Summary

** Makes correlationId a required parameter on the AuthError constructor (and all subclass error constructors) across every MSAL package. This ensures thrown errors carry correlation context consistently for telemetry and debugging.

Previously correlationId was attached after construction via setCorrelationId(), which was inconsistently called. That helper is removed; the value is now required at construction.

Scope of this PR

This PR now serves as the single consolidated PR for the correlationId error propagation work (instead of the original stacked split).

Beyond making the constructor parameter required, residual "" (placeholder) sites are being addressed per-component, starting with the lowest instance counts. For each component the throw sites are categorized into "real correlationId in scope → thread it" vs. "genuinely no request context → keep """ (e.g. interface/stub "not implemented" throws, static factory methods, pre-request config validation).

Changes

@azure/msal-common

• AuthError constructor signature changed from (errorCode, errorMessage?, suberror?) to (errorCode, correlationId, errorMessage?, suberror?).
• All subclasses updated: ClientAuthError, ClientConfigurationError, InteractionRequiredAuthError, ServerError, JoseHeaderError, NetworkError, CacheError.
• setCorrelationId() removed.
• Error helper signatures and call sites updated to pass correlationId (or "" where not yet in scope).
• Where a real correlationId is already in scope, it is now passed instead of "" (e.g. Token.sendPostRequest network error fallback). Remaining "" sites are low-level utilities (e.g. ProtocolUtils, AuthToken) whose signatures don't yet carry correlationId; threading it through them is deferred follow-up.
• API review file regenerated to reflect new public signatures.

@azure/msal-browser

• Updated error construction paths to pass required correlationId.
• Native auth error translation updated and test coverage expanded for correlationId propagation.
• Pass the in-scope correlationId (instead of "") at PkceGenerator (generateCodeVerifier, generateCodeChallengeFromVerifier) and the BrowserUtils redirect-bridge empty-response path.

@azure/msal-react

• ReactAuthError.createInvalidInteractionTypeError and createUnableToFallbackToInteractionError now accept an optional correlationId. useMsalAuthentication passes the in-scope value (loginRequest?.correlationId on the login path, the local correlationId on the acquireToken fallback path) instead of "".

@azure/msal-node-extensions

• NativeBrokerPlugin.wrapError() now takes a correlationId, threaded from the request context at every call site, so the wrapped PlatformBrokerError, InteractionRequiredAuthError, ServerError, and createClient*Error branches all carry it. The signOut no-account throw now passes request.correlationId. The only remaining "" is the setLogger → RegisterLogger catch, which runs during logger registration with no request context.

@azure/msal-node

• Error throw paths updated to pass required correlationId.
• Threaded the in-scope correlationId (instead of "") through error paths where a real value was available:
  • NodeAuthError factory methods (createRedirectUriNotSupportedError, createNoAuthCodeInResponseError, createLoopbackServerTimeoutError, createStateNotFoundError) now accept an optional correlationId.
  • PublicClientApplication (acquireTokenInteractive/acquireTokenSilent, plus threading correlationId into the private waitForRedirectUri), ClientApplication.validateState, ConfidentialClientApplication (missingTenantIdError), ClientCredentialClient and OnBehalfOfClient cache throws (multipleMatchingTokens, tokenRefreshRequired), DeviceCodeClient (threaded into the private continuePolling and the unknown-error throw), and BaseManagedIdentitySource (network-error catch).
• Remaining "" sites are pre-request config/input validation, boot-time managed-identity source selection/static factories, and interface/public-method signatures lacking a correlationId arg (INetworkModule/HttpClient, the managed-identity getServerTokenResponseAsync/getServerTokenResponse override chain, getManagedIdentityUserAssignedIdQueryParameterKey, ClientAssertion.getJwt); threading those requires wider shared/public signature changes and is tracked as continuing follow-up.

@azure/msal-angular

• Mechanical fan-out: error throw paths updated to pass correlationId (or "" where not in scope). Both invalid_interaction_type throws (msal.guard.ts, msal.interceptor.ts) are pre-request configuration validation with no correlationId in scope, so they correctly remain "".
• Threading real values into the remaining low-level/stub "" sites in the larger msal-common/msal-browser sets is tracked as continuing per-component follow-up.

Change files

• Minor version bump change files included for affected packages.

Migration

// Before
throw new AuthError("my_code", "my message");
err.setCorrelationId(corrId);

// After
throw new AuthError("my_code", correlationId, "my message");