@azure/msal-common 16.9.0 → 16.10.0

package/lib/{index-node-CcOYLhxB.js → index-node-BSFEsmmC.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.9.0 2026-06-16 */
+/*! @azure/msal-common v16.10.0 2026-06-23 */
 'use strict';
 'use strict';
 
@@ -29,7 +29,7 @@ function getDefaultErrorMessage(code) {
  * General error class thrown by the MSAL.js library.
  */
 class AuthError extends Error {
-    constructor(errorCode, errorMessage, suberror) {
+    constructor(errorCode, correlationId, errorMessage, suberror) {
         const message = errorMessage ||
             (errorCode ? getDefaultErrorMessage(errorCode) : "");
         const errorString = message ? `${errorCode}: ${message}` : errorCode;
@@ -38,14 +38,12 @@ class AuthError extends Error {
         this.errorCode = errorCode || "";
         this.errorMessage = message || "";
         this.subError = suberror || "";
-        this.name = "AuthError";
-    }
-    setCorrelationId(correlationId) {
         this.correlationId = correlationId;
+        this.name = "AuthError";
     }
 }
-function createAuthError(code, additionalMessage) {
-    return new AuthError(code, additionalMessage || getDefaultErrorMessage(code));
+function createAuthError(code, correlationId, additionalMessage) {
+    return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage(code));
 }
 
 /*
@@ -64,8 +62,6 @@ const invalidState = "invalid_state";
 const stateMismatch = "state_mismatch";
 const stateNotFound = "state_not_found";
 const nonceMismatch = "nonce_mismatch";
-const authTimeNotFound = "auth_time_not_found";
-const maxAgeTranspired = "max_age_transpired";
 const multipleMatchingTokens = "multiple_matching_tokens";
 const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
 const requestCannotBeMade = "request_cannot_be_made";
@@ -94,7 +90,6 @@ const misplacedResourceParam = "misplaced_resource_parameter";
 
 var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
-    authTimeNotFound: authTimeNotFound,
     authorizationCodeMissingFromServerResponse: authorizationCodeMissingFromServerResponse,
     bindingKeyNotRemoved: bindingKeyNotRemoved,
     cannotAppendScopeSet: cannotAppendScopeSet,
@@ -109,7 +104,6 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     invalidCacheRecord: invalidCacheRecord,
     invalidState: invalidState,
     keyIdMissing: keyIdMissing,
-    maxAgeTranspired: maxAgeTranspired,
     methodNotImplemented: methodNotImplemented,
     misplacedResourceParam: misplacedResourceParam,
     multipleMatchingAppMetadata: multipleMatchingAppMetadata,
@@ -146,14 +140,14 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
  * Error thrown when there is an error in the client code running on the browser.
  */
 class ClientAuthError extends AuthError {
-    constructor(errorCode, additionalMessage) {
-        super(errorCode, additionalMessage);
+    constructor(errorCode, correlationId, additionalMessage) {
+        super(errorCode, correlationId, additionalMessage);
         this.name = "ClientAuthError";
         Object.setPrototypeOf(this, ClientAuthError.prototype);
     }
 }
-function createClientAuthError(errorCode, additionalMessage) {
-    return new ClientAuthError(errorCode, additionalMessage);
+function createClientAuthError(errorCode, correlationId, additionalMessage) {
+    return new ClientAuthError(errorCode, correlationId, additionalMessage);
 }
 
 /*
@@ -165,8 +159,8 @@ function createClientAuthError(errorCode, additionalMessage) {
  *
  * @param encodedToken
  */
-function extractTokenClaims(encodedToken, base64Decode) {
-    const jswPayload = getJWSPayload(encodedToken);
+function extractTokenClaims(encodedToken, base64Decode, correlationId) {
+    const jswPayload = getJWSPayload(encodedToken, correlationId);
     // token will be decoded to get the username
     try {
         // base64Decode() should throw an error if there is an issue
@@ -174,7 +168,7 @@ function extractTokenClaims(encodedToken, base64Decode) {
         return JSON.parse(base64Decoded);
     }
     catch (err) {
-        throw createClientAuthError(tokenParsingError);
+        throw createClientAuthError(tokenParsingError, correlationId);
     }
 }
 /**
@@ -201,14 +195,14 @@ function isKmsi(idTokenClaims) {
  *
  * @param authToken
  */
-function getJWSPayload(authToken) {
+function getJWSPayload(authToken, correlationId) {
     if (!authToken) {
-        throw createClientAuthError(nullOrEmptyToken);
+        throw createClientAuthError(nullOrEmptyToken, correlationId);
     }
     const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
     const matches = tokenPartsRegex.exec(authToken);
     if (!matches || matches.length < 4) {
-        throw createClientAuthError(tokenParsingError);
+        throw createClientAuthError(tokenParsingError, correlationId);
     }
     /**
      * const crackedToken = {
@@ -218,25 +212,10 @@ function getJWSPayload(authToken) {
      * };
      */
     return matches[2];
-}
-/**
- * Determine if the token's max_age has transpired
- */
-function checkMaxAge(authTime, maxAge) {
-    /*
-     * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-     * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
-     * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
-     */
-    const fiveMinuteSkew = 300000; // five minutes in milliseconds
-    if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
-        throw createClientAuthError(maxAgeTranspired);
-    }
 }
 
 var AuthToken = /*#__PURE__*/Object.freeze({
     __proto__: null,
-    checkMaxAge: checkMaxAge,
     extractTokenClaims: extractTokenClaims,
     getJWSPayload: getJWSPayload,
     isKmsi: isKmsi
@@ -332,14 +311,14 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
  * Error thrown when there is an error in configuration of the MSAL.js library.
  */
 class ClientConfigurationError extends AuthError {
-    constructor(errorCode) {
-        super(errorCode);
+    constructor(errorCode, correlationId) {
+        super(errorCode, correlationId);
         this.name = "ClientConfigurationError";
         Object.setPrototypeOf(this, ClientConfigurationError.prototype);
     }
 }
-function createClientConfigurationError(errorCode) {
-    return new ClientConfigurationError(errorCode);
+function createClientConfigurationError(errorCode, correlationId) {
+    return new ClientConfigurationError(errorCode, correlationId);
 }
 
 /*
@@ -454,8 +433,8 @@ const AUTHORIZATION_PENDING = "authorization_pending";
 const NOT_APPLICABLE = "N/A";
 const NOT_AVAILABLE = "Not Available";
 const FORWARD_SLASH = "/";
-const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute/location";
-const IMDS_VERSION = "2020-06-01";
+const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute";
+const IMDS_VERSION = "2021-02-01";
 const IMDS_TIMEOUT = 2000;
 const AZURE_REGION_AUTO_DISCOVER_FLAG = "TryAutoDetect";
 const REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX = "login.microsoft.com";
@@ -529,6 +508,9 @@ const AADAuthority = {
 const ClaimsRequestKeys = {
     ACCESS_TOKEN: "access_token",
     XMS_CC: "xms_cc",
+    ID_TOKEN: "id_token",
+    SIGNIN_STATE: "signin_state",
+    LOGIN_HINT: "login_hint",
 };
 /**
  * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
@@ -577,6 +559,7 @@ const GrantType = {
     REFRESH_TOKEN_GRANT: "refresh_token",
     DEVICE_CODE_GRANT: "device_code",
     JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    USER_FIC: "user_fic",
 };
 /**
  * Account types in Cache
@@ -830,11 +813,12 @@ class UrlString {
     get urlString() {
         return this._urlString;
     }
-    constructor(url) {
+    constructor(url, correlationId) {
         this._urlString = url;
+        this.correlationId = correlationId;
         if (!this._urlString) {
             // Throws error if url is empty
-            throw createClientConfigurationError(urlEmptyError);
+            throw createClientConfigurationError(urlEmptyError, correlationId);
         }
         if (!url.includes("#")) {
             this._urlString = UrlString.canonicalizeUri(url);
@@ -870,16 +854,16 @@ class UrlString {
             components = this.getUrlComponents();
         }
         catch (e) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, this.correlationId);
         }
         // Throw error if URI or path segments are not parseable.
         if (!components.HostNameAndPort || !components.PathSegments) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, this.correlationId);
         }
         // Throw error if uri is insecure.
         if (!components.Protocol ||
             components.Protocol.toLowerCase() !== "https:") {
-            throw createClientConfigurationError(authorityUriInsecure);
+            throw createClientConfigurationError(authorityUriInsecure, this.correlationId);
         }
     }
     /**
@@ -916,7 +900,7 @@ class UrlString {
                 pathArray[0] === AADAuthority.ORGANIZATIONS)) {
             pathArray[0] = tenantId;
         }
-        return UrlString.constructAuthorityUriFromObject(urlObject);
+        return UrlString.constructAuthorityUriFromObject(urlObject, this.correlationId);
     }
     /**
      * Parses out the components from a url string.
@@ -928,7 +912,7 @@ class UrlString {
         // If url string does not match regEx, we throw an error
         const match = this.urlString.match(regEx);
         if (!match) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, this.correlationId);
         }
         // Url component object
         const urlComponents = {
@@ -946,17 +930,17 @@ class UrlString {
         }
         return urlComponents;
     }
-    static getDomainFromUrl(url) {
+    static getDomainFromUrl(url, correlationId) {
         const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
         const match = url.match(regEx);
         if (!match) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, correlationId);
         }
         return match[2];
     }
-    static getAbsoluteUrl(relativeUrl, baseUrl) {
+    static getAbsoluteUrl(relativeUrl, baseUrl, correlationId) {
         if (relativeUrl[0] === FORWARD_SLASH) {
-            const url = new UrlString(baseUrl);
+            const url = new UrlString(baseUrl, correlationId);
             const baseComponents = url.getUrlComponents();
             return (baseComponents.Protocol +
                 "//" +
@@ -965,12 +949,12 @@ class UrlString {
         }
         return relativeUrl;
     }
-    static constructAuthorityUriFromObject(urlObject) {
+    static constructAuthorityUriFromObject(urlObject, correlationId) {
         return new UrlString(urlObject.Protocol +
             "//" +
             urlObject.HostNameAndPort +
             "/" +
-            urlObject.PathSegments.join("/"));
+            urlObject.PathSegments.join("/"), correlationId);
     }
 }
 
