@azure/msal-common 16.8.0 → 16.10.0

package/lib/{index-node-7wFgJ2eB.js → index-node-BSFEsmmC.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.8.0 2026-06-10 */
+/*! @azure/msal-common v16.10.0 2026-06-23 */
 'use strict';
 'use strict';
 
@@ -29,7 +29,7 @@ function getDefaultErrorMessage(code) {
  * General error class thrown by the MSAL.js library.
  */
 class AuthError extends Error {
-    constructor(errorCode, errorMessage, suberror) {
+    constructor(errorCode, correlationId, errorMessage, suberror) {
         const message = errorMessage ||
             (errorCode ? getDefaultErrorMessage(errorCode) : "");
         const errorString = message ? `${errorCode}: ${message}` : errorCode;
@@ -38,14 +38,12 @@ class AuthError extends Error {
         this.errorCode = errorCode || "";
         this.errorMessage = message || "";
         this.subError = suberror || "";
-        this.name = "AuthError";
-    }
-    setCorrelationId(correlationId) {
         this.correlationId = correlationId;
+        this.name = "AuthError";
     }
 }
-function createAuthError(code, additionalMessage) {
-    return new AuthError(code, additionalMessage || getDefaultErrorMessage(code));
+function createAuthError(code, correlationId, additionalMessage) {
+    return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage(code));
 }
 
 /*
@@ -64,8 +62,6 @@ const invalidState = "invalid_state";
 const stateMismatch = "state_mismatch";
 const stateNotFound = "state_not_found";
 const nonceMismatch = "nonce_mismatch";
-const authTimeNotFound = "auth_time_not_found";
-const maxAgeTranspired = "max_age_transpired";
 const multipleMatchingTokens = "multiple_matching_tokens";
 const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
 const requestCannotBeMade = "request_cannot_be_made";
@@ -94,7 +90,6 @@ const misplacedResourceParam = "misplaced_resource_parameter";
 
 var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
-    authTimeNotFound: authTimeNotFound,
     authorizationCodeMissingFromServerResponse: authorizationCodeMissingFromServerResponse,
     bindingKeyNotRemoved: bindingKeyNotRemoved,
     cannotAppendScopeSet: cannotAppendScopeSet,
@@ -109,7 +104,6 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     invalidCacheRecord: invalidCacheRecord,
     invalidState: invalidState,
     keyIdMissing: keyIdMissing,
-    maxAgeTranspired: maxAgeTranspired,
     methodNotImplemented: methodNotImplemented,
     misplacedResourceParam: misplacedResourceParam,
     multipleMatchingAppMetadata: multipleMatchingAppMetadata,
@@ -146,14 +140,14 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
  * Error thrown when there is an error in the client code running on the browser.
  */
 class ClientAuthError extends AuthError {
-    constructor(errorCode, additionalMessage) {
-        super(errorCode, additionalMessage);
+    constructor(errorCode, correlationId, additionalMessage) {
+        super(errorCode, correlationId, additionalMessage);
         this.name = "ClientAuthError";
         Object.setPrototypeOf(this, ClientAuthError.prototype);
     }
 }
-function createClientAuthError(errorCode, additionalMessage) {
-    return new ClientAuthError(errorCode, additionalMessage);
+function createClientAuthError(errorCode, correlationId, additionalMessage) {
+    return new ClientAuthError(errorCode, correlationId, additionalMessage);
 }
 
 /*
@@ -165,8 +159,8 @@ function createClientAuthError(errorCode, additionalMessage) {
  *
  * @param encodedToken
  */
-function extractTokenClaims(encodedToken, base64Decode) {
-    const jswPayload = getJWSPayload(encodedToken);
+function extractTokenClaims(encodedToken, base64Decode, correlationId) {
+    const jswPayload = getJWSPayload(encodedToken, correlationId);
     // token will be decoded to get the username
     try {
         // base64Decode() should throw an error if there is an issue
@@ -174,7 +168,7 @@ function extractTokenClaims(encodedToken, base64Decode) {
         return JSON.parse(base64Decoded);
     }
     catch (err) {
-        throw createClientAuthError(tokenParsingError);
+        throw createClientAuthError(tokenParsingError, correlationId);
     }
 }
 /**
@@ -201,14 +195,14 @@ function isKmsi(idTokenClaims) {
  *
  * @param authToken
  */
-function getJWSPayload(authToken) {
+function getJWSPayload(authToken, correlationId) {
     if (!authToken) {
-        throw createClientAuthError(nullOrEmptyToken);
+        throw createClientAuthError(nullOrEmptyToken, correlationId);
     }
     const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
     const matches = tokenPartsRegex.exec(authToken);
     if (!matches || matches.length < 4) {
-        throw createClientAuthError(tokenParsingError);
+        throw createClientAuthError(tokenParsingError, correlationId);
     }
     /**
      * const crackedToken = {
@@ -218,25 +212,10 @@ function getJWSPayload(authToken) {
      * };
      */
     return matches[2];
-}
-/**
- * Determine if the token's max_age has transpired
- */
-function checkMaxAge(authTime, maxAge) {
-    /*
-     * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-     * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
-     * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
-     */
-    const fiveMinuteSkew = 300000; // five minutes in milliseconds
-    if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
-        throw createClientAuthError(maxAgeTranspired);
-    }
 }
 
 var AuthToken = /*#__PURE__*/Object.freeze({
     __proto__: null,
-    checkMaxAge: checkMaxAge,
     extractTokenClaims: extractTokenClaims,
     getJWSPayload: getJWSPayload,
     isKmsi: isKmsi
@@ -332,14 +311,14 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
  * Error thrown when there is an error in configuration of the MSAL.js library.
  */
 class ClientConfigurationError extends AuthError {
-    constructor(errorCode) {
-        super(errorCode);
+    constructor(errorCode, correlationId) {
+        super(errorCode, correlationId);
         this.name = "ClientConfigurationError";
         Object.setPrototypeOf(this, ClientConfigurationError.prototype);
     }
 }
-function createClientConfigurationError(errorCode) {
-    return new ClientConfigurationError(errorCode);
+function createClientConfigurationError(errorCode, correlationId) {
+    return new ClientConfigurationError(errorCode, correlationId);
 }
 
 /*
@@ -454,8 +433,8 @@ const AUTHORIZATION_PENDING = "authorization_pending";
 const NOT_APPLICABLE = "N/A";
 const NOT_AVAILABLE = "Not Available";
 const FORWARD_SLASH = "/";
-const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute/location";
-const IMDS_VERSION = "2020-06-01";
+const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute";
+const IMDS_VERSION = "2021-02-01";
 const IMDS_TIMEOUT = 2000;
 const AZURE_REGION_AUTO_DISCOVER_FLAG = "TryAutoDetect";
 const REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX = "login.microsoft.com";
@@ -529,6 +508,9 @@ const AADAuthority = {
 const ClaimsRequestKeys = {
     ACCESS_TOKEN: "access_token",
     XMS_CC: "xms_cc",
+    ID_TOKEN: "id_token",
+    SIGNIN_STATE: "signin_state",
+    LOGIN_HINT: "login_hint",
 };
 /**
  * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
@@ -577,6 +559,7 @@ const GrantType = {
     REFRESH_TOKEN_GRANT: "refresh_token",
     DEVICE_CODE_GRANT: "device_code",
     JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    USER_FIC: "user_fic",
 };
 /**
  * Account types in Cache
@@ -830,11 +813,12 @@ class UrlString {
     get urlString() {
         return this._urlString;
     }
-    constructor(url) {
+    constructor(url, correlationId) {
         this._urlString = url;
+        this.correlationId = correlationId;
         if (!this._urlString) {
             // Throws error if url is empty
-            throw createClientConfigurationError(urlEmptyError);
+            throw createClientConfigurationError(urlEmptyError, correlationId);
         }
         if (!url.includes("#")) {
             this._urlString = UrlString.canonicalizeUri(url);
@@ -870,16 +854,16 @@ class UrlString {
             components = this.getUrlComponents();
         }
         catch (e) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, this.correlationId);
         }
         // Throw error if URI or path segments are not parseable.
         if (!components.HostNameAndPort || !components.PathSegments) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, this.correlationId);
         }
         // Throw error if uri is insecure.
         if (!components.Protocol ||
             components.Protocol.toLowerCase() !== "https:") {
-            throw createClientConfigurationError(authorityUriInsecure);
+            throw createClientConfigurationError(authorityUriInsecure, this.correlationId);
         }
     }
     /**
@@ -916,7 +900,7 @@ class UrlString {
                 pathArray[0] === AADAuthority.ORGANIZATIONS)) {
             pathArray[0] = tenantId;
         }
-        return UrlString.constructAuthorityUriFromObject(urlObject);
+        return UrlString.constructAuthorityUriFromObject(urlObject, this.correlationId);
     }
     /**
      * Parses out the components from a url string.
@@ -928,7 +912,7 @@ class UrlString {
         // If url string does not match regEx, we throw an error
         const match = this.urlString.match(regEx);
         if (!match) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, this.correlationId);
         }
         // Url component object
         const urlComponents = {
@@ -946,17 +930,17 @@ class UrlString {
         }
         return urlComponents;
     }
-    static getDomainFromUrl(url) {
+    static getDomainFromUrl(url, correlationId) {
         const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
         const match = url.match(regEx);
         if (!match) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, correlationId);
         }
         return match[2];
     }
-    static getAbsoluteUrl(relativeUrl, baseUrl) {
+    static getAbsoluteUrl(relativeUrl, baseUrl, correlationId) {
         if (relativeUrl[0] === FORWARD_SLASH) {
-            const url = new UrlString(baseUrl);
+            const url = new UrlString(baseUrl, correlationId);
             const baseComponents = url.getUrlComponents();
             return (baseComponents.Protocol +
                 "//" +
@@ -965,12 +949,12 @@ class UrlString {
         }
         return relativeUrl;
     }
-    static constructAuthorityUriFromObject(urlObject) {
+    static constructAuthorityUriFromObject(urlObject, correlationId) {
         return new UrlString(urlObject.Protocol +
             "//" +
             urlObject.HostNameAndPort +
             "/" +
-            urlObject.PathSegments.join("/"));
+            urlObject.PathSegments.join("/"), correlationId);
     }
 }
 
