@azure/msal-common 14.15.0 → 14.16.1

package/lib/{index-node-aee3f7b6.js → index-node-CebvEPer.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.15.0 2024-09-20 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 'use strict';
 'use strict';
 
@@ -96,6 +96,7 @@ const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, Constants.EMAIL_SCOPE];
  */
 const HeaderNames = {
     CONTENT_TYPE: "Content-Type",
+    CONTENT_LENGTH: "Content-Length",
     RETRY_AFTER: "Retry-After",
     CCS_HEADER: "X-AnchorMailbox",
     WWWAuthenticate: "WWW-Authenticate",
@@ -1612,6 +1613,7 @@ const PerformanceEvents = {
     /**
      * Time spent sending/waiting for the response of a request to the token endpoint
      */
+    NetworkClientSendPostRequestAsync: "networkClientSendPostRequestAsync",
     RefreshTokenClientExecutePostToTokenEndpoint: "refreshTokenClientExecutePostToTokenEndpoint",
     AuthorizationCodeClientExecutePostToTokenEndpoint: "authorizationCodeClientExecutePostToTokenEndpoint",
     /**
@@ -1785,6 +1787,10 @@ const PerformanceEventAbbreviations = new Map([
         PerformanceEvents.BaseClientCreateTokenRequestHeaders,
         "BaseClientCreateTReqHead",
     ],
+    [
+        PerformanceEvents.NetworkClientSendPostRequestAsync,
+        "NetClientSendPost",
+    ],
     [
         PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint,
         "RTClientExecPost",
@@ -3519,11 +3525,15 @@ const LOGOUT_HINT = "logout_hint";
 const SID = "sid";
 const LOGIN_HINT = "login_hint";
 const DOMAIN_HINT = "domain_hint";
-const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+const BROKER_CLIENT_ID = "brk_client_id";
+const BROKER_REDIRECT_URI = "brk_redirect_uri";
 
 var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     __proto__: null,
     ACCESS_TOKEN: ACCESS_TOKEN,
+    BROKER_CLIENT_ID: BROKER_CLIENT_ID,
+    BROKER_REDIRECT_URI: BROKER_REDIRECT_URI,
     CCS_HEADER: CCS_HEADER,
     CLAIMS: CLAIMS,
     CLIENT_ASSERTION: CLIENT_ASSERTION,
@@ -3806,7 +3816,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "14.15.0";
+const version = "14.16.1";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4388,13 +4398,13 @@ class AccountEntity {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
-const cacheUnknownErrorCode = "cache_error_unknown";
+const cacheQuotaExceeded = "cache_quota_exceeded";
+const cacheErrorUnknown = "cache_error_unknown";
 
 var CacheErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
-    cacheQuotaExceededErrorCode: cacheQuotaExceededErrorCode,
-    cacheUnknownErrorCode: cacheUnknownErrorCode
+    cacheErrorUnknown: cacheErrorUnknown,
+    cacheQuotaExceeded: cacheQuotaExceeded
 });
 
 /*
@@ -4402,8 +4412,8 @@ var CacheErrorCodes = /*#__PURE__*/Object.freeze({
  * Licensed under the MIT License.
  */
 const CacheErrorMessages = {
-    [cacheQuotaExceededErrorCode]: "Exceeded cache storage capacity.",
-    [cacheUnknownErrorCode]: "Unexpected error occurred when using cache storage.",
+    [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
+    [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
 };
 /**
  * Error thrown when there is an error with the cache
@@ -4413,13 +4423,31 @@ class CacheError extends Error {
         const message = errorMessage ||
             (CacheErrorMessages[errorCode]
                 ? CacheErrorMessages[errorCode]
-                : CacheErrorMessages[cacheUnknownErrorCode]);
+                : CacheErrorMessages[cacheErrorUnknown]);
         super(`${errorCode}: ${message}`);
         Object.setPrototypeOf(this, CacheError.prototype);
         this.name = "CacheError";
         this.errorCode = errorCode;
         this.errorMessage = message;
     }
+}
+/**
+ * Helper function to wrap browser errors in a CacheError object
+ * @param e
+ * @returns
+ */
+function createCacheError(e) {
+    if (!(e instanceof Error)) {
+        return new CacheError(cacheErrorUnknown);
+    }
+    if (e.name === "QuotaExceededError" ||
+        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+        e.message.includes("exceeded the quota")) {
+        return new CacheError(cacheQuotaExceeded);
+    }
+    else {
+        return new CacheError(e.name, e.message);
+    }
 }
 
 /*
@@ -4442,14 +4470,14 @@ class CacheManager {
      * @param accountFilter - (Optional) filter to narrow down the accounts returned
      * @returns Array of AccountInfo objects in cache
      */
-    getAllAccounts(accountFilter) {
-        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}), accountFilter);
+    getAllAccounts(correlationId, accountFilter) {
+        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}, correlationId), correlationId, accountFilter);
     }
     /**
      * Gets first tenanted AccountInfo object found based on provided filters
      */
-    getAccountInfoFilteredBy(accountFilter) {
-        const allAccounts = this.getAllAccounts(accountFilter);
+    getAccountInfoFilteredBy(accountFilter, correlationId) {
+        const allAccounts = this.getAllAccounts(correlationId, accountFilter);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
             const sortedAccounts = allAccounts.sort((account) => {
@@ -4470,8 +4498,8 @@ class CacheManager {
      * @param accountFilter
      * @returns
      */
-    getBaseAccountInfo(accountFilter) {
-        const accountEntities = this.getAccountsFilteredBy(accountFilter);
+    getBaseAccountInfo(accountFilter, correlationId) {
+        const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
         if (accountEntities.length > 0) {
             return accountEntities[0].getAccountInfo();
         }
@@ -4486,12 +4514,12 @@ class CacheManager {
      * @param accountFilter
      * @returns Array of AccountInfo objects that match account and tenant profile filters
      */
-    buildTenantProfiles(cachedAccounts, accountFilter) {
+    buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
         return cachedAccounts.flatMap((accountEntity) => {
-            return this.getTenantProfilesFromAccountEntity(accountEntity, accountFilter?.tenantId, accountFilter);
+            return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
         });
