@openclaw/msteams 2026.7.1-beta.1 → 2026.7.1-beta.4

package/node_modules/@azure/msal-node/lib/msal-node.cjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-node v5.2.3 2026-06-05 */
+/*! @azure/msal-node v5.3.1 2026-06-30 */
 'use strict';
 'use strict';
 
@@ -94,6 +94,7 @@ class Serializer {
                 token_type: atEntity.tokenType,
                 userAssertionHash: atEntity.userAssertionHash,
                 resource: atEntity.resource,
+                additionalCacheKeyComponents: atEntity.additionalCacheKeyComponents,
             };
         });
         return accessTokens;
@@ -150,7 +151,7 @@ class Serializer {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -180,8 +181,8 @@ const AUTHORIZATION_PENDING = "authorization_pending";
 const NOT_APPLICABLE = "N/A";
 const NOT_AVAILABLE = "Not Available";
 const FORWARD_SLASH = "/";
-const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute/location";
-const IMDS_VERSION = "2020-06-01";
+const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute";
+const IMDS_VERSION = "2021-02-01";
 const IMDS_TIMEOUT = 2000;
 const AZURE_REGION_AUTO_DISCOVER_FLAG = "TryAutoDetect";
 const REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX = "login.microsoft.com";
@@ -240,6 +241,9 @@ const AADAuthority = {
 const ClaimsRequestKeys = {
     ACCESS_TOKEN: "access_token",
     XMS_CC: "xms_cc",
+    ID_TOKEN: "id_token",
+    SIGNIN_STATE: "signin_state",
+    LOGIN_HINT: "login_hint",
 };
 /**
  * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
@@ -284,6 +288,7 @@ const GrantType = {
     REFRESH_TOKEN_GRANT: "refresh_token",
     DEVICE_CODE_GRANT: "device_code",
     JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    USER_FIC: "user_fic",
 };
 /**
  * Account types in Cache
@@ -398,7 +403,7 @@ const EncodingTypes = {
     UTF8: "utf-8",
 };
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -449,9 +454,13 @@ const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 const INSTANCE_AWARE = "instance_aware";
 const RESOURCE = "resource";
-const CLI_DATA = "clidata";
+const CLI_DATA = "clidata";
+const USER_FEDERATED_IDENTITY_CREDENTIAL = "user_federated_identity_credential";
+const USERNAME = "username";
+const USER_ID = "user_id";
+const FMI_PATH = "fmi_path";
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -463,7 +472,7 @@ function getDefaultErrorMessage(code) {
  * General error class thrown by the MSAL.js library.
  */
 class AuthError extends Error {
-    constructor(errorCode, errorMessage, suberror) {
+    constructor(errorCode, correlationId, errorMessage, suberror) {
         const message = errorMessage ||
             (errorCode ? getDefaultErrorMessage(errorCode) : "");
         const errorString = message ? `${errorCode}: ${message}` : errorCode;
@@ -472,17 +481,15 @@ class AuthError extends Error {
         this.errorCode = errorCode || "";
         this.errorMessage = message || "";
         this.subError = suberror || "";
-        this.name = "AuthError";
-    }
-    setCorrelationId(correlationId) {
         this.correlationId = correlationId;
+        this.name = "AuthError";
     }
 }
-function createAuthError(code, additionalMessage) {
-    return new AuthError(code, additionalMessage || getDefaultErrorMessage(code));
+function createAuthError(code, correlationId, additionalMessage) {
+    return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage(code));
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -492,17 +499,17 @@ function createAuthError(code, additionalMessage) {
  * Error thrown when there is an error in configuration of the MSAL.js library.
  */
 class ClientConfigurationError extends AuthError {
-    constructor(errorCode) {
-        super(errorCode);
+    constructor(errorCode, correlationId) {
+        super(errorCode, correlationId);
         this.name = "ClientConfigurationError";
         Object.setPrototypeOf(this, ClientConfigurationError.prototype);
     }
 }
-function createClientConfigurationError(errorCode) {
-    return new ClientConfigurationError(errorCode);
+function createClientConfigurationError(errorCode, correlationId) {
+    return new ClientConfigurationError(errorCode, correlationId);
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -582,7 +589,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -595,17 +602,17 @@ class StringUtils {
  * Error thrown when there is an error in the client code running on the browser.
  */
 class ClientAuthError extends AuthError {
-    constructor(errorCode, additionalMessage) {
-        super(errorCode, additionalMessage);
+    constructor(errorCode, correlationId, additionalMessage) {
+        super(errorCode, correlationId, additionalMessage);
         this.name = "ClientAuthError";
         Object.setPrototypeOf(this, ClientAuthError.prototype);
     }
 }
-function createClientAuthError(errorCode, additionalMessage) {
-    return new ClientAuthError(errorCode, additionalMessage);
+function createClientAuthError(errorCode, correlationId, additionalMessage) {
+    return new ClientAuthError(errorCode, correlationId, additionalMessage);
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -663,7 +670,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -680,8 +687,6 @@ const invalidState = "invalid_state";
 const stateMismatch = "state_mismatch";
 const stateNotFound = "state_not_found";
 const nonceMismatch = "nonce_mismatch";
-const authTimeNotFound = "auth_time_not_found";
-const maxAgeTranspired = "max_age_transpired";
 const multipleMatchingTokens = "multiple_matching_tokens";
 const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
 const requestCannotBeMade = "request_cannot_be_made";
@@ -710,7 +715,6 @@ const misplacedResourceParam = "misplaced_resource_parameter";
 
 var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
-    authTimeNotFound: authTimeNotFound,
     authorizationCodeMissingFromServerResponse: authorizationCodeMissingFromServerResponse,
     bindingKeyNotRemoved: bindingKeyNotRemoved,
     cannotAppendScopeSet: cannotAppendScopeSet,
@@ -725,7 +729,6 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     invalidCacheRecord: invalidCacheRecord,
     invalidState: invalidState,
     keyIdMissing: keyIdMissing,
-    maxAgeTranspired: maxAgeTranspired,
     methodNotImplemented: methodNotImplemented,
     misplacedResourceParam: misplacedResourceParam,
     multipleMatchingAppMetadata: multipleMatchingAppMetadata,
@@ -751,7 +754,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userCanceled: userCanceled
 });
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -763,7 +766,8 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
  * to ensure uniqueness of strings.
  */
 class ScopeSet {
-    constructor(inputScopes) {
+    constructor(inputScopes, correlationId) {
+        this.correlationId = correlationId;
         // Filter empty string and null/undefined array items
         const scopeArr = inputScopes
             ? StringUtils.trimArrayEntries([...inputScopes])
@@ -773,7 +777,7 @@ class ScopeSet {
             : [];
         // Check if scopes array has at least one member
         if (!filteredInput || !filteredInput.length) {
-            throw createClientConfigurationError(emptyInputScopesError);
+            throw createClientConfigurationError(emptyInputScopesError, correlationId);
         }
         this.scopes = new Set(); // Iterator in constructor not supported by IE11
         filteredInput.forEach((scope) => this.scopes.add(scope));
@@ -784,22 +788,22 @@ class ScopeSet {
      * @param appClientId
      * @param scopesRequired
      */
-    static fromString(inputScopeString) {
+    static fromString(inputScopeString, correlationId) {
         const scopeString = inputScopeString || "";
         const inputScopes = scopeString.split(" ");
-        return new ScopeSet(inputScopes);
+        return new ScopeSet(inputScopes, correlationId);
     }
     /**
      * Creates the set of scopes to search for in cache lookups
      * @param inputScopeString
      * @returns
      */
-    static createSearchScopes(inputScopeString) {
+    static createSearchScopes(inputScopeString, correlationId) {
         // Handle empty scopes by using default OIDC scopes for cache lookup
         const scopesToUse = inputScopeString && inputScopeString.length > 0
             ? inputScopeString
             : [...OIDC_DEFAULT_SCOPES];
-        const scopeSet = new ScopeSet(scopesToUse);
+        const scopeSet = new ScopeSet(scopesToUse, correlationId);
         if (!scopeSet.containsOnlyOIDCScopes()) {
             scopeSet.removeOIDCScopes();
         }
@@ -814,7 +818,7 @@ class ScopeSet {
      */
     containsScope(scope) {
         const lowerCaseScopes = this.printScopesLowerCase().split(" ");
-        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
+        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes, this.correlationId);
         // compare lowercase scopes
         return scope
             ? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
@@ -861,7 +865,7 @@ class ScopeSet {
             newScopes.forEach((newScope) => this.appendScope(newScope));
         }
         catch (e) {
-            throw createClientAuthError(cannotAppendScopeSet);
+            throw createClientAuthError(cannotAppendScopeSet, this.correlationId);
         }
     }
     /**
@@ -870,7 +874,7 @@ class ScopeSet {
      */
     removeScope(scope) {
         if (!scope) {
-            throw createClientAuthError(cannotRemoveEmptyScope);
+            throw createClientAuthError(cannotRemoveEmptyScope, this.correlationId);
         }
         this.scopes.delete(scope.trim());
     }
@@ -889,7 +893,7 @@ class ScopeSet {
      */
     unionScopeSets(otherScopes) {
         if (!otherScopes) {
-            throw createClientAuthError(emptyInputScopeSet);
+            throw createClientAuthError(emptyInputScopeSet, this.correlationId);
         }
         const unionScopes = new Set(); // Iterator in constructor not supported in IE11
         otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
@@ -902,7 +906,7 @@ class ScopeSet {
      */
     intersectingScopeSets(otherScopes) {
         if (!otherScopes) {
-            throw createClientAuthError(emptyInputScopeSet);
+            throw createClientAuthError(emptyInputScopeSet, this.correlationId);
         }
         // Do not allow OIDC scopes to be the only intersecting scopes
         if (!otherScopes.containsOnlyOIDCScopes()) {
@@ -946,7 +950,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -984,7 +988,7 @@ function addResponseMode(parameters, responseMode) {
  * @param scopeSet
  * @param addOidcScopes
  */
-function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+function addScopes(parameters, scopes, correlationId, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
     // Always add openid to the scopes when adding OIDC scopes
     if (addOidcScopes &&
         !defaultScopes.includes("openid") &&
@@ -994,7 +998,7 @@ function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OID
     const requestScopes = addOidcScopes
         ? [...(scopes || []), ...defaultScopes]
         : scopes || [];
-    const scopeSet = new ScopeSet(requestScopes);
+    const scopeSet = new ScopeSet(requestScopes, correlationId);
     parameters.set(SCOPE, scopeSet.printScopes());
 }
 /**
@@ -1064,26 +1068,18 @@ function addSid(parameters, sid) {
  * Adds claims to request parameters, conditionally excluding clientCapabilities
  * when skipBrokerClaims is true and a brokered flow is in effect.
  * @param parameters - The request parameters map
+ * @param correlationId - The request correlation id
  * @param claims - The claims string from the request
  * @param clientCapabilities - The client capabilities from configuration
  * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
  */
-function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims) {
     // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
     const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
         ? undefined
         : clientCapabilities;
-    if (!StringUtils.isEmptyObj(claims) ||
-        (configClaims && configClaims.length > 0)) {
-        const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
-        try {
-            JSON.parse(mergedClaims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-        parameters.set(CLAIMS, mergedClaims);
-    }
+    const mergedClaims = buildMergedClaims(claims, configClaims, correlationId);
+    parameters.set(CLAIMS, mergedClaims);
 }
 /**
  * add correlationId
@@ -1154,7 +1150,7 @@ function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod)
         parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
     }
     else {
-        throw createClientConfigurationError(pkceParamsMissing);
+        throw createClientConfigurationError(pkceParamsMissing, "");
     }
 }
 /**
@@ -1260,7 +1256,23 @@ function addExtraParameters(parameters, extraParams) {
         }
     });
 }
-function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+/**
+ * Default optional idToken claims requested on all auth requests.
+ * signin_state enables KMSI detection; login_hint enables login hint propagation.
+ */
+const DEFAULT_ID_TOKEN_CLAIMS = {
+    [ClaimsRequestKeys.SIGNIN_STATE]: { essential: false },
+    [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
+};
+/**
+ * Parses claims JSON, merges default optional idToken claims (signin_state, login_hint),
+ * and appends client capabilities (xms_cc) to the access_token section.
+ * Does not overwrite idToken claims already specified by the caller.
+ * @param claims - Existing claims JSON string from the request (may be undefined)
+ * @param clientCapabilities - Client capabilities array from configuration
+ * @returns Merged claims JSON string
+ */
+function buildMergedClaims(claims, clientCapabilities, correlationId = "") {
     let mergedClaims;
     // Parse provided claims into JSON object or initialize empty object
     if (!claims) {
@@ -1268,14 +1280,31 @@ function addClientCapabilitiesToClaims(claims, clientCapabilities) {
     }
     else {
         try {
-            mergedClaims = JSON.parse(claims);
+            const parsed = JSON.parse(claims);
+            if (typeof parsed !== "object" ||
+                parsed === null ||
+                Array.isArray(parsed)) {
+                throw new Error("Claims must be a JSON object");
+            }
+            mergedClaims = parsed;
         }
         catch (e) {
-            throw createClientConfigurationError(invalidClaims);
+            throw createClientConfigurationError(invalidClaims, correlationId);
         }
     }
+    // Add default optional idToken claims
+    if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ID_TOKEN)) {
+        mergedClaims[ClaimsRequestKeys.ID_TOKEN] = {};
+    }
+    const idTokenClaims = mergedClaims[ClaimsRequestKeys.ID_TOKEN];
+    for (const [key, value] of Object.entries(DEFAULT_ID_TOKEN_CLAIMS)) {
+        if (!(key in idTokenClaims)) {
+            idTokenClaims[key] = value;
+        }
+    }
+    // Add client capabilities
     if (clientCapabilities && clientCapabilities.length > 0) {
-        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+        if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ACCESS_TOKEN)) {
             // Add access_token key to claims object
             mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
         }
@@ -1322,6 +1351,7 @@ function addSshJwk(parameters, sshJwkString) {
 /**
  * add server telemetry fields
  * @param serverTelemetryManager
+ * @internal
  */
 function addServerTelemetry(parameters, serverTelemetryManager) {
     parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
@@ -1353,7 +1383,12 @@ function addResource(parameters, resource) {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -1391,7 +1426,7 @@ function getDeserializedResponse(responseString) {
         }
     }
     catch (e) {
-        throw createClientAuthError(hashNotDeserialized);
+        throw createClientAuthError(hashNotDeserialized, "");
     }
     return null;
 }
@@ -1406,7 +1441,7 @@ function mapToQueryString(parameters) {
     return queryParameterArray.join("&");
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1414,38 +1449,38 @@ function mapToQueryString(parameters) {
  */
 const DEFAULT_CRYPTO_IMPLEMENTATION = {
     createNewGuid: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     base64Decode: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     base64Encode: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     base64UrlEncode: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     encodeKid: () => {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async getPublicKeyThumbprint() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async removeTokenBindingKey() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async clearKeystore() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async signJwt() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async hashString() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
 };
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1493,7 +1528,7 @@ function addLogToCache(correlationId, loggedMessage) {
         // Remove LRU (first entry) if capacity exceeded
         if (correlationCache.size > CACHE_CAPACITY) {
             const firstKey = correlationCache.keys().next().value;
-            if (firstKey) {
+            if (firstKey !== undefined) {
                 correlationCache.delete(firstKey);
             }
         }
@@ -1508,22 +1543,36 @@ function addLogToCache(correlationId, loggedMessage) {
     }
 }
 /**
- * Checks if a string is already a hashed logging string (6 alphanumeric characters)
- */
-function isHashedString(str) {
-    if (str.length !== 6) {
-        return false;
+ * Extracts the leading minification hash from a log message, if present.
+ *
+ * Minified messages are produced by the logger-minify rollup plugin and are
+ * either a bare 6-character alphanumeric hash, or that hash followed by a space
+ * and runtime variables appended for local (console) logging, e.g.
+ * "abc123 user-1 popup". Only the leading hash is returned so that telemetry
+ * never captures the appended variables. Returns null when the message is not
+ * a minified message.
+ */
+function getMessageHash(str) {
+    if (str.length < 6) {
+        return null;
+    }
+    /*
+     * If the message is longer than the hash, the hash must be delimited by a
+     * space (the separator the plugin inserts before appended variables).
+     */
+    if (str.length > 6 && str[6] !== " ") {
+        return null;
     }
-    for (let i = 0; i < str.length; i++) {
+    for (let i = 0; i < 6; i++) {
         const char = str[i];
         const isAlphaNumeric = (char >= "a" && char <= "z") ||
             (char >= "A" && char <= "Z") ||
             (char >= "0" && char <= "9");
         if (!isAlphaNumeric) {
-            return false;
+            return null;
         }
     }
-    return true;
+    return str.substring(0, 6);
 }
 /**
  * Class which facilitates logging of messages to a specific place.
@@ -1570,10 +1619,10 @@ class Logger {
      */
     logMessage(logMessage, options) {
         const correlationId = options.correlationId;
-        const isHashedInput = isHashedString(logMessage);
-        if (isHashedInput) {
+        const messageHash = getMessageHash(logMessage);
+        if (messageHash) {
             const loggedMessage = {
-                hash: logMessage,
+                hash: messageHash,
                 level: options.logLevel,
                 containsPii: options.containsPii || false,
                 milliseconds: 0, // Will be calculated in addLogToCache
@@ -1706,12 +1755,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.7.0";
+const version$1 = "16.11.0";
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1731,7 +1780,74 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Extract token by decoding the rawToken
+ *
+ * @param encodedToken
+ */
+function extractTokenClaims(encodedToken, base64Decode, correlationId) {
+    const jswPayload = getJWSPayload(encodedToken, correlationId);
+    // token will be decoded to get the username
+    try {
+        // base64Decode() should throw an error if there is an issue
+        const base64Decoded = base64Decode(jswPayload);
+        return JSON.parse(base64Decoded);
+    }
+    catch (err) {
+        throw createClientAuthError(tokenParsingError, correlationId);
+    }
+}
+/**
+ * Check if the signin_state claim contains "kmsi"
+ * @param idTokenClaims
+ * @returns
+ */
+function isKmsi(idTokenClaims) {
+    if (!idTokenClaims.signin_state) {
+        return false;
+    }
+    /**
+     * Signin_state claim known values:
+     * dvc_mngd - device is managed
+     * dvc_dmjd - device is domain joined
+     * kmsi - user opted to "keep me signed in"
+     * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
+     */
+    const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
+    return idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
+}
+/**
+ * decode a JWT
+ *
+ * @param authToken
+ */
+function getJWSPayload(authToken, correlationId) {
+    if (!authToken) {
+        throw createClientAuthError(nullOrEmptyToken, correlationId);
+    }
+    const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
+    const matches = tokenPartsRegex.exec(authToken);
+    if (!matches || matches.length < 4) {
+        throw createClientAuthError(tokenParsingError, correlationId);
+    }
+    /**
+     * const crackedToken = {
+     *  header: matches[1],
+     *  JWSPayload: matches[2],
+     *  JWSSig: matches[3],
+     * };
+     */
+    return matches[2];
+}
+
+/*! @azure/msal-common v16.11.0 2026-06-30 */
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1752,10 +1868,11 @@ function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
  * @param homeAccountId - Home account identifier for this account object
  * @param localAccountId - Local account identifer for this account object
  * @param tenantId - Full tenant or organizational id that this account belongs to
+ * @param nativeAccountId - Native account identifier for this tenant
  * @param idTokenClaims - Claims from the ID token
  * @returns
  */
-function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
+function buildTenantProfile(homeAccountId, localAccountId, tenantId, nativeAccountId, idTokenClaims) {
     if (idTokenClaims) {
         const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint, } = idTokenClaims;
         /**
@@ -1773,6 +1890,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
             upn: upn,
+            ...(nativeAccountId && { nativeAccountId }),
         };
     }
     else {
@@ -1781,6 +1899,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             localAccountId,
             username: "",
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            ...(nativeAccountId && { nativeAccountId }),
         };
     }
 }
@@ -1802,99 +1921,20 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     if (idTokenClaims) {
         // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
+        const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, updatedAccountInfo.nativeAccountId, idTokenClaims);
         updatedAccountInfo = {
             ...updatedAccountInfo,
             ...claimsSourcedTenantProfile,
             idTokenClaims: idTokenClaims,
             idToken: idTokenSecret,
+            kmsi: isKmsi(idTokenClaims),
         };
         return updatedAccountInfo;
     }
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Extract token by decoding the rawToken
- *
- * @param encodedToken
- */
-function extractTokenClaims(encodedToken, base64Decode) {
-    const jswPayload = getJWSPayload(encodedToken);
-    // token will be decoded to get the username
-    try {
-        // base64Decode() should throw an error if there is an issue
-        const base64Decoded = base64Decode(jswPayload);
-        return JSON.parse(base64Decoded);
-    }
-    catch (err) {
-        throw createClientAuthError(tokenParsingError);
-    }
-}
-/**
- * Check if the signin_state claim contains "kmsi"
- * @param idTokenClaims
- * @returns
- */
-function isKmsi(idTokenClaims) {
-    if (!idTokenClaims.signin_state) {
-        return false;
-    }
-    /**
-     * Signin_state claim known values:
-     * dvc_mngd - device is managed
-     * dvc_dmjd - device is domain joined
-     * kmsi - user opted to "keep me signed in"
-     * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
-     */
-    const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
-    return idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
-}
-/**
- * decode a JWT
- *
- * @param authToken
- */
-function getJWSPayload(authToken) {
-    if (!authToken) {
-        throw createClientAuthError(nullOrEmptyToken);
-    }
-    const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
-    const matches = tokenPartsRegex.exec(authToken);
-    if (!matches || matches.length < 4) {
-        throw createClientAuthError(tokenParsingError);
-    }
-    /**
-     * const crackedToken = {
-     *  header: matches[1],
-     *  JWSPayload: matches[2],
-     *  JWSSig: matches[3],
-     * };
-     */
-    return matches[2];
-}
-/**
- * Determine if the token's max_age has transpired
- */
-function checkMaxAge(authTime, maxAge) {
-    /*
-     * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-     * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
-     * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
-     */
-    const fiveMinuteSkew = 300000; // five minutes in milliseconds
-    if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
-        throw createClientAuthError(maxAgeTranspired);
-    }
-}
-
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1907,11 +1947,12 @@ class UrlString {
     get urlString() {
         return this._urlString;
     }
-    constructor(url) {
+    constructor(url, correlationId) {
         this._urlString = url;
+        this.correlationId = correlationId;
         if (!this._urlString) {
             // Throws error if url is empty
-            throw createClientConfigurationError(urlEmptyError);
+            throw createClientConfigurationError(urlEmptyError, correlationId);
         }
         if (!url.includes("#")) {
             this._urlString = UrlString.canonicalizeUri(url);
@@ -1947,16 +1988,16 @@ class UrlString {
             components = this.getUrlComponents();
         }
         catch (e) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, this.correlationId);
         }
         // Throw error if URI or path segments are not parseable.
         if (!components.HostNameAndPort || !components.PathSegments) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, this.correlationId);
         }
         // Throw error if uri is insecure.
         if (!components.Protocol ||
             components.Protocol.toLowerCase() !== "https:") {
-            throw createClientConfigurationError(authorityUriInsecure);
+            throw createClientConfigurationError(authorityUriInsecure, this.correlationId);
         }
     }
     /**
@@ -1993,7 +2034,7 @@ class UrlString {
                 pathArray[0] === AADAuthority.ORGANIZATIONS)) {
             pathArray[0] = tenantId;
         }
-        return UrlString.constructAuthorityUriFromObject(urlObject);
+        return UrlString.constructAuthorityUriFromObject(urlObject, this.correlationId);
     }
     /**
      * Parses out the components from a url string.
@@ -2005,7 +2046,7 @@ class UrlString {
         // If url string does not match regEx, we throw an error
         const match = this.urlString.match(regEx);
         if (!match) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, this.correlationId);
         }
         // Url component object
         const urlComponents = {
@@ -2023,17 +2064,17 @@ class UrlString {
         }
         return urlComponents;
     }
-    static getDomainFromUrl(url) {
+    static getDomainFromUrl(url, correlationId) {
         const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
         const match = url.match(regEx);
         if (!match) {
-            throw createClientConfigurationError(urlParseError);
+            throw createClientConfigurationError(urlParseError, correlationId);
         }
         return match[2];
     }
-    static getAbsoluteUrl(relativeUrl, baseUrl) {
+    static getAbsoluteUrl(relativeUrl, baseUrl, correlationId) {
         if (relativeUrl[0] === FORWARD_SLASH) {
-            const url = new UrlString(baseUrl);
+            const url = new UrlString(baseUrl, correlationId);
             const baseComponents = url.getUrlComponents();
             return (baseComponents.Protocol +
                 "//" +
@@ -2042,16 +2083,16 @@ class UrlString {
         }
         return relativeUrl;
     }
-    static constructAuthorityUriFromObject(urlObject) {
+    static constructAuthorityUriFromObject(urlObject, correlationId) {
         return new UrlString(urlObject.Protocol +
             "//" +
             urlObject.HostNameAndPort +
             "/" +
-            urlObject.PathSegments.join("/"));
+            urlObject.PathSegments.join("/"), correlationId);
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2167,7 +2208,7 @@ function getAliasesFromStaticSources(staticAuthorityOptions, logger, correlation
     let staticAliases;
     const canonicalAuthority = staticAuthorityOptions.canonicalAuthority;
     if (canonicalAuthority) {
-        const authorityHost = new UrlString(canonicalAuthority).getUrlComponents().HostNameAndPort;
+        const authorityHost = new UrlString(canonicalAuthority, correlationId).getUrlComponents().HostNameAndPort;
         staticAliases =
             getAliasesFromMetadata(logger, correlationId, authorityHost, staticAuthorityOptions.cloudDiscoveryMetadata?.metadata, AuthorityMetadataSource.CONFIG) ||
                 getAliasesFromMetadata(logger, correlationId, authorityHost, InstanceDiscoveryMetadata.metadata, AuthorityMetadataSource.HARDCODED_VALUES) ||
@@ -2217,7 +2258,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2225,7 +2266,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2263,7 +2304,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2276,14 +2317,14 @@ function createCacheError(e) {
  */
 function buildClientInfo(rawClientInfo, base64Decode) {
     if (!rawClientInfo) {
-        throw createClientAuthError(clientInfoEmptyError);
+        throw createClientAuthError(clientInfoEmptyError, "");
     }
     try {
         const decodedClientInfo = base64Decode(rawClientInfo);
         return JSON.parse(decodedClientInfo);
     }
     catch (e) {
-        throw createClientAuthError(clientInfoDecodingError);
+        throw createClientAuthError(clientInfoDecodingError, "");
     }
 }
 /**
@@ -2292,7 +2333,7 @@ function buildClientInfo(rawClientInfo, base64Decode) {
  */
 function buildClientInfoFromHomeAccountId(homeAccountId) {
     if (!homeAccountId) {
-        throw createClientAuthError(clientInfoDecodingError);
+        throw createClientAuthError(clientInfoDecodingError, "");
     }
     const clientInfoParts = homeAccountId.split(CLIENT_INFO_SEPARATOR, 2);
     return {
@@ -2301,7 +2342,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2316,7 +2357,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2338,7 +2379,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2362,9 +2403,10 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /**
  * Returns the AccountInfo interface for this account.
+ * @internal
  */
 function getAccountInfo(accountEntity) {
     const tenantProfiles = accountEntity.tenantProfiles || [];
@@ -2372,8 +2414,11 @@ function getAccountInfo(accountEntity) {
     if (tenantProfiles.length === 0 &&
         accountEntity.realm &&
         accountEntity.localAccountId) {
-        tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm));
+        tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm, accountEntity.nativeAccountId));
     }
+    // Resolve nativeAccountId from the home tenant profile first, fall back to top-level (deprecated) for old cache entries
+    const homeTenantProfile = tenantProfiles.find((tp) => tp.tenantId === accountEntity.realm);
+    const nativeAccountId = homeTenantProfile?.nativeAccountId || accountEntity.nativeAccountId;
     return {
         homeAccountId: accountEntity.homeAccountId,
         environment: accountEntity.environment,
@@ -2382,7 +2427,7 @@ function getAccountInfo(accountEntity) {
         localAccountId: accountEntity.localAccountId,
         loginHint: accountEntity.loginHint,
         name: accountEntity.name,
-        nativeAccountId: accountEntity.nativeAccountId,
+        nativeAccountId: nativeAccountId,
         authorityType: accountEntity.authorityType,
         // Deserialize tenant profiles array into a Map
         tenantProfiles: new Map(tenantProfiles.map((tenantProfile) => {
@@ -2394,8 +2439,9 @@ function getAccountInfo(accountEntity) {
 /**
  * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
  * @param accountDetails
+ * @internal
  */
-function createAccountEntity(accountDetails, authority, base64Decode) {
+function createAccountEntity(accountDetails, authority, correlationId, base64Decode) {
     let authorityType;
     if (authority.authorityType === AuthorityType.Adfs) {
         authorityType = CACHE_ACCOUNT_TYPE_ADFS;
@@ -2417,7 +2463,7 @@ function createAccountEntity(accountDetails, authority, base64Decode) {
     const env = accountDetails.environment ||
         (authority && authority.getPreferredCache());
     if (!env) {
-        throw createClientAuthError(invalidCacheEnvironment);
+        throw createClientAuthError(invalidCacheEnvironment, correlationId);
     }
     /*
      * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
@@ -2444,7 +2490,7 @@ function createAccountEntity(accountDetails, authority, base64Decode) {
         tenantProfiles = accountDetails.tenantProfiles;
     }
     else {
-        const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.idTokenClaims);
+        const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.nativeAccountId, accountDetails.idTokenClaims);
         tenantProfiles = [tenantProfile];
     }
     return {
@@ -2492,6 +2538,7 @@ function generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, co
 /**
  * Validates an entity: checks for all expected params
  * @param entity
+ * @internal
  */
 function isAccountEntity(entity) {
     if (!entity) {
@@ -2505,7 +2552,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2594,7 +2641,7 @@ class CacheManager {
         }
         const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
         if (idToken) {
-            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
+            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode, correlationId);
             if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
                 // ID token sourced claims don't match so this tenant profile is not a match
                 return null;
@@ -2657,6 +2704,11 @@ class CacheManager {
             !(tenantProfile.upn === tenantProfileFilter.upn)) {
             return false;
         }
+        if (!!tenantProfileFilter.nativeAccountId &&
+            tenantProfile.nativeAccountId !==
+                tenantProfileFilter.nativeAccountId) {
+            return false;
+        }
         return true;
     }
     idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -2694,7 +2746,7 @@ class CacheManager {
      */
     async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
         if (!cacheRecord) {
-            throw createClientAuthError(invalidCacheRecord);
+            throw createClientAuthError(invalidCacheRecord, correlationId);
         }
         try {
             if (!!cacheRecord.account) {
@@ -2739,7 +2791,7 @@ class CacheManager {
             tokenType: credential.tokenType,
         };
         const tokenKeys = this.getTokenKeys();
-        const currentScopes = ScopeSet.fromString(credential.target);
+        const currentScopes = ScopeSet.fromString(credential.target, correlationId);
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                 return;
@@ -2747,7 +2799,7 @@ class CacheManager {
             const tokenEntity = this.getAccessTokenCredential(key, correlationId);
             if (tokenEntity &&
                 this.credentialMatchesFilter(tokenEntity, accessTokenFilter, correlationId)) {
-                const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                const tokenScopeSet = ScopeSet.fromString(tokenEntity.target, correlationId);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
                     this.removeAccessToken(key, correlationId);
                 }
@@ -2781,10 +2833,6 @@ class CacheManager {
                 !this.matchRealm(entity, accountFilter.realm)) {
                 return;
             }
-            if (!!accountFilter.nativeAccountId &&
-                !this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
-                return;
-            }
             if (!!accountFilter.authorityType &&
                 !this.matchAuthorityType(entity, accountFilter.authorityType)) {
                 return;
@@ -2796,6 +2844,7 @@ class CacheManager {
                 username: accountFilter?.username,
                 loginHint: accountFilter?.loginHint,
                 upn: accountFilter?.upn,
+                nativeAccountId: accountFilter?.nativeAccountId,
             };
             const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                 return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -2849,7 +2898,8 @@ class CacheManager {
          * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
          * Resource specific refresh tokens case will be added when the support is deemed necessary
          */
-        if (!!filter.target && !this.matchTarget(entity, filter.target)) {
+        if (!!filter.target &&
+            !this.matchTarget(entity, filter.target, correlationId)) {
             return false;
         }
         // Access Token with Auth Scheme specific matching
@@ -2866,6 +2916,28 @@ class CacheManager {
                 }
             }
         }
+        // Additional cache key components matching (bidirectional isolation)
+        const entityComponents = entity.additionalCacheKeyComponents;
+        const filterComponents = filter.additionalCacheKeyComponents;
+        const entityHasComponents = !!entityComponents && Object.keys(entityComponents).length > 0;
+        const filterHasComponents = !!filterComponents && Object.keys(filterComponents).length > 0;
+        if (entityHasComponents !== filterHasComponents) {
+            return false;
+        }
+        if (entityHasComponents && filterHasComponents) {
+            const entityKeys = Object.keys(entityComponents).sort();
+            const filterKeys = Object.keys(filterComponents).sort();
+            if (entityKeys.length !== filterKeys.length) {
+                return false;
+            }
+            for (let i = 0; i < entityKeys.length; i++) {
+                if (entityKeys[i] !== filterKeys[i] ||
+                    entityComponents[entityKeys[i]] !==
+                        filterComponents[filterKeys[i]]) {
+                    return false;
+                }
+            }
+        }
         return true;
     }
     /**
@@ -3133,7 +3205,7 @@ class CacheManager {
     getAccessToken(account, request, tokenKeys, targetRealm) {
         const correlationId = request.correlationId;
         this.commonLogger.trace("CacheManager - getAccessToken called", correlationId);
-        const scopes = ScopeSet.createSearchScopes(request.scopes);
+        const scopes = ScopeSet.createSearchScopes(request.scopes, correlationId);
         const authScheme = request.authenticationScheme ||
             AuthenticationScheme.BEARER;
         /*
@@ -3323,7 +3395,7 @@ class CacheManager {
             return null;
         }
         else if (numAppMetadata > 1) {
-            throw createClientAuthError(multipleMatchingAppMetadata);
+            throw createClientAuthError(multipleMatchingAppMetadata, correlationId);
         }
         return appMetadataEntries[0];
     }
@@ -3453,15 +3525,6 @@ class CacheManager {
     matchRealm(entity, realm) {
         return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
     }
-    /**
-     * helper to match nativeAccountId
-     * @param entity
-     * @param nativeAccountId
-     * @returns boolean indicating the match result
-     */
-    matchNativeAccountId(entity, nativeAccountId) {
-        return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
-    }
     /**
      * helper to match loginHint which can be either:
      * 1. login_hint ID token claim
@@ -3505,14 +3568,14 @@ class CacheManager {
      * @param entity
      * @param target
      */
-    matchTarget(entity, target) {
+    matchTarget(entity, target, correlationId) {
         const isNotAccessTokenCredential = entity.credentialType !== CredentialType.ACCESS_TOKEN &&
             entity.credentialType !==
                 CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
         if (isNotAccessTokenCredential || !entity.target) {
             return false;
         }
-        const entityScopeSet = ScopeSet.fromString(entity.target);
+        const entityScopeSet = ScopeSet.fromString(entity.target, correlationId);
         return entityScopeSet.containsScopeSet(target);
     }
     /**
@@ -3566,77 +3629,77 @@ class CacheManager {
 /** @internal */
 class DefaultStorageClass extends CacheManager {
     async setAccount() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAccount() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     async setIdTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getIdTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     async setAccessTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAccessTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     async setRefreshTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getRefreshTokenCredential() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setAppMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAppMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setServerTelemetry() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getServerTelemetry() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setAuthorityMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAuthorityMetadata() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAuthorityMetadataKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     setThrottlingCache() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getThrottlingCache() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     removeItem() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getAccountKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     getTokenKeys() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     generateCredentialKey() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
     generateAccountKey() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3650,7 +3713,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3697,6 +3760,9 @@ class StubPerformanceClient {
     addFields() {
         return;
     }
+    addGlobalFields() {
+        return;
+    }
     incrementFields() {
         return;
     }
@@ -3705,7 +3771,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3725,10 +3791,10 @@ const DEFAULT_LOGGER_IMPLEMENTATION = {
 };
 const DEFAULT_NETWORK_IMPLEMENTATION = {
     async sendGetRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
     async sendPostRequestAsync() {
-        throw createClientAuthError(methodNotImplemented);
+        throw createClientAuthError(methodNotImplemented, "");
     },
 };
 const DEFAULT_LIBRARY_INFO = {
@@ -3757,6 +3823,7 @@ const DEFAULT_TELEMETRY_OPTIONS$1 = {
  * @param Configuration
  *
  * @returns Configuration
+ * @internal
  */
 function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
     const loggerOptions = {
@@ -3768,7 +3835,7 @@ function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions:
         systemOptions: { ...DEFAULT_SYSTEM_OPTIONS$1, ...userSystemOptions },
         loggerOptions: loggerOptions,
         storageInterface: storageImplementation ||
-            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
+            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions, name$1, version$1), new StubPerformanceClient()),
         networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
@@ -3800,7 +3867,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3827,7 +3894,7 @@ function isOidcProtocolMode(config) {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3882,7 +3949,7 @@ function delay(t, value) {
     return new Promise((resolve) => setTimeout(() => resolve(value), t));
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3918,7 +3985,7 @@ function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tena
  * @param expiresOn
  * @param extExpiresOn
  */
-function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, correlationId, refreshOn, tokenType, userAssertionHash, keyId, additionalCacheKeyComponents) {
     const atEntity = {
         homeAccountId: homeAccountId,
         credentialType: CredentialType.ACCESS_TOKEN,
@@ -3950,9 +4017,9 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
         switch (atEntity.tokenType) {
             case AuthenticationScheme.POP:
                 // Make sure keyId is present and add it to credential
-                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                const tokenClaims = extractTokenClaims(accessToken, base64Decode, correlationId);
                 if (!tokenClaims?.cnf?.kid) {
-                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt, correlationId);
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
                 break;
@@ -3960,6 +4027,11 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
                 atEntity.keyId = keyId;
         }
     }
+    /* Additional cache key components for cache isolation (e.g., FMI path) */
+    if (additionalCacheKeyComponents &&
+        Object.keys(additionalCacheKeyComponents).length > 0) {
+        atEntity.additionalCacheKeyComponents = additionalCacheKeyComponents;
+    }
     return atEntity;
 }
 /**
@@ -4119,6 +4191,7 @@ function generateAuthorityMetadataExpiresAt() {
     return (nowSeconds() +
         AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
 }
+/** @internal */
 function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
     authorityMetadata.authorization_endpoint =
         updatedValues.authorization_endpoint;
@@ -4128,6 +4201,7 @@ function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromN
     authorityMetadata.endpointsFromNetwork = fromNetwork;
     authorityMetadata.jwks_uri = updatedValues.jwks_uri;
 }
+/** @internal */
 function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
     authorityMetadata.aliases = updatedValues.aliases;
     authorityMetadata.preferred_cache = updatedValues.preferred_cache;
@@ -4136,12 +4210,13 @@ function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetw
 }
 /**
  * Returns whether or not the data needs to be refreshed
+ * @internal
  */
 function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4203,7 +4278,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
  */
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4296,7 +4371,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4357,7 +4432,7 @@ class PopTokenGenerator {
         // Deconstruct request to extract SHR parameters
         const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
         const resourceUrlString = resourceRequestUri
-            ? new UrlString(resourceRequestUri)
+            ? new UrlString(resourceRequestUri, request.correlationId)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
         return this.cryptoUtils.signJwt({
@@ -4376,7 +4451,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4440,7 +4515,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uiNotAllowed: uiNotAllowed
 });
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4471,12 +4546,11 @@ const InteractionRequiredAuthSubErrorMessage = [
  * Error thrown when user interaction is required.
  */
 class InteractionRequiredAuthError extends AuthError {
-    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
-        super(errorCode, errorMessage, subError);
+    constructor(errorCode, correlationId, errorMessage, subError, timestamp, traceId, claims, errorNo) {
+        super(errorCode, correlationId, errorMessage, subError);
         Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
         this.timestamp = timestamp || "";
         this.traceId = traceId || "";
-        this.correlationId = correlationId || "";
         this.claims = claims || "";
         this.name = "InteractionRequiredAuthError";
         this.errorNo = errorNo;
@@ -4504,11 +4578,11 @@ function isInteractionRequiredError(errorCode, errorString, subError) {
 /**
  * Creates an InteractionRequiredAuthError
  */
-function createInteractionRequiredAuthError(errorCode, errorMessage) {
-    return new InteractionRequiredAuthError(errorCode, errorMessage);
+function createInteractionRequiredAuthError(errorCode, correlationId, errorMessage) {
+    return new InteractionRequiredAuthError(errorCode, correlationId, errorMessage);
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4518,8 +4592,8 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
  * Error thrown when there is an error with the server code, for example, unavailability.
  */
 class ServerError extends AuthError {
-    constructor(errorCode, errorMessage, subError, errorNo, status) {
-        super(errorCode, errorMessage, subError);
+    constructor(errorCode, correlationId, errorMessage, subError, errorNo, status) {
+        super(errorCode, correlationId, errorMessage, subError);
         this.name = "ServerError";
         this.errorNo = errorNo;
         this.status = status;
@@ -4527,18 +4601,19 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /**
  * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
  * @param base64Decode
  * @param state
+ * @param correlationId
  */
-function parseRequestState(base64Decode, state) {
+function parseRequestState(base64Decode, state, correlationId) {
     if (!base64Decode) {
-        throw createClientAuthError(noCryptoObject);
+        throw createClientAuthError(noCryptoObject, correlationId);
     }
     if (!state) {
-        throw createClientAuthError(invalidState);
+        throw createClientAuthError(invalidState, correlationId);
     }
     try {
         // Split the state between library state and user passed state and decode them separately
@@ -4555,11 +4630,11 @@ function parseRequestState(base64Decode, state) {
         };
     }
     catch (e) {
-        throw createClientAuthError(invalidState);
+        throw createClientAuthError(invalidState, correlationId);
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4594,7 +4669,7 @@ class ResponseHandler {
             const serverErrorNo = serverResponse.error_codes?.length
                 ? serverResponse.error_codes[0]
                 : undefined;
-            const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
+            const serverError = new ServerError(serverResponse.error || "", serverResponse.correlation_id || "", errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
             // check if 500 error
             if (refreshAccessToken &&
                 serverResponse.status &&
@@ -4616,7 +4691,7 @@ class ResponseHandler {
                 return;
             }
             if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-                throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+                throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.correlation_id || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.claims || "", serverErrorNo);
             }
             throw serverError;
         }
@@ -4626,37 +4701,29 @@ class ResponseHandler {
      * @param serverTokenResponse
      * @param authority
      */
-    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
+    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId, additionalCacheKeyComponents) {
         // create an idToken object (not entity)
         let idTokenClaims;
         if (serverTokenResponse.id_token) {
-            idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode);
+            idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode, request.correlationId);
             // token nonce check (TODO: Add a warning if no nonce is given?)
             if (authCodePayload && authCodePayload.nonce) {
                 if (idTokenClaims.nonce !== authCodePayload.nonce) {
-                    throw createClientAuthError(nonceMismatch);
+                    throw createClientAuthError(nonceMismatch, request.correlationId);
                 }
             }
-            // token max_age check
-            if (request.maxAge || request.maxAge === 0) {
-                const authTime = idTokenClaims.auth_time;
-                if (!authTime) {
-                    throw createClientAuthError(authTimeNotFound);
-                }
-                checkMaxAge(authTime, request.maxAge);
-            }
         }
         // generate homeAccountId
         this.homeAccountIdentifier = generateHomeAccountId(serverTokenResponse.client_info || "", authority.authorityType, this.logger, this.cryptoObj, request.correlationId, idTokenClaims);
         // save the response tokens
         let requestStateObj;
         if (!!authCodePayload && !!authCodePayload.state) {
-            requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state);
+            requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state, request.correlationId);
         }
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
             serverTokenResponse.key_id || request.sshKid || undefined;
-        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload);
+        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents);
         let cacheContext;
         try {
             if (this.persistencePlugin && this.serializableCache) {
@@ -4703,10 +4770,10 @@ class ResponseHandler {
      * @param idTokenObj
      * @param authority
      */
-    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
+    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents) {
         const env = authority.getPreferredCache();
         if (!env) {
-            throw createClientAuthError(invalidCacheEnvironment);
+            throw createClientAuthError(invalidCacheEnvironment, request.correlationId);
         }
         const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
         // IdToken: non AAD scenarios can have empty realm
@@ -4722,8 +4789,8 @@ class ResponseHandler {
         if (serverTokenResponse.access_token) {
             // If scopes not returned in server response, use request scopes
             const responseScopes = serverTokenResponse.scope
-                ? ScopeSet.fromString(serverTokenResponse.scope)
-                : new ScopeSet(request.scopes || []);
+                ? ScopeSet.fromString(serverTokenResponse.scope, request.correlationId)
+                : new ScopeSet(request.scopes || [], request.correlationId);
             /*
              * Use timestamp calculated before request
              * Server may return timestamps as strings, parse to numbers if so.
