@azure/msal-common 14.0.3 → 14.1.0

package/dist/index.cjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.0.3 2023-09-05 */
+/*! @azure/msal-common v14.1.0 2023-10-05 */
 'use strict';
 'use strict';
 
@@ -357,12 +357,20 @@ const RegionDiscoveryOutcomes = {
     AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
     AUTO_DETECTION_REQUESTED_FAILED: "5",
 };
+/**
+ * Specifies the reason for fetching the access token from the identity provider
+ */
 const CacheOutcome = {
-    NO_CACHE_HIT: "0",
-    FORCE_REFRESH: "1",
+    // When a token is found in the cache or the cache is not supposed to be hit when making the request
+    NOT_APPLICABLE: "0",
+    // When the token request goes to the identity provider because force_refresh was set to true. Also occurs if claims were requested
+    FORCE_REFRESH_OR_CLAIMS: "1",
+    // When the token request goes to the identity provider because no cached access token exists
     NO_CACHED_ACCESS_TOKEN: "2",
+    // When the token request goes to the identity provider because cached access token expired
     CACHED_ACCESS_TOKEN_EXPIRED: "3",
-    REFRESH_CACHED_ACCESS_TOKEN: "4",
+    // When the token request goes to the identity provider because refresh_in was used and the existing token needs to be refreshed
+    PROACTIVELY_REFRESHED: "4",
 };
 const JsonTypes = {
     Jwt: "JWT",
@@ -378,14 +386,35 @@ const ONE_DAY_IN_MS = 86400000;
 /**
  * AuthErrorMessage class containing string constants used by error codes and messages.
  */
+const unexpectedError = "unexpected_error";
+const postRequestFailed = "post_request_failed";
+
+var AuthErrorCodes = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    postRequestFailed: postRequestFailed,
+    unexpectedError: unexpectedError
+});
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const AuthErrorMessages = {
+    [unexpectedError]: "Unexpected error in authentication.",
+    [postRequestFailed]: "Post request failed from the network, could be a 4xx/5xx or a network unavailability. Please check the exact error code for details.",
+};
+/**
+ * AuthErrorMessage class containing string constants used by error codes and messages.
+ * @deprecated Use AuthErrorCodes instead
+ */
 const AuthErrorMessage = {
     unexpectedError: {
-        code: "unexpected_error",
-        desc: "Unexpected error in authentication.",
+        code: unexpectedError,
+        desc: AuthErrorMessages[unexpectedError],
     },
     postRequestFailed: {
-        code: "post_request_failed",
-        desc: "Post request failed from the network, could be a 4xx/5xx or a network unavailability. Please check the exact error code for details.",
+        code: postRequestFailed,
+        desc: AuthErrorMessages[postRequestFailed],
     },
 };
 /**
@@ -406,22 +435,352 @@ class AuthError extends Error {
     setCorrelationId(correlationId) {
         this.correlationId = correlationId;
     }
-    /**
-     * Creates an error that is thrown when something unexpected happens in the library.
-     * @param errDesc
-     */
-    static createUnexpectedError(errDesc) {
-        return new AuthError(AuthErrorMessage.unexpectedError.code, `${AuthErrorMessage.unexpectedError.desc}: ${errDesc}`);
-    }
-    /**
-     * Creates an error for post request failures.
-     * @param errDesc
-     * @returns
-     */
-    static createPostRequestFailed(errDesc) {
-        return new AuthError(AuthErrorMessage.postRequestFailed.code, `${AuthErrorMessage.postRequestFailed.desc}: ${errDesc}`);
+}
+function createAuthError(code, additionalMessage) {
+    return new AuthError(code, additionalMessage
+        ? `${AuthErrorMessages[code]} ${additionalMessage}`
+        : AuthErrorMessages[code]);
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const clientInfoDecodingError = "client_info_decoding_error";
+const clientInfoEmptyError = "client_info_empty_error";
+const tokenParsingError = "token_parsing_error";
+const nullOrEmptyToken = "null_or_empty_token";
+const endpointResolutionError = "endpoints_resolution_error";
+const networkError = "network_error";
+const openIdConfigError = "openid_config_error";
+const hashNotDeserialized = "hash_not_deserialized";
+const invalidState = "invalid_state";
+const stateMismatch = "state_mismatch";
+const stateNotFound = "state_not_found";
+const nonceMismatch = "nonce_mismatch";
+const authTimeNotFound = "auth_time_not_found";
+const maxAgeTranspired = "max_age_transpired";
+const multipleMatchingTokens = "multiple_matching_tokens";
+const multipleMatchingAccounts = "multiple_matching_accounts";
+const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
+const requestCannotBeMade = "request_cannot_be_made";
+const cannotRemoveEmptyScope = "cannot_remove_empty_scope";
+const cannotAppendScopeSet = "cannot_append_scopeset";
+const emptyInputScopeSet = "empty_input_scopeset";
+const deviceCodePollingCancelled = "device_code_polling_cancelled";
+const deviceCodeExpired = "device_code_expired";
+const deviceCodeUnknownError = "device_code_unknown_error";
+const noAccountInSilentRequest = "no_account_in_silent_request";
+const invalidCacheRecord = "invalid_cache_record";
+const invalidCacheEnvironment = "invalid_cache_environment";
+const noAccountFound = "no_account_found";
+const noCryptoObject = "no_crypto_object";
+const unexpectedCredentialType = "unexpected_credential_type";
+const invalidAssertion = "invalid_assertion";
+const invalidClientCredential = "invalid_client_credential";
+const tokenRefreshRequired = "token_refresh_required";
+const userTimeoutReached = "user_timeout_reached";
+const tokenClaimsCnfRequiredForSignedJwt = "token_claims_cnf_required_for_signedjwt";
+const authorizationCodeMissingFromServerResponse = "authorization_code_missing_from_server_response";
+const bindingKeyNotRemoved = "binding_key_not_removed";
+const endSessionEndpointNotSupported = "end_session_endpoint_not_supported";
+const keyIdMissing = "key_id_missing";
+const noNetworkConnectivity = "no_network_connectivity";
+const userCanceled = "user_canceled";
+const missingTenantIdError = "missing_tenant_id_error";
+const methodNotImplemented = "method_not_implemented";
+
+var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    authTimeNotFound: authTimeNotFound,
+    authorizationCodeMissingFromServerResponse: authorizationCodeMissingFromServerResponse,
+    bindingKeyNotRemoved: bindingKeyNotRemoved,
+    cannotAppendScopeSet: cannotAppendScopeSet,
+    cannotRemoveEmptyScope: cannotRemoveEmptyScope,
+    clientInfoDecodingError: clientInfoDecodingError,
+    clientInfoEmptyError: clientInfoEmptyError,
+    deviceCodeExpired: deviceCodeExpired,
+    deviceCodePollingCancelled: deviceCodePollingCancelled,
+    deviceCodeUnknownError: deviceCodeUnknownError,
+    emptyInputScopeSet: emptyInputScopeSet,
+    endSessionEndpointNotSupported: endSessionEndpointNotSupported,
+    endpointResolutionError: endpointResolutionError,
+    hashNotDeserialized: hashNotDeserialized,
+    invalidAssertion: invalidAssertion,
+    invalidCacheEnvironment: invalidCacheEnvironment,
+    invalidCacheRecord: invalidCacheRecord,
+    invalidClientCredential: invalidClientCredential,
+    invalidState: invalidState,
+    keyIdMissing: keyIdMissing,
+    maxAgeTranspired: maxAgeTranspired,
+    methodNotImplemented: methodNotImplemented,
+    missingTenantIdError: missingTenantIdError,
+    multipleMatchingAccounts: multipleMatchingAccounts,
+    multipleMatchingAppMetadata: multipleMatchingAppMetadata,
+    multipleMatchingTokens: multipleMatchingTokens,
+    networkError: networkError,
+    noAccountFound: noAccountFound,
+    noAccountInSilentRequest: noAccountInSilentRequest,
+    noCryptoObject: noCryptoObject,
+    noNetworkConnectivity: noNetworkConnectivity,
+    nonceMismatch: nonceMismatch,
+    nullOrEmptyToken: nullOrEmptyToken,
+    openIdConfigError: openIdConfigError,
+    requestCannotBeMade: requestCannotBeMade,
+    stateMismatch: stateMismatch,
+    stateNotFound: stateNotFound,
+    tokenClaimsCnfRequiredForSignedJwt: tokenClaimsCnfRequiredForSignedJwt,
+    tokenParsingError: tokenParsingError,
+    tokenRefreshRequired: tokenRefreshRequired,
+    unexpectedCredentialType: unexpectedCredentialType,
+    userCanceled: userCanceled,
+    userTimeoutReached: userTimeoutReached
+});
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * ClientAuthErrorMessage class containing string constants used by error codes and messages.
+ */
+const ClientAuthErrorMessages = {
+    [clientInfoDecodingError]: "The client info could not be parsed/decoded correctly",
+    [clientInfoEmptyError]: "The client info was empty",
+    [tokenParsingError]: "Token cannot be parsed",
+    [nullOrEmptyToken]: "The token is null or empty",
+    [endpointResolutionError]: "Endpoints cannot be resolved",
+    [networkError]: "Network request failed",
+    [openIdConfigError]: "Could not retrieve endpoints. Check your authority and verify the .well-known/openid-configuration endpoint returns the required endpoints.",
+    [hashNotDeserialized]: "The hash parameters could not be deserialized",
+    [invalidState]: "State was not the expected format",
+    [stateMismatch]: "State mismatch error",
+    [stateNotFound]: "State not found",
+    [nonceMismatch]: "Nonce mismatch error",
+    [authTimeNotFound]: "Max Age was requested and the ID token is missing the auth_time variable." +
+        " auth_time is an optional claim and is not enabled by default - it must be enabled." +
+        " See https://aka.ms/msaljs/optional-claims for more information.",
+    [maxAgeTranspired]: "Max Age is set to 0, or too much time has elapsed since the last end-user authentication.",
+    [multipleMatchingTokens]: "The cache contains multiple tokens satisfying the requirements. " +
+        "Call AcquireToken again providing more requirements such as authority or account.",
+    [multipleMatchingAccounts]: "The cache contains multiple accounts satisfying the given parameters. Please pass more info to obtain the correct account",
+    [multipleMatchingAppMetadata]: "The cache contains multiple appMetadata satisfying the given parameters. Please pass more info to obtain the correct appMetadata",
+    [requestCannotBeMade]: "Token request cannot be made without authorization code or refresh token.",
+    [cannotRemoveEmptyScope]: "Cannot remove null or empty scope from ScopeSet",
+    [cannotAppendScopeSet]: "Cannot append ScopeSet",
+    [emptyInputScopeSet]: "Empty input ScopeSet cannot be processed",
+    [deviceCodePollingCancelled]: "Caller has cancelled token endpoint polling during device code flow by setting DeviceCodeRequest.cancel = true.",
+    [deviceCodeExpired]: "Device code is expired.",
+    [deviceCodeUnknownError]: "Device code stopped polling for unknown reasons.",
+    [noAccountInSilentRequest]: "Please pass an account object, silent flow is not supported without account information",
+    [invalidCacheRecord]: "Cache record object was null or undefined.",
+    [invalidCacheEnvironment]: "Invalid environment when attempting to create cache entry",
+    [noAccountFound]: "No account found in cache for given key.",
+    [noCryptoObject]: "No crypto object detected.",
+    [unexpectedCredentialType]: "Unexpected credential type.",
+    [invalidAssertion]: "Client assertion must meet requirements described in https://tools.ietf.org/html/rfc7515",
+    [invalidClientCredential]: "Client credential (secret, certificate, or assertion) must not be empty when creating a confidential client. An application should at most have one credential",
+    [tokenRefreshRequired]: "Cannot return token from cache because it must be refreshed. This may be due to one of the following reasons: forceRefresh parameter is set to true, claims have been requested, there is no cached access token or it is expired.",
+    [userTimeoutReached]: "User defined timeout for device code polling reached",
+    [tokenClaimsCnfRequiredForSignedJwt]: "Cannot generate a POP jwt if the token_claims are not populated",
+    [authorizationCodeMissingFromServerResponse]: "Server response does not contain an authorization code to proceed",
+    [bindingKeyNotRemoved]: "Could not remove the credential's binding key from storage.",
+    [endSessionEndpointNotSupported]: "The provided authority does not support logout",
+    [keyIdMissing]: "A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key.",
+    [noNetworkConnectivity]: "No network connectivity. Check your internet connection.",
+    [userCanceled]: "User cancelled the flow.",
+    [missingTenantIdError]: "A tenant id - not common, organizations, or consumers - must be specified when using the client_credentials flow.",
+    [methodNotImplemented]: "This method has not been implemented",
+};
+/**
+ * String constants used by error codes and messages.
