npm - @azure/msal-browser - Versions diffs - 5.11.0 → 5.13.0 - Mend

@azure/msal-browser 5.11.0 → 5.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (267) hide show

package/lib/msal-browser.js CHANGED Viewed

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.11.0 2026-05-19 */
+/*! @azure/msal-browser v5.13.0 2026-06-10 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -238,7 +238,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -290,7 +290,7 @@
     const RESOURCE = "resource";
     const CLI_DATA = "clidata";
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -321,7 +321,7 @@
         return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -341,7 +341,7 @@
         return new ClientConfigurationError(errorCode);
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -421,7 +421,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -444,7 +444,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -502,7 +502,7 @@
         urlParseError: urlParseError
     });
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -590,7 +590,7 @@
         userCanceled: userCanceled
     });
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -785,7 +785,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1134,8 +1134,14 @@
      * @param serverTelemetryManager
      */
     function addServerTelemetry(parameters, serverTelemetryManager) {
-        parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-        parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+        const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
+        const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
+        if (currentTelemetryHeader) {
+            parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
+        }
+        if (lastTelemetryHeader) {
+            parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
+        }
     }
     /**
      * Adds parameter that indicates to the server that throttling is supported
@@ -1174,34 +1180,12 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    /**
-     * Canonicalizes a URL by making it lowercase and ensuring it ends with /
-     * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
-     * @param url - URL to canonicalize
-     * @returns Canonicalized URL
-     */
-    function canonicalizeUrl(url) {
-        if (!url) {
-            return url;
-        }
-        let lowerCaseUrl = url.toLowerCase();
-        if (StringUtils.endsWith(lowerCaseUrl, "?")) {
-            lowerCaseUrl = lowerCaseUrl.slice(0, -1);
-        }
-        else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
-            lowerCaseUrl = lowerCaseUrl.slice(0, -2);
-        }
-        if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
-            lowerCaseUrl += "/";
-        }
-        return lowerCaseUrl;
-    }
     /**
      * Parses hash string from given string. Returns empty string if no hash symbol is found.
      * @param hashString
@@ -1254,36 +1238,71 @@
         return queryParameterArray.join("&");
     }
     /**
-     * Normalizes URLs for comparison by removing hash, canonicalizing,
-     * and ensuring consistent URL encoding in query parameters.
-     * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+     * Normalizes URLs for comparison per MDN & RFC 3986 standards:
+     * - Hash/fragment is removed
+     * - Scheme and host are lowercased (case-insensitive per spec)
+     * - Path and query parameters preserve original casing (case-sensitive per spec)
+     * - Percent-encoding in pathname is normalized (e.g., %27 and ' are treated equivalently)
+     * - Ensures pathname ends with /
+     * Throws a urlParseError if the provided URL is malformed and cannot be parsed.
      * @param url - URL to normalize
+     * @param logger - Optional logger used to log parse failures
+     * @param correlationId - Optional correlationId associated with the log entry
      * @returns Normalized URL string for comparison
      */
-    function normalizeUrlForComparison(url) {
+    function normalizeUrlForComparison(url, logger, correlationId) {
         if (!url) {
             return url;
         }
-        // Remove hash first
         const urlWithoutHash = url.split("#")[0];
+        if (!urlWithoutHash) {
+            return urlWithoutHash;
+        }
         try {
-            // Parse the URL to handle encoding consistently
             const urlObj = new URL(urlWithoutHash);
-            /*
-             * Reconstruct the URL with properly decoded query parameters
-             * This ensures that %27 and ' are treated as equivalent
-             */
-            const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
-            // Apply canonicalization logic inline to avoid circular dependency
-            return canonicalizeUrl(normalizedUrl);
+            // Treat an empty query string (a bare trailing "?") as equivalent to no query
+            if (!urlObj.search) {
+                urlObj.search = "";
+            }
+            // Decode the pathname to normalize percent-encoding and ensure trailing slash
+            let pathname;
+            try {
+                pathname = decodeURIComponent(urlObj.pathname);
+            }
+            catch (e) {
+                pathname = urlObj.pathname;
+            }
+            if (!pathname.endsWith("/")) {
+                pathname += "/";
+            }
+            urlObj.pathname = pathname;
+            return urlObj.href;
+        }
+        catch (e) {
+            logger?.error("15apdm", correlationId || "");
+            throw createClientConfigurationError(urlParseError);
+        }
+    }
+    /**
+     * Validates that the provided value is a well-formed, parseable absolute URL.
+     * Throws a urlParseError if the value cannot be parsed by the URL API (e.g. the
+     * literal string "null", an empty string, or any malformed/relative URL). Use this
+     * to guard against persisting an invalid value (such as a redirect URL) to the cache.
+     * @param url - URL to validate
+     * @param logger - Optional logger used to log validation failures
+     * @param correlationId - Optional correlationId associated with the log entry
+     */
+    function validateUrl(url, logger, correlationId) {
+        try {
+            new URL(url);
         }
         catch (e) {
-            // Fallback to original logic if URL parsing fails
-            return canonicalizeUrl(urlWithoutHash);
+            logger?.error("1lrjz7", correlationId || "");
+            throw createClientConfigurationError(urlParseError);
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1322,7 +1341,7 @@
         },
     };
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1370,7 +1389,7 @@
             // Remove LRU (first entry) if capacity exceeded
             if (correlationCache.size > CACHE_CAPACITY) {
                 const firstKey = correlationCache.keys().next().value;
-                if (firstKey) {
+                if (firstKey !== undefined) {
                     correlationCache.delete(firstKey);
                 }
             }
@@ -1597,12 +1616,12 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "16.6.2";
+    const version$1 = "16.8.0";
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1622,7 +1641,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1705,7 +1724,7 @@
         return updatedAccountInfo;
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1785,7 +1804,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1942,7 +1961,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2108,7 +2127,7 @@
         return null;
