri
-     * @param redirectUri
-     */
-    function addPostLogoutRedirectUri(parameters, redirectUri) {
-        parameters.set(POST_LOGOUT_URI, redirectUri);
-    }
-    /**
-     * add id_token_hint to logout request
-     * @param idTokenHint
-     */
-    function addIdTokenHint(parameters, idTokenHint) {
-        parameters.set(ID_TOKEN_HINT, idTokenHint);
-    }
-    /**
-     * add domain_hint
-     * @param domainHint
-     */
-    function addDomainHint(parameters, domainHint) {
-        parameters.set(DOMAIN_HINT, domainHint);
-    }
-    /**
-     * add login_hint
-     * @param loginHint
-     */
-    function addLoginHint(parameters, loginHint) {
-        parameters.set(LOGIN_HINT, loginHint);
-    }
-    /**
-     * Adds the CCS (Cache Credential Service) query parameter for login_hint
-     * @param loginHint
-     */
-    function addCcsUpn(parameters, loginHint) {
-        parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
-    }
-    /**
-     * Adds the CCS (Cache Credential Service) query parameter for account object
-     * @param loginHint
-     */
-    function addCcsOid(parameters, clientInfo) {
-        parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
-    }
-    /**
-     * add sid
-     * @param sid
-     */
-    function addSid(parameters, sid) {
-        parameters.set(SID, sid);
-    }
-    /**
-     * add claims
-     * @param claims
-     */
-    function addClaims(parameters, claims, clientCapabilities) {
-        const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
-        try {
-            JSON.parse(mergedClaims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-        parameters.set(CLAIMS, mergedClaims);
-    }
-    /**
-     * add correlationId
-     * @param correlationId
-     */
-    function addCorrelationId(parameters, correlationId) {
-        parameters.set(CLIENT_REQUEST_ID, correlationId);
-    }
-    /**
-     * add library info query params
-     * @param libraryInfo
-     */
-    function addLibraryInfo(parameters, libraryInfo) {
-        // Telemetry Info
-        parameters.set(X_CLIENT_SKU, libraryInfo.sku);
-        parameters.set(X_CLIENT_VER, libraryInfo.version);
-        if (libraryInfo.os) {
-            parameters.set(X_CLIENT_OS, libraryInfo.os);
-        }
-        if (libraryInfo.cpu) {
-            parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
-        }
-    }
-    /**
-     * Add client telemetry parameters
-     * @param appTelemetry
-     */
-    function addApplicationTelemetry(parameters, appTelemetry) {
-        if (appTelemetry?.appName) {
-            parameters.set(X_APP_NAME, appTelemetry.appName);
-        }
-        if (appTelemetry?.appVersion) {
-            parameters.set(X_APP_VER, appTelemetry.appVersion);
-        }
-    }
-    /**
-     * add prompt
-     * @param prompt
-     */
-    function addPrompt(parameters, prompt) {
-        parameters.set(PROMPT, prompt);
-    }
-    /**
-     * add state
-     * @param state
-     */
-    function addState(parameters, state) {
-        if (state) {
-            parameters.set(STATE, state);
-        }
-    }
-    /**
-     * add nonce
-     * @param nonce
-     */
-    function addNonce(parameters, nonce) {
-        parameters.set(NONCE, nonce);
-    }
-    /**
-     * add code_challenge and code_challenge_method
-     * - throw if either of them are not passed
-     * @param codeChallenge
-     * @param codeChallengeMethod
-     */
-    function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
-        if (codeChallenge && codeChallengeMethod) {
-            parameters.set(CODE_CHALLENGE, codeChallenge);
-            parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
-        }
-        else {
-            throw createClientConfigurationError(pkceParamsMissing);
-        }
-    }
-    /**
-     * add the `authorization_code` passed by the user to exchange for a token
-     * @param code
-     */
-    function addAuthorizationCode(parameters, code) {
-        parameters.set(CODE, code);
-    }
-    /**
-     * add the `refreshToken` passed by the user
-     * @param refreshToken
-     */
-    function addRefreshToken(parameters, refreshToken) {
-        parameters.set(REFRESH_TOKEN, refreshToken);
-    }
-    /**
-     * add the `code_verifier` passed by the user to exchange for a token
-     * @param codeVerifier
-     */
-    function addCodeVerifier(parameters, codeVerifier) {
-        parameters.set(CODE_VERIFIER, codeVerifier);
-    }
-    /**
-     * add client_secret
-     * @param clientSecret
-     */
-    function addClientSecret(parameters, clientSecret) {
-        parameters.set(CLIENT_SECRET, clientSecret);
-    }
-    /**
-     * add clientAssertion for confidential client flows
-     * @param clientAssertion
-     */
-    function addClientAssertion(parameters, clientAssertion) {
-        if (clientAssertion) {
-            parameters.set(CLIENT_ASSERTION, clientAssertion);
-        }
-    }
-    /**
-     * add clientAssertionType for confidential client flows
-     * @param clientAssertionType
-     */
-    function addClientAssertionType(parameters, clientAssertionType) {
-        if (clientAssertionType) {
-            parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
-        }
-    }
-    /**
-     * add grant type
-     * @param grantType
-     */
-    function addGrantType(parameters, grantType) {
-        parameters.set(GRANT_TYPE, grantType);
-    }
-    /**
-     * add client info
-     *
-     */
-    function addClientInfo(parameters) {
-        parameters.set(CLIENT_INFO, "1");
-    }
-    function addInstanceAware(parameters) {
-        if (!parameters.has(INSTANCE_AWARE)) {
-            parameters.set(INSTANCE_AWARE, "true");
-        }
-    }
-    /**
-     * add extraQueryParams
-     * @param eQParams
-     */
-    function addExtraQueryParameters(parameters, eQParams) {
-        Object.entries(eQParams).forEach(([key, value]) => {
-            if (!parameters.has(key) && value) {
-                parameters.set(key, value);
-            }
-        });
-    }
-    function addClientCapabilitiesToClaims(claims, clientCapabilities) {
-        let mergedClaims;
-        // Parse provided claims into JSON object or initialize empty object
-        if (!claims) {
-            mergedClaims = {};
-        }
-        else {
-            try {
-                mergedClaims = JSON.parse(claims);
-            }
-            catch (e) {
-                throw createClientConfigurationError(invalidClaims);
-            }
-        }
-        if (clientCapabilities && clientCapabilities.length > 0) {
-            if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
-                // Add access_token key to claims object
-                mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
-            }
-            // Add xms_cc claim with provided clientCapabilities to access_token key
-            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
-                {
-                    values: clientCapabilities,
-                };
-        }
-        return JSON.stringify(mergedClaims);
-    }
-    /**
-     * add pop_jwk to query params
-     * @param cnfString
-     */
-    function addPopToken(parameters, cnfString) {
-        if (cnfString) {
-            parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
-            parameters.set(REQ_CNF, cnfString);
-        }
-    }
-    /**
-     * add SSH JWK and key ID to query params
-     */
-    function addSshJwk(parameters, sshJwkString) {
-        if (sshJwkString) {
-            parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
-            parameters.set(REQ_CNF, sshJwkString);
-        }
-    }
-    /**
-     * add server telemetry fields
-     * @param serverTelemetryManager
-     */
-    function addServerTelemetry(parameters, serverTelemetryManager) {
-        parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-        parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
-    }
-    /**
-     * Adds parameter that indicates to the server that throttling is supported
-     */
-    function addThrottling(parameters) {
-        parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
-    }
-    /**
-     * Adds logout_hint parameter for "silent" logout which prevent server account picker
-     */
-    function addLogoutHint(parameters, logoutHint) {
-        parameters.set(LOGOUT_HINT, logoutHint);
-    }
-    function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
-        if (!parameters.has(BROKER_CLIENT_ID)) {
-            parameters.set(BROKER_CLIENT_ID, brokerClientId);
-        }
-        if (!parameters.has(BROKER_REDIRECT_URI)) {
-            parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
-        }
-    }
-    /**
-     * Add EAR (Encrypted Authorize Response) request parameters
-     * @param parameters
-     * @param jwk
-     */
-    function addEARParameters(parameters, jwk) {
-        parameters.set(EAR_JWK, encodeURIComponent(jwk));
-        // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
-        const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
-        parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
-    }
-
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    function isOpenIdConfigResponse(response) {
-        return (response.hasOwnProperty("authorization_endpoint") &&
-            response.hasOwnProperty("token_endpoint") &&
-            response.hasOwnProperty("issuer") &&
-            response.hasOwnProperty("jwks_uri"));
-    }
-
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    function isCloudInstanceDiscoveryResponse(response) {
-        return (response.hasOwnProperty("tenant_discovery_endpoint") &&
-            response.hasOwnProperty("metadata"));
-    }
-
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    function isCloudInstanceDiscoveryErrorResponse(response) {
-        return (response.hasOwnProperty("error") &&
-            response.hasOwnProperty("error_description"));
-    }
-
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Enumeration of operations that are instrumented by have their performance measured by the PerformanceClient.
-     *
-     * @export
-     * @enum {number}
+     * @export
+     * @enum {number}
      */
     const PerformanceEvents = {
         /**
@@ -4954,34 +4379,672 @@
         [PerformanceEvents.DecryptEarResponse, "decryptEarResp"],
     ]);
     /**
-     * State of the performance event.
+     * State of the performance event.