@@ -1088,7 +1072,7 @@ function getAliasesFromStaticSources(staticAuthorityOptions, logger, correlation
     let staticAliases;
     const canonicalAuthority = staticAuthorityOptions.canonicalAuthority;
     if (canonicalAuthority) {
-        const authorityHost = new UrlString(canonicalAuthority).getUrlComponents().HostNameAndPort;
+        const authorityHost = new UrlString(canonicalAuthority, correlationId).getUrlComponents().HostNameAndPort;
         staticAliases =
             getAliasesFromMetadata(logger, correlationId, authorityHost, staticAuthorityOptions.cloudDiscoveryMetadata?.metadata, AuthorityMetadataSource.CONFIG) ||
                 getAliasesFromMetadata(logger, correlationId, authorityHost, InstanceDiscoveryMetadata.metadata, AuthorityMetadataSource.HARDCODED_VALUES) ||
@@ -1415,9 +1399,12 @@ class RegionDiscovery {
             try {
                 const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(IMDS_VERSION, options);
                 if (localIMDSVersionResponse.status === HTTP_SUCCESS) {
-                    autodetectedRegionName = localIMDSVersionResponse.body;
-                    regionDiscoveryMetadata.region_source =
-                        RegionDiscoverySources.IMDS;
+                    autodetectedRegionName =
+                        localIMDSVersionResponse.body?.location;
+                    if (autodetectedRegionName) {
+                        regionDiscoveryMetadata.region_source =
+                            RegionDiscoverySources.IMDS;
+                    }
                 }
                 // If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
                 if (localIMDSVersionResponse.status ===
@@ -1432,9 +1419,11 @@ class RegionDiscovery {
                     if (currentIMDSVersionResponse.status ===
                         HTTP_SUCCESS) {
                         autodetectedRegionName =
-                            currentIMDSVersionResponse.body;
-                        regionDiscoveryMetadata.region_source =
-                            RegionDiscoverySources.IMDS;
+                            currentIMDSVersionResponse.body?.location;
+                        if (autodetectedRegionName) {
+                            regionDiscoveryMetadata.region_source =
+                                RegionDiscoverySources.IMDS;
+                        }
                     }
                 }
             }
@@ -1458,11 +1447,12 @@ class RegionDiscovery {
     /**
      * Make the call to the IMDS endpoint
      *
-     * @param imdsEndpointUrl
-     * @returns Promise<NetworkResponse<string>>
+     * @param version
+     * @param options
+     * @returns Promise<NetworkResponse<ImdsComputeResponse>>
      */
     async getRegionFromIMDS(version, options) {
-        return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}&format=text`, options, IMDS_TIMEOUT);
+        return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}`, options, IMDS_TIMEOUT);
     }
     /**
      * Get the most recent version of the IMDS endpoint available
@@ -1610,7 +1600,7 @@ function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tena
  * @param expiresOn
  * @param extExpiresOn
  */
-function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, correlationId, refreshOn, tokenType, userAssertionHash, keyId, additionalCacheKeyComponents) {
     const atEntity = {
         homeAccountId: homeAccountId,
         credentialType: CredentialType.ACCESS_TOKEN,
@@ -1642,9 +1632,9 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
         switch (atEntity.tokenType) {
             case AuthenticationScheme.POP:
                 // Make sure keyId is present and add it to credential
-                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                const tokenClaims = extractTokenClaims(accessToken, base64Decode, correlationId);
                 if (!tokenClaims?.cnf?.kid) {
-                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt, correlationId);
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
                 break;
@@ -1652,6 +1642,11 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
                 atEntity.keyId = keyId;
         }
     }
+    /* Additional cache key components for cache isolation (e.g., FMI path) */
+    if (additionalCacheKeyComponents &&
+        Object.keys(additionalCacheKeyComponents).length > 0) {
+        atEntity.additionalCacheKeyComponents = additionalCacheKeyComponents;
+    }
     return atEntity;
 }
 /**
@@ -1811,6 +1806,7 @@ function generateAuthorityMetadataExpiresAt() {
     return (nowSeconds() +
         AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
 }
+/** @internal */
 function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
     authorityMetadata.authorization_endpoint =
         updatedValues.authorization_endpoint;
@@ -1820,6 +1816,7 @@ function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromN
     authorityMetadata.endpointsFromNetwork = fromNetwork;
     authorityMetadata.jwks_uri = updatedValues.jwks_uri;
 }
+/** @internal */
 function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
     authorityMetadata.aliases = updatedValues.aliases;
     authorityMetadata.preferred_cache = updatedValues.preferred_cache;
@@ -1828,6 +1825,7 @@ function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetw
 }
 /**
  * Returns whether or not the data needs to be refreshed
+ * @internal
  */
 function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
@@ -1881,7 +1879,7 @@ class Authority {
         this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
     }
     /**
-     * Get {@link AuthorityType}
+     * Get {@link AuthorityType:type}
      * @param authorityUri {@link IUri}
      * @private
      */
@@ -1927,7 +1925,7 @@ class Authority {
      * Sets canonical authority.
      */
     set canonicalAuthority(url) {
-        this._canonicalAuthority = new UrlString(url);
+        this._canonicalAuthority = new UrlString(url, this.correlationId);
         this._canonicalAuthority.validateAsUri();
         this._canonicalAuthorityUrlComponents = null;
     }
@@ -1961,7 +1959,7 @@ class Authority {
             return this.replacePath(this.metadata.authorization_endpoint);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -1972,7 +1970,7 @@ class Authority {
             return this.replacePath(this.metadata.token_endpoint);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     get deviceCodeEndpoint() {
@@ -1980,7 +1978,7 @@ class Authority {
             return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -1990,12 +1988,12 @@ class Authority {
         if (this.discoveryComplete()) {
             // ROPC policies may not have end_session_endpoint set
             if (!this.metadata.end_session_endpoint) {
-                throw createClientAuthError(endSessionEndpointNotSupported);
+                throw createClientAuthError(endSessionEndpointNotSupported, this.correlationId);
             }
             return this.replacePath(this.metadata.end_session_endpoint);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -2006,7 +2004,7 @@ class Authority {
             return this.replacePath(this.metadata.issuer);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -2017,7 +2015,7 @@ class Authority {
             return this.replacePath(this.metadata.jwks_uri);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -2044,7 +2042,7 @@ class Authority {
      */
     replacePath(urlString) {
         let endpoint = urlString;
-        const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
+        const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority, this.correlationId);
         const cachedAuthorityUrlComponents = cachedAuthorityUrl.getUrlComponents();
         const cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
         const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
@@ -2052,7 +2050,7 @@ class Authority {
             let cachedPart = cachedAuthorityParts[index];
             if (index === 0 &&
                 this.canReplaceTenant(cachedAuthorityUrlComponents)) {
-                const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
+                const tenantId = new UrlString(this.metadata.authorization_endpoint, this.correlationId).getUrlComponents().PathSegments[0];
                 /**
                  * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
                  * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
@@ -2186,7 +2184,7 @@ class Authority {
         }
         else {
             // Metadata could not be obtained from the config, cache, network or hardcoded values
-            throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint);
+            throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint, this.correlationId);
         }
     }
     /**
@@ -2238,7 +2236,7 @@ class Authority {
      * @param metadataEntity
      */
     isAuthoritySameType(metadataEntity) {
-        const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority);
+        const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority, this.correlationId);
         const cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
         return (cachedParts.length ===
             this.canonicalAuthorityUrlComponents.PathSegments.length);
@@ -2252,7 +2250,7 @@ class Authority {
                 return JSON.parse(this.authorityOptions.authorityMetadata);
             }
             catch (e) {
-                throw createClientConfigurationError(invalidAuthorityMetadata);
+                throw createClientConfigurationError(invalidAuthorityMetadata, this.correlationId);
             }
         }
         return null;
@@ -2308,7 +2306,7 @@ class Authority {
                     RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
                 this.regionDiscoveryMetadata.region_used =
                     userConfiguredAzureRegion;
-                return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
+                return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion, this.correlationId);
             }
             const autodetectedRegionName = await invokeAsync(this.regionDiscovery.detectRegion.bind(this.regionDiscovery), RegionDiscoveryDetectRegion, this.logger, this.performanceClient, this.correlationId)(this.authorityOptions.azureRegionConfiguration
                 ?.environmentRegion, this.regionDiscoveryMetadata);
@@ -2317,7 +2315,7 @@ class Authority {
                     RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
                 this.regionDiscoveryMetadata.region_used =
                     autodetectedRegionName;
-                return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
+                return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName, this.correlationId);
             }
             this.regionDiscoveryMetadata.region_outcome =
                 RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
@@ -2342,7 +2340,7 @@ class Authority {
             return AuthorityMetadataSource.NETWORK;
         }
         // Metadata could not be obtained from the config, cache, network or hardcoded values
-        throw createClientConfigurationError(untrustedAuthority);
+        throw createClientConfigurationError(untrustedAuthority, this.correlationId);
     }
     updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
         this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration", this.correlationId);
@@ -2406,7 +2404,7 @@ class Authority {
             }
             catch (e) {
                 this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error.", this.correlationId);
-                throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+                throw createClientConfigurationError(invalidCloudDiscoveryMetadata, this.correlationId);
             }
         }
         // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
@@ -2484,8 +2482,7 @@ class Authority {
         const normalizedHost = host.toLowerCase();
         const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
             return (authority &&
-                UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                    normalizedHost);
+                UrlString.getDomainFromUrl(authority, this.correlationId).toLowerCase() === normalizedHost);
         });
         return matches.length > 0;
     }
@@ -2529,7 +2526,7 @@ class Authority {
             return this.metadata.preferred_cache;
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -2572,7 +2569,7 @@ class Authority {
      */
     validateIssuer(issuer) {
         if (!issuer) {
-            throw createClientConfigurationError(issuerValidationFailed);
+            throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
         }
         // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
         let issuerUrl;
@@ -2580,7 +2577,7 @@ class Authority {
             issuerUrl = new URL(issuer);
         }
         catch {
-            throw createClientConfigurationError(issuerValidationFailed);
+            throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
         }
         const issuerScheme = issuerUrl.protocol;
         const issuerHost = issuerUrl.host;
@@ -2618,7 +2615,7 @@ class Authority {
             return;
         }
         // issuer validation fails if none of the above rules are satisfied
-        throw createClientConfigurationError(issuerValidationFailed);
+        throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
     }
     /**
      * Rule 1: The issuer scheme + host (and port) match the authority's. Path
@@ -2706,9 +2703,9 @@ class Authority {
      * @param host string
      * @param region string
      */
-    static buildRegionalAuthorityString(host, region, queryString) {
+    static buildRegionalAuthorityString(host, region, correlationId, queryString) {
         // Create and validate a Url string object with the initial authority string
-        const authorityUrlInstance = new UrlString(host);
+        const authorityUrlInstance = new UrlString(host, correlationId);
         authorityUrlInstance.validateAsUri();
         const authorityUrlParts = authorityUrlInstance.getUrlComponents();
         let hostNameAndPort = `${region}.${authorityUrlParts.HostNameAndPort}`;
@@ -2719,7 +2716,7 @@ class Authority {
         const url = UrlString.constructAuthorityUriFromObject({
             ...authorityUrlInstance.getUrlComponents(),
             HostNameAndPort: hostNameAndPort,
-        }).urlString;
+        }, correlationId).urlString;
         // Add the query string if a query string was provided
         if (queryString)
             return `${url}?${queryString}`;
@@ -2731,15 +2728,15 @@ class Authority {
      * @param metadata OpenIdConfigResponse
      * @param azureRegion string
      */
-    static replaceWithRegionalInformation(metadata, azureRegion) {
+    static replaceWithRegionalInformation(metadata, azureRegion, correlationId) {
         const regionalMetadata = { ...metadata };
         regionalMetadata.authorization_endpoint =
-            Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
+            Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion, correlationId);
         regionalMetadata.token_endpoint =
-            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
+            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion, correlationId);
         if (regionalMetadata.end_session_endpoint) {
             regionalMetadata.end_session_endpoint =
-                Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
+                Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion, correlationId);
         }
         return regionalMetadata;
     }
@@ -2752,9 +2749,9 @@ class Authority {
      *
      * @param authority
      */
-    static transformCIAMAuthority(authority) {
+    static transformCIAMAuthority(authority, correlationId) {
         let ciamAuthority = authority;
-        const authorityUrl = new UrlString(authority);
+        const authorityUrl = new UrlString(authority, correlationId);
         const authorityUrlComponents = authorityUrl.getUrlComponents();
         // check if transformation is needed
         if (authorityUrlComponents.PathSegments.length === 0 &&
@@ -2776,8 +2773,8 @@ Authority.reservedTenantDomains = new Set([
 /**
  * Extract tenantId from authority
  */
-function getTenantFromAuthorityString(authority) {
-    const authorityUrl = new UrlString(authority);
+function getTenantFromAuthorityString(authority, correlationId) {
+    const authorityUrl = new UrlString(authority, correlationId);
     const authorityUrlComponents = authorityUrl.getUrlComponents();
     /**
      * For credential matching purposes, tenantId is the last path segment of the authority URL:
@@ -2810,7 +2807,7 @@ function buildStaticAuthorityOptions(authOptions) {
             cloudDiscoveryMetadata = JSON.parse(rawCloudDiscoveryMetadata);
         }
         catch (e) {
-            throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+            throw createClientConfigurationError(invalidCloudDiscoveryMetadata, "");
         }
     }
     return {
@@ -2842,7 +2839,7 @@ function buildStaticAuthorityOptions(authOptions) {
  * @internal
  */
 async function createDiscoveredInstance(authorityUri, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient) {
-    const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri));
+    const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri), correlationId);
     // Initialize authority and perform discovery endpoint check.
     const acquireTokenAuthority = new Authority(authorityUriFinal, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient);
     try {
@@ -2850,7 +2847,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
         return acquireTokenAuthority;
     }
     catch (e) {
-        throw createClientAuthError(endpointResolutionError);
+        throw createClientAuthError(endpointResolutionError, correlationId);
     }
 }
 
@@ -2900,7 +2897,7 @@ function getDeserializedResponse(responseString) {
         }
     }
     catch (e) {
-        throw createClientAuthError(hashNotDeserialized);
+        throw createClientAuthError(hashNotDeserialized, "");
     }
     return null;
 }
@@ -2957,7 +2954,7 @@ function normalizeUrlForComparison(url, logger, correlationId) {
     }
     catch (e) {
         logger?.error(`Failed to normalize URL for comparison: '${e}'`, correlationId || "");
-        throw createClientConfigurationError(urlParseError);
+        throw createClientConfigurationError(urlParseError, correlationId || "");
     }
 }
 /**
@@ -2975,7 +2972,7 @@ function validateUrl(url, logger, correlationId) {
     }
     catch (e) {
         logger?.error(`Failed to validate URL: '${e}'`, correlationId || "");
-        throw createClientConfigurationError(urlParseError);
+        throw createClientConfigurationError(urlParseError, correlationId || "");
     }
 }
 
@@ -3051,7 +3048,11 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
-const CLI_DATA = "clidata";
+const CLI_DATA = "clidata";
+const USER_FEDERATED_IDENTITY_CREDENTIAL = "user_federated_identity_credential";
+const USERNAME = "username";
+const USER_ID = "user_id";
+const FMI_PATH = "fmi_path";
 