@@ -4743,7 +4810,7 @@ class ResponseHandler {
                 ? reqTimestamp + refreshIn
                 : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+            cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, request.correlationId, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, additionalCacheKeyComponents);
             // Set resource (to be used for MCP scenarios)
             const resource = request.resource || null;
             if (resource) {
@@ -4809,14 +4876,14 @@ class ResponseHandler {
                 const popTokenGenerator = new PopTokenGenerator(cryptoObj, performanceClient);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
-                    throw createClientAuthError(keyIdMissing);
+                    throw createClientAuthError(keyIdMissing, request.correlationId);
                 }
                 accessToken = await popTokenGenerator.signPopToken(secret, keyId, request);
             }
             else {
                 accessToken = cacheRecord.accessToken.secret;
             }
-            responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
+            responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target, request.correlationId).asArray();
             // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
             expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
             extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
@@ -4834,8 +4901,18 @@ class ResponseHandler {
         const tid = idTokenClaims?.tid || "";
         // for hybrid + native bridge enablement, send back the native account Id
         if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
+            // Set on deprecated top-level for downgrade compat
             cacheRecord.account.nativeAccountId =
                 serverTokenResponse?.spa_accountid;
+            // Set on the matching tenant profile (source of truth)
+            const targetTenantId = tid || cacheRecord.account.realm;
+            if (cacheRecord.account.tenantProfiles) {
+                const matchingProfile = cacheRecord.account.tenantProfiles.find((tp) => tp.tenantId === targetTenantId);
+                if (matchingProfile) {
+                    matchingProfile.nativeAccountId =
+                        serverTokenResponse.spa_accountid;
+                }
+            }
         }
         const accountInfo = cacheRecord.account
             ? updateAccountTenantProfileData(getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
@@ -4866,6 +4943,7 @@ class ResponseHandler {
         };
     }
 }
+/** @internal */
 function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
     logger?.verbose("setCachedAccount called", correlationId);
     /*
@@ -4893,21 +4971,21 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
             cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
             msGraphHost: authCodePayload?.msgraph_host,
             nativeAccountId: nativeAccountId,
-        }, authority, base64Decode);
+        }, authority, correlationId, base64Decode);
     const tenantProfiles = baseAccount.tenantProfiles || [];
     const tenantId = claimsTenantId || baseAccount.realm;
     if (tenantId &&
         !tenantProfiles.find((tenantProfile) => {
             return tenantProfile.tenantId === tenantId;
         })) {
-        const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, idTokenClaims);
+        const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, nativeAccountId, idTokenClaims);
         tenantProfiles.push(newTenantProfile);
     }
     baseAccount.tenantProfiles = tenantProfiles;
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4917,12 +4995,12 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
+async function getClientAssertion(clientAssertion, clientId, tokenEndpoint, fmiPath) {
     if (typeof clientAssertion === "string") {
         return clientAssertion;
     }
@@ -4930,12 +5008,13 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
         const config = {
             clientId: clientId,
             tokenEndpoint: tokenEndpoint,
+            fmiPath: fmiPath,
         };
         return clientAssertion(config);
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4953,10 +5032,11 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
         shrClaims: request.shrClaims,
         sshKid: request.sshKid,
         embeddedClientId: request.embeddedClientId || request.extraParameters?.clientId,
+        resource: request.resource,
     };
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4984,7 +5064,7 @@ class ThrottlingUtils {
                 cacheManager.removeItem(key, correlationId);
                 return;
             }
-            throw new ServerError(value.errorCodes?.join(" ") || "", value.errorMessage, value.subError);
+            throw new ServerError(value.errorCodes?.join(" ") || "", correlationId, value.errorMessage, value.subError);
         }
     }
     /**
@@ -5042,7 +5122,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5053,7 +5133,7 @@ class ThrottlingUtils {
  */
 class NetworkError extends AuthError {
     constructor(error, httpStatus, responseHeaders) {
-        super(error.errorCode, error.errorMessage, error.subError);
+        super(error.errorCode, error.correlationId, error.errorMessage, error.subError);
         Object.setPrototypeOf(this, NetworkError.prototype);
         this.name = "NetworkError";
         this.error = error;
@@ -5073,7 +5153,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5125,6 +5205,7 @@ function createTokenQueryParameters(request, clientId, redirectUri, performanceC
  * @param queryString
  * @param headers
  * @param thumbprint
+ * @internal
  */
 async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, cacheManager, networkClient, logger, performanceClient, serverTelemetryManager) {
     const response = await sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId, cacheManager, networkClient, logger, performanceClient);
@@ -5146,6 +5227,7 @@ async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, t
  * @param networkClient - Network module instance
  * @param logger - Logger instance
  * @param performanceClient - Performance client instance
+ * @internal
  */
 async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId, cacheManager, networkClient, logger, performanceClient) {
     ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
@@ -5180,14 +5262,14 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
             throw e;
         }
         else {
-            throw createClientAuthError(networkError);
+            throw createClientAuthError(networkError, correlationId);
         }
     }
     ThrottlingUtils.postProcess(cacheManager, thumbprint, response, correlationId);
     return response;
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5199,7 +5281,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5209,7 +5291,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5219,7 +5301,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5246,9 +5328,12 @@ class RegionDiscovery {
             try {
                 const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(IMDS_VERSION, options);
                 if (localIMDSVersionResponse.status === HTTP_SUCCESS) {
-                    autodetectedRegionName = localIMDSVersionResponse.body;
-                    regionDiscoveryMetadata.region_source =
-                        RegionDiscoverySources.IMDS;
+                    autodetectedRegionName =
+                        localIMDSVersionResponse.body?.location;
+                    if (autodetectedRegionName) {
+                        regionDiscoveryMetadata.region_source =
+                            RegionDiscoverySources.IMDS;
+                    }
                 }
                 // If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
                 if (localIMDSVersionResponse.status ===
@@ -5263,9 +5348,11 @@ class RegionDiscovery {
                     if (currentIMDSVersionResponse.status ===
                         HTTP_SUCCESS) {
                         autodetectedRegionName =
-                            currentIMDSVersionResponse.body;
-                        regionDiscoveryMetadata.region_source =
-                            RegionDiscoverySources.IMDS;
+                            currentIMDSVersionResponse.body?.location;
+                        if (autodetectedRegionName) {
+                            regionDiscoveryMetadata.region_source =
+                                RegionDiscoverySources.IMDS;
+                        }
                     }
                 }
             }
@@ -5289,11 +5376,12 @@ class RegionDiscovery {
     /**
      * Make the call to the IMDS endpoint
      *
-     * @param imdsEndpointUrl
-     * @returns Promise<NetworkResponse<string>>
+     * @param version
+     * @param options
+     * @returns Promise<NetworkResponse<ImdsComputeResponse>>
      */
     async getRegionFromIMDS(version, options) {
-        return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}&format=text`, options, IMDS_TIMEOUT);
+        return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}`, options, IMDS_TIMEOUT);
     }
     /**
      * Get the most recent version of the IMDS endpoint available
@@ -5324,7 +5412,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5354,7 +5442,7 @@ class Authority {
         this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
     }
     /**
-     * Get {@link AuthorityType}
+     * Get {@link AuthorityType:type}
      * @param authorityUri {@link IUri}
      * @private
      */
@@ -5400,7 +5488,7 @@ class Authority {
      * Sets canonical authority.
      */
     set canonicalAuthority(url) {
-        this._canonicalAuthority = new UrlString(url);
+        this._canonicalAuthority = new UrlString(url, this.correlationId);
         this._canonicalAuthority.validateAsUri();
         this._canonicalAuthorityUrlComponents = null;
     }
@@ -5434,7 +5522,7 @@ class Authority {
             return this.replacePath(this.metadata.authorization_endpoint);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -5445,7 +5533,7 @@ class Authority {
             return this.replacePath(this.metadata.token_endpoint);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     get deviceCodeEndpoint() {
@@ -5453,7 +5541,7 @@ class Authority {
             return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -5463,12 +5551,12 @@ class Authority {
         if (this.discoveryComplete()) {
             // ROPC policies may not have end_session_endpoint set
             if (!this.metadata.end_session_endpoint) {
-                throw createClientAuthError(endSessionEndpointNotSupported);
+                throw createClientAuthError(endSessionEndpointNotSupported, this.correlationId);
             }
             return this.replacePath(this.metadata.end_session_endpoint);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -5479,7 +5567,7 @@ class Authority {
             return this.replacePath(this.metadata.issuer);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -5490,7 +5578,7 @@ class Authority {
             return this.replacePath(this.metadata.jwks_uri);
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -5517,7 +5605,7 @@ class Authority {
      */
     replacePath(urlString) {
         let endpoint = urlString;
-        const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
+        const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority, this.correlationId);
         const cachedAuthorityUrlComponents = cachedAuthorityUrl.getUrlComponents();
         const cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
         const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
@@ -5525,7 +5613,7 @@ class Authority {
             let cachedPart = cachedAuthorityParts[index];
             if (index === 0 &&
                 this.canReplaceTenant(cachedAuthorityUrlComponents)) {
-                const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
+                const tenantId = new UrlString(this.metadata.authorization_endpoint, this.correlationId).getUrlComponents().PathSegments[0];
                 /**
                  * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
                  * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
@@ -5659,7 +5747,7 @@ class Authority {
         }
         else {
             // Metadata could not be obtained from the config, cache, network or hardcoded values
-            throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint);
+            throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint, this.correlationId);
         }
     }
     /**
@@ -5711,7 +5799,7 @@ class Authority {
      * @param metadataEntity
      */
     isAuthoritySameType(metadataEntity) {
-        const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority);
+        const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority, this.correlationId);
         const cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
         return (cachedParts.length ===
             this.canonicalAuthorityUrlComponents.PathSegments.length);
@@ -5725,7 +5813,7 @@ class Authority {
                 return JSON.parse(this.authorityOptions.authorityMetadata);
             }
             catch (e) {
-                throw createClientConfigurationError(invalidAuthorityMetadata);
+                throw createClientConfigurationError(invalidAuthorityMetadata, this.correlationId);
             }
         }
         return null;
@@ -5781,7 +5869,7 @@ class Authority {
                     RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
                 this.regionDiscoveryMetadata.region_used =
                     userConfiguredAzureRegion;
-                return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
+                return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion, this.correlationId);
             }
             const autodetectedRegionName = await invokeAsync(this.regionDiscovery.detectRegion.bind(this.regionDiscovery), RegionDiscoveryDetectRegion, this.logger, this.performanceClient, this.correlationId)(this.authorityOptions.azureRegionConfiguration
                 ?.environmentRegion, this.regionDiscoveryMetadata);
@@ -5790,7 +5878,7 @@ class Authority {
                     RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
                 this.regionDiscoveryMetadata.region_used =
                     autodetectedRegionName;
-                return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
+                return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName, this.correlationId);
             }
             this.regionDiscoveryMetadata.region_outcome =
                 RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
@@ -5815,7 +5903,7 @@ class Authority {
             return AuthorityMetadataSource.NETWORK;
         }
         // Metadata could not be obtained from the config, cache, network or hardcoded values
-        throw createClientConfigurationError(untrustedAuthority);
+        throw createClientConfigurationError(untrustedAuthority, this.correlationId);
     }
     updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
         this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration", this.correlationId);
@@ -5879,7 +5967,7 @@ class Authority {
             }
             catch (e) {
                 this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error.", this.correlationId);
-                throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+                throw createClientConfigurationError(invalidCloudDiscoveryMetadata, this.correlationId);
             }
         }
         // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
@@ -5957,8 +6045,7 @@ class Authority {
         const normalizedHost = host.toLowerCase();
         const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
             return (authority &&
-                UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                    normalizedHost);
+                UrlString.getDomainFromUrl(authority, this.correlationId).toLowerCase() === normalizedHost);
         });
         return matches.length > 0;
     }
@@ -6002,7 +6089,7 @@ class Authority {
             return this.metadata.preferred_cache;
         }
         else {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, this.correlationId);
         }
     }
     /**
@@ -6045,7 +6132,7 @@ class Authority {
      */
     validateIssuer(issuer) {
         if (!issuer) {
-            throw createClientConfigurationError(issuerValidationFailed);
+            throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
         }
         // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
         let issuerUrl;
@@ -6053,7 +6140,7 @@ class Authority {
             issuerUrl = new URL(issuer);
         }
         catch {
-            throw createClientConfigurationError(issuerValidationFailed);
+            throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
         }
         const issuerScheme = issuerUrl.protocol;
         const issuerHost = issuerUrl.host;
@@ -6091,7 +6178,7 @@ class Authority {
             return;
         }
         // issuer validation fails if none of the above rules are satisfied
-        throw createClientConfigurationError(issuerValidationFailed);
+        throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
     }
     /**
      * Rule 1: The issuer scheme + host (and port) match the authority's. Path
@@ -6179,9 +6266,9 @@ class Authority {
      * @param host string
      * @param region string
      */
-    static buildRegionalAuthorityString(host, region, queryString) {
+    static buildRegionalAuthorityString(host, region, correlationId, queryString) {
         // Create and validate a Url string object with the initial authority string
-        const authorityUrlInstance = new UrlString(host);
+        const authorityUrlInstance = new UrlString(host, correlationId);
         authorityUrlInstance.validateAsUri();
         const authorityUrlParts = authorityUrlInstance.getUrlComponents();
         let hostNameAndPort = `${region}.${authorityUrlParts.HostNameAndPort}`;
@@ -6192,7 +6279,7 @@ class Authority {
         const url = UrlString.constructAuthorityUriFromObject({
             ...authorityUrlInstance.getUrlComponents(),
             HostNameAndPort: hostNameAndPort,
-        }).urlString;
+        }, correlationId).urlString;
         // Add the query string if a query string was provided
         if (queryString)
             return `${url}?${queryString}`;
@@ -6204,15 +6291,15 @@ class Authority {
      * @param metadata OpenIdConfigResponse
      * @param azureRegion string
      */
-    static replaceWithRegionalInformation(metadata, azureRegion) {
+    static replaceWithRegionalInformation(metadata, azureRegion, correlationId) {
         const regionalMetadata = { ...metadata };
         regionalMetadata.authorization_endpoint =
-            Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
+            Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion, correlationId);
         regionalMetadata.token_endpoint =
-            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
+            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion, correlationId);
         if (regionalMetadata.end_session_endpoint) {
             regionalMetadata.end_session_endpoint =
-                Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
+                Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion, correlationId);
         }
         return regionalMetadata;
     }
@@ -6225,9 +6312,9 @@ class Authority {
      *
      * @param authority
      */
-    static transformCIAMAuthority(authority) {
+    static transformCIAMAuthority(authority, correlationId) {
         let ciamAuthority = authority;
-        const authorityUrl = new UrlString(authority);
+        const authorityUrl = new UrlString(authority, correlationId);
         const authorityUrlComponents = authorityUrl.getUrlComponents();
         // check if transformation is needed
         if (authorityUrlComponents.PathSegments.length === 0 &&
@@ -6249,8 +6336,8 @@ Authority.reservedTenantDomains = new Set([
 /**
  * Extract tenantId from authority
  */
-function getTenantFromAuthorityString(authority) {
-    const authorityUrl = new UrlString(authority);
+function getTenantFromAuthorityString(authority, correlationId) {
+    const authorityUrl = new UrlString(authority, correlationId);
     const authorityUrlComponents = authorityUrl.getUrlComponents();
     /**
      * For credential matching purposes, tenantId is the last path segment of the authority URL:
@@ -6283,7 +6370,7 @@ function buildStaticAuthorityOptions(authOptions) {
             cloudDiscoveryMetadata = JSON.parse(rawCloudDiscoveryMetadata);
         }
         catch (e) {
-            throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+            throw createClientConfigurationError(invalidCloudDiscoveryMetadata, "");
         }
     }
     return {
@@ -6295,7 +6382,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6317,7 +6404,7 @@ function buildStaticAuthorityOptions(authOptions) {
  * @internal
  */
 async function createDiscoveredInstance(authorityUri, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient) {
-    const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri));
+    const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri), correlationId);
     // Initialize authority and perform discovery endpoint check.
     const acquireTokenAuthority = new Authority(authorityUriFinal, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient);
     try {
@@ -6325,11 +6412,11 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
         return acquireTokenAuthority;
     }
     catch (e) {
-        throw createClientAuthError(endpointResolutionError);
+        throw createClientAuthError(endpointResolutionError, correlationId);
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6369,7 +6456,7 @@ class AuthorizationCodeClient {
      */
     async acquireToken(request, apiId, authCodePayload) {
         if (!request.code) {
-            throw createClientAuthError(requestCannotBeMade);
+            throw createClientAuthError(requestCannotBeMade, request.correlationId);
         }
         // Check for new cloud instance
         if (authCodePayload && authCodePayload.cloud_instance_host_name) {
@@ -6392,7 +6479,7 @@ class AuthorizationCodeClient {
     getLogoutUri(logoutRequest) {
         // Throw error if logoutRequest is null/undefined
         if (!logoutRequest) {
-            throw createClientConfigurationError(logoutRequestEmpty);
+            throw createClientConfigurationError(logoutRequestEmpty, "");
         }
         const queryString = this.createLogoutUrlQueryString(logoutRequest);
         // Construct logout URI
@@ -6440,7 +6527,7 @@ class AuthorizationCodeClient {
         if (!this.includeRedirectUri) {
             // Just validate
             if (!request.redirectUri) {
-                throw createClientConfigurationError(redirectUriEmpty);
+                throw createClientConfigurationError(redirectUriEmpty, request.correlationId);
             }
         }
         else {
@@ -6448,7 +6535,7 @@ class AuthorizationCodeClient {
             addRedirectUri(parameters, request.redirectUri);
         }
         // Add scope array, parameter builder will add default scopes and dedupe
-        addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+        addScopes(parameters, request.scopes, request.correlationId, true, this.oidcDefaultScopes);
         addResource(parameters, request.resource);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
@@ -6491,7 +6578,7 @@ class AuthorizationCodeClient {
                 addSshJwk(parameters, request.sshJwk);
             }
             else {
-                throw createClientConfigurationError(missingSshJwk);
+                throw createClientConfigurationError(missingSshJwk, request.correlationId);
             }
         }
         let ccsCred = undefined;
@@ -6542,7 +6629,7 @@ class AuthorizationCodeClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+        addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
     /**
@@ -6586,7 +6673,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6632,11 +6719,11 @@ class RefreshTokenClient {
     async acquireTokenByRefreshToken(request, apiId) {
         // Cannot renew token if no request object is given.
         if (!request) {
-            throw createClientConfigurationError(tokenRequestEmpty);
+            throw createClientConfigurationError(tokenRequestEmpty, "");
         }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
-            throw createClientAuthError(noAccountInSilentRequest);
+            throw createClientAuthError(noAccountInSilentRequest, request.correlationId);
         }
         // try checking if FOCI is enabled for the given application
         const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, request.correlationId);
@@ -6673,7 +6760,7 @@ class RefreshTokenClient {
         // fetches family RT or application RT based on FOCI value
         const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined);
         if (!refreshToken) {
-            throw createInteractionRequiredAuthError(noTokensFound);
+            throw createInteractionRequiredAuthError(noTokensFound, request.correlationId);
         }
         if (refreshToken.expiresOn) {
             const offset = request.refreshTokenExpirationOffsetSeconds ||
@@ -6683,7 +6770,7 @@ class RefreshTokenClient {
                 rtOffsetSeconds: offset,
             }, request.correlationId);
             if (isTokenExpired(refreshToken.expiresOn, offset)) {
-                throw createInteractionRequiredAuthError(refreshTokenExpired);
+                throw createInteractionRequiredAuthError(refreshTokenExpired, request.correlationId);
             }
         }
         // attach cached RT size to the current measurement
@@ -6737,7 +6824,7 @@ class RefreshTokenClient {
         if (request.redirectUri) {
             addRedirectUri(parameters, request.redirectUri);
         }
-        addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addScopes(parameters, request.scopes, request.correlationId, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
         addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
         addClientInfo(parameters);
         addLibraryInfo(parameters, this.config.libraryInfo);
@@ -6773,7 +6860,7 @@ class RefreshTokenClient {
                 addSshJwk(parameters, request.sshJwk);
             }
             else {
-                throw createClientConfigurationError(missingSshJwk);
+                throw createClientConfigurationError(missingSshJwk, request.correlationId);
             }
         }
         if (this.config.systemOptions.preventCorsPreflight &&
@@ -6802,12 +6889,12 @@ class RefreshTokenClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+        addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6842,32 +6929,32 @@ class SilentFlowClient {
         if (request.forceRefresh || !StringUtils.isEmptyObj(request.claims)) {
             // Must refresh due to present force_refresh flag.
             this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
-            throw createClientAuthError(noAccountInSilentRequest);
+            throw createClientAuthError(noAccountInSilentRequest, request.correlationId);
         }
         const requestTenantId = request.account.tenantId ||
-            getTenantFromAuthorityString(request.authority);
+            getTenantFromAuthorityString(request.authority, request.correlationId);
         const tokenKeys = this.cacheManager.getTokenKeys();
         const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
         if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
             isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
             // must refresh due to the expires_in value
             this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         else if (request.resource) {
             // cached access token must have a resource that matches the request resource for MCP scenarios
             if (cachedAccessToken.resource !== request.resource) {
                 this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
-                throw createClientAuthError(tokenRefreshRequired);
+                throw createClientAuthError(tokenRefreshRequired, request.correlationId);
             }
         }
         else if (cachedAccessToken.refreshOn &&
@@ -6909,21 +6996,13 @@ class SilentFlowClient {
     async generateResultFromCacheRecord(cacheRecord, request) {
         let idTokenClaims;
         if (cacheRecord.idToken) {
-            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
-        }
-        // token max_age check
-        if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenClaims?.auth_time;
-            if (!authTime) {
-                throw createClientAuthError(authTimeNotFound);
-            }
-            checkMaxAge(authTime, request.maxAge);
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode, request.correlationId);
         }
         return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
     }
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6936,6 +7015,7 @@ class SilentFlowClient {
  * @param logger
  * @param performanceClient
  * @returns
+ * @internal
  */
 function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
     // generate the correlationId if not set by the user and add
@@ -6948,7 +7028,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
         ...(request.scopes || []),
         ...(request.extraScopesToConsent || []),
     ];
-    addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addScopes(parameters, requestScopes, request.correlationId, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
     addResource(parameters, request.resource);
     addRedirectUri(parameters, request.redirectUri);
     addCorrelationId(parameters, correlationId);
@@ -7042,7 +7122,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
-    addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
+    addClaims(parameters, request.correlationId, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -7056,6 +7136,7 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
  * @param authority
  * @param requestParameters
  * @returns
+ * @internal
  */
 function getAuthorizeUrl(authority, requestParameters) {
     const queryString = mapToQueryString(requestParameters);
@@ -7072,7 +7153,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7092,10 +7173,10 @@ function enforceResourceParameter(isMcp, request) {
     if (request.resource &&
         (containsResourceParam(request.extraParameters) ||
             containsResourceParam(request.extraQueryParameters))) {
-        throw createClientAuthError(misplacedResourceParam);
+        throw createClientAuthError(misplacedResourceParam, request.correlationId || "");
     }
     if (!request.resource) {
-        throw createClientAuthError(resourceParameterRequired);
+        throw createClientAuthError(resourceParameterRequired, request.correlationId || "");
     }
 }
 function containsResourceParam(params) {
@@ -7105,7 +7186,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7122,7 +7203,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.11.0 2026-06-30 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7233,35 +7314,40 @@ class ServerTelemetryManager {
      * @param error
      */
     cacheFailedRequest(error) {
-        const lastRequests = this.getLastRequests();
-        if (lastRequests.errors.length >=
-            SERVER_TELEM_MAX_CACHED_ERRORS) {
-            // Remove a cached error to make room, first in first out
-            lastRequests.failedRequests.shift(); // apiId
-            lastRequests.failedRequests.shift(); // correlationId
-            lastRequests.errors.shift();
-        }
-        lastRequests.failedRequests.push(this.apiId, this.correlationId);
-        if (error instanceof Error && !!error && error.toString()) {
-            if (error instanceof AuthError) {
-                if (error.subError) {
-                    lastRequests.errors.push(error.subError);
-                }
-                else if (error.errorCode) {
-                    lastRequests.errors.push(error.errorCode);
+        try {
+            const lastRequests = this.getLastRequests();
+            if (lastRequests.errors.length >=
+                SERVER_TELEM_MAX_CACHED_ERRORS) {
+                // Remove a cached error to make room, first in first out
+                lastRequests.failedRequests.shift(); // apiId
+                lastRequests.failedRequests.shift(); // correlationId
+                lastRequests.errors.shift();
+            }
+            lastRequests.failedRequests.push(this.apiId, this.correlationId);
+            if (error instanceof Error && !!error && error.toString()) {
+                if (error instanceof AuthError) {
+                    if (error.subError) {
+                        lastRequests.errors.push(error.subError);
+                    }
+                    else if (error.errorCode) {
+                        lastRequests.errors.push(error.errorCode);
+                    }
+                    else {
+                        lastRequests.errors.push(error.toString());
+                    }
                 }
                 else {
                     lastRequests.errors.push(error.toString());
                 }
             }
             else {
-                lastRequests.errors.push(error.toString());
+                lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
             }
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         }
-        else {
-            lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
+        catch {
+            // Ignore telemetry cache failures to avoid masking the original auth error path.
         }
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return;
     }
     /**
@@ -7480,6 +7566,7 @@ class Deserializer {
                     tokenType: serializedAT.token_type,
                     userAssertionHash: serializedAT.userAssertionHash,
                     resource: serializedAT.resource,
+                    additionalCacheKeyComponents: serializedAT.additionalCacheKeyComponents,
                     lastUpdatedAt: Date.now().toString(),
                 };
                 atObjects[key] = accessToken;
@@ -7691,6 +7778,7 @@ const ApiId = {
     acquireTokenByClientCredential: 771,
     acquireTokenByOBO: 772,
     acquireTokenWithManagedIdentity: 773,
+    acquireTokenByUserFederatedIdentityCredential: 774,
     acquireTokenByCode: 871,
     acquireTokenByRefreshToken: 872,
 };
@@ -7821,9 +7909,9 @@ class HttpClient {
                 clearTimeout(timeoutId);
             }
             if (error instanceof Error && error.name === "AbortError") {
-                throw createAuthError(networkError, "Request timeout");
+                throw createAuthError(networkError, "", "Request timeout");
             }
-            const baseAuthError = createAuthError(networkError, `Network request failed: ${error instanceof Error ? error.message : "unknown"}`);
+            const baseAuthError = createAuthError(networkError, "", `Network request failed: ${error instanceof Error ? error.message : "unknown"}`);
             throw createNetworkError(baseAuthError, undefined, undefined, error instanceof Error ? error : undefined);
         }
         // Clean up timeout to prevent memory leaks
@@ -7838,7 +7926,7 @@ class HttpClient {
             };
         }
         catch (error) {
-            throw createAuthError(tokenParsingError, `Failed to parse response: ${error instanceof Error ? error.message : "unknown"}`);
+            throw createAuthError(tokenParsingError, "", `Failed to parse response: ${error instanceof Error ? error.message : "unknown"}`);
         }
     }
 }
@@ -7938,14 +8026,14 @@ const ManagedIdentityErrorMessages = {
     [wwwAuthenticateHeaderUnsupportedFormat]: "A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is in an unsupported format.",
 };
 class ManagedIdentityError extends AuthError {
-    constructor(errorCode) {
-        super(errorCode, ManagedIdentityErrorMessages[errorCode]);
+    constructor(errorCode, correlationId) {
+        super(errorCode, correlationId, ManagedIdentityErrorMessages[errorCode]);
         this.name = "ManagedIdentityError";
         Object.setPrototypeOf(this, ManagedIdentityError.prototype);
     }
 }
-function createManagedIdentityError(errorCode) {
-    return new ManagedIdentityError(errorCode);
+function createManagedIdentityError(errorCode, correlationId) {
+    return new ManagedIdentityError(errorCode, correlationId);
 }
 
 /*
@@ -7971,21 +8059,21 @@ class ManagedIdentityId {
         const userAssignedObjectId = managedIdentityIdParams?.userAssignedObjectId;
         if (userAssignedClientId) {
             if (userAssignedResourceId || userAssignedObjectId) {
-                throw createManagedIdentityError(invalidManagedIdentityIdType);
+                throw createManagedIdentityError(invalidManagedIdentityIdType, "");
             }
             this.id = userAssignedClientId;
             this.idType = ManagedIdentityIdType.USER_ASSIGNED_CLIENT_ID;
         }
         else if (userAssignedResourceId) {
             if (userAssignedClientId || userAssignedObjectId) {
-                throw createManagedIdentityError(invalidManagedIdentityIdType);
+                throw createManagedIdentityError(invalidManagedIdentityIdType, "");
             }
             this.id = userAssignedResourceId;
             this.idType = ManagedIdentityIdType.USER_ASSIGNED_RESOURCE_ID;
         }
         else if (userAssignedObjectId) {
             if (userAssignedClientId || userAssignedResourceId) {
-                throw createManagedIdentityError(invalidManagedIdentityIdType);
+                throw createManagedIdentityError(invalidManagedIdentityIdType, "");
             }
             this.id = userAssignedObjectId;
             this.idType = ManagedIdentityIdType.USER_ASSIGNED_OBJECT_ID;
@@ -8043,63 +8131,63 @@ const NodeAuthErrorMessage = {
     },
 };
 class NodeAuthError extends AuthError {
-    constructor(errorCode, errorMessage) {
-        super(errorCode, errorMessage);
+    constructor(errorCode, correlationId, errorMessage) {
+        super(errorCode, correlationId, errorMessage);
         this.name = "NodeAuthError";
     }
     /**
      * Creates an error thrown if loopback server address is of type string.
      */
     static createInvalidLoopbackAddressTypeError() {
-        return new NodeAuthError(NodeAuthErrorMessage.invalidLoopbackAddressType.code, `${NodeAuthErrorMessage.invalidLoopbackAddressType.desc}`);
+        return new NodeAuthError(NodeAuthErrorMessage.invalidLoopbackAddressType.code, "", `${NodeAuthErrorMessage.invalidLoopbackAddressType.desc}`);
     }
     /**
      * Creates an error thrown if the loopback server is unable to get a url.
      */
     static createUnableToLoadRedirectUrlError() {
-        return new NodeAuthError(NodeAuthErrorMessage.unableToLoadRedirectUri.code, `${NodeAuthErrorMessage.unableToLoadRedirectUri.desc}`);
+        return new NodeAuthError(NodeAuthErrorMessage.unableToLoadRedirectUri.code, "", `${NodeAuthErrorMessage.unableToLoadRedirectUri.desc}`);
     }
     /**
      * Creates an error thrown if the server response does not contain an auth code.
      */
-    static createNoAuthCodeInResponseError() {
-        return new NodeAuthError(NodeAuthErrorMessage.noAuthCodeInResponse.code, `${NodeAuthErrorMessage.noAuthCodeInResponse.desc}`);
+    static createNoAuthCodeInResponseError(correlationId = "") {
+        return new NodeAuthError(NodeAuthErrorMessage.noAuthCodeInResponse.code, correlationId, `${NodeAuthErrorMessage.noAuthCodeInResponse.desc}`);
     }
     /**
      * Creates an error thrown if the loopback server has not been spun up yet.
      */
     static createNoLoopbackServerExistsError() {
-        return new NodeAuthError(NodeAuthErrorMessage.noLoopbackServerExists.code, `${NodeAuthErrorMessage.noLoopbackServerExists.desc}`);
+        return new NodeAuthError(NodeAuthErrorMessage.noLoopbackServerExists.code, "", `${NodeAuthErrorMessage.noLoopbackServerExists.desc}`);
     }
     /**
      * Creates an error thrown if a loopback server already exists when attempting to create another one.
      */
     static createLoopbackServerAlreadyExistsError() {
-        return new NodeAuthError(NodeAuthErrorMessage.loopbackServerAlreadyExists.code, `${NodeAuthErrorMessage.loopbackServerAlreadyExists.desc}`);
+        return new NodeAuthError(NodeAuthErrorMessage.loopbackServerAlreadyExists.code, "", `${NodeAuthErrorMessage.loopbackServerAlreadyExists.desc}`);
     }
     /**
      * Creates an error thrown if the loopback server times out registering the auth code listener.
      */
-    static createLoopbackServerTimeoutError() {
-        return new NodeAuthError(NodeAuthErrorMessage.loopbackServerTimeout.code, `${NodeAuthErrorMessage.loopbackServerTimeout.desc}`);
+    static createLoopbackServerTimeoutError(correlationId = "") {
+        return new NodeAuthError(NodeAuthErrorMessage.loopbackServerTimeout.code, correlationId, `${NodeAuthErrorMessage.loopbackServerTimeout.desc}`);
     }
     /**
      * Creates an error thrown when the state is not present.
      */
-    static createStateNotFoundError() {
-        return new NodeAuthError(NodeAuthErrorMessage.stateNotFoundError.code, NodeAuthErrorMessage.stateNotFoundError.desc);
+    static createStateNotFoundError(correlationId = "") {
+        return new NodeAuthError(NodeAuthErrorMessage.stateNotFoundError.code, correlationId, NodeAuthErrorMessage.stateNotFoundError.desc);
     }
     /**
      * Creates an error thrown when client certificate was provided, but neither the SHA-1 or SHA-256 thumbprints were provided
      */
     static createThumbprintMissingError() {
-        return new NodeAuthError(NodeAuthErrorMessage.thumbprintMissing.code, NodeAuthErrorMessage.thumbprintMissing.desc);
+        return new NodeAuthError(NodeAuthErrorMessage.thumbprintMissing.code, "", NodeAuthErrorMessage.thumbprintMissing.desc);
     }
     /**
      * Creates an error thrown when redirectUri is provided in an unsupported scenario
      */
-    static createRedirectUriNotSupportedError() {
-        return new NodeAuthError(NodeAuthErrorMessage.redirectUriNotSupported.code, NodeAuthErrorMessage.redirectUriNotSupported.desc);
+    static createRedirectUriNotSupportedError(correlationId = "") {
+        return new NodeAuthError(NodeAuthErrorMessage.redirectUriNotSupported.code, correlationId, NodeAuthErrorMessage.redirectUriNotSupported.desc);
     }
 }
 
@@ -8431,6 +8519,15 @@ class CryptoProvider {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Computes a combined hash from additional cache key components.
+ * Matches the cross-SDK algorithm: sort keys → concatenate key+value → SHA-256 → Base64URL (no padding).
+ */
+function computeAdditionalCacheKeyHash(components) {
+    const sortedKeys = Object.keys(components).sort();
+    const input = sortedKeys.map((k) => k + components[k]).join("");
+    return crypto.createHash("sha256").update(input, "utf8").digest("base64url");
+}
 function generateCredentialKey(credential) {
     const familyId = (credential.credentialType === CredentialType.REFRESH_TOKEN &&
         credential.familyId) ||
@@ -8449,6 +8546,11 @@ function generateCredentialKey(credential) {
         credential.target || "",
         scheme,
     ];
+    // Compute and append a combined hash from additional cache key components (e.g., fmi_path)
+    if (credential.additionalCacheKeyComponents &&
+        Object.keys(credential.additionalCacheKeyComponents).length > 0) {
+        credentialKey.push(computeAdditionalCacheKeyHash(credential.additionalCacheKeyComponents));
+    }
     return credentialKey.join(CACHE.KEY_SEPARATOR).toLowerCase();
 }
 function generateAccountKey(account) {
@@ -9180,6 +9282,9 @@ const missingTenantIdError = "missing_tenant_id_error";
 const userTimeoutReached = "user_timeout_reached";
 const invalidAssertion = "invalid_assertion";
 const invalidClientCredential = "invalid_client_credential";
+const emptyFicAssertion = "empty_fic_assertion";
+const conflictingUserIdentifiers = "conflicting_user_identifiers";
+const missingUserIdentifier = "missing_user_identifier";
 const deviceCodePollingCancelled = "device_code_polling_cancelled";
 const deviceCodeExpired = "device_code_expired";
 const deviceCodeUnknownError = "device_code_unknown_error";
@@ -9261,7 +9366,7 @@ class ClientAssertion {
         if (this.jwt) {
             return this.jwt;
         }
-        throw createClientAuthError(invalidAssertion);
+        throw createClientAuthError(invalidAssertion, "");
     }
     /**
      * JWT format and required claims specified: https://tools.ietf.org/html/rfc7523#section-3
@@ -9330,7 +9435,7 @@ class ClientAssertion {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-node";
-const version = "5.2.3";
+const version = "5.3.1";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9457,7 +9562,7 @@ class UsernamePasswordClient extends BaseClient {
         addClientId(parameters, this.config.authOptions.clientId);
         addUsername(parameters, request.username);
         addPassword(parameters, request.password);
-        addScopes(parameters, request.scopes);
+        addScopes(parameters, request.scopes, request.correlationId);
         addResponseType(parameters, OAuthResponseType.IDTOKEN_TOKEN);
         addGrantType(parameters, GrantType.RESOURCE_OWNER_PASSWORD_GRANT);
         addClientInfo(parameters);
@@ -9481,7 +9586,7 @@ class UsernamePasswordClient extends BaseClient {
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities);
         }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.username) {
@@ -9579,7 +9684,7 @@ class ClientApplication {
         this.logger.info("acquireTokenByCode called", request.correlationId || "");
         if (request.state && authCodePayLoad) {
             this.logger.info("acquireTokenByCode - validating state", request.correlationId || "");
-            this.validateState(request.state, authCodePayLoad.state || "");
+            this.validateState(request.state, authCodePayLoad.state || "", request.correlationId || "");
             // eslint-disable-next-line no-param-reassign
             authCodePayLoad = { ...authCodePayLoad, state: "" };
         }
@@ -9598,7 +9703,7 @@ class ClientApplication {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -9628,7 +9733,7 @@ class ClientApplication {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -9671,7 +9776,7 @@ class ClientApplication {
         }
         catch (error) {
             if (error instanceof AuthError) {
-                error.setCorrelationId(validRequest.correlationId);
+                error.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(error);
             throw error;
@@ -9725,7 +9830,7 @@ class ClientApplication {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -9747,12 +9852,12 @@ class ClientApplication {
      * @param state - Unique GUID generated by the user that is cached by the user and sent to the server during the first leg of the flow
      * @param cachedState - This string is sent back by the server with the authorization code
      */
-    validateState(state, cachedState) {
+    validateState(state, cachedState, correlationId) {
         if (!state) {
-            throw NodeAuthError.createStateNotFoundError();
+            throw NodeAuthError.createStateNotFoundError(correlationId);
         }
         if (state !== cachedState) {
-            throw createClientAuthError(stateMismatch);
+            throw createClientAuthError(stateMismatch, correlationId);
         }
     }
     /**
@@ -10057,7 +10162,7 @@ class DeviceCodeClient extends BaseClient {
      */
     createQueryString(request) {
         const parameters = new Map();
-        addScopes(parameters, request.scopes);
+        addScopes(parameters, request.scopes, request.correlationId);
         addClientId(parameters, this.config.authOptions.clientId);
         if (request.extraQueryParameters) {
             addExtraParameters(parameters, request.extraQueryParameters);
@@ -10065,33 +10170,34 @@ class DeviceCodeClient extends BaseClient {
         if (request.claims ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities);
         }
         return mapToQueryString(parameters);
     }
     /**
      * Breaks the polling with specific conditions
      * @param deviceCodeExpirationTime - expiration time for the device code request
+     * @param correlationId - correlation id of the request
      * @param userSpecifiedTimeout - developer provided timeout, to be compared against deviceCodeExpirationTime
      * @param userSpecifiedCancelFlag - boolean indicating the developer would like to cancel the request
      */
-    continuePolling(deviceCodeExpirationTime, userSpecifiedTimeout, userSpecifiedCancelFlag) {
+    continuePolling(deviceCodeExpirationTime, correlationId, userSpecifiedTimeout, userSpecifiedCancelFlag) {
         if (userSpecifiedCancelFlag) {
-            this.logger.error("Token request cancelled by setting DeviceCodeRequest.cancel = true", "");
-            throw createClientAuthError(deviceCodePollingCancelled);
+            this.logger.error("Token request cancelled by setting DeviceCodeRequest.cancel = true", correlationId);
+            throw createClientAuthError(deviceCodePollingCancelled, correlationId);
         }
         else if (userSpecifiedTimeout &&
             userSpecifiedTimeout < deviceCodeExpirationTime &&
             nowSeconds() > userSpecifiedTimeout) {
-            this.logger.error(`User defined timeout for device code polling reached. The timeout was set for ${userSpecifiedTimeout}`, "");
-            throw createClientAuthError(userTimeoutReached);
+            this.logger.error(`User defined timeout for device code polling reached. The timeout was set for ${userSpecifiedTimeout}`, correlationId);
+            throw createClientAuthError(userTimeoutReached, correlationId);
         }
         else if (nowSeconds() > deviceCodeExpirationTime) {
             if (userSpecifiedTimeout) {
-                this.logger.verbose(`User specified timeout ignored as the device code has expired before the timeout elapsed. The user specified timeout was set for ${userSpecifiedTimeout}`, "");
+                this.logger.verbose(`User specified timeout ignored as the device code has expired before the timeout elapsed. The user specified timeout was set for ${userSpecifiedTimeout}`, correlationId);
             }
-            this.logger.error(`Device code expired. Expiration time of device code was ${deviceCodeExpirationTime}`, "");
-            throw createClientAuthError(deviceCodeExpired);
+            this.logger.error(`Device code expired. Expiration time of device code was ${deviceCodeExpirationTime}`, correlationId);
+            throw createClientAuthError(deviceCodeExpired, correlationId);
         }
         return true;
     }
@@ -10114,7 +10220,7 @@ class DeviceCodeClient extends BaseClient {
          * Poll token endpoint while (device code is not expired AND operation has not been cancelled by
          * setting CancellationToken.cancel = true). POST request is sent at interval set by pollingIntervalMilli
          */
-        while (this.continuePolling(deviceCodeExpirationTime, userSpecifiedTimeout, request.cancel)) {
+        while (this.continuePolling(deviceCodeExpirationTime, request.correlationId, userSpecifiedTimeout, request.cancel)) {
             const thumbprint = {
                 clientId: this.config.authOptions.clientId,
                 authority: request.authority,
@@ -10136,7 +10242,7 @@ class DeviceCodeClient extends BaseClient {
                 else {
                     // for any other error, throw
                     this.logger.info("Unexpected error in polling from the server", request.correlationId);
-                    throw createAuthError(postRequestFailed, response.body.error);
+                    throw createAuthError(postRequestFailed, request.correlationId, response.body.error);
                 }
             }
             else {
@@ -10149,7 +10255,7 @@ class DeviceCodeClient extends BaseClient {
          * and in the rare case the conditionals in continuePolling() may not catch everything...