@@ -1088,7 +1072,7 @@ function getAliasesFromStaticSources(staticAuthorityOptions, logger, correlation
     let staticAliases;
     const canonicalAuthority = staticAuthorityOptions.canonicalAuthority;
     if (canonicalAuthority) {
-        const authorityHost = new UrlString(canonicalAuthority).getUrlComponents().HostNameAndPort;
+        const authorityHost = new UrlString(canonicalAuthority, correlationId).getUrlComponents().HostNameAndPort;
         staticAliases =
             getAliasesFromMetadata(logger, correlationId, authorityHost, staticAuthorityOptions.cloudDiscoveryMetadata?.metadata, AuthorityMetadataSource.CONFIG) ||
                 getAliasesFromMetadata(logger, correlationId, authorityHost, InstanceDiscoveryMetadata.metadata, AuthorityMetadataSource.HARDCODED_VALUES) ||
@@ -1415,9 +1399,12 @@ class RegionDiscovery {
             try {
                 const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(IMDS_VERSION, options);
                 if (localIMDSVersionResponse.status === HTTP_SUCCESS) {
-                    autodetectedRegionName = localIMDSVersionResponse.body;
-                    regionDiscoveryMetadata.region_source =
-                        RegionDiscoverySources.IMDS;
+                    autodetectedRegionName =
+                        localIMDSVersionResponse.body?.location;
+                    if (autodetectedRegionName) {
+                        regionDiscoveryMetadata.region_source =
+                            RegionDiscoverySources.IMDS;
+                    }
                 }
                 // If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
                 if (localIMDSVersionResponse.status ===
@@ -1432,9 +1419,11 @@ class RegionDiscovery {
                     if (currentIMDSVersionResponse.status ===
                         HTTP_SUCCESS) {
                         autodetectedRegionName =
-                            currentIMDSVersionResponse.body;
-                        regionDiscoveryMetadata.region_source =
-                            RegionDiscoverySources.IMDS;
+                            currentIMDSVersionResponse.body?.location;
+                        if (autodetectedRegionName) {
+                            regionDiscoveryMetadata.region_source =
+                                RegionDiscoverySources.IMDS;
+                        }
                     }
                 }
             }
@@ -1458,11 +1447,12 @@ class RegionDiscovery {
     /**
      * Make the call to the IMDS endpoint
      *
-     * @param imdsEndpointUrl
-     * @returns Promise<NetworkResponse<string>>
+     * @param version
+     * @param options
+     * @returns Promise<NetworkResponse<ImdsComputeResponse>>
      */
     async getRegionFromIMDS(version, options) {
-        return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}&format=text`, options, IMDS_TIMEOUT);
+        return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}`, options, IMDS_TIMEOUT);
     }
     /**
      * Get the most recent version of the IMDS endpoint available
@@ -1610,7 +1600,7 @@ function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tena
  * @param expiresOn
  * @param extExpiresOn
  */
-function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, correlationId, refreshOn, tokenType, userAssertionHash, keyId, additionalCacheKeyComponents) {
     const atEntity = {
         homeAccountId: homeAccountId,
         credentialType: CredentialType.ACCESS_TOKEN,
@@ -1642,9 +1632,9 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
         switch (atEntity.tokenType) {
             case AuthenticationScheme.POP:
                 // Make sure keyId is present and add it to credential
-                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                const tokenClaims = extractTokenClaims(accessToken, base64Decode, correlationId);
                 if (!tokenClaims?.cnf?.kid) {
-                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt, correlationId);
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
                 break;
@@ -1652,6 +1642,11 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
                 atEntity.keyId = keyId;
         }
     }
+    /* Additional cache key components for cache isolation (e.g., FMI path) */
+    if (additionalCacheKeyComponents &&
+        Object.keys(additionalCacheKeyComponents).length > 0) {
+        atEntity.additionalCacheKeyComponents = additionalCacheKeyComponents;
+    }
     return atEntity;
 }
 /**
@@ -1930,7 +1925,7 @@ class Authority {
      * Sets canonical authority.
      */
     set canonicalAuthority(url) {
-        this._canonicalAuthority = new UrlString(url);
+        this._canonicalAuthority = new UrlString(url, this.correlationId);
         this._canonicalAuthority.validateAsUri();
         this._canonicalAuthorityUrlComponents = null;
     }
@@ -1964,7 +1959,7 @@ class Authority {
             return this.replacePath(this.metadata.authorization_endpoint);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -1975,7 +1970,7 @@ class Authority {
             return this.replacePath(this.metadata.token_endpoint);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     get deviceCodeEndpoint() {
@@ -1983,7 +1978,7 @@ class Authority {
             return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -1993,12 +1988,12 @@ class Authority {
         if (this.discoveryComplete()) {
             // ROPC policies may not have end_session_endpoint set
             if (!this.metadata.end_session_endpoint) {
-                throw createClientAuthError(endSessionEndpointNotSupported);
+                throw createClientAuthError(endSessionEndpointNotSupported, this.correlationId);
             }
             return this.replacePath(this.metadata.end_session_endpoint);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -2009,7 +2004,7 @@ class Authority {
             return this.replacePath(this.metadata.issuer);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -2020,7 +2015,7 @@ class Authority {
             return this.replacePath(this.metadata.jwks_uri);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -2047,7 +2042,7 @@ class Authority {
      */
     replacePath(urlString) {
         let endpoint = urlString;
-        const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
+        const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority, this.correlationId);
         const cachedAuthorityUrlComponents = cachedAuthorityUrl.getUrlComponents();
         const cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
         const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
@@ -2055,7 +2050,7 @@ class Authority {
             let cachedPart = cachedAuthorityParts[index];
             if (index === 0 &&
                 this.canReplaceTenant(cachedAuthorityUrlComponents)) {
-                const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
+                const tenantId = new UrlString(this.metadata.authorization_endpoint, this.correlationId).getUrlComponents().PathSegments[0];
                 /**
                  * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
                  * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
@@ -2189,7 +2184,7 @@ class Authority {
         }
         else {
             // Metadata could not be obtained from the config, cache, network or hardcoded values
-            throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint);
+            throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint, this.correlationId);
         }
     }
     /**
@@ -2241,7 +2236,7 @@ class Authority {
      * @param metadataEntity
      */
     isAuthoritySameType(metadataEntity) {
-        const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority);
+        const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority, this.correlationId);
         const cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
         return (cachedParts.length ===
             this.canonicalAuthorityUrlComponents.PathSegments.length);
@@ -2255,7 +2250,7 @@ class Authority {
                 return JSON.parse(this.authorityOptions.authorityMetadata);
             }
             catch (e) {
-                throw createClientConfigurationError(invalidAuthorityMetadata);
+                throw createClientConfigurationError(invalidAuthorityMetadata, this.correlationId);
             }
         }
         return null;
@@ -2311,7 +2306,7 @@ class Authority {
                     RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
                 this.regionDiscoveryMetadata.region_used =
                     userConfiguredAzureRegion;
-                return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
+                return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion, this.correlationId);
             }
             const autodetectedRegionName = await invokeAsync(this.regionDiscovery.detectRegion.bind(this.regionDiscovery), RegionDiscoveryDetectRegion, this.logger, this.performanceClient, this.correlationId)(this.authorityOptions.azureRegionConfiguration
                 ?.environmentRegion, this.regionDiscoveryMetadata);
@@ -2320,7 +2315,7 @@ class Authority {
                     RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
                 this.regionDiscoveryMetadata.region_used =
                     autodetectedRegionName;
-                return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
+                return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName, this.correlationId);
             }
             this.regionDiscoveryMetadata.region_outcome =
                 RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
@@ -2345,7 +2340,7 @@ class Authority {
             return AuthorityMetadataSource.NETWORK;
         }
         // Metadata could not be obtained from the config, cache, network or hardcoded values
-        throw createClientConfigurationError(untrustedAuthority);
+        throw createClientConfigurationError(untrustedAuthority, this.correlationId);
     }
     updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
         this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration", this.correlationId);
@@ -2409,7 +2404,7 @@ class Authority {
             }
             catch (e) {
                 this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error.", this.correlationId);
-                throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+                throw createClientConfigurationError(invalidCloudDiscoveryMetadata, this.correlationId);
             }
         }
         // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
@@ -2487,8 +2482,7 @@ class Authority {
         const normalizedHost = host.toLowerCase();
         const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
             return (authority &&
-                UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                    normalizedHost);
+                UrlString.getDomainFromUrl(authority, this.correlationId).toLowerCase() === normalizedHost);
         });
         return matches.length > 0;
     }
@@ -2532,7 +2526,7 @@ class Authority {
             return this.metadata.preferred_cache;
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -2575,7 +2569,7 @@ class Authority {
      */
     validateIssuer(issuer) {
         if (!issuer) {
-            throw createClientConfigurationError(issuerValidationFailed);
+            throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
         }
         // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
         let issuerUrl;
@@ -2583,7 +2577,7 @@ class Authority {
             issuerUrl = new URL(issuer);
         }
         catch {
-            throw createClientConfigurationError(issuerValidationFailed);
+            throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
         }
         const issuerScheme = issuerUrl.protocol;
         const issuerHost = issuerUrl.host;
@@ -2621,7 +2615,7 @@ class Authority {
             return;
         }
         // issuer validation fails if none of the above rules are satisfied
-        throw createClientConfigurationError(issuerValidationFailed);
+        throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
     }
     /**
      * Rule 1: The issuer scheme + host (and port) match the authority's. Path
@@ -2709,9 +2703,9 @@ class Authority {
      * @param host string
      * @param region string
      */
-    static buildRegionalAuthorityString(host, region, queryString) {
+    static buildRegionalAuthorityString(host, region, correlationId, queryString) {
         // Create and validate a Url string object with the initial authority string
-        const authorityUrlInstance = new UrlString(host);
+        const authorityUrlInstance = new UrlString(host, correlationId);
         authorityUrlInstance.validateAsUri();
         const authorityUrlParts = authorityUrlInstance.getUrlComponents();
         let hostNameAndPort = `${region}.${authorityUrlParts.HostNameAndPort}`;
@@ -2722,7 +2716,7 @@ class Authority {
         const url = UrlString.constructAuthorityUriFromObject({
             ...authorityUrlInstance.getUrlComponents(),
             HostNameAndPort: hostNameAndPort,
-        }).urlString;
+        }, correlationId).urlString;
         // Add the query string if a query string was provided
         if (queryString)
             return `${url}?${queryString}`;
@@ -2734,15 +2728,15 @@ class Authority {
      * @param metadata OpenIdConfigResponse
      * @param azureRegion string
      */
-    static replaceWithRegionalInformation(metadata, azureRegion) {
+    static replaceWithRegionalInformation(metadata, azureRegion, correlationId) {
         const regionalMetadata = { ...metadata };
         regionalMetadata.authorization_endpoint =
-            Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
+            Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion, correlationId);
         regionalMetadata.token_endpoint =
-            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
+            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion, correlationId);
         if (regionalMetadata.end_session_endpoint) {
             regionalMetadata.end_session_endpoint =
-                Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
+                Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion, correlationId);
         }
         return regionalMetadata;
     }
@@ -2755,9 +2749,9 @@ class Authority {
      *
      * @param authority
      */
-    static transformCIAMAuthority(authority) {
+    static transformCIAMAuthority(authority, correlationId) {
         let ciamAuthority = authority;
-        const authorityUrl = new UrlString(authority);
+        const authorityUrl = new UrlString(authority, correlationId);
         const authorityUrlComponents = authorityUrl.getUrlComponents();
         // check if transformation is needed
         if (authorityUrlComponents.PathSegments.length === 0 &&
@@ -2779,8 +2773,8 @@ Authority.reservedTenantDomains = new Set([
 /**
  * Extract tenantId from authority
  */
-function getTenantFromAuthorityString(authority) {
-    const authorityUrl = new UrlString(authority);
+function getTenantFromAuthorityString(authority, correlationId) {
+    const authorityUrl = new UrlString(authority, correlationId);
     const authorityUrlComponents = authorityUrl.getUrlComponents();
     /**
      * For credential matching purposes, tenantId is the last path segment of the authority URL:
@@ -2813,7 +2807,7 @@ function buildStaticAuthorityOptions(authOptions) {
             cloudDiscoveryMetadata = JSON.parse(rawCloudDiscoveryMetadata);
         }
         catch (e) {
-            throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+            throw createClientConfigurationError(invalidCloudDiscoveryMetadata, "");
         }
     }
     return {
@@ -2845,7 +2839,7 @@ function buildStaticAuthorityOptions(authOptions) {
  * @internal
  */
 async function createDiscoveredInstance(authorityUri, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient) {
-    const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri));
+    const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri), correlationId);
     // Initialize authority and perform discovery endpoint check.
     const acquireTokenAuthority = new Authority(authorityUriFinal, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient);
     try {
@@ -2853,7 +2847,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
         return acquireTokenAuthority;
     }
     catch (e) {
-        throw createClientAuthError(endpointResolutionError);
+        throw createClientAuthError(endpointResolutionError, correlationId);
     }
 }
 
