@azure/msal-browser 4.13.2 → 4.15.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.13.2 2025-06-18 */
+/*! @azure/msal-browser v4.15.0 2025-07-08 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -135,19 +135,11 @@ const PromptValue = {
     CREATE: "create",
     NO_SESSION: "no_session",
 };
-/**
- * allowed values for codeVerifier
- */
-const CodeChallengeMethodValues = {
-    PLAIN: "plain",
-    S256: "S256",
-};
 /**
  * Allowed values for response_type
  */
 const OAuthResponseType = {
     CODE: "code",
-    IDTOKEN_TOKEN: "id_token token",
     IDTOKEN_TOKEN_REFRESHTOKEN: "id_token token refresh_token",
 };
 /**
@@ -162,29 +154,19 @@ const ServerResponseType = {
  * allowed values for response_mode
  */
 const ResponseMode = {
-    QUERY: "query",
-    FRAGMENT: "fragment",
-    FORM_POST: "form_post",
-};
+    QUERY: "query"};
 /**
  * allowed grant_type
  */
 const GrantType = {
-    IMPLICIT_GRANT: "implicit",
     AUTHORIZATION_CODE_GRANT: "authorization_code",
-    CLIENT_CREDENTIALS_GRANT: "client_credentials",
-    RESOURCE_OWNER_PASSWORD_GRANT: "password",
-    REFRESH_TOKEN_GRANT: "refresh_token",
-    DEVICE_CODE_GRANT: "device_code",
-    JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-};
+    REFRESH_TOKEN_GRANT: "refresh_token"};
 /**
  * Account types in Cache
  */
 const CacheAccountType = {
     MSSTS_ACCOUNT_TYPE: "MSSTS",
     ADFS_ACCOUNT_TYPE: "ADFS",
-    MSAV1_ACCOUNT_TYPE: "MSA",
     GENERIC_ACCOUNT_TYPE: "Generic", // NTLM, Kerberos, FBA, Basic etc
 };
 /**
@@ -221,7 +203,6 @@ const AuthorityMetadataSource = {
 };
 const SERVER_TELEM_CONSTANTS = {
     SCHEMA_VERSION: 5,
-    MAX_CUR_HEADER_BYTES: 80,
     MAX_LAST_HEADER_BYTES: 330,
     MAX_CACHED_ERRORS: 50,
     CACHE_KEY: "server-telemetry",
@@ -269,9 +250,7 @@ const RegionDiscoverySources = {
  * Region Discovery Outcomes
  */
 const RegionDiscoveryOutcomes = {
-    CONFIGURED_MATCHES_DETECTED: "1",
     CONFIGURED_NO_AUTO_DETECTION: "2",
-    CONFIGURED_NOT_DETECTED: "3",
     AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
     AUTO_DETECTION_REQUESTED_FAILED: "5",
 };
@@ -298,7 +277,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -315,7 +294,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -364,7 +343,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -462,7 +441,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -714,7 +693,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -753,7 +732,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -944,12 +923,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.7.1";
+const version$1 = "15.8.1";
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -969,7 +948,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1030,7 +1009,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1085,7 +1064,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1412,7 +1391,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1423,7 +1402,6 @@ const authorityUriInsecure = "authority_uri_insecure";
 const urlParseError = "url_parse_error";
 const urlEmptyError = "empty_url_error";
 const emptyInputScopesError = "empty_input_scopes_error";
-const invalidPromptValue = "invalid_prompt_value";
 const invalidClaims = "invalid_claims";
 const tokenRequestEmpty = "token_request_empty";
 const logoutRequestEmpty = "logout_request_empty";
@@ -1453,7 +1431,6 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     invalidClaims: invalidClaims,
     invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
     invalidCodeChallengeMethod: invalidCodeChallengeMethod,
-    invalidPromptValue: invalidPromptValue,
     logoutRequestEmpty: logoutRequestEmpty,
     missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,
     missingSshJwk: missingSshJwk,
@@ -1466,7 +1443,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1479,7 +1456,6 @@ const ClientConfigurationErrorMessages = {
     [urlParseError]: "URL could not be parsed into appropriate segments.",
     [urlEmptyError]: "URL was empty or null.",
     [emptyInputScopesError]: "Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",
-    [invalidPromptValue]: "Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
     [invalidClaims]: "Given claims parameter must be a stringified JSON object.",
     [tokenRequestEmpty]: "Token request was empty and not found in cache.",
     [logoutRequestEmpty]: "The logout request was null or undefined.",
@@ -1525,10 +1501,6 @@ const ClientConfigurationErrorMessage = {
         code: emptyInputScopesError,
         desc: ClientConfigurationErrorMessages[emptyInputScopesError],
     },
-    invalidPrompt: {
-        code: invalidPromptValue,
-        desc: ClientConfigurationErrorMessages[invalidPromptValue],
-    },
     invalidClaimsRequest: {
         code: invalidClaims,
         desc: ClientConfigurationErrorMessages[invalidClaims],
@@ -1604,7 +1576,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1701,7 +1673,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1892,7 +1864,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1932,7 +1904,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2011,7 +1983,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2026,7 +1998,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2048,7 +2020,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2072,7 +2044,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2315,7 +2287,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2380,7 +2352,7 @@ function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParame
     return queryParameterArray.join("&");
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2544,7 +2516,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2575,7 +2547,6 @@ const rawMetdataJSON = {
         },
     },
     instanceDiscoveryMetadata: {
-        tenant_discovery_endpoint: "https://{canonicalAuthority}/v2.0/.well-known/openid-configuration",
         metadata: [
             {
                 preferred_network: "login.microsoftonline.com",
@@ -2684,42 +2655,60 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
-const cacheUnknownErrorCode = "cache_error_unknown";
+const cacheQuotaExceeded = "cache_quota_exceeded";
+const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 const CacheErrorMessages = {
-    [cacheQuotaExceededErrorCode]: "Exceeded cache storage capacity.",
-    [cacheUnknownErrorCode]: "Unexpected error occurred when using cache storage.",
+    [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
+    [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
 };
 /**
  * Error thrown when there is an error with the cache
  */
-class CacheError extends Error {
+class CacheError extends AuthError {
     constructor(errorCode, errorMessage) {
         const message = errorMessage ||
             (CacheErrorMessages[errorCode]
                 ? CacheErrorMessages[errorCode]
-                : CacheErrorMessages[cacheUnknownErrorCode]);
+                : CacheErrorMessages[cacheErrorUnknown]);
         super(`${errorCode}: ${message}`);
         Object.setPrototypeOf(this, CacheError.prototype);
         this.name = "CacheError";
         this.errorCode = errorCode;
         this.errorMessage = message;
     }
+}
+/**
+ * Helper function to wrap browser errors in a CacheError object
+ * @param e
+ * @returns
+ */
+function createCacheError(e) {
+    if (!(e instanceof Error)) {
+        return new CacheError(cacheErrorUnknown);
+    }
+    if (e.name === "QuotaExceededError" ||
+        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+        e.message.includes("exceeded the quota")) {
+        return new CacheError(cacheQuotaExceeded);
+    }
+    else {
+        return new CacheError(e.name, e.message);
+    }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2742,14 +2731,14 @@ class CacheManager {
      * @param accountFilter - (Optional) filter to narrow down the accounts returned
      * @returns Array of AccountInfo objects in cache
      */
-    getAllAccounts(accountFilter) {
-        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}), accountFilter);
+    getAllAccounts(accountFilter, correlationId) {
+        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
     }
     /**
      * Gets first tenanted AccountInfo object found based on provided filters
      */
-    getAccountInfoFilteredBy(accountFilter) {
-        const allAccounts = this.getAllAccounts(accountFilter);
+    getAccountInfoFilteredBy(accountFilter, correlationId) {
+        const allAccounts = this.getAllAccounts(accountFilter, correlationId);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
             const sortedAccounts = allAccounts.sort((account) => {
@@ -2770,8 +2759,8 @@ class CacheManager {
      * @param accountFilter
      * @returns
      */
-    getBaseAccountInfo(accountFilter) {
-        const accountEntities = this.getAccountsFilteredBy(accountFilter);
+    getBaseAccountInfo(accountFilter, correlationId) {
+        const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
         if (accountEntities.length > 0) {
             return accountEntities[0].getAccountInfo();
         }
@@ -2786,12 +2775,12 @@ class CacheManager {
      * @param accountFilter
      * @returns Array of AccountInfo objects that match account and tenant profile filters
      */
-    buildTenantProfiles(cachedAccounts, accountFilter) {
+    buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
         return cachedAccounts.flatMap((accountEntity) => {
-            return this.getTenantProfilesFromAccountEntity(accountEntity, accountFilter?.tenantId, accountFilter);
+            return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
         });
     }
-    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter) {
+    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
         let tenantedAccountInfo = null;
         let idTokenClaims;
         if (tenantProfileFilter) {
@@ -2799,7 +2788,7 @@ class CacheManager {
                 return null;
             }
         }
-        const idToken = this.getIdToken(accountInfo, tokenKeys, tenantProfile.tenantId);
+        const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
         if (idToken) {
             idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
             if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
@@ -2811,7 +2800,7 @@ class CacheManager {
         tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
         return tenantedAccountInfo;
     }
-    getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {
+    getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
         const accountInfo = accountEntity.getAccountInfo();
         let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
         const tokenKeys = this.getTokenKeys();
@@ -2831,7 +2820,7 @@ class CacheManager {
         }
         const matchingTenantProfiles = [];
         searchTenantProfiles.forEach((tenantProfile) => {
-            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter);
+            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter);
             if (tenantedAccountInfo) {
                 matchingTenantProfiles.push(tenantedAccountInfo);
             }
@@ -2905,26 +2894,16 @@ class CacheManager {
                 await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
             }
             if (!!cacheRecord.appMetadata) {
-                this.setAppMetadata(cacheRecord.appMetadata);
+                this.setAppMetadata(cacheRecord.appMetadata, correlationId);
             }
         }
         catch (e) {
             this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);
-            if (e instanceof Error) {
-                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e.message}`, correlationId);
-                if (e.name === "QuotaExceededError" ||
-                    e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
-                    e.message.includes("exceeded the quota")) {
-                    this.commonLogger?.error(`CacheManager.saveCacheRecord: exceeded storage quota`, correlationId);
-                    throw new CacheError(cacheQuotaExceededErrorCode);
-                }
-                else {
-                    throw new CacheError(e.name, e.message);
-                }
+            if (e instanceof AuthError) {
+                throw e;
             }
             else {
-                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e}`, correlationId);
-                throw new CacheError(cacheUnknownErrorCode);
+                throw createCacheError(e);
             }
         }
     }
@@ -2948,7 +2927,7 @@ class CacheManager {
             if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                 return;
             }
-            const tokenEntity = this.getAccessTokenCredential(key);
+            const tokenEntity = this.getAccessTokenCredential(key, correlationId);
             if (tokenEntity &&
                 this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
                 const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
@@ -2964,7 +2943,7 @@ class CacheManager {
      * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
      * @param accountFilter - An object containing Account properties to filter by
      */
-    getAccountsFilteredBy(accountFilter) {
+    getAccountsFilteredBy(accountFilter, correlationId) {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
@@ -2972,7 +2951,7 @@ class CacheManager {
                 // Don't parse value if the key doesn't match the account filters
                 return;
             }
-            const entity = this.getAccount(cacheKey, this.commonLogger);
+            const entity = this.getAccount(cacheKey, correlationId);
             // Match base account fields
             if (!entity) {
                 return;
@@ -3209,12 +3188,12 @@ class CacheManager {
      * @param account
      */
     removeAccount(accountKey, correlationId) {
-        const account = this.getAccount(accountKey, this.commonLogger);
+        const account = this.getAccount(accountKey, correlationId);
         if (!account) {
             return;
         }
         this.removeAccountContext(account, correlationId);
-        this.removeItem(accountKey);
+        this.removeItem(accountKey, correlationId);
     }
     /**
      * Removes credentials associated with the provided account
@@ -3225,7 +3204,7 @@ class CacheManager {
         const accountId = account.generateAccountId();
         allTokenKeys.idToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             }
         });
         allTokenKeys.accessToken.forEach((key) => {
@@ -3235,45 +3214,43 @@ class CacheManager {
         });
         allTokenKeys.refreshToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeRefreshToken(key);
+                this.removeRefreshToken(key, correlationId);
             }
         });
     }
     /**
-     * returns a boolean if the given credential is removed
-     * @param credential
+     * Removes accessToken from the cache
+     * @param key
+     * @param correlationId
      */
     removeAccessToken(key, correlationId) {
-        const credential = this.getAccessTokenCredential(key);
-        if (!credential) {
+        const credential = this.getAccessTokenCredential(key, correlationId);
+        this.removeItem(key, correlationId);
+        this.performanceClient.incrementFields({ accessTokensRemoved: 1 }, correlationId);
+        if (!credential ||
+            credential.credentialType.toLowerCase() !==
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase() ||
+            credential.tokenType !== AuthenticationScheme.POP) {
+            // If the credential is not a PoP token, we can return
             return;
         }
-        this.removeItem(key);
         // Remove Token Binding Key from key store for PoP Tokens Credentials
-        if (credential.credentialType.toLowerCase() ===
-            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
-            if (credential.tokenType === AuthenticationScheme.POP) {
-                const accessTokenWithAuthSchemeEntity = credential;
-                const kid = accessTokenWithAuthSchemeEntity.keyId;
-                if (kid) {
-                    void this.cryptoImpl
-                        .removeTokenBindingKey(kid)
-                        .catch(() => {
-                        this.commonLogger.error(`Failed to remove token binding key ${kid}`, correlationId);
-                        this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
-                    });
-                }
-            }
+        const kid = credential.keyId;
+        if (kid) {
+            void this.cryptoImpl.removeTokenBindingKey(kid).catch(() => {
+                this.commonLogger.error(`Failed to remove token binding key ${kid}`, correlationId);
+                this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
+            });
         }
     }
     /**
      * Removes all app metadata objects from cache.
      */
-    removeAppMetadata() {
+    removeAppMetadata(correlationId) {
         const allCacheKeys = this.getKeys();
         allCacheKeys.forEach((cacheKey) => {
             if (this.isAppMetadata(cacheKey)) {
-                this.removeItem(cacheKey);
+                this.removeItem(cacheKey, correlationId);
             }
         });
         return true;
@@ -3282,9 +3259,9 @@ class CacheManager {
      * Retrieve AccountEntity from cache
      * @param account
      */
-    readAccountFromCache(account) {
+    readAccountFromCache(account, correlationId) {
         const accountKey = AccountEntity.generateAccountCacheKey(account);
-        return this.getAccount(accountKey, this.commonLogger);
+        return this.getAccount(accountKey, correlationId);
     }
     /**
      * Retrieve IdTokenEntity from cache
@@ -3294,7 +3271,7 @@ class CacheManager {
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getIdToken(account, tokenKeys, targetRealm, performanceClient, correlationId) {
+    getIdToken(account, correlationId, tokenKeys, targetRealm, performanceClient) {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter = {
             homeAccountId: account.homeAccountId,
@@ -3303,7 +3280,7 @@ class CacheManager {
             clientId: this.clientId,
             realm: targetRealm,
         };
-        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
+        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, correlationId, tokenKeys);
         const numIdTokens = idTokenMap.size;
         if (numIdTokens < 1) {
             this.commonLogger.info("CacheManager:getIdToken - No token found");
@@ -3336,7 +3313,7 @@ class CacheManager {
             // Multiple tokens for a single tenant profile, remove all and return null
             this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them");
             tokensToBeRemoved.forEach((idToken, key) => {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             });
             if (performanceClient && correlationId) {
                 performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
@@ -3351,7 +3328,7 @@ class CacheManager {
      * @param filter
      * @returns
      */
-    getIdTokensByFilter(filter, tokenKeys) {
+    getIdTokensByFilter(filter, correlationId, tokenKeys) {
         const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;
         const idTokens = new Map();
         idTokenKeys.forEach((key) => {
@@ -3361,7 +3338,7 @@ class CacheManager {
             })) {
                 return;
             }
-            const idToken = this.getIdTokenCredential(key);
+            const idToken = this.getIdTokenCredential(key, correlationId);
             if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                 idTokens.set(key, idToken);
             }
@@ -3390,20 +3367,21 @@ class CacheManager {
      * Removes idToken from the cache
      * @param key
      */
-    removeIdToken(key) {
-        this.removeItem(key);
+    removeIdToken(key, correlationId) {
+        this.removeItem(key, correlationId);
     }
     /**
      * Removes refresh token from the cache
      * @param key
      */
-    removeRefreshToken(key) {
-        this.removeItem(key);
+    removeRefreshToken(key, correlationId) {
+        this.removeItem(key, correlationId);
     }
     /**
      * Retrieve AccessTokenEntity from cache
      * @param account {AccountInfo}
      * @param request {BaseAuthRequest}
+     * @param correlationId {?string}
      * @param tokenKeys {?TokenKeys}
      * @param performanceClient {?IPerformanceClient}
      */
@@ -3438,7 +3416,7 @@ class CacheManager {
         accessTokenKeys.forEach((key) => {
             // Validate key
             if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
-                const accessToken = this.getAccessTokenCredential(key);
+                const accessToken = this.getAccessTokenCredential(key, correlationId);
                 // Validate value
                 if (accessToken &&
                     this.credentialMatchesFilter(accessToken, accessTokenFilter)) {
@@ -3508,14 +3486,14 @@ class CacheManager {
      * @param filter
      * @returns
      */
-    getAccessTokensByFilter(filter) {
+    getAccessTokensByFilter(filter, correlationId) {
         const tokenKeys = this.getTokenKeys();
         const accessTokens = [];
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, filter, true)) {
                 return;
             }
-            const accessToken = this.getAccessTokenCredential(key);
+            const accessToken = this.getAccessTokenCredential(key, correlationId);
             if (accessToken &&
                 this.credentialMatchesFilter(accessToken, filter)) {
                 accessTokens.push(accessToken);
@@ -3527,11 +3505,11 @@ class CacheManager {
      * Helper to retrieve the appropriate refresh token from cache
      * @param account {AccountInfo}
      * @param familyRT {boolean}
+     * @param correlationId {?string}
      * @param tokenKeys {?TokenKeys}
      * @param performanceClient {?IPerformanceClient}
-     * @param correlationId {?string}
      */
-    getRefreshToken(account, familyRT, tokenKeys, performanceClient, correlationId) {
+    getRefreshToken(account, familyRT, correlationId, tokenKeys, performanceClient) {
         this.commonLogger.trace("CacheManager - getRefreshToken called");
         const id = familyRT ? THE_FAMILY_ID : undefined;
         const refreshTokenFilter = {
@@ -3547,7 +3525,7 @@ class CacheManager {
         refreshTokenKeys.forEach((key) => {
             // Validate key
             if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
-                const refreshToken = this.getRefreshTokenCredential(key);
+                const refreshToken = this.getRefreshTokenCredential(key, correlationId);
                 // Validate value
                 if (refreshToken &&
                     this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {
@@ -3897,7 +3875,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4389,7 +4367,6 @@ const PerformanceEventAbbreviations = new Map([
  * @enum {number}
  */
 const PerformanceEventStatus = {
-    NotStarted: 0,
     InProgress: 1,
     Completed: 2,
 };
@@ -4410,7 +4387,7 @@ const IntFields = new Set([
     "encryptedCacheExpiredCount",
 ]);
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4489,7 +4466,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4589,7 +4566,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4599,7 +4576,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4649,7 +4626,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5017,7 +4994,7 @@ function addEARParameters(parameters, jwk) {
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5029,7 +5006,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5039,7 +5016,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5049,7 +5026,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5145,7 +5122,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5251,7 +5228,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6090,7 +6067,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6121,7 +6098,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6140,7 +6117,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6161,7 +6138,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6181,12 +6158,12 @@ class ThrottlingUtils {
      * @param cacheManager
      * @param thumbprint
      */
-    static preProcess(cacheManager, thumbprint) {
+    static preProcess(cacheManager, thumbprint, correlationId) {
         const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
         const value = cacheManager.getThrottlingCache(key);
         if (value) {
             if (value.throttleTime < Date.now()) {
-                cacheManager.removeItem(key);
+                cacheManager.removeItem(key, correlationId);
                 return;
             }
             throw new ServerError(value.errorCodes?.join(" ") || Constants.EMPTY_STRING, value.errorMessage, value.subError);
@@ -6198,7 +6175,7 @@ class ThrottlingUtils {
      * @param thumbprint
      * @param response
      */
-    static postProcess(cacheManager, thumbprint, response) {
+    static postProcess(cacheManager, thumbprint, response, correlationId) {
         if (ThrottlingUtils.checkResponseStatus(response) ||
             ThrottlingUtils.checkResponseForRetryAfter(response)) {
             const thumbprintValue = {
@@ -6208,7 +6185,7 @@ class ThrottlingUtils {
                 errorMessage: response.body.error_description,
                 subError: response.body.suberror,
             };
-            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue);
+            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
         }
     }
     /**
@@ -6244,11 +6221,11 @@ class ThrottlingUtils {
     static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
         const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
         const key = this.generateThrottlingStorageKey(thumbprint);
-        cacheManager.removeItem(key);
+        cacheManager.removeItem(key, request.correlationId);
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6279,7 +6256,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6361,7 +6338,7 @@ class BaseClient {
      * @param correlationId - CorrelationId for telemetry
      */
     async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
-        ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
+        ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
         let response;
         try {
             response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
@@ -6396,7 +6373,7 @@ class BaseClient {
                 throw createClientAuthError(networkError);
             }
         }
-        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
+        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
         return response;
     }
     /**
@@ -6427,7 +6404,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6455,7 +6432,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uxNotAllowed: uxNotAllowed
 });
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6545,7 +6522,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6617,16 +6594,14 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 const KeyLocation = {
-    SW: "sw",
-    UHW: "uhw",
-};
+    SW: "sw"};
 /** @internal */
 class PopTokenGenerator {
     constructor(cryptoUtils, performanceClient) {
@@ -6701,7 +6676,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6728,7 +6703,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6841,7 +6816,7 @@ class ResponseHandler {
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key);
+                const account = this.cacheStorage.getAccount(key, request.correlationId);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
@@ -6876,7 +6851,7 @@ class ResponseHandler {
         let cachedAccount;
         if (serverTokenResponse.id_token && !!idTokenClaims) {
             cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
-            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
             this.logger);
         }
         // AccessToken
@@ -7025,7 +7000,7 @@ class ResponseHandler {
         };
     }
 }
-function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
     logger?.verbose("setCachedAccount called");
     // Check if base account is already cached
     const accountKeys = cacheStorage.getAccountKeys();
@@ -7034,7 +7009,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     });
     let cachedAccount = null;
     if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey);
+        cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId);
     }
     const baseAccount = cachedAccount ||
         AccountEntity.createAccount({
@@ -7059,74 +7034,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Validates server consumable params from the "request" objects
- */
-class RequestValidator {
-    /**
-     * Utility to check if the `redirectUri` in the request is a non-null value
-     * @param redirectUri
-     */
-    static validateRedirectUri(redirectUri) {
-        if (!redirectUri) {
-            throw createClientConfigurationError(redirectUriEmpty);
-        }
-    }
-    /**
-     * Utility to validate prompt sent by the user in the request
-     * @param prompt
-     */
-    static validatePrompt(prompt) {
-        const promptValues = [];
-        for (const value in PromptValue) {
-            promptValues.push(PromptValue[value]);
-        }
-        if (promptValues.indexOf(prompt) < 0) {
-            throw createClientConfigurationError(invalidPromptValue);
-        }
-    }
-    static validateClaims(claims) {
-        try {
-            JSON.parse(claims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-    }
-    /**
-     * Utility to validate code_challenge and code_challenge_method
-     * @param codeChallenge
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-        if (!codeChallenge || !codeChallengeMethod) {
-            throw createClientConfigurationError(pkceParamsMissing);
-        }
-        else {
-            this.validateCodeChallengeMethod(codeChallengeMethod);
-        }
-    }
-    /**
-     * Utility to validate code_challenge_method
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeMethod(codeChallengeMethod) {
-        if ([
-            CodeChallengeMethodValues.PLAIN,
-            CodeChallengeMethodValues.S256,
-        ].indexOf(codeChallengeMethod) < 0) {
-            throw createClientConfigurationError(invalidCodeChallengeMethod);
-        }
-    }
-}
-
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7144,7 +7052,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7238,7 +7146,9 @@ class AuthorizationCodeClient extends BaseClient {
          */
         if (!this.includeRedirectUri) {
             // Just validate
-            RequestValidator.validateRedirectUri(request.redirectUri);
+            if (!request.redirectUri) {
+                throw createClientConfigurationError(redirectUriEmpty);
+            }
         }
         else {
             // Validate and include redirect uri
@@ -7377,7 +7287,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7450,7 +7360,7 @@ class RefreshTokenClient extends BaseClient {
     async acquireTokenWithCachedRefreshToken(request, foci) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
         // fetches family RT or application RT based on FOCI value
-        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
+        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined, this.performanceClient);
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(noTokensFound);
         }
@@ -7480,7 +7390,7 @@ class RefreshTokenClient extends BaseClient {
                     // Remove bad refresh token from cache
                     this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
                     const badRefreshTokenKey = generateCredentialKey(refreshToken);
-                    this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+                    this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
                 }
             }
             throw e;
@@ -7586,7 +7496,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7638,9 +7548,9 @@ class SilentFlowClient extends BaseClient {
         }
         const environment = request.authority || this.authority.getPreferredCache();