     }
-    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter) {
+    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
         let tenantedAccountInfo = null;
         let idTokenClaims;
         if (tenantProfileFilter) {
@@ -4499,7 +4527,7 @@ class CacheManager {
                 return null;
             }
         }
-        const idToken = this.getIdToken(accountInfo, tokenKeys, tenantProfile.tenantId);
+        const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
         if (idToken) {
             idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
             if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
@@ -4511,7 +4539,7 @@ class CacheManager {
         tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
         return tenantedAccountInfo;
     }
-    getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {
+    getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
         const accountInfo = accountEntity.getAccountInfo();
         let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
         const tokenKeys = this.getTokenKeys();
@@ -4531,7 +4559,7 @@ class CacheManager {
         }
         const matchingTenantProfiles = [];
         searchTenantProfiles.forEach((tenantProfile) => {
-            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter);
+            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter);
             if (tenantedAccountInfo) {
                 matchingTenantProfiles.push(tenantedAccountInfo);
             }
@@ -4585,46 +4613,36 @@ class CacheManager {
      * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
         if (!cacheRecord) {
             throw createClientAuthError(invalidCacheRecord);
         }
         try {
             if (!!cacheRecord.account) {
-                this.setAccount(cacheRecord.account);
+                this.setAccount(cacheRecord.account, correlationId);
             }
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                this.setIdTokenCredential(cacheRecord.idToken);
+                this.setIdTokenCredential(cacheRecord.idToken, correlationId);
             }
             if (!!cacheRecord.accessToken &&
                 storeInCache?.accessToken !== false) {
-                await this.saveAccessToken(cacheRecord.accessToken);
+                await this.saveAccessToken(cacheRecord.accessToken, correlationId);
             }
             if (!!cacheRecord.refreshToken &&
                 storeInCache?.refreshToken !== false) {
-                this.setRefreshTokenCredential(cacheRecord.refreshToken);
+                this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
             }
             if (!!cacheRecord.appMetadata) {
-                this.setAppMetadata(cacheRecord.appMetadata);
+                this.setAppMetadata(cacheRecord.appMetadata, correlationId);
             }
         }
         catch (e) {
             this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);
-            if (e instanceof Error) {
-                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e.message}`, correlationId);
-                if (e.name === "QuotaExceededError" ||
-                    e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
-                    e.message.includes("exceeded the quota")) {
-                    this.commonLogger?.error(`CacheManager.saveCacheRecord: exceeded storage quota`, correlationId);
-                    throw new CacheError(cacheQuotaExceededErrorCode);
-                }
-                else {
-                    throw new CacheError(e.name, e.message);
-                }
+            if (e instanceof AuthError) {
+                throw e;
             }
             else {
-                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e}`, correlationId);
-                throw new CacheError(cacheUnknownErrorCode);
+                throw createCacheError(e);
             }
         }
     }
@@ -4632,7 +4650,7 @@ class CacheManager {
      * saves access token credential
      * @param credential
      */
-    async saveAccessToken(credential) {
+    async saveAccessToken(credential, correlationId) {
         const accessTokenFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -4644,29 +4662,27 @@ class CacheManager {
         };
         const tokenKeys = this.getTokenKeys();
         const currentScopes = ScopeSet.fromString(credential.target);
-        const removedAccessTokens = [];
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                 return;
             }
-            const tokenEntity = this.getAccessTokenCredential(key);
+            const tokenEntity = this.getAccessTokenCredential(key, correlationId);
             if (tokenEntity &&
                 this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
                 const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                    removedAccessTokens.push(this.removeAccessToken(key));
+                    this.removeAccessToken(key, correlationId);
                 }
             }
         });
-        await Promise.all(removedAccessTokens);
-        this.setAccessTokenCredential(credential);
+        this.setAccessTokenCredential(credential, correlationId);
     }
     /**
      * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
      * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
      * @param accountFilter - An object containing Account properties to filter by
      */
-    getAccountsFilteredBy(accountFilter) {
+    getAccountsFilteredBy(accountFilter, correlationId) {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
@@ -4674,7 +4690,7 @@ class CacheManager {
                 // Don't parse value if the key doesn't match the account filters
                 return;
             }
-            const entity = this.getAccount(cacheKey, this.commonLogger);
+            const entity = this.getAccount(cacheKey, correlationId, this.commonLogger);
             // Match base account fields
             if (!entity) {
                 return;
@@ -4900,11 +4916,11 @@ class CacheManager {
     /**
      * Removes all accounts and related tokens from cache.
      */
-    async removeAllAccounts() {
+    async removeAllAccounts(correlationId) {
         const allAccountKeys = this.getAccountKeys();
         const removedAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
-            removedAccounts.push(this.removeAccount(cacheKey));
+            removedAccounts.push(this.removeAccount(cacheKey, correlationId));
         });
         await Promise.all(removedAccounts);
     }
@@ -4912,38 +4928,41 @@ class CacheManager {
      * Removes the account and related tokens for a given account key
      * @param account
      */
-    async removeAccount(accountKey) {
-        const account = this.getAccount(accountKey, this.commonLogger);
+    async removeAccount(accountKey, correlationId) {
+        const account = this.getAccount(accountKey, correlationId, this.commonLogger);
         if (!account) {
             return;
         }
-        await this.removeAccountContext(account);
-        this.removeItem(accountKey);
+        await this.removeAccountContext(account, correlationId);
+        this.removeItem(accountKey, correlationId);
     }
     /**
      * Removes credentials associated with the provided account
      * @param account
      */
-    async removeAccountContext(account) {
+    async removeAccountContext(account, correlationId) {
         const allTokenKeys = this.getTokenKeys();
         const accountId = account.generateAccountId();
-        const removedCredentials = [];
         allTokenKeys.idToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             }
         });
         allTokenKeys.accessToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                removedCredentials.push(this.removeAccessToken(key));
+                this.removeAccessToken(key, correlationId);
             }
         });
         allTokenKeys.refreshToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeRefreshToken(key);
+                this.removeRefreshToken(key, correlationId);
+            }
+        });
+        this.getKeys().forEach((key) => {
+            if (key.includes(accountId)) {
+                this.removeItem(key, correlationId);
             }
         });
-        await Promise.all(removedCredentials);
     }
     /**
      * Migrates a single-tenant account and all it's associated alternate cross-tenant account objects in the
@@ -4953,7 +4972,7 @@ class CacheManager {
      * @param logger
      * @returns
      */
-    updateOutdatedCachedAccount(accountKey, accountEntity, logger) {
+    updateOutdatedCachedAccount(accountKey, accountEntity, correlationId, logger) {
         // Only update if account entity is defined and has no tenantProfiles object (is outdated)
         if (accountEntity && accountEntity.isSingleTenant()) {
             this.commonLogger?.verbose("updateOutdatedCachedAccount: Found a single-tenant (outdated) account entity in the cache, migrating to multi-tenant account entity");
@@ -4964,7 +4983,7 @@ class CacheManager {
             // Get all account entities belonging to user
             const accountsToMerge = [];
             matchingAccountKeys.forEach((key) => {
-                const account = this.getCachedAccountEntity(key);
+                const account = this.getCachedAccountEntity(key, correlationId);
                 if (account) {
                     accountsToMerge.push(account);
                 }
@@ -4989,11 +5008,11 @@ class CacheManager {
             // Clear cache of legacy account objects that have been collpsed into tenant profiles
             matchingAccountKeys.forEach((key) => {
                 if (key !== newAccountKey) {
-                    this.removeOutdatedAccount(accountKey);
+                    this.removeOutdatedAccount(accountKey, correlationId);
                 }
             });
             // Cache updated account object
-            this.setAccount(updatedAccount);
+            this.setAccount(updatedAccount, correlationId);
             logger?.verbose("Updated an outdated account entity in the cache");
             return updatedAccount;
         }
@@ -5004,37 +5023,31 @@ class CacheManager {
      * returns a boolean if the given credential is removed
      * @param credential
      */
-    async removeAccessToken(key) {
-        const credential = this.getAccessTokenCredential(key);
-        if (!credential) {
+    removeAccessToken(key, correlationId) {
+        const credential = this.getAccessTokenCredential(key, correlationId);
+        this.removeItem(key, correlationId);
+        if (!credential ||
+            credential.credentialType.toLowerCase() !==
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase() ||
+            credential.tokenType !== AuthenticationScheme.POP) {
             return;
         }
         // Remove Token Binding Key from key store for PoP Tokens Credentials
-        if (credential.credentialType.toLowerCase() ===
-            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
-            if (credential.tokenType === AuthenticationScheme.POP) {
-                const accessTokenWithAuthSchemeEntity = credential;
-                const kid = accessTokenWithAuthSchemeEntity.keyId;
-                if (kid) {
-                    try {
-                        await this.cryptoImpl.removeTokenBindingKey(kid);
-                    }
-                    catch (error) {
-                        throw createClientAuthError(bindingKeyNotRemoved);
-                    }
-                }
-            }
+        const kid = credential.keyId;
+        if (kid) {
+            void this.cryptoImpl.removeTokenBindingKey(kid).catch(() => {
+                this.commonLogger.error("Binding key could not be removed");
+            });
         }
-        return this.removeItem(key);
     }
     /**
      * Removes all app metadata objects from cache.