 var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -3078,6 +3079,7 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     ERROR: ERROR,
     ERROR_DESCRIPTION: ERROR_DESCRIPTION,
     EXPIRES_IN: EXPIRES_IN,
+    FMI_PATH: FMI_PATH,
     FOCI: FOCI,
     GRANT_TYPE: GRANT_TYPE,
     ID_TOKEN: ID_TOKEN,
@@ -3105,6 +3107,9 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     SID: SID,
     STATE: STATE,
     TOKEN_TYPE: TOKEN_TYPE,
+    USERNAME: USERNAME,
+    USER_FEDERATED_IDENTITY_CREDENTIAL: USER_FEDERATED_IDENTITY_CREDENTIAL,
+    USER_ID: USER_ID,
     X_APP_NAME: X_APP_NAME,
     X_APP_VER: X_APP_VER,
     X_CLIENT_CPU: X_CLIENT_CPU,
@@ -3128,14 +3133,14 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
  */
 function buildClientInfo(rawClientInfo, base64Decode) {
     if (!rawClientInfo) {
-        throw createClientAuthError(clientInfoEmptyError);
+        throw createClientAuthError(clientInfoEmptyError, "");
     }
     try {
         const decodedClientInfo = base64Decode(rawClientInfo);
         return JSON.parse(decodedClientInfo);
     }
     catch (e) {
-        throw createClientAuthError(clientInfoDecodingError);
+        throw createClientAuthError(clientInfoDecodingError, "");
     }
 }
 /**
@@ -3144,7 +3149,7 @@ function buildClientInfo(rawClientInfo, base64Decode) {
  */
 function buildClientInfoFromHomeAccountId(homeAccountId) {
     if (!homeAccountId) {
-        throw createClientAuthError(clientInfoDecodingError);
+        throw createClientAuthError(clientInfoDecodingError, "");
     }
     const clientInfoParts = homeAccountId.split(CLIENT_INFO_SEPARATOR, 2);
     return {
@@ -3173,10 +3178,11 @@ function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
  * @param homeAccountId - Home account identifier for this account object
  * @param localAccountId - Local account identifer for this account object
  * @param tenantId - Full tenant or organizational id that this account belongs to
+ * @param nativeAccountId - Native account identifier for this tenant
  * @param idTokenClaims - Claims from the ID token
  * @returns
  */
-function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
+function buildTenantProfile(homeAccountId, localAccountId, tenantId, nativeAccountId, idTokenClaims) {
     if (idTokenClaims) {
         const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint, } = idTokenClaims;
         /**
@@ -3194,6 +3200,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
             upn: upn,
+            ...(nativeAccountId && { nativeAccountId }),
         };
     }
     else {
@@ -3202,6 +3209,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             localAccountId,
             username: "",
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            ...(nativeAccountId && { nativeAccountId }),
         };
     }
 }
@@ -3223,12 +3231,13 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     if (idTokenClaims) {
         // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
+        const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, updatedAccountInfo.nativeAccountId, idTokenClaims);
         updatedAccountInfo = {
             ...updatedAccountInfo,
             ...claimsSourcedTenantProfile,
             idTokenClaims: idTokenClaims,
             idToken: idTokenSecret,
+            kmsi: isKmsi(idTokenClaims),
         };
         return updatedAccountInfo;
     }
@@ -3262,6 +3271,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
  */
 /**
  * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+ * @internal
  */
 function generateAccountId(accountEntity) {
     const accountId = [
@@ -3272,6 +3282,7 @@ function generateAccountId(accountEntity) {
 }
 /**
  * Returns the AccountInfo interface for this account.
+ * @internal
  */
 function getAccountInfo(accountEntity) {
     const tenantProfiles = accountEntity.tenantProfiles || [];
@@ -3279,8 +3290,11 @@ function getAccountInfo(accountEntity) {
     if (tenantProfiles.length === 0 &&
         accountEntity.realm &&
         accountEntity.localAccountId) {
-        tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm));
+        tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm, accountEntity.nativeAccountId));
     }
+    // Resolve nativeAccountId from the home tenant profile first, fall back to top-level (deprecated) for old cache entries
+    const homeTenantProfile = tenantProfiles.find((tp) => tp.tenantId === accountEntity.realm);
+    const nativeAccountId = homeTenantProfile?.nativeAccountId || accountEntity.nativeAccountId;
     return {
         homeAccountId: accountEntity.homeAccountId,
         environment: accountEntity.environment,
@@ -3289,7 +3303,7 @@ function getAccountInfo(accountEntity) {
         localAccountId: accountEntity.localAccountId,
         loginHint: accountEntity.loginHint,
         name: accountEntity.name,
-        nativeAccountId: accountEntity.nativeAccountId,
+        nativeAccountId: nativeAccountId,
         authorityType: accountEntity.authorityType,
         // Deserialize tenant profiles array into a Map
         tenantProfiles: new Map(tenantProfiles.map((tenantProfile) => {
@@ -3300,6 +3314,7 @@ function getAccountInfo(accountEntity) {
 }
 /**
  * Returns true if the account entity is in single tenant format (outdated), false otherwise
+ * @internal
  */
 function isSingleTenant(accountEntity) {
     return !accountEntity.tenantProfiles;
@@ -3307,8 +3322,9 @@ function isSingleTenant(accountEntity) {
 /**
  * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
  * @param accountDetails
+ * @internal
  */
-function createAccountEntity(accountDetails, authority, base64Decode) {
+function createAccountEntity(accountDetails, authority, correlationId, base64Decode) {
     let authorityType;
     if (authority.authorityType === AuthorityType.Adfs) {
         authorityType = CACHE_ACCOUNT_TYPE_ADFS;
@@ -3330,7 +3346,7 @@ function createAccountEntity(accountDetails, authority, base64Decode) {
     const env = accountDetails.environment ||
         (authority && authority.getPreferredCache());
     if (!env) {
-        throw createClientAuthError(invalidCacheEnvironment);
+        throw createClientAuthError(invalidCacheEnvironment, correlationId);
     }
     /*
      * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
@@ -3357,7 +3373,7 @@ function createAccountEntity(accountDetails, authority, base64Decode) {
         tenantProfiles = accountDetails.tenantProfiles;
     }
     else {
-        const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.idTokenClaims);
+        const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.nativeAccountId, accountDetails.idTokenClaims);
         tenantProfiles = [tenantProfile];
     }
     return {
@@ -3385,6 +3401,7 @@ function createAccountEntity(accountDetails, authority, base64Decode) {
  * @param cloudGraphHostName
  * @param msGraphHost
  * @returns
+ * @internal
  */
 function createAccountEntityFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
     // Serialize tenant profiles map into an array
@@ -3393,7 +3410,14 @@ function createAccountEntityFromAccountInfo(accountInfo, cloudGraphHostName, msG
     if (tenantProfiles.length === 0 &&
         accountInfo.tenantId &&
         accountInfo.localAccountId) {
-        tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.idTokenClaims));
+        tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.nativeAccountId, accountInfo.idTokenClaims));
+    }
+    else if (accountInfo.nativeAccountId) {
+        // Ensure nativeAccountId is set on the matching tenant profile
+        const matchingProfile = tenantProfiles.find((tp) => tp.tenantId === accountInfo.tenantId);
+        if (matchingProfile && !matchingProfile.nativeAccountId) {
+            matchingProfile.nativeAccountId = accountInfo.nativeAccountId;
+        }
     }
     return {
         authorityType: accountInfo.authorityType || CACHE_ACCOUNT_TYPE_GENERIC,
@@ -3437,6 +3461,7 @@ function generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, co
 /**
  * Validates an entity: checks for all expected params
  * @param entity
+ * @internal
  */
 function isAccountEntity(entity) {
     if (!entity) {
@@ -3471,7 +3496,8 @@ var AccountEntityUtils = /*#__PURE__*/Object.freeze({
  * to ensure uniqueness of strings.
  */
 class ScopeSet {
-    constructor(inputScopes) {
+    constructor(inputScopes, correlationId) {
+        this.correlationId = correlationId;
         // Filter empty string and null/undefined array items
         const scopeArr = inputScopes
             ? StringUtils.trimArrayEntries([...inputScopes])
@@ -3481,7 +3507,7 @@ class ScopeSet {
             : [];
         // Check if scopes array has at least one member
         if (!filteredInput || !filteredInput.length) {
-            throw createClientConfigurationError(emptyInputScopesError);
+            throw createClientConfigurationError(emptyInputScopesError, correlationId);
         }
         this.scopes = new Set(); // Iterator in constructor not supported by IE11
         filteredInput.forEach((scope) => this.scopes.add(scope));
@@ -3492,22 +3518,22 @@ class ScopeSet {
      * @param appClientId
      * @param scopesRequired
      */
-    static fromString(inputScopeString) {
+    static fromString(inputScopeString, correlationId) {
         const scopeString = inputScopeString || "";
         const inputScopes = scopeString.split(" ");
-        return new ScopeSet(inputScopes);
+        return new ScopeSet(inputScopes, correlationId);
     }
     /**
      * Creates the set of scopes to search for in cache lookups
      * @param inputScopeString
      * @returns
      */
-    static createSearchScopes(inputScopeString) {
+    static createSearchScopes(inputScopeString, correlationId) {
         // Handle empty scopes by using default OIDC scopes for cache lookup
         const scopesToUse = inputScopeString && inputScopeString.length > 0
             ? inputScopeString
             : [...OIDC_DEFAULT_SCOPES];
-        const scopeSet = new ScopeSet(scopesToUse);
+        const scopeSet = new ScopeSet(scopesToUse, correlationId);
         if (!scopeSet.containsOnlyOIDCScopes()) {
             scopeSet.removeOIDCScopes();
         }
@@ -3522,7 +3548,7 @@ class ScopeSet {
      */
     containsScope(scope) {
         const lowerCaseScopes = this.printScopesLowerCase().split(" ");
-        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
+        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes, this.correlationId);
         // compare lowercase scopes
         return scope
             ? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
@@ -3569,7 +3595,7 @@ class ScopeSet {
             newScopes.forEach((newScope) => this.appendScope(newScope));
         }
         catch (e) {
-            throw createClientAuthError(cannotAppendScopeSet);
+            throw createClientAuthError(cannotAppendScopeSet, this.correlationId);
         }
     }
     /**
@@ -3578,7 +3604,7 @@ class ScopeSet {
      */
     removeScope(scope) {
         if (!scope) {
-            throw createClientAuthError(cannotRemoveEmptyScope);
+            throw createClientAuthError(cannotRemoveEmptyScope, this.correlationId);
         }
         this.scopes.delete(scope.trim());
     }
@@ -3597,7 +3623,7 @@ class ScopeSet {
      */
     unionScopeSets(otherScopes) {
         if (!otherScopes) {
-            throw createClientAuthError(emptyInputScopeSet);
+            throw createClientAuthError(emptyInputScopeSet, this.correlationId);
         }
         const unionScopes = new Set(); // Iterator in constructor not supported in IE11
         otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
@@ -3610,7 +3636,7 @@ class ScopeSet {
      */
     intersectingScopeSets(otherScopes) {
         if (!otherScopes) {
-            throw createClientAuthError(emptyInputScopeSet);
+            throw createClientAuthError(emptyInputScopeSet, this.correlationId);
         }
         // Do not allow OIDC scopes to be the only intersecting scopes
         if (!otherScopes.containsOnlyOIDCScopes()) {
@@ -3696,7 +3722,7 @@ function addNativeBroker(parameters) {
  * @param scopeSet
  * @param addOidcScopes
  */
-function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+function addScopes(parameters, scopes, correlationId, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
     // Always add openid to the scopes when adding OIDC scopes
     if (addOidcScopes &&
         !defaultScopes.includes("openid") &&
@@ -3706,7 +3732,7 @@ function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OID
     const requestScopes = addOidcScopes
         ? [...(scopes || []), ...defaultScopes]
         : scopes || [];
-    const scopeSet = new ScopeSet(requestScopes);
+    const scopeSet = new ScopeSet(requestScopes, correlationId);
     parameters.set(SCOPE, scopeSet.printScopes());
 }
 /**
@@ -3776,26 +3802,18 @@ function addSid(parameters, sid) {
  * Adds claims to request parameters, conditionally excluding clientCapabilities
  * when skipBrokerClaims is true and a brokered flow is in effect.
  * @param parameters - The request parameters map
+ * @param correlationId - The request correlation id
  * @param claims - The claims string from the request
  * @param clientCapabilities - The client capabilities from configuration
  * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
  */
-function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims) {
     // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
     const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
         ? undefined
         : clientCapabilities;
-    if (!StringUtils.isEmptyObj(claims) ||
-        (configClaims && configClaims.length > 0)) {
-        const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
-        try {
-            JSON.parse(mergedClaims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-        parameters.set(CLAIMS, mergedClaims);
-    }
+    const mergedClaims = buildMergedClaims(claims, configClaims, correlationId);
+    parameters.set(CLAIMS, mergedClaims);
 }
 /**
  * add correlationId
@@ -3866,7 +3884,7 @@ function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod)
         parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
     }
     else {
-        throw createClientConfigurationError(pkceParamsMissing);
+        throw createClientConfigurationError(pkceParamsMissing, "");
     }
 }
 /**
@@ -3972,7 +3990,23 @@ function addExtraParameters(parameters, extraParams) {
         }
     });
 }
-function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+/**
+ * Default optional idToken claims requested on all auth requests.
+ * signin_state enables KMSI detection; login_hint enables login hint propagation.
+ */
+const DEFAULT_ID_TOKEN_CLAIMS = {
+    [ClaimsRequestKeys.SIGNIN_STATE]: { essential: false },
+    [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
+};
+/**
+ * Parses claims JSON, merges default optional idToken claims (signin_state, login_hint),
+ * and appends client capabilities (xms_cc) to the access_token section.
+ * Does not overwrite idToken claims already specified by the caller.
+ * @param claims - Existing claims JSON string from the request (may be undefined)
+ * @param clientCapabilities - Client capabilities array from configuration
+ * @returns Merged claims JSON string
+ */
+function buildMergedClaims(claims, clientCapabilities, correlationId = "") {
     let mergedClaims;
     // Parse provided claims into JSON object or initialize empty object
     if (!claims) {
@@ -3980,14 +4014,31 @@ function addClientCapabilitiesToClaims(claims, clientCapabilities) {
     }
     else {
         try {
-            mergedClaims = JSON.parse(claims);
+            const parsed = JSON.parse(claims);
+            if (typeof parsed !== "object" ||
+                parsed === null ||
+                Array.isArray(parsed)) {
+                throw new Error("Claims must be a JSON object");
+            }
+            mergedClaims = parsed;
         }
         catch (e) {
-            throw createClientConfigurationError(invalidClaims);
+            throw createClientConfigurationError(invalidClaims, correlationId);
         }
     }
+    // Add default optional idToken claims
+    if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ID_TOKEN)) {
+        mergedClaims[ClaimsRequestKeys.ID_TOKEN] = {};
+    }
+    const idTokenClaims = mergedClaims[ClaimsRequestKeys.ID_TOKEN];
+    for (const [key, value] of Object.entries(DEFAULT_ID_TOKEN_CLAIMS)) {
+        if (!(key in idTokenClaims)) {
+            idTokenClaims[key] = value;
+        }
+    }
+    // Add client capabilities
     if (clientCapabilities && clientCapabilities.length > 0) {
-        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+        if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ACCESS_TOKEN)) {
             // Add access_token key to claims object
             mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
         }
@@ -4034,16 +4085,11 @@ function addSshJwk(parameters, sshJwkString) {
 /**
  * add server telemetry fields
  * @param serverTelemetryManager
+ * @internal
  */
 function addServerTelemetry(parameters, serverTelemetryManager) {
-    const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
-    const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
-    if (currentTelemetryHeader) {
-        parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
-    }
-    if (lastTelemetryHeader) {
-        parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
-    }
+    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
 }
 /**
  * Adds parameter that indicates to the server that throttling is supported
@@ -4093,7 +4139,6 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     addCliData: addCliData,
     addClientAssertion: addClientAssertion,
     addClientAssertionType: addClientAssertionType,
-    addClientCapabilitiesToClaims: addClientCapabilitiesToClaims,
     addClientId: addClientId,
     addClientInfo: addClientInfo,
     addClientSecret: addClientSecret,
@@ -4130,6 +4175,7 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     addState: addState,
     addThrottling: addThrottling,
     addUsername: addUsername,
+    buildMergedClaims: buildMergedClaims,
     instrumentBrokerParams: instrumentBrokerParams
 });
 