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2116,7 +2135,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2154,7 +2173,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2192,7 +2211,7 @@
         };
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2207,7 +2226,7 @@
         Ciam: 3,
     };
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2229,7 +2248,7 @@
         return null;
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2253,7 +2272,7 @@
         EAR: "EAR",
     };
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -2428,7 +2447,7 @@
             entity.hasOwnProperty("authorityType"));
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2568,8 +2587,8 @@
                 return false;
             }
             if (!!tenantProfileFilter.username &&
-                !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
-                    !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+                !this.matchUsername(tenantProfile.username, tenantProfileFilter.username) &&
+                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username)) {
                 return false;
             }
             if (!!tenantProfileFilter.loginHint &&
@@ -3560,7 +3579,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3603,7 +3622,20 @@
         "currAccessCount",
         "currIdCount",
         "currRefreshCount",
-        "expiredCacheRemovedCount",
+        "ttlExpiredAcntCount",
+        "ttlExpiredITCount",
+        "ttlExpiredATCount",
+        "ttlExpiredRTCount",
+        "decryptFailedAcntCount",
+        "decryptFailedITCount",
+        "decryptFailedATCount",
+        "decryptFailedRTCount",
+        "invalidAcntCount",
+        "invalidITCount",
+        "invalidATCount",
+        "invalidRTCount",
+        "expiredATCount",
+        "expiredRTCount",
         "upgradedCacheCount",
         "cacheMatchedAccounts",
         "networkRtt",
@@ -3611,7 +3643,7 @@
         "redirectBridgeMessageVersion",
     ]);
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3666,7 +3698,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3761,7 +3793,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3788,7 +3820,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3853,7 +3885,7 @@
         return cachedAtSec > nowSeconds();
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4112,7 +4144,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4183,7 +4215,7 @@
     const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
     const SetUserData = "setUserData";
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4276,7 +4308,7 @@
         };
     };
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4356,7 +4388,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4380,7 +4412,7 @@
      * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
      * @public
      */
-    const uxNotAllowed = "ux_not_allowed";
+    const uiNotAllowed = "ui_not_allowed";
     /**
      * Server-originated error code indicating interaction is required to complete the request.
      * @public
@@ -4417,10 +4449,10 @@
         nativeAccountUnavailable: nativeAccountUnavailable,
         noTokensFound: noTokensFound,
         refreshTokenExpired: refreshTokenExpired,
-        uxNotAllowed: uxNotAllowed
+        uiNotAllowed: uiNotAllowed
     });
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4434,7 +4466,7 @@
         consentRequired,
         loginRequired,
         badToken,
-        uxNotAllowed,
+        uiNotAllowed,
         interruptedUser,
     ];
     const InteractionRequiredAuthSubErrorMessage = [
@@ -4444,7 +4476,7 @@
         "user_password_expired",
         "consent_required",
         "bad_token",
-        "ux_not_allowed",
+        "ui_not_allowed",
         "interrupted_user",
     ];
     /**
@@ -4488,7 +4520,7 @@
         return new InteractionRequiredAuthError(errorCode, errorMessage);
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4507,7 +4539,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4575,7 +4607,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4923,7 +4955,7 @@
         return baseAccount;
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4933,7 +4965,7 @@
         UPN: "UPN",
     };
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4951,7 +4983,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4972,7 +5004,7 @@
         };
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5058,7 +5090,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5089,7 +5121,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5203,7 +5235,7 @@
         return response;
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5215,7 +5247,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5225,7 +5257,7 @@
             response.hasOwnProperty("metadata"));
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5235,7 +5267,7 @@
             response.hasOwnProperty("error_description"));
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5340,7 +5372,7 @@
         },
     };
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5897,7 +5929,7 @@
                 }
             }
             // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
-            if (this.isInKnownAuthorities()) {
+            if (this.isInKnownAuthorities(this.hostnameAndPort)) {
                 this.logger.verbose("0mt9al", this.correlationId);
                 return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
             }
@@ -5964,13 +5996,14 @@
             return match;
         }
         /**
-         * Helper function to determine if this host is included in the knownAuthorities config option
+         * Helper function to determine if a host is included in the knownAuthorities config option.
          */
-        isInKnownAuthorities() {
+        isInKnownAuthorities(host) {
+            const normalizedHost = host.toLowerCase();
             const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
                 return (authority &&
                     UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                        this.hostnameAndPort);
+                        normalizedHost);
             });
             return matches.length > 0;
         }
@@ -6047,6 +6080,10 @@
          *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
          *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
          *     path.
+         *  5. The issuer host is HTTPS and is explicitly listed in the
+         *     developer-configured `knownAuthorities`. This covers scenarios where
+         *     the OIDC discovery document returns an issuer host that differs from
+         *     the authority (e.g., a GUID-based issuer for a name-based CIAM authority).
          *
          * @param issuer The `issuer` value returned in the OIDC discovery document.
          * @throws ClientConfigurationError("issuer_validation_failed") on failure.
@@ -6083,11 +6120,19 @@
              * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
              */
             const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+            /*
+             * Rule 5: The issuer host is explicitly listed in the developer-configured
+             * knownAuthorities. This covers scenarios where the OIDC discovery document
+             * returns an issuer with a different host than the authority
+             * (e.g., a GUID-based issuer for a name-based authority).
+             */
+            const matchesKnownAuthority = issuerScheme === "https:" && this.isInKnownAuthorities(issuerHost);
             // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
             if (matchesAuthorityOrigin ||
                 matