npm - @azure/msal-browser - Versions diffs - 5.11.0 → 5.13.0 - Mend

@azure/msal-browser 5.11.0 → 5.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (267) hide show

package/lib/msal-browser.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.11.0 2026-05-19 */
+/*! @azure/msal-browser v5.13.0 2026-06-10 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -234,7 +234,7 @@ const JsonWebTokenTypes$1 = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -286,7 +286,7 @@ const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -317,7 +317,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -337,7 +337,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -417,7 +417,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -440,7 +440,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -498,7 +498,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -586,7 +586,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userCanceled: userCanceled
 });
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -781,7 +781,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1130,8 +1130,14 @@ function addSshJwk(parameters, sshJwkString) {
  * @param serverTelemetryManager
  */
 function addServerTelemetry(parameters, serverTelemetryManager) {
-    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+    const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
+    const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
+    if (currentTelemetryHeader) {
+        parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
+    }
+    if (lastTelemetryHeader) {
+        parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
+    }
 }
 /**
  * Adds parameter that indicates to the server that throttling is supported
@@ -1170,34 +1176,12 @@ function addResource(parameters, resource) {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-/**
- * Canonicalizes a URL by making it lowercase and ensuring it ends with /
- * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
- * @param url - URL to canonicalize
- * @returns Canonicalized URL
- */
-function canonicalizeUrl(url) {
-    if (!url) {
-        return url;
-    }
-    let lowerCaseUrl = url.toLowerCase();
-    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
-    }
-    else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
-    }
-    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
-        lowerCaseUrl += "/";
-    }
-    return lowerCaseUrl;
-}
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -1250,36 +1234,71 @@ function mapToQueryString(parameters) {
     return queryParameterArray.join("&");
 }
 /**
- * Normalizes URLs for comparison by removing hash, canonicalizing,
- * and ensuring consistent URL encoding in query parameters.
- * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * Normalizes URLs for comparison per MDN & RFC 3986 standards:
+ * - Hash/fragment is removed
+ * - Scheme and host are lowercased (case-insensitive per spec)
+ * - Path and query parameters preserve original casing (case-sensitive per spec)
+ * - Percent-encoding in pathname is normalized (e.g., %27 and ' are treated equivalently)
+ * - Ensures pathname ends with /
+ * Throws a urlParseError if the provided URL is malformed and cannot be parsed.
  * @param url - URL to normalize
+ * @param logger - Optional logger used to log parse failures
+ * @param correlationId - Optional correlationId associated with the log entry
  * @returns Normalized URL string for comparison
  */
-function normalizeUrlForComparison(url) {
+function normalizeUrlForComparison(url, logger, correlationId) {
     if (!url) {
         return url;
     }
-    // Remove hash first
     const urlWithoutHash = url.split("#")[0];
+    if (!urlWithoutHash) {
+        return urlWithoutHash;
+    }
     try {
-        // Parse the URL to handle encoding consistently
         const urlObj = new URL(urlWithoutHash);
-        /*
-         * Reconstruct the URL with properly decoded query parameters
-         * This ensures that %27 and ' are treated as equivalent
-         */
-        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
-        // Apply canonicalization logic inline to avoid circular dependency
-        return canonicalizeUrl(normalizedUrl);
+        // Treat an empty query string (a bare trailing "?") as equivalent to no query
+        if (!urlObj.search) {
+            urlObj.search = "";
+        }
+        // Decode the pathname to normalize percent-encoding and ensure trailing slash
+        let pathname;
+        try {
+            pathname = decodeURIComponent(urlObj.pathname);
+        }
+        catch (e) {
+            pathname = urlObj.pathname;
+        }
+        if (!pathname.endsWith("/")) {
+            pathname += "/";
+        }
+        urlObj.pathname = pathname;
+        return urlObj.href;
+    }
+    catch (e) {
+        logger?.error("15apdm", correlationId || "");
+        throw createClientConfigurationError(urlParseError);
+    }
+}
+/**
+ * Validates that the provided value is a well-formed, parseable absolute URL.
+ * Throws a urlParseError if the value cannot be parsed by the URL API (e.g. the
+ * literal string "null", an empty string, or any malformed/relative URL). Use this
+ * to guard against persisting an invalid value (such as a redirect URL) to the cache.
+ * @param url - URL to validate
+ * @param logger - Optional logger used to log validation failures
+ * @param correlationId - Optional correlationId associated with the log entry
+ */
+function validateUrl(url, logger, correlationId) {
+    try {
+        new URL(url);
     }
     catch (e) {
-        // Fallback to original logic if URL parsing fails
-        return canonicalizeUrl(urlWithoutHash);
+        logger?.error("1lrjz7", correlationId || "");
+        throw createClientConfigurationError(urlParseError);
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1318,7 +1337,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1366,7 +1385,7 @@ function addLogToCache(correlationId, loggedMessage) {
         // Remove LRU (first entry) if capacity exceeded
         if (correlationCache.size > CACHE_CAPACITY) {
             const firstKey = correlationCache.keys().next().value;
-            if (firstKey) {
+            if (firstKey !== undefined) {
                 correlationCache.delete(firstKey);
             }
         }
@@ -1593,12 +1612,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.6.2";
+const version$1 = "16.8.0";
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1618,7 +1637,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1701,7 +1720,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1781,7 +1800,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1938,7 +1957,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2104,7 +2123,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2112,7 +2131,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2150,7 +2169,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2188,7 +2207,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2203,7 +2222,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2225,7 +2244,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2249,7 +2268,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2424,7 +2443,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2564,8 +2583,8 @@ class CacheManager {
             return false;
         }
         if (!!tenantProfileFilter.username &&
-            !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
-                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+            !this.matchUsername(tenantProfile.username, tenantProfileFilter.username) &&
+            !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username)) {
             return false;
         }
         if (!!tenantProfileFilter.loginHint &&
@@ -3556,7 +3575,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3599,7 +3618,20 @@ const IntFields = new Set([
     "currAccessCount",
     "currIdCount",
     "currRefreshCount",
-    "expiredCacheRemovedCount",
+    "ttlExpiredAcntCount",
+    "ttlExpiredITCount",
+    "ttlExpiredATCount",
+    "ttlExpiredRTCount",
+    "decryptFailedAcntCount",
+    "decryptFailedITCount",
+    "decryptFailedATCount",
+    "decryptFailedRTCount",
+    "invalidAcntCount",
+    "invalidITCount",
+    "invalidATCount",
+    "invalidRTCount",
+    "expiredATCount",
+    "expiredRTCount",
     "upgradedCacheCount",
     "cacheMatchedAccounts",
     "networkRtt",
@@ -3607,7 +3639,7 @@ const IntFields = new Set([
     "redirectBridgeMessageVersion",
 ]);
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3662,7 +3694,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3757,7 +3789,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3784,7 +3816,7 @@ function isOidcProtocolMode(config) {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3849,7 +3881,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4108,7 +4140,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4179,7 +4211,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4272,7 +4304,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4352,7 +4384,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4376,7 +4408,7 @@ const refreshTokenExpired = "refresh_token_expired";
  * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
  * @public
  */
-const uxNotAllowed = "ux_not_allowed";
+const uiNotAllowed = "ui_not_allowed";
 /**
  * Server-originated error code indicating interaction is required to complete the request.
  * @public
@@ -4413,10 +4445,10 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     nativeAccountUnavailable: nativeAccountUnavailable,
     noTokensFound: noTokensFound,
     refreshTokenExpired: refreshTokenExpired,
-    uxNotAllowed: uxNotAllowed
+    uiNotAllowed: uiNotAllowed
 });
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4430,7 +4462,7 @@ const InteractionRequiredServerErrorMessage = [
     consentRequired,
     loginRequired,
     badToken,
-    uxNotAllowed,
+    uiNotAllowed,
     interruptedUser,
 ];
 const InteractionRequiredAuthSubErrorMessage = [
@@ -4440,7 +4472,7 @@ const InteractionRequiredAuthSubErrorMessage = [
     "user_password_expired",
     "consent_required",
     "bad_token",
-    "ux_not_allowed",
+    "ui_not_allowed",
     "interrupted_user",
 ];
 /**
@@ -4484,7 +4516,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4503,7 +4535,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4571,7 +4603,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4919,7 +4951,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4929,7 +4961,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4947,7 +4979,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4968,7 +5000,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5054,7 +5086,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5085,7 +5117,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5199,7 +5231,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5211,7 +5243,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5221,7 +5253,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5231,7 +5263,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5336,7 +5368,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5893,7 +5925,7 @@ class Authority {
             }
         }
         // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
-        if (this.isInKnownAuthorities()) {
+        if (this.isInKnownAuthorities(this.hostnameAndPort)) {
             this.logger.verbose("0mt9al", this.correlationId);
             return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
         }
@@ -5960,13 +5992,14 @@ class Authority {
         return match;
     }
     /**
-     * Helper function to determine if this host is included in the knownAuthorities config option
+     * Helper function to determine if a host is included in the knownAuthorities config option.
      */
-    isInKnownAuthorities() {
+    isInKnownAuthorities(host) {
+        const normalizedHost = host.toLowerCase();
         const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
             return (authority &&
                 UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                    this.hostnameAndPort);
+                    normalizedHost);
         });
         return matches.length > 0;
     }
@@ -6043,6 +6076,10 @@ class Authority {
      *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
      *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
      *     path.
+     *  5. The issuer host is HTTPS and is explicitly listed in the
+     *     developer-configured `knownAuthorities`. This covers scenarios where
+     *     the OIDC discovery document returns an issuer host that differs from
+     *     the authority (e.g., a GUID-based issuer for a name-based CIAM authority).
      *
      * @param issuer The `issuer` value returned in the OIDC discovery document.
      * @throws ClientConfigurationError("issuer_validation_failed") on failure.
@@ -6079,11 +6116,19 @@ class Authority {
          * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
          */
         const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+        /*
+         * Rule 5: The issuer host is explicitly listed in the developer-configured
+         * knownAuthorities. This covers scenarios where the OIDC discovery document
+         * returns an issuer with a different host than the authority
+         * (e.g., a GUID-based issuer for a name-based authority).