      */
-    removeAppMetadata() {
+    removeAppMetadata(correlationId) {
         const allCacheKeys = this.getKeys();
         allCacheKeys.forEach((cacheKey) => {
             if (this.isAppMetadata(cacheKey)) {
-                this.removeItem(cacheKey);
+                this.removeItem(cacheKey, correlationId);
             }
         });
         return true;
@@ -5043,9 +5056,9 @@ class CacheManager {
      * Retrieve AccountEntity from cache
      * @param account
      */
-    readAccountFromCache(account) {
+    readAccountFromCache(account, correlationId) {
         const accountKey = AccountEntity.generateAccountCacheKey(account);
-        return this.getAccount(accountKey, this.commonLogger);
+        return this.getAccount(accountKey, correlationId, this.commonLogger);
     }
     /**
      * Retrieve IdTokenEntity from cache
@@ -5055,7 +5068,7 @@ class CacheManager {
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getIdToken(account, tokenKeys, targetRealm, performanceClient, correlationId) {
+    getIdToken(account, correlationId, tokenKeys, targetRealm, performanceClient) {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter = {
             homeAccountId: account.homeAccountId,
@@ -5064,7 +5077,7 @@ class CacheManager {
             clientId: this.clientId,
             realm: targetRealm,
         };
-        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
+        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, correlationId, tokenKeys);
         const numIdTokens = idTokenMap.size;
         if (numIdTokens < 1) {
             this.commonLogger.info("CacheManager:getIdToken - No token found");
@@ -5097,7 +5110,7 @@ class CacheManager {
             // Multiple tokens for a single tenant profile, remove all and return null
             this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them");
             tokensToBeRemoved.forEach((idToken, key) => {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             });
             if (performanceClient && correlationId) {
                 performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
@@ -5112,7 +5125,7 @@ class CacheManager {
      * @param filter
      * @returns
      */
-    getIdTokensByFilter(filter, tokenKeys) {
+    getIdTokensByFilter(filter, correlationId, tokenKeys) {
         const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;
         const idTokens = new Map();
         idTokenKeys.forEach((key) => {
@@ -5122,7 +5135,7 @@ class CacheManager {
             })) {
                 return;
             }
-            const idToken = this.getIdTokenCredential(key);
+            const idToken = this.getIdTokenCredential(key, correlationId);
             if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                 idTokens.set(key, idToken);
             }
@@ -5151,15 +5164,15 @@ class CacheManager {
      * Removes idToken from the cache
      * @param key
      */
-    removeIdToken(key) {
-        this.removeItem(key);
+    removeIdToken(key, correlationId) {
+        this.removeItem(key, correlationId);
     }
     /**
      * Removes refresh token from the cache
      * @param key
      */
-    removeRefreshToken(key) {
-        this.removeItem(key);
+    removeRefreshToken(key, correlationId) {
+        this.removeItem(key, correlationId);
     }
     /**
      * Retrieve AccessTokenEntity from cache
@@ -5169,7 +5182,7 @@ class CacheManager {
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getAccessToken(account, request, tokenKeys, targetRealm, performanceClient, correlationId) {
+    getAccessToken(account, request, tokenKeys, targetRealm, performanceClient) {
         this.commonLogger.trace("CacheManager - getAccessToken called");
         const scopes = ScopeSet.createSearchScopes(request.scopes);
         const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
@@ -5199,7 +5212,7 @@ class CacheManager {
         accessTokenKeys.forEach((key) => {
             // Validate key
             if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
-                const accessToken = this.getAccessTokenCredential(key);
+                const accessToken = this.getAccessTokenCredential(key, request.correlationId);
                 // Validate value
                 if (accessToken &&
                     this.credentialMatchesFilter(accessToken, accessTokenFilter)) {
@@ -5215,10 +5228,10 @@ class CacheManager {
         else if (numAccessTokens > 1) {
             this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them");
             accessTokens.forEach((accessToken) => {
-                void this.removeAccessToken(generateCredentialKey(accessToken));
+                void this.removeAccessToken(generateCredentialKey(accessToken), request.correlationId);
             });
-            if (performanceClient && correlationId) {
-                performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
+            if (performanceClient && request.correlationId) {
+                performanceClient.addFields({ multiMatchedAT: accessTokens.length }, request.correlationId);
             }
             return null;
         }
@@ -5271,14 +5284,14 @@ class CacheManager {
      * @param filter
      * @returns
      */
-    getAccessTokensByFilter(filter) {
+    getAccessTokensByFilter(filter, correlationId) {
         const tokenKeys = this.getTokenKeys();
         const accessTokens = [];
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, filter, true)) {
                 return;
             }
-            const accessToken = this.getAccessTokenCredential(key);
+            const accessToken = this.getAccessTokenCredential(key, correlationId);
             if (accessToken &&
                 this.credentialMatchesFilter(accessToken, filter)) {
                 accessTokens.push(accessToken);
@@ -5294,7 +5307,7 @@ class CacheManager {
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getRefreshToken(account, familyRT, tokenKeys, performanceClient, correlationId) {
+    getRefreshToken(account, familyRT, correlationId, tokenKeys, performanceClient) {
         this.commonLogger.trace("CacheManager - getRefreshToken called");
         const id = familyRT ? THE_FAMILY_ID : undefined;
         const refreshTokenFilter = {
@@ -5310,7 +5323,7 @@ class CacheManager {
         refreshTokenKeys.forEach((key) => {
             // Validate key
             if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
-                const refreshToken = this.getRefreshTokenCredential(key);
+                const refreshToken = this.getRefreshTokenCredential(key, correlationId);
                 // Validate value
                 if (refreshToken &&
                     this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {
@@ -5661,9 +5674,6 @@ class DefaultStorageClass extends CacheManager {
     getTokenKeys() {
         throw createClientAuthError(methodNotImplemented);
     }
-    async clear() {
-        throw createClientAuthError(methodNotImplemented);
-    }
     updateCredentialCacheKey() {
         throw createClientAuthError(methodNotImplemented);
     }
@@ -5769,154 +5779,6 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Error thrown when there is an error with the server code, for example, unavailability.