@@ -2903,7 +2897,7 @@ function getDeserializedResponse(responseString) {
         }
     }
     catch (e) {
-        throw createClientAuthError(hashNotDeserialized);
+        throw createClientAuthError(hashNotDeserialized, "");
     }
     return null;
 }
@@ -2960,7 +2954,7 @@ function normalizeUrlForComparison(url, logger, correlationId) {
     }
     catch (e) {
         logger?.error(`Failed to normalize URL for comparison: '${e}'`, correlationId || "");
-        throw createClientConfigurationError(urlParseError);
+        throw createClientConfigurationError(urlParseError, correlationId || "");
     }
 }
 /**
@@ -2978,7 +2972,7 @@ function validateUrl(url, logger, correlationId) {
     }
     catch (e) {
         logger?.error(`Failed to validate URL: '${e}'`, correlationId || "");
-        throw createClientConfigurationError(urlParseError);
+        throw createClientConfigurationError(urlParseError, correlationId || "");
     }
 }
 
@@ -3054,7 +3048,11 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
-const CLI_DATA = "clidata";
+const CLI_DATA = "clidata";
+const USER_FEDERATED_IDENTITY_CREDENTIAL = "user_federated_identity_credential";
+const USERNAME = "username";
+const USER_ID = "user_id";
+const FMI_PATH = "fmi_path";
 