+     *
+     * @export
+     * @enum {number}
+     */
+    const PerformanceEventStatus = {
+        InProgress: 1,
+        Completed: 2,
+    };
+    const IntFields = new Set([
+        "accessTokenSize",
+        "durationMs",
+        "idTokenSize",
+        "matsSilentStatus",
+        "matsHttpStatus",
+        "refreshTokenSize",
+        "queuedTimeMs",
+        "startTimeMs",
+        "status",
+        "multiMatchedAT",
+        "multiMatchedID",
+        "multiMatchedRT",
+        "unencryptedCacheCount",
+        "encryptedCacheExpiredCount",
+    ]);
+
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    class StubPerformanceMeasurement {
+        startMeasurement() {
+            return;
+        }
+        endMeasurement() {
+            return;
+        }
+        flushMeasurement() {
+            return null;
+        }
+    }
+    class StubPerformanceClient {
+        generateId() {
+            return "callback-id";
+        }
+        startMeasurement(measureName, correlationId) {
+            return {
+                end: () => null,
+                discard: () => { },
+                add: () => { },
+                increment: () => { },
+                event: {
+                    eventId: this.generateId(),
+                    status: PerformanceEventStatus.InProgress,
+                    authority: "",
+                    libraryName: "",
+                    libraryVersion: "",
+                    clientId: "",
+                    name: measureName,
+                    startTimeMs: Date.now(),
+                    correlationId: correlationId || "",
+                },
+                measurement: new StubPerformanceMeasurement(),
+            };
+        }
+        startPerformanceMeasurement() {
+            return new StubPerformanceMeasurement();
+        }
+        calculateQueuedTime() {
+            return 0;
+        }
+        addQueueMeasurement() {
+            return;
+        }
+        setPreQueueTime() {
+            return;
+        }
+        endMeasurement() {
+            return null;
+        }
+        discardMeasurements() {
+            return;
+        }
+        removePerformanceCallback() {
+            return true;
+        }
+        addPerformanceCallback() {
+            return "";
+        }
+        emitEvents() {
+            return;
+        }
+        addFields() {
+            return;
+        }
+        incrementFields() {
+            return;
+        }
+        cacheEventByCorrelationId() {
+            return;
+        }
+    }
+
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    const DEFAULT_SYSTEM_OPTIONS = {
+        tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+        preventCorsPreflight: false,
+    };
+    const DEFAULT_LOGGER_IMPLEMENTATION = {
+        loggerCallback: () => {
+            // allow users to not set loggerCallback
+        },
+        piiLoggingEnabled: false,
+        logLevel: exports.LogLevel.Info,
+        correlationId: Constants.EMPTY_STRING,
+    };
+    const DEFAULT_CACHE_OPTIONS = {
+        claimsBasedCachingEnabled: false,
+    };
+    const DEFAULT_NETWORK_IMPLEMENTATION = {
+        async sendGetRequestAsync() {
+            throw createClientAuthError(methodNotImplemented);
+        },
+        async sendPostRequestAsync() {
+            throw createClientAuthError(methodNotImplemented);
+        },
+    };
+    const DEFAULT_LIBRARY_INFO = {
+        sku: Constants.SKU,
+        version: version$1,
+        cpu: Constants.EMPTY_STRING,
+        os: Constants.EMPTY_STRING,
+    };
+    const DEFAULT_CLIENT_CREDENTIALS = {
+        clientSecret: Constants.EMPTY_STRING,
+        clientAssertion: undefined,
+    };
+    const DEFAULT_AZURE_CLOUD_OPTIONS = {
+        azureCloudInstance: AzureCloudInstance.None,
+        tenant: `${Constants.DEFAULT_COMMON_TENANT}`,
+    };
+    const DEFAULT_TELEMETRY_OPTIONS = {
+        application: {
+            appName: "",
+            appVersion: "",
+        },
+    };
+    /**
+     * Function that sets the default options when not explicitly configured from app developer
+     *
+     * @param Configuration
+     *
+     * @returns Configuration
+     */
+    function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, cacheOptions: userCacheOptions, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
+        const loggerOptions = {
+            ...DEFAULT_LOGGER_IMPLEMENTATION,
+            ...userLoggerOption,
+        };
+        return {
+            authOptions: buildAuthOptions(userAuthOptions),
+            systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
+            loggerOptions: loggerOptions,
+            cacheOptions: { ...DEFAULT_CACHE_OPTIONS, ...userCacheOptions },
+            storageInterface: storageImplementation ||
+                new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
+            networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
+            cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+            clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
+            libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
+            telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
+            serverTelemetryManager: serverTelemetryManager || null,
+            persistencePlugin: persistencePlugin || null,
+            serializableCache: serializableCache || null,
+        };
+    }
+    /**
+     * Construct authoptions from the client and platform passed values
+     * @param authOptions
+     */
+    function buildAuthOptions(authOptions) {
+        return {
+            clientCapabilities: [],
+            azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
+            skipAuthorityMetadataCache: false,
+            instanceAware: false,
+            encodeExtraQueryParams: false,
+            ...authOptions,
+        };
+    }
+    /**
+     * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+     * @param ClientConfiguration
+     */
+    function isOidcProtocolMode(config) {
+        return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+    }
+
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    const CcsCredentialType = {
+        HOME_ACCOUNT_ID: "home_account_id",
+        UPN: "UPN",
+    };
+
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    const CLIENT_ID = "client_id";
+    const REDIRECT_URI = "redirect_uri";
+    const RESPONSE_TYPE = "response_type";
+    const RESPONSE_MODE = "response_mode";
+    const GRANT_TYPE = "grant_type";
+    const CLAIMS = "claims";
+    const SCOPE = "scope";
+    const REFRESH_TOKEN = "refresh_token";
+    const STATE = "state";
+    const NONCE = "nonce";
+    const PROMPT = "prompt";
+    const CODE = "code";
+    const CODE_CHALLENGE = "code_challenge";
+    const CODE_CHALLENGE_METHOD = "code_challenge_method";
+    const CODE_VERIFIER = "code_verifier";
+    const CLIENT_REQUEST_ID = "client-request-id";
+    const X_CLIENT_SKU = "x-client-SKU";
+    const X_CLIENT_VER = "x-client-VER";
+    const X_CLIENT_OS = "x-client-OS";
+    const X_CLIENT_CPU = "x-client-CPU";
+    const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
+    const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
+    const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
+    const X_APP_NAME = "x-app-name";
+    const X_APP_VER = "x-app-ver";
+    const POST_LOGOUT_URI = "post_logout_redirect_uri";
+    const ID_TOKEN_HINT = "id_token_hint";
+    const CLIENT_SECRET = "client_secret";
+    const CLIENT_ASSERTION = "client_assertion";
+    const CLIENT_ASSERTION_TYPE = "client_assertion_type";
+    const TOKEN_TYPE = "token_type";
+    const REQ_CNF = "req_cnf";
+    const RETURN_SPA_CODE = "return_spa_code";
+    const NATIVE_BROKER = "nativebroker";
+    const LOGOUT_HINT = "logout_hint";
+    const SID = "sid";
+    const LOGIN_HINT = "login_hint";
+    const DOMAIN_HINT = "domain_hint";
+    const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+    const BROKER_CLIENT_ID = "brk_client_id";
+    const BROKER_REDIRECT_URI = "brk_redirect_uri";
+    const INSTANCE_AWARE = "instance_aware";
+    const EAR_JWK = "ear_jwk";
+    const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function instrumentBrokerParams(parameters, correlationId, performanceClient) {
+        if (!correlationId) {
+            return;
+        }
+        const clientId = parameters.get(CLIENT_ID);
+        if (clientId && parameters.has(BROKER_CLIENT_ID)) {
+            performanceClient?.addFields({
+                embeddedClientId: clientId,
+                embeddedRedirectUri: parameters.get(REDIRECT_URI),
+            }, correlationId);
+        }
+    }
+    /**
+     * Add the given response_type
+     * @param parameters
+     * @param responseType
+     */
+    function addResponseType(parameters, responseType) {
+        parameters.set(RESPONSE_TYPE, responseType);
+    }
+    /**
+     * add response_mode. defaults to query.
+     * @param responseMode
+     */
+    function addResponseMode(parameters, responseMode) {
+        parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
+    }
+    /**
+     * Add flag to indicate STS should attempt to use WAM if available
+     */
+    function addNativeBroker(parameters) {
+        parameters.set(NATIVE_BROKER, "1");
+    }
+    /**
+     * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
+     * @param scopeSet
+     * @param addOidcScopes
+     */
+    function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+        // Always add openid to the scopes when adding OIDC scopes
+        if (addOidcScopes &&
+            !defaultScopes.includes("openid") &&
+            !scopes.includes("openid")) {
+            defaultScopes.push("openid");
+        }
+        const requestScopes = addOidcScopes
+            ? [...(scopes || []), ...defaultScopes]
+            : scopes || [];
+        const scopeSet = new ScopeSet(requestScopes);
+        parameters.set(SCOPE, scopeSet.printScopes());
+    }
+    /**
+     * add clientId
+     * @param clientId
+     */
+    function addClientId(parameters, clientId) {
+        parameters.set(CLIENT_ID, clientId);
+    }
+    /**
+     * add redirect_uri
+     * @param redirectUri
+     */
+    function addRedirectUri(parameters, redirectUri) {
+        parameters.set(REDIRECT_URI, redirectUri);
+    }
+    /**
+     * add post logout redirectUri
+     * @param redirectUri
+     */
+    function addPostLogoutRedirectUri(parameters, redirectUri) {
+        parameters.set(POST_LOGOUT_URI, redirectUri);
+    }
+    /**
+     * add id_token_hint to logout request
+     * @param idTokenHint
+     */
+    function addIdTokenHint(parameters, idTokenHint) {
+        parameters.set(ID_TOKEN_HINT, idTokenHint);
+    }
+    /**
+     * add domain_hint
+     * @param domainHint
+     */
+    function addDomainHint(parameters, domainHint) {
+        parameters.set(DOMAIN_HINT, domainHint);
+    }
+    /**
+     * add login_hint
+     * @param loginHint
+     */
+    function addLoginHint(parameters, loginHint) {
+        parameters.set(LOGIN_HINT, loginHint);
+    }
+    /**
+     * Adds the CCS (Cache Credential Service) query parameter for login_hint
+     * @param loginHint
+     */
+    function addCcsUpn(parameters, loginHint) {
+        parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
+    }
+    /**
+     * Adds the CCS (Cache Credential Service) query parameter for account object
+     * @param loginHint
+     */
+    function addCcsOid(parameters, clientInfo) {
+        parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
+    }
+    /**
+     * add sid
+     * @param sid
+     */
+    function addSid(parameters, sid) {
+        parameters.set(SID, sid);
+    }
+    /**
+     * add claims
+     * @param claims
+     */
+    function addClaims(parameters, claims, clientCapabilities) {
+        const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
+        try {
+            JSON.parse(mergedClaims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+        parameters.set(CLAIMS, mergedClaims);
+    }
+    /**
+     * add correlationId
+     * @param correlationId
+     */
+    function addCorrelationId(parameters, correlationId) {