- */
-class ServerError extends AuthError {
-    constructor(errorCode, errorMessage, subError, errorNo, status) {
-        super(errorCode, errorMessage, subError);
-        this.name = "ServerError";
-        this.errorNo = errorNo;
-        this.status = status;
-        Object.setPrototypeOf(this, ServerError.prototype);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class ThrottlingUtils {
-    /**
-     * Prepares a RequestThumbprint to be stored as a key.
-     * @param thumbprint
-     */
-    static generateThrottlingStorageKey(thumbprint) {
-        return `${ThrottlingConstants.THROTTLING_PREFIX}.${JSON.stringify(thumbprint)}`;
-    }
-    /**
-     * Performs necessary throttling checks before a network request.
-     * @param cacheManager
-     * @param thumbprint
-     */
-    static preProcess(cacheManager, thumbprint) {
-        const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
-        const value = cacheManager.getThrottlingCache(key);
-        if (value) {
-            if (value.throttleTime < Date.now()) {
-                cacheManager.removeItem(key);
-                return;
-            }
-            throw new ServerError(value.errorCodes?.join(" ") || Constants.EMPTY_STRING, value.errorMessage, value.subError);
-        }
-    }
-    /**
-     * Performs necessary throttling checks after a network request.
-     * @param cacheManager
-     * @param thumbprint
-     * @param response
-     */
-    static postProcess(cacheManager, thumbprint, response) {
-        if (ThrottlingUtils.checkResponseStatus(response) ||
-            ThrottlingUtils.checkResponseForRetryAfter(response)) {
-            const thumbprintValue = {
-                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
-                error: response.body.error,
-                errorCodes: response.body.error_codes,
-                errorMessage: response.body.error_description,
-                subError: response.body.suberror,
-            };
-            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue);
-        }
-    }
-    /**
-     * Checks a NetworkResponse object's status codes against 429 or 5xx
-     * @param response
-     */
-    static checkResponseStatus(response) {
-        return (response.status === 429 ||
-            (response.status >= 500 && response.status < 600));
-    }
-    /**
-     * Checks a NetworkResponse object's RetryAfter header
-     * @param response
-     */
-    static checkResponseForRetryAfter(response) {
-        if (response.headers) {
-            return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
-                (response.status < 200 || response.status >= 300));
-        }
-        return false;
-    }
-    /**
-     * Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
-     * @param throttleTime
-     */
-    static calculateThrottleTime(throttleTime) {
-        const time = throttleTime <= 0 ? 0 : throttleTime;
-        const currentSeconds = Date.now() / 1000;
-        return Math.floor(Math.min(currentSeconds +
-            (time || ThrottlingConstants.DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds +
-            ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
-    }
-    static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
-        const thumbprint = {
-            clientId: clientId,
-            authority: request.authority,
-            scopes: request.scopes,
-            homeAccountIdentifier: homeAccountIdentifier,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-        };
-        const key = this.generateThrottlingStorageKey(thumbprint);
-        cacheManager.removeItem(key);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class NetworkManager {
-    constructor(networkClient, cacheManager) {
-        this.networkClient = networkClient;
-        this.cacheManager = cacheManager;
-    }
-    /**
-     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
-     * @param thumbprint
-     * @param tokenEndpoint
-     * @param options
-     */
-    async sendPostRequest(thumbprint, tokenEndpoint, options) {
-        ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
-        let response;
-        try {
-            response = await this.networkClient.sendPostRequestAsync(tokenEndpoint, options);
-        }
-        catch (e) {
-            if (e instanceof AuthError) {
-                throw e;
-            }
-            else {
-                throw createClientAuthError(networkError);
-            }
-        }
-        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
-        return response;
-    }
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5995,10 +5857,24 @@ class RequestValidator {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+function instrumentBrokerParams(parameters, correlationId, performanceClient) {
+    if (!correlationId) {
+        return;
+    }
+    const clientId = parameters.get(CLIENT_ID);
+    if (clientId && parameters.has(BROKER_CLIENT_ID)) {
+        performanceClient?.addFields({
+            embeddedClientId: clientId,
+            embeddedRedirectUri: parameters.get(REDIRECT_URI),
+        }, correlationId);
+    }
+}
 /** @internal */
 class RequestParameterBuilder {
-    constructor() {
+    constructor(correlationId, performanceClient) {
         this.parameters = new Map();
+        this.performanceClient = performanceClient;
+        this.correlationId = correlationId;
     }
     /**
      * add response_type = code
@@ -6362,6 +6238,14 @@ class RequestParameterBuilder {
     addLogoutHint(logoutHint) {
         this.parameters.set(LOGOUT_HINT, encodeURIComponent(logoutHint));
     }
+    addBrokerParameters(params) {
+        const brokerParams = {};
+        brokerParams[BROKER_CLIENT_ID] =
+            params.brokerClientId;
+        brokerParams[BROKER_REDIRECT_URI] =
+            params.brokerRedirectUri;
+        this.addExtraQueryParameters(brokerParams);
+    }
     /**
      * Utility to create a URL from the params map
      */
@@ -6370,10 +6254,152 @@ class RequestParameterBuilder {
         this.parameters.forEach((value, key) => {
             queryParameterArray.push(`${key}=${value}`);
         });
+        instrumentBrokerParams(this.parameters, this.correlationId, this.performanceClient);
         return queryParameterArray.join("&");
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Error thrown when there is an error with the server code, for example, unavailability.