 var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -3081,6 +3079,7 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     ERROR: ERROR,
     ERROR_DESCRIPTION: ERROR_DESCRIPTION,
     EXPIRES_IN: EXPIRES_IN,
+    FMI_PATH: FMI_PATH,
     FOCI: FOCI,
     GRANT_TYPE: GRANT_TYPE,
     ID_TOKEN: ID_TOKEN,
@@ -3108,6 +3107,9 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     SID: SID,
     STATE: STATE,
     TOKEN_TYPE: TOKEN_TYPE,
+    USERNAME: USERNAME,
+    USER_FEDERATED_IDENTITY_CREDENTIAL: USER_FEDERATED_IDENTITY_CREDENTIAL,
+    USER_ID: USER_ID,
     X_APP_NAME: X_APP_NAME,
     X_APP_VER: X_APP_VER,
     X_CLIENT_CPU: X_CLIENT_CPU,
@@ -3131,14 +3133,14 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
  */
 function buildClientInfo(rawClientInfo, base64Decode) {
     if (!rawClientInfo) {
-        throw createClientAuthError(clientInfoEmptyError);
+        throw createClientAuthError(clientInfoEmptyError, "");
     }
     try {
         const decodedClientInfo = base64Decode(rawClientInfo);
         return JSON.parse(decodedClientInfo);
     }
     catch (e) {
-        throw createClientAuthError(clientInfoDecodingError);
+        throw createClientAuthError(clientInfoDecodingError, "");
     }
 }
 /**
@@ -3147,7 +3149,7 @@ function buildClientInfo(rawClientInfo, base64Decode) {
  */
 function buildClientInfoFromHomeAccountId(homeAccountId) {
     if (!homeAccountId) {
-        throw createClientAuthError(clientInfoDecodingError);
+        throw createClientAuthError(clientInfoDecodingError, "");
     }
     const clientInfoParts = homeAccountId.split(CLIENT_INFO_SEPARATOR, 2);
     return {
@@ -3176,10 +3178,11 @@ function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
  * @param homeAccountId - Home account identifier for this account object
  * @param localAccountId - Local account identifer for this account object
  * @param tenantId - Full tenant or organizational id that this account belongs to
+ * @param nativeAccountId - Native account identifier for this tenant
  * @param idTokenClaims - Claims from the ID token
  * @returns
  */
-function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
+function buildTenantProfile(homeAccountId, localAccountId, tenantId, nativeAccountId, idTokenClaims) {
     if (idTokenClaims) {
         const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint, } = idTokenClaims;
         /**
@@ -3197,6 +3200,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
             upn: upn,
+            ...(nativeAccountId && { nativeAccountId }),
         };
     }
     else {
@@ -3205,6 +3209,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             localAccountId,
             username: "",
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            ...(nativeAccountId && { nativeAccountId }),
         };
     }
 }
@@ -3226,12 +3231,13 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     if (idTokenClaims) {
         // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
+        const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, updatedAccountInfo.nativeAccountId, idTokenClaims);
         updatedAccountInfo = {
             ...updatedAccountInfo,
             ...claimsSourcedTenantProfile,
             idTokenClaims: idTokenClaims,
             idToken: idTokenSecret,
+            kmsi: isKmsi(idTokenClaims),
         };
         return updatedAccountInfo;
     }
@@ -3284,8 +3290,11 @@ function getAccountInfo(accountEntity) {
     if (tenantProfiles.length === 0 &&
         accountEntity.realm &&
         accountEntity.localAccountId) {
-        tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm));
+        tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm, accountEntity.nativeAccountId));
     }
+    // Resolve nativeAccountId from the home tenant profile first, fall back to top-level (deprecated) for old cache entries
+    const homeTenantProfile = tenantProfiles.find((tp) => tp.tenantId === accountEntity.realm);
+    const nativeAccountId = homeTenantProfile?.nativeAccountId || accountEntity.nativeAccountId;
     return {
         homeAccountId: accountEntity.homeAccountId,
         environment: accountEntity.environment,
@@ -3294,7 +3303,7 @@ function getAccountInfo(accountEntity) {
         localAccountId: accountEntity.localAccountId,
         loginHint: accountEntity.loginHint,
         name: accountEntity.name,
-        nativeAccountId: accountEntity.nativeAccountId,
+        nativeAccountId: nativeAccountId,
         authorityType: accountEntity.authorityType,
         // Deserialize tenant profiles array into a Map
         tenantProfiles: new Map(tenantProfiles.map((tenantProfile) => {
@@ -3315,7 +3324,7 @@ function isSingleTenant(accountEntity) {
  * @param accountDetails
  * @internal
  */
-function createAccountEntity(accountDetails, authority, base64Decode) {
+function createAccountEntity(accountDetails, authority, correlationId, base64Decode) {
     let authorityType;
     if (authority.authorityType === AuthorityType.Adfs) {
         authorityType = CACHE_ACCOUNT_TYPE_ADFS;
@@ -3337,7 +3346,7 @@ function createAccountEntity(accountDetails, authority, base64Decode) {
     const env = accountDetails.environment ||
         (authority && authority.getPreferredCache());
     if (!env) {
-        throw createClientAuthError(invalidCacheEnvironment);
+        throw createClientAuthError(invalidCacheEnvironment, correlationId);
     }
     /*
      * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
@@ -3364,7 +3373,7 @@ function createAccountEntity(accountDetails, authority, base64Decode) {
         tenantProfiles = accountDetails.tenantProfiles;
     }
     else {
-        const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.idTokenClaims);
+        const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.nativeAccountId, accountDetails.idTokenClaims);
         tenantProfiles = [tenantProfile];
     }
     return {
@@ -3401,7 +3410,14 @@ function createAccountEntityFromAccountInfo(accountInfo, cloudGraphHostName, msG
     if (tenantProfiles.length === 0 &&
         accountInfo.tenantId &&
         accountInfo.localAccountId) {
-        tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.idTokenClaims));
+        tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.nativeAccountId, accountInfo.idTokenClaims));
+    }
+    else if (accountInfo.nativeAccountId) {
+        // Ensure nativeAccountId is set on the matching tenant profile
+        const matchingProfile = tenantProfiles.find((tp) => tp.tenantId === accountInfo.tenantId);
+        if (matchingProfile && !matchingProfile.nativeAccountId) {
+            matchingProfile.nativeAccountId = accountInfo.nativeAccountId;
+        }
     }
     return {
         authorityType: accountInfo.authorityType || CACHE_ACCOUNT_TYPE_GENERIC,
@@ -3480,7 +3496,8 @@ var AccountEntityUtils = /*#__PURE__*/Object.freeze({
  * to ensure uniqueness of strings.
  */
 class ScopeSet {
-    constructor(inputScopes) {
+    constructor(inputScopes, correlationId) {
+        this.correlationId = correlationId;
         // Filter empty string and null/undefined array items
         const scopeArr = inputScopes
             ? StringUtils.trimArrayEntries([...inputScopes])
@@ -3490,7 +3507,7 @@ class ScopeSet {
             : [];
         // Check if scopes array has at least one member
         if (!filteredInput || !filteredInput.length) {
-            throw createClientConfigurationError(emptyInputScopesError);
+            throw createClientConfigurationError(emptyInputScopesError, correlationId);
         }
         this.scopes = new Set(); // Iterator in constructor not supported by IE11
         filteredInput.forEach((scope) => this.scopes.add(scope));
@@ -3501,22 +3518,22 @@ class ScopeSet {
      * @param appClientId
      * @param scopesRequired
      */
-    static fromString(inputScopeString) {
+    static fromString(inputScopeString, correlationId) {
         const scopeString = inputScopeString || "";
         const inputScopes = scopeString.split(" ");
-        return new ScopeSet(inputScopes);
+        return new ScopeSet(inputScopes, correlationId);
     }
     /**
      * Creates the set of scopes to search for in cache lookups
      * @param inputScopeString
      * @returns
      */
-    static createSearchScopes(inputScopeString) {
+    static createSearchScopes(inputScopeString, correlationId) {
         // Handle empty scopes by using default OIDC scopes for cache lookup
         const scopesToUse = inputScopeString && inputScopeString.length > 0
             ? inputScopeString
             : [...OIDC_DEFAULT_SCOPES];
-        const scopeSet = new ScopeSet(scopesToUse);
+        const scopeSet = new ScopeSet(scopesToUse, correlationId);
         if (!scopeSet.containsOnlyOIDCScopes()) {
             scopeSet.removeOIDCScopes();
         }
@@ -3531,7 +3548,7 @@ class ScopeSet {
      */
     containsScope(scope) {
         const lowerCaseScopes = this.printScopesLowerCase().split(" ");
-        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
+        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes, this.correlationId);
         // compare lowercase scopes
         return scope
             ? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
@@ -3578,7 +3595,7 @@ class ScopeSet {
             newScopes.forEach((newScope) => this.appendScope(newScope));
         }
         catch (e) {
-            throw createClientAuthError(cannotAppendScopeSet);
+            throw createClientAuthError(cannotAppendScopeSet, this.correlationId);
         }
     }
     /**
@@ -3587,7 +3604,7 @@ class ScopeSet {
      */
     removeScope(scope) {
         if (!scope) {
-            throw createClientAuthError(cannotRemoveEmptyScope);
+            throw createClientAuthError(cannotRemoveEmptyScope, this.correlationId);
         }
         this.scopes.delete(scope.trim());
     }
@@ -3606,7 +3623,7 @@ class ScopeSet {
      */
     unionScopeSets(otherScopes) {
         if (!otherScopes) {
-            throw createClientAuthError(emptyInputScopeSet);
+            throw createClientAuthError(emptyInputScopeSet, this.correlationId);
         }
         const unionScopes = new Set(); // Iterator in constructor not supported in IE11
         otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
@@ -3619,7 +3636,7 @@ class ScopeSet {
      */
     intersectingScopeSets(otherScopes) {
         if (!otherScopes) {
-            throw createClientAuthError(emptyInputScopeSet);
+            throw createClientAuthError(emptyInputScopeSet, this.correlationId);
         }
         // Do not allow OIDC scopes to be the only intersecting scopes
         if (!otherScopes.containsOnlyOIDCScopes()) {
@@ -3705,7 +3722,7 @@ function addNativeBroker(parameters) {
  * @param scopeSet
  * @param addOidcScopes
  */
-function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+function addScopes(parameters, scopes, correlationId, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
     // Always add openid to the scopes when adding OIDC scopes
     if (addOidcScopes &&
         !defaultScopes.includes("openid") &&
@@ -3715,7 +3732,7 @@ function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OID
     const requestScopes = addOidcScopes
         ? [...(scopes || []), ...defaultScopes]
         : scopes || [];
-    const scopeSet = new ScopeSet(requestScopes);
+    const scopeSet = new ScopeSet(requestScopes, correlationId);
     parameters.set(SCOPE, scopeSet.printScopes());
 }
 /**
@@ -3785,26 +3802,18 @@ function addSid(parameters, sid) {
  * Adds claims to request parameters, conditionally excluding clientCapabilities
  * when skipBrokerClaims is true and a brokered flow is in effect.
  * @param parameters - The request parameters map
+ * @param correlationId - The request correlation id
  * @param claims - The claims string from the request
  * @param clientCapabilities - The client capabilities from configuration
  * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
  */
-function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims) {
     // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
     const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
         ? undefined
         : clientCapabilities;
-    if (!StringUtils.isEmptyObj(claims) ||
-        (configClaims && configClaims.length > 0)) {
-        const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
-        try {
-            JSON.parse(mergedClaims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-        parameters.set(CLAIMS, mergedClaims);
-    }
+    const mergedClaims = buildMergedClaims(claims, configClaims, correlationId);
+    parameters.set(CLAIMS, mergedClaims);
 }
 /**
  * add correlationId
@@ -3875,7 +3884,7 @@ function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod)
         parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
     }
     else {
-        throw createClientConfigurationError(pkceParamsMissing);
+        throw createClientConfigurationError(pkceParamsMissing, "");
     }
 }
 /**
@@ -3981,7 +3990,23 @@ function addExtraParameters(parameters, extraParams) {
         }
     });
 }
-function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+/**
+ * Default optional idToken claims requested on all auth requests.
+ * signin_state enables KMSI detection; login_hint enables login hint propagation.
+ */
+const DEFAULT_ID_TOKEN_CLAIMS = {
+    [ClaimsRequestKeys.SIGNIN_STATE]: { essential: false },
+    [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
+};
+/**
+ * Parses claims JSON, merges default optional idToken claims (signin_state, login_hint),
+ * and appends client capabilities (xms_cc) to the access_token section.
+ * Does not overwrite idToken claims already specified by the caller.
+ * @param claims - Existing claims JSON string from the request (may be undefined)
+ * @param clientCapabilities - Client capabilities array from configuration
+ * @returns Merged claims JSON string
+ */
+function buildMergedClaims(claims, clientCapabilities, correlationId = "") {
     let mergedClaims;
     // Parse provided claims into JSON object or initialize empty object
     if (!claims) {
@@ -3989,14 +4014,31 @@ function addClientCapabilitiesToClaims(claims, clientCapabilities) {
     }
     else {
         try {
-            mergedClaims = JSON.parse(claims);
+            const parsed = JSON.parse(claims);
+            if (typeof parsed !== "object" ||
+                parsed === null ||
+                Array.isArray(parsed)) {
+                throw new Error("Claims must be a JSON object");
+            }
+            mergedClaims = parsed;
         }
         catch (e) {
-            throw createClientConfigurationError(invalidClaims);
+            throw createClientConfigurationError(invalidClaims, correlationId);
+        }
+    }
+    // Add default optional idToken claims
+    if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ID_TOKEN)) {
+        mergedClaims[ClaimsRequestKeys.ID_TOKEN] = {};
+    }
+    const idTokenClaims = mergedClaims[ClaimsRequestKeys.ID_TOKEN];
+    for (const [key, value] of Object.entries(DEFAULT_ID_TOKEN_CLAIMS)) {
+        if (!(key in idTokenClaims)) {
+            idTokenClaims[key] = value;
         }
     }
+    // Add client capabilities
     if (clientCapabilities && clientCapabilities.length > 0) {
-        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+        if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ACCESS_TOKEN)) {
             // Add access_token key to claims object
             mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
         }
@@ -4046,14 +4088,8 @@ function addSshJwk(parameters, sshJwkString) {
  * @internal
  */
 function addServerTelemetry(parameters, serverTelemetryManager) {
-    const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
-    const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
-    if (currentTelemetryHeader) {
-        parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
-    }
-    if (lastTelemetryHeader) {
-        parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
-    }
+    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
 }
 /**
  * Adds parameter that indicates to the server that throttling is supported
@@ -4103,7 +4139,6 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     addCliData: addCliData,
     addClientAssertion: addClientAssertion,
     addClientAssertionType: addClientAssertionType,
-    addClientCapabilitiesToClaims: addClientCapabilitiesToClaims,
     addClientId: addClientId,
     addClientInfo: addClientInfo,
     addClientSecret: addClientSecret,
@@ -4140,6 +4175,7 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     addState: addState,
     addThrottling: addThrottling,
     addUsername: addUsername,
+    buildMergedClaims: buildMergedClaims,
     instrumentBrokerParams: instrumentBrokerParams
 });
 