+         */
+        const matchesKnownAuthority = issuerScheme === "https:" && this.isInKnownAuthorities(issuerHost);
         // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
         if (matchesAuthorityOrigin ||
             matchesKnownMicrosoftHost ||
             matchesRegionalMicrosoftHost ||
-            matchesCiamTenantPattern) {
+            matchesCiamTenantPattern ||
+            matchesKnownAuthority) {
             return;
         }
         // issuer validation fails if none of the above rules are satisfied
@@ -6291,7 +6336,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6325,7 +6370,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6582,7 +6627,7 @@ class AuthorizationCodeClient {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6803,7 +6848,7 @@ class RefreshTokenClient {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6919,7 +6964,7 @@ class SilentFlowClient {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6934,7 +6979,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7157,7 +7202,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7190,7 +7235,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7248,7 +7293,7 @@ class AuthenticationHeaderParser {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7265,7 +7310,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7376,35 +7421,40 @@ class ServerTelemetryManager {
      * @param error
      */
     cacheFailedRequest(error) {
-        const lastRequests = this.getLastRequests();
-        if (lastRequests.errors.length >=
-            SERVER_TELEM_MAX_CACHED_ERRORS) {
-            // Remove a cached error to make room, first in first out
-            lastRequests.failedRequests.shift(); // apiId
-            lastRequests.failedRequests.shift(); // correlationId
-            lastRequests.errors.shift();
-        }
-        lastRequests.failedRequests.push(this.apiId, this.correlationId);
-        if (error instanceof Error && !!error && error.toString()) {
-            if (error instanceof AuthError) {
-                if (error.subError) {
-                    lastRequests.errors.push(error.subError);
-                }
-                else if (error.errorCode) {
-                    lastRequests.errors.push(error.errorCode);
+        try {
+            const lastRequests = this.getLastRequests();
+            if (lastRequests.errors.length >=
+                SERVER_TELEM_MAX_CACHED_ERRORS) {
+                // Remove a cached error to make room, first in first out
+                lastRequests.failedRequests.shift(); // apiId
+                lastRequests.failedRequests.shift(); // correlationId
+                lastRequests.errors.shift();
+            }
+            lastRequests.failedRequests.push(this.apiId, this.correlationId);
+            if (error instanceof Error && !!error && error.toString()) {
+                if (error instanceof AuthError) {
+                    if (error.subError) {
+                        lastRequests.errors.push(error.subError);
+                    }
+                    else if (error.errorCode) {
+                        lastRequests.errors.push(error.errorCode);
+                    }
+                    else {
+                        lastRequests.errors.push(error.toString());
+                    }
                 }
                 else {
                     lastRequests.errors.push(error.toString());
                 }
             }
             else {
-                lastRequests.errors.push(error.toString());
+                lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
             }
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         }
-        else {
-            lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
+        catch {
+            // Ignore telemetry cache failures to avoid masking the original auth error path.
         }
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return;
     }
     /**
@@ -7524,9 +7574,36 @@ class ServerTelemetryManager {
     static makeExtraSkuString(params) {
         return makeExtraSkuString(params);
     }
+}
+/** @internal */
+class StubServerTelemetryManager extends ServerTelemetryManager {
+    constructor() {
+        super({ clientId: "", apiId: 0, correlationId: "", forceRefresh: false }, {});
+    }
+    generateCurrentRequestHeaderValue() {
+        return "";
+    }
+    generateLastRequestHeaderValue() {
+        return "";
+    }
+    cacheFailedRequest() { }
+    incrementCacheHits() {
+        return 0;
+    }
+    clearTelemetryCache() { }
+    getRegionDiscoveryFields() {
+        return "";
+    }
+    updateRegionDiscoveryMetadata() { }
+    setCacheOutcome() { }
+    setNativeBrokerErrorCode() { }
+    getNativeBrokerErrorCode() {
+        return undefined;
+    }
+    clearNativeBrokerErrorCode() { }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7547,7 +7624,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7555,7 +7632,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7595,7 +7672,7 @@ class JoseHeader {
     }
 }
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8208,7 +8285,6 @@ const SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
  */
 const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
 const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
-const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
 /**
  * Helper functions in StandardInteractionClient class (msal-browser)
  */
@@ -8390,6 +8466,43 @@ function createBrowserAuthError(errorCode, subError) {
     return new BrowserAuthError(errorCode, subError);
 }
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
+ * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
+ */
+/**
+ * Returns a URL-safe plaintext decoded string from b64 encoded input.
+ * @param input
+ */
+function base64Decode(input) {
+    return new TextDecoder().decode(base64DecToArr(input));
+}
+/**
+ * Decodes base64 into Uint8Array
+ * @param base64String
+ */
+function base64DecToArr(base64String) {
+    let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
+    switch (encodedString.length % 4) {
+        case 0:
+            break;
+        case 2:
+            encodedString += "==";
+            break;
+        case 3:
+            encodedString += "=";
+            break;
+        default:
+            throw createBrowserAuthError(invalidBase64String);
+    }
+    const binString = atob(encodedString);
+    return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
+}
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8649,43 +8762,6 @@ function base64EncArr(aBytes) {
     return btoa(binString);
 }
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
- * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
- */
-/**
- * Returns a URL-safe plaintext decoded string from b64 encoded input.
- * @param input
- */
-function base64Decode(input) {
-    return new TextDecoder().decode(base64DecToArr(input));
-}
-/**
- * Decodes base64 into Uint8Array
- * @param base64String
- */
-function base64DecToArr(base64String) {
-    let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
-    switch (encodedString.length % 4) {
-        case 0:
-            break;
-        case 2:
-            encodedString += "==";
-            break;
-        case 3:
-            encodedString += "=";
-            break;
-        default:
-            throw createBrowserAuthError(invalidBase64String);
-    }
-    const binString = atob(encodedString);
-    return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
-}
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -9104,6 +9180,16 @@ function clearHash(contentWindow) {
         contentWindow.history.replaceState(null, "", `${contentWindow.location.origin}${contentWindow.location.pathname}${contentWindow.location.search}`);
     }
 }
+/**
+ * Strips both hash and query string from the given window's URL by replacing
+ * with origin + pathname only. Used to remove auth response parameters
+ * (auth code, state, etc.) before the window is closed or navigated away.
+ */
+function clearAuthResponseFromUrl(contentWindow) {
+    if (typeof contentWindow.history?.replaceState === "function") {
+        contentWindow.history.replaceState(null, "", `${contentWindow.location.origin}${contentWindow.location.pathname}`);
+    }
+}
 /**
  * Replaces current hash with hash from provided url
  */
@@ -9162,7 +9248,7 @@ function cancelPendingBridgeResponse(logger, correlationId) {
         activeBridgeMonitor = null;
     }
 }
-async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient, experimentalConfig) {
+async function waitForBridgeResponse(timeoutMs, logger, request, performanceClient, experimentalConfig) {
     return new Promise((resolve, reject) => {
         logger.verbose("1rf6em", request.correlationId);
         const correlationId = request.correlationId;
@@ -9170,7 +9256,7 @@ async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request,
             redirectBridgeTimeoutMs: timeoutMs,
             lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false,
         }, correlationId);
-        const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
+        const { libraryState } = parseRequestState(base64Decode, request.state || "");
         const channel = new BroadcastChannel(libraryState.id);
         let responseString = undefined;
         let timedOut$1 = false;
@@ -9358,6 +9444,7 @@ var BrowserUtils = /*#__PURE__*/Object.freeze({
     blockRedirectInIframe: blockRedirectInIframe,
     blockReloadInHiddenIframes: blockReloadInHiddenIframes,
     cancelPendingBridgeResponse: cancelPendingBridgeResponse,
+    clearAuthResponseFromUrl: clearAuthResponseFromUrl,
     clearHash: clearHash,
     createGuid: createGuid,
     getCurrentUri: getCurrentUri,
@@ -10532,7 +10619,7 @@ const EventType = {
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.11.0";
+const version = "5.13.0";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10554,6 +10641,15 @@ function removeElementFromArray(array, element) {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Reason an old-schema cache entry was removed during migration.
+ */
+const MigrationRemovalReason = {
+    Invalid: "invalid",
+    TtlExpired: "ttlExpired",
+    DecryptFailed: "decryptFailed",
+    Expired: "expired",
+};
 /**
  * This class implements the cache storage interface for MSAL through browser local or session storage.
  */
@@ -10623,7 +10719,10 @@ class BrowserCacheManager extends CacheManager {
         const parsedValue = this.validateAndParseJson(rawValue || "");
         if (!parsedValue) {
             this.browserStorage.removeItem(key);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Invalid,
+            };
         }
         if (!parsedValue.lastUpdatedAt) {
             // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
@@ -10632,25 +10731,42 @@ class BrowserCacheManager extends CacheManager {
         }
         else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
             this.browserStorage.removeItem(key);
-            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.TtlExpired,
+            };
         }
-        const decryptedData = isEncrypted(parsedValue)
+        const wasEncrypted = isEncrypted(parsedValue);
+        const decryptedData = wasEncrypted
             ? await this.browserStorage.decryptData(key, parsedValue, correlationId)
             : parsedValue;
-        if (!decryptedData || !isCredentialEntity(decryptedData)) {
-            this.performanceClient.incrementFields({ invalidCacheCount: 1 }, correlationId);
-            return null;
+        if (!decryptedData) {
+            this.browserStorage.removeItem(key);
+            return {
+                entry: null,
+                removalReason: wasEncrypted
+                    ? MigrationRemovalReason.DecryptFailed
+                    : MigrationRemovalReason.Invalid,
+            };
+        }
+        if (!isCredentialEntity(decryptedData)) {
+            this.browserStorage.removeItem(key);
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Invalid,
+            };
         }
         if ((isAccessTokenEntity(decryptedData) ||
             isRefreshTokenEntity(decryptedData)) &&
             decryptedData.expiresOn &&
             isTokenExpired(decryptedData.expiresOn, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
             this.browserStorage.removeItem(key);
-            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Expired,
+            };
         }
-        return decryptedData;
+        return { entry: decryptedData };
     }
     /**
      * Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
@@ -10669,6 +10785,8 @@ class BrowserCacheManager extends CacheManager {
             const rawValue = this.browserStorage.getItem(accountKey);
             const parsedValue = this.validateAndParseJson(rawValue || "");
             if (!parsedValue) {
+                this.browserStorage.removeItem(accountKey);
+                this.performanceClient.incrementFields({ invalidAcntCount: 1 }, correlationId);
                 removeElementFromArray(accountKeysToCheck, accountKey);
                 continue;
             }
@@ -10681,8 +10799,20 @@ class BrowserCacheManager extends CacheManager {
             else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
                 // Cache expired remove account and associated tokens
                 await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
+                this.performanceClient.incrementFields({ ttlExpiredAcntCount: 1 }, correlationId);
                 removeElementFromArray(accountKeysToCheck, accountKey);
             }
+            else if (isEncrypted(parsedValue)) {
+                // Remove accounts encrypted with a different key (session cookie expired/changed)
+                const decrypted = await this.browserStorage.decryptData(accountKey, parsedValue, correlationId);
+                if (!decrypted) {
+                    this.browserStorage.removeItem(accountKey);
+                    this.performanceClient.incrementFields({
+                        decryptFailedAcntCount: 1,
+                    }, correlationId);
+                    removeElementFromArray(accountKeysToCheck, accountKey);
+                }
+            }
         }
         this.setAccountKeys(accountKeysToCheck, correlationId, accountSchema);
     }
@@ -10720,7 +10850,6 @@ class BrowserCacheManager extends CacheManager {
             });
             this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
         }
-        this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
         this.browserStorage.removeItem(accountKey);
     }
     /**
@@ -10759,8 +10888,20 @@ class BrowserCacheManager extends CacheManager {
         const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
         for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
             this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
-            const oldSchemaData = (await this.updateOldEntry(idTokenKey, correlationId));
+            const result = await this.updateOldEntry(idTokenKey, correlationId);
+            const oldSchemaData = result.entry;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields({ ttlExpiredITCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields({ decryptFailedITCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields({ invalidITCount: 1 }, correlationId);
+                        break;
+                }
                 removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
                 continue;
             }
@@ -10839,8 +10980,23 @@ class BrowserCacheManager extends CacheManager {
         const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
         for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
             this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
-            const oldSchemaData = (await this.updateOldEntry(accessTokenKey, correlationId));
+            const result = await this.updateOldEntry(accessTokenKey, correlationId);
+            const oldSchemaData = result.entry;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields({ ttlExpiredATCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields({ decryptFailedATCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Expired:
+                        this.performanceClient.incrementFields({ expiredATCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields({ invalidATCount: 1 }, correlationId);
+                        break;
+                }
                 removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
                 continue;
             }
@@ -10886,8 +11042,23 @@ class BrowserCacheManager extends CacheManager {
             ...credentialKeysToMigrate.refreshToken,
         ]) {
             this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
-            const oldSchemaData = (await this.updateOldEntry(refreshTokenKey, correlationId));
+            const result = await this.updateOldEntry(refreshTokenKey, correlationId);
+            const oldSchemaData = result.entry;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields({ ttlExpiredRTCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields({ decryptFailedRTCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Expired:
+                        this.performanceClient.incrementFields({ expiredRTCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields({ invalidRTCount: 1 }, correlationId);
+                        break;
+                }
                 removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
                 continue;
             }
@@ -12087,10 +12258,15 @@ function getRedirectUri(requestRedirectUri, clientConfigRedirectUri, logger, cor
  * @param browserStorage - Browser cache manager instance for storing telemetry data
  * @param logger - Optional logger instance for verbose logging
  * @param forceRefresh - Optional flag to force refresh of telemetry data
+ * @param enabled - Optional flag to enable or disable server telemetry (default: true for custom_auth flows, false for standard flows)
  * @returns Configured ServerTelemetryManager instance
  */
-function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh) {
+function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh, enabled = true) {
     logger.verbose("1p12tq", correlationId);
+    if (!enabled) {
+        logger.verbose("0tajnr", correlationId);
+        return new StubServerTelemetryManager();
+    }
     const telemetryPayload = {
         clientId: clientId,
         correlationId: correlationId,
@@ -12626,7 +12802,7 @@ const USER_CANCEL = "USER_CANCEL";
 const NO_NETWORK = "NO_NETWORK";
 const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
-const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
+const UI_NOT_ALLOWED = "UI_NOT_ALLOWED";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12681,8 +12857,8 @@ function createNativeAuthError(code, description, ext) {
                 return createBrowserAuthError(userCancelled);
             case NO_NETWORK:
                 return createBrowserAuthError(noNetworkConnectivity);
-            case UX_NOT_ALLOWED:
-                return createInteractionRequiredAuthError(uxNotAllowed);
+            case UI_NOT_ALLOWED:
+                return createInteractionRequiredAuthError(uiNotAllowed);
         }
     }
     return new NativeAuthError(code, description, ext);
@@ -12699,7 +12875,7 @@ class SilentCacheClient extends StandardInteractionClient {
      */
     async acquireToken(silentRequest) {
         // Telemetry manager only used to increment cacheHits here
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
             serverTelemetryManager,
             requestAuthority: silentRequest.authority,
@@ -12775,7 +12951,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // start the perf measurement
         const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
         const reqTimestamp = nowSeconds();
-        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // initialize native request
             const nativeRequest = await this.initializePlatformRequest(request);
@@ -12899,7 +13075,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         catch (e) {
             // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
             if (e instanceof NativeAuthError) {
-                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                 if (isFatalNativeAuthError(e)) {
                     throw e;
@@ -12913,7 +13089,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             noHistory: false,
         };
         const redirectUri = navigateToLoginRequestUrl
-            ? window.location.href
+            ? UrlString.getAbsoluteUrl(request.redirectStartPage || window.location.href, getCurrentUri())
             : getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
         rootMeasurement.end({ success: true });
         await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
@@ -12946,7 +13122,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             this.logger.verbose("003x5a", this.correlationId);
             const response = await this.platformAuthProvider.sendMessage(request);
             const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
-            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             serverTelemetryManager.clearNativeBrokerErrorCode();
             this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
             return authResult;
@@ -13953,6 +14129,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
         protocolMode: ProtocolMode.AAD,
+        serverTelemetryEnabled: false,
     };
     const providedSystemOptions = {
         ...DEFAULT_BROWSER_SYSTEM_OPTIONS,
@@ -14499,10 +14676,11 @@ function isPlatformAuthAllowed(config, logger, correlationId, platformAuthProvid
  * Licensed under the MIT License.