+ */
+class ServerError extends AuthError {
+    constructor(errorCode, errorMessage, subError, errorNo, status) {
+        super(errorCode, errorMessage, subError);
+        this.name = "ServerError";
+        this.errorNo = errorNo;
+        this.status = status;
+        Object.setPrototypeOf(this, ServerError.prototype);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class ThrottlingUtils {
+    /**
+     * Prepares a RequestThumbprint to be stored as a key.
+     * @param thumbprint
+     */
+    static generateThrottlingStorageKey(thumbprint) {
+        return `${ThrottlingConstants.THROTTLING_PREFIX}.${JSON.stringify(thumbprint)}`;
+    }
+    /**
+     * Performs necessary throttling checks before a network request.
+     * @param cacheManager
+     * @param thumbprint
+     */
+    static preProcess(cacheManager, thumbprint, correlationId) {
+        const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
+        const value = cacheManager.getThrottlingCache(key);
+        if (value) {
+            if (value.throttleTime < Date.now()) {
+                cacheManager.removeItem(key, correlationId);
+                return;
+            }
+            throw new ServerError(value.errorCodes?.join(" ") || Constants.EMPTY_STRING, value.errorMessage, value.subError);
+        }
+    }
+    /**
+     * Performs necessary throttling checks after a network request.
+     * @param cacheManager
+     * @param thumbprint
+     * @param response
+     */
+    static postProcess(cacheManager, thumbprint, response, correlationId) {
+        if (ThrottlingUtils.checkResponseStatus(response) ||
+            ThrottlingUtils.checkResponseForRetryAfter(response)) {
+            const thumbprintValue = {
+                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
+                error: response.body.error,
+                errorCodes: response.body.error_codes,
+                errorMessage: response.body.error_description,
+                subError: response.body.suberror,
+            };
+            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
+        }
+    }
+    /**
+     * Checks a NetworkResponse object's status codes against 429 or 5xx
+     * @param response
+     */
+    static checkResponseStatus(response) {
+        return (response.status === 429 ||
+            (response.status >= 500 && response.status < 600));
+    }
+    /**
+     * Checks a NetworkResponse object's RetryAfter header
+     * @param response
+     */
+    static checkResponseForRetryAfter(response) {
+        if (response.headers) {
+            return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
+                (response.status < 200 || response.status >= 300));
+        }
+        return false;
+    }
+    /**
+     * Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
+     * @param throttleTime
+     */
+    static calculateThrottleTime(throttleTime) {
+        const time = throttleTime <= 0 ? 0 : throttleTime;
+        const currentSeconds = Date.now() / 1000;
+        return Math.floor(Math.min(currentSeconds +
+            (time || ThrottlingConstants.DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds +
+            ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
+    }
+    static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
+        const thumbprint = {
+            clientId: clientId,
+            authority: request.authority,
+            scopes: request.scopes,
+            homeAccountIdentifier: homeAccountIdentifier,
+            claims: request.claims,
+            authenticationScheme: request.authenticationScheme,
+            resourceRequestMethod: request.resourceRequestMethod,
+            resourceRequestUri: request.resourceRequestUri,
+            shrClaims: request.shrClaims,
+            sshKid: request.sshKid,
+        };
+        const key = this.generateThrottlingStorageKey(thumbprint);
+        cacheManager.removeItem(key, request.correlationId);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Represents network related errors
+ */
+class NetworkError extends AuthError {
+    constructor(error, httpStatus, responseHeaders) {
+        super(error.errorCode, error.errorMessage, error.subError);
+        Object.setPrototypeOf(this, NetworkError.prototype);
+        this.name = "NetworkError";
+        this.error = error;
+        this.httpStatus = httpStatus;
+        this.responseHeaders = responseHeaders;
+    }
+}
+/**
+ * Creates NetworkError object for a failed network request
+ * @param error - Error to be thrown back to the caller
+ * @param httpStatus - Status code of the network request
+ * @param responseHeaders - Response headers of the network request, when available
+ * @returns NetworkError object
+ */
+function createNetworkError(error, httpStatus, responseHeaders) {
+    return new NetworkError(error, httpStatus, responseHeaders);
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6394,8 +6420,6 @@ class BaseClient {
         this.cacheManager = this.config.storageInterface;
         // Set the network interface
         this.networkClient = this.config.networkInterface;
-        // Set the NetworkManager
-        this.networkManager = new NetworkManager(this.networkClient, this.cacheManager);
         // Set TelemetryManager
         this.serverTelemetryManager = this.config.serverTelemetryManager;
         // set Authority
@@ -6439,11 +6463,7 @@ class BaseClient {
         if (queuedEvent) {
             this.performanceClient?.addQueueMeasurement(queuedEvent, correlationId);
         }
-        const response = await this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers });
-        this.performanceClient?.addFields({
-            refreshTokenSize: response.body.refresh_token?.length || 0,
-            httpVerToken: response.headers?.[HeaderNames.X_MS_HTTP_VERSION] || "",
-        }, correlationId);
+        const response = await this.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId);
         if (this.config.serverTelemetryManager &&
             response.status < 500 &&
             response.status !== 429) {
@@ -6452,6 +6472,52 @@ class BaseClient {
         }
         return response;
     }
+    /**
+     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+     * @param thumbprint - Request thumbprint for throttling
+     * @param tokenEndpoint - Endpoint to make the POST to
+     * @param options - Body and Headers to include on the POST request
+     * @param correlationId - CorrelationId for telemetry
+     */
+    async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
+        ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
+        let response;
+        try {
+            response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
+            const responseHeaders = response.headers || {};
+            this.performanceClient?.addFields({
+                refreshTokenSize: response.body.refresh_token?.length || 0,
+                httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+            }, correlationId);
+        }
+        catch (e) {
+            if (e instanceof NetworkError) {
+                const responseHeaders = e.responseHeaders;
+                if (responseHeaders) {
+                    this.performanceClient?.addFields({
+                        httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                        requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
+                            "",
+                        contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                            undefined,
+                        contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                            undefined,
+                        httpStatus: e.httpStatus,
+                    }, correlationId);
+                }
+                throw e.error;
+            }
+            if (e instanceof AuthError) {
+                throw e;
+            }
+            else {
+                throw createClientAuthError(networkError);
+            }
+        }
+        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
+        return response;
+    }
     /**
      * Updates the authority object of the client. Endpoint discovery must be completed.