@@ -4149,34 +4185,34 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
  */
 const DEFAULT_CRYPTO_IMPLEMENTATION = {
     createNewGuid: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     base64Decode: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     base64Encode: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     base64UrlEncode: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     encodeKid: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async getPublicKeyThumbprint() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async removeTokenBindingKey() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async clearKeystore() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async signJwt() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async hashString() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
 };
 
@@ -4470,7 +4506,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.9.0";
+const version = "16.10.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4608,7 +4644,7 @@ class CacheManager {
         }
         const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
         if (idToken) {
-            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
+            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode, correlationId);
             if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
                 // ID token sourced claims don't match so this tenant profile is not a match
                 return null;
@@ -4671,6 +4707,11 @@ class CacheManager {
             !(tenantProfile.upn === tenantProfileFilter.upn)) {
             return false;
         }
+        if (!!tenantProfileFilter.nativeAccountId &&
+            tenantProfile.nativeAccountId !==
+                tenantProfileFilter.nativeAccountId) {
+            return false;
+        }
         return true;
     }
     idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -4708,7 +4749,7 @@ class CacheManager {
      */
     async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
         if (!cacheRecord) {
-            throw createClientAuthError(invalidCacheRecord);
+            throw createClientAuthError(invalidCacheRecord, correlationId);
         }
         try {
             if (!!cacheRecord.account) {
@@ -4753,7 +4794,7 @@ class CacheManager {
             tokenType: credential.tokenType,
         };
         const tokenKeys = this.getTokenKeys();
-        const currentScopes = ScopeSet.fromString(credential.target);
+        const currentScopes = ScopeSet.fromString(credential.target, correlationId);
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                 return;
@@ -4761,7 +4802,7 @@ class CacheManager {
             const tokenEntity = this.getAccessTokenCredential(key, correlationId);
             if (tokenEntity &&
                 this.credentialMatchesFilter(tokenEntity, accessTokenFilter, correlationId)) {
-                const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                const tokenScopeSet = ScopeSet.fromString(tokenEntity.target, correlationId);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
                     this.removeAccessToken(key, correlationId);
                 }
@@ -4795,10 +4836,6 @@ class CacheManager {
                 !this.matchRealm(entity, accountFilter.realm)) {
                 return;
             }
-            if (!!accountFilter.nativeAccountId &&
-                !this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
-                return;
-            }
             if (!!accountFilter.authorityType &&
                 !this.matchAuthorityType(entity, accountFilter.authorityType)) {
                 return;
@@ -4810,6 +4847,7 @@ class CacheManager {
                 username: accountFilter?.username,
                 loginHint: accountFilter?.loginHint,
                 upn: accountFilter?.upn,
+                nativeAccountId: accountFilter?.nativeAccountId,
             };
             const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                 return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -4863,7 +4901,8 @@ class CacheManager {
          * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
          * Resource specific refresh tokens case will be added when the support is deemed necessary
          */
-        if (!!filter.target && !this.matchTarget(entity, filter.target)) {
+        if (!!filter.target &&
+            !this.matchTarget(entity, filter.target, correlationId)) {
             return false;
         }
         // Access Token with Auth Scheme specific matching
@@ -4880,6 +4919,28 @@ class CacheManager {
                 }
             }
         }
+        // Additional cache key components matching (bidirectional isolation)
+        const entityComponents = entity.additionalCacheKeyComponents;
+        const filterComponents = filter.additionalCacheKeyComponents;
+        const entityHasComponents = !!entityComponents && Object.keys(entityComponents).length > 0;
+        const filterHasComponents = !!filterComponents && Object.keys(filterComponents).length > 0;
+        if (entityHasComponents !== filterHasComponents) {
+            return false;
+        }
+        if (entityHasComponents && filterHasComponents) {
+            const entityKeys = Object.keys(entityComponents).sort();
+            const filterKeys = Object.keys(filterComponents).sort();
+            if (entityKeys.length !== filterKeys.length) {
+                return false;
+            }
+            for (let i = 0; i < entityKeys.length; i++) {
+                if (entityKeys[i] !== filterKeys[i] ||
+                    entityComponents[entityKeys[i]] !==
+                        filterComponents[filterKeys[i]]) {
+                    return false;
+                }
+            }
+        }
         return true;
     }
     /**
@@ -5147,7 +5208,7 @@ class CacheManager {
     getAccessToken(account, request, tokenKeys, targetRealm) {
         const correlationId = request.correlationId;
         this.commonLogger.trace("CacheManager - getAccessToken called", correlationId);
-        const scopes = ScopeSet.createSearchScopes(request.scopes);
+        const scopes = ScopeSet.createSearchScopes(request.scopes, correlationId);
         const authScheme = request.authenticationScheme ||
             AuthenticationScheme.BEARER;
         /*
@@ -5338,7 +5399,7 @@ class CacheManager {
             return null;
         }
         else if (numAppMetadata > 1) {
-            throw createClientAuthError(multipleMatchingAppMetadata);
+            throw createClientAuthError(multipleMatchingAppMetadata, correlationId);
         }
         return appMetadataEntries[0];
     }
@@ -5468,15 +5529,6 @@ class CacheManager {
     matchRealm(entity, realm) {
         return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
     }
-    /**
-     * helper to match nativeAccountId
-     * @param entity
-     * @param nativeAccountId
-     * @returns boolean indicating the match result
-     */
-    matchNativeAccountId(entity, nativeAccountId) {
-        return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
-    }
     /**
      * helper to match loginHint which can be either:
      * 1. login_hint ID token claim
@@ -5520,14 +5572,14 @@ class CacheManager {
      * @param entity
      * @param target
      */
-    matchTarget(entity, target) {
+    matchTarget(entity, target, correlationId) {
         const isNotAccessTokenCredential = entity.credentialType !== CredentialType.ACCESS_TOKEN &&
             entity.credentialType !==
                 CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
         if (isNotAccessTokenCredential || !entity.target) {
             return false;
         }
-        const entityScopeSet = ScopeSet.fromString(entity.target);
+        const entityScopeSet = ScopeSet.fromString(entity.target, correlationId);
         return entityScopeSet.containsScopeSet(target);
     }
     /**
@@ -5581,73 +5633,73 @@ class CacheManager {
 /** @internal */
 class DefaultStorageClass extends CacheManager {
     async setAccount() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAccount() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     async setIdTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getIdTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     async setAccessTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAccessTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     async setRefreshTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getRefreshTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setAppMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAppMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setServerTelemetry() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getServerTelemetry() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setAuthorityMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAuthorityMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAuthorityMetadataKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setThrottlingCache() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getThrottlingCache() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     removeItem() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAccountKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getTokenKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     generateCredentialKey() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     generateAccountKey() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
 }
 