          */
         this.logger.error("Polling stopped for unknown reasons.", request.correlationId);
-        throw createClientAuthError(deviceCodeUnknownError);
+        throw createClientAuthError(deviceCodeUnknownError, request.correlationId);
     }
     /**
      * Creates query parameters and converts to string.
@@ -10158,7 +10264,7 @@ class DeviceCodeClient extends BaseClient {
      */
     createTokenRequestBody(request, deviceCodeResponse) {
         const parameters = new Map();
-        addScopes(parameters, request.scopes);
+        addScopes(parameters, request.scopes, request.correlationId);
         addClientId(parameters, this.config.authOptions.clientId);
         addGrantType(parameters, GrantType.DEVICE_CODE_GRANT);
         addDeviceCode(parameters, deviceCodeResponse.deviceCode);
@@ -10175,7 +10281,7 @@ class DeviceCodeClient extends BaseClient {
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities);
         }
         return mapToQueryString(parameters);
     }
@@ -10247,7 +10353,7 @@ class PublicClientApplication extends ClientApplication {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -10281,7 +10387,7 @@ class PublicClientApplication extends ClientApplication {
         if (request.redirectUri) {
             // If it's not a broker fallback scenario, we throw an error
             if (!this.config.broker.nativeBrokerPlugin) {
-                throw NodeAuthError.createRedirectUriNotSupportedError();
+                throw NodeAuthError.createRedirectUriNotSupportedError(correlationId);
             }
             // If a redirect URI is provided for a broker flow but MSAL runtime startup failed, we fall back to the browser flow and will ignore the redirect URI provided for the broker flow
             request.redirectUri = "";
@@ -10301,7 +10407,7 @@ class PublicClientApplication extends ClientApplication {
                 authCodeListenerError = e;
             });
             // Wait for server to be listening
-            const redirectUri = await this.waitForRedirectUri(loopbackClient);
+            const redirectUri = await this.waitForRedirectUri(loopbackClient, correlationId);
             const validRequest = {
                 ...remainingProperties,
                 correlationId: correlationId,
@@ -10318,10 +10424,10 @@ class PublicClientApplication extends ClientApplication {
                 throw authCodeListenerError;
             }
             if (authCodeResponse.error) {
-                throw new ServerError(authCodeResponse.error, authCodeResponse.error_description, authCodeResponse.suberror);
+                throw new ServerError(authCodeResponse.error, correlationId, authCodeResponse.error_description, authCodeResponse.suberror);
             }
             else if (!authCodeResponse.code) {
-                throw NodeAuthError.createNoAuthCodeInResponseError();
+                throw NodeAuthError.createNoAuthCodeInResponseError(correlationId);
             }
             const clientInfo = authCodeResponse.client_info;
             const tokenRequest = {
@@ -10366,7 +10472,7 @@ class PublicClientApplication extends ClientApplication {
         if (request.redirectUri) {
             // If it's not a broker fallback scenario, we throw an error
             if (!this.config.broker.nativeBrokerPlugin) {
-                throw NodeAuthError.createRedirectUriNotSupportedError();
+                throw NodeAuthError.createRedirectUriNotSupportedError(correlationId);
             }
             request.redirectUri = "";
         }
@@ -10419,9 +10525,10 @@ class PublicClientApplication extends ClientApplication {
     /**
      * Attempts to retrieve the redirectUri from the loopback server. If the loopback server does not start listening for requests within the timeout this will throw.
      * @param loopbackClient - developer provided custom loopback server implementation
+     * @param correlationId - correlation id of the request
      * @returns
      */
-    async waitForRedirectUri(loopbackClient) {
+    async waitForRedirectUri(loopbackClient, correlationId) {
         return new Promise((resolve, reject) => {
             let ticks = 0;
             const id = setInterval(() => {
@@ -10429,7 +10536,7 @@ class PublicClientApplication extends ClientApplication {
                     LOOPBACK_SERVER_CONSTANTS.INTERVAL_MS <
                     ticks) {
                     clearInterval(id);
-                    reject(NodeAuthError.createLoopbackServerTimeoutError());
+                    reject(NodeAuthError.createLoopbackServerTimeoutError(correlationId));
                     return;
                 }
                 try {
@@ -10473,10 +10580,18 @@ class ClientCredentialClient extends BaseClient {
      * @param request - CommonClientCredentialRequest provided by the developer
      */
     async acquireToken(request) {
+        // Build additional cache key components for FMI cache isolation
+        let additionalCacheKeyComponents;
+        if (request.fmiPath) {
+            additionalCacheKeyComponents = {
+                fmi_path: request.fmiPath,
+            };
+        }
         if (request.skipCache || request.claims) {
-            return this.executeTokenRequest(request, this.authority);
+            return this.executeTokenRequest(request, this.authority, 
+            /* refreshAccessToken */ undefined, additionalCacheKeyComponents);
         }
-        const [cachedAuthenticationResult, lastCacheOutcome] = await this.getCachedAuthenticationResult(request, this.config, this.cryptoUtils, this.authority, this.cacheManager, this.serverTelemetryManager);
+        const [cachedAuthenticationResult, lastCacheOutcome] = await this.getCachedAuthenticationResult(request, this.config, this.cryptoUtils, this.authority, this.cacheManager, this.serverTelemetryManager, additionalCacheKeyComponents);
         if (cachedAuthenticationResult) {
             // if the token is not expired but must be refreshed; get a new one in the background
             if (lastCacheOutcome ===
@@ -10484,19 +10599,20 @@ class ClientCredentialClient extends BaseClient {
                 this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.", request.correlationId);
                 // refresh the access token in the background
                 const refreshAccessToken = true;
-                await this.executeTokenRequest(request, this.authority, refreshAccessToken);
+                await this.executeTokenRequest(request, this.authority, refreshAccessToken, additionalCacheKeyComponents);
             }
             // return the cached token
             return cachedAuthenticationResult;
         }
         else {
-            return this.executeTokenRequest(request, this.authority);
+            return this.executeTokenRequest(request, this.authority, 
+            /* refreshAccessToken */ undefined, additionalCacheKeyComponents);
         }
     }
     /**
      * looks up cache if the tokens are cached already
      */
-    async getCachedAuthenticationResult(request, config, cryptoUtils, authority, cacheManager, serverTelemetryManager) {
+    async getCachedAuthenticationResult(request, config, cryptoUtils, authority, cacheManager, serverTelemetryManager, additionalCacheKeyComponents) {
         const clientConfiguration = config;
         const managedIdentityConfiguration = config;
         let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
@@ -10508,7 +10624,7 @@ class ClientCredentialClient extends BaseClient {
             await clientConfiguration.persistencePlugin.beforeCacheAccess(cacheContext);
         }
         const cachedAccessToken = this.readAccessTokenFromCache(authority, managedIdentityConfiguration.managedIdentityId?.id ||
-            clientConfiguration.authOptions.clientId, new ScopeSet(request.scopes || []), cacheManager, request.correlationId);
+            clientConfiguration.authOptions.clientId, new ScopeSet(request.scopes || [], request.correlationId), cacheManager, request.correlationId, additionalCacheKeyComponents);
         if (clientConfiguration.serializableCache &&
             clientConfiguration.persistencePlugin &&
             cacheContext) {
@@ -10545,21 +10661,22 @@ class ClientCredentialClient extends BaseClient {
     /**
      * Reads access token from the cache
      */
-    readAccessTokenFromCache(authority, id, scopeSet, cacheManager, correlationId) {
+    readAccessTokenFromCache(authority, id, scopeSet, cacheManager, correlationId, additionalCacheKeyComponents) {
         const accessTokenFilter = {
             homeAccountId: "",
             environment: authority.canonicalAuthorityUrlComponents.HostNameAndPort,
             credentialType: CredentialType.ACCESS_TOKEN,
             clientId: id,
             realm: authority.tenant,
-            target: ScopeSet.createSearchScopes(scopeSet.asArray()),
+            target: ScopeSet.createSearchScopes(scopeSet.asArray(), correlationId),
+            additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
         const accessTokens = cacheManager.getAccessTokensByFilter(accessTokenFilter, correlationId);
         if (accessTokens.length < 1) {
             return null;
         }
         else if (accessTokens.length > 1) {
-            throw createClientAuthError(multipleMatchingTokens);
+            throw createClientAuthError(multipleMatchingTokens, correlationId);
         }
         return accessTokens[0];
     }
@@ -10568,7 +10685,7 @@ class ClientCredentialClient extends BaseClient {
      * @param request - CommonClientCredentialRequest provided by the developer
      * @param authority - authority object
      */
-    async executeTokenRequest(request, authority, refreshAccessToken) {
+    async executeTokenRequest(request, authority, refreshAccessToken, additionalCacheKeyComponents) {
         let serverTokenResponse;
         let reqTimestamp;
         if (this.appTokenProvider) {
@@ -10612,7 +10729,12 @@ class ClientCredentialClient extends BaseClient {
         }
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
         responseHandler.validateTokenResponse(serverTokenResponse, request.correlationId, refreshAccessToken);
-        const tokenResponse = await responseHandler.handleServerTokenResponse(serverTokenResponse, this.authority, reqTimestamp, request, ApiId.acquireTokenByClientCredential);
+        const tokenResponse = await responseHandler.handleServerTokenResponse(serverTokenResponse, this.authority, reqTimestamp, request, ApiId.acquireTokenByClientCredential, undefined, // authCodePayload
+        undefined, // userAssertionHash
+        undefined, // handlingRefreshTokenResponse
+        undefined, // forceCacheRefreshTokenResponse
+        undefined, // serverRequestId
+        additionalCacheKeyComponents);
         return tokenResponse;
     }
     /**
@@ -10622,7 +10744,7 @@ class ClientCredentialClient extends BaseClient {
     async createTokenRequestBody(request) {
         const parameters = new Map();
         addClientId(parameters, this.config.authOptions.clientId);
-        addScopes(parameters, request.scopes, false);
+        addScopes(parameters, request.scopes, request.correlationId, false);
         addGrantType(parameters, GrantType.CLIENT_CREDENTIALS_GRANT);
         addLibraryInfo(parameters, this.config.libraryInfo);
         addApplicationTelemetry(parameters, this.config.telemetry.application);
@@ -10640,13 +10762,16 @@ class ClientCredentialClient extends BaseClient {
         const clientAssertion = request.clientAssertion ||
             this.config.clientCredentials.clientAssertion;
         if (clientAssertion) {
-            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, this.authority.tokenEndpoint, request.fmiPath));
             addClientAssertionType(parameters, clientAssertion.assertionType);
         }
+        if (request.fmiPath) {
+            parameters.set(FMI_PATH, request.fmiPath);
+        }
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities);
         }
         return mapToQueryString(parameters);
     }
@@ -10669,7 +10794,7 @@ class OnBehalfOfClient extends BaseClient {
      * @param request - developer provided CommonOnBehalfOfRequest
      */
     async acquireToken(request) {
-        this.scopeSet = new ScopeSet(request.scopes || []);
+        this.scopeSet = new ScopeSet(request.scopes || [], request.correlationId);
         // generate the user_assertion_hash for OBOAssertion
         this.userAssertionHash = await this.cryptoUtils.hashString(request.oboAssertion);
         if (request.skipCache || request.claims) {
@@ -10698,20 +10823,20 @@ class OnBehalfOfClient extends BaseClient {
             // Must refresh due to non-existent access_token.
             this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
             this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.", request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         else if (isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
             // Access token expired, will need to renewed
             this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
             this.logger.info(`OnbehalfofFlow:getCachedAuthenticationResult - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
+            throw createClientAuthError(tokenRefreshRequired, request.correlationId);
         }
         // fetch the idToken from cache
         const cachedIdToken = this.readIdTokenFromCacheForOBO(cachedAccessToken.homeAccountId, request.correlationId);
         let idTokenClaims;
         let cachedAccount = null;
         if (cachedIdToken) {
-            idTokenClaims = extractTokenClaims(cachedIdToken.secret, EncodingUtils.base64Decode);
+            idTokenClaims = extractTokenClaims(cachedIdToken.secret, EncodingUtils.base64Decode, request.correlationId);
             const localAccountId = idTokenClaims.oid || idTokenClaims.sub;
             const accountInfo = {
                 homeAccountId: cachedIdToken.homeAccountId,
@@ -10773,7 +10898,7 @@ class OnBehalfOfClient extends BaseClient {
         const accessTokenFilter = {
             credentialType: credentialType,
             clientId,
-            target: ScopeSet.createSearchScopes(this.scopeSet.asArray()),
+            target: ScopeSet.createSearchScopes(this.scopeSet.asArray(), request.correlationId),
             tokenType: authScheme,
             keyId: request.sshKid,
             userAssertionHash: this.userAssertionHash,
@@ -10784,7 +10909,7 @@ class OnBehalfOfClient extends BaseClient {
             return null;
         }
         else if (numAccessTokens > 1) {
-            throw createClientAuthError(multipleMatchingTokens);
+            throw createClientAuthError(multipleMatchingTokens, request.correlationId);
         }
         return accessTokens[0];
     }
@@ -10823,7 +10948,7 @@ class OnBehalfOfClient extends BaseClient {
     async createTokenRequestBody(request) {
         const parameters = new Map();
         addClientId(parameters, this.config.authOptions.clientId);
-        addScopes(parameters, request.scopes);
+        addScopes(parameters, request.scopes, request.correlationId);
         addGrantType(parameters, GrantType.JWT_BEARER);
         addClientInfo(parameters);
         addLibraryInfo(parameters, this.config.libraryInfo);
@@ -10848,7 +10973,106 @@ class OnBehalfOfClient extends BaseClient {
         if (request.claims ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities);
+        }
+        return mapToQueryString(parameters);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Client for the user_fic grant type (Leg 3 of Agent Identity).
+ * Exchanges a federated identity credential (instance token) for a user-scoped token.
+ * @internal
+ */
+class UserFederatedIdentityCredentialClient extends BaseClient {
+    constructor(configuration) {
+        super(configuration);
+    }
+    /**
+     * Acquires a token using the user_fic grant type.
+     * Always hits the network (no cache lookup for the network call).
+     * Developers use acquireTokenSilent for cached FIC tokens.