      * @param updatedAuthority
@@ -6467,10 +6533,17 @@ class BaseClient {
      * @param request
      */
     createTokenQueryParameters(request) {
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
         if (request.tokenQueryParameters) {
             parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);
         }
+        parameterBuilder.addCorrelationId(request.correlationId);
         return parameterBuilder.createQueryString();
     }
 }
@@ -6922,13 +6995,13 @@ class ResponseHandler {
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key, this.logger);
+                const account = this.cacheStorage.getAccount(key, request.correlationId, this.logger);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache, request.correlationId);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, request.storeInCache);
         }
         finally {
             if (this.persistencePlugin &&
@@ -6957,7 +7030,7 @@ class ResponseHandler {
         let cachedAccount;
         if (serverTokenResponse.id_token && !!idTokenClaims) {
             cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
-            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
             this.logger);
         }
         // AccessToken
@@ -7105,7 +7178,7 @@ class ResponseHandler {
         };
     }
 }
-function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
     logger?.verbose("setCachedAccount called");
     // Check if base account is already cached
     const accountKeys = cacheStorage.getAccountKeys();
@@ -7114,7 +7187,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     });
     let cachedAccount = null;
     if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+        cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId, logger);
     }
     const baseAccount = cachedAccount ||
         AccountEntity.createAccount({
@@ -7285,8 +7358,9 @@ class AuthorizationCodeClient extends BaseClient {
      */
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);
-        const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(request.tokenBodyParameters?.[CLIENT_ID] ||
+        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+        parameterBuilder.addClientId(request.embeddedClientId ||
+            request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         /*
          * For hybrid spa flow, there will be a code but no verifier
@@ -7346,9 +7420,6 @@ class AuthorizationCodeClient extends BaseClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        const correlationId = request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
-        parameterBuilder.addCorrelationId(correlationId);
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
@@ -7388,6 +7459,12 @@ class AuthorizationCodeClient extends BaseClient {
                     break;
             }
         }
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
         if (request.tokenBodyParameters) {
             parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
         }
@@ -7406,9 +7483,13 @@ class AuthorizationCodeClient extends BaseClient {
      * @param request
      */
     async createAuthCodeUrlQueryString(request) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, request.correlationId);
-        const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(request.extraQueryParameters?.[CLIENT_ID] ||
+        // generate the correlationId if not set by the user and add
+        const correlationId = request.correlationId ||
+            this.config.cryptoInterface.createNewGuid();
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, correlationId);
+        const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
+        parameterBuilder.addClientId(request.embeddedClientId ||
+            request.extraQueryParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         const requestScopes = [
             ...(request.scopes || []),
@@ -7417,9 +7498,6 @@ class AuthorizationCodeClient extends BaseClient {
         parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);
         // validate the redirectUri (to be a non null value)
         parameterBuilder.addRedirectUri(request.redirectUri);
-        // generate the correlationId if not set by the user and add
-        const correlationId = request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
         parameterBuilder.addCorrelationId(correlationId);
         // add response_mode. If not passed in it defaults to query.