         const cacheRecord = {
-            account: this.cacheManager.readAccountFromCache(request.account),
+            account: this.cacheManager.readAccountFromCache(request.account, request.correlationId),
             accessToken: cachedAccessToken,
-            idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),
+            idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId, this.performanceClient),
             refreshToken: null,
             appMetadata: this.cacheManager.readAppMetadataFromCache(environment),
         };
@@ -7684,7 +7594,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7699,7 +7609,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7923,7 +7833,7 @@ function extractLoginHint(account) {
     return account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7981,7 +7891,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8120,7 +8030,7 @@ class ServerTelemetryManager {
         else {
             lastRequests.errors.push(SERVER_TELEM_CONSTANTS.UNKNOWN_ERROR);
         }
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return;
     }
     /**
@@ -8129,7 +8039,7 @@ class ServerTelemetryManager {
     incrementCacheHits() {
         const lastRequests = this.getLastRequests();
         lastRequests.cacheHits += 1;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return lastRequests.cacheHits;
     }
     /**
@@ -8153,7 +8063,7 @@ class ServerTelemetryManager {
         const errorCount = lastRequests.errors.length;
         if (numErrorsFlushed === errorCount) {
             // All errors were sent on last request, clear Telemetry cache
-            this.cacheManager.removeItem(this.telemetryCacheKey);
+            this.cacheManager.removeItem(this.telemetryCacheKey, this.correlationId);
         }
         else {
             // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
@@ -8162,7 +8072,7 @@ class ServerTelemetryManager {
                 errors: lastRequests.errors.slice(numErrorsFlushed),
                 cacheHits: 0,
             };
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity, this.correlationId);
         }
     }
     /**
@@ -8229,7 +8139,7 @@ class ServerTelemetryManager {
     setNativeBrokerErrorCode(errorCode) {
         const lastRequests = this.getLastRequests();
         lastRequests.nativeBrokerErrorCode = errorCode;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
     }
     getNativeBrokerErrorCode() {
         return this.getLastRequests().nativeBrokerErrorCode;
@@ -8237,14 +8147,14 @@ class ServerTelemetryManager {
     clearNativeBrokerErrorCode() {
         const lastRequests = this.getLastRequests();
         delete lastRequests.nativeBrokerErrorCode;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
     }
     static makeExtraSkuString(params) {
         return makeExtraSkuString(params);
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8252,7 +8162,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8277,7 +8187,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8317,7 +8227,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v15.7.1 2025-06-18 */
+/*! @azure/msal-common v15.8.1 2025-07-08 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8979,7 +8889,8 @@ const invalidBase64String = "invalid_base64_string";
 const invalidPopTokenRequest = "invalid_pop_token_request";
 const failedToBuildHeaders = "failed_to_build_headers";
 const failedToParseHeaders = "failed_to_parse_headers";
-const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
+const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
+const timedOut = "timed_out";
 
 var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -9027,6 +8938,7 @@ var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     silentPromptValueError: silentPromptValueError,
     spaCodeAndNativeAccountIdPresent: spaCodeAndNativeAccountIdPresent,
     stateInteractionTypeMismatch: stateInteractionTypeMismatch,
+    timedOut: timedOut,
     unableToAcquireTokenFromNativePlatform: unableToAcquireTokenFromNativePlatform,
     unableToLoadToken: unableToLoadToken,
     unableToParseState: unableToParseState,
@@ -9094,6 +9006,7 @@ const BrowserAuthErrorMessages = {
     [failedToBuildHeaders]: "Failed to build request headers object.",
     [failedToParseHeaders]: "Failed to parse response headers",
     [failedToDecryptEarResponse]: "Failed to decrypt ear response",
+    [timedOut]: "The request timed out.",
 };
 /**
  * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9307,10 +9220,6 @@ function createBrowserAuthError(errorCode, subError) {
  * Constants
  */
 const BrowserConstants = {
-    /**
-     * Interaction in progress cache value
-     */
-    INTERACTION_IN_PROGRESS_VALUE: "interaction_in_progress",
     /**
      * Invalid grant error code
      */
@@ -10162,9 +10071,9 @@ class NavigationClient {
         else {
             window.location.assign(url); // CodeQL [SM03712] Application owner controls the URL. User can't change it.
         }
-        return new Promise((resolve) => {
+        return new Promise((resolve, reject) => {
             setTimeout(() => {
-                resolve(true);
+                reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
             }, options.timeout);
         });
     }
@@ -10422,7 +10331,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.13.2";
+const version = "4.15.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11535,7 +11444,7 @@ class LocalStorage {
     setItem(key, value) {
         window.localStorage.setItem(key, value);
     }
-    async setUserData(key, value, correlationId) {
+    async setUserData(key, value, correlationId, timestamp) {
         if (!this.initialized || !this.encryptionCookie) {
             throw createBrowserAuthError(uninitializedPublicClientApplication);
         }
@@ -11544,6 +11453,7 @@ class LocalStorage {
             id: this.encryptionCookie.id,
             nonce: nonce,
             data: data,
+            lastUpdatedAt: timestamp,
         };
         this.memoryStorage.setItem(key, value);
         this.setItem(key, JSON.stringify(encryptedData));
@@ -11813,7 +11723,7 @@ class BrowserCacheManager extends CacheManager {
             this.performanceClient.addFields({ previousLibraryVersion: previousVersion }, correlationId);
         }
         if (previousVersion !== version) {
-            this.browserStorage.setItem(StaticCacheKeys.VERSION, version);
+            this.setItem(StaticCacheKeys.VERSION, version, correlationId);
         }
     }
     /**
@@ -11837,22 +11747,111 @@ class BrowserCacheManager extends CacheManager {
             return null;
         }
     }
+    /**
+     * Helper to setItem in browser storage, with cleanup in case of quota errors
+     * @param key
+     * @param value
+     */
+    setItem(key, value, correlationId) {
+        let accessTokenKeys = [];
+        const maxRetries = 20;
+        for (let i = 0; i <= maxRetries; i++) {
+            try {
+                this.browserStorage.setItem(key, value);
+                if (i > 0) {
+                    // Finally update the token keys array with the tokens removed
+                    this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId);
+                }
+                break; // If setItem succeeds, exit the loop
+            }
+            catch (e) {
+                const cacheError = createCacheError(e);
+                if (cacheError.errorCode ===
+                    cacheQuotaExceeded &&
+                    i < maxRetries) {
+                    if (!accessTokenKeys.length) {
+                        if (key ===
+                            `${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`) {
+                            // If we are currently trying to set the token keys, use the value we're trying to set
+                            accessTokenKeys = JSON.parse(value)
+                                .accessToken;
+                        }
+                        else {
+                            // If token keys have not been initialized, get them
+                            accessTokenKeys = this.getTokenKeys().accessToken;
+                        }
+                    }
+                    if (accessTokenKeys.length <= i) {
+                        // Nothing to remove, rethrow the error
+                        throw cacheError;
+                    }
+                    // When cache quota is exceeded, start removing access tokens until we can successfully set the item
+                    this.removeAccessToken(accessTokenKeys[i], correlationId, false // Don't save token keys yet, do it at the end
+                    );
+                }
+                else {
+                    // If the error is not a quota exceeded error, rethrow it
+                    throw cacheError;
+                }
+            }
+        }
+    }
+    /**
+     * Helper to setUserData in browser storage, with cleanup in case of quota errors
+     * @param key
+     * @param value
+     * @param correlationId
+     */
+    async setUserData(key, value, correlationId, timestamp) {
+        let accessTokenKeys = [];
+        const maxRetries = 20;
+        for (let i = 0; i <= maxRetries; i++) {
+            try {
+                await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, value, correlationId, timestamp);
+                if (i > 0) {
+                    // Finally update the token keys array with the tokens removed
+                    this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId);
+                }
+                break; // If setItem succeeds, exit the loop
+            }
+            catch (e) {
+                const cacheError = createCacheError(e);
+                if (cacheError.errorCode ===
+                    cacheQuotaExceeded &&
+                    i < maxRetries) {
+                    if (!accessTokenKeys.length) {
+                        accessTokenKeys = this.getTokenKeys().accessToken;
+                    }
+                    if (accessTokenKeys.length <= i) {
+                        // Nothing left to remove, rethrow the error
+                        throw cacheError;
+                    }
+                    // When cache quota is exceeded, start removing access tokens until we can successfully set the item
+                    this.removeAccessToken(accessTokenKeys[i], correlationId, false // Don't save token keys yet, do it at the end
+                    );
+                }
+                else {
+                    // If the error is not a quota exceeded error, rethrow it
+                    throw cacheError;
+                }
+            }
+        }
+    }
     /**
      * Reads account from cache, deserializes it into an account entity and returns it.