  */
 class PopupClient extends StandardInteractionClient {
-    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, correlationId, platformAuthHandler) {
+    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, correlationId, platformAuthHandler, waitForPopupResponseHook) {
         super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthHandler);
         this.nativeStorage = nativeStorageImpl;
         this.eventHandler = eventHandler;
+        this.waitForPopupResponseHook = waitForPopupResponseHook;
     }
     /**
      * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
@@ -14610,7 +14788,7 @@ class PopupClient extends StandardInteractionClient {
      */
     async executeCodeFlow(request, popupParams, pkceCodes) {
         const correlationId = request.correlationId;
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const pkce = pkceCodes ||
             (await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId));
         const popupRequest = {
@@ -14636,7 +14814,7 @@ class PopupClient extends StandardInteractionClient {
                 const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, correlationId, exports.InteractionType.Popup, { popupWindow }, null);
                 // Wait for the redirect bridge response
-                const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+                const responseString = await this.waitForPopupResponse(request, popupWindow, popupParams.popupWindowParent);
                 const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
                 return await invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
             }
@@ -14671,11 +14849,11 @@ class PopupClient extends StandardInteractionClient {
         const form = await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest, this.performanceClient);
+        const responseString = await invokeAsync(this.waitForPopupResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupRequest, popupWindow, popupParams.popupWindowParent);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
                 requestExtraQueryParameters: request.extraQueryParameters,
@@ -14696,7 +14874,7 @@ class PopupClient extends StandardInteractionClient {
         const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+        const responseString = await invokeAsync(this.waitForPopupResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(request, popupWindow, popupParams.popupWindowParent);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
@@ -14712,7 +14890,7 @@ class PopupClient extends StandardInteractionClient {
     async logoutPopupAsync(validRequest, popupParams, requestAuthority, mainWindowRedirectUri) {
         this.logger.verbose("0b7yrk", this.correlationId);
         this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, exports.InteractionType.Popup, validRequest);
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // Clear cache on logout
             await clearCacheOnLogout(this.browserStorage, this.browserCrypto, this.logger, this.correlationId, validRequest.account);
@@ -14753,7 +14931,7 @@ class PopupClient extends StandardInteractionClient {
             // Open the popup window to requestUrl.
             const popupWindow = this.openPopup(logoutUri, popupParams);
             this.eventHandler.emitEvent(EventType.POPUP_OPENED, validRequest.correlationId, exports.InteractionType.Popup, { popupWindow }, null);
-            await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest, this.performanceClient).catch(() => {
+            await this.waitForPopupResponse(validRequest, popupWindow, popupParams.popupWindowParent).catch(() => {
                 // Swallow any errors related to monitoring the window. Server logout is best effort
             });
             if (mainWindowRedirectUri) {
@@ -14832,6 +15010,19 @@ class PopupClient extends StandardInteractionClient {
             if (!popupWindow) {
                 throw createBrowserAuthError(emptyWindowError);
             }
+            try {
+                popupWindow.document.title = "Microsoft Authentication";
+            }
+            catch (e) {
+                if (typeof DOMException !== "undefined" &&
+                    e instanceof DOMException &&
+                    e.name === "SecurityError") {
+                    // Cross-origin - title cannot be set
+                }
+                else {
+                    this.logger.verbose("1s1yfs", this.correlationId);
+                }
+            }
             if (popupWindow.focus) {
                 popupWindow.focus();
             }
@@ -14910,6 +15101,12 @@ class PopupClient extends StandardInteractionClient {
         const homeAccountId = request.account && request.account.homeAccountId;
         return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
     }
+    async waitForPopupResponse(request, popupWindow, popupWindowParent) {
+        if (this.waitForPopupResponseHook) {
+            return this.waitForPopupResponseHook(request, popupWindow, popupWindowParent);
+        }
+        return waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, request, this.performanceClient);
+    }
 }
 /*
@@ -14977,7 +15174,7 @@ class RedirectClient extends StandardInteractionClient {
      */
     async executeCodeFlow(request) {
         const correlationId = request.correlationId;
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
         const redirectRequest = {
             ...request,
@@ -15063,7 +15260,9 @@ class RedirectClient extends StandardInteractionClient {
      * @param options {HandleRedirectPromiseOptions} options for handling redirect promise
      */
     async handleRedirectPromise(request, pkceVerifier, parentMeasurement, options) {
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const originalTitle = document.title;
+        document.title = "Microsoft Authentication";
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
         try {
             const [serverParams, responseString] = this.getRedirectResponse(options?.hash || "");
@@ -15082,8 +15281,8 @@ class RedirectClient extends StandardInteractionClient {
             }
             // If navigateToLoginRequestUrl is true, get the url where the redirect request was initiated
             const loginRequestUrl = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, this.correlationId, true) || "";
-            const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl);
-            const currentUrlNormalized = normalizeUrlForComparison(window.location.href);
+            const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl, this.logger, this.correlationId);
+            const currentUrlNormalized = normalizeUrlForComparison(window.location.href, this.logger, this.correlationId);
             if (loginRequestUrlNormalized === currentUrlNormalized &&
                 navigateToLoginRequestUrl) {
                 // We are on the page we need to navigate to - handle hash
@@ -15116,8 +15315,8 @@ class RedirectClient extends StandardInteractionClient {
                  * The start page is expected to also call handleRedirectPromise which will process the hash in one of the checks above.
                  */
                 let processHashOnRedirect = true;
-                if (!loginRequestUrl || loginRequestUrl === "null") {
-                    // Redirect to home page if login request url is null (real null or the string null)
+                if (!loginRequestUrl) {
+                    // Redirect to home page if login request url is empty
                     const homepage = getHomepage();
                     // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                     this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, homepage, true);
@@ -15145,6 +15344,9 @@ class RedirectClient extends StandardInteractionClient {
             }
             throw e;
         }
+        finally {
+            document.title = originalTitle;
+        }
     }
     /**
      * Gets the response hash for a redirect request
@@ -15260,7 +15462,7 @@ class RedirectClient extends StandardInteractionClient {
     async logout(logoutRequest) {
         this.logger.verbose("1rkurh", this.correlationId);
         const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, exports.InteractionType.Redirect, logoutRequest);
             // Clear cache on logout
@@ -15341,7 +15543,10 @@ class RedirectClient extends StandardInteractionClient {
      */
     getRedirectStartPage(requestStartPage) {
         const redirectStartPage = requestStartPage || window.location.href;
-        return UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+        const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+        // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
+        validateUrl(absoluteRedirectStartPage, this.logger, this.correlationId);
+        return absoluteRedirectStartPage;
     }
 }
@@ -15350,20 +15555,20 @@ class RedirectClient extends StandardInteractionClient {
  * Licensed under the MIT License.