@@ -4139,34 +4185,34 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
  */
 const DEFAULT_CRYPTO_IMPLEMENTATION = {
     createNewGuid: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     base64Decode: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     base64Encode: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     base64UrlEncode: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     encodeKid: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async getPublicKeyThumbprint() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async removeTokenBindingKey() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async clearKeystore() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async signJwt() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async hashString() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
 };
 
@@ -4246,22 +4292,36 @@ function getAndFlushLogsFromCache(correlationId) {
     return res;
 }
 /**
- * Checks if a string is already a hashed logging string (6 alphanumeric characters)
- */
-function isHashedString(str) {
-    if (str.length !== 6) {
-        return false;
+ * Extracts the leading minification hash from a log message, if present.
+ *
+ * Minified messages are produced by the logger-minify rollup plugin and are
+ * either a bare 6-character alphanumeric hash, or that hash followed by a space
+ * and runtime variables appended for local (console) logging, e.g.
+ * "abc123 user-1 popup". Only the leading hash is returned so that telemetry
+ * never captures the appended variables. Returns null when the message is not
+ * a minified message.
+ */
+function getMessageHash(str) {
+    if (str.length < 6) {
+        return null;
     }
-    for (let i = 0; i < str.length; i++) {
+    /*
+     * If the message is longer than the hash, the hash must be delimited by a
+     * space (the separator the plugin inserts before appended variables).
+     */
+    if (str.length > 6 && str[6] !== " ") {
+        return null;
+    }
+    for (let i = 0; i < 6; i++) {
         const char = str[i];
         const isAlphaNumeric = (char >= "a" && char <= "z") ||
             (char >= "A" && char <= "Z") ||
             (char >= "0" && char <= "9");
         if (!isAlphaNumeric) {
-            return false;
+            return null;
         }
     }
-    return true;
+    return str.substring(0, 6);
 }
 /**
  * Class which facilitates logging of messages to a specific place.
@@ -4308,10 +4368,10 @@ class Logger {
      */
     logMessage(logMessage, options) {
         const correlationId = options.correlationId;
-        const isHashedInput = isHashedString(logMessage);
-        if (isHashedInput) {
+        const messageHash = getMessageHash(logMessage);
+        if (messageHash) {
             const loggedMessage = {
-                hash: logMessage,
+                hash: messageHash,
                 level: options.logLevel,
                 containsPii: options.containsPii || false,
                 milliseconds: 0, // Will be calculated in addLogToCache
@@ -4446,7 +4506,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.8.0";
+const version = "16.10.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4584,7 +4644,7 @@ class CacheManager {
         }
         const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
         if (idToken) {
-            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
+            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode, correlationId);
             if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
                 // ID token sourced claims don't match so this tenant profile is not a match
                 return null;
@@ -4647,6 +4707,11 @@ class CacheManager {
             !(tenantProfile.upn === tenantProfileFilter.upn)) {
             return false;
         }
+        if (!!tenantProfileFilter.nativeAccountId &&
+            tenantProfile.nativeAccountId !==
+                tenantProfileFilter.nativeAccountId) {
+            return false;
+        }
         return true;
     }
     idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -4684,7 +4749,7 @@ class CacheManager {
      */
     async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
         if (!cacheRecord) {
-            throw createClientAuthError(invalidCacheRecord);
+            throw createClientAuthError(invalidCacheRecord, correlationId);
         }
         try {
             if (!!cacheRecord.account) {
@@ -4729,7 +4794,7 @@ class CacheManager {
             tokenType: credential.tokenType,
         };
         const tokenKeys = this.getTokenKeys();
-        const currentScopes = ScopeSet.fromString(credential.target);
+        const currentScopes = ScopeSet.fromString(credential.target, correlationId);
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                 return;
@@ -4737,7 +4802,7 @@ class CacheManager {
             const tokenEntity = this.getAccessTokenCredential(key, correlationId);
             if (tokenEntity &&
                 this.credentialMatchesFilter(tokenEntity, accessTokenFilter, correlationId)) {
-                const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                const tokenScopeSet = ScopeSet.fromString(tokenEntity.target, correlationId);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
                     this.removeAccessToken(key, correlationId);
                 }
@@ -4771,10 +4836,6 @@ class CacheManager {
                 !this.matchRealm(entity, accountFilter.realm)) {
                 return;
             }
-            if (!!accountFilter.nativeAccountId &&
-                !this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
-                return;
-            }
             if (!!accountFilter.authorityType &&
                 !this.matchAuthorityType(entity, accountFilter.authorityType)) {
                 return;
@@ -4786,6 +4847,7 @@ class CacheManager {
                 username: accountFilter?.username,
                 loginHint: accountFilter?.loginHint,
                 upn: accountFilter?.upn,
+                nativeAccountId: accountFilter?.nativeAccountId,
             };
             const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                 return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -4839,7 +4901,8 @@ class CacheManager {
          * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
          * Resource specific refresh tokens case will be added when the support is deemed necessary
          */
-        if (!!filter.target && !this.matchTarget(entity, filter.target)) {
+        if (!!filter.target &&
+            !this.matchTarget(entity, filter.target, correlationId)) {
             return false;
         }
         // Access Token with Auth Scheme specific matching
@@ -4856,6 +4919,28 @@ class CacheManager {
                 }
             }
         }
+        // Additional cache key components matching (bidirectional isolation)
+        const entityComponents = entity.additionalCacheKeyComponents;
+        const filterComponents = filter.additionalCacheKeyComponents;
+        const entityHasComponents = !!entityComponents && Object.keys(entityComponents).length > 0;
+        const filterHasComponents = !!filterComponents && Object.keys(filterComponents).length > 0;
+        if (entityHasComponents !== filterHasComponents) {
+            return false;
+        }
+        if (entityHasComponents && filterHasComponents) {
+            const entityKeys = Object.keys(entityComponents).sort();
+            const filterKeys = Object.keys(filterComponents).sort();
+            if (entityKeys.length !== filterKeys.length) {
+                return false;
+            }
+            for (let i = 0; i < entityKeys.length; i++) {
+                if (entityKeys[i] !== filterKeys[i] ||
+                    entityComponents[entityKeys[i]] !==
+                        filterComponents[filterKeys[i]]) {
+                    return false;
+                }
+            }
+        }
         return true;
     }
     /**
@@ -5123,7 +5208,7 @@ class CacheManager {
     getAccessToken(account, request, tokenKeys, targetRealm) {
         const correlationId = request.correlationId;
         this.commonLogger.trace("CacheManager - getAccessToken called", correlationId);
-        const scopes = ScopeSet.createSearchScopes(request.scopes);
+        const scopes = ScopeSet.createSearchScopes(request.scopes, correlationId);
         const authScheme = request.authenticationScheme ||
             AuthenticationScheme.BEARER;
         /*
@@ -5314,7 +5399,7 @@ class CacheManager {
             return null;
         }
         else if (numAppMetadata > 1) {
-            throw createClientAuthError(multipleMatchingAppMetadata);
+            throw createClientAuthError(multipleMatchingAppMetadata, correlationId);
         }
         return appMetadataEntries[0];
     }
@@ -5444,15 +5529,6 @@ class CacheManager {
     matchRealm(entity, realm) {
         return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
     }
-    /**
-     * helper to match nativeAccountId
-     * @param entity
-     * @param nativeAccountId
-     * @returns boolean indicating the match result
-     */
-    matchNativeAccountId(entity, nativeAccountId) {
-        return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
-    }
     /**
      * helper to match loginHint which can be either:
      * 1. login_hint ID token claim
@@ -5496,14 +5572,14 @@ class CacheManager {
      * @param entity
      * @param target
      */
-    matchTarget(entity, target) {
+    matchTarget(entity, target, correlationId) {
         const isNotAccessTokenCredential = entity.credentialType !== CredentialType.ACCESS_TOKEN &&
             entity.credentialType !==
                 CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
         if (isNotAccessTokenCredential || !entity.target) {
             return false;
         }
-        const entityScopeSet = ScopeSet.fromString(entity.target);
+        const entityScopeSet = ScopeSet.fromString(entity.target, correlationId);
         return entityScopeSet.containsScopeSet(target);
     }
     /**
@@ -5557,73 +5633,73 @@ class CacheManager {
 /** @internal */
 class DefaultStorageClass extends CacheManager {
     async setAccount() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAccount() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     async setIdTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getIdTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     async setAccessTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAccessTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     async setRefreshTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getRefreshTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setAppMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAppMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setServerTelemetry() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getServerTelemetry() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setAuthorityMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAuthorityMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAuthorityMetadataKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setThrottlingCache() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getThrottlingCache() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     removeItem() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAccountKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getTokenKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     generateCredentialKey() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     generateAccountKey() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
 }
 
@@ -5762,10 +5838,10 @@ const DEFAULT_LOGGER_IMPLEMENTATION = {
 };
 const DEFAULT_NETWORK_IMPLEMENTATION = {
     async sendGetRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async sendPostRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
 };
 const DEFAULT_LIBRARY_INFO = {
@@ -5794,6 +5870,7 @@ const DEFAULT_TELEMETRY_OPTIONS = {
  * @param Configuration
  *
  * @returns Configuration
+ * @internal
  */
 function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
     const loggerOptions = {
@@ -5805,7 +5882,7 @@ function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions:
         systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
         loggerOptions: loggerOptions,
         storageInterface: storageImplementation ||
-            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
+            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions, name, version), new StubPerformanceClient()),
         networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
@@ -5922,7 +5999,7 @@ class PopTokenGenerator {
         // Deconstruct request to extract SHR parameters
         const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
         const resourceUrlString = resourceRequestUri
-            ? new UrlString(resourceRequestUri)
+            ? new UrlString(resourceRequestUri, request.correlationId)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
         return this.cryptoUtils.signJwt({
@@ -6033,12 +6110,11 @@ const InteractionRequiredAuthSubErrorMessage = [
  * Error thrown when user interaction is required.
  */
 class InteractionRequiredAuthError extends AuthError {
-    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
-        super(errorCode, errorMessage, subError);
+    constructor(errorCode, correlationId, errorMessage, subError, timestamp, traceId, claims, errorNo) {
+        super(errorCode, correlationId, errorMessage, subError);
         Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
         this.timestamp = timestamp || "";
         this.traceId = traceId || "";
-        this.correlationId = correlationId || "";
         this.claims = claims || "";
         this.name = "InteractionRequiredAuthError";
         this.errorNo = errorNo;
@@ -6066,8 +6142,8 @@ function isInteractionRequiredError(errorCode, errorString, subError) {
 /**
  * Creates an InteractionRequiredAuthError
  */
-function createInteractionRequiredAuthError(errorCode, errorMessage) {
-    return new InteractionRequiredAuthError(errorCode, errorMessage);
+function createInteractionRequiredAuthError(errorCode, correlationId, errorMessage) {
+    return new InteractionRequiredAuthError(errorCode, correlationId, errorMessage);
 }
 
 /*
@@ -6078,8 +6154,8 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
  * Error thrown when there is an error with the server code, for example, unavailability.
  */
 class ServerError extends AuthError {
-    constructor(errorCode, errorMessage, subError, errorNo, status) {
-        super(errorCode, errorMessage, subError);
+    constructor(errorCode, correlationId, errorMessage, subError, errorNo, status) {
+        super(errorCode, correlationId, errorMessage, subError);
         this.name = "ServerError";
         this.errorNo = errorNo;
         this.status = status;
@@ -6096,9 +6172,10 @@ class ServerError extends AuthError {
  * @param cryptoObj
  * @param userState
  * @param meta
+ * @param correlationId
  */
-function setRequestState(cryptoObj, userState, meta) {
-    const libraryState = generateLibraryState(cryptoObj, meta);
+function setRequestState(cryptoObj, userState, meta, correlationId) {
+    const libraryState = generateLibraryState(cryptoObj, correlationId, meta);
     return userState
         ? `${libraryState}${RESOURCE_DELIM}${userState}`
         : libraryState;
@@ -6106,11 +6183,12 @@ function setRequestState(cryptoObj, userState, meta) {
 /**
  * Generates the state value used by the common library.
  * @param cryptoObj
+ * @param correlationId
  * @param meta
  */
-function generateLibraryState(cryptoObj, meta) {
+function generateLibraryState(cryptoObj, correlationId, meta) {
     if (!cryptoObj) {
-        throw createClientAuthError(noCryptoObject);
+        throw createClientAuthError(noCryptoObject, correlationId);
     }
     // Create a state object containing a unique id and the timestamp of the request creation
     const stateObj = {
@@ -6126,13 +6204,14 @@ function generateLibraryState(cryptoObj, meta) {
  * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
  * @param base64Decode
  * @param state
+ * @param correlationId
  */
-function parseRequestState(base64Decode, state) {
+function parseRequestState(base64Decode, state, correlationId) {
     if (!base64Decode) {
-        throw createClientAuthError(noCryptoObject);
+        throw createClientAuthError(noCryptoObject, correlationId);
     }
     if (!state) {
-        throw createClientAuthError(invalidState);
+        throw createClientAuthError(invalidState, correlationId);
     }
     try {
         // Split the state between library state and user passed state and decode them separately
@@ -6149,7 +6228,7 @@ function parseRequestState(base64Decode, state) {
         };
     }
     catch (e) {
-        throw createClientAuthError(invalidState);
+        throw createClientAuthError(invalidState, correlationId);
     }
 }
 
@@ -6193,7 +6272,7 @@ class ResponseHandler {
             const serverErrorNo = serverResponse.error_codes?.length
                 ? serverResponse.error_codes[0]
                 : undefined;
-            const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
+            const serverError = new ServerError(serverResponse.error || "", serverResponse.correlation_id || "", errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
             // check if 500 error
             if (refreshAccessToken &&
                 serverResponse.status &&
@@ -6215,7 +6294,7 @@ class ResponseHandler {
                 return;
             }
             if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-                throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+                throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.correlation_id || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.claims || "", serverErrorNo);
             }
             throw serverError;
         }
@@ -6225,24 +6304,16 @@ class ResponseHandler {
      * @param serverTokenResponse
      * @param authority
      */
-    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
+    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId, additionalCacheKeyComponents) {
         // create an idToken object (not entity)
         let idTokenClaims;
         if (serverTokenResponse.id_token) {
-            idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode);
+            idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode, request.correlationId);
             // token nonce check (TODO: Add a warning if no nonce is given?)
             if (authCodePayload && authCodePayload.nonce) {
                 if (idTokenClaims.nonce !== authCodePayload.nonce) {
-                    throw createClientAuthError(nonceMismatch);
-                }
-            }
-            // token max_age check
-            if (request.maxAge || request.maxAge === 0) {
-                const authTime = idTokenClaims.auth_time;
-                if (!authTime) {
-                    throw createClientAuthError(authTimeNotFound);
+                    throw createClientAuthError(nonceMismatch, request.correlationId);
                 }
-                checkMaxAge(authTime, request.maxAge);
             }
         }
         // generate homeAccountId
@@ -6250,12 +6321,12 @@ class ResponseHandler {
         // save the response tokens
         let requestStateObj;
         if (!!authCodePayload && !!authCodePayload.state) {
-            requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state);
+            requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state, request.correlationId);
         }
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
             serverTokenResponse.key_id || request.sshKid || undefined;
-        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload);
+        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents);
         let cacheContext;
         try {
             if (this.persistencePlugin && this.serializableCache) {
@@ -6302,10 +6373,10 @@ class ResponseHandler {
      * @param idTokenObj
      * @param authority
      */
-    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
+    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents) {
         const env = authority.getPreferredCache();
         if (!env) {
-            throw createClientAuthError(invalidCacheEnvironment);
+            throw createClientAuthError(invalidCacheEnvironment, request.correlationId);
         }
         const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
         // IdToken: non AAD scenarios can have empty realm
@@ -6321,8 +6392,8 @@ class ResponseHandler {
         if (serverTokenResponse.access_token) {
             // If scopes not returned in server response, use request scopes
             const responseScopes = serverTokenResponse.scope
-                ? ScopeSet.fromString(serverTokenResponse.scope)
-                : new ScopeSet(request.scopes || []);
+                ? ScopeSet.fromString(serverTokenResponse.scope, request.correlationId)
+                : new ScopeSet(request.scopes || [], request.correlationId);
             /*
              * Use timestamp calculated before request
              * Server may return timestamps as strings, parse to numbers if so.
@@ -6342,7 +6413,7 @@ class ResponseHandler {
                 ? reqTimestamp + refreshIn
                 : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+            cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, request.correlationId, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, additionalCacheKeyComponents);
             // Set resource (to be used for MCP scenarios)
             const resource = request.resource || null;
             if (resource) {
@@ -6408,14 +6479,14 @@ class ResponseHandler {
                 const popTokenGenerator = new PopTokenGenerator(cryptoObj, performanceClient);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
-                    throw createClientAuthError(keyIdMissing);
+                    throw createClientAuthError(keyIdMissing, request.correlationId);
                 }
                 accessToken = await popTokenGenerator.signPopToken(secret, keyId, request);
             }
             else {
                 accessToken = cacheRecord.accessToken.secret;
             }
-            responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
+            responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target, request.correlationId).asArray();
             // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
             expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
             extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
@@ -6433,8 +6504,18 @@ class ResponseHandler {
         const tid = idTokenClaims?.tid || "";
         // for hybrid + native bridge enablement, send back the native account Id
         if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
+            // Set on deprecated top-level for downgrade compat
             cacheRecord.account.nativeAccountId =
                 serverTokenResponse?.spa_accountid;
+            // Set on the matching tenant profile (source of truth)
+            const targetTenantId = tid || cacheRecord.account.realm;
+            if (cacheRecord.account.tenantProfiles) {
+                const matchingProfile = cacheRecord.account.tenantProfiles.find((tp) => tp.tenantId === targetTenantId);
+                if (matchingProfile) {
+                    matchingProfile.nativeAccountId =
+                        serverTokenResponse.spa_accountid;
+                }
+            }
         }
         const accountInfo = cacheRecord.account
             ? updateAccountTenantProfileData(getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
@@ -6465,6 +6546,7 @@ class ResponseHandler {
         };
     }
 }
+/** @internal */
 function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
     logger?.verbose("setCachedAccount called", correlationId);
     /*
@@ -6492,14 +6574,14 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
             cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
             msGraphHost: authCodePayload?.msgraph_host,
             nativeAccountId: nativeAccountId,
-        }, authority, base64Decode);
+        }, authority, correlationId, base64Decode);
     const tenantProfiles = baseAccount.tenantProfiles || [];
     const tenantId = claimsTenantId || baseAccount.realm;
     if (tenantId &&
         !tenantProfiles.find((tenantProfile) => {
             return tenantProfile.tenantId === tenantId;
         })) {
-        const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, idTokenClaims);
+        const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, nativeAccountId, idTokenClaims);
         tenantProfiles.push(newTenantProfile);
     }
     baseAccount.tenantProfiles = tenantProfiles;
@@ -6519,7 +6601,7 @@ const CcsCredentialType = {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
+async function getClientAssertion(clientAssertion, clientId, tokenEndpoint, fmiPath) {
     if (typeof clientAssertion === "string") {
         return clientAssertion;
     }
@@ -6527,6 +6609,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
         const config = {
             clientId: clientId,
             tokenEndpoint: tokenEndpoint,
+            fmiPath: fmiPath,
         };
         return clientAssertion(config);
     }
@@ -6583,7 +6666,7 @@ class ThrottlingUtils {
                 cacheManager.removeItem(key, correlationId);
                 return;
             }
-            throw new ServerError(value.errorCodes?.join(" ") || "", value.errorMessage, value.subError);
+            throw new ServerError(value.errorCodes?.join(" ") || "", correlationId, value.errorMessage, value.subError);
         }
     }
     /**
@@ -6650,7 +6733,7 @@ class ThrottlingUtils {
  */
 class NetworkError extends AuthError {
     constructor(error, httpStatus, responseHeaders) {
-        super(error.errorCode, error.errorMessage, error.subError);
+        super(error.errorCode, error.correlationId, error.errorMessage, error.subError);
         Object.setPrototypeOf(this, NetworkError.prototype);
         this.name = "NetworkError";
         this.error = error;
@@ -6720,6 +6803,7 @@ function createTokenQueryParameters(request, clientId, redirectUri, performanceC
  * @param queryString
  * @param headers
  * @param thumbprint
+ * @internal
  */
 async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, cacheManager, networkClient, logger, performanceClient, serverTelemetryManager) {
     const response = await sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId, cacheManager, networkClient, logger, performanceClient);
@@ -6741,6 +6825,7 @@ async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, t
  * @param networkClient - Network module instance
  * @param logger - Logger instance
  * @param performanceClient - Performance client instance
+ * @internal
  */
 async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId, cacheManager, networkClient, logger, performanceClient) {
     ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
@@ -6775,7 +6860,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
             throw e;
         }
         else {
-            throw createClientAuthError(networkError);
+            throw createClientAuthError(networkError, correlationId);
         }
     }
     ThrottlingUtils.postProcess(cacheManager, thumbprint, response, correlationId);
@@ -6828,7 +6913,7 @@ class AuthorizationCodeClient {
      */
     async acquireToken(request, apiId, authCodePayload) {
         if (!request.code) {
-            throw createClientAuthError(requestCannotBeMade);
+            throw createClientAuthError(requestCannotBeMade, request.correlationId);
         }
         // Check for new cloud instance
         if (authCodePayload && authCodePayload.cloud_instance_host_name) {
@@ -6851,7 +6936,7 @@ class AuthorizationCodeClient {
     getLogoutUri(logoutRequest) {
         // Throw error if logoutRequest is null/undefined
         if (!logoutRequest) {
-            throw createClientConfigurationError(logoutRequestEmpty);
+            throw createClientConfigurationError(logoutRequestEmpty, "");
         }
         const queryString = this.createLogoutUrlQueryString(logoutRequest);
         // Construct logout URI
@@ -6899,7 +6984,7 @@ class AuthorizationCodeClient {
         if (!this.includeRedirectUri) {
             // Just validate
             if (!request.redirectUri) {
-                throw createClientConfigurationError(redirectUriEmpty);
+                throw createClientConfigurationError(redirectUriEmpty, request.correlationId);
             }
         }
         else {
@@ -6907,7 +6992,7 @@ class AuthorizationCodeClient {
             addRedirectUri(parameters, request.redirectUri);
         }
         // Add scope array, parameter builder will add default scopes and dedupe
-        addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+        addScopes(parameters, request.scopes, request.correlationId, true, this.oidcDefaultScopes);
         addResource(parameters, request.resource);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
@@ -6950,7 +7035,7 @@ class AuthorizationCodeClient {
                 addSshJwk(parameters, request.sshJwk);
             }
             else {
-                throw createClientConfigurationError(missingSshJwk);
+                throw createClientConfigurationError(missingSshJwk, request.correlationId);
             }
         }
         let ccsCred = undefined;
@@ -7001,7 +7086,7 @@ class AuthorizationCodeClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+        addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
     /**
@@ -7089,11 +7174,11 @@ class RefreshTokenClient {
     async acquireTokenByRefreshToken(request, apiId) {
         // Cannot renew token if no request object is given.
         if (!request) {
-            throw createClientConfigurationError(tokenRequestEmpty);
+            throw createClientConfigurationError(tokenRequestEmpty, "");
         }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
-            throw createClientAuthError(noAccountInSilentRequest);
+            throw createClientAuthError(noAccountInSilentRequest, request.correlationId);
         }
         // try checking if FOCI is enabled for the given application
         const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, request.correlationId);
@@ -7130,7 +7215,7 @@ class RefreshTokenClient {
         // fetches family RT or application RT based on FOCI value
         const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined);
         if (!refreshToken) {
-            throw createInteractionRequiredAuthError(noTokensFound);
+            throw createInteractionRequiredAuthError(noTokensFound, request.correlationId);
         }
         if (refreshToken.expiresOn) {
             const offset = request.refreshTokenExpirationOffsetSeconds ||
@@ -7140,7 +7225,7 @@ class RefreshTokenClient {
                 rtOffsetSeconds: offset,
             }, request.correlationId);
             if (isTokenExpired(refreshToken.expiresOn, offset)) {
-                throw createInteractionRequiredAuthError(refreshTokenExpired);
+                throw createInteractionRequiredAuthError(refreshTokenExpired, request.correlationId);
             }
         }
         // attach cached RT size to the current measurement
@@ -7194,7 +7279,7 @@ class RefreshTokenClient {
         if (request.redirectUri) {
             addRedirectUri(parameters, request.redirectUri);
         }
-        addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addScopes(parameters, request.scopes, request.correlationId, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
         addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
         addClientInfo(parameters);
         addLibraryInfo(parameters, this.config.libraryInfo);
@@ -7230,7 +7315,7 @@ class RefreshTokenClient {
                 addSshJwk(parameters, request.sshJwk);
             }
             else {
-                throw createClientConfigurationError(missingSshJwk);
+                throw createClientConfigurationError(missingSshJwk, request.correlationId);
             }
         }
         if (this.config.systemOptions.preventCorsPreflight &&
@@ -7259,7 +7344,7 @@ class RefreshTokenClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+        addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
 }
@@ -7297,32 +7382,32 @@ class SilentFlowClient {
         if (request.forceRefresh || !StringUtils.isEmptyObj(request.claims)) {
             // Must refresh due to present force_refresh flag.
             this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
-            throw createClientAuthError(noAccountInSilentRequest);
+            throw createClientAuthError(noAccountInSilentRequest, request.correlationId);
         }
         const requestTenantId = request.account.tenantId ||
-            getTenantFromAuthorityString(request.authority);
+            getTenantFromAuthorityString(request.authority, request.correlationId);
         const tokenKeys = this.cacheManager.getTokenKeys();
         const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
         if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
             isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
             // must refresh due to the expires_in value
             this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         else if (request.resource) {
             // cached access token must have a resource that matches the request resource for MCP scenarios
             if (cachedAccessToken.resource !== request.resource) {
                 this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
-                throw createClientAuthError(tokenRefreshRequired);
+                throw createClientAuthError(tokenRefreshRequired, request.correlationId);
             }
         }
         else if (cachedAccessToken.refreshOn &&
@@ -7364,15 +7449,7 @@ class SilentFlowClient {
     async generateResultFromCacheRecord(cacheRecord, request) {
         let idTokenClaims;
         if (cacheRecord.idToken) {
-            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
-        }
-        // token max_age check
-        if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenClaims?.auth_time;
-            if (!authTime) {
-                throw createClientAuthError(authTimeNotFound);
-            }
-            checkMaxAge(authTime, request.maxAge);
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode, request.correlationId);
         }
         return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
     }
@@ -7383,11 +7460,12 @@ class SilentFlowClient {
  * Licensed under the MIT License.
  */
 const StubbedNetworkModule = {
+    // Module-level singleton: no per-request correlationId available
     sendGetRequestAsync: () => {
-        return Promise.reject(createClientAuthError(methodNotImplemented));
+        return Promise.reject(createClientAuthError(methodNotImplemented, ""));
     },
     sendPostRequestAsync: () => {
-        return Promise.reject(createClientAuthError(methodNotImplemented));
+        return Promise.reject(createClientAuthError(methodNotImplemented, ""));
     },
 };
 