@@ -5786,10 +5838,10 @@ const DEFAULT_LOGGER_IMPLEMENTATION = {
 };
 const DEFAULT_NETWORK_IMPLEMENTATION = {
     async sendGetRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async sendPostRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
 };
 const DEFAULT_LIBRARY_INFO = {
@@ -5947,7 +5999,7 @@ class PopTokenGenerator {
         // Deconstruct request to extract SHR parameters
         const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
         const resourceUrlString = resourceRequestUri
-            ? new UrlString(resourceRequestUri)
+            ? new UrlString(resourceRequestUri, request.correlationId)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
         return this.cryptoUtils.signJwt({
@@ -6058,12 +6110,11 @@ const InteractionRequiredAuthSubErrorMessage = [
  * Error thrown when user interaction is required.
  */
 class InteractionRequiredAuthError extends AuthError {
-    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
-        super(errorCode, errorMessage, subError);
+    constructor(errorCode, correlationId, errorMessage, subError, timestamp, traceId, claims, errorNo) {
+        super(errorCode, correlationId, errorMessage, subError);
         Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
         this.timestamp = timestamp || "";
         this.traceId = traceId || "";
-        this.correlationId = correlationId || "";
         this.claims = claims || "";
         this.name = "InteractionRequiredAuthError";
         this.errorNo = errorNo;
@@ -6091,8 +6142,8 @@ function isInteractionRequiredError(errorCode, errorString, subError) {
 /**
  * Creates an InteractionRequiredAuthError
  */
-function createInteractionRequiredAuthError(errorCode, errorMessage) {
-    return new InteractionRequiredAuthError(errorCode, errorMessage);
+function createInteractionRequiredAuthError(errorCode, correlationId, errorMessage) {
+    return new InteractionRequiredAuthError(errorCode, correlationId, errorMessage);
 }
 
 /*
@@ -6103,8 +6154,8 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
  * Error thrown when there is an error with the server code, for example, unavailability.
  */
 class ServerError extends AuthError {
-    constructor(errorCode, errorMessage, subError, errorNo, status) {
-        super(errorCode, errorMessage, subError);
+    constructor(errorCode, correlationId, errorMessage, subError, errorNo, status) {
+        super(errorCode, correlationId, errorMessage, subError);
         this.name = "ServerError";
         this.errorNo = errorNo;
         this.status = status;
@@ -6121,9 +6172,10 @@ class ServerError extends AuthError {
  * @param cryptoObj
  * @param userState
  * @param meta
+ * @param correlationId
  */
-function setRequestState(cryptoObj, userState, meta) {
-    const libraryState = generateLibraryState(cryptoObj, meta);
+function setRequestState(cryptoObj, userState, meta, correlationId) {
+    const libraryState = generateLibraryState(cryptoObj, correlationId, meta);
     return userState
         ? `${libraryState}${RESOURCE_DELIM}${userState}`
         : libraryState;
@@ -6131,11 +6183,12 @@ function setRequestState(cryptoObj, userState, meta) {
 /**
  * Generates the state value used by the common library.
  * @param cryptoObj
+ * @param correlationId
  * @param meta
  */
-function generateLibraryState(cryptoObj, meta) {
+function generateLibraryState(cryptoObj, correlationId, meta) {
     if (!cryptoObj) {
-        throw createClientAuthError(noCryptoObject);
+        throw createClientAuthError(noCryptoObject, correlationId);
     }
     // Create a state object containing a unique id and the timestamp of the request creation
     const stateObj = {
@@ -6151,13 +6204,14 @@ function generateLibraryState(cryptoObj, meta) {
  * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
  * @param base64Decode
  * @param state
+ * @param correlationId
  */
-function parseRequestState(base64Decode, state) {
+function parseRequestState(base64Decode, state, correlationId) {
     if (!base64Decode) {
-        throw createClientAuthError(noCryptoObject);
+        throw createClientAuthError(noCryptoObject, correlationId);
     }
     if (!state) {
-        throw createClientAuthError(invalidState);
+        throw createClientAuthError(invalidState, correlationId);
     }
     try {
         // Split the state between library state and user passed state and decode them separately
@@ -6174,7 +6228,7 @@ function parseRequestState(base64Decode, state) {
         };
     }
     catch (e) {
-        throw createClientAuthError(invalidState);
+        throw createClientAuthError(invalidState, correlationId);
     }
 }
 
@@ -6218,7 +6272,7 @@ class ResponseHandler {
             const serverErrorNo = serverResponse.error_codes?.length
                 ? serverResponse.error_codes[0]
                 : undefined;
-            const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
+            const serverError = new ServerError(serverResponse.error || "", serverResponse.correlation_id || "", errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
             // check if 500 error
             if (refreshAccessToken &&
                 serverResponse.status &&
@@ -6240,7 +6294,7 @@ class ResponseHandler {
                 return;
             }
             if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-                throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+                throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.correlation_id || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.claims || "", serverErrorNo);
             }
             throw serverError;
         }
@@ -6250,37 +6304,29 @@ class ResponseHandler {
      * @param serverTokenResponse
      * @param authority
      */
-    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
+    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId, additionalCacheKeyComponents) {
         // create an idToken object (not entity)
         let idTokenClaims;
         if (serverTokenResponse.id_token) {
-            idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode);
+            idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode, request.correlationId);
             // token nonce check (TODO: Add a warning if no nonce is given?)
             if (authCodePayload && authCodePayload.nonce) {
                 if (idTokenClaims.nonce !== authCodePayload.nonce) {
-                    throw createClientAuthError(nonceMismatch);
+                    throw createClientAuthError(nonceMismatch, request.correlationId);
                 }
             }
-            // token max_age check
-            if (request.maxAge || request.maxAge === 0) {
-                const authTime = idTokenClaims.auth_time;
-                if (!authTime) {
-                    throw createClientAuthError(authTimeNotFound);
-                }
-                checkMaxAge(authTime, request.maxAge);
-            }
         }
         // generate homeAccountId
         this.homeAccountIdentifier = generateHomeAccountId(serverTokenResponse.client_info || "", authority.authorityType, this.logger, this.cryptoObj, request.correlationId, idTokenClaims);
         // save the response tokens
         let requestStateObj;
         if (!!authCodePayload && !!authCodePayload.state) {
-            requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state);
+            requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state, request.correlationId);
         }
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
             serverTokenResponse.key_id || request.sshKid || undefined;
-        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload);
+        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents);
         let cacheContext;
         try {
             if (this.persistencePlugin && this.serializableCache) {
@@ -6327,10 +6373,10 @@ class ResponseHandler {
      * @param idTokenObj
      * @param authority
      */
-    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
+    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents) {
         const env = authority.getPreferredCache();
         if (!env) {
-            throw createClientAuthError(invalidCacheEnvironment);
+            throw createClientAuthError(invalidCacheEnvironment, request.correlationId);
         }
         const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
         // IdToken: non AAD scenarios can have empty realm
@@ -6346,8 +6392,8 @@ class ResponseHandler {
         if (serverTokenResponse.access_token) {
             // If scopes not returned in server response, use request scopes
             const responseScopes = serverTokenResponse.scope
-                ? ScopeSet.fromString(serverTokenResponse.scope)
-                : new ScopeSet(request.scopes || []);
+                ? ScopeSet.fromString(serverTokenResponse.scope, request.correlationId)
+                : new ScopeSet(request.scopes || [], request.correlationId);
             /*
              * Use timestamp calculated before request
              * Server may return timestamps as strings, parse to numbers if so.
@@ -6367,7 +6413,7 @@ class ResponseHandler {
                 ? reqTimestamp + refreshIn
                 : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+            cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, request.correlationId, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, additionalCacheKeyComponents);
             // Set resource (to be used for MCP scenarios)
             const resource = request.resource || null;
             if (resource) {
@@ -6433,14 +6479,14 @@ class ResponseHandler {
                 const popTokenGenerator = new PopTokenGenerator(cryptoObj, performanceClient);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
-                    throw createClientAuthError(keyIdMissing);
+                    throw createClientAuthError(keyIdMissing, request.correlationId);
                 }
                 accessToken = await popTokenGenerator.signPopToken(secret, keyId, request);
             }
             else {
                 accessToken = cacheRecord.accessToken.secret;
             }
-            responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
+            responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target, request.correlationId).asArray();
             // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
             expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
             extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
@@ -6458,8 +6504,18 @@ class ResponseHandler {
         const tid = idTokenClaims?.tid || "";
         // for hybrid + native bridge enablement, send back the native account Id
         if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
+            // Set on deprecated top-level for downgrade compat
             cacheRecord.account.nativeAccountId =
                 serverTokenResponse?.spa_accountid;
+            // Set on the matching tenant profile (source of truth)
+            const targetTenantId = tid || cacheRecord.account.realm;
+            if (cacheRecord.account.tenantProfiles) {
+                const matchingProfile = cacheRecord.account.tenantProfiles.find((tp) => tp.tenantId === targetTenantId);
+                if (matchingProfile) {
+                    matchingProfile.nativeAccountId =
+                        serverTokenResponse.spa_accountid;
+                }
+            }
         }
         const accountInfo = cacheRecord.account
             ? updateAccountTenantProfileData(getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
@@ -6518,14 +6574,14 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
             cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
             msGraphHost: authCodePayload?.msgraph_host,
             nativeAccountId: nativeAccountId,
-        }, authority, base64Decode);
+        }, authority, correlationId, base64Decode);
     const tenantProfiles = baseAccount.tenantProfiles || [];
     const tenantId = claimsTenantId || baseAccount.realm;
     if (tenantId &&
         !tenantProfiles.find((tenantProfile) => {
             return tenantProfile.tenantId === tenantId;
         })) {
-        const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, idTokenClaims);
+        const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, nativeAccountId, idTokenClaims);
         tenantProfiles.push(newTenantProfile);
     }
     baseAccount.tenantProfiles = tenantProfiles;
@@ -6545,7 +6601,7 @@ const CcsCredentialType = {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
+async function getClientAssertion(clientAssertion, clientId, tokenEndpoint, fmiPath) {
     if (typeof clientAssertion === "string") {
         return clientAssertion;
     }
@@ -6553,6 +6609,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
         const config = {
             clientId: clientId,
             tokenEndpoint: tokenEndpoint,
+            fmiPath: fmiPath,
         };
         return clientAssertion(config);
     }
@@ -6609,7 +6666,7 @@ class ThrottlingUtils {
                 cacheManager.removeItem(key, correlationId);
                 return;
             }
-            throw new ServerError(value.errorCodes?.join(" ") || "", value.errorMessage, value.subError);
+            throw new ServerError(value.errorCodes?.join(" ") || "", correlationId, value.errorMessage, value.subError);
         }
     }
     /**
@@ -6676,7 +6733,7 @@ class ThrottlingUtils {
  */
 class NetworkError extends AuthError {
     constructor(error, httpStatus, responseHeaders) {
-        super(error.errorCode, error.errorMessage, error.subError);
+        super(error.errorCode, error.correlationId, error.errorMessage, error.subError);
         Object.setPrototypeOf(this, NetworkError.prototype);
         this.name = "NetworkError";
         this.error = error;
@@ -6803,7 +6860,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
             throw e;
         }
         else {
-            throw createClientAuthError(networkError);
+            throw createClientAuthError(networkError, correlationId);
         }
     }
     ThrottlingUtils.postProcess(cacheManager, thumbprint, response, correlationId);
@@ -6856,7 +6913,7 @@ class AuthorizationCodeClient {
      */
     async acquireToken(request, apiId, authCodePayload) {
         if (!request.code) {
-            throw createClientAuthError(requestCannotBeMade);
+            throw createClientAuthError(requestCannotBeMade, request.correlationId);
         }
         // Check for new cloud instance
         if (authCodePayload && authCodePayload.cloud_instance_host_name) {
@@ -6879,7 +6936,7 @@ class AuthorizationCodeClient {
     getLogoutUri(logoutRequest) {
         // Throw error if logoutRequest is null/undefined
         if (!logoutRequest) {
-            throw createClientConfigurationError(logoutRequestEmpty);
+            throw createClientConfigurationError(logoutRequestEmpty, "");
         }
         const queryString = this.createLogoutUrlQueryString(logoutRequest);
         // Construct logout URI
@@ -6927,7 +6984,7 @@ class AuthorizationCodeClient {
         if (!this.includeRedirectUri) {
             // Just validate
             if (!request.redirectUri) {
-                throw createClientConfigurationError(redirectUriEmpty);
+                throw createClientConfigurationError(redirectUriEmpty, request.correlationId);
             }
         }
         else {
@@ -6935,7 +6992,7 @@ class AuthorizationCodeClient {
             addRedirectUri(parameters, request.redirectUri);
         }
         // Add scope array, parameter builder will add default scopes and dedupe
-        addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+        addScopes(parameters, request.scopes, request.correlationId, true, this.oidcDefaultScopes);
         addResource(parameters, request.resource);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
@@ -6978,7 +7035,7 @@ class AuthorizationCodeClient {
                 addSshJwk(parameters, request.sshJwk);
             }
             else {
-                throw createClientConfigurationError(missingSshJwk);
+                throw createClientConfigurationError(missingSshJwk, request.correlationId);
             }
         }
         let ccsCred = undefined;
@@ -7029,7 +7086,7 @@ class AuthorizationCodeClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+        addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
     /**
@@ -7117,11 +7174,11 @@ class RefreshTokenClient {
     async acquireTokenByRefreshToken(request, apiId) {
         // Cannot renew token if no request object is given.
         if (!request) {
-            throw createClientConfigurationError(tokenRequestEmpty);
+            throw createClientConfigurationError(tokenRequestEmpty, "");
         }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
-            throw createClientAuthError(noAccountInSilentRequest);
+            throw createClientAuthError(noAccountInSilentRequest, request.correlationId);
         }
         // try checking if FOCI is enabled for the given application
         const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, request.correlationId);
@@ -7158,7 +7215,7 @@ class RefreshTokenClient {
         // fetches family RT or application RT based on FOCI value
         const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined);
         if (!refreshToken) {
-            throw createInteractionRequiredAuthError(noTokensFound);
+            throw createInteractionRequiredAuthError(noTokensFound, request.correlationId);
         }
         if (refreshToken.expiresOn) {
             const offset = request.refreshTokenExpirationOffsetSeconds ||
@@ -7168,7 +7225,7 @@ class RefreshTokenClient {
                 rtOffsetSeconds: offset,
             }, request.correlationId);
             if (isTokenExpired(refreshToken.expiresOn, offset)) {
-                throw createInteractionRequiredAuthError(refreshTokenExpired);
+                throw createInteractionRequiredAuthError(refreshTokenExpired, request.correlationId);
             }
         }
         // attach cached RT size to the current measurement
@@ -7222,7 +7279,7 @@ class RefreshTokenClient {
         if (request.redirectUri) {
             addRedirectUri(parameters, request.redirectUri);
         }
-        addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addScopes(parameters, request.scopes, request.correlationId, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
         addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
         addClientInfo(parameters);
         addLibraryInfo(parameters, this.config.libraryInfo);
@@ -7258,7 +7315,7 @@ class RefreshTokenClient {
                 addSshJwk(parameters, request.sshJwk);
             }
             else {
-                throw createClientConfigurationError(missingSshJwk);
+                throw createClientConfigurationError(missingSshJwk, request.correlationId);
             }
         }
         if (this.config.systemOptions.preventCorsPreflight &&
@@ -7287,7 +7344,7 @@ class RefreshTokenClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+        addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
 }
@@ -7325,32 +7382,32 @@ class SilentFlowClient {
         if (request.forceRefresh || !StringUtils.isEmptyObj(request.claims)) {
             // Must refresh due to present force_refresh flag.
             this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
-            throw createClientAuthError(noAccountInSilentRequest);
+            throw createClientAuthError(noAccountInSilentRequest, request.correlationId);
         }
         const requestTenantId = request.account.tenantId ||
-            getTenantFromAuthorityString(request.authority);
+            getTenantFromAuthorityString(request.authority, request.correlationId);
         const tokenKeys = this.cacheManager.getTokenKeys();
         const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
         if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
             isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
             // must refresh due to the expires_in value
             this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         else if (request.resource) {
             // cached access token must have a resource that matches the request resource for MCP scenarios
             if (cachedAccessToken.resource !== request.resource) {
                 this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
-                throw createClientAuthError(tokenRefreshRequired);
+                throw createClientAuthError(tokenRefreshRequired, request.correlationId);
             }
         }
         else if (cachedAccessToken.refreshOn &&
@@ -7392,15 +7449,7 @@ class SilentFlowClient {
     async generateResultFromCacheRecord(cacheRecord, request) {
         let idTokenClaims;
         if (cacheRecord.idToken) {
-            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
-        }
-        // token max_age check
-        if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenClaims?.auth_time;
-            if (!authTime) {
-                throw createClientAuthError(authTimeNotFound);
-            }
-            checkMaxAge(authTime, request.maxAge);
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode, request.correlationId);
         }
         return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
     }
@@ -7411,11 +7460,12 @@ class SilentFlowClient {
  * Licensed under the MIT License.
  */
 const StubbedNetworkModule = {
+    // Module-level singleton: no per-request correlationId available
     sendGetRequestAsync: () => {
-        return Promise.reject(createClientAuthError(methodNotImplemented));
+        return Promise.reject(createClientAuthError(methodNotImplemented, ""));
     },
     sendPostRequestAsync: () => {
-        return Promise.reject(createClientAuthError(methodNotImplemented));
+        return Promise.reject(createClientAuthError(methodNotImplemented, ""));
     },
 };
 