  */
 /**
- * Creates a hidden iframe to given URL using user-requested scopes as an id.
- * @param urlNavigate
- * @param userRequestScopes
+ * Navigates the given hidden iframe to the provided URL.
+ * @param frame
+ * @param requestUrl
  */
-async function initiateCodeRequest(requestUrl, performanceClient, logger, correlationId) {
+async function initiateCodeRequest(frame, requestUrl, logger, correlationId) {
     if (!requestUrl) {
         // Throw error if request URL is empty.
         logger.info("1l7hyp", correlationId);
         throw createBrowserAuthError(emptyNavigateUri);
     }
-    return invoke(loadFrameSync, SilentHandlerLoadFrameSync, logger, performanceClient, correlationId)(requestUrl);
+    frame.src = requestUrl;
+    return frame;
 }
-async function initiateCodeFlowWithPost(config, authority, request, logger, performanceClient) {
-    const frame = createHiddenIframe();
+async function initiateCodeFlowWithPost(frame, config, authority, request, logger, performanceClient) {
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -15371,8 +15576,7 @@ async function initiateCodeFlowWithPost(config, authority, request, logger, perf
     form.submit();
     return frame;
 }
-async function initiateEarRequest(config, authority, request, logger, performanceClient) {
-    const frame = createHiddenIframe();
+async function initiateEarRequest(frame, config, authority, request, logger, performanceClient) {
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -15382,24 +15586,14 @@ async function initiateEarRequest(config, authority, request, logger, performanc
 }
 /**
  * @hidden
- * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
- * @param urlNavigate
- * @param frameName
- * @param logger
- */
-function loadFrameSync(urlNavigate) {
-    const frameHandle = createHiddenIframe();
-    frameHandle.src = urlNavigate;
-    return frameHandle;
-}
-/**
- * @hidden
- * Creates a new hidden iframe or gets an existing one for silent token renewal.
+ * Creates a new hidden iframe for silent token renewal. Callers navigate it
+ * (set `src` or submit a form) after registering the response listener.
  * @ignore
  */
 function createHiddenIframe() {
     const authFrame = document.createElement("iframe");
     authFrame.className = "msalSilentIframe";
+    authFrame.title = "Microsoft Authentication";
     authFrame.style.visibility = "hidden";
     authFrame.style.position = "absolute";
     authFrame.style.width = authFrame.style.height = "0";
@@ -15425,10 +15619,11 @@ function removeHiddenIframe(iframe) {
  * Licensed under the MIT License.
  */
 class SilentIframeClient extends StandardInteractionClient {
-    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, correlationId, platformAuthProvider) {
+    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, correlationId, platformAuthProvider, waitForIframeResponseHook) {
         super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthProvider);
         this.apiId = apiId;
         this.nativeStorage = nativeStorageImpl;
+        this.waitForIframeResponseHook = waitForIframeResponseHook;
     }
     /**
      * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none or prompt=no_session
@@ -15471,7 +15666,7 @@ class SilentIframeClient extends StandardInteractionClient {
      */
     async executeCodeFlow(request) {
         let authClient;
-        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // Initialize the client
             authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
@@ -15513,11 +15708,22 @@ class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        const iframe = await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
         const responseType = this.config.auth.OIDCOptions.responseMode;
         let responseString;
         try {
-            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+            const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If navigation below throws before responsePromise is awaited,
+                 * the listener still rejects on timeout. Swallow it here so it
+                 * does not surface as an unhandled rejection; the navigation
+                 * error is propagated instead.
+                 */
+            });
+            await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+            responseString = await responsePromise;
         }
         finally {
             invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -15526,7 +15732,7 @@ class SilentIframeClient extends StandardInteractionClient {
         if (!serverParams.ear_jwe && serverParams.code) {
             // If server doesn't support EAR, they may fallback to auth code flow instead
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
                 requestExtraQueryParameters: request.extraQueryParameters,
@@ -15553,7 +15759,7 @@ class SilentIframeClient extends StandardInteractionClient {
         // Create silent request
         const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, exports.InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
         const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
-            serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger),
+            serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
             requestAuthority: silentRequest.authority,
             requestAzureCloudOptions: silentRequest.azureCloudOptions,
             requestExtraQueryParameters: silentRequest.extraQueryParameters,
@@ -15601,21 +15807,32 @@ class SilentIframeClient extends StandardInteractionClient {
             ...request,
             codeChallenge: pkceCodes.challenge,
         };
-        let iframe;
-        if (request.httpMethod === HttpMethod.POST) {
-            iframe = await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-        }
-        else {
-            // Create authorize request url
-            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-            // Get the frame handle for the silent request
-            iframe = await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId);
-        }
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
         let responseString;
         try {
-            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+            const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If URL creation or navigation below throws before
+                 * responsePromise is awaited, the listener still rejects on
+                 * timeout. Swallow it here so it does not surface as an
+                 * unhandled rejection; the navigation error is propagated
+                 * instead.