+ * @deprecated Use ClientAuthErrorCodes instead
+ */
+const ClientAuthErrorMessage = {
+    clientInfoDecodingError: {
+        code: clientInfoDecodingError,
+        desc: ClientAuthErrorMessages[clientInfoDecodingError],
+    },
+    clientInfoEmptyError: {
+        code: clientInfoEmptyError,
+        desc: ClientAuthErrorMessages[clientInfoEmptyError],
+    },
+    tokenParsingError: {
+        code: tokenParsingError,
+        desc: ClientAuthErrorMessages[tokenParsingError],
+    },
+    nullOrEmptyToken: {
+        code: nullOrEmptyToken,
+        desc: ClientAuthErrorMessages[nullOrEmptyToken],
+    },
+    endpointResolutionError: {
+        code: endpointResolutionError,
+        desc: ClientAuthErrorMessages[endpointResolutionError],
+    },
+    networkError: {
+        code: networkError,
+        desc: ClientAuthErrorMessages[networkError],
+    },
+    unableToGetOpenidConfigError: {
+        code: openIdConfigError,
+        desc: ClientAuthErrorMessages[openIdConfigError],
+    },
+    hashNotDeserialized: {
+        code: hashNotDeserialized,
+        desc: ClientAuthErrorMessages[hashNotDeserialized],
+    },
+    invalidStateError: {
+        code: invalidState,
+        desc: ClientAuthErrorMessages[invalidState],
+    },
+    stateMismatchError: {
+        code: stateMismatch,
+        desc: ClientAuthErrorMessages[stateMismatch],
+    },
+    stateNotFoundError: {
+        code: stateNotFound,
+        desc: ClientAuthErrorMessages[stateNotFound],
+    },
+    nonceMismatchError: {
+        code: nonceMismatch,
+        desc: ClientAuthErrorMessages[nonceMismatch],
+    },
+    authTimeNotFoundError: {
+        code: authTimeNotFound,
+        desc: ClientAuthErrorMessages[authTimeNotFound],
+    },
+    maxAgeTranspired: {
+        code: maxAgeTranspired,
+        desc: ClientAuthErrorMessages[maxAgeTranspired],
+    },
+    multipleMatchingTokens: {
+        code: multipleMatchingTokens,
+        desc: ClientAuthErrorMessages[multipleMatchingTokens],
+    },
+    multipleMatchingAccounts: {
+        code: multipleMatchingAccounts,
+        desc: ClientAuthErrorMessages[multipleMatchingAccounts],
+    },
+    multipleMatchingAppMetadata: {
+        code: multipleMatchingAppMetadata,
+        desc: ClientAuthErrorMessages[multipleMatchingAppMetadata],
+    },
+    tokenRequestCannotBeMade: {
+        code: requestCannotBeMade,
+        desc: ClientAuthErrorMessages[requestCannotBeMade],
+    },
+    removeEmptyScopeError: {
+        code: cannotRemoveEmptyScope,
+        desc: ClientAuthErrorMessages[cannotRemoveEmptyScope],
+    },
+    appendScopeSetError: {
+        code: cannotAppendScopeSet,
+        desc: ClientAuthErrorMessages[cannotAppendScopeSet],
+    },
+    emptyInputScopeSetError: {
+        code: emptyInputScopeSet,
+        desc: ClientAuthErrorMessages[emptyInputScopeSet],
+    },
+    DeviceCodePollingCancelled: {
+        code: deviceCodePollingCancelled,
+        desc: ClientAuthErrorMessages[deviceCodePollingCancelled],
+    },
+    DeviceCodeExpired: {
+        code: deviceCodeExpired,
+        desc: ClientAuthErrorMessages[deviceCodeExpired],
+    },
+    DeviceCodeUnknownError: {
+        code: deviceCodeUnknownError,
+        desc: ClientAuthErrorMessages[deviceCodeUnknownError],
+    },
+    NoAccountInSilentRequest: {
+        code: noAccountInSilentRequest,
+        desc: ClientAuthErrorMessages[noAccountInSilentRequest],
+    },
+    invalidCacheRecord: {
+        code: invalidCacheRecord,
+        desc: ClientAuthErrorMessages[invalidCacheRecord],
+    },
+    invalidCacheEnvironment: {
+        code: invalidCacheEnvironment,
+        desc: ClientAuthErrorMessages[invalidCacheEnvironment],
+    },
+    noAccountFound: {
+        code: noAccountFound,
+        desc: ClientAuthErrorMessages[noAccountFound],
+    },
+    noCryptoObj: {
+        code: noCryptoObject,
+        desc: ClientAuthErrorMessages[noCryptoObject],
+    },
+    unexpectedCredentialType: {
+        code: unexpectedCredentialType,
+        desc: ClientAuthErrorMessages[unexpectedCredentialType],
+    },
+    invalidAssertion: {
+        code: invalidAssertion,
+        desc: ClientAuthErrorMessages[invalidAssertion],
+    },
+    invalidClientCredential: {
+        code: invalidClientCredential,
+        desc: ClientAuthErrorMessages[invalidClientCredential],
+    },
+    tokenRefreshRequired: {
+        code: tokenRefreshRequired,
+        desc: ClientAuthErrorMessages[tokenRefreshRequired],
+    },
+    userTimeoutReached: {
+        code: userTimeoutReached,
+        desc: ClientAuthErrorMessages[userTimeoutReached],
+    },
+    tokenClaimsRequired: {
+        code: tokenClaimsCnfRequiredForSignedJwt,
+        desc: ClientAuthErrorMessages[tokenClaimsCnfRequiredForSignedJwt],
+    },
+    noAuthorizationCodeFromServer: {
+        code: authorizationCodeMissingFromServerResponse,
+        desc: ClientAuthErrorMessages[authorizationCodeMissingFromServerResponse],
+    },
+    bindingKeyNotRemovedError: {
+        code: bindingKeyNotRemoved,
+        desc: ClientAuthErrorMessages[bindingKeyNotRemoved],
+    },
+    logoutNotSupported: {
+        code: endSessionEndpointNotSupported,
+        desc: ClientAuthErrorMessages[endSessionEndpointNotSupported],
+    },
+    keyIdMissing: {
+        code: keyIdMissing,
+        desc: ClientAuthErrorMessages[keyIdMissing],
+    },
+    noNetworkConnectivity: {
+        code: noNetworkConnectivity,
+        desc: ClientAuthErrorMessages[noNetworkConnectivity],
+    },
+    userCanceledError: {
+        code: userCanceled,
+        desc: ClientAuthErrorMessages[userCanceled],
+    },
+    missingTenantIdError: {
+        code: missingTenantIdError,
+        desc: ClientAuthErrorMessages[missingTenantIdError],
+    },
+};
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+class ClientAuthError extends AuthError {
+    constructor(errorCode, additionalMessage) {
+        super(errorCode, additionalMessage
+            ? `${ClientAuthErrorMessages[errorCode]}: ${additionalMessage}`
+            : ClientAuthErrorMessages[errorCode]);
+        this.name = "ClientAuthError";
+        Object.setPrototypeOf(this, ClientAuthError.prototype);
     }
 }
+function createClientAuthError(errorCode, additionalMessage) {
+    return new ClientAuthError(errorCode, additionalMessage);
+}
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -429,40 +788,28 @@ class AuthError extends Error {
  */
 const DEFAULT_CRYPTO_IMPLEMENTATION = {
     createNewGuid: () => {
-        const notImplErr = "Crypto interface - createNewGuid() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
     base64Decode: () => {
-        const notImplErr = "Crypto interface - base64Decode() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
     base64Encode: () => {
-        const notImplErr = "Crypto interface - base64Encode() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    async generatePkceCodes() {
-        const notImplErr = "Crypto interface - generatePkceCodes() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
     async getPublicKeyThumbprint() {
-        const notImplErr = "Crypto interface - getPublicKeyThumbprint() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
     async removeTokenBindingKey() {
-        const notImplErr = "Crypto interface - removeTokenBindingKey() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
     async clearKeystore() {
-        const notImplErr = "Crypto interface - clearKeystore() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
     async signJwt() {
-        const notImplErr = "Crypto interface - signJwt() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
     async hashString() {
-        const notImplErr = "Crypto interface - hashString() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
 };
 
@@ -657,7 +1004,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "14.0.3";
+const version = "14.1.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -682,800 +1029,189 @@ const AzureCloudInstance = {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-/**
- * ClientAuthErrorMessage class containing string constants used by error codes and messages.
- */
-const ClientAuthErrorMessage = {
-    clientInfoDecodingError: {
-        code: "client_info_decoding_error",
-        desc: "The client info could not be parsed/decoded correctly. Please review the trace to determine the root cause.",
-    },
-    clientInfoEmptyError: {
-        code: "client_info_empty_error",
-        desc: "The client info was empty. Please review the trace to determine the root cause.",
-    },
-    tokenParsingError: {
-        code: "token_parsing_error",
-        desc: "Token cannot be parsed. Please review stack trace to determine root cause.",
-    },
-    nullOrEmptyToken: {
-        code: "null_or_empty_token",
-        desc: "The token is null or empty. Please review the trace to determine the root cause.",
-    },
-    endpointResolutionError: {
-        code: "endpoints_resolution_error",
-        desc: "Error: could not resolve endpoints. Please check network and try again.",
-    },
-    networkError: {
-        code: "network_error",
-        desc: "Network request failed. Please check network trace to determine root cause.",
-    },
-    unableToGetOpenidConfigError: {
-        code: "openid_config_error",
-        desc: "Could not retrieve endpoints. Check your authority and verify the .well-known/openid-configuration endpoint returns the required endpoints.",
-    },
-    hashNotDeserialized: {
-        code: "hash_not_deserialized",
-        desc: "The hash parameters could not be deserialized. Please review the trace to determine the root cause.",
-    },
-    blankGuidGenerated: {
-        code: "blank_guid_generated",
-        desc: "The guid generated was blank. Please review the trace to determine the root cause.",
-    },
-    invalidStateError: {
-        code: "invalid_state",
-        desc: "State was not the expected format. Please check the logs to determine whether the request was sent using ProtocolUtils.setRequestState().",
-    },
-    stateMismatchError: {
-        code: "state_mismatch",
-        desc: "State mismatch error. Please check your network. Continued requests may cause cache overflow.",
-    },
-    stateNotFoundError: {
-        code: "state_not_found",
-        desc: "State not found",
-    },
-    nonceMismatchError: {
-        code: "nonce_mismatch",
-        desc: "Nonce mismatch error. This may be caused by a race condition in concurrent requests.",
-    },
-    nonceNotFoundError: {
-        code: "nonce_not_found",
-        desc: "nonce not found",
-    },
-    authTimeNotFoundError: {
-        code: "auth_time_not_found",
-        desc: "Max Age was requested and the ID token is missing the auth_time variable." +
-            " auth_time is an optional claim and is not enabled by default - it must be enabled." +
-            " See https://aka.ms/msaljs/optional-claims for more information.",
-    },
-    maxAgeTranspiredError: {
-        code: "max_age_transpired",
-        desc: "Max Age is set to 0, or too much time has elapsed since the last end-user authentication.",
-    },
-    noTokensFoundError: {
-        code: "no_tokens_found",
-        desc: "No tokens were found for the given scopes, and no authorization code was passed to acquireToken. You must retrieve an authorization code before making a call to acquireToken().",
-    },
-    multipleMatchingTokens: {
-        code: "multiple_matching_tokens",
-        desc: "The cache contains multiple tokens satisfying the requirements. " +
-            "Call AcquireToken again providing more requirements such as authority or account.",
-    },
-    multipleMatchingAccounts: {
-        code: "multiple_matching_accounts",
-        desc: "The cache contains multiple accounts satisfying the given parameters. Please pass more info to obtain the correct account",
-    },
-    multipleMatchingAppMetadata: {
-        code: "multiple_matching_appMetadata",
-        desc: "The cache contains multiple appMetadata satisfying the given parameters. Please pass more info to obtain the correct appMetadata",
-    },
-    tokenRequestCannotBeMade: {
-        code: "request_cannot_be_made",
-        desc: "Token request cannot be made without authorization code or refresh token.",
-    },
-    appendEmptyScopeError: {
-        code: "cannot_append_empty_scope",
-        desc: "Cannot append null or empty scope to ScopeSet. Please check the stack trace for more info.",
-    },
-    removeEmptyScopeError: {
-        code: "cannot_remove_empty_scope",
-        desc: "Cannot remove null or empty scope from ScopeSet. Please check the stack trace for more info.",
-    },
-    appendScopeSetError: {
-        code: "cannot_append_scopeset",
-        desc: "Cannot append ScopeSet due to error.",
-    },
-    emptyInputScopeSetError: {
-        code: "empty_input_scopeset",
-        desc: "Empty input ScopeSet cannot be processed.",
-    },
-    DeviceCodePollingCancelled: {
-        code: "device_code_polling_cancelled",
-        desc: "Caller has cancelled token endpoint polling during device code flow by setting DeviceCodeRequest.cancel = true.",
-    },
-    DeviceCodeExpired: {
-        code: "device_code_expired",
-        desc: "Device code is expired.",
-    },
-    DeviceCodeUnknownError: {
-        code: "device_code_unknown_error",
-        desc: "Device code stopped polling for unknown reasons.",
-    },
-    NoAccountInSilentRequest: {
-        code: "no_account_in_silent_request",
-        desc: "Please pass an account object, silent flow is not supported without account information",
-    },
-    invalidCacheRecord: {
-        code: "invalid_cache_record",
-        desc: "Cache record object was null or undefined.",
-    },
-    invalidCacheEnvironment: {
-        code: "invalid_cache_environment",
-        desc: "Invalid environment when attempting to create cache entry",
-    },
-    noAccountFound: {
-        code: "no_account_found",
-        desc: "No account found in cache for given key.",
-    },
-    CachePluginError: {
-        code: "no cache plugin set on CacheManager",
-        desc: "ICachePlugin needs to be set before using readFromStorage or writeFromStorage",
-    },
-    noCryptoObj: {
-        code: "no_crypto_object",
-        desc: "No crypto object detected. This is required for the following operation: ",
-    },
-    invalidCacheType: {
-        code: "invalid_cache_type",
-        desc: "Invalid cache type",
-    },
-    unexpectedAccountType: {
-        code: "unexpected_account_type",
-        desc: "Unexpected account type.",
-    },
-    unexpectedCredentialType: {
-        code: "unexpected_credential_type",
-        desc: "Unexpected credential type.",
-    },
-    invalidAssertion: {
-        code: "invalid_assertion",
-        desc: "Client assertion must meet requirements described in https://tools.ietf.org/html/rfc7515",
-    },
-    invalidClientCredential: {
-        code: "invalid_client_credential",
-        desc: "Client credential (secret, certificate, or assertion) must not be empty when creating a confidential client. An application should at most have one credential",
-    },
-    tokenRefreshRequired: {
-        code: "token_refresh_required",
-        desc: "Cannot return token from cache because it must be refreshed. This may be due to one of the following reasons: forceRefresh parameter is set to true, claims have been requested, there is no cached access token or it is expired.",
-    },
-    userTimeoutReached: {
-        code: "user_timeout_reached",
-        desc: "User defined timeout for device code polling reached",
-    },
-    tokenClaimsRequired: {
-        code: "token_claims_cnf_required_for_signedjwt",
-        desc: "Cannot generate a POP jwt if the token_claims are not populated",
-    },
-    noAuthorizationCodeFromServer: {
-        code: "authorization_code_missing_from_server_response",
-        desc: "Server response does not contain an authorization code to proceed",
-    },
-    noAzureRegionDetected: {
-        code: "no_azure_region_detected",
-        desc: "No azure region was detected and no fallback was made available",
-    },
-    accessTokenEntityNullError: {
-        code: "access_token_entity_null",
-        desc: "Access token entity is null, please check logs and cache to ensure a valid access token is present.",
-    },
-    bindingKeyNotRemovedError: {
-        code: "binding_key_not_removed",
-        desc: "Could not remove the credential's binding key from storage.",
-    },
-    logoutNotSupported: {
-        code: "end_session_endpoint_not_supported",
-        desc: "Provided authority does not support logout.",
-    },
-    keyIdMissing: {
-        code: "key_id_missing",
-        desc: "A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key.",
-    },
-    noNetworkConnectivity: {
-        code: "no_network_connectivity",
-        desc: "No network connectivity. Check your internet connection.",
-    },
-    userCanceledError: {
-        code: "user_canceled",
-        desc: "User canceled the flow.",
-    },
-    missingTenantIdError: {
-        code: "missing_tenant_id_error",
-        desc: "A tenant id - not common, organizations, or consumers - must be specified when using the client_credentials flow.",
-    },
-};
-/**
- * Error thrown when there is an error in the client code running on the browser.
- */
-class ClientAuthError extends AuthError {
-    constructor(errorCode, errorMessage) {
-        super(errorCode, errorMessage);
-        this.name = "ClientAuthError";
-        Object.setPrototypeOf(this, ClientAuthError.prototype);
-    }
-    /**
-     * Creates an error thrown when client info object doesn't decode correctly.
-     * @param caughtError
-     */
-    static createClientInfoDecodingError(caughtError) {
-        return new ClientAuthError(ClientAuthErrorMessage.clientInfoDecodingError.code, `${ClientAuthErrorMessage.clientInfoDecodingError.desc} Failed with error: ${caughtError}`);
-    }
-    /**
-     * Creates an error thrown if the client info is empty.
-     * @param rawClientInfo
-     */
-    static createClientInfoEmptyError() {
-        return new ClientAuthError(ClientAuthErrorMessage.clientInfoEmptyError.code, `${ClientAuthErrorMessage.clientInfoEmptyError.desc}`);
-    }
-    /**
-     * Creates an error thrown when the id token extraction errors out.
-     * @param err
-     */
-    static createTokenParsingError(caughtExtractionError) {
-        return new ClientAuthError(ClientAuthErrorMessage.tokenParsingError.code, `${ClientAuthErrorMessage.tokenParsingError.desc} Failed with error: ${caughtExtractionError}`);
-    }
-    /**
-     * Creates an error thrown when the id token string is null or empty.
-     * @param invalidRawTokenString
-     */
-    static createTokenNullOrEmptyError(invalidRawTokenString) {
-        return new ClientAuthError(ClientAuthErrorMessage.nullOrEmptyToken.code, `${ClientAuthErrorMessage.nullOrEmptyToken.desc} Raw Token Value: ${invalidRawTokenString}`);
-    }
-    /**
-     * Creates an error thrown when the endpoint discovery doesn't complete correctly.
-     */
-    static createEndpointDiscoveryIncompleteError(errDetail) {
-        return new ClientAuthError(ClientAuthErrorMessage.endpointResolutionError.code, `${ClientAuthErrorMessage.endpointResolutionError.desc} Detail: ${errDetail}`);
-    }
-    /**
-     * Creates an error thrown when the fetch client throws
-     */
-    static createNetworkError(endpoint, errDetail) {
-        return new ClientAuthError(ClientAuthErrorMessage.networkError.code, `${ClientAuthErrorMessage.networkError.desc} | Fetch client threw: ${errDetail} | Attempted to reach: ${endpoint.split("?")[0]}`);
-    }
-    /**
-     * Creates an error thrown when the openid-configuration endpoint cannot be reached or does not contain the required data
-     */
-    static createUnableToGetOpenidConfigError(errDetail) {
-        return new ClientAuthError(ClientAuthErrorMessage.unableToGetOpenidConfigError.code, `${ClientAuthErrorMessage.unableToGetOpenidConfigError.desc} Attempted to retrieve endpoints from: ${errDetail}`);
-    }
-    /**
-     * Creates an error thrown when the hash cannot be deserialized.