@@ -7443,7 +7493,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
         ...(request.scopes || []),
         ...(request.extraScopesToConsent || []),
     ];
-    addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addScopes(parameters, requestScopes, request.correlationId, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
     addResource(parameters, request.resource);
     addRedirectUri(parameters, request.redirectUri);
     addCorrelationId(parameters, correlationId);
@@ -7545,7 +7595,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
-    addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
+    addClaims(parameters, request.correlationId, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -7570,13 +7620,14 @@ function getAuthorizeUrl(authority, requestParameters) {
  * the client to exchange for a token in acquireToken.
  * @param serverParams
  * @param cachedState
+ * @param correlationId
  */
-function getAuthorizationCodePayload(serverParams, cachedState) {
+function getAuthorizationCodePayload(serverParams, cachedState, correlationId) {
     // Get code response
-    validateAuthorizationResponse(serverParams, cachedState);
+    validateAuthorizationResponse(serverParams, cachedState, correlationId);
     // throw when there is no auth code in the response
     if (!serverParams.code) {
-        throw createClientAuthError(authorizationCodeMissingFromServerResponse);
+        throw createClientAuthError(authorizationCodeMissingFromServerResponse, correlationId);
     }
     return serverParams;
 }
@@ -7584,12 +7635,13 @@ function getAuthorizationCodePayload(serverParams, cachedState) {
  * Function which validates server authorization code response.
  * @param serverResponseHash
  * @param requestState
+ * @param correlationId
  */
-function validateAuthorizationResponse(serverResponse, requestState) {
+function validateAuthorizationResponse(serverResponse, requestState, correlationId) {
     if (!serverResponse.state || !requestState) {
         throw serverResponse.state
-            ? createClientAuthError(stateNotFound, "Cached State")
-            : createClientAuthError(stateNotFound, "Server State");
+            ? createClientAuthError(stateNotFound, correlationId, "Cached State")
+            : createClientAuthError(stateNotFound, correlationId, "Server State");
     }
     let decodedServerResponseState;
     let decodedRequestState;
@@ -7597,16 +7649,16 @@ function validateAuthorizationResponse(serverResponse, requestState) {
         decodedServerResponseState = decodeURIComponent(serverResponse.state);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
     }
     try {
         decodedRequestState = decodeURIComponent(requestState);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
     }
     if (decodedServerResponseState !== decodedRequestState) {
-        throw createClientAuthError(stateMismatch);
+        throw createClientAuthError(stateMismatch, correlationId);
     }
     // Check for error
     if (serverResponse.error ||
@@ -7614,9 +7666,9 @@ function validateAuthorizationResponse(serverResponse, requestState) {
         serverResponse.suberror) {
         const serverErrorNo = parseServerErrorNo(serverResponse);
         if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-            throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+            throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.correlation_id || correlationId, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.claims || "", serverErrorNo);
         }
-        throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
+        throw new ServerError(serverResponse.error || "", serverResponse.correlation_id || correlationId, serverResponse.error_description, serverResponse.suberror, serverErrorNo);
     }
 }
 /**
@@ -7668,10 +7720,10 @@ function enforceResourceParameter(isMcp, request) {
     if (request.resource &&
         (containsResourceParam(request.extraParameters) ||
             containsResourceParam(request.extraQueryParameters))) {
-        throw createClientAuthError(misplacedResourceParam);
+        throw createClientAuthError(misplacedResourceParam, request.correlationId || "");
     }
     if (!request.resource) {
-        throw createClientAuthError(resourceParameterRequired);
+        throw createClientAuthError(resourceParameterRequired, request.correlationId || "");
     }
 }
 function containsResourceParam(params) {
@@ -7705,7 +7757,7 @@ class AuthenticationHeaderParser {
             if (authenticationInfoChallenges.nextnonce) {
                 return authenticationInfoChallenges.nextnonce;
             }
-            throw createClientConfigurationError(invalidAuthenticationHeader);
+            throw createClientConfigurationError(invalidAuthenticationHeader, "");
         }
         // Attempt to parse nonce from WWW-Authenticate
         const wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
@@ -7714,10 +7766,10 @@ class AuthenticationHeaderParser {
             if (wwwAuthenticateChallenges.nonce) {
                 return wwwAuthenticateChallenges.nonce;
             }
-            throw createClientConfigurationError(invalidAuthenticationHeader);
+            throw createClientConfigurationError(invalidAuthenticationHeader, "");
         }
         // If neither header is present, throw missing headers error
-        throw createClientConfigurationError(missingNonceAuthenticationHeader);
+        throw createClientConfigurationError(missingNonceAuthenticationHeader, "");
     }
     /**
      * Parses an HTTP header's challenge set into a key/value map.
@@ -7767,12 +7819,12 @@ function tagToString(tag) {
  * Error class for MSAL Runtime errors that preserves detailed broker information
  */
 class PlatformBrokerError extends AuthError {
-    constructor(errorStatus, errorContext, errorCode, errorTag) {
+    constructor(errorStatus, correlationId, errorContext, errorCode, errorTag) {
         const tagString = tagToString(errorTag);
         const enhancedErrorContext = errorContext
             ? `${errorContext} (Error Code: ${errorCode}, Tag: ${tagString})`
             : `(Error Code: ${errorCode}, Tag: ${tagString})`;
-        super(errorStatus, enhancedErrorContext);
+        super(errorStatus, correlationId, enhancedErrorContext);
         this.name = "PlatformBrokerError";
         this.statusCode = errorCode;
         this.tag = tagString;
@@ -8150,4 +8202,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-CcOYLhxB.js.map
+//# sourceMappingURL=index-node-BSFEsmmC.js.map