@@ -7402,6 +7480,7 @@ const StubbedNetworkModule = {
  * @param logger
  * @param performanceClient
  * @returns
+ * @internal
  */
 function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
     // generate the correlationId if not set by the user and add
@@ -7414,7 +7493,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
         ...(request.scopes || []),
         ...(request.extraScopesToConsent || []),
     ];
-    addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addScopes(parameters, requestScopes, request.correlationId, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
     addResource(parameters, request.resource);
     addRedirectUri(parameters, request.redirectUri);
     addCorrelationId(parameters, correlationId);
@@ -7516,7 +7595,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
-    addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
+    addClaims(parameters, request.correlationId, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -7530,6 +7609,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
  * @param authority
  * @param requestParameters
  * @returns
+ * @internal
  */
 function getAuthorizeUrl(authority, requestParameters) {
     const queryString = mapToQueryString(requestParameters);
@@ -7540,13 +7620,14 @@ function getAuthorizeUrl(authority, requestParameters) {
  * the client to exchange for a token in acquireToken.
  * @param serverParams
  * @param cachedState
+ * @param correlationId
  */
-function getAuthorizationCodePayload(serverParams, cachedState) {
+function getAuthorizationCodePayload(serverParams, cachedState, correlationId) {
     // Get code response
-    validateAuthorizationResponse(serverParams, cachedState);
+    validateAuthorizationResponse(serverParams, cachedState, correlationId);
     // throw when there is no auth code in the response
     if (!serverParams.code) {
-        throw createClientAuthError(authorizationCodeMissingFromServerResponse);
+        throw createClientAuthError(authorizationCodeMissingFromServerResponse, correlationId);
     }
     return serverParams;
 }
@@ -7554,12 +7635,13 @@ function getAuthorizationCodePayload(serverParams, cachedState) {
  * Function which validates server authorization code response.
  * @param serverResponseHash
  * @param requestState
+ * @param correlationId
  */
-function validateAuthorizationResponse(serverResponse, requestState) {
+function validateAuthorizationResponse(serverResponse, requestState, correlationId) {
     if (!serverResponse.state || !requestState) {
         throw serverResponse.state
-            ? createClientAuthError(stateNotFound, "Cached State")
-            : createClientAuthError(stateNotFound, "Server State");
+            ? createClientAuthError(stateNotFound, correlationId, "Cached State")
+            : createClientAuthError(stateNotFound, correlationId, "Server State");
     }
     let decodedServerResponseState;
     let decodedRequestState;
@@ -7567,16 +7649,16 @@ function validateAuthorizationResponse(serverResponse, requestState) {
         decodedServerResponseState = decodeURIComponent(serverResponse.state);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
     }
     try {
         decodedRequestState = decodeURIComponent(requestState);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
     }
     if (decodedServerResponseState !== decodedRequestState) {
-        throw createClientAuthError(stateMismatch);
+        throw createClientAuthError(stateMismatch, correlationId);
     }
     // Check for error
     if (serverResponse.error ||
@@ -7584,9 +7666,9 @@ function validateAuthorizationResponse(serverResponse, requestState) {
         serverResponse.suberror) {
         const serverErrorNo = parseServerErrorNo(serverResponse);
         if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-            throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+            throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.correlation_id || correlationId, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.claims || "", serverErrorNo);
         }
-        throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
+        throw new ServerError(serverResponse.error || "", serverResponse.correlation_id || correlationId, serverResponse.error_description, serverResponse.suberror, serverErrorNo);
     }
 }
 /**
@@ -7638,10 +7720,10 @@ function enforceResourceParameter(isMcp, request) {
     if (request.resource &&
         (containsResourceParam(request.extraParameters) ||
             containsResourceParam(request.extraQueryParameters))) {
-        throw createClientAuthError(misplacedResourceParam);
+        throw createClientAuthError(misplacedResourceParam, request.correlationId || "");
     }
     if (!request.resource) {
-        throw createClientAuthError(resourceParameterRequired);
+        throw createClientAuthError(resourceParameterRequired, request.correlationId || "");
     }
 }
 function containsResourceParam(params) {
@@ -7675,7 +7757,7 @@ class AuthenticationHeaderParser {
             if (authenticationInfoChallenges.nextnonce) {
                 return authenticationInfoChallenges.nextnonce;
             }
-            throw createClientConfigurationError(invalidAuthenticationHeader);
+            throw createClientConfigurationError(invalidAuthenticationHeader, "");
         }
         // Attempt to parse nonce from WWW-Authenticate
         const wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
@@ -7684,10 +7766,10 @@ class AuthenticationHeaderParser {
             if (wwwAuthenticateChallenges.nonce) {
                 return wwwAuthenticateChallenges.nonce;
             }
-            throw createClientConfigurationError(invalidAuthenticationHeader);
+            throw createClientConfigurationError(invalidAuthenticationHeader, "");
         }
         // If neither header is present, throw missing headers error
-        throw createClientConfigurationError(missingNonceAuthenticationHeader);
+        throw createClientConfigurationError(missingNonceAuthenticationHeader, "");
     }
     /**
      * Parses an HTTP header's challenge set into a key/value map.
@@ -7737,12 +7819,12 @@ function tagToString(tag) {
  * Error class for MSAL Runtime errors that preserves detailed broker information
  */
 class PlatformBrokerError extends AuthError {
-    constructor(errorStatus, errorContext, errorCode, errorTag) {
+    constructor(errorStatus, correlationId, errorContext, errorCode, errorTag) {
         const tagString = tagToString(errorTag);
         const enhancedErrorContext = errorContext
             ? `${errorContext} (Error Code: ${errorCode}, Tag: ${tagString})`
             : `(Error Code: ${errorCode}, Tag: ${tagString})`;
-        super(errorStatus, enhancedErrorContext);
+        super(errorStatus, correlationId, enhancedErrorContext);
         this.name = "PlatformBrokerError";
         this.statusCode = errorCode;
         this.tag = tagString;
@@ -8120,4 +8202,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-7wFgJ2eB.js.map
+//# sourceMappingURL=index-node-BSFEsmmC.js.map