      * If account is not found from the key, returns null and removes key from map.
      * @param accountKey
      * @returns
      */
-    getAccount(accountKey) {
+    getAccount(accountKey, correlationId) {
         this.logger.trace("BrowserCacheManager.getAccount called");
         const serializedAccount = this.browserStorage.getUserData(accountKey);
         if (!serializedAccount) {
-            this.removeAccountKeyFromMap(accountKey);
+            this.removeAccountKeyFromMap(accountKey, correlationId);
             return null;
         }
         const parsedAccount = this.validateAndParseJson(serializedAccount);
         if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
-            this.removeAccountKeyFromMap(accountKey);
             return null;
         }
         return CacheManager.toObject(new AccountEntity(), parsedAccount);
@@ -11864,8 +11863,10 @@ class BrowserCacheManager extends CacheManager {
     async setAccount(account, correlationId) {
         this.logger.trace("BrowserCacheManager.setAccount called");
         const key = account.generateAccountKey();
-        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, JSON.stringify(account), correlationId);
-        const wasAdded = this.addAccountKeyToMap(key);
+        const timestamp = Date.now().toString();
+        account.lastUpdatedAt = timestamp;
+        await this.setUserData(key, JSON.stringify(account), correlationId, timestamp);
+        const wasAdded = this.addAccountKeyToMap(key, correlationId);
         /**
          * @deprecated - Remove this in next major version in favor of more consistent LOGIN event
          */
@@ -11886,14 +11887,14 @@ class BrowserCacheManager extends CacheManager {
      * Add a new account to the key map
      * @param key
      */
-    addAccountKeyToMap(key) {
+    addAccountKeyToMap(key, correlationId) {
         this.logger.trace("BrowserCacheManager.addAccountKeyToMap called");
         this.logger.tracePii(`BrowserCacheManager.addAccountKeyToMap called with key: ${key}`);
         const accountKeys = this.getAccountKeys();
         if (accountKeys.indexOf(key) === -1) {
             // Only add key if it does not already exist in the map
             accountKeys.push(key);
-            this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
             this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
             return true;
         }
@@ -11906,14 +11907,21 @@ class BrowserCacheManager extends CacheManager {
      * Remove an account from the key map
      * @param key
      */
-    removeAccountKeyFromMap(key) {
+    removeAccountKeyFromMap(key, correlationId) {
         this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called");
         this.logger.tracePii(`BrowserCacheManager.removeAccountKeyFromMap called with key: ${key}`);
         const accountKeys = this.getAccountKeys();
         const removalIndex = accountKeys.indexOf(key);
         if (removalIndex > -1) {
             accountKeys.splice(removalIndex, 1);
-            this.browserStorage.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            if (accountKeys.length === 0) {
+                // If no keys left, remove the map
+                this.removeItem(StaticCacheKeys.ACCOUNT_KEYS);
+                return;
+            }
+            else {
+                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
+            }
             this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
         }
         else {
@@ -11926,7 +11934,7 @@ class BrowserCacheManager extends CacheManager {
      */
     removeAccount(key, correlationId) {
         super.removeAccount(key, correlationId);
-        this.removeAccountKeyFromMap(key);
+        this.removeAccountKeyFromMap(key, correlationId);
     }
     /**
      * Removes credentials associated with the provided account
@@ -11945,25 +11953,60 @@ class BrowserCacheManager extends CacheManager {
      * Removes given idToken from the cache and from the key map
      * @param key
      */
-    removeIdToken(key) {
-        super.removeIdToken(key);
-        this.removeTokenKey(key, CredentialType.ID_TOKEN);
+    removeIdToken(key, correlationId) {
+        super.removeIdToken(key, correlationId);
+        const tokenKeys = this.getTokenKeys();
+        const idRemoval = tokenKeys.idToken.indexOf(key);
+        if (idRemoval > -1) {
+            this.logger.info("idToken removed from tokenKeys map");
+            tokenKeys.idToken.splice(idRemoval, 1);
+            this.setTokenKeys(tokenKeys, correlationId);
+        }
     }
     /**
      * Removes given accessToken from the cache and from the key map
      * @param key
      */
-    removeAccessToken(key, correlationId) {
+    removeAccessToken(key, correlationId, updateTokenKeys = true) {
         super.removeAccessToken(key, correlationId);
-        this.removeTokenKey(key, CredentialType.ACCESS_TOKEN);
+        updateTokenKeys && this.removeAccessTokenKeys([key], correlationId);
+    }
+    /**
+     * Remove access token key from the key map
+     * @param key
+     * @param correlationId
+     * @param tokenKeys
+     */
+    removeAccessTokenKeys(keys, correlationId) {
+        this.logger.trace("removeAccessTokenKey called");
+        const tokenKeys = this.getTokenKeys();
+        let keysRemoved = 0;
+        keys.forEach((key) => {
+            const accessRemoval = tokenKeys.accessToken.indexOf(key);
+            if (accessRemoval > -1) {
+                tokenKeys.accessToken.splice(accessRemoval, 1);
+                keysRemoved++;
+            }
+        });
+        if (keysRemoved > 0) {
+            this.logger.info(`removed ${keysRemoved} accessToken keys from tokenKeys map`);
+            this.setTokenKeys(tokenKeys, correlationId);
+            return;
+        }
     }
     /**
      * Removes given refreshToken from the cache and from the key map
      * @param key
      */
-    removeRefreshToken(key) {
-        super.removeRefreshToken(key);
-        this.removeTokenKey(key, CredentialType.REFRESH_TOKEN);
+    removeRefreshToken(key, correlationId) {
+        super.removeRefreshToken(key, correlationId);
+        const tokenKeys = this.getTokenKeys();
+        const refreshRemoval = tokenKeys.refreshToken.indexOf(key);
+        if (refreshRemoval > -1) {
+            this.logger.info("refreshToken removed from tokenKeys map");
+            tokenKeys.refreshToken.splice(refreshRemoval, 1);
+            this.setTokenKeys(tokenKeys, correlationId);
+        }
     }
     /**
      * Gets the keys for the cached tokens associated with this clientId
@@ -11973,101 +12016,37 @@ class BrowserCacheManager extends CacheManager {
         return getTokenKeys(this.clientId, this.browserStorage);
     }
     /**
-     * Adds the given key to the token key map
-     * @param key
-     * @param type
+     * Stores the token keys in the cache
+     * @param tokenKeys
+     * @param correlationId
+     * @returns
      */
-    addTokenKey(key, type) {
-        this.logger.trace("BrowserCacheManager addTokenKey called");
-        const tokenKeys = this.getTokenKeys();
-        switch (type) {
-            case CredentialType.ID_TOKEN:
-                if (tokenKeys.idToken.indexOf(key) === -1) {
-                    this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
-                    tokenKeys.idToken.push(key);
-                }
-                break;
-            case CredentialType.ACCESS_TOKEN:
-                if (tokenKeys.accessToken.indexOf(key) === -1) {
-                    this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map");
-                    tokenKeys.accessToken.push(key);
-                }
-                break;
-            case CredentialType.REFRESH_TOKEN:
-                if (tokenKeys.refreshToken.indexOf(key) === -1) {
-                    this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
-                    tokenKeys.refreshToken.push(key);
-                }
-                break;
-            default:
-                this.logger.error(`BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
-                throw createClientAuthError(unexpectedCredentialType);
+    setTokenKeys(tokenKeys, correlationId) {
+        if (tokenKeys.idToken.length === 0 &&
+            tokenKeys.accessToken.length === 0 &&
+            tokenKeys.refreshToken.length === 0) {
+            // If no keys left, remove the map
+            this.removeItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
+            return;
         }
-        this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
-    }
-    /**
-     * Removes the given key from the token key map
-     * @param key
-     * @param type
-     */
-    removeTokenKey(key, type) {
-        this.logger.trace("BrowserCacheManager removeTokenKey called");
-        const tokenKeys = this.getTokenKeys();
-        switch (type) {
-            case CredentialType.ID_TOKEN:
-                this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: ${key} from map`);
-                const idRemoval = tokenKeys.idToken.indexOf(key);
-                if (idRemoval > -1) {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - idToken removed from map");
-                    tokenKeys.idToken.splice(idRemoval, 1);
-                }
-                else {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - idToken does not exist in map. Either it was previously removed or it was never added.");
-                }
-                break;
-            case CredentialType.ACCESS_TOKEN:
-                this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove accessToken with key: ${key} from map`);
-                const accessRemoval = tokenKeys.accessToken.indexOf(key);
-                if (accessRemoval > -1) {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - accessToken removed from map");
-                    tokenKeys.accessToken.splice(accessRemoval, 1);
-                }
-                else {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - accessToken does not exist in map. Either it was previously removed or it was never added.");
-                }
-                break;
-            case CredentialType.REFRESH_TOKEN:
-                this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove refreshToken with key: ${key} from map`);
-                const refreshRemoval = tokenKeys.refreshToken.indexOf(key);
-                if (refreshRemoval > -1) {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken removed from map");
-                    tokenKeys.refreshToken.splice(refreshRemoval, 1);
-                }
-                else {
-                    this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken does not exist in map. Either it was previously removed or it was never added.");
-                }
-                break;
-            default:
-                this.logger.error(`BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
-                throw createClientAuthError(unexpectedCredentialType);
+        else {
+            this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys), correlationId);
         }
-        this.browserStorage.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
     }
     /**
      * generates idToken entity from a string
      * @param idTokenKey
      */
-    getIdTokenCredential(idTokenKey) {
+    getIdTokenCredential(idTokenKey, correlationId) {
         const value = this.browserStorage.getUserData(idTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+            this.removeIdToken(idTokenKey, correlationId);
             return null;
         }
         const parsedIdToken = this.validateAndParseJson(value);
         if (!parsedIdToken || !isIdTokenEntity(parsedIdToken)) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit");
@@ -12080,25 +12059,31 @@ class BrowserCacheManager extends CacheManager {
     async setIdTokenCredential(idToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
         const idTokenKey = generateCredentialKey(idToken);
-        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(idTokenKey, JSON.stringify(idToken), correlationId);
-        this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+        const timestamp = Date.now().toString();
+        idToken.lastUpdatedAt = timestamp;
+        await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp);
+        const tokenKeys = this.getTokenKeys();
+        if (tokenKeys.idToken.indexOf(idTokenKey) === -1) {
+            this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
+            tokenKeys.idToken.push(idTokenKey);
+            this.setTokenKeys(tokenKeys, correlationId);
+        }
     }
     /**
      * generates accessToken entity from a string
      * @param key
      */
-    getAccessTokenCredential(accessTokenKey) {
+    getAccessTokenCredential(accessTokenKey, correlationId) {
         const value = this.browserStorage.getUserData(accessTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+            this.removeAccessTokenKeys([accessTokenKey], correlationId);
             return null;
         }
         const parsedAccessToken = this.validateAndParseJson(value);
         if (!parsedAccessToken ||
             !isAccessTokenEntity(parsedAccessToken)) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit");
@@ -12111,25 +12096,33 @@ class BrowserCacheManager extends CacheManager {
     async setAccessTokenCredential(accessToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
         const accessTokenKey = generateCredentialKey(accessToken);
-        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(accessTokenKey, JSON.stringify(accessToken), correlationId);
-        this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+        const timestamp = Date.now().toString();
+        accessToken.lastUpdatedAt = timestamp;
+        await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp);
+        const tokenKeys = this.getTokenKeys();
+        const index = tokenKeys.accessToken.indexOf(accessTokenKey);
+        if (index !== -1) {
+            tokenKeys.accessToken.splice(index, 1); // Remove existing key before pushing to the end
+        }
+        this.logger.trace(`access token ${index === -1 ? "added to" : "updated in"} map`);
+        tokenKeys.accessToken.push(accessTokenKey);
+        this.setTokenKeys(tokenKeys, correlationId);
     }
     /**
      * generates refreshToken entity from a string
      * @param refreshTokenKey
      */
-    getRefreshTokenCredential(refreshTokenKey) {
+    getRefreshTokenCredential(refreshTokenKey, correlationId) {
         const value = this.browserStorage.getUserData(refreshTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+            this.removeRefreshToken(refreshTokenKey, correlationId);
             return null;
         }
         const parsedRefreshToken = this.validateAndParseJson(value);
         if (!parsedRefreshToken ||
             !isRefreshTokenEntity(parsedRefreshToken)) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit");
@@ -12142,8 +12135,15 @@ class BrowserCacheManager extends CacheManager {
     async setRefreshTokenCredential(refreshToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
         const refreshTokenKey = generateCredentialKey(refreshToken);
-        await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(refreshTokenKey, JSON.stringify(refreshToken), correlationId);
-        this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+        const timestamp = Date.now().toString();
+        refreshToken.lastUpdatedAt = timestamp;
+        await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp);
+        const tokenKeys = this.getTokenKeys();
+        if (tokenKeys.refreshToken.indexOf(refreshTokenKey) === -1) {
+            this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
+            tokenKeys.refreshToken.push(refreshTokenKey);
+            this.setTokenKeys(tokenKeys, correlationId);
+        }
     }
     /**
      * fetch appMetadata entity from the platform cache
@@ -12168,10 +12168,10 @@ class BrowserCacheManager extends CacheManager {
      * set appMetadata entity to the platform cache
      * @param appMetadata
      */
-    setAppMetadata(appMetadata) {
+    setAppMetadata(appMetadata, correlationId) {
         this.logger.trace("BrowserCacheManager.setAppMetadata called");
         const appMetadataKey = generateAppMetadataKey(appMetadata);
-        this.browserStorage.setItem(appMetadataKey, JSON.stringify(appMetadata));
+        this.setItem(appMetadataKey, JSON.stringify(appMetadata), correlationId);
     }
     /**
      * fetch server telemetry entity from the platform cache
@@ -12197,9 +12197,9 @@ class BrowserCacheManager extends CacheManager {
      * @param serverTelemetryKey
      * @param serverTelemetry
      */
-    setServerTelemetry(serverTelemetryKey, serverTelemetry) {
+    setServerTelemetry(serverTelemetryKey, serverTelemetry, correlationId) {
         this.logger.trace("BrowserCacheManager.setServerTelemetry called");
-        this.browserStorage.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry));
+        this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry), correlationId);
     }
     /**
      *
@@ -12257,7 +12257,7 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Gets the active account
      */
-    getActiveAccount() {
+    getActiveAccount(correlationId) {
         const activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
         const activeAccountValueFilters = this.browserStorage.getItem(activeAccountKeyFilters);
         if (!activeAccountValueFilters) {
@@ -12271,7 +12271,7 @@ class BrowserCacheManager extends CacheManager {
                 homeAccountId: activeAccountValueObj.homeAccountId,
                 localAccountId: activeAccountValueObj.localAccountId,
                 tenantId: activeAccountValueObj.tenantId,
-            });
+            }, correlationId);
         }
         this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found");
         return null;
@@ -12280,7 +12280,7 @@ class BrowserCacheManager extends CacheManager {
      * Sets the active account's localAccountId in cache
      * @param account
      */
-    setActiveAccount(account) {
+    setActiveAccount(account, correlationId) {
         const activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
         if (account) {
             this.logger.verbose("setActiveAccount: Active account set");
@@ -12288,8 +12288,9 @@ class BrowserCacheManager extends CacheManager {
                 homeAccountId: account.homeAccountId,
                 localAccountId: account.localAccountId,
                 tenantId: account.tenantId,
+                lastUpdatedAt: nowSeconds().toString(),
             };
-            this.browserStorage.setItem(activeAccountKey, JSON.stringify(activeAccountValue));
+            this.setItem(activeAccountKey, JSON.stringify(activeAccountValue), correlationId);
         }
         else {
             this.logger.verbose("setActiveAccount: No account passed, active account not set");
@@ -12321,9 +12322,9 @@ class BrowserCacheManager extends CacheManager {
      * @param throttlingCacheKey
      * @param throttlingCache
      */
-    setThrottlingCache(throttlingCacheKey, throttlingCache) {
+    setThrottlingCache(throttlingCacheKey, throttlingCache, correlationId) {
         this.logger.trace("BrowserCacheManager.setThrottlingCache called");
-        this.browserStorage.setItem(throttlingCacheKey, JSON.stringify(throttlingCache));
+        this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache), correlationId);
     }
     /**
      * Gets cache item with given key.