+        parameters.set(CLIENT_REQUEST_ID, correlationId);
+    }
+    /**
+     * add library info query params
+     * @param libraryInfo
+     */
+    function addLibraryInfo(parameters, libraryInfo) {
+        // Telemetry Info
+        parameters.set(X_CLIENT_SKU, libraryInfo.sku);
+        parameters.set(X_CLIENT_VER, libraryInfo.version);
+        if (libraryInfo.os) {
+            parameters.set(X_CLIENT_OS, libraryInfo.os);
+        }
+        if (libraryInfo.cpu) {
+            parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
+        }
+    }
+    /**
+     * Add client telemetry parameters
+     * @param appTelemetry
+     */
+    function addApplicationTelemetry(parameters, appTelemetry) {
+        if (appTelemetry?.appName) {
+            parameters.set(X_APP_NAME, appTelemetry.appName);
+        }
+        if (appTelemetry?.appVersion) {
+            parameters.set(X_APP_VER, appTelemetry.appVersion);
+        }
+    }
+    /**
+     * add prompt
+     * @param prompt
+     */
+    function addPrompt(parameters, prompt) {
+        parameters.set(PROMPT, prompt);
+    }
+    /**
+     * add state
+     * @param state
+     */
+    function addState(parameters, state) {
+        if (state) {
+            parameters.set(STATE, state);
+        }
+    }
+    /**
+     * add nonce
+     * @param nonce
+     */
+    function addNonce(parameters, nonce) {
+        parameters.set(NONCE, nonce);
+    }
+    /**
+     * add code_challenge and code_challenge_method
+     * - throw if either of them are not passed
+     * @param codeChallenge
+     * @param codeChallengeMethod
+     */
+    function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
+        if (codeChallenge && codeChallengeMethod) {
+            parameters.set(CODE_CHALLENGE, codeChallenge);
+            parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
+        }
+        else {
+            throw createClientConfigurationError(pkceParamsMissing);
+        }
+    }
+    /**
+     * add the `authorization_code` passed by the user to exchange for a token
+     * @param code
+     */
+    function addAuthorizationCode(parameters, code) {
+        parameters.set(CODE, code);
+    }
+    /**
+     * add the `refreshToken` passed by the user
+     * @param refreshToken
+     */
+    function addRefreshToken(parameters, refreshToken) {
+        parameters.set(REFRESH_TOKEN, refreshToken);
+    }
+    /**
+     * add the `code_verifier` passed by the user to exchange for a token
+     * @param codeVerifier
+     */
+    function addCodeVerifier(parameters, codeVerifier) {
+        parameters.set(CODE_VERIFIER, codeVerifier);
+    }
+    /**
+     * add client_secret
+     * @param clientSecret
+     */
+    function addClientSecret(parameters, clientSecret) {
+        parameters.set(CLIENT_SECRET, clientSecret);
+    }
+    /**
+     * add clientAssertion for confidential client flows
+     * @param clientAssertion
+     */
+    function addClientAssertion(parameters, clientAssertion) {
+        if (clientAssertion) {
+            parameters.set(CLIENT_ASSERTION, clientAssertion);
+        }
+    }
+    /**
+     * add clientAssertionType for confidential client flows
+     * @param clientAssertionType
+     */
+    function addClientAssertionType(parameters, clientAssertionType) {
+        if (clientAssertionType) {
+            parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
+        }
+    }
+    /**
+     * add grant type
+     * @param grantType
+     */
+    function addGrantType(parameters, grantType) {
+        parameters.set(GRANT_TYPE, grantType);
+    }
+    /**
+     * add client info
      *
-     * @export
-     * @enum {number}
      */
-    const PerformanceEventStatus = {
-        NotStarted: 0,
-        InProgress: 1,
-        Completed: 2,
-    };
-    const IntFields = new Set([
-        "accessTokenSize",
-        "durationMs",
-        "idTokenSize",
-        "matsSilentStatus",
-        "matsHttpStatus",
-        "refreshTokenSize",
-        "queuedTimeMs",
-        "startTimeMs",
-        "status",
-        "multiMatchedAT",
-        "multiMatchedID",
-        "multiMatchedRT",
-        "unencryptedCacheCount",
-        "encryptedCacheExpiredCount",
-    ]);
+    function addClientInfo(parameters) {
+        parameters.set(CLIENT_INFO, "1");
+    }
+    function addInstanceAware(parameters) {
+        if (!parameters.has(INSTANCE_AWARE)) {
+            parameters.set(INSTANCE_AWARE, "true");
+        }
+    }
+    /**
+     * add extraQueryParams
+     * @param eQParams
+     */
+    function addExtraQueryParameters(parameters, eQParams) {
+        Object.entries(eQParams).forEach(([key, value]) => {
+            if (!parameters.has(key) && value) {
+                parameters.set(key, value);
+            }
+        });
+    }
+    function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+        let mergedClaims;
+        // Parse provided claims into JSON object or initialize empty object
+        if (!claims) {
+            mergedClaims = {};
+        }
+        else {
+            try {
+                mergedClaims = JSON.parse(claims);
+            }
+            catch (e) {
+                throw createClientConfigurationError(invalidClaims);
+            }
+        }
+        if (clientCapabilities && clientCapabilities.length > 0) {
+            if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+                // Add access_token key to claims object
+                mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
+            }
+            // Add xms_cc claim with provided clientCapabilities to access_token key
+            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
+                {
+                    values: clientCapabilities,
+                };
+        }
+        return JSON.stringify(mergedClaims);
+    }
+    /**
+     * add pop_jwk to query params
+     * @param cnfString
+     */
+    function addPopToken(parameters, cnfString) {
+        if (cnfString) {
+            parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
+            parameters.set(REQ_CNF, cnfString);
+        }
+    }
+    /**
+     * add SSH JWK and key ID to query params
+     */
+    function addSshJwk(parameters, sshJwkString) {
+        if (sshJwkString) {
+            parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
+            parameters.set(REQ_CNF, sshJwkString);
+        }
+    }
+    /**
+     * add server telemetry fields
+     * @param serverTelemetryManager
+     */
+    function addServerTelemetry(parameters, serverTelemetryManager) {
+        parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+        parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+    }
+    /**
+     * Adds parameter that indicates to the server that throttling is supported
+     */
+    function addThrottling(parameters) {
+        parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+    }
+    /**
+     * Adds logout_hint parameter for "silent" logout which prevent server account picker
+     */
+    function addLogoutHint(parameters, logoutHint) {
+        parameters.set(LOGOUT_HINT, logoutHint);
+    }
+    function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
+        if (!parameters.has(BROKER_CLIENT_ID)) {
+            parameters.set(BROKER_CLIENT_ID, brokerClientId);
+        }
+        if (!parameters.has(BROKER_REDIRECT_URI)) {
+            parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
+        }
+    }
+    /**
+     * Add EAR (Encrypted Authorize Response) request parameters
+     * @param parameters
+     * @param jwk
+     */
+    function addEARParameters(parameters, jwk) {
+        parameters.set(EAR_JWK, encodeURIComponent(jwk));
+        // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
+        const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
+        parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+    }
+
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function isOpenIdConfigResponse(response) {
+        return (response.hasOwnProperty("authorization_endpoint") &&
+            response.hasOwnProperty("token_endpoint") &&
+            response.hasOwnProperty("issuer") &&
+            response.hasOwnProperty("jwks_uri"));
+    }
+
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function isCloudInstanceDiscoveryResponse(response) {
+        return (response.hasOwnProperty("tenant_discovery_endpoint") &&
+            response.hasOwnProperty("metadata"));
+    }
+
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function isCloudInstanceDiscoveryErrorResponse(response) {
+        return (response.hasOwnProperty("error") &&
+            response.hasOwnProperty("error_description"));
+    }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5077,7 +5140,7 @@
         };
     };
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5183,7 +5246,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6022,7 +6085,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6053,7 +6116,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6072,7 +6135,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6093,7 +6156,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6113,12 +6176,12 @@
          * @param cacheManager
          * @param thumbprint
          */
-        static preProcess(cacheManager, thumbprint) {
+        static preProcess(cacheManager, thumbprint, correlationId) {
             const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
             const value = cacheManager.getThrottlingCache(key);
             if (value) {
                 if (value.throttleTime < Date.now()) {
-                    cacheManager.removeItem(key);
+                    cacheManager.removeItem(key, correlationId);
                     return;
                 }
                 throw new ServerError(value.errorCodes?.join(" ") || Constants.EMPTY_STRING, value.errorMessage, value.subError);
@@ -6130,7 +6193,7 @@
          * @param thumbprint
          * @param response
          */
-        static postProcess(cacheManager, thumbprint, response) {
+        static postProcess(cacheManager, thumbprint, response, correlationId) {
             if (ThrottlingUtils.checkResponseStatus(response) ||
                 ThrottlingUtils.checkResponseForRetryAfter(response)) {
                 const thumbprintValue = {
@@ -6140,7 +6203,7 @@
                     errorMessage: response.body.error_description,
                     subError: response.body.suberror,
                 };
-                cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue);
+                cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
             }
         }
         /**
@@ -6176,11 +6239,11 @@
         static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
             const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
             const key = this.generateThrottlingStorageKey(thumbprint);
-            cacheManager.removeItem(key);
+            cacheManager.removeItem(key, request.correlationId);
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6211,7 +6274,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6293,7 +6356,7 @@
          * @param correlationId - CorrelationId for telemetry
          */
         async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
-            ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
+            ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
             let response;
             try {
                 response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
@@ -6328,7 +6391,7 @@
                     throw createClientAuthError(networkError);
                 }
             }
-            ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
+            ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
             return response;
         }
         /**
@@ -6359,7 +6422,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6368,6 +6431,7 @@
     const noTokensFound = "no_tokens_found";
     const nativeAccountUnavailable = "native_account_unavailable";
     const refreshTokenExpired = "refresh_token_expired";
+    const uxNotAllowed = "ux_not_allowed";
     // Codes potentially returned by server