-     * @param hashParamObj
-     */
-    static createHashNotDeserializedError(hashParamObj) {
-        return new ClientAuthError(ClientAuthErrorMessage.hashNotDeserialized.code, `${ClientAuthErrorMessage.hashNotDeserialized.desc} Given Object: ${hashParamObj}`);
-    }
-    /**
-     * Creates an error thrown when the state cannot be parsed.
-     * @param invalidState
-     */
-    static createInvalidStateError(invalidState, errorString) {
-        return new ClientAuthError(ClientAuthErrorMessage.invalidStateError.code, `${ClientAuthErrorMessage.invalidStateError.desc} Invalid State: ${invalidState}, Root Err: ${errorString}`);
-    }
-    /**
-     * Creates an error thrown when two states do not match.
-     */
-    static createStateMismatchError() {
-        return new ClientAuthError(ClientAuthErrorMessage.stateMismatchError.code, ClientAuthErrorMessage.stateMismatchError.desc);
-    }
-    /**
-     * Creates an error thrown when the state is not present
-     * @param missingState
-     */
-    static createStateNotFoundError(missingState) {
-        return new ClientAuthError(ClientAuthErrorMessage.stateNotFoundError.code, `${ClientAuthErrorMessage.stateNotFoundError.desc}:  ${missingState}`);
-    }
-    /**
-     * Creates an error thrown when the nonce does not match.
-     */
-    static createNonceMismatchError() {
-        return new ClientAuthError(ClientAuthErrorMessage.nonceMismatchError.code, ClientAuthErrorMessage.nonceMismatchError.desc);
-    }
-    /**
-     * Creates an error thrown when max_age was provided in the request, but auth_time is not in the token claims
-     * @param missingNonce
-     */
-    static createAuthTimeNotFoundError() {
-        return new ClientAuthError(ClientAuthErrorMessage.authTimeNotFoundError.code, ClientAuthErrorMessage.authTimeNotFoundError.desc);
-    }
-    /**
-     * Creates an error thrown when too much time has elapsed since the last end-user authentication
-     */
-    static createMaxAgeTranspiredError() {
-        return new ClientAuthError(ClientAuthErrorMessage.maxAgeTranspiredError.code, ClientAuthErrorMessage.maxAgeTranspiredError.desc);
-    }
-    /**
-     * Creates an error thrown when the mnonce is not present
-     * @param missingNonce
-     */
-    static createNonceNotFoundError(missingNonce) {
-        return new ClientAuthError(ClientAuthErrorMessage.nonceNotFoundError.code, `${ClientAuthErrorMessage.nonceNotFoundError.desc}:  ${missingNonce}`);
-    }
-    /**
-     * Throws error when multiple tokens are in cache.
-     */
-    static createMultipleMatchingTokensInCacheError() {
-        return new ClientAuthError(ClientAuthErrorMessage.multipleMatchingTokens.code, `${ClientAuthErrorMessage.multipleMatchingTokens.desc}.`);
-    }
-    /**
-     * Throws error when multiple accounts are in cache for the given params
-     */
-    static createMultipleMatchingAccountsInCacheError() {
-        return new ClientAuthError(ClientAuthErrorMessage.multipleMatchingAccounts.code, ClientAuthErrorMessage.multipleMatchingAccounts.desc);
-    }
-    /**
-     * Throws error when multiple appMetada are in cache for the given clientId.
-     */
-    static createMultipleMatchingAppMetadataInCacheError() {
-        return new ClientAuthError(ClientAuthErrorMessage.multipleMatchingAppMetadata.code, ClientAuthErrorMessage.multipleMatchingAppMetadata.desc);
-    }
-    /**
-     * Throws error when no auth code or refresh token is given to ServerTokenRequestParameters.
-     */
-    static createTokenRequestCannotBeMadeError() {
-        return new ClientAuthError(ClientAuthErrorMessage.tokenRequestCannotBeMade.code, ClientAuthErrorMessage.tokenRequestCannotBeMade.desc);
-    }
-    /**
-     * Throws error when attempting to append a null, undefined or empty scope to a set
-     * @param givenScope
-     */
-    static createAppendEmptyScopeToSetError(givenScope) {
-        return new ClientAuthError(ClientAuthErrorMessage.appendEmptyScopeError.code, `${ClientAuthErrorMessage.appendEmptyScopeError.desc} Given Scope: ${givenScope}`);
-    }
-    /**
-     * Throws error when attempting to append a null, undefined or empty scope to a set
-     * @param givenScope
-     */
-    static createRemoveEmptyScopeFromSetError(givenScope) {
-        return new ClientAuthError(ClientAuthErrorMessage.removeEmptyScopeError.code, `${ClientAuthErrorMessage.removeEmptyScopeError.desc} Given Scope: ${givenScope}`);
-    }
-    /**
-     * Throws error when attempting to append null or empty ScopeSet.
-     * @param appendError
-     */
-    static createAppendScopeSetError(appendError) {
-        return new ClientAuthError(ClientAuthErrorMessage.appendScopeSetError.code, `${ClientAuthErrorMessage.appendScopeSetError.desc} Detail Error: ${appendError}`);
-    }
-    /**
-     * Throws error if ScopeSet is null or undefined.
-     * @param givenScopeSet
-     */
-    static createEmptyInputScopeSetError() {
-        return new ClientAuthError(ClientAuthErrorMessage.emptyInputScopeSetError.code, `${ClientAuthErrorMessage.emptyInputScopeSetError.desc}`);
-    }
-    /**
-     * Throws error if user sets CancellationToken.cancel = true during polling of token endpoint during device code flow
-     */
-    static createDeviceCodeCancelledError() {
-        return new ClientAuthError(ClientAuthErrorMessage.DeviceCodePollingCancelled.code, `${ClientAuthErrorMessage.DeviceCodePollingCancelled.desc}`);
-    }
-    /**
-     * Throws error if device code is expired
-     */
-    static createDeviceCodeExpiredError() {
-        return new ClientAuthError(ClientAuthErrorMessage.DeviceCodeExpired.code, `${ClientAuthErrorMessage.DeviceCodeExpired.desc}`);
-    }
-    /**
-     * Throws error if device code is expired
-     */
-    static createDeviceCodeUnknownError() {
-        return new ClientAuthError(ClientAuthErrorMessage.DeviceCodeUnknownError.code, `${ClientAuthErrorMessage.DeviceCodeUnknownError.desc}`);
-    }
-    /**
-     * Throws error when silent requests are made without an account object
-     */
-    static createNoAccountInSilentRequestError() {
-        return new ClientAuthError(ClientAuthErrorMessage.NoAccountInSilentRequest.code, `${ClientAuthErrorMessage.NoAccountInSilentRequest.desc}`);
-    }
-    /**
-     * Throws error when cache record is null or undefined.
-     */
-    static createNullOrUndefinedCacheRecord() {
-        return new ClientAuthError(ClientAuthErrorMessage.invalidCacheRecord.code, ClientAuthErrorMessage.invalidCacheRecord.desc);
-    }
-    /**
-     * Throws error when provided environment is not part of the CloudDiscoveryMetadata object
-     */
-    static createInvalidCacheEnvironmentError() {
-        return new ClientAuthError(ClientAuthErrorMessage.invalidCacheEnvironment.code, ClientAuthErrorMessage.invalidCacheEnvironment.desc);
-    }
-    /**
-     * Throws error when account is not found in cache.
-     */
-    static createNoAccountFoundError() {
-        return new ClientAuthError(ClientAuthErrorMessage.noAccountFound.code, ClientAuthErrorMessage.noAccountFound.desc);
-    }
-    /**
-     * Throws error if ICachePlugin not set on CacheManager.
-     */
-    static createCachePluginError() {
-        return new ClientAuthError(ClientAuthErrorMessage.CachePluginError.code, `${ClientAuthErrorMessage.CachePluginError.desc}`);
-    }
-    /**
-     * Throws error if crypto object not found.
-     * @param operationName
-     */
-    static createNoCryptoObjectError(operationName) {
-        return new ClientAuthError(ClientAuthErrorMessage.noCryptoObj.code, `${ClientAuthErrorMessage.noCryptoObj.desc}${operationName}`);
-    }
-    /**
-     * Throws error if cache type is invalid.
-     */
-    static createInvalidCacheTypeError() {
-        return new ClientAuthError(ClientAuthErrorMessage.invalidCacheType.code, `${ClientAuthErrorMessage.invalidCacheType.desc}`);
-    }
-    /**
-     * Throws error if unexpected account type.
-     */
-    static createUnexpectedAccountTypeError() {
-        return new ClientAuthError(ClientAuthErrorMessage.unexpectedAccountType.code, `${ClientAuthErrorMessage.unexpectedAccountType.desc}`);
-    }
-    /**
-     * Throws error if unexpected credential type.
-     */
-    static createUnexpectedCredentialTypeError() {
-        return new ClientAuthError(ClientAuthErrorMessage.unexpectedCredentialType.code, `${ClientAuthErrorMessage.unexpectedCredentialType.desc}`);
-    }
-    /**
-     * Throws error if client assertion is not valid.
-     */
-    static createInvalidAssertionError() {
-        return new ClientAuthError(ClientAuthErrorMessage.invalidAssertion.code, `${ClientAuthErrorMessage.invalidAssertion.desc}`);
-    }
-    /**
-     * Throws error if client assertion is not valid.
-     */
-    static createInvalidCredentialError() {
-        return new ClientAuthError(ClientAuthErrorMessage.invalidClientCredential.code, `${ClientAuthErrorMessage.invalidClientCredential.desc}`);
-    }
-    /**
-     * Throws error if token cannot be retrieved from cache due to refresh being required.
-     */
-    static createRefreshRequiredError() {
-        return new ClientAuthError(ClientAuthErrorMessage.tokenRefreshRequired.code, ClientAuthErrorMessage.tokenRefreshRequired.desc);
-    }
-    /**
-     * Throws error if the user defined timeout is reached.
-     */
-    static createUserTimeoutReachedError() {
-        return new ClientAuthError(ClientAuthErrorMessage.userTimeoutReached.code, ClientAuthErrorMessage.userTimeoutReached.desc);
-    }
-    /*
-     * Throws error if token claims are not populated for a signed jwt generation
-     */
-    static createTokenClaimsRequiredError() {
-        return new ClientAuthError(ClientAuthErrorMessage.tokenClaimsRequired.code, ClientAuthErrorMessage.tokenClaimsRequired.desc);
-    }
-    /**
-     * Throws error when the authorization code is missing from the server response
-     */
-    static createNoAuthCodeInServerResponseError() {
-        return new ClientAuthError(ClientAuthErrorMessage.noAuthorizationCodeFromServer.code, ClientAuthErrorMessage.noAuthorizationCodeFromServer.desc);
-    }
-    static createBindingKeyNotRemovedError() {
-        return new ClientAuthError(ClientAuthErrorMessage.bindingKeyNotRemovedError.code, ClientAuthErrorMessage.bindingKeyNotRemovedError.desc);
-    }
-    /**
-     * Thrown when logout is attempted for an authority that doesnt have an end_session_endpoint
-     */
-    static createLogoutNotSupportedError() {
-        return new ClientAuthError(ClientAuthErrorMessage.logoutNotSupported.code, ClientAuthErrorMessage.logoutNotSupported.desc);
-    }
-    /**
-     * Create an error when kid attribute is missing from a PoP token's cache record
-     */
-    static createKeyIdMissingError() {
-        return new ClientAuthError(ClientAuthErrorMessage.keyIdMissing.code, ClientAuthErrorMessage.keyIdMissing.desc);
-    }
-    /**
-     * Create an error when the client does not have network connectivity
-     */
-    static createNoNetworkConnectivityError() {
-        return new ClientAuthError(ClientAuthErrorMessage.noNetworkConnectivity.code, ClientAuthErrorMessage.noNetworkConnectivity.desc);
-    }
-    /**
-     * Create an error when the user cancels the flow
-     */
-    static createUserCanceledError() {
-        return new ClientAuthError(ClientAuthErrorMessage.userCanceledError.code, ClientAuthErrorMessage.userCanceledError.desc);
-    }
-    /**
-     * Creates an error for during acquireTokenByClientCredential when TenantId is set to "common" or "organizations"
-     */
-    static createMissingTenantIdError() {
-        return new AuthError(ClientAuthErrorMessage.missingTenantIdError.code, ClientAuthErrorMessage.missingTenantIdError.desc);
-    }
-}
+const redirectUriEmpty = "redirect_uri_empty";
+const claimsRequestParsingError = "claims_request_parsing_error";
+const authorityUriInsecure = "authority_uri_insecure";
+const urlParseError = "url_parse_error";
+const urlEmptyError = "empty_url_error";
+const emptyInputScopesError = "empty_input_scopes_error";
+const invalidPromptValue = "invalid_prompt_value";
+const invalidClaims = "invalid_claims";
+const tokenRequestEmpty = "token_request_empty";
+const logoutRequestEmpty = "logout_request_empty";
+const invalidCodeChallengeMethod = "invalid_code_challenge_method";
+const pkceParamsMissing = "pkce_params_missing";
+const invalidCloudDiscoveryMetadata = "invalid_cloud_discovery_metadata";
+const invalidAuthorityMetadata = "invalid_authority_metadata";
+const untrustedAuthority = "untrusted_authority";
+const missingSshJwk = "missing_ssh_jwk";
+const missingSshKid = "missing_ssh_kid";
+const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
+const invalidAuthenticationHeader = "invalid_authentication_header";
+const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
+const cannotAllowNativeBroker = "cannot_allow_native_broker";
+const authorityMismatch = "authority_mismatch";
+
+var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    authorityMismatch: authorityMismatch,
+    authorityUriInsecure: authorityUriInsecure,
+    cannotAllowNativeBroker: cannotAllowNativeBroker,
+    cannotSetOIDCOptions: cannotSetOIDCOptions,
+    claimsRequestParsingError: claimsRequestParsingError,
+    emptyInputScopesError: emptyInputScopesError,
+    invalidAuthenticationHeader: invalidAuthenticationHeader,
+    invalidAuthorityMetadata: invalidAuthorityMetadata,
+    invalidClaims: invalidClaims,
+    invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
+    invalidCodeChallengeMethod: invalidCodeChallengeMethod,
+    invalidPromptValue: invalidPromptValue,
+    logoutRequestEmpty: logoutRequestEmpty,
+    missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,
+    missingSshJwk: missingSshJwk,
+    missingSshKid: missingSshKid,
+    pkceParamsMissing: pkceParamsMissing,
+    redirectUriEmpty: redirectUriEmpty,
+    tokenRequestEmpty: tokenRequestEmpty,
+    untrustedAuthority: untrustedAuthority,
+    urlEmptyError: urlEmptyError,
+    urlParseError: urlParseError
+});
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+const ClientConfigurationErrorMessages = {
+    [redirectUriEmpty]: "A redirect URI is required for all calls, and none has been set.",
+    [claimsRequestParsingError]: "Could not parse the given claims request object.",
+    [authorityUriInsecure]: "Authority URIs must use https.  Please see here for valid authority configuration options: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-initializing-client-applications#configuration-options",
+    [urlParseError]: "URL could not be parsed into appropriate segments.",
+    [urlEmptyError]: "URL was empty or null.",
+    [emptyInputScopesError]: "Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",
+    [invalidPromptValue]: "Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
+    [invalidClaims]: "Given claims parameter must be a stringified JSON object.",
+    [tokenRequestEmpty]: "Token request was empty and not found in cache.",
+    [logoutRequestEmpty]: "The logout request was null or undefined.",
+    [invalidCodeChallengeMethod]: 'code_challenge_method passed is invalid. Valid values are "plain" and "S256".',
+    [pkceParamsMissing]: "Both params: code_challenge and code_challenge_method are to be passed if to be sent in the request",
+    [invalidCloudDiscoveryMetadata]: "Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields",
+    [invalidAuthorityMetadata]: "Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields.",
+    [untrustedAuthority]: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.",
+    [missingSshJwk]: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme.",
+    [missingSshKid]: "Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme.",
+    [missingNonceAuthenticationHeader]: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",
+    [invalidAuthenticationHeader]: "Invalid authentication header provided",
+    [cannotSetOIDCOptions]: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
+    [cannotAllowNativeBroker]: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
+    [authorityMismatch]: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+};
 /**
  * ClientConfigurationErrorMessage class containing string constants used by error codes and messages.
+ * @deprecated Use ClientConfigurationErrorCodes instead
  */
 const ClientConfigurationErrorMessage = {
     redirectUriNotSet: {
-        code: "redirect_uri_empty",
-        desc: "A redirect URI is required for all calls, and none has been set.",
-    },
-    postLogoutUriNotSet: {
-        code: "post_logout_uri_empty",
-        desc: "A post logout redirect has not been set.",
+        code: redirectUriEmpty,
+        desc: ClientConfigurationErrorMessages[redirectUriEmpty],
     },
     claimsRequestParsingError: {
-        code: "claims_request_parsing_error",
-        desc: "Could not parse the given claims request object.",
+        code: claimsRequestParsingError,
+        desc: ClientConfigurationErrorMessages[claimsRequestParsingError],
     },
     authorityUriInsecure: {
-        code: "authority_uri_insecure",
-        desc: "Authority URIs must use https.  Please see here for valid authority configuration options: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-initializing-client-applications#configuration-options",
+        code: authorityUriInsecure,
+        desc: ClientConfigurationErrorMessages[authorityUriInsecure],
     },
     urlParseError: {
-        code: "url_parse_error",
-        desc: "URL could not be parsed into appropriate segments.",
+        code: urlParseError,
+        desc: ClientConfigurationErrorMessages[urlParseError],
     },
     urlEmptyError: {
-        code: "empty_url_error",
-        desc: "URL was empty or null.",
+        code: urlEmptyError,
+        desc: ClientConfigurationErrorMessages[urlEmptyError],
     },
     emptyScopesError: {
-        code: "empty_input_scopes_error",
-        desc: "Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",
-    },
-    nonArrayScopesError: {
-        code: "nonarray_input_scopes_error",
-        desc: "Scopes cannot be passed as non-array.",
-    },
-    clientIdSingleScopeError: {
-        code: "clientid_input_scopes_error",
-        desc: "Client ID can only be provided as a single scope.",
+        code: emptyInputScopesError,
+        desc: ClientConfigurationErrorMessages[emptyInputScopesError],
     },
     invalidPrompt: {
-        code: "invalid_prompt_value",
-        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create', 'none' and 'no_session'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
+        code: invalidPromptValue,
+        desc: ClientConfigurationErrorMessages[invalidPromptValue],
     },
     invalidClaimsRequest: {
-        code: "invalid_claims",
-        desc: "Given claims parameter must be a stringified JSON object.",
+        code: invalidClaims,
+        desc: ClientConfigurationErrorMessages[invalidClaims],
     },
     tokenRequestEmptyError: {
-        code: "token_request_empty",
-        desc: "Token request was empty and not found in cache.",
+        code: tokenRequestEmpty,
+        desc: ClientConfigurationErrorMessages[tokenRequestEmpty],
     },
     logoutRequestEmptyError: {
-        code: "logout_request_empty",
-        desc: "The logout request was null or undefined.",
+        code: logoutRequestEmpty,
+        desc: ClientConfigurationErrorMessages[logoutRequestEmpty],
     },
     invalidCodeChallengeMethod: {
-        code: "invalid_code_challenge_method",
-        desc: 'code_challenge_method passed is invalid. Valid values are "plain" and "S256".',
+        code: invalidCodeChallengeMethod,
+        desc: ClientConfigurationErrorMessages[invalidCodeChallengeMethod],
     },
     invalidCodeChallengeParams: {
-        code: "pkce_params_missing",
-        desc: "Both params: code_challenge and code_challenge_method are to be passed if to be sent in the request",
+        code: pkceParamsMissing,
+        desc: ClientConfigurationErrorMessages[pkceParamsMissing],
     },
     invalidCloudDiscoveryMetadata: {
-        code: "invalid_cloud_discovery_metadata",
-        desc: "Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields",
+        code: invalidCloudDiscoveryMetadata,
+        desc: ClientConfigurationErrorMessages[invalidCloudDiscoveryMetadata],
     },
     invalidAuthorityMetadata: {
-        code: "invalid_authority_metadata",
-        desc: "Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields.",
+        code: invalidAuthorityMetadata,
+        desc: ClientConfigurationErrorMessages[invalidAuthorityMetadata],
     },
     untrustedAuthority: {
-        code: "untrusted_authority",
-        desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.",
-    },
-    invalidAzureCloudInstance: {
-        code: "invalid_azure_cloud_instance",
-        desc: "Invalid AzureCloudInstance provided. Please refer MSAL JS docs: aks.ms/msaljs/azure_cloud_instance for valid values",
+        code: untrustedAuthority,
+        desc: ClientConfigurationErrorMessages[untrustedAuthority],
     },
     missingSshJwk: {
-        code: "missing_ssh_jwk",
-        desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme.",
+        code: missingSshJwk,
+        desc: ClientConfigurationErrorMessages[missingSshJwk],
     },
     missingSshKid: {
-        code: "missing_ssh_kid",
-        desc: "Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme.",
+        code: missingSshKid,
+        desc: ClientConfigurationErrorMessages[missingSshKid],
     },
     missingNonceAuthenticationHeader: {
-        code: "missing_nonce_authentication_header",
-        desc: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",
+        code: missingNonceAuthenticationHeader,
+        desc: ClientConfigurationErrorMessages[missingNonceAuthenticationHeader],
     },
     invalidAuthenticationHeader: {
-        code: "invalid_authentication_header",
-        desc: "Invalid authentication header provided",
+        code: invalidAuthenticationHeader,
+        desc: ClientConfigurationErrorMessages[invalidAuthenticationHeader],
     },
     cannotSetOIDCOptions: {
-        code: "cannot_set_OIDCOptions",
-        desc: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
+        code: cannotSetOIDCOptions,
+        desc: ClientConfigurationErrorMessages[cannotSetOIDCOptions],
     },
     cannotAllowNativeBroker: {
-        code: "cannot_allow_native_broker",
-        desc: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
+        code: cannotAllowNativeBroker,
+        desc: ClientConfigurationErrorMessages[cannotAllowNativeBroker],
     },
     authorityMismatch: {
-        code: "authority_mismatch",
-        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+        code: authorityMismatch,
+        desc: ClientConfigurationErrorMessages[authorityMismatch],
     },
 };
 /**
  * Error thrown when there is an error in configuration of the MSAL.js library.
  */
-class ClientConfigurationError extends ClientAuthError {
-    constructor(errorCode, errorMessage) {
-        super(errorCode, errorMessage);
+class ClientConfigurationError extends AuthError {
+    constructor(errorCode) {
+        super(errorCode, ClientConfigurationErrorMessages[errorCode]);
         this.name = "ClientConfigurationError";
         Object.setPrototypeOf(this, ClientConfigurationError.prototype);
     }
-    /**
-     * Creates an error thrown when the redirect uri is empty (not set by caller)
-     */
-    static createRedirectUriEmptyError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.redirectUriNotSet.code, ClientConfigurationErrorMessage.redirectUriNotSet.desc);
-    }
-    /**
-     * Creates an error thrown when the post-logout redirect uri is empty (not set by caller)
-     */
-    static createPostLogoutRedirectUriEmptyError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.postLogoutUriNotSet.code, ClientConfigurationErrorMessage.postLogoutUriNotSet.desc);
-    }
-    /**
-     * Creates an error thrown when the claims request could not be successfully parsed
-     */
-    static createClaimsRequestParsingError(claimsRequestParseError) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.claimsRequestParsingError.code, `${ClientConfigurationErrorMessage.claimsRequestParsingError.desc} Given value: ${claimsRequestParseError}`);
-    }
-    /**
-     * Creates an error thrown if authority uri is given an insecure protocol.
-     * @param urlString
-     */
-    static createInsecureAuthorityUriError(urlString) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.authorityUriInsecure.code, `${ClientConfigurationErrorMessage.authorityUriInsecure.desc} Given URI: ${urlString}`);
-    }
-    /**
-     * Creates an error thrown if URL string does not parse into separate segments.
-     * @param urlString
-     */
-    static createUrlParseError(urlParseError) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.urlParseError.code, `${ClientConfigurationErrorMessage.urlParseError.desc} Given Error: ${urlParseError}`);
-    }
-    /**
-     * Creates an error thrown if URL string is empty or null.
-     * @param urlString
-     */
-    static createUrlEmptyError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.urlEmptyError.code, ClientConfigurationErrorMessage.urlEmptyError.desc);
-    }
-    /**
-     * Error thrown when scopes are empty.
-     * @param scopesValue
-     */
-    static createEmptyScopesArrayError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.emptyScopesError.code, `${ClientConfigurationErrorMessage.emptyScopesError.desc}`);
-    }
-    /**
-     * Error thrown when client id scope is not provided as single scope.
-     * @param inputScopes
-     */
-    static createClientIdSingleScopeError(inputScopes) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.clientIdSingleScopeError.code, `${ClientConfigurationErrorMessage.clientIdSingleScopeError.desc} Given Scopes: ${inputScopes}`);
-    }
-    /**
-     * Error thrown when prompt is not an allowed type.
-     * @param promptValue
-     */
-    static createInvalidPromptError(promptValue) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidPrompt.code, `${ClientConfigurationErrorMessage.invalidPrompt.desc} Given value: ${promptValue}`);
-    }
-    /**
-     * Creates error thrown when claims parameter is not a stringified JSON object
-     */
-    static createInvalidClaimsRequestError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidClaimsRequest.code, ClientConfigurationErrorMessage.invalidClaimsRequest.desc);
-    }
-    /**
-     * Throws error when token request is empty and nothing cached in storage.
-     */
-    static createEmptyLogoutRequestError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.logoutRequestEmptyError.code, ClientConfigurationErrorMessage.logoutRequestEmptyError.desc);
-    }
-    /**
-     * Throws error when token request is empty and nothing cached in storage.
-     */
-    static createEmptyTokenRequestError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.tokenRequestEmptyError.code, ClientConfigurationErrorMessage.tokenRequestEmptyError.desc);
-    }
-    /**
-     * Throws error when an invalid code_challenge_method is passed by the user
-     */
-    static createInvalidCodeChallengeMethodError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidCodeChallengeMethod.code, ClientConfigurationErrorMessage.invalidCodeChallengeMethod.desc);
-    }
-    /**
-     * Throws error when both params: code_challenge and code_challenge_method are not passed together
-     */
-    static createInvalidCodeChallengeParamsError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidCodeChallengeParams.code, ClientConfigurationErrorMessage.invalidCodeChallengeParams.desc);
-    }
-    /**
-     * Throws an error when the user passes invalid cloudDiscoveryMetadata
-     */
-    static createInvalidCloudDiscoveryMetadataError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidCloudDiscoveryMetadata.code, ClientConfigurationErrorMessage.invalidCloudDiscoveryMetadata.desc);
-    }
-    /**
-     * Throws an error when the user passes invalid cloudDiscoveryMetadata
-     */
-    static createInvalidAuthorityMetadataError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthorityMetadata.code, ClientConfigurationErrorMessage.invalidAuthorityMetadata.desc);
-    }
-    /**
-     * Throws error when provided authority is not a member of the trusted host list
-     */
-    static createUntrustedAuthorityError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.untrustedAuthority.code, ClientConfigurationErrorMessage.untrustedAuthority.desc);
-    }
-    /**
-     * Throws error when the AzureCloudInstance is set to an invalid value
-     */
-    static createInvalidAzureCloudInstanceError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAzureCloudInstance.code, ClientConfigurationErrorMessage.invalidAzureCloudInstance.desc);
-    }
-    /**
-     * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
-     */
-    static createMissingSshJwkError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshJwk.code, ClientConfigurationErrorMessage.missingSshJwk.desc);
-    }
-    /**
-     * Throws an error when the authentication scheme is set to SSH but the SSH public key ID is omitted from the request
-     */
-    static createMissingSshKidError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshKid.code, ClientConfigurationErrorMessage.missingSshKid.desc);
-    }
-    /**
-     * Throws error when provided headers don't contain a header that a server nonce can be extracted from
-     */
-    static createMissingNonceAuthenticationHeadersError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.code, ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.desc);
-    }
-    /**
-     * Throws error when a provided header is invalid in any way
-     */
-    static createInvalidAuthenticationHeaderError(invalidHeaderName, details) {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, `${ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc}. Invalid header: ${invalidHeaderName}. Details: ${details}`);
-    }
-    /**
-     * Throws error when provided non-default OIDCOptions when not in OIDC protocol mode
-     */
-    static createCannotSetOIDCOptionsError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotSetOIDCOptions.code, ClientConfigurationErrorMessage.cannotSetOIDCOptions.desc);
-    }
-    /**
-     * Throws error when allowNativeBroker is set to true when not in AAD protocol mode
-     */
-    static createCannotAllowNativeBrokerError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.cannotAllowNativeBroker.code, ClientConfigurationErrorMessage.cannotAllowNativeBroker.desc);
-    }
-    /**
-     * Create an error when the authority provided in request does not match authority provided in account or MSAL.js configuration.
-     */
-    static createAuthorityMismatchError() {
-        return new ClientConfigurationError(ClientConfigurationErrorMessage.authorityMismatch.code, ClientConfigurationErrorMessage.authorityMismatch.desc);
-    }
+}
+function createClientConfigurationError(errorCode) {
+    return new ClientConfigurationError(errorCode);
 }
 
 /*
@@ -1631,7 +1367,7 @@ class ScopeSet {
     validateInputScopes(inputScopes) {
         // Check if scopes are required but not given or is an empty array
         if (!inputScopes || inputScopes.length < 1) {
-            throw ClientConfigurationError.createEmptyScopesArrayError();
+            throw createClientConfigurationError(emptyInputScopesError);
         }
     }
     /**
@@ -1687,7 +1423,7 @@ class ScopeSet {
             newScopes.forEach((newScope) => this.appendScope(newScope));
         }
         catch (e) {
-            throw ClientAuthError.createAppendScopeSetError(e);
+            throw createClientAuthError(cannotAppendScopeSet);
         }
     }
     /**
@@ -1696,7 +1432,7 @@ class ScopeSet {
      */
     removeScope(scope) {
         if (!scope) {
-            throw ClientAuthError.createRemoveEmptyScopeFromSetError(scope);
+            throw createClientAuthError(cannotRemoveEmptyScope);
         }
         this.scopes.delete(scope.trim());
     }
@@ -1715,7 +1451,7 @@ class ScopeSet {
      */
     unionScopeSets(otherScopes) {
         if (!otherScopes) {
-            throw ClientAuthError.createEmptyInputScopeSetError();
+            throw createClientAuthError(emptyInputScopeSet);
         }
         const unionScopes = new Set(); // Iterator in constructor not supported in IE11
         otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
@@ -1728,7 +1464,7 @@ class ScopeSet {
      */
     intersectingScopeSets(otherScopes) {
         if (!otherScopes) {
-            throw ClientAuthError.createEmptyInputScopeSetError();
+            throw createClientAuthError(emptyInputScopeSet);
         }
         // Do not allow OIDC scopes to be the only intersecting scopes
         if (!otherScopes.containsOnlyOIDCScopes()) {
@@ -1783,14 +1519,14 @@ class ScopeSet {
  */
 function buildClientInfo(rawClientInfo, crypto) {
     if (!rawClientInfo) {
-        throw ClientAuthError.createClientInfoEmptyError();
+        throw createClientAuthError(clientInfoEmptyError);
     }
     try {
         const decodedClientInfo = crypto.base64Decode(rawClientInfo);
         return JSON.parse(decodedClientInfo);
     }
     catch (e) {
-        throw ClientAuthError.createClientInfoDecodingError(e.message);
+        throw createClientAuthError(clientInfoDecodingError);
     }
 }
 /**
@@ -1799,7 +1535,7 @@ function buildClientInfo(rawClientInfo, crypto) {
  */
 function buildClientInfoFromHomeAccountId(homeAccountId) {
     if (!homeAccountId) {
-        throw ClientAuthError.createClientInfoDecodingError("Home account ID was empty.");
+        throw createClientAuthError(clientInfoDecodingError);
     }
     const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
     return {
@@ -1932,7 +1668,7 @@ class AccountEntity {
         const env = accountDetails.environment ||
             (authority && authority.getPreferredCache());
         if (!env) {
-            throw ClientAuthError.createInvalidCacheEnvironmentError();
+            throw createClientAuthError(invalidCacheEnvironment);
         }
         account.environment = env;
         // non AAD scenarios can have empty realm
@@ -2075,7 +1811,7 @@ function extractTokenClaims(encodedToken, base64Decode) {
         return JSON.parse(base64Decoded);
     }
     catch (err) {
-        throw ClientAuthError.createTokenParsingError(err);
+        throw createClientAuthError(tokenParsingError);
     }
 }
 /**
@@ -2085,12 +1821,12 @@ function extractTokenClaims(encodedToken, base64Decode) {
  */
 function getJWSPayload(authToken) {
     if (!authToken) {
-        throw ClientAuthError.createTokenNullOrEmptyError(authToken);
+        throw createClientAuthError(nullOrEmptyToken);
     }
     const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
     const matches = tokenPartsRegex.exec(authToken);
     if (!matches || matches.length < 4) {
-        throw ClientAuthError.createTokenParsingError(`Given token is malformed: ${JSON.stringify(authToken)}`);
+        throw createClientAuthError(tokenParsingError);
     }
     /**
      * const crackedToken = {
@@ -2112,7 +1848,7 @@ function checkMaxAge(authTime, maxAge) {
      */
     const fiveMinuteSkew = 300000; // five minutes in milliseconds
     if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
-        throw ClientAuthError.createMaxAgeTranspiredError();
+        throw createClientAuthError(maxAgeTranspired);
     }
 }
 
@@ -2138,9 +1874,16 @@ class CacheManager {
         this.commonLogger = logger.clone(name, version);
     }
     /**
-     * Returns all accounts in cache
+     * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
+     * @param accountFilter - (Optional) filter to narrow down the accounts returned
+     * @returns Array of AccountInfo objects in cache
      */
-    getAllAccounts() {
+    getAllAccounts(accountFilter) {
+        if (accountFilter) {
+            return this.getAccountsFilteredBy(accountFilter).map((accountEntity) => {
+                return accountEntity.getAccountInfo();
+            });
+        }
         const allAccountKeys = this.getAccountKeys();
         if (allAccountKeys.length < 1) {
             return [];
@@ -2153,15 +1896,10 @@ class CacheManager {
             accounts.push(entity);
             return accounts;
         }, []);
-        if (accountEntities.length < 1) {
-            return [];
-        }
-        else {
-            const allAccounts = accountEntities.map((accountEntity) => {
-                return this.getAccountInfoFromEntity(accountEntity);
-            });
-            return allAccounts;
-        }
+        const allAccounts = accountEntities.map((accountEntity) => {
+            return this.getAccountInfoFromEntity(accountEntity);
+        });
+        return allAccounts;
     }
     /**
      * Gets accountInfo object based on provided filters
@@ -2190,7 +1928,7 @@ class CacheManager {
      */
     async saveCacheRecord(cacheRecord, storeInCache) {
         if (!cacheRecord) {
-            throw ClientAuthError.createNullOrUndefinedCacheRecord();
+            throw createClientAuthError(invalidCacheRecord);
         }
         if (!!cacheRecord.account) {
             this.setAccount(cacheRecord.account);
@@ -2243,17 +1981,15 @@ class CacheManager {
         this.setAccessTokenCredential(credential);
     }
     /**
-     * retrieve accounts matching all provided filters; if no filter is set, get all accounts
-     * not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
-     * @param homeAccountId
-     * @param environment
-     * @param realm
+     * Retrieve accounts matching all provided filters; if no filter is set, get all accounts
+     * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
+     * @param accountFilter - An object containing Account properties to filter by
      */
     getAccountsFilteredBy(accountFilter) {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
-            if (!this.isAccountKey(cacheKey, accountFilter.homeAccountId, accountFilter.realm)) {
+            if (!this.isAccountKey(cacheKey, accountFilter.homeAccountId, accountFilter.tenantId)) {
                 // Don't parse value if the key doesn't match the account filters
                 return;
             }
@@ -2281,10 +2017,27 @@ class CacheManager {
                 !this.matchRealm(entity, accountFilter.realm)) {
                 return;
             }
+            // tenantId is another name for realm
+            if (!!accountFilter.tenantId &&
+                !this.matchRealm(entity, accountFilter.tenantId)) {
+                return;
+            }
             if (!!accountFilter.nativeAccountId &&
                 !this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
                 return;
             }
+            if (!!accountFilter.loginHint &&
+                !this.matchLoginHint(entity, accountFilter.loginHint)) {
+                return;
+            }
+            if (!!accountFilter.authorityType &&
+                !this.matchAuthorityType(entity, accountFilter.authorityType)) {
+                return;
+            }
+            if (!!accountFilter.name &&
+                !this.matchName(entity, accountFilter.name)) {
+                return;
+            }
             matchingAccounts.push(entity);
         });
         return matchingAccounts;
@@ -2541,7 +2294,7 @@ class CacheManager {
                         await this.cryptoImpl.removeTokenBindingKey(kid);
                     }
                     catch (error) {
-                        throw ClientAuthError.createBindingKeyNotRemovedError();
+                        throw createClientAuthError(bindingKeyNotRemoved);
                     }
                 }
             }
@@ -2877,7 +2630,7 @@ class CacheManager {
             return null;
         }
         else if (numAppMetadata > 1) {
-            throw ClientAuthError.createMultipleMatchingAppMetadataInCacheError();
+            throw createClientAuthError(multipleMatchingAppMetadata);
         }
         return appMetadataEntries[0];
     }
@@ -2919,6 +2672,15 @@ class CacheManager {
         return !!(typeof entity.username === "string" &&
             username.toLowerCase() === entity.username.toLowerCase());
     }
+    /**
+     * helper to match names
+     * @param entity
+     * @param name
+     * @returns true if the downcased name properties are present and match in the filter and the entity
+     */
+    matchName(entity, name) {
+        return !!(name.toLowerCase() === entity.name?.toLowerCase());
+    }
     /**
      * helper to match assertion
      * @param value
@@ -2983,6 +2745,31 @@ class CacheManager {
     matchNativeAccountId(entity, nativeAccountId) {
         return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
     }
+    /**
+     * helper to match loginHint which can be either:
+     * 1. login_hint ID token claim
+     * 2. username in cached account object
+     * 3. upn in ID token claims
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    matchLoginHint(entity, loginHint) {
+        if (entity.idTokenClaims?.login_hint === loginHint) {
+            return true;
+        }
+        if (entity.username === loginHint) {
+            return true;
+        }
+        if (entity.idTokenClaims?.upn === loginHint) {
+            return true;
+        }
+        return false;
+    }
+    matchAuthorityType(entity, authorityType) {
+        return !!(entity.authorityType &&
+            authorityType.toLowerCase() === entity.authorityType.toLowerCase());
+    }
     /**
      * Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.
      * @param entity
@@ -3049,100 +2836,76 @@ class CacheManager {
 /** @internal */
 class DefaultStorageClass extends CacheManager {
     setAccount() {
-        const notImplErr = "Storage interface - setAccount() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getAccount() {
-        const notImplErr = "Storage interface - getAccount() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     setIdTokenCredential() {
-        const notImplErr = "Storage interface - setIdTokenCredential() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getIdTokenCredential() {
-        const notImplErr = "Storage interface - getIdTokenCredential() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     setAccessTokenCredential() {
-        const notImplErr = "Storage interface - setAccessTokenCredential() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getAccessTokenCredential() {
-        const notImplErr = "Storage interface - getAccessTokenCredential() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     setRefreshTokenCredential() {
-        const notImplErr = "Storage interface - setRefreshTokenCredential() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getRefreshTokenCredential() {
-        const notImplErr = "Storage interface - getRefreshTokenCredential() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     setAppMetadata() {
-        const notImplErr = "Storage interface - setAppMetadata() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getAppMetadata() {
-        const notImplErr = "Storage interface - getAppMetadata() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     setServerTelemetry() {
-        const notImplErr = "Storage interface - setServerTelemetry() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getServerTelemetry() {
-        const notImplErr = "Storage interface - getServerTelemetry() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     setAuthorityMetadata() {
-        const notImplErr = "Storage interface - setAuthorityMetadata() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getAuthorityMetadata() {
-        const notImplErr = "Storage interface - getAuthorityMetadata() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getAuthorityMetadataKeys() {
-        const notImplErr = "Storage interface - getAuthorityMetadataKeys() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     setThrottlingCache() {
-        const notImplErr = "Storage interface - setThrottlingCache() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getThrottlingCache() {
-        const notImplErr = "Storage interface - getThrottlingCache() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     removeItem() {
-        const notImplErr = "Storage interface - removeItem() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     containsKey() {
-        const notImplErr = "Storage interface - containsKey() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getKeys() {
-        const notImplErr = "Storage interface - getKeys() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getAccountKeys() {
-        const notImplErr = "Storage interface - getAccountKeys() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     getTokenKeys() {
-        const notImplErr = "Storage interface - getTokenKeys() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     async clear() {
-        const notImplErr = "Storage interface - clear() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
     updateCredentialCacheKey() {
-        const notImplErr = "Storage interface - updateCredentialCacheKey() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     }
 }
 
@@ -3169,12 +2932,10 @@ const DEFAULT_CACHE_OPTIONS = {
 };
 const DEFAULT_NETWORK_IMPLEMENTATION = {
     async sendGetRequestAsync() {
-        const notImplErr = "Network interface - sendGetRequestAsync() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
     async sendPostRequestAsync() {
-        const notImplErr = "Network interface - sendPostRequestAsync() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
+        throw createClientAuthError(methodNotImplemented);
     },
 };
 const DEFAULT_LIBRARY_INFO = {
@@ -3384,7 +3145,7 @@ class NetworkManager {
                 throw e;
             }
             else {
-                throw ClientAuthError.createNetworkError(tokenEndpoint, e);
+                throw createClientAuthError(networkError);
             }
         }
         ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
@@ -3415,7 +3176,7 @@ class RequestValidator {
      */
     static validateRedirectUri(redirectUri) {
         if (!redirectUri) {
-            throw ClientConfigurationError.createRedirectUriEmptyError();
+            throw createClientConfigurationError(redirectUriEmpty);
         }
     }
     /**
@@ -3428,7 +3189,7 @@ class RequestValidator {
             promptValues.push(PromptValue[value]);
         }
         if (promptValues.indexOf(prompt) < 0) {
-            throw ClientConfigurationError.createInvalidPromptError(prompt);
+            throw createClientConfigurationError(invalidPromptValue);
         }
     }
     static validateClaims(claims) {
@@ -3436,7 +3197,7 @@ class RequestValidator {
             JSON.parse(claims);
         }
         catch (e) {
-            throw ClientConfigurationError.createInvalidClaimsRequestError();
+            throw createClientConfigurationError(invalidClaims);
         }
     }
     /**
@@ -3446,7 +3207,7 @@ class RequestValidator {
      */
     static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
         if (!codeChallenge || !codeChallengeMethod) {
-            throw ClientConfigurationError.createInvalidCodeChallengeParamsError();
+            throw createClientConfigurationError(pkceParamsMissing);
         }
         else {
             this.validateCodeChallengeMethod(codeChallengeMethod);
@@ -3461,7 +3222,7 @@ class RequestValidator {
             CodeChallengeMethodValues.PLAIN,
             CodeChallengeMethodValues.S256,
         ].indexOf(codeChallengeMethod) < 0) {
-            throw ClientConfigurationError.createInvalidCodeChallengeMethodError();
+            throw createClientConfigurationError(invalidCodeChallengeMethod);
         }
     }
     /**
@@ -3680,7 +3441,7 @@ class RequestParameterBuilder {
             this.parameters.set(AADServerParamKeys.CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
         }
         else {
-            throw ClientConfigurationError.createInvalidCodeChallengeParamsError();
+            throw createClientConfigurationError(pkceParamsMissing);
         }
     }
     /**
@@ -3785,7 +3546,7 @@ class RequestParameterBuilder {
                 mergedClaims = JSON.parse(claims);
             }
             catch (e) {
-                throw ClientConfigurationError.createInvalidClaimsRequestError();
+                throw createClientConfigurationError(invalidClaims);
             }
         }
         if (clientCapabilities && clientCapabilities.length > 0) {
@@ -4076,6 +3837,14 @@ const PerformanceEvents = {
      * Cache operations
      */
     ClearTokensAndKeysWithClaims: "clearTokensAndKeysWithClaims",
+    /**
+     * Crypto Operations
+     */
+    GeneratePkceCodes: "generatePkceCodes",
+    GenerateCodeVerifier: "generateCodeVerifier",
+    GenerateCodeChallengeFromVerifier: "generateCodeChallengeFromVerifier",
+    Sha256Digest: "sha256Digest",
+    GetRandomValues: "getRandomValues",
 };
 /**
  * State of the performance event.
@@ -4162,7 +3931,7 @@ class BaseClient {
      * @param thumbprint
      */
     async executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.BaseClientCreateTokenRequestHeaders, correlationId);
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.BaseClientExecutePostToTokenEndpoint, correlationId);
         const response = await this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers });
         this.performanceClient?.addFields({
             refreshTokenSize: response.body.refresh_token?.length || 0,
@@ -4182,7 +3951,7 @@ class BaseClient {
      */
     updateAuthority(updatedAuthority) {
         if (!updatedAuthority.discoveryComplete()) {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Updated authority has not completed endpoint discovery.");
+            throw createClientAuthError(endpointResolutionError);
         }
         this.authority = updatedAuthority;
     }
@@ -4263,7 +4032,7 @@ class CredentialEntity {
             case CredentialType.REFRESH_TOKEN:
                 return CacheType.REFRESH_TOKEN;
             default: {
-                throw ClientAuthError.createUnexpectedCredentialTypeError();
+                throw createClientAuthError(unexpectedCredentialType);
             }
         }
     }
@@ -4518,7 +4287,7 @@ class AccessTokenEntity extends CredentialEntity {
                     // Make sure keyId is present and add it to credential
                     const tokenClaims = extractTokenClaims(accessToken, cryptoUtils.base64Decode);
                     if (!tokenClaims?.cnf?.kid) {
-                        throw ClientAuthError.createTokenClaimsRequiredError();
+                        throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
                     }
                     atEntity.keyId = tokenClaims.cnf.kid;
                     break;
@@ -4609,6 +4378,27 @@ class RefreshTokenEntity extends CredentialEntity {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+// Codes defined by MSAL
+const noTokensFound = "no_tokens_found";
+const nativeAccountUnavailable = "native_account_unavailable";
+// Codes potentially returned by server
+const interactionRequired = "interaction_required";
+const consentRequired = "consent_required";
+const loginRequired = "login_required";
+
+var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    consentRequired: consentRequired,
+    interactionRequired: interactionRequired,
+    loginRequired: loginRequired,
+    nativeAccountUnavailable: nativeAccountUnavailable,
+    noTokensFound: noTokensFound
+});
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4617,9 +4407,9 @@ class RefreshTokenEntity extends CredentialEntity {
  * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
  */
 const InteractionRequiredServerErrorMessage = [
-    "interaction_required",
-    "consent_required",
-    "login_required",
+    interactionRequired,
+    consentRequired,
+    loginRequired,
 ];
 const InteractionRequiredAuthSubErrorMessage = [
     "message_only",
@@ -4628,17 +4418,22 @@ const InteractionRequiredAuthSubErrorMessage = [
     "user_password_expired",
     "consent_required",
 ];
+const InteractionRequiredAuthErrorMessages = {
+    [noTokensFound]: "No refresh token found in the cache. Please sign-in.",
+    [nativeAccountUnavailable]: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
+};
 /**
  * Interaction required errors defined by the SDK
+ * @deprecated Use InteractionRequiredAuthErrorCodes instead
  */
 const InteractionRequiredAuthErrorMessage = {
     noTokensFoundError: {
-        code: "no_tokens_found",
-        desc: "No refresh token found in the cache. Please sign-in.",
+        code: noTokensFound,
+        desc: InteractionRequiredAuthErrorMessages[noTokensFound],
     },
     native_account_unavailable: {
-        code: "native_account_unavailable",
-        desc: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
+        code: nativeAccountUnavailable,
+        desc: InteractionRequiredAuthErrorMessages[nativeAccountUnavailable],
     },
 };
 /**
@@ -4654,38 +4449,31 @@ class InteractionRequiredAuthError extends AuthError {
         this.claims = claims || Constants.EMPTY_STRING;
         this.name = "InteractionRequiredAuthError";
     }
-    /**
-     * Helper function used to determine if an error thrown by the server requires interaction to resolve
-     * @param errorCode
-     * @param errorString
-     * @param subError
-     */
-    static isInteractionRequiredError(errorCode, errorString, subError) {
-        const isInteractionRequiredErrorCode = !!errorCode &&
-            InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
-        const isInteractionRequiredSubError = !!subError &&
-            InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
-        const isInteractionRequiredErrorDesc = !!errorString &&
-            InteractionRequiredServerErrorMessage.some((irErrorCode) => {
-                return errorString.indexOf(irErrorCode) > -1;
-            });
-        return (isInteractionRequiredErrorCode ||
-            isInteractionRequiredErrorDesc ||
-            isInteractionRequiredSubError);
-    }
-    /**
-     * Creates an error thrown when the authorization code required for a token request is null or empty.