@@ -12402,7 +12403,7 @@ class BrowserCacheManager extends CacheManager {
     clear(correlationId) {
         // Removes all accounts and their credentials
         this.removeAllAccounts(correlationId);
-        this.removeAppMetadata();
+        this.removeAppMetadata(correlationId);
         // Remove temp storage first to make sure any cookies are cleared
         this.temporaryCacheStorage.getKeys().forEach((cacheKey) => {
             if (cacheKey.indexOf(Constants.CACHE_PREFIX) !== -1 ||
@@ -12431,7 +12432,7 @@ class BrowserCacheManager extends CacheManager {
         let removedAccessTokens = 0;
         tokenKeys.accessToken.forEach((key) => {
             // if the access token has claims in its key, remove the token key and the token
-            const credential = this.getAccessTokenCredential(key);
+            const credential = this.getAccessTokenCredential(key, correlationId);
             if (credential?.requestedClaimsHash &&
                 key.includes(credential.requestedClaimsHash.toLowerCase())) {
                 this.removeAccessToken(key, correlationId);
@@ -12667,22 +12668,24 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient, even
  * @param accountFilter - (Optional) filter to narrow down the accounts returned
  * @returns Array of AccountInfo objects in cache
  */
-function getAllAccounts(logger, browserStorage, isInBrowser, accountFilter) {
+function getAllAccounts(logger, browserStorage, isInBrowser, correlationId, accountFilter) {
     logger.verbose("getAllAccounts called");
-    return isInBrowser ? browserStorage.getAllAccounts(accountFilter) : [];
+    return isInBrowser
+        ? browserStorage.getAllAccounts(accountFilter || {}, correlationId)
+        : [];
 }
 /**
  * Returns the first account found in the cache that matches the account filter passed in.
  * @param accountFilter
  * @returns The first account found in the cache matching the provided filter or null if no account could be found.
  */
-function getAccount(accountFilter, logger, browserStorage) {
+function getAccount(accountFilter, logger, browserStorage, correlationId) {
     logger.trace("getAccount called");
     if (Object.keys(accountFilter).length === 0) {
         logger.warning("getAccount: No accountFilter provided");
         return null;
     }
-    const account = browserStorage.getAccountInfoFilteredBy(accountFilter);
+    const account = browserStorage.getAccountInfoFilteredBy(accountFilter, correlationId);
     if (account) {
         logger.verbose("getAccount: Account matching provided filter found, returning");
         return account;
@@ -12700,7 +12703,7 @@ function getAccount(accountFilter, logger, browserStorage) {
  * @param username
  * @returns The account object stored in MSAL
  */
-function getAccountByUsername(username, logger, browserStorage) {
+function getAccountByUsername(username, logger, browserStorage, correlationId) {
     logger.trace("getAccountByUsername called");
     if (!username) {
         logger.warning("getAccountByUsername: No username provided");
@@ -12708,7 +12711,7 @@ function getAccountByUsername(username, logger, browserStorage) {
     }
     const account = browserStorage.getAccountInfoFilteredBy({
         username,
-    });
+    }, correlationId);
     if (account) {
         logger.verbose("getAccountByUsername: Account matching username found, returning");
         logger.verbosePii(`getAccountByUsername: Returning signed-in accounts matching username: ${username}`);
@@ -12726,7 +12729,7 @@ function getAccountByUsername(username, logger, browserStorage) {
  * @param homeAccountId
  * @returns The account object stored in MSAL
  */
-function getAccountByHomeId(homeAccountId, logger, browserStorage) {
+function getAccountByHomeId(homeAccountId, logger, browserStorage, correlationId) {
     logger.trace("getAccountByHomeId called");
     if (!homeAccountId) {
         logger.warning("getAccountByHomeId: No homeAccountId provided");
@@ -12734,7 +12737,7 @@ function getAccountByHomeId(homeAccountId, logger, browserStorage) {
     }
     const account = browserStorage.getAccountInfoFilteredBy({
         homeAccountId,
-    });
+    }, correlationId);
     if (account) {
         logger.verbose("getAccountByHomeId: Account matching homeAccountId found, returning");
         logger.verbosePii(`getAccountByHomeId: Returning signed-in accounts matching homeAccountId: ${homeAccountId}`);
@@ -12752,7 +12755,7 @@ function getAccountByHomeId(homeAccountId, logger, browserStorage) {
  * @param localAccountId
  * @returns The account object stored in MSAL
  */
-function getAccountByLocalId(localAccountId, logger, browserStorage) {
+function getAccountByLocalId(localAccountId, logger, browserStorage, correlationId) {
     logger.trace("getAccountByLocalId called");
     if (!localAccountId) {
         logger.warning("getAccountByLocalId: No localAccountId provided");
@@ -12760,7 +12763,7 @@ function getAccountByLocalId(localAccountId, logger, browserStorage) {
     }
     const account = browserStorage.getAccountInfoFilteredBy({
         localAccountId,
-    });
+    }, correlationId);
     if (account) {
         logger.verbose("getAccountByLocalId: Account matching localAccountId found, returning");
         logger.verbosePii(`getAccountByLocalId: Returning signed-in accounts matching localAccountId: ${localAccountId}`);
@@ -12775,14 +12778,14 @@ function getAccountByLocalId(localAccountId, logger, browserStorage) {
  * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
  * @param account
  */
-function setActiveAccount(account, browserStorage) {
-    browserStorage.setActiveAccount(account);
+function setActiveAccount(account, browserStorage, correlationId) {
+    browserStorage.setActiveAccount(account, correlationId);
 }
 /**
  * Gets the currently active account
  */
-function getActiveAccount(browserStorage) {
-    return browserStorage.getActiveAccount();
+function getActiveAccount(browserStorage, correlationId) {
+    return browserStorage.getActiveAccount(correlationId);
 }
 
 /*
@@ -12906,15 +12909,15 @@ class BaseInteractionClient {
         this.logger = logger.clone(BrowserConstants.MSAL_SKU, version, this.correlationId);
         this.performanceClient = performanceClient;
     }
-    async clearCacheOnLogout(account) {
+    async clearCacheOnLogout(correlationId, account) {
         if (account) {
-            if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(), false)) {
+            if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(correlationId), false)) {
                 this.logger.verbose("Setting active account to null");
-                this.browserStorage.setActiveAccount(null);
+                this.browserStorage.setActiveAccount(null, correlationId);
             }
             // Clear given account.