     const interactionRequired = "interaction_required";
     const consentRequired = "consent_required";
@@ -6382,10 +6446,11 @@
         loginRequired: loginRequired,
         nativeAccountUnavailable: nativeAccountUnavailable,
         noTokensFound: noTokensFound,
-        refreshTokenExpired: refreshTokenExpired
+        refreshTokenExpired: refreshTokenExpired,
+        uxNotAllowed: uxNotAllowed
     });
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6399,6 +6464,7 @@
         consentRequired,
         loginRequired,
         badToken,
+        uxNotAllowed,
     ];
     const InteractionRequiredAuthSubErrorMessage = [
         "message_only",
@@ -6413,6 +6479,7 @@
         [nativeAccountUnavailable]: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
         [refreshTokenExpired]: "Refresh token has expired.",
         [badToken]: "Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",
+        [uxNotAllowed]: "`canShowUI` flag in Edge was set to false. User interaction required on web page. Please invoke an interactive API to resolve.",
     };
     /**
      * Interaction required errors defined by the SDK
@@ -6473,7 +6540,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6545,16 +6612,14 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     const KeyLocation = {
-        SW: "sw",
-        UHW: "uhw",
-    };
+        SW: "sw"};
     /** @internal */
     class PopTokenGenerator {
         constructor(cryptoUtils, performanceClient) {
@@ -6629,7 +6694,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6656,7 +6721,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6769,7 +6834,7 @@
                     !forceCacheRefreshTokenResponse &&
                     cacheRecord.account) {
                     const key = cacheRecord.account.generateAccountKey();
-                    const account = this.cacheStorage.getAccount(key);
+                    const account = this.cacheStorage.getAccount(key, request.correlationId);
                     if (!account) {
                         this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                         return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
@@ -6804,7 +6869,7 @@
             let cachedAccount;
             if (serverTokenResponse.id_token && !!idTokenClaims) {
                 cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
-                cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+                cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
                 this.logger);
             }
             // AccessToken
@@ -6953,7 +7018,7 @@
             };
         }
     }
-    function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+    function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
         logger?.verbose("setCachedAccount called");
         // Check if base account is already cached
         const accountKeys = cacheStorage.getAccountKeys();
@@ -6962,7 +7027,7 @@
         });
         let cachedAccount = null;
         if (baseAccountKey) {
-            cachedAccount = cacheStorage.getAccount(baseAccountKey);
+            cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId);
         }
         const baseAccount = cachedAccount ||
             AccountEntity.createAccount({
@@ -6987,7 +7052,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7054,7 +7119,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7072,7 +7137,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7305,7 +7370,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7378,7 +7443,7 @@
         async acquireTokenWithCachedRefreshToken(request, foci) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
             // fetches family RT or application RT based on FOCI value
-            const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
+            const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined, this.performanceClient);
             if (!refreshToken) {
                 throw createInteractionRequiredAuthError(noTokensFound);
             }
@@ -7408,7 +7473,7 @@
                         // Remove bad refresh token from cache
                         this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
                         const badRefreshTokenKey = generateCredentialKey(refreshToken);
-                        this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+                        this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
                     }
                 }
                 throw e;
@@ -7514,7 +7579,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7546,7 +7611,7 @@
             const requestTenantId = request.account.tenantId ||
                 getTenantFromAuthorityString(request.authority);
             const tokenKeys = this.cacheManager.getTokenKeys();
-            const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);
+            const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
             if (!cachedAccessToken) {
                 // must refresh due to non-existent access_token
                 this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
@@ -7566,9 +7631,9 @@
             }
             const environment = request.authority || this.authority.getPreferredCache();
             const cacheRecord = {
-                account: this.cacheManager.readAccountFromCache(request.account),
+                account: this.cacheManager.readAccountFromCache(request.account, request.correlationId),
                 accessToken: cachedAccessToken,
-                idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),
+                idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId, this.performanceClient),
                 refreshToken: null,
                 appMetadata: this.cacheManager.readAppMetadataFromCache(environment),
             };
@@ -7612,7 +7677,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7627,7 +7692,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7851,7 +7916,7 @@
         return account.idTokenClaims?.login_hint || null;
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7909,7 +7974,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8048,7 +8113,7 @@
             else {
                 lastRequests.errors.push(SERVER_TELEM_CONSTANTS.UNKNOWN_ERROR);
             }
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
             return;
         }
         /**
@@ -8057,7 +8122,7 @@
         incrementCacheHits() {
             const lastRequests = this.getLastRequests();
             lastRequests.cacheHits += 1;
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
             return lastRequests.cacheHits;
         }
         /**
@@ -8081,7 +8146,7 @@
             const errorCount = lastRequests.errors.length;
             if (numErrorsFlushed === errorCount) {
                 // All errors were sent on last request, clear Telemetry cache
-                this.cacheManager.removeItem(this.telemetryCacheKey);
+                this.cacheManager.removeItem(this.telemetryCacheKey, this.correlationId);
             }
             else {
                 // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
@@ -8090,7 +8155,7 @@
                     errors: lastRequests.errors.slice(numErrorsFlushed),
                     cacheHits: 0,
                 };
-                this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity);
+                this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity, this.correlationId);
             }
         }
         /**
@@ -8157,7 +8222,7 @@
         setNativeBrokerErrorCode(errorCode) {
             const lastRequests = this.getLastRequests();
             lastRequests.nativeBrokerErrorCode = errorCode;
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         }
         getNativeBrokerErrorCode() {
             return this.getLastRequests().nativeBrokerErrorCode;
@@ -8165,14 +8230,14 @@
         clearNativeBrokerErrorCode() {
             const lastRequests = this.getLastRequests();
             delete lastRequests.nativeBrokerErrorCode;
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         }
         static makeExtraSkuString(params) {
             return makeExtraSkuString(params);
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8180,7 +8245,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8205,7 +8270,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8245,86 +8310,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    class StubPerformanceMeasurement {
-        startMeasurement() {
-            return;
-        }
-        endMeasurement() {
-            return;
-        }
-        flushMeasurement() {
-            return null;
-        }
-    }
-    class StubPerformanceClient {
-        generateId() {
-            return "callback-id";
-        }
-        startMeasurement(measureName, correlationId) {
-            return {
-                end: () => null,
-                discard: () => { },
-                add: () => { },
-                increment: () => { },
-                event: {
-                    eventId: this.generateId(),
-                    status: PerformanceEventStatus.InProgress,
-                    authority: "",
-                    libraryName: "",
-                    libraryVersion: "",
-                    clientId: "",
-                    name: measureName,
-                    startTimeMs: Date.now(),
-                    correlationId: correlationId || "",
-                },
-                measurement: new StubPerformanceMeasurement(),
-            };
-        }
-        startPerformanceMeasurement() {
-            return new StubPerformanceMeasurement();
-        }
-        calculateQueuedTime() {
-            return 0;
-        }
-        addQueueMeasurement() {
-            return;
-        }
-        setPreQueueTime() {
-            return;
-        }
-        endMeasurement() {
-            return null;
-        }
-        discardMeasurements() {
-            return;
-        }
-        removePerformanceCallback() {
-            return true;
-        }
-        addPerformanceCallback() {
-            return "";
-        }
-        emitEvents() {
-            return;
-        }
-        addFields() {
-            return;
-        }
-        incrementFields() {
-            return;
-        }
-        cacheEventByCorrelationId() {
-            return;
-        }
-    }
-
-    /*! @azure/msal-common v15.7.0 2025-06-10 */
+    /*! @azure/msal-common v15.8.0 2025-07-01 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8986,7 +8972,8 @@
     const invalidPopTokenRequest = "invalid_pop_token_request";
     const failedToBuildHeaders = "failed_to_build_headers";
     const failedToParseHeaders = "failed_to_parse_headers";
-    const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
+    const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
+    const timedOut = "timed_out";
 
     var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -9034,6 +9021,7 @@
         silentPromptValueError: silentPromptValueError,
         spaCodeAndNativeAccountIdPresent: spaCodeAndNativeAccountIdPresent,
         stateInteractionTypeMismatch: stateInteractionTypeMismatch,
+        timedOut: timedOut,
         unableToAcquireTokenFromNativePlatform: unableToAcquireTokenFromNativePlatform,
         unableToLoadToken: unableToLoadToken,
         unableToParseState: unableToParseState,
@@ -9101,6 +9089,7 @@
         [failedToBuildHeaders]: "Failed to build request headers object.",
         [failedToParseHeaders]: "Failed to parse response headers",
         [failedToDecryptEarResponse]: "Failed to decrypt ear response",
+        [timedOut]: "The request timed out.",
     };
     /**
      * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9314,10 +9303,6 @@
      * Constants
      */
     const BrowserConstants = {
-        /**
-         * Interaction in progress cache value
-         */
-        INTERACTION_IN_PROGRESS_VALUE: "interaction_in_progress",
         /**
          * Invalid grant error code
          */
@@ -10169,9 +10154,9 @@
             else {
                 window.location.assign(url); // CodeQL [SM03712] Application owner controls the URL. User can't change it.
             }
-            return new Promise((resolve) => {
+            return new Promise((resolve, reject) => {
                 setTimeout(() => {
-                    resolve(true);
+                    reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
                 }, options.timeout);
             });
         }
@@ -10429,7 +10414,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "4.13.1";
+    const version = "4.14.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11273,7 +11258,9 @@
         async removeTokenBindingKey(kid) {
             await this.cache.removeItem(kid);
             const keyFound = await this.cache.containsKey(kid);
-            return !keyFound;
+            if (keyFound) {
+                throw createClientAuthError(bindingKeyNotRemoved);
+            }
         }
         /**
          * Removes all cryptographic keys from IndexedDB storage
@@ -11540,7 +11527,7 @@
         setItem(key, value) {
             window.localStorage.setItem(key, value);
         }
-        async setUserData(key, value, correlationId) {
+        async setUserData(key, value, correlationId, timestamp) {
             if (!this.initialized || !this.encryptionCookie) {
                 throw createBrowserAuthError(uninitializedPublicClientApplication);
             }
@@ -11549,6 +11536,7 @@
                 id: this.encryptionCookie.id,
                 nonce: nonce,
                 data: data,
+                lastUpdatedAt: timestamp,
             };
             this.memoryStorage.setItem(key, value);
             this.setItem(key, JSON.stringify(encryptedData));
@@ -11795,14 +11783,13 @@
      */
     class BrowserCacheManager extends CacheManager {
         constructor(clientId, cacheConfig, cryptoImpl, logger, performanceClient, eventHandler, staticAuthorityOptions) {
-            super(clientId, cryptoImpl, logger, staticAuthorityOptions);
+            super(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions);
             this.cacheConfig = cacheConfig;
             this.logger = logger;
             this.internalStorage = new MemoryStorage();
             this.browserStorage = getStorageImplementation(clientId, cacheConfig.cacheLocation, logger, performanceClient);
             this.temporaryCacheStorage = getStorageImplementation(clientId, cacheConfig.temporaryCacheLocation, logger, performanceClient);
             this.cookieStorage = new CookieStorage();
-            this.performanceClient = performanceClient;
             this.eventHandler = eventHandler;
         }
         async initialize(correlationId) {
@@ -11819,7 +11806,7 @@
                 this.performanceClient.addFields({ previousLibraryVersion: previousVersion }, correlationId);
             }
             if (previousVersion !== version) {
-                this.browserStorage.setItem(StaticCacheKeys.VERSION, version);
+                this.setItem(StaticCacheKeys.VERSION, version, correlationId);
             }
         }
         /**
@@ -11843,22 +11830,111 @@
                 return null;
             }
         }
+        /**
+         * Helper to setItem in browser storage, with cleanup in case of quota errors
+         * @param key
+         * @param value
+         */
+        setItem(key, value, correlationId) {
+            let accessTokenKeys = [];
+            const maxRetries = 20;
+            for (let i = 0; i <= maxRetries; i++) {
+                try {
+                    this.browserStorage.setItem(key, value);
+                    if (i > 0) {
+                        // Finally update the token keys array with the tokens removed
+                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId);
+                    }
+                    break; // If setItem succeeds, exit the loop
+                }
+                catch (e) {
+                    const cacheError = createCacheError(e);
+                    if (cacheError.errorCode ===
+                        cacheQuotaExceeded &&
+                        i < maxRetries) {
+                        if (!accessTokenKeys.length) {
+                            if (key ===
+                                `${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`) {
+                                // If we are currently trying to set the token keys, use the value we're trying to set
+                                accessTokenKeys = JSON.parse(value)
+                                    .accessToken;
+                            }
+                            else {
+                                // If token keys have not been initialized, get them
+                                accessTokenKeys = this.getTokenKeys().accessToken;
+                            }
+                        }
+                        if (accessTokenKeys.length <= i) {
+                            // Nothing to remove, rethrow the error
+                            throw cacheError;
+                        }
+                        // When cache quota is exceeded, start removing access tokens until we can successfully set the item
+                        this.removeAccessToken(accessTokenKeys[i], correlationId, false // Don't save token keys yet, do it at the end
+                        );
+                    }
+                    else {
+                        // If the error is not a quota exceeded error, rethrow it
+                        throw cacheError;
+                    }
+                }
+            }
+        }
+        /**
+         * Helper to setUserData in browser storage, with cleanup in case of quota errors
+         * @param key
+         * @param value
+         * @param correlationId
+         */
+        async setUserData(key, value, correlationId, timestamp) {
+            let accessTokenKeys = [];
+            const maxRetries = 20;
+            for (let i = 0; i <= maxRetries; i++) {
+                try {
+                    await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, value, correlationId, timestamp);
+                    if (i > 0) {
+                        // Finally update the token keys array with the tokens removed
+                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId);
+                    }
+                    break; // If setItem succeeds, exit the loop
+                }
+                catch (e) {
+                    const cacheError = createCacheError(e);
+                    if (cacheError.errorCode ===
+                        cacheQuotaExceeded &&
+                        i < maxRetries) {
+                        if (!accessTokenKeys.length) {
+                            accessTokenKeys = this.getTokenKeys().accessToken;
+                        }
+                        if (accessTokenKeys.length <= i) {
+                            // Nothing left to remove, rethrow the error
+                            throw cacheError;
+                        }
+                        // When cache quota is exceeded, start removing access tokens until we can successfully set the item
+                        this.removeAccessToken(accessTokenKeys[i], correlationId, false // Don't save token keys yet, do it at the end
+                        );
+                    }
+                    else {
+                        // If the error is not a quota exceeded error, rethrow it
+                        throw cacheError;
+                    }
+                }
+            }
+        }
         /**
          * Reads account from cache, deserializes it into an account entity and returns it.
          * If account is not found from the key, returns null and removes key from map.
          * @param accountKey
          * @returns
          */
-        getAccount(accountKey) {
+        getAccount(accountKey, correlationId) {
             this.logger.trace("BrowserCacheManager.getAccount called");
             const serializedAccount = this.browserStorage.getUserData(accountKey);
             if (!serializedAccount) {
-                this.removeAccountKeyFromMap(accountKey);
+                this.removeAccountKeyFromMap(accountKey, correlationId);
                 return null;
             }
             const parsedAccount = this.validateAndParseJson(serializedAccount);
             if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
-                this.removeAccountKeyFromMap(accountKey);
                 return null;
             }
             return CacheManager.toObject(new AccountEntity(), parsedAccount);
@@ -11870,8 +11946,10 @@
         async setAccount(account, correlationId) {
             this.logger.trace("BrowserCacheManager.setAccount called");
             const key = account.generateAccountKey();
-            await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, JSON.stringify(account), correlationId);
-            const wasAdded = this.addAccountKeyToMap(key);
+            const timestamp = Date.now().toString();
+            account.lastUpdatedAt = timestamp;
+            await this.setUserData(key, JSON.stringify(account), correlationId, timestamp);
+            const wasAdded = this.addAccountKeyToMap(key, correlationId);
             /**
              * @deprecated - Remove this in next major version in favor of more consistent LOGIN event
              */
@@ -11892,14 +11970,14 @@
          * Add a new account to the key map
          * @param key
          */
-        addAccountKeyToMap(key) {
+        addAccountKeyToMap(key, correlationId) {
             this.logger.trace("BrowserCacheManager.addAccountKeyToMap called");
             this.logger.tracePii(`BrowserCacheManager.addAccountKeyToMap called with key: ${key}`);
             const accountKeys = this.getAccountKeys();
             if (accountKeys.indexOf(key) === -1) {
                 // Only add key if it does not already exist in the map
                 accountKeys.push(key);
-                this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
                 this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
                 return true;
             }
@@ -11912,14 +11990,21 @@
          * Remove an account from the key map
          * @param key
          */
-        removeAccountKeyFromMap(key) {
+        removeAccountKeyFromMap(key, correlationId) {
             this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called");
             this.logger.tracePii(`BrowserCacheManager.removeAccountKeyFromMap called with key: ${key}`);
             const accountKeys = this.getAccountKeys();
             const removalIndex = accountKeys.indexOf(key);
             if (removalIndex > -1) {
                 accountKeys.splice(removalIndex, 1);
-                this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+                if (accountKeys.length === 0) {
+                    // If no keys left, remove the map
+                    this.removeItem(StaticCacheKeys.ACCOUNT_KEYS);
+                    return;
+                }
+                else {
+                    this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
+                }
                 this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
             }
             else {
@@ -11930,16 +12015,16 @@
          * Extends inherited removeAccount function to include removal of the account key from the map
          * @param key
          */
-        async removeAccount(key) {
-            void super.removeAccount(key);
-            this.removeAccountKeyFromMap(key);
+        removeAccount(key, correlationId) {
+            super.removeAccount(key, correlationId);
+            this.removeAccountKeyFromMap(key, correlationId);
         }
         /**
          * Removes credentials associated with the provided account
          * @param account
          */
-        async removeAccountContext(account) {
-            await super.removeAccountContext(account);
+        removeAccountContext(account, correlationId) {
+            super.removeAccountContext(account, correlationId);
             /**
              * @deprecated - Remove this in next major version in favor of more consistent LOGOUT event
              */
@@ -11951,25 +12036,60 @@
          * Removes given idToken from the cache and from the key map
          * @param key
          */
-        removeIdToken(key) {
-            super.removeIdToken(key);
-            this.removeTokenKey(key, CredentialType.ID_TOKEN);
+        removeIdToken(key, correlationId) {
+            super.removeIdToken(key, correlationId);
+            const tokenKeys = this.getTokenKeys();
+            const idRemoval = tokenKeys.idToken.indexOf(key);
+            if (idRemoval > -1) {
+                this.logger.info("idToken removed from tokenKeys map");
+                tokenKeys.idToken.splice(idRemoval, 1);
+                this.setTokenKeys(tokenKeys, correlationId);
+            }
         }
         /**
          * Removes given accessToken from the cache and from the key map
          * @param key
          */
-        async removeAccessToken(key) {
-            void super.removeAccessToken(key);
-            this.removeTokenKey(key, CredentialType.ACCESS_TOKEN);
+        removeAccessToken(key, correlationId, updateTokenKeys = true) {
+            super.removeAccessToken(key, correlationId);
+            updateTokenKeys && this.removeAccessTokenKeys([key], correlationId);
+        }
+        /**
+         * Remove access token key from the key map
+         * @param key
+         * @param correlationId
+         * @param tokenKeys
+         */
+        removeAccessTokenKeys(keys, correlationId) {
+            this.logger.trace("removeAccessTokenKey called");
+            const tokenKeys = this.getTokenKeys();
+            let keysRemoved = 0;
+            keys.forEach((key) => {
+                const accessRemoval = tokenKeys.accessToken.indexOf(key);
+                if (accessRemoval > -1) {
+                    tokenKeys.accessToken.splice(accessRemoval, 1);
+                    keysRemoved++;
+                }
+            });
+            if (keysRemoved > 0) {
+                this.logger.info(`removed ${keysRemoved} accessToken keys from tokenKeys map`);
+                this.setTokenKeys(tokenKeys, correlationId);
+                return;
+            }
         }
         /**
          * Removes given refreshToken from the cache and from the key map
          * @param key
          */
-        removeRefreshToken(key) {
-            super.removeRefreshToken(key);
-            this.removeTokenKey(key, CredentialType.REFRESH_TOKEN);
+        removeRefreshToken(key, correlationId) {
+            super.removeRefreshToken(key, correlationId);
+            const tokenKeys = this.getTokenKeys();
+            const refreshRemoval = tokenKeys.refreshToken.indexOf(key);
+            if (refreshRemoval > -1) {
+                this.logger.info("refreshToken removed from tokenKeys map");
+                tokenKeys.refreshToken.splice(refreshRemoval, 1);
+                this.setTokenKeys(tokenKeys, correlationId);
+            }
         }
         /**
          * Gets the keys for the cached tokens associated with this clientId
@@ -11979,101 +12099,37 @@
             return getTokenKeys(this.clientId, this.browserStorage);
         }
         /**
-         * Adds the given key to the token key map
-         * @param key
-         * @param type
+         * Stores the token keys in the cache
+         * @param tokenKeys
+         * @param correlationId
+         * @returns
          */
-        addTokenKey(key, type) {
-            this.logger.trace("BrowserCacheManager addTokenKey called");
-            const tokenKeys = this.getTokenKeys();
-            switch (type) {
-                case CredentialType.ID_TOKEN:
-                    if (tokenKeys.idToken.indexOf(key) === -1) {
-                        this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
-                        tokenKeys.idToken.push(key);
-                    }
-                    break;
-                case CredentialType.ACCESS_TOKEN:
-                    if (tokenKeys.accessToken.indexOf(key) === -1) {
-                        this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map");
-                        tokenKeys.accessToken.push(key);
-                    }
-                    break;
-                case CredentialType.REFRESH_TOKEN:
-                    if (tokenKeys.refreshToken.indexOf(key) === -1) {
-                        this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
-                        tokenKeys.refreshToken.push(key);
-                    }
-                    break;
-                default:
-                    this.logger.error(`BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
-                    throw createClientAuthError(unexpectedCredentialType);
+        setTokenKeys(tokenKeys, correlationId) {
+            if (tokenKeys.idToken.length === 0 &&
+                tokenKeys.accessToken.length === 0 &&
+                tokenKeys.refreshToken.length === 0) {
+                // If no keys left, remove the map
+                this.removeItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
+                return;
             }
-            this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
-        }
-        /**
-         * Removes the given key from the token key map
-         * @param key
-         * @param type
-         */
-        removeTokenKey(key, type) {
-            this.logger.trace("BrowserCacheManager removeTokenKey called");
-            const tokenKeys = this.getTokenKeys();
-            switch (type) {
-                case CredentialType.ID_TOKEN:
-                    this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: ${key} from map`);
-                    const idRemoval = tokenKeys.idToken.indexOf(key);
-                    if (idRemoval > -1) {
-                        this.logger.info("BrowserCacheManager: removeTokenKey - idToken removed from map");
-                        tokenKeys.idToken.splice(idRemoval, 1);
-                    }
-                    else {
-                        this.logger.info("BrowserCacheManager: removeTokenKey - idToken does not exist in map. Either it was previously removed or it was never added.");
-                    }
-                    break;
-                case CredentialType.ACCESS_TOKEN:
-                    this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove accessToken with key: ${key} from map`);
-                    const accessRemoval = tokenKeys.accessToken.indexOf(key);
-                    if (accessRemoval > -1) {
-                        this.logger.info("BrowserCacheManager: removeTokenKey - accessToken removed from map");
-                        tokenKeys.accessToken.splice(accessRemoval, 1);
-                    }
-                    else {
-                        this.logger.info("BrowserCacheManager: removeTokenKey - accessToken does not exist in map. Either it was previously removed or it was never added.");
-                    }
-                    break;
-                case CredentialType.REFRESH_TOKEN:
-                    this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove refreshToken with key: ${key} from map`);
-                    const refreshRemoval = tokenKeys.refreshToken.indexOf(key);
-                    if (refreshRemoval > -1) {
-                        this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken removed from map");
-                        tokenKeys.refreshToken.splice(refreshRemoval, 1);
-                    }
-                    else {
-                        this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken does not exist in map. Either it was previously removed or it was never added.");
-                    }
-                    break;
-                default:
-                    this.logger.error(`BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
-                    throw createClientAuthError(unexpectedCredentialType);
+            else {
+                this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys), correlationId);
             }
-            this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
         }
         /**
          * generates idToken entity from a string
          * @param idTokenKey
          */
-        getIdTokenCredential(idTokenKey) {
+        getIdTokenCredential(idTokenKey, correlationId) {
             const value = this.browserStorage.getUserData(idTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-                this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+                this.removeIdToken(idTokenKey, correlationId);
                 return null;
             }
             const parsedIdToken = this.validateAndParseJson(value);
             if (!parsedIdToken || !isIdTokenEntity(parsedIdToken)) {
                 this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-                this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit");
@@ -12086,25 +12142,31 @@
         async setIdTokenCredential(idToken, correlationId) {
             this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
             const idTokenKey = generateCredentialKey(idToken);
-            await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(idTokenKey, JSON.stringify(idToken), correlationId);
-            this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+            const timestamp = Date.now().toString();
+            idToken.lastUpdatedAt = timestamp;
+            await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp);
+            const tokenKeys = this.getTokenKeys();
+            if (tokenKeys.idToken.indexOf(idTokenKey) === -1) {
+                this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
+                tokenKeys.idToken.push(idTokenKey);
+                this.setTokenKeys(tokenKeys, correlationId);
+            }
         }
         /**
          * generates accessToken entity from a string
          * @param key
          */
-        getAccessTokenCredential(accessTokenKey) {
+        getAccessTokenCredential(accessTokenKey, correlationId) {
             const value = this.browserStorage.getUserData(accessTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-                this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+                this.removeAccessTokenKeys([accessTokenKey], correlationId);
                 return null;
             }
             const parsedAccessToken = this.validateAndParseJson(value);
             if (!parsedAccessToken ||
                 !isAccessTokenEntity(parsedAccessToken)) {
                 this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-                this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit");
@@ -12117,25 +12179,33 @@
         async setAccessTokenCredential(accessToken, correlationId) {
             this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
             const accessTokenKey = generateCredentialKey(accessToken);
-            await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(accessTokenKey, JSON.stringify(accessToken), correlationId);
-            this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+            const timestamp = Date.now().toString();
+            accessToken.lastUpdatedAt = timestamp;
+            await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp);
+            const tokenKeys = this.getTokenKeys();
+            const index = tokenKeys.accessToken.indexOf(accessTokenKey);
+            if (index !== -1) {
+                tokenKeys.accessToken.splice(index, 1); // Remove existing key before pushing to the end
+            }
+            this.logger.trace(`access token ${index === -1 ? "added to" : "updated in"} map`);
+            tokenKeys.accessToken.push(accessTokenKey);
+            this.setTokenKeys(tokenKeys, correlationId);
         }
         /**
          * generates refreshToken entity from a string
          * @param refreshTokenKey
          */
-        getRefreshTokenCredential(refreshTokenKey) {
+        getRefreshTokenCredential(refreshTokenKey, correlationId) {
             const value = this.browserStorage.getUserData(refreshTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-                this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+                this.removeRefreshToken(refreshTokenKey, correlationId);
                 return null;
             }
             const parsedRefreshToken = this.validateAndParseJson(value);
             if (!parsedRefreshToken ||
                 !isRefreshTokenEntity(parsedRefreshToken)) {
                 this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-                this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit");
@@ -12148,8 +12218,15 @@
         async setRefreshTokenCredential(refreshToken, correlationId) {
             this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
             const refreshTokenKey = generateCredentialKey(refreshToken);
-            await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(refreshTokenKey, JSON.stringify(refreshToken), correlationId);
-            this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+            const timestamp = Date.now().toString();
+            refreshToken.lastUpdatedAt = timestamp;
+            await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp);
+            const tokenKeys = this.getTokenKeys();
+            if (tokenKeys.refreshToken.indexOf(refreshTokenKey) === -1) {
+                this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
+                tokenKeys.refreshToken.push(refreshTokenKey);
+                this.setTokenKeys(tokenKeys, correlationId);
+            }
         }
         /**
          * fetch appMetadata entity from the platform cache
@@ -12174,10 +12251,10 @@
          * set appMetadata entity to the platform cache
          * @param appMetadata
          */
-        setAppMetadata(appMetadata) {
+        setAppMetadata(appMetadata, correlationId) {
             this.logger.trace("BrowserCacheManager.setAppMetadata called");
             const appMetadataKey = generateAppMetadataKey(appMetadata);
-            this.browserStorage.setItem(appMetadataKey, JSON.stringify(appMetadata));
+            this.setItem(appMetadataKey, JSON.stringify(appMetadata), correlationId);
         }
         /**
          * fetch server telemetry entity from the platform cache
@@ -12203,9 +12280,9 @@
          * @param serverTelemetryKey
          * @param serverTelemetry
          */
-        setServerTelemetry(serverTelemetryKey, serverTelemetry) {
+        setServerTelemetry(serverTelemetryKey, serverTelemetry, correlationId) {
             this.logger.trace("BrowserCacheManager.setServerTelemetry called");
-            this.browserStorage.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry));
+            this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry), correlationId);
         }
         /**
          *
@@ -12263,7 +12340,7 @@
         /**
          * Gets the active account
          */
-        getActiveAccount() {
+        getActiveAccount(correlationId) {
             const activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
             const activeAccountValueFilters = this.browserStorage.getItem(activeAccountKeyFilters);
             if (!activeAccountValueFilters) {
@@ -12277,7 +12354,7 @@
                     homeAccountId: activeAccountValueObj.homeAccountId,
                     localAccountId: activeAccountValueObj.localAccountId,
                     tenantId: activeAccountValueObj.tenantId,
-                });
+                }, correlationId);
             }
             this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found");
             return null;
@@ -12286,7 +12363,7 @@
          * Sets the active account's localAccountId in cache
          * @param account
          */
-        setActiveAccount(account) {
+        setActiveAccount(account, correlationId) {
             const activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
             if (account) {
                 this.logger.verbose("setActiveAccount: Active account set");
@@ -12294,8 +12371,9 @@
                     homeAccountId: account.homeAccountId,
                     localAccountId: account.localAccountId,
                     tenantId: account.tenantId,
+                    lastUpdatedAt: nowSeconds().toString(),
                 };
-                this.browserStorage.setItem(activeAccountKey, JSON.stringify(activeAccountValue));
+                this.setItem(activeAccountKey, JSON.stringify(activeAccountValue), correlationId);
             }
             else {
                 this.logger.verbose("setActiveAccount: No account passed, active account not set");
@@ -12327,9 +12405,9 @@
          * @param throttlingCacheKey
          * @param throttlingCache
          */
-        setThrottlingCache(throttlingCacheKey, throttlingCache) {
+        setThrottlingCache(throttlingCacheKey, throttlingCache, correlationId) {
             this.logger.trace("BrowserCacheManager.setThrottlingCache called");
-            this.browserStorage.setItem(throttlingCacheKey, JSON.stringify(throttlingCache));
+            this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache), correlationId);
         }
         /**
          * Gets cache item with given key.
@@ -12405,10 +12483,10 @@
         /**
          * Clears all cache entries created by MSAL.