-     */
-    static createNoTokensFoundError() {
-        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.noTokensFoundError.code, InteractionRequiredAuthErrorMessage.noTokensFoundError.desc);
-    }
-    /**
-     * Creates an error thrown when the native broker returns ACCOUNT_UNAVAILABLE status, indicating that the account was removed and interactive sign-in is required
-     * @returns
-     */
-    static createNativeAccountUnavailableError() {
-        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.native_account_unavailable.code, InteractionRequiredAuthErrorMessage.native_account_unavailable.desc);
-    }
+}
+/**
+ * Helper function used to determine if an error thrown by the server requires interaction to resolve
+ * @param errorCode
+ * @param errorString
+ * @param subError
+ */
+function isInteractionRequiredError(errorCode, errorString, subError) {
+    const isInteractionRequiredErrorCode = !!errorCode &&
+        InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
+    const isInteractionRequiredSubError = !!subError &&
+        InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
+    const isInteractionRequiredErrorDesc = !!errorString &&
+        InteractionRequiredServerErrorMessage.some((irErrorCode) => {
+            return errorString.indexOf(irErrorCode) > -1;
+        });
+    return (isInteractionRequiredErrorCode ||
+        isInteractionRequiredErrorDesc ||
+        isInteractionRequiredSubError);
+}
+/**
+ * Creates an InteractionRequiredAuthError
+ */
+function createInteractionRequiredAuthError(errorCode) {
+    return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
 /*
@@ -4729,7 +4517,7 @@ class ProtocolUtils {
      */
     static generateLibraryState(cryptoObj, meta) {
         if (!cryptoObj) {
-            throw ClientAuthError.createNoCryptoObjectError("generateLibraryState");
+            throw createClientAuthError(noCryptoObject);
         }
         // Create a state object containing a unique id and the timestamp of the request creation
         const stateObj = {
@@ -4748,10 +4536,10 @@ class ProtocolUtils {
      */
     static parseRequestState(cryptoObj, state) {
         if (!cryptoObj) {
-            throw ClientAuthError.createNoCryptoObjectError("parseRequestState");
+            throw createClientAuthError(noCryptoObject);
         }
         if (!state) {
-            throw ClientAuthError.createInvalidStateError(state, "Null, undefined or empty state");
+            throw createClientAuthError(invalidState);
         }
         try {
             // Split the state between library state and user passed state and decode them separately
@@ -4768,7 +4556,7 @@ class ProtocolUtils {
             };
         }
         catch (e) {
-            throw ClientAuthError.createInvalidStateError(state, e);
+            throw createClientAuthError(invalidState);
         }
     }
 }
@@ -4788,7 +4576,7 @@ class UrlString {
         this._urlString = url;
         if (!this._urlString) {
             // Throws error if url is empty
-            throw ClientConfigurationError.createUrlEmptyError();
+            throw createClientConfigurationError(urlEmptyError);
         }
         if (!this.getHash()) {
             this._urlString = UrlString.canonicalizeUri(url);
@@ -4824,16 +4612,16 @@ class UrlString {
             components = this.getUrlComponents();
         }
         catch (e) {
-            throw ClientConfigurationError.createUrlParseError(e);
+            throw createClientConfigurationError(urlParseError);
         }
         // Throw error if URI or path segments are not parseable.
         if (!components.HostNameAndPort || !components.PathSegments) {
-            throw ClientConfigurationError.createUrlParseError(`Given url string: ${this.urlString}`);
+            throw createClientConfigurationError(urlParseError);
         }
         // Throw error if uri is insecure.
         if (!components.Protocol ||
             components.Protocol.toLowerCase() !== "https:") {
-            throw ClientConfigurationError.createInsecureAuthorityUriError(this.urlString);
+            throw createClientConfigurationError(authorityUriInsecure);
         }
     }
     /**
@@ -4888,7 +4676,7 @@ class UrlString {
         // If url string does not match regEx, we throw an error
         const match = this.urlString.match(regEx);
         if (!match) {
-            throw ClientConfigurationError.createUrlParseError(`Given url string: ${this.urlString}`);
+            throw createClientConfigurationError(urlParseError);
         }
         // Url component object
         const urlComponents = {
@@ -4910,7 +4698,7 @@ class UrlString {
         const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
         const match = url.match(regEx);
         if (!match) {
-            throw ClientConfigurationError.createUrlParseError(`Given url string: ${url}`);
+            throw createClientConfigurationError(urlParseError);
         }
         return match[2];
     }
@@ -5000,7 +4788,7 @@ class UrlString {
         const deserializedHash = StringUtils.queryStringToObject(parsedHash || hash);
         // Check if deserialization didn't work
         if (!deserializedHash) {
-            throw ClientAuthError.createHashNotDeserializedError(JSON.stringify(deserializedHash));
+            throw createClientAuthError(hashNotDeserialized);
         }
         return deserializedHash;
     }
@@ -5018,7 +4806,7 @@ class UrlString {
         const deserializedQueryString = StringUtils.queryStringToObject(parsedQueryString || query);
         // Check if deserialization didn't work
         if (!deserializedQueryString) {
-            throw ClientAuthError.createHashNotDeserializedError(JSON.stringify(deserializedQueryString));
+            throw createClientAuthError(hashNotDeserialized);
         }
         return deserializedQueryString;
     }
@@ -5053,6 +4841,91 @@ class UrlString {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Wraps a function with a performance measurement.
+ * Usage: invoke(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
+ * @param callback
+ * @param eventName
+ * @param logger
+ * @param telemetryClient
+ * @param correlationId
+ * @returns
+ * @internal
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const invoke = (callback, eventName, logger, telemetryClient, correlationId) => {
+    return (...args) => {
+        logger.trace(`Executing function ${eventName}`);
+        const inProgressEvent = telemetryClient?.startMeasurement(eventName, correlationId);
+        try {
+            const result = callback(...args);
+            inProgressEvent?.end({
+                success: true,
+            });
+            logger.trace(`Returning result from ${eventName}`);
+            return result;
+        }
+        catch (e) {
+            logger.trace(`Error occurred in ${eventName}`);
+            try {
+                logger.trace(JSON.stringify(e));
+            }
+            catch (e) {
+                logger.trace("Unable to print error message.");
+            }
+            inProgressEvent?.end({
+                success: false,
+            });
+            throw e;
+        }
+    };
+};
+/**
+ * Wraps an async function with a performance measurement.
+ * Usage: invokeAsync(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
+ * @param callback
+ * @param eventName
+ * @param logger
+ * @param telemetryClient
+ * @param correlationId
+ * @returns
+ * @internal
+ *
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId) => {
+    return (...args) => {
+        logger.trace(`Executing function ${eventName}`);
+        const inProgressEvent = telemetryClient?.startMeasurement(eventName, correlationId);
+        telemetryClient?.setPreQueueTime(eventName, correlationId);
+        return callback(...args)
+            .then((response) => {
+            logger.trace(`Returning result from ${eventName}`);
+            inProgressEvent?.end({
+                success: true,
+            });
+            return response;
+        })
+            .catch((e) => {
+            logger.trace(`Error occurred in ${eventName}`);
+            try {
+                logger.trace(JSON.stringify(e));
+            }
+            catch (e) {
+                logger.trace("Unable to print error message.");
+            }
+            inProgressEvent?.end({
+                success: false,
+            });
+            throw e;
+        });
+    };
+};
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5073,10 +4946,9 @@ class PopTokenGenerator {
      * @param request
      * @returns
      */
-    async generateCnf(request) {
+    async generateCnf(request, logger) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.PopTokenGenerateKid, request.correlationId);
-        const reqCnf = await this.generateKid(request);
+        const reqCnf = await invokeAsync(this.generateKid.bind(this), PerformanceEvents.PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
         const reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
         return {
             kid: reqCnf.kid,
@@ -5257,8 +5129,8 @@ class ResponseHandler {
     validateServerAuthorizationCodeResponse(serverResponseHash, cachedState, cryptoObj) {
         if (!serverResponseHash.state || !cachedState) {
             throw serverResponseHash.state
-                ? ClientAuthError.createStateNotFoundError("Cached State")
-                : ClientAuthError.createStateNotFoundError("Server State");
+                ? createClientAuthError(stateNotFound, "Cached State")
+                : createClientAuthError(stateNotFound, "Server State");
         }
         let decodedServerResponseHash;
         let decodedCachedState;
@@ -5266,22 +5138,22 @@ class ResponseHandler {
             decodedServerResponseHash = decodeURIComponent(serverResponseHash.state);
         }
         catch (e) {
-            throw ClientAuthError.createInvalidStateError(serverResponseHash.state, `Server response hash URI could not be decoded`);
+            throw createClientAuthError(invalidState, serverResponseHash.state);
         }
         try {
             decodedCachedState = decodeURIComponent(cachedState);
         }
         catch (e) {
-            throw ClientAuthError.createInvalidStateError(serverResponseHash.state, `Cached state URI could not be decoded`);
+            throw createClientAuthError(invalidState, serverResponseHash.state);
         }
         if (decodedServerResponseHash !== decodedCachedState) {
-            throw ClientAuthError.createStateMismatchError();
+            throw createClientAuthError(stateMismatch);
         }
         // Check for error
         if (serverResponseHash.error ||
             serverResponseHash.error_description ||
             serverResponseHash.suberror) {
-            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponseHash.error, serverResponseHash.error_description, serverResponseHash.suberror)) {
+            if (isInteractionRequiredError(serverResponseHash.error, serverResponseHash.error_description, serverResponseHash.suberror)) {
                 throw new InteractionRequiredAuthError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror, serverResponseHash.timestamp || Constants.EMPTY_STRING, serverResponseHash.trace_id || Constants.EMPTY_STRING, serverResponseHash.correlation_id || Constants.EMPTY_STRING, serverResponseHash.claims || Constants.EMPTY_STRING);
             }
             throw new ServerError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror);
@@ -5320,7 +5192,7 @@ class ResponseHandler {
                 // don't throw an exception, but alert the user via a log that the token was unable to be refreshed
                 return;
             }
-            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
+            if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
                 throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || Constants.EMPTY_STRING, serverResponse.trace_id || Constants.EMPTY_STRING, serverResponse.correlation_id || Constants.EMPTY_STRING, serverResponse.claims || Constants.EMPTY_STRING);
             }
             throw serverError;
@@ -5340,14 +5212,14 @@ class ResponseHandler {
             // token nonce check (TODO: Add a warning if no nonce is given?)
             if (authCodePayload && authCodePayload.nonce) {
                 if (idTokenClaims.nonce !== authCodePayload.nonce) {
-                    throw ClientAuthError.createNonceMismatchError();
+                    throw createClientAuthError(nonceMismatch);
                 }
             }
             // token max_age check
             if (request.maxAge || request.maxAge === 0) {
                 const authTime = idTokenClaims.auth_time;
                 if (!authTime) {
-                    throw ClientAuthError.createAuthTimeNotFoundError();
+                    throw createClientAuthError(authTimeNotFound);
                 }
                 checkMaxAge(authTime, request.maxAge);
             }
@@ -5407,7 +5279,7 @@ class ResponseHandler {
     generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
         const env = authority.getPreferredCache();
         if (!env) {
-            throw ClientAuthError.createInvalidCacheEnvironmentError();
+            throw createClientAuthError(invalidCacheEnvironment);
         }
         // IdToken: non AAD scenarios can have empty realm
         let cachedIdToken;
@@ -5484,7 +5356,7 @@ class ResponseHandler {
                 const popTokenGenerator = new PopTokenGenerator(cryptoObj);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
-                    throw ClientAuthError.createKeyIdMissingError();
+                    throw createClientAuthError(keyIdMissing);
                 }
                 accessToken = await popTokenGenerator.signPopToken(secret, keyId, request);
             }
@@ -5542,92 +5414,6 @@ class ResponseHandler {
     }
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Wraps a function with a performance measurement.
- * Usage: invoke(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
- * @param callback
- * @param eventName
- * @param logger
- * @param telemetryClient
- * @param correlationId
- * @returns
- * @internal
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const invoke = (callback, eventName, logger, telemetryClient, correlationId) => {
-    return (...args) => {
-        logger.trace(`Executing function ${eventName}`);
-        const inProgressEvent = telemetryClient?.startMeasurement(eventName, correlationId);
-        telemetryClient?.setPreQueueTime(eventName, correlationId);
-        try {
-            const result = callback(...args);
-            inProgressEvent?.end({
-                success: true,
-            });
-            logger.trace(`Returning result from ${eventName}`);
-            return result;
-        }
-        catch (e) {
-            logger.trace(`Error occurred in ${eventName}`);
-            try {
-                logger.trace(JSON.stringify(e));
-            }
-            catch (e) {
-                logger.trace("Unable to print error message.");
-            }
-            inProgressEvent?.end({
-                success: false,
-            });
-            throw e;
-        }
-    };
-};
-/**
- * Wraps an async function with a performance measurement.
- * Usage: invokeAsync(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
- * @param callback
- * @param eventName
- * @param logger
- * @param telemetryClient
- * @param correlationId
- * @returns
- * @internal
- *
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId) => {
-    return (...args) => {
-        logger.trace(`Executing function ${eventName}`);
-        const inProgressEvent = telemetryClient?.startMeasurement(eventName, correlationId);
-        telemetryClient?.setPreQueueTime(eventName, correlationId);
-        return callback(...args)
-            .then((response) => {
-            logger.trace(`Returning result from ${eventName}`);
-            inProgressEvent?.end({
-                success: true,
-            });
-            return response;
-        })
-            .catch((e) => {
-            logger.trace(`Error occurred in ${eventName}`);
-            try {
-                logger.trace(JSON.stringify(e));
-            }
-            catch (e) {
-                logger.trace("Unable to print error message.");
-            }
-            inProgressEvent?.end({
-                success: false,
-            });
-            throw e;
-        });
-    };
-};
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5667,7 +5453,7 @@ class AuthorizationCodeClient extends BaseClient {
     async acquireToken(request, authCodePayload) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientAcquireToken, request.correlationId);
         if (!request.code) {
-            throw ClientAuthError.createTokenRequestCannotBeMadeError();
+            throw createClientAuthError(requestCannotBeMade);
         }
         const reqTimestamp = TimeUtils.nowSeconds();
         const response = await invokeAsync(this.executeTokenRequest.bind(this), PerformanceEvents.AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request);
@@ -5692,7 +5478,7 @@ class AuthorizationCodeClient extends BaseClient {
         responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState, this.cryptoUtils);
         // throw when there is no auth code in the response
         if (!serverParams.code) {
-            throw ClientAuthError.createNoAuthCodeInServerResponseError();
+            throw createClientAuthError(authorizationCodeMissingFromServerResponse);
         }
         return {
             ...serverParams,
@@ -5708,7 +5494,7 @@ class AuthorizationCodeClient extends BaseClient {
     getLogoutUri(logoutRequest) {
         // Throw error if logoutRequest is null/undefined
         if (!logoutRequest) {
-            throw ClientConfigurationError.createEmptyLogoutRequestError();
+            throw createClientConfigurationError(logoutRequestEmpty);
         }
         const queryString = this.createLogoutUrlQueryString(logoutRequest);
         // Construct logout URI
@@ -5739,7 +5525,8 @@ class AuthorizationCodeClient extends BaseClient {
         }
         const headers = this.createTokenRequestHeaders(ccsCredential || request.ccsCredential);
         const thumbprint = {
-            clientId: this.config.authOptions.clientId,
+            clientId: request.tokenBodyParameters?.clientId ||
+                this.config.authOptions.clientId,
             authority: authority.canonicalAuthority,
             scopes: request.scopes,
             claims: request.claims,
@@ -5799,8 +5586,7 @@ class AuthorizationCodeClient extends BaseClient {
         parameterBuilder.addClientInfo();
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            this.performanceClient?.setPreQueueTime(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
-            const reqCnfData = await popTokenGenerator.generateCnf(request);
+            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
             parameterBuilder.addPopToken(reqCnfData.reqCnfString);
         }
@@ -5809,7 +5595,7 @@ class AuthorizationCodeClient extends BaseClient {
                 parameterBuilder.addSshJwk(request.sshJwk);
             }
             else {
-                throw ClientConfigurationError.createMissingSshJwkError();
+                throw createClientConfigurationError(missingSshJwk);
             }
         }
         const correlationId = request.correlationId ||
@@ -5993,7 +5779,7 @@ class AuthorizationCodeClient extends BaseClient {
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                 // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                const reqCnfData = await popTokenGenerator.generateCnf(request);
+                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
                 parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
             }
         }
@@ -6051,33 +5837,13 @@ class RefreshTokenClient extends BaseClient {
     }
     async acquireToken(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
-        const atsMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
-        this.logger.verbose("RefreshTokenClientAcquireToken called", request.correlationId);
         const reqTimestamp = TimeUtils.nowSeconds();
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
-        const response = await this.executeTokenRequest(request, this.authority);
+        const response = await invokeAsync(this.executeTokenRequest.bind(this), PerformanceEvents.RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
         // Retrieve requestId from response headers
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
         responseHandler.validateTokenResponse(response.body);
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.HandleServerTokenResponse, request.correlationId);
-        return responseHandler
-            .handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId)
-            .then((result) => {
-            atsMeasurement?.end({
-                success: true,
-            });
-            return result;
-        })
-            .catch((error) => {
-            this.logger.verbose("Error in fetching refresh token", request.correlationId);
-            atsMeasurement?.end({
-                errorCode: error.errorCode,
-                subErrorCode: error.subError,
-                success: false,
-            });
-            throw error;
-        });
+        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId);
     }
     /**
      * Gets cached refresh token and attaches to request, then calls acquireToken API
@@ -6086,33 +5852,30 @@ class RefreshTokenClient extends BaseClient {
     async acquireTokenByRefreshToken(request) {
         // Cannot renew token if no request object is given.
         if (!request) {
-            throw ClientConfigurationError.createEmptyTokenRequestError();
+            throw createClientConfigurationError(tokenRequestEmpty);
         }
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken, request.correlationId);
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
-            throw ClientAuthError.createNoAccountInSilentRequestError();
+            throw createClientAuthError(noAccountInSilentRequest);
         }
         // try checking if FOCI is enabled for the given application
         const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment);
         // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
         if (isFOCI) {
             try {
-                this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
-                return this.acquireTokenWithCachedRefreshToken(request, true);
+                return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true);
             }
             catch (e) {
                 const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
                     e.errorCode ===
-                        InteractionRequiredAuthErrorMessage.noTokensFoundError
-                            .code;
+                        noTokensFound;
                 const clientMismatchErrorWithFamilyRT = e instanceof ServerError &&
                     e.errorCode === Errors.INVALID_GRANT_ERROR &&
                     e.subError === Errors.CLIENT_MISMATCH_ERROR;
                 // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
                 if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
-                    this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
-                    return this.acquireTokenWithCachedRefreshToken(request, false);
+                    return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
                     // throw in all other cases
                 }
                 else {
@@ -6121,8 +5884,7 @@ class RefreshTokenClient extends BaseClient {
             }
         }
         // fall back to application refresh token acquisition
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
-        return this.acquireTokenWithCachedRefreshToken(request, false);
+        return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
     }
     /**
      * makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
@@ -6131,17 +5893,11 @@ class RefreshTokenClient extends BaseClient {
     async acquireTokenWithCachedRefreshToken(request, foci) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
         // fetches family RT or application RT based on FOCI value
-        const atsMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
-        this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
         const refreshToken = this.cacheManager.getRefreshToken(request.account, foci);
         if (!refreshToken) {
-            atsMeasurement?.discard();
-            throw InteractionRequiredAuthError.createNoTokensFoundError();
+            throw createInteractionRequiredAuthError(noTokensFound);
         }
         // attach cached RT size to the current measurement
-        atsMeasurement?.end({
-            success: true,
-        });
         const refreshTokenRequest = {
             ...request,
             refreshToken: refreshToken.secret,
@@ -6151,8 +5907,7 @@ class RefreshTokenClient extends BaseClient {
                 type: CcsCredentialType.HOME_ACCOUNT_ID,
             },
         };
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
-        return this.acquireToken(refreshTokenRequest);
+        return invokeAsync(this.acquireToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest);
     }
     /**
      * Constructs the network message and makes a NW call to the underlying secure token service
@@ -6161,14 +5916,13 @@ class RefreshTokenClient extends BaseClient {
      */
     async executeTokenRequest(request, authority) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
-        const acquireTokenMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);
         const queryParametersString = this.createTokenQueryParameters(request);
         const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
-        const requestBody = await this.createTokenRequestBody(request);
+        const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
         const headers = this.createTokenRequestHeaders(request.ccsCredential);
         const thumbprint = {
-            clientId: this.config.authOptions.clientId,
+            clientId: request.tokenBodyParameters?.clientId ||
+                this.config.authOptions.clientId,
             authority: authority.canonicalAuthority,
             scopes: request.scopes,
             claims: request.claims,
@@ -6178,19 +5932,7 @@ class RefreshTokenClient extends BaseClient {
             shrClaims: request.shrClaims,
             sshKid: request.sshKid,
         };
-        return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint, request.correlationId)
-            .then((result) => {
-            acquireTokenMeasurement?.end({
-                success: true,
-            });
-            return result;
-        })
-            .catch((error) => {
-            acquireTokenMeasurement?.end({
-                success: false,
-            });
-            throw error;
-        });
+        return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.BaseClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId);
     }
     /**
      * Helper function to create the token request body
@@ -6199,9 +5941,12 @@ class RefreshTokenClient extends BaseClient {
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);
         const correlationId = request.correlationId;
-        const acquireTokenMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.BaseClientCreateTokenRequestHeaders, correlationId);
         const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(this.config.authOptions.clientId);
+        parameterBuilder.addClientId(request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+            this.config.authOptions.clientId);
+        if (request.redirectUri) {
+            parameterBuilder.addRedirectUri(request.redirectUri);
+        }
         parameterBuilder.addScopes(request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
         parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
         parameterBuilder.addClientInfo();
@@ -6223,8 +5968,7 @@ class RefreshTokenClient extends BaseClient {
         }
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            this.performanceClient?.setPreQueueTime(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
-            const reqCnfData = await popTokenGenerator.generateCnf(request);
+            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
             parameterBuilder.addPopToken(reqCnfData.reqCnfString);
         }
@@ -6233,10 +5977,7 @@ class RefreshTokenClient extends BaseClient {
                 parameterBuilder.addSshJwk(request.sshJwk);
             }
             else {
-                acquireTokenMeasurement?.end({
-                    success: false,
-                });
-                throw ClientConfigurationError.createMissingSshJwkError();
+                throw createClientConfigurationError(missingSshJwk);
             }
         }
         if (!StringUtils.isEmptyObj(request.claims) ||
@@ -6262,9 +6003,9 @@ class RefreshTokenClient extends BaseClient {
                     break;
             }
         }
-        acquireTokenMeasurement?.end({
-            success: true,
-        });
+        if (request.tokenBodyParameters) {
+            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+        }
         return parameterBuilder.createQueryString();
     }
 }
@@ -6285,11 +6026,24 @@ class SilentFlowClient extends BaseClient {
      */
     async acquireToken(request) {
         try {
-            return await this.acquireCachedToken(request);
+            const [authResponse, cacheOutcome] = await this.acquireCachedToken(request);
+            // if the token is not expired but must be refreshed; get a new one in the background
+            if (cacheOutcome === CacheOutcome.PROACTIVELY_REFRESHED) {
+                this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.");
+                // refresh the access token in the background
+                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
+                refreshTokenClient
+                    .acquireTokenByRefreshToken(request)
+                    .catch(() => {
+                    // do nothing, this is running in the background and no action is to be taken upon success or failure
+                });
+            }
+            // return the cached token
+            return authResponse;
         }
         catch (e) {
             if (e instanceof ClientAuthError &&
-                e.errorCode === ClientAuthErrorMessage.tokenRefreshRequired.code) {
+                e.errorCode === tokenRefreshRequired) {
                 const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
                 return refreshTokenClient.acquireTokenByRefreshToken(request);
             }
@@ -6303,52 +6057,61 @@ class SilentFlowClient extends BaseClient {
      * @param request
      */
     async acquireCachedToken(request) {
+        let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
         // Cannot renew token if no request object is given.
         if (!request) {
-            throw ClientConfigurationError.createEmptyTokenRequestError();
+            throw createClientConfigurationError(tokenRequestEmpty);
         }
         if (request.forceRefresh) {
             // Must refresh due to present force_refresh flag.
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
+            lastCacheOutcome = CacheOutcome.FORCE_REFRESH_OR_CLAIMS;
+            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS);
             this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
-            throw ClientAuthError.createRefreshRequiredError();
+            throw createClientAuthError(tokenRefreshRequired);
         }
         else if (!this.config.cacheOptions.claimsBasedCachingEnabled &&
             !StringUtils.isEmptyObj(request.claims)) {
+            lastCacheOutcome = CacheOutcome.FORCE_REFRESH_OR_CLAIMS;
             // Must refresh due to request parameters.
             this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims-based caching is disabled and claims were requested.");
-            throw ClientAuthError.createRefreshRequiredError();
+            throw createClientAuthError(tokenRefreshRequired);
         }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
-            throw ClientAuthError.createNoAccountInSilentRequestError();
+            throw createClientAuthError(noAccountInSilentRequest);
         }
         const environment = request.authority || this.authority.getPreferredCache();
         const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
         if (!cacheRecord.accessToken) {
-            // Must refresh due to non-existent access_token.
+            // must refresh due to non-existent access_token
+            lastCacheOutcome = CacheOutcome.NO_CACHED_ACCESS_TOKEN;
             this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
             this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
-            throw ClientAuthError.createRefreshRequiredError();
+            throw createClientAuthError(tokenRefreshRequired);
         }
         else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
             TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
-            // Must refresh due to expired access_token.
+            // must refresh due to the expires_in value
+            lastCacheOutcome = CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED;
             this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
             this.logger.info(`SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`);
-            throw ClientAuthError.createRefreshRequiredError();
+            throw createClientAuthError(tokenRefreshRequired);
         }
         else if (cacheRecord.accessToken.refreshOn &&
             TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
-            // Must refresh due to the refresh_in value.
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);
+            // must refresh (in the background) due to the refresh_in value
+            lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
+            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.PROACTIVELY_REFRESHED);
             this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
-            throw ClientAuthError.createRefreshRequiredError();
+            // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
         }
         if (this.config.serverTelemetryManager) {
             this.config.serverTelemetryManager.incrementCacheHits();
         }
-        return await this.generateResultFromCacheRecord(cacheRecord, request);
+        return [
+            await this.generateResultFromCacheRecord(cacheRecord, request),
+            lastCacheOutcome,
+        ];
     }
     /**
      * Helper function to build response object from the CacheRecord
@@ -6363,7 +6126,7 @@ class SilentFlowClient extends BaseClient {
         if (request.maxAge || request.maxAge === 0) {
             const authTime = idTokenClaims?.auth_time;
             if (!authTime) {
-                throw ClientAuthError.createAuthTimeNotFoundError();
+                throw createClientAuthError(authTimeNotFound);
             }
             checkMaxAge(authTime, request.maxAge);
         }
@@ -7369,8 +7132,9 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
  * Licensed under the MIT License.
  */
 class RegionDiscovery {
-    constructor(networkInterface, performanceClient, correlationId) {
+    constructor(networkInterface, logger, performanceClient, correlationId) {
         this.networkInterface = networkInterface;
+        this.logger = logger;
         this.performanceClient = performanceClient;
         this.correlationId = correlationId;
     }
@@ -7387,8 +7151,7 @@ class RegionDiscovery {
         if (!autodetectedRegionName) {
             const options = RegionDiscovery.IMDS_OPTIONS;
             try {
-                this.performanceClient?.setPreQueueTime(PerformanceEvents.RegionDiscoveryGetRegionFromIMDS, this.correlationId);
-                const localIMDSVersionResponse = await this.getRegionFromIMDS(Constants.IMDS_VERSION, options);
+                const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), PerformanceEvents.RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(Constants.IMDS_VERSION, options);
                 if (localIMDSVersionResponse.status ===
                     ResponseCodes.httpSuccess) {
                     autodetectedRegionName = localIMDSVersionResponse.body;
@@ -7398,15 +7161,13 @@ class RegionDiscovery {
                 // If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
                 if (localIMDSVersionResponse.status ===
                     ResponseCodes.httpBadRequest) {
-                    this.performanceClient?.setPreQueueTime(PerformanceEvents.RegionDiscoveryGetCurrentVersion, this.correlationId);
-                    const currentIMDSVersion = await this.getCurrentVersion(options);
+                    const currentIMDSVersion = await invokeAsync(this.getCurrentVersion.bind(this), PerformanceEvents.RegionDiscoveryGetCurrentVersion, this.logger, this.performanceClient, this.correlationId)(options);
                     if (!currentIMDSVersion) {
                         regionDiscoveryMetadata.region_source =
                             RegionDiscoverySources.FAILED_AUTO_DETECTION;
                         return null;
                     }
-                    this.performanceClient?.setPreQueueTime(PerformanceEvents.RegionDiscoveryGetRegionFromIMDS, this.correlationId);
-                    const currentIMDSVersionResponse = await this.getRegionFromIMDS(currentIMDSVersion, options);
+                    const currentIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), PerformanceEvents.RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(currentIMDSVersion, options);
                     if (currentIMDSVersionResponse.status ===
                         ResponseCodes.httpSuccess) {
                         autodetectedRegionName =
@@ -7497,7 +7258,7 @@ class Authority {
         this.logger = logger;
         this.performanceClient = performanceClient;
         this.correlationId = correlationId;
-        this.regionDiscovery = new RegionDiscovery(networkInterface, this.performanceClient, this.correlationId);
+        this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
     }
     /**
      * Get {@link AuthorityType}
@@ -7580,7 +7341,7 @@ class Authority {
             return this.replacePath(this.metadata.authorization_endpoint);
         }
         else {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            throw createClientAuthError(endpointResolutionError);
         }
     }
     /**
@@ -7591,7 +7352,7 @@ class Authority {
             return this.replacePath(this.metadata.token_endpoint);
         }
         else {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            throw createClientAuthError(endpointResolutionError);
         }
     }
     get deviceCodeEndpoint() {
@@ -7599,7 +7360,7 @@ class Authority {
             return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
         }
         else {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            throw createClientAuthError(endpointResolutionError);
         }
     }
     /**
@@ -7609,12 +7370,12 @@ class Authority {
         if (this.discoveryComplete()) {
             // ROPC policies may not have end_session_endpoint set
             if (!this.metadata.end_session_endpoint) {
-                throw ClientAuthError.createLogoutNotSupportedError();
+                throw createClientAuthError(endSessionEndpointNotSupported);
             }
             return this.replacePath(this.metadata.end_session_endpoint);
         }
         else {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            throw createClientAuthError(endpointResolutionError);
         }
     }
     /**
@@ -7625,7 +7386,7 @@ class Authority {
             return this.replacePath(this.metadata.issuer);
         }
         else {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            throw createClientAuthError(endpointResolutionError);
         }
     }
     /**
@@ -7636,7 +7397,7 @@ class Authority {
             return this.replacePath(this.metadata.jwks_uri);
         }
         else {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            throw createClientAuthError(endpointResolutionError);
         }
     }
     /**
@@ -7693,7 +7454,8 @@ class Authority {
      */
     get defaultOpenIdConfigurationEndpoint() {
         const canonicalAuthorityHost = this.hostnameAndPort;
-        if (this.authorityType === AuthorityType.Adfs ||
+        if (this.canonicalAuthority.endsWith("v2.0/") ||
+            this.authorityType === AuthorityType.Adfs ||
             (this.protocolMode !== ProtocolMode.AAD &&
                 !this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost))) {
             return `${this.canonicalAuthority}.well-known/openid-configuration`;
@@ -7717,11 +7479,9 @@ class Authority {
             metadataEntity = new AuthorityMetadataEntity();
             metadataEntity.updateCanonicalAuthority(this.canonicalAuthority);
         }
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateCloudDiscoveryMetadata, this.correlationId);
-        const cloudDiscoverySource = await this.updateCloudDiscoveryMetadata(metadataEntity);
+        const cloudDiscoverySource = await invokeAsync(this.updateCloudDiscoveryMetadata.bind(this), PerformanceEvents.AuthorityUpdateCloudDiscoveryMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
         this.canonicalAuthority = this.canonicalAuthority.replace(this.hostnameAndPort, metadataEntity.preferred_network);
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateEndpointMetadata, this.correlationId);
-        const endpointSource = await this.updateEndpointMetadata(metadataEntity);
+        const endpointSource = await invokeAsync(this.updateEndpointMetadata.bind(this), PerformanceEvents.AuthorityUpdateEndpointMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
         if (cloudDiscoverySource !== AuthorityMetadataSource.CACHE &&
             endpointSource !== AuthorityMetadataSource.CACHE) {
             // Reset the expiration time unless both values came from a successful cache lookup
@@ -7756,10 +7516,7 @@ class Authority {
                 this.logger.verbose("Found endpoint metadata from hardcoded values.");
                 // If the user prefers to use an azure region replace the global endpoints with regional information.