         parameterBuilder.addResponseMode(request.responseMode);
@@ -7521,6 +7599,12 @@ class AuthorizationCodeClient extends BaseClient {
                 this.config.authOptions.clientCapabilities.length > 0)) {
             parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
         }
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
         this.addExtraQueryParams(request, parameterBuilder);
         if (request.nativeBroker) {
             // signal ests that this is a WAM call
@@ -7547,7 +7631,7 @@ class AuthorizationCodeClient extends BaseClient {
      * @param request
      */
     createLogoutUrlQueryString(request) {
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
         if (request.postLogoutRedirectUri) {
             parameterBuilder.addPostLogoutRedirectUri(request.postLogoutRedirectUri);
         }
@@ -7661,7 +7745,7 @@ class RefreshTokenClient extends BaseClient {
     async acquireTokenWithCachedRefreshToken(request, foci) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
         // fetches family RT or application RT based on FOCI value
-        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
+        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined, this.performanceClient);
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(noTokensFound);
         }
@@ -7689,7 +7773,7 @@ class RefreshTokenClient extends BaseClient {
                 // Remove bad refresh token from cache
                 this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
                 const badRefreshTokenKey = generateCredentialKey(refreshToken);
-                this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+                this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
             }
             throw e;
         }
@@ -7726,8 +7810,9 @@ class RefreshTokenClient extends BaseClient {
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);
         const correlationId = request.correlationId;
-        const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(request.tokenBodyParameters?.[CLIENT_ID] ||
+        const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
+        parameterBuilder.addClientId(request.embeddedClientId ||
+            request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         if (request.redirectUri) {
             parameterBuilder.addRedirectUri(request.redirectUri);
@@ -7741,7 +7826,6 @@ class RefreshTokenClient extends BaseClient {
         if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
         }
-        parameterBuilder.addCorrelationId(correlationId);
         parameterBuilder.addRefreshToken(request.refreshToken);
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
@@ -7795,6 +7879,12 @@ class RefreshTokenClient extends BaseClient {
                     break;
             }
         }
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
         if (request.tokenBodyParameters) {
             parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
         }
@@ -7870,7 +7960,7 @@ class SilentFlowClient extends BaseClient {
         const requestTenantId = request.account.tenantId ||
             getTenantFromAuthorityString(request.authority);
         const tokenKeys = this.cacheManager.getTokenKeys();
-        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);
+        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient);
         if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
@@ -7890,9 +7980,9 @@ class SilentFlowClient extends BaseClient {
         }
         const environment = request.authority || this.authority.getPreferredCache();
         const cacheRecord = {
-            account: this.cacheManager.readAccountFromCache(request.account),
+            account: this.cacheManager.readAccountFromCache(request.account, request.correlationId),
             accessToken: cachedAccessToken,
-            idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),
+            idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId, this.performanceClient),
             refreshToken: null,
             appMetadata: this.cacheManager.readAppMetadataFromCache(environment),
         };
@@ -8142,7 +8232,7 @@ class ServerTelemetryManager {
         else {
             lastRequests.errors.push(SERVER_TELEM_CONSTANTS.UNKNOWN_ERROR);
         }
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return;
     }
     /**
@@ -8151,7 +8241,7 @@ class ServerTelemetryManager {
     incrementCacheHits() {
         const lastRequests = this.getLastRequests();
         lastRequests.cacheHits += 1;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return lastRequests.cacheHits;
     }
     /**
@@ -8175,7 +8265,7 @@ class ServerTelemetryManager {
         const errorCount = lastRequests.errors.length;
         if (numErrorsFlushed === errorCount) {
             // All errors were sent on last request, clear Telemetry cache
-            this.cacheManager.removeItem(this.telemetryCacheKey);
+            this.cacheManager.removeItem(this.telemetryCacheKey, this.correlationId);
         }
         else {
             // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
@@ -8184,7 +8274,7 @@ class ServerTelemetryManager {
                 errors: lastRequests.errors.slice(numErrorsFlushed),
                 cacheHits: 0,
             };
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity, this.correlationId);
         }
     }
     /**
@@ -8251,7 +8341,7 @@ class ServerTelemetryManager {
     setNativeBrokerErrorCode(errorCode) {
         const lastRequests = this.getLastRequests();
         lastRequests.nativeBrokerErrorCode = errorCode;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
     }
     getNativeBrokerErrorCode() {
         return this.getLastRequests().nativeBrokerErrorCode;
@@ -8259,7 +8349,7 @@ class ServerTelemetryManager {
     clearNativeBrokerErrorCode() {
         const lastRequests = this.getLastRequests();
         delete lastRequests.nativeBrokerErrorCode;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
     }
     static makeExtraSkuString(params) {
         return makeExtraSkuString(params);
@@ -8314,7 +8404,7 @@ exports.InteractionRequiredAuthErrorCodes = InteractionRequiredAuthErrorCodes;
 exports.InteractionRequiredAuthErrorMessage = InteractionRequiredAuthErrorMessage;
 exports.JsonWebTokenTypes = JsonWebTokenTypes;
 exports.Logger = Logger;
-exports.NetworkManager = NetworkManager;
+exports.NetworkError = NetworkError;
 exports.OIDC_DEFAULT_SCOPES = OIDC_DEFAULT_SCOPES;
 exports.ONE_DAY_IN_MS = ONE_DAY_IN_MS;
 exports.PasswordGrantConstants = PasswordGrantConstants;
@@ -8350,9 +8440,11 @@ exports.buildClientInfoFromHomeAccountId = buildClientInfoFromHomeAccountId;
 exports.buildStaticAuthorityOptions = buildStaticAuthorityOptions;
 exports.buildTenantProfile = buildTenantProfile;
 exports.createAuthError = createAuthError;
+exports.createCacheError = createCacheError;
 exports.createClientAuthError = createClientAuthError;
 exports.createClientConfigurationError = createClientConfigurationError;
 exports.createInteractionRequiredAuthError = createInteractionRequiredAuthError;
+exports.createNetworkError = createNetworkError;
 exports.formatAuthorityUri = formatAuthorityUri;
 exports.getClientAssertion = getClientAssertion;
 exports.getTenantIdFromIdTokenClaims = getTenantIdFromIdTokenClaims;
@@ -8361,4 +8453,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-aee3f7b6.js.map
+//# sourceMappingURL=index-node-CebvEPer.js.map