          */
-        async clear() {
+        clear(correlationId) {
             // Removes all accounts and their credentials
-            await this.removeAllAccounts();
-            this.removeAppMetadata();
+            this.removeAllAccounts(correlationId);
+            this.removeAppMetadata(correlationId);
             // Remove temp storage first to make sure any cookies are cleared
             this.temporaryCacheStorage.getKeys().forEach((cacheKey) => {
                 if (cacheKey.indexOf(Constants.CACHE_PREFIX) !== -1 ||
@@ -12431,22 +12509,22 @@
          * @param correlationId {string} correlation id
          * @returns
          */
-        async clearTokensAndKeysWithClaims(performanceClient, correlationId) {
-            performanceClient.addQueueMeasurement(PerformanceEvents.ClearTokensAndKeysWithClaims, correlationId);
+        clearTokensAndKeysWithClaims(correlationId) {
+            this.performanceClient.addQueueMeasurement(PerformanceEvents.ClearTokensAndKeysWithClaims, correlationId);
             const tokenKeys = this.getTokenKeys();
-            const removedAccessTokens = [];
+            let removedAccessTokens = 0;
             tokenKeys.accessToken.forEach((key) => {
                 // if the access token has claims in its key, remove the token key and the token
-                const credential = this.getAccessTokenCredential(key);
+                const credential = this.getAccessTokenCredential(key, correlationId);
                 if (credential?.requestedClaimsHash &&
                     key.includes(credential.requestedClaimsHash.toLowerCase())) {
-                    removedAccessTokens.push(this.removeAccessToken(key));
+                    this.removeAccessToken(key, correlationId);
+                    removedAccessTokens++;
                 }
             });
-            await Promise.all(removedAccessTokens);
             // warn if any access tokens are removed
-            if (removedAccessTokens.length > 0) {
-                this.logger.warning(`${removedAccessTokens.length} access tokens with claims in the cache keys have been removed from the cache.`);
+            if (removedAccessTokens > 0) {
+                this.logger.warning(`${removedAccessTokens} access tokens with claims in the cache keys have been removed from the cache.`);
             }
         }
         /**
@@ -12673,22 +12751,24 @@
      * @param accountFilter - (Optional) filter to narrow down the accounts returned
      * @returns Array of AccountInfo objects in cache
      */
-    function getAllAccounts(logger, browserStorage, isInBrowser, accountFilter) {
+    function getAllAccounts(logger, browserStorage, isInBrowser, correlationId, accountFilter) {
         logger.verbose("getAllAccounts called");
-        return isInBrowser ? browserStorage.getAllAccounts(accountFilter) : [];
+        return isInBrowser
+            ? browserStorage.getAllAccounts(accountFilter || {}, correlationId)
+            : [];
     }
     /**
      * Returns the first account found in the cache that matches the account filter passed in.
      * @param accountFilter
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
-    function getAccount(accountFilter, logger, browserStorage) {
+    function getAccount(accountFilter, logger, browserStorage, correlationId) {
         logger.trace("getAccount called");
         if (Object.keys(accountFilter).length === 0) {
             logger.warning("getAccount: No accountFilter provided");
             return null;
         }
-        const account = browserStorage.getAccountInfoFilteredBy(accountFilter);
+        const account = browserStorage.getAccountInfoFilteredBy(accountFilter, correlationId);
         if (account) {
             logger.verbose("getAccount: Account matching provided filter found, returning");
             return account;
@@ -12706,7 +12786,7 @@
      * @param username
      * @returns The account object stored in MSAL
      */
-    function getAccountByUsername(username, logger, browserStorage) {
+    function getAccountByUsername(username, logger, browserStorage, correlationId) {
         logger.trace("getAccountByUsername called");
         if (!username) {
             logger.warning("getAccountByUsername: No username provided");
@@ -12714,7 +12794,7 @@
         }
         const account = browserStorage.getAccountInfoFilteredBy({
             username,
-        });
+        }, correlationId);
         if (account) {
             logger.verbose("getAccountByUsername: Account matching username found, returning");
             logger.verbosePii(`getAccountByUsername: Returning signed-in accounts matching username: ${username}`);
@@ -12732,7 +12812,7 @@
      * @param homeAccountId
      * @returns The account object stored in MSAL
      */
-    function getAccountByHomeId(homeAccountId, logger, browserStorage) {
+    function getAccountByHomeId(homeAccountId, logger, browserStorage, correlationId) {
         logger.trace("getAccountByHomeId called");
         if (!homeAccountId) {
             logger.warning("getAccountByHomeId: No homeAccountId provided");
@@ -12740,7 +12820,7 @@
         }
         const account = browserStorage.getAccountInfoFilteredBy({
             homeAccountId,
-        });
+        }, correlationId);
         if (account) {
             logger.verbose("getAccountByHomeId: Account matching homeAccountId found, returning");
             logger.verbosePii(`getAccountByHomeId: Returning signed-in accounts matching homeAccountId: ${homeAccountId}`);
@@ -12758,7 +12838,7 @@
      * @param localAccountId
      * @returns The account object stored in MSAL
      */
-    function getAccountByLocalId(localAccountId, logger, browserStorage) {
+    function getAccountByLocalId(localAccountId, logger, browserStorage, correlationId) {
         logger.trace("getAccountByLocalId called");
         if (!localAccountId) {
             logger.warning("getAccountByLocalId: No localAccountId provided");
@@ -12766,7 +12846,7 @@
         }
         const account = browserStorage.getAccountInfoFilteredBy({
             localAccountId,
-        });
+        }, correlationId);
         if (account) {
             logger.verbose("getAccountByLocalId: Account matching localAccountId found, returning");
             logger.verbosePii(`getAccountByLocalId: Returning signed-in accounts matching localAccountId: ${localAccountId}`);
@@ -12781,14 +12861,14 @@
      * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
      * @param account
      */
-    function setActiveAccount(account, browserStorage) {
-        browserStorage.setActiveAccount(account);
+    function setActiveAccount(account, browserStorage, correlationId) {
+        browserStorage.setActiveAccount(account, correlationId);
     }
     /**
      * Gets the currently active account
      */
-    function getActiveAccount(browserStorage) {
-        return browserStorage.getActiveAccount();
+    function getActiveAccount(browserStorage, correlationId) {
+        return browserStorage.getActiveAccount(correlationId);
     }
 
     /*
@@ -12912,15 +12992,15 @@
             this.logger = logger.clone(BrowserConstants.MSAL_SKU, version, this.correlationId);
             this.performanceClient = performanceClient;
         }
-        async clearCacheOnLogout(account) {
+        async clearCacheOnLogout(correlationId, account) {
             if (account) {
-                if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(), false)) {
+                if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(correlationId), false)) {
                     this.logger.verbose("Setting active account to null");
-                    this.browserStorage.setActiveAccount(null);
+                    this.browserStorage.setActiveAccount(null, correlationId);
                 }
                 // Clear given account.
                 try {
-                    await this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account));
+                    this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account), correlationId);
                     this.logger.verbose("Cleared cache items belonging to the account provided in the logout request.");
                 }
                 catch (error) {
@@ -12931,7 +13011,7 @@
                 try {
                     this.logger.verbose("No account provided in logout request, clearing all cache items.", this.correlationId);
                     // Clear all accounts and tokens
-                    await this.browserStorage.clear();
+                    this.browserStorage.clear(correlationId);
                     // Clear any stray keys from IndexedDB
                     await this.browserCrypto.clearKeystore();
                 }
@@ -13253,7 +13333,8 @@
             if (request.loginHint || request.sid) {
                 return validatedRequest;
             }
-            const account = request.account || this.browserStorage.getActiveAccount();
+            const account = request.account ||
+                this.browserStorage.getActiveAccount(this.correlationId);
             if (account) {
                 this.logger.verbose("Setting validated request account", this.correlationId);
                 this.logger.verbosePii(`Setting validated request account: ${account.homeAccountId}`, this.correlationId);
@@ -13433,7 +13514,8 @@
     const NO_NETWORK = "NO_NETWORK";
     const PERSISTENT_ERROR = "PERSISTENT_ERROR";
     const DISABLED = "DISABLED";
-    const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
+    const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
+    const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13491,6 +13573,8 @@
                     return createBrowserAuthError(userCancelled);
                 case NO_NETWORK:
                     return createBrowserAuthError(noNetworkConnectivity);
+                case UX_NOT_ALLOWED:
+                    return createInteractionRequiredAuthError(uxNotAllowed);
             }
         }
         return new NativeAuthError(code, NativeAuthErrorMessages[code] || description, ext);
@@ -13540,7 +13624,7 @@
         logout(logoutRequest) {
             this.logger.verbose("logoutRedirect called");
             const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-            return this.clearCacheOnLogout(validLogoutRequest?.account);
+            return this.clearCacheOnLogout(validLogoutRequest.correlationId, validLogoutRequest?.account);
         }
     }
 
@@ -13664,7 +13748,7 @@
             // fetch the account from browser cache
             const account = this.browserStorage.getBaseAccountInfo({
                 nativeAccountId,
-            });
+            }, this.correlationId);
             if (!account) {
                 throw createClientAuthError(noAccountFound);
             }
@@ -13780,7 +13864,7 @@
             const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
             const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
                 nativeAccountId: request.accountId,
-            })?.homeAccountId;
+            }, this.correlationId)?.homeAccountId;
             // add exception for double brokering, please note this is temporary and will be fortified in future
             if (request.extraParameters?.child_client_id &&
                 response.account.id !== request.accountId) {
@@ -13795,7 +13879,7 @@
             const authority = await this.getDiscoveredAuthority({
                 requestAuthority: request.authority,
             });
-            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
+            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, undefined, // environment
             idTokenClaims.tid, undefined, // auth code payload
             response.account.id, this.logger);
             // Ensure expires_in is in number format
@@ -13803,7 +13887,7 @@
             // generate authenticationResult
             const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
             // cache accounts and tokens in the appropriate storage
-            await this.cacheAccount(baseAccount);
+            await this.cacheAccount(baseAccount, this.correlationId);
             await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
             return result;
         }
@@ -13927,13 +14011,11 @@
          * cache the account entity in browser storage
          * @param accountEntity
          */
-        async cacheAccount(accountEntity) {
+        async cacheAccount(accountEntity, correlationId) {
             // Store the account info and hence `nativeAccountId` in browser cache
             await this.browserStorage.setAccount(accountEntity, this.correlationId);
             // Remove any existing cached tokens for this account in browser storage
-            this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
-                this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
-            });
+            this.browserStorage.removeAccountContext(accountEntity, correlationId);
         }
         /**
          * Stores the access_token and id_token in inmemory storage
@@ -14889,14 +14971,14 @@
      * @param authenticationScheme
      */
     function isPlatformAuthAllowed(config, logger, platformAuthProvider, authenticationScheme) {
-        logger.trace("isBrokerAvailable called");
+        logger.trace("isPlatformAuthAllowed called");
         if (!config.system.allowPlatformBroker) {
-            logger.trace("isBrokerAvailable: allowPlatformBroker is not enabled, returning false");