                 if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
-                    this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
-                    this.logger.verbose("Found azure region configuration. Updating endpoints with regional information.");
-                    hardcodedMetadata =
-                        await this.updateMetadataWithRegionalInformation(hardcodedMetadata);
+                    hardcodedMetadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(hardcodedMetadata);
                 }
                 metadataEntity.updateEndpointMetadata(hardcodedMetadata, false);
                 return AuthorityMetadataSource.HARDCODED_VALUES;
@@ -7780,24 +7537,18 @@ class Authority {
         else if (metadataEntityExpired) {
             this.logger.verbose("The metadata entity is expired.");
         }
-        this.logger.verbose("Did not find cached endpoint metadata... Attempting to get endpoint metadata from the network.");
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork, this.correlationId);
-        metadata = await this.getEndpointMetadataFromNetwork();
+        metadata = await invokeAsync(this.getEndpointMetadataFromNetwork.bind(this), PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
         if (metadata) {
-            this.logger.verbose("Endpoint metadata was successfully returned from getEndpointMetadataFromNetwork()");
             // If the user prefers to use an azure region replace the global endpoints with regional information.
             if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
-                this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
-                this.logger.verbose("Found azure region configuration. Updating endpoints with regional information.");
-                metadata = await this.updateMetadataWithRegionalInformation(metadata);
+                metadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(metadata);
             }
             metadataEntity.updateEndpointMetadata(metadata, true);
             return AuthorityMetadataSource.NETWORK;
         }
         else {
             // Metadata could not be obtained from the config, cache, network or hardcoded values
-            this.logger.error("Did not find endpoint metadata from network... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
-            throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
+            throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint);
         }
     }
     /**
@@ -7821,7 +7572,7 @@ class Authority {
                 return JSON.parse(this.authorityOptions.authorityMetadata);
             }
             catch (e) {
-                throw ClientConfigurationError.createInvalidAuthorityMetadataError();
+                throw createClientConfigurationError(invalidAuthorityMetadata);
             }
         }
         return null;
@@ -7833,7 +7584,6 @@ class Authority {
      */
     async getEndpointMetadataFromNetwork() {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork, this.correlationId);
-        const perfEvent = this.performanceClient?.startMeasurement(PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork, this.correlationId);
         const options = {};
         /*
          * TODO: Add a timeout if the authority exists in our library's
@@ -7845,23 +7595,14 @@ class Authority {
             const response = await this.networkInterface.sendGetRequestAsync(openIdConfigurationEndpoint, options);
             const isValidResponse = isOpenIdConfigResponse(response.body);
             if (isValidResponse) {
-                perfEvent?.end({ success: true });
                 return response.body;
             }
             else {
-                perfEvent?.end({
-                    success: false,
-                    errorCode: "invalid_response",
-                });
                 this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration`);
                 return null;
             }
         }
         catch (e) {
-            perfEvent?.end({
-                success: false,
-                errorCode: "request_failure",
-            });
             this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: ${e}`);
             return null;
         }
@@ -7891,8 +7632,7 @@ class Authority {
                     userConfiguredAzureRegion;
                 return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
             }
-            this.performanceClient?.setPreQueueTime(PerformanceEvents.RegionDiscoveryDetectRegion, this.correlationId);
-            const autodetectedRegionName = await this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration
+            const autodetectedRegionName = await invokeAsync(this.regionDiscovery.detectRegion.bind(this.regionDiscovery), PerformanceEvents.RegionDiscoveryDetectRegion, this.logger, this.performanceClient, this.correlationId)(this.authorityOptions.azureRegionConfiguration
                 ?.environmentRegion, this.regionDiscoveryMetadata);
             if (autodetectedRegionName) {
                 this.regionDiscoveryMetadata.region_outcome =
@@ -7951,17 +7691,13 @@ class Authority {
         else if (metadataEntityExpired) {
             this.logger.verbose("The metadata entity is expired.");
         }
-        this.logger.verbose("Did not find cloud discovery metadata in the cache... Attempting to get cloud discovery metadata from the network.");
-        this.performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityGetCloudDiscoveryMetadataFromNetwork, this.correlationId);
-        metadata = await this.getCloudDiscoveryMetadataFromNetwork();
+        metadata = await invokeAsync(this.getCloudDiscoveryMetadataFromNetwork.bind(this), PerformanceEvents.AuthorityGetCloudDiscoveryMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
         if (metadata) {
-            this.logger.verbose("cloud discovery metadata was successfully returned from getCloudDiscoveryMetadataFromNetwork()");
             metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
             return AuthorityMetadataSource.NETWORK;
         }
         // Metadata could not be obtained from the config, cache, network or hardcoded values
-        this.logger.error("Did not find cloud discovery metadata from network... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
-        throw ClientConfigurationError.createUntrustedAuthorityError();
+        throw createClientConfigurationError(untrustedAuthority);
     }
     /**
      * Parse cloudDiscoveryMetadata config or check knownAuthorities
@@ -7990,7 +7726,7 @@ class Authority {
             }
             catch (e) {
                 this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error.");
-                throw ClientConfigurationError.createInvalidCloudDiscoveryMetadataError();
+                throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
             }
         }
         // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
@@ -8134,7 +7870,7 @@ class Authority {
             return this.metadata.preferred_cache;
         }
         else {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            throw createClientAuthError(endpointResolutionError);
         }
     }
     /**
@@ -8259,12 +7995,11 @@ class AuthorityFactory {
         // Initialize authority and perform discovery endpoint check.
         const acquireTokenAuthority = AuthorityFactory.createInstance(authorityUriFinal, networkClient, cacheManager, authorityOptions, logger, performanceClient, correlationId);
         try {
-            performanceClient?.setPreQueueTime(PerformanceEvents.AuthorityResolveEndpointsAsync, correlationId);
-            await acquireTokenAuthority.resolveEndpointsAsync();
+            await invokeAsync(acquireTokenAuthority.resolveEndpointsAsync.bind(acquireTokenAuthority), PerformanceEvents.AuthorityResolveEndpointsAsync, logger, performanceClient, correlationId)();
             return acquireTokenAuthority;
         }
         catch (e) {
-            throw ClientAuthError.createEndpointDiscoveryIncompleteError(e);
+            throw createClientAuthError(endpointResolutionError);
         }
     }
     /**
@@ -8280,7 +8015,7 @@ class AuthorityFactory {
     static createInstance(authorityUrl, networkInterface, cacheManager, authorityOptions, logger, performanceClient, correlationId) {
         // Throw error if authority url is empty
         if (!authorityUrl) {
-            throw ClientConfigurationError.createUrlEmptyError();
+            throw createClientConfigurationError(urlEmptyError);
         }
         return new Authority(authorityUrl, networkInterface, cacheManager, authorityOptions, logger, performanceClient, correlationId);
     }
@@ -8344,12 +8079,10 @@ class ThrottlingEntity {
  */
 const StubbedNetworkModule = {
     sendGetRequestAsync: () => {
-        const notImplErr = "Network interface - sendGetRequestAsync() has not been implemented for the Network interface.";
-        return Promise.reject(AuthError.createUnexpectedError(notImplErr));
+        return Promise.reject(createClientAuthError(methodNotImplemented));
     },
     sendPostRequestAsync: () => {
-        const notImplErr = "Network interface - sendPostRequestAsync() has not been implemented for the Network interface.";
-        return Promise.reject(AuthError.createUnexpectedError(notImplErr));
+        return Promise.reject(createClientAuthError(methodNotImplemented));
     },
 };
 
@@ -8357,18 +8090,16 @@ const StubbedNetworkModule = {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-/**
- * ClientAuthErrorMessage class containing string constants used by error codes and messages.
+const missingKidError = "missing_kid_error";
+const missingAlgError = "missing_alg_error";
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
  */
-const JoseHeaderErrorMessage = {
-    missingKidError: {
-        code: "missing_kid_error",
-        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided.",
-    },
-    missingAlgError: {
-        code: "missing_alg_error",
-        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided.",
-    },
+const JoseHeaderErrorMessages = {
+    [missingKidError]: "The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided.",
+    [missingAlgError]: "The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided.",
 };
 /**
  * Error thrown when there is an error in the client code running on the browser.
@@ -8379,18 +8110,10 @@ class JoseHeaderError extends AuthError {
         this.name = "JoseHeaderError";
         Object.setPrototypeOf(this, JoseHeaderError.prototype);
     }
-    /**
-     * Creates an error thrown when keyId isn't set on JOSE header.
-     */
-    static createMissingKidError() {
-        return new JoseHeaderError(JoseHeaderErrorMessage.missingKidError.code, JoseHeaderErrorMessage.missingKidError.desc);
-    }
-    /**
-     * Creates an error thrown when algorithm isn't set on JOSE header.
-     */
-    static createMissingAlgError() {
-        return new JoseHeaderError(JoseHeaderErrorMessage.missingAlgError.code, JoseHeaderErrorMessage.missingAlgError.desc);
-    }
+}
+/** Returns JoseHeaderError object */
+function createJoseHeaderError(code) {
+    return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
 /*
@@ -8415,11 +8138,11 @@ class JoseHeader {
     static getShrHeaderString(shrHeaderOptions) {
         // KeyID is required on the SHR header
         if (!shrHeaderOptions.kid) {
-            throw JoseHeaderError.createMissingKidError();
+            throw createJoseHeaderError(missingKidError);
         }
         // Alg is required on the SHR header
         if (!shrHeaderOptions.alg) {
-            throw JoseHeaderError.createMissingAlgError();
+            throw createJoseHeaderError(missingAlgError);
         }
         const shrHeader = new JoseHeader({
             // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
@@ -8455,7 +8178,7 @@ class AuthenticationHeaderParser {
             if (authenticationInfoChallenges.nextnonce) {
                 return authenticationInfoChallenges.nextnonce;
             }
-            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.AuthenticationInfo, "nextnonce challenge is missing.");
+            throw createClientConfigurationError(invalidAuthenticationHeader);
         }
         // Attempt to parse nonce from WWW-Authenticate
         const wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
@@ -8464,10 +8187,10 @@ class AuthenticationHeaderParser {
             if (wwwAuthenticateChallenges.nonce) {
                 return wwwAuthenticateChallenges.nonce;
             }
-            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.WWWAuthenticate, "nonce challenge is missing.");
+            throw createClientConfigurationError(invalidAuthenticationHeader);
         }
         // If neither header is present, throw missing headers error
-        throw ClientConfigurationError.createMissingNonceAuthenticationHeadersError();
+        throw createClientConfigurationError(missingNonceAuthenticationHeader);
     }
     /**
      * Parses an HTTP header's challenge set into a key/value map.
@@ -8494,7 +8217,7 @@ class AuthenticationHeaderParser {
 /** @internal */
 class ServerTelemetryManager {
     constructor(telemetryRequest, cacheManager) {
-        this.cacheOutcome = CacheOutcome.NO_CACHE_HIT;
+        this.cacheOutcome = CacheOutcome.NOT_APPLICABLE;
         this.cacheManager = cacheManager;
         this.apiId = telemetryRequest.apiId;
         this.correlationId = telemetryRequest.correlationId;
@@ -8798,7 +8521,8 @@ class PerformanceClient {
         }
         const queueMeasurement = {
             eventName,
-            queueTime,
+            // Always default queue time to 0 for manually completed (improperly instrumented)
+            queueTime: manuallyCompleted ? 0 : queueTime,
             manuallyCompleted,
         };
         // Adds to existing correlation Id if present in queueMeasurements
@@ -9177,6 +8901,7 @@ exports.AccessTokenEntity = AccessTokenEntity;
 exports.AccountEntity = AccountEntity;
 exports.AppMetadataEntity = AppMetadataEntity;
 exports.AuthError = AuthError;
+exports.AuthErrorCodes = AuthErrorCodes;
 exports.AuthErrorMessage = AuthErrorMessage;
 exports.AuthToken = AuthToken;
 exports.AuthenticationHeaderParser = AuthenticationHeaderParser;
@@ -9196,8 +8921,10 @@ exports.CacheType = CacheType;
 exports.CcsCredentialType = CcsCredentialType;
 exports.ClaimsRequestKeys = ClaimsRequestKeys;
 exports.ClientAuthError = ClientAuthError;
+exports.ClientAuthErrorCodes = ClientAuthErrorCodes;
 exports.ClientAuthErrorMessage = ClientAuthErrorMessage;
 exports.ClientConfigurationError = ClientConfigurationError;
+exports.ClientConfigurationErrorCodes = ClientConfigurationErrorCodes;
 exports.ClientConfigurationErrorMessage = ClientConfigurationErrorMessage;
 exports.CodeChallengeMethodValues = CodeChallengeMethodValues;
 exports.Constants = Constants;
@@ -9213,6 +8940,7 @@ exports.HttpStatus = HttpStatus;
 exports.IdTokenEntity = IdTokenEntity;
 exports.IntFields = IntFields;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
+exports.InteractionRequiredAuthErrorCodes = InteractionRequiredAuthErrorCodes;
 exports.InteractionRequiredAuthErrorMessage = InteractionRequiredAuthErrorMessage;
 exports.JoseHeader = JoseHeader;
 exports.Logger = Logger;
@@ -9252,6 +8980,10 @@ exports.TokenCacheContext = TokenCacheContext;
 exports.UrlString = UrlString;
 exports.buildClientInfo = buildClientInfo;
 exports.buildClientInfoFromHomeAccountId = buildClientInfoFromHomeAccountId;
+exports.createAuthError = createAuthError;
+exports.createClientAuthError = createClientAuthError;
+exports.createClientConfigurationError = createClientConfigurationError;
+exports.createInteractionRequiredAuthError = createInteractionRequiredAuthError;
 exports.invoke = invoke;
 exports.invokeAsync = invokeAsync;
 exports.version = version;