+     */
+    async acquireToken(request) {
+        return this.executeTokenRequest(request, this.authority);
+    }
+    /**
+     * Makes a network call to the token endpoint
+     */
+    async executeTokenRequest(request, authority) {
+        // Build augmented scopes once for both thumbprint and body
+        const scopeSet = new ScopeSet(request.scopes || [], request.correlationId);
+        scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
+        const augmentedScopes = scopeSet.asArray();
+        const queryParametersString = this.createTokenQueryParameters(request);
+        const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
+        const requestBody = await this.createTokenRequestBody(request, augmentedScopes);
+        const headers = this.createTokenRequestHeaders();
+        const thumbprint = {
+            clientId: this.config.authOptions.clientId,
+            authority: request.authority,
+            scopes: augmentedScopes,
+            claims: request.claims,
+            authenticationScheme: request.authenticationScheme,
+            resourceRequestMethod: request.resourceRequestMethod,
+            resourceRequestUri: request.resourceRequestUri,
+            shrClaims: request.shrClaims,
+            sshKid: request.sshKid,
+        };
+        const reqTimestamp = nowSeconds();
+        const response = await this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint, request.correlationId);
+        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
+        responseHandler.validateTokenResponse(response.body, request.correlationId);
+        const tokenResponse = await responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, ApiId.acquireTokenByUserFederatedIdentityCredential);
+        return tokenResponse;
+    }
+    /**
+     * Builds the request body for the user_fic grant type
+     */
+    async createTokenRequestBody(request, augmentedScopes) {
+        const parameters = new Map();
+        addClientId(parameters, this.config.authOptions.clientId);
+        addScopes(parameters, augmentedScopes, request.correlationId);
+        addGrantType(parameters, GrantType.USER_FIC);
+        // Send client_info=1 to get homeAccountId for user cache
+        addClientInfo(parameters);
+        // Add the user_federated_identity_credential (instance token)
+        parameters.set(USER_FEDERATED_IDENTITY_CREDENTIAL, request.assertion);
+        // Add user identification: either username or user_id (object ID)
+        if (request.username) {
+            parameters.set(USERNAME, request.username);
+        }
+        else if (request.userObjectId) {
+            parameters.set(USER_ID, request.userObjectId);
+        }
+        addLibraryInfo(parameters, this.config.libraryInfo);
+        addApplicationTelemetry(parameters, this.config.telemetry.application);
+        addThrottling(parameters);
+        if (this.serverTelemetryManager) {
+            addServerTelemetry(parameters, this.serverTelemetryManager);
+        }
+        const correlationId = request.correlationId ||
+            this.config.cryptoInterface.createNewGuid();
+        addCorrelationId(parameters, correlationId);
+        // Add client credentials (secret or assertion)
+        if (this.config.clientCredentials.clientSecret) {
+            addClientSecret(parameters, this.config.clientCredentials.clientSecret);
+        }
+        // Use per-request client assertion if provided, otherwise fall back to app-level
+        const clientAssertion = request.clientAssertion ||
+            this.config.clientCredentials.clientAssertion;
+        if (clientAssertion) {
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, this.authority.tokenEndpoint));
+            addClientAssertionType(parameters, clientAssertion.assertionType);
+        }
+        if (request.claims ||
+            (this.config.authOptions.clientCapabilities &&
+                this.config.authOptions.clientCapabilities.length > 0)) {
+            addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities);
         }
         return mapToQueryString(parameters);
     }
@@ -10902,7 +11126,7 @@ class ConfidentialClientApplication extends ClientApplication {
         if ((clientSecretNotEmpty && clientAssertionNotEmpty) ||
             (clientAssertionNotEmpty && certificateNotEmpty) ||
             (clientSecretNotEmpty && certificateNotEmpty)) {
-            throw createClientAuthError(invalidClientCredential);
+            throw createClientAuthError(invalidClientCredential, "");
         }
         if (this.config.auth.clientSecret) {
             this.clientSecret = this.config.auth.clientSecret;
@@ -10914,7 +11138,7 @@ class ConfidentialClientApplication extends ClientApplication {
             return;
         }
         if (!certificateNotEmpty) {
-            throw createClientAuthError(invalidClientCredential);
+            throw createClientAuthError(invalidClientCredential, "");
         }
         else {
             this.clientAssertion = !!this.config.auth.clientCertificate
@@ -10965,10 +11189,10 @@ class ConfidentialClientApplication extends ClientApplication {
          * valid request should not have "common" or "organizations" in lieu of the tenant_id in the authority in the auth configuration
          * example authority: "https://login.microsoftonline.com/TenantId",
          */
-        const authority = new UrlString(validRequest.authority);
+        const authority = new UrlString(validRequest.authority, validRequest.correlationId);
         const tenantId = authority.getUrlComponents().PathSegments[0];
         if (Object.values(AADAuthority).includes(tenantId)) {
-            throw createClientAuthError(missingTenantIdError);
+            throw createClientAuthError(missingTenantIdError, validRequest.correlationId);
         }
         /*
          * if this env variable is set, and the developer provided region isn't defined and isn't "DisableMsalForceRegion",
@@ -10998,7 +11222,7 @@ class ConfidentialClientApplication extends ClientApplication {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -11030,8 +11254,60 @@ class ConfidentialClientApplication extends ClientApplication {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
+            }
+            throw e;
+        }
+    }
+    /**
+     * Acquires a user-scoped token using the user_fic grant type (Leg 3 of Agent Identity).
+     *
+     * Exchanges a federated identity credential (instance token from Leg 2) for a user-scoped token.
+     * Exactly one of `userObjectId` or `username` must be provided to identify the target user.
+     *
+     * This method always makes a network call. Use `acquireTokenSilent` to retrieve cached FIC tokens.
+     */
+    async acquireTokenByUserFederatedIdentityCredential(request) {
+        this.logger.info("acquireTokenByUserFederatedIdentityCredential called", request.correlationId || "");
+        // Validate that exactly one user identifier is provided
+        if (request.userObjectId && request.username) {
+            throw createClientAuthError(conflictingUserIdentifiers, request.correlationId || "");
+        }
+        if (!request.userObjectId && !request.username) {
+            throw createClientAuthError(missingUserIdentifier, request.correlationId || "");
+        }
+        // Validate that the assertion is not empty
+        if (!request.assertion) {
+            throw createClientAuthError(emptyFicAssertion, request.correlationId || "");
+        }
+        // If there is a client assertion present in the request, resolve it
+        let clientAssertion;
+        if (request.clientAssertion) {
+            clientAssertion = {
+                assertion: await getClientAssertion(request.clientAssertion, this.config.auth.clientId),
+                assertionType: Constants.JWT_BEARER_ASSERTION_TYPE,
+            };
+        }
+        const baseRequest = await this.initializeBaseRequest(request);
+        const validRequest = {
+            ...request,
+            ...baseRequest,
+            assertion: request.assertion,
+            clientAssertion,
+        };
+        const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenByUserFederatedIdentityCredential, validRequest.correlationId);
+        try {
+            const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, undefined, request.azureCloudOptions);
+            const clientConfig = await this.buildOauthClientConfiguration(discoveredAuthority, validRequest.correlationId, "", serverTelemetryManager);
+            const ficClient = new UserFederatedIdentityCredentialClient(clientConfig);
+            this.logger.verbose("UserFederatedIdentityCredential client created", validRequest.correlationId);
+            return await ficClient.acquireToken(validRequest);
+        }
+        catch (e) {
+            if (e instanceof AuthError) {
+                e.correlationId = validRequest.correlationId;
             }
+            serverTelemetryManager.cacheFailedRequest(e);
             throw e;
         }
     }
@@ -11270,7 +11546,7 @@ class BaseManagedIdentitySource {
                 throw error;
             }
             else {
-                throw createClientAuthError(networkError);
+                throw createClientAuthError(networkError, managedIdentityRequest.correlationId);
             }
         }
         const responseHandler = new ResponseHandler(managedIdentityId.id, this.nodeStorage, this.cryptoProvider, this.logger, new StubPerformanceClient(), null, null);
@@ -11309,7 +11585,7 @@ class BaseManagedIdentitySource {
                 this.logger.info("[Managed Identity] Adding user assigned object id to the request.", "");
                 return ManagedIdentityUserAssignedIdQueryParameterNames.MANAGED_IDENTITY_OBJECT_ID;
             default:
-                throw createManagedIdentityError(invalidManagedIdentityIdType);
+                throw createManagedIdentityError(invalidManagedIdentityIdType, "");
         }
     }
 }
@@ -11329,11 +11605,12 @@ class BaseManagedIdentitySource {
  */
 BaseManagedIdentitySource.getValidatedEnvVariableUrlString = (envVariableStringName, envVariable, sourceName, logger) => {
     try {
-        return new UrlString(envVariable).urlString;
+        // Static boot-time helper invoked from each MI source's tryCreate() before any request exists
+        return new UrlString(envVariable, "").urlString;
     }
     catch (error) {
         logger.info(`[Managed Identity] ${sourceName} managed identity is unavailable because the '${envVariableStringName}' environment variable is malformed.`, "");
-        throw createManagedIdentityError(MsiEnvironmentVariableUrlMalformedErrorCodes[envVariableStringName]);
+        throw createManagedIdentityError(MsiEnvironmentVariableUrlMalformedErrorCodes[envVariableStringName], "");
     }
 };
 
@@ -11659,7 +11936,7 @@ class AzureArc extends BaseManagedIdentitySource {
             logger.info(`[Managed Identity] Environment variables validation passed for ${ManagedIdentitySourceNames.AZURE_ARC} managed identity. Endpoint URI: ${validatedIdentityEndpoint}. Creating ${ManagedIdentitySourceNames.AZURE_ARC} managed identity.`, "");
         }
         if (managedIdentityId.idType !== ManagedIdentityIdType.SYSTEM_ASSIGNED) {
-            throw createManagedIdentityError(unableToCreateAzureArc);
+            throw createManagedIdentityError(unableToCreateAzureArc, "");
         }
         return new AzureArc(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, identityEndpoint);
     }
@@ -11713,22 +11990,22 @@ class AzureArc extends BaseManagedIdentitySource {
         if (originalResponse.status === HTTP_UNAUTHORIZED) {
             const wwwAuthHeader = originalResponse.headers["www-authenticate"];
             if (!wwwAuthHeader) {
-                throw createManagedIdentityError(wwwAuthenticateHeaderMissing);
+                throw createManagedIdentityError(wwwAuthenticateHeaderMissing, "");
             }
             if (!wwwAuthHeader.includes("Basic realm=")) {
-                throw createManagedIdentityError(wwwAuthenticateHeaderUnsupportedFormat);
+                throw createManagedIdentityError(wwwAuthenticateHeaderUnsupportedFormat, "");
             }
             const secretFilePath = wwwAuthHeader.split("Basic realm=")[1];
             // throw an error if the managed identity application is not being run on Windows or Linux
             if (!SUPPORTED_AZURE_ARC_PLATFORMS.hasOwnProperty(process.platform)) {
-                throw createManagedIdentityError(platformNotSupported);
+                throw createManagedIdentityError(platformNotSupported, "");
             }
             // get the expected Windows or Linux file path
             const expectedSecretFilePath = SUPPORTED_AZURE_ARC_PLATFORMS[process.platform];
             // throw an error if the file in the file path is not a .key file
             const fileName = path.basename(secretFilePath);
             if (!fileName.endsWith(".key")) {
-                throw createManagedIdentityError(invalidFileExtension);
+                throw createManagedIdentityError(invalidFileExtension, "");
             }
             /*
              * throw an error if the file path from the www-authenticate header does not match the
@@ -11736,7 +12013,7 @@ class AzureArc extends BaseManagedIdentitySource {
              * is running on
              */
             if (expectedSecretFilePath + fileName !== secretFilePath) {
-                throw createManagedIdentityError(invalidFilePath);
+                throw createManagedIdentityError(invalidFilePath, "");
             }
             let secretFileSize;
             // attempt to get the secret file's size, in bytes
@@ -11744,11 +12021,11 @@ class AzureArc extends BaseManagedIdentitySource {
                 secretFileSize = await fs.statSync(secretFilePath).size;
             }
             catch (e) {
-                throw createManagedIdentityError(unableToReadSecretFile);
+                throw createManagedIdentityError(unableToReadSecretFile, "");
             }
             // throw an error if the secret file's size is greater than 4096 bytes
             if (secretFileSize > AZURE_ARC_SECRET_FILE_MAX_SIZE_BYTES) {
-                throw createManagedIdentityError(invalidSecret);
+                throw createManagedIdentityError(invalidSecret, "");
             }
             // attempt to read the contents of the secret file
             let secret;
@@ -11756,7 +12033,7 @@ class AzureArc extends BaseManagedIdentitySource {
                 secret = fs.readFileSync(secretFilePath, EncodingTypes.UTF8);
             }
             catch (e) {
-                throw createManagedIdentityError(unableToReadSecretFile);
+                throw createManagedIdentityError(unableToReadSecretFile, "");
             }
             const authHeaderValue = `Basic ${secret}`;
             this.logger.info(`[Managed Identity] Adding authorization header to the request.`, "");
@@ -11770,7 +12047,7 @@ class AzureArc extends BaseManagedIdentitySource {
                     throw error;
                 }
                 else {
-                    throw createClientAuthError(networkError);
+                    throw createClientAuthError(networkError, "");
                 }
             }
         }
@@ -11847,7 +12124,7 @@ class CloudShell extends BaseManagedIdentitySource {
         const validatedMsiEndpoint = CloudShell.getValidatedEnvVariableUrlString(ManagedIdentityEnvironmentVariableNames.MSI_ENDPOINT, msiEndpoint, ManagedIdentitySourceNames.CLOUD_SHELL, logger);
         logger.info(`[Managed Identity] Environment variable validation passed for ${ManagedIdentitySourceNames.CLOUD_SHELL} managed identity. Endpoint URI: ${validatedMsiEndpoint}. Creating ${ManagedIdentitySourceNames.CLOUD_SHELL} managed identity.`, "");
         if (managedIdentityId.idType !== ManagedIdentityIdType.SYSTEM_ASSIGNED) {
-            throw createManagedIdentityError(unableToCreateCloudShell);
+            throw createManagedIdentityError(unableToCreateCloudShell, "");
         }
         return new CloudShell(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, msiEndpoint);
     }
@@ -12387,7 +12664,7 @@ class ManagedIdentityClient {
             AzureArc.tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, managedIdentityId) ||
             Imds.tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries);
         if (!source) {
-            throw createManagedIdentityError(unableToCreateSource);
+            throw createManagedIdentityError(unableToCreateSource, "");
         }
         return source;
     }
@@ -12439,7 +12716,7 @@ class ManagedIdentityApplication {
      */
     async acquireToken(managedIdentityRequestParams) {
         if (!managedIdentityRequestParams.resource) {
-            throw createClientConfigurationError(urlEmptyError);
+            throw createClientConfigurationError(urlEmptyError, "");
         }
         const managedIdentityRequest = {
             forceRefresh: managedIdentityRequestParams.forceRefresh,