+            logger.trace("isPlatformAuthAllowed: allowPlatformBroker is not enabled, returning false");
             // Developer disabled WAM
             return false;
         }
         if (!platformAuthProvider) {
-            logger.trace("isBrokerAvailable: Platform auth provider is not initialized, returning false");
+            logger.trace("isPlatformAuthAllowed: Platform auth provider is not initialized, returning false");
             // Platform broker auth providers are not available
             return false;
         }
@@ -14904,10 +14986,10 @@
             switch (authenticationScheme) {
                 case AuthenticationScheme.BEARER:
                 case AuthenticationScheme.POP:
-                    logger.trace("isBrokerAvailable: authenticationScheme is supported, returning true");
+                    logger.trace("isPlatformAuthAllowed: authenticationScheme is supported, returning true");
                     return true;
                 default:
-                    logger.trace("isBrokerAvailable: authenticationScheme is not supported, returning false");
+                    logger.trace("isPlatformAuthAllowed: authenticationScheme is not supported, returning false");
                     return false;
             }
         }
@@ -15103,7 +15185,7 @@
             const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.logoutPopup);
             try {
                 // Clear cache on logout
-                await this.clearCacheOnLogout(validRequest.account);
+                await this.clearCacheOnLogout(this.correlationId, validRequest.account);
                 // Initialize the client
                 const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
                     serverTelemetryManager,
@@ -15117,7 +15199,7 @@
                     if (validRequest.account?.homeAccountId &&
                         validRequest.postLogoutRedirectUri &&
                         authClient.authority.protocolMode === ProtocolMode.OIDC) {
-                        void this.browserStorage.removeAccount(validRequest.account?.homeAccountId);
+                        this.browserStorage.removeAccount(validRequest.account?.homeAccountId, this.correlationId);
                         this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
                         if (mainWindowRedirectUri) {
                             const navigationOptions = {
@@ -15481,6 +15563,11 @@
             this.browserStorage.cacheAuthorizeRequest(redirectRequest);
             const form = await getEARForm(document, this.config, discoveredAuthority, redirectRequest, this.logger, this.performanceClient);
             form.submit();
+            return new Promise((resolve, reject) => {
+                setTimeout(() => {
+                    reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
+                }, this.config.system.redirectNavigationTimeout);
+            });
         }
         /**
          * Checks if navigateToLoginRequestUrl is set, and:
@@ -15695,7 +15782,7 @@
             try {
                 this.eventHandler.emitEvent(EventType.LOGOUT_START, exports.InteractionType.Redirect, logoutRequest);
                 // Clear cache on logout
-                await this.clearCacheOnLogout(validLogoutRequest.account);
+                await this.clearCacheOnLogout(this.correlationId, validLogoutRequest.account);
                 const navigationOptions = {
                     apiId: ApiId.logout,
                     timeout: this.config.system.redirectNavigationTimeout,
@@ -15713,7 +15800,7 @@
                     }
                     catch {
                         if (validLogoutRequest.account?.homeAccountId) {
-                            void this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId);
+                            this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId, this.correlationId);
                             this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Redirect, validLogoutRequest);
                             return;
                         }
@@ -16190,7 +16277,7 @@
             }
             const homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
             const claimsTenantId = idTokenClaims?.tid;
-            const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
+            const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
             undefined, // nativeAccountId
             this.logger);
             await this.storage.setAccount(cachedAccount, correlationId);
@@ -16553,7 +16640,7 @@
             }
             if (!this.config.cache.claimsBasedCachingEnabled) {
                 this.logger.verbose("Claims-based caching is disabled. Clearing the previous cache with claims");
-                await invokeAsync(this.browserStorage.clearTokensAndKeysWithClaims.bind(this.browserStorage), PerformanceEvents.ClearTokensAndKeysWithClaims, this.logger, this.performanceClient, initCorrelationId)(this.performanceClient, initCorrelationId);
+                invoke(this.browserStorage.clearTokensAndKeysWithClaims.bind(this.browserStorage), PerformanceEvents.ClearTokensAndKeysWithClaims, this.logger, this.performanceClient, initCorrelationId)(initCorrelationId);
             }
             this.config.system.asyncPopups &&
                 (await this.preGeneratePkceCodes(initCorrelationId));
@@ -17228,7 +17315,8 @@
          * @returns Array of AccountInfo objects in cache
          */
         getAllAccounts(accountFilter) {
-            return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, accountFilter);
+            const correlationId = this.getRequestCorrelationId();
+            return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, correlationId, accountFilter);
         }
         /**
          * Returns the first account found in the cache that matches the account filter passed in.
@@ -17236,7 +17324,8 @@
          * @returns The first account found in the cache matching the provided filter or null if no account could be found.
          */
         getAccount(accountFilter) {
-            return getAccount(accountFilter, this.logger, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching username.
@@ -17247,7 +17336,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByUsername(username) {
-            return getAccountByUsername(username, this.logger, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching homeAccountId.
@@ -17257,7 +17347,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByHomeId(homeAccountId) {
-            return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching localAccountId.
@@ -17267,20 +17358,23 @@
          * @returns The account object stored in MSAL
          */
         getAccountByLocalId(localAccountId) {
-            return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
          * @param account
          */
         setActiveAccount(account) {
-            setActiveAccount(account, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            setActiveAccount(account, this.browserStorage, correlationId);
         }
         /**
          * Gets the currently active account
          */
         getActiveAccount() {
-            return getActiveAccount(this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getActiveAccount(this.browserStorage, correlationId);
         }
         // #endregion
         /**
@@ -17620,9 +17714,7 @@
         async acquireTokenSilentDeduped(request, account, correlationId) {
             const thumbprint = getRequestThumbprint(this.config.auth.clientId, {
                 ...request,
-                authority: request.authority || this.config.auth.authority,
-                correlationId: correlationId,
-            }, account.homeAccountId);
+                authority: request.authority || this.config.auth.authority}, account.homeAccountId);
             const silentRequestKey = JSON.stringify(thumbprint);
             const inProgressRequest = this.activeSilentTokenRequests.get(silentRequestKey);
             if (typeof inProgressRequest === "undefined") {
@@ -18284,8 +18376,9 @@
             // always prioritize the account context from the bridge
             const accountContext = this.bridgeProxy.getAccountContext() || this.currentAccountContext;
             let currentAccount = null;
+            const correlationId = request.correlationId || this.browserCrypto.createNewGuid();
             if (accountContext) {
-                currentAccount = getAccount(accountContext, this.logger, this.browserStorage);
+                currentAccount = getAccount(accountContext, this.logger, this.browserStorage, correlationId);
             }
             // fall back to brokering if no cached account is found
             if (!currentAccount) {
@@ -18303,7 +18396,7 @@
             };
             // fetch access token and check for expiry
             const tokenKeys = this.browserStorage.getTokenKeys();
-            const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+            const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId);
             // If there is no access token, log it and return null
             if (!cachedAccessToken) {
                 this.logger.verbose("No cached access token found");
@@ -18314,7 +18407,7 @@
                 this.logger.verbose("Cached access token has expired");
                 return Promise.resolve(null);
             }
-            const cachedIdToken = this.browserStorage.getIdToken(currentAccount, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+            const cachedIdToken = this.browserStorage.getIdToken(currentAccount, authRequest.correlationId, tokenKeys, currentAccount.tenantId, this.performanceClient);
             if (!cachedIdToken) {
                 this.logger.verbose("No cached id token found");
                 return Promise.resolve(null);
@@ -18411,7 +18504,8 @@
          * @returns Array of AccountInfo objects in cache
          */
         getAllAccounts(accountFilter) {
-            return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), accountFilter);
+            const correlationId = this.browserCrypto.createNewGuid();
+            return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), correlationId, accountFilter);
         }
         /**
          * Returns the first account found in the cache that matches the account filter passed in.
@@ -18419,7 +18513,8 @@
          * @returns The first account found in the cache matching the provided filter or null if no account could be found.
          */
         getAccount(accountFilter) {
-            return getAccount(accountFilter, this.logger, this.browserStorage);
+            const correlationId = this.browserCrypto.createNewGuid();
+            return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching username.
@@ -18430,7 +18525,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByUsername(username) {
-            return getAccountByUsername(username, this.logger, this.browserStorage);
+            const correlationId = this.browserCrypto.createNewGuid();
+            return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching homeAccountId.
@@ -18440,7 +18536,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByHomeId(homeAccountId) {
-            return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+            const correlationId = this.browserCrypto.createNewGuid();
+            return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching localAccountId.
@@ -18450,7 +18547,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByLocalId(localAccountId) {
-            return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+            const correlationId = this.browserCrypto.createNewGuid();
+            return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
@@ -18461,13 +18559,15 @@
              * StandardController uses this to allow the developer to set the active account
              * in the nested app auth scenario the active account is controlled by the app hosting the nested app
              */
-            return setActiveAccount(account, this.browserStorage);
+            const correlationId = this.browserCrypto.createNewGuid();
+            return setActiveAccount(account, this.browserStorage, correlationId);
         }
         /**
          * Gets the currently active account
          */
         getActiveAccount() {
-            return getActiveAccount(this.browserStorage);
+            const correlationId = this.browserCrypto.createNewGuid();
+            return getActiveAccount(this.browserStorage, correlationId);
         }
         // #endregion
         handleRedirectPromise(hash // eslint-disable-line @typescript-eslint/no-unused-vars
@@ -19816,7 +19916,20 @@
          * @returns If keys are properly deleted
          */
         async removeKeys(publicKeyThumbprint) {
-            return this.cryptoOps.removeTokenBindingKey(publicKeyThumbprint);
+            return this.cryptoOps
+                .removeTokenBindingKey(publicKeyThumbprint)
+                .then(() => true)
+                .catch((error) => {
+                /*
+                 * @deprecated - To maintain public API signature, we return false if the error is due to the key still being present in indexedDB.
+                 */
+                if (error instanceof ClientAuthError &&
+                    error.errorCode ===
+                        bindingKeyNotRemoved) {
+                    return false;
+                }
+                throw error;
+            });
         }
     }