             try {
-                this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account), this.correlationId);
+                this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account), correlationId);
                 this.logger.verbose("Cleared cache items belonging to the account provided in the logout request.");
             }
             catch (error) {
@@ -12925,7 +12928,7 @@ class BaseInteractionClient {
             try {
                 this.logger.verbose("No account provided in logout request, clearing all cache items.", this.correlationId);
                 // Clear all accounts and tokens
-                this.browserStorage.clear(this.correlationId);
+                this.browserStorage.clear(correlationId);
                 // Clear any stray keys from IndexedDB
                 await this.browserCrypto.clearKeystore();
             }
@@ -13247,7 +13250,8 @@ class StandardInteractionClient extends BaseInteractionClient {
         if (request.loginHint || request.sid) {
             return validatedRequest;
         }
-        const account = request.account || this.browserStorage.getActiveAccount();
+        const account = request.account ||
+            this.browserStorage.getActiveAccount(this.correlationId);
         if (account) {
             this.logger.verbose("Setting validated request account", this.correlationId);
             this.logger.verbosePii(`Setting validated request account: ${account.homeAccountId}`, this.correlationId);
@@ -13537,7 +13541,7 @@ class SilentCacheClient extends StandardInteractionClient {
     logout(logoutRequest) {
         this.logger.verbose("logoutRedirect called");
         const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-        return this.clearCacheOnLogout(validLogoutRequest?.account);
+        return this.clearCacheOnLogout(validLogoutRequest.correlationId, validLogoutRequest?.account);
     }
 }
 
@@ -13661,7 +13665,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // fetch the account from browser cache
         const account = this.browserStorage.getBaseAccountInfo({
             nativeAccountId,
-        });
+        }, this.correlationId);
         if (!account) {
             throw createClientAuthError(noAccountFound);
         }
@@ -13777,7 +13781,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
         const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
             nativeAccountId: request.accountId,
-        })?.homeAccountId;
+        }, this.correlationId)?.homeAccountId;
         // add exception for double brokering, please note this is temporary and will be fortified in future
         if (request.extraParameters?.child_client_id &&
             response.account.id !== request.accountId) {
@@ -13792,7 +13796,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const authority = await this.getDiscoveredAuthority({
             requestAuthority: request.authority,
         });
-        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
+        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, undefined, // environment
         idTokenClaims.tid, undefined, // auth code payload
         response.account.id, this.logger);
         // Ensure expires_in is in number format
@@ -13800,7 +13804,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
-        await this.cacheAccount(baseAccount);
+        await this.cacheAccount(baseAccount, this.correlationId);
         await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
         return result;
     }
@@ -13924,11 +13928,11 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * cache the account entity in browser storage
      * @param accountEntity
      */
-    async cacheAccount(accountEntity) {
+    async cacheAccount(accountEntity, correlationId) {
         // Store the account info and hence `nativeAccountId` in browser cache
         await this.browserStorage.setAccount(accountEntity, this.correlationId);
         // Remove any existing cached tokens for this account in browser storage
-        this.browserStorage.removeAccountContext(accountEntity, this.correlationId);
+        this.browserStorage.removeAccountContext(accountEntity, correlationId);
     }
     /**
      * Stores the access_token and id_token in inmemory storage
@@ -15098,7 +15102,7 @@ class PopupClient extends StandardInteractionClient {
         const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.logoutPopup);
         try {
             // Clear cache on logout
-            await this.clearCacheOnLogout(validRequest.account);
+            await this.clearCacheOnLogout(this.correlationId, validRequest.account);
             // Initialize the client
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
                 serverTelemetryManager,
@@ -15476,6 +15480,11 @@ class RedirectClient extends StandardInteractionClient {
         this.browserStorage.cacheAuthorizeRequest(redirectRequest);
         const form = await getEARForm(document, this.config, discoveredAuthority, redirectRequest, this.logger, this.performanceClient);
         form.submit();
+        return new Promise((resolve, reject) => {
+            setTimeout(() => {
+                reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
+            }, this.config.system.redirectNavigationTimeout);
+        });
     }
     /**
      * Checks if navigateToLoginRequestUrl is set, and:
@@ -15690,7 +15699,7 @@ class RedirectClient extends StandardInteractionClient {
         try {
             this.eventHandler.emitEvent(EventType.LOGOUT_START, exports.InteractionType.Redirect, logoutRequest);
             // Clear cache on logout
-            await this.clearCacheOnLogout(validLogoutRequest.account);
+            await this.clearCacheOnLogout(this.correlationId, validLogoutRequest.account);
             const navigationOptions = {
                 apiId: ApiId.logout,
                 timeout: this.config.system.redirectNavigationTimeout,
@@ -16185,7 +16194,7 @@ class TokenCache {
         }
         const homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
         const claimsTenantId = idTokenClaims?.tid;
-        const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
+        const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
         undefined, // nativeAccountId
         this.logger);
         await this.storage.setAccount(cachedAccount, correlationId);
@@ -17223,7 +17232,8 @@ class StandardController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter) {
-        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, accountFilter);
+        const correlationId = this.getRequestCorrelationId();
+        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, correlationId, accountFilter);
     }
     /**
      * Returns the first account found in the cache that matches the account filter passed in.
@@ -17231,7 +17241,8 @@ class StandardController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter) {
-        return getAccount(accountFilter, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching username.
@@ -17242,7 +17253,8 @@ class StandardController {
      * @returns The account object stored in MSAL
      */
     getAccountByUsername(username) {
-        return getAccountByUsername(username, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching homeAccountId.
@@ -17252,7 +17264,8 @@ class StandardController {
      * @returns The account object stored in MSAL
      */
     getAccountByHomeId(homeAccountId) {
-        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching localAccountId.
@@ -17262,20 +17275,23 @@ class StandardController {
      * @returns The account object stored in MSAL
      */
     getAccountByLocalId(localAccountId) {
-        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
      * @param account
      */
     setActiveAccount(account) {
-        setActiveAccount(account, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        setActiveAccount(account, this.browserStorage, correlationId);
     }
     /**
      * Gets the currently active account
      */
     getActiveAccount() {
-        return getActiveAccount(this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getActiveAccount(this.browserStorage, correlationId);
     }
     // #endregion
     /**
@@ -17615,9 +17631,7 @@ class StandardController {
     async acquireTokenSilentDeduped(request, account, correlationId) {
         const thumbprint = getRequestThumbprint(this.config.auth.clientId, {
             ...request,
-            authority: request.authority || this.config.auth.authority,
-            correlationId: correlationId,
-        }, account.homeAccountId);
+            authority: request.authority || this.config.auth.authority}, account.homeAccountId);
         const silentRequestKey = JSON.stringify(thumbprint);
         const inProgressRequest = this.activeSilentTokenRequests.get(silentRequestKey);
         if (typeof inProgressRequest === "undefined") {
@@ -18279,8 +18293,9 @@ class NestedAppAuthController {
         // always prioritize the account context from the bridge
         const accountContext = this.bridgeProxy.getAccountContext() || this.currentAccountContext;
         let currentAccount = null;
+        const correlationId = request.correlationId || this.browserCrypto.createNewGuid();
         if (accountContext) {
-            currentAccount = getAccount(accountContext, this.logger, this.browserStorage);
+            currentAccount = getAccount(accountContext, this.logger, this.browserStorage, correlationId);
         }
         // fall back to brokering if no cached account is found
         if (!currentAccount) {
@@ -18309,7 +18324,7 @@ class NestedAppAuthController {
             this.logger.verbose("Cached access token has expired");
             return Promise.resolve(null);
         }
-        const cachedIdToken = this.browserStorage.getIdToken(currentAccount, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+        const cachedIdToken = this.browserStorage.getIdToken(currentAccount, authRequest.correlationId, tokenKeys, currentAccount.tenantId, this.performanceClient);
         if (!cachedIdToken) {
             this.logger.verbose("No cached id token found");
             return Promise.resolve(null);
@@ -18406,7 +18421,8 @@ class NestedAppAuthController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter) {
-        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), accountFilter);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), correlationId, accountFilter);
     }
     /**
      * Returns the first account found in the cache that matches the account filter passed in.
@@ -18414,7 +18430,8 @@ class NestedAppAuthController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter) {
-        return getAccount(accountFilter, this.logger, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching username.
@@ -18425,7 +18442,8 @@ class NestedAppAuthController {
      * @returns The account object stored in MSAL
      */
     getAccountByUsername(username) {
-        return getAccountByUsername(username, this.logger, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching homeAccountId.
@@ -18435,7 +18453,8 @@ class NestedAppAuthController {
      * @returns The account object stored in MSAL
      */
     getAccountByHomeId(homeAccountId) {
-        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching localAccountId.
@@ -18445,7 +18464,8 @@ class NestedAppAuthController {
      * @returns The account object stored in MSAL
      */
     getAccountByLocalId(localAccountId) {
-        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
@@ -18456,13 +18476,15 @@ class NestedAppAuthController {
          * StandardController uses this to allow the developer to set the active account
          * in the nested app auth scenario the active account is controlled by the app hosting the nested app
          */
-        return setActiveAccount(account, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return setActiveAccount(account, this.browserStorage, correlationId);
     }
     /**
      * Gets the currently active account
      */
     getActiveAccount() {
-        return getActiveAccount(this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return getActiveAccount(this.browserStorage, correlationId);
     }
     // #endregion
     handleRedirectPromise(hash // eslint-disable-line @typescript-eslint/no-unused-vars