+                 */
+            });
+            if (request.httpMethod === HttpMethod.POST) {
+                await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+            }
+            else {
+                // Create authorize request url
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+                // Navigate the iframe to the authorize request url
+                await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, navigateUrl, this.logger, correlationId);
+            }
+            responseString = await responsePromise;
         }
         finally {
             invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -15623,6 +15840,12 @@ class SilentIframeClient extends StandardInteractionClient {
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         return { serverParams, pkceCodes, silentRequest };
     }
+    async waitForIframeResponse(iframe, request) {
+        if (this.waitForIframeResponseHook) {
+            return this.waitForIframeResponseHook(iframe, request);
+        }
+        return waitForBridgeResponse(this.config.system.iframeBridgeTimeout, this.logger, request, this.performanceClient, this.config.experimental);
+    }
 }
 /*
@@ -15644,7 +15867,7 @@ class SilentRefreshClient extends StandardInteractionClient {
             // Make sure any passed redirectUri is converted to an absolute URL - redirectUri is not a required parameter for refresh token redemption so only include if explicitly provided
             silentRequest.redirectUri = getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
         }
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const refreshTokenClient = await this.createRefreshTokenClient({
             serverTelemetryManager,
             authorityUrl: silentRequest.authority,
@@ -15724,7 +15947,7 @@ class SilentAuthCodeClient extends StandardInteractionClient {
          * Each auth request creates a new instance of *Client so we can safely use this.correlationId.
          */
         this.correlationId);
-        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // Create auth code request (PKCE not needed)
             const authCodeRequest = {
@@ -16089,6 +16312,8 @@ class StandardController {
         // Preflight request
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.verbose("0os66p", correlationId);
+        redirectPreflightCheck(this.initialized, this.config);
+        this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
         const atrMeasurement = this.performanceClient.startMeasurement(AcquireTokenPreRedirect, correlationId);
         atrMeasurement.add({
             scenarioId: request.scenarioId,
@@ -16106,9 +16331,7 @@ class StandardController {
             return navigate;
         };
         try {
-            redirectPreflightCheck(this.initialized, this.config);
             enforceResourceParameter(this.config.auth.isMcp, request);
-            this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Redirect, request);
             let result;
             if (this.platformAuthProvider &&
@@ -16836,7 +17059,7 @@ class StandardController {
      * @param correlationId
      */
     createPopupClient(correlationId) {
-        return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider);
+        return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider, this.operatingContext.getResponseHandlers()?.waitForPopupResponse);
     }
     /**
      * Returns new instance of the Redirect Interaction Client
@@ -16850,7 +17073,7 @@ class StandardController {
      * @param correlationId
      */
     createSilentIframeClient(correlationId) {
-        return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider);
+        return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider, this.operatingContext.getResponseHandlers()?.waitForIframeResponse);
     }
     /**
      * Returns new instance of the Silent Cache Interaction Client
@@ -17324,7 +17547,7 @@ class BaseOperatingContext {
                 return;
         }
     }
-    constructor(config) {
+    constructor(config, responseHandlers) {
         /*
          * If loaded in an environment where window is not available,
          * set internal flag to false so that further requests fail.
@@ -17332,6 +17555,7 @@ class BaseOperatingContext {
          */
         this.browserEnvironment = typeof window !== "undefined";
         this.config = buildConfiguration(config, this.browserEnvironment);
+        this.responseHandlers = responseHandlers;
         let sessionStorage;
         try {
             sessionStorage = window[BrowserCacheLocation.SessionStorage];
@@ -17368,6 +17592,13 @@ class BaseOperatingContext {
     getConfig() {
         return this.config;
     }
+    /**
+     * Returns the internal response handlers supplied by PublicClientApplication, if any.
+     * @returns AuthResponseHandlers | undefined
+     */
+    getResponseHandlers() {
+        return this.responseHandlers;
+    }
     /**
      * Returns the MSAL Logger
      * @returns Logger
@@ -18389,7 +18620,48 @@ class PublicClientApplication {
     constructor(configuration, controller) {
         this.controller =
             controller ||
-                new StandardController(new StandardOperatingContext(configuration));
+                new StandardController(new StandardOperatingContext(configuration, {
+                    waitForPopupResponse: this.waitForPopupResponse.bind(this),
+                    waitForIframeResponse: this.waitForIframeResponse.bind(this),
+                }));
+    }
+    /**
+     * Waits for the auth response from a popup window opened by MSAL.
+     *
+     * The default implementation delegates to MSAL's `BroadcastChannel`-based bridge.
+     * Subclasses must return the raw response string (hash/query/fragment), or reject
+     * with an `AuthError` on failure.
+     *
+     * @internal
+     * @param request The in-flight authorization or end-session request.
+     * @param popupWindow The popup window opened by MSAL.
+     * @param popupWindowParent The parent window that opened the popup.
+     */
+    async waitForPopupResponse(request,
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    popupWindow,
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    popupWindowParent) {
+        const controller = this.controller;
+        return waitForBridgeResponse(controller.getConfiguration().system.popupBridgeTimeout, controller.getLogger(), request, controller.getPerformanceClient());
+    }
+    /**
+     * Waits for the auth response from a hidden iframe used by MSAL silent flows.
+     *
+     * The default implementation delegates to MSAL's `BroadcastChannel`-based bridge.
+     * Subclasses must return the raw response string (hash/query/fragment), or reject
+     * with an `AuthError` on failure.
+     *
+     * @internal
+     * @param iframe The hidden iframe MSAL attached to the document.
+     * @param request The in-flight authorization request.
+     */
+    async waitForIframeResponse(
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    iframe, request) {
+        const controller = this.controller;
+        const config = controller.getConfiguration();
+        return waitForBridgeResponse(config.system.iframeBridgeTimeout, controller.getLogger(), request, controller.getPerformanceClient(), config.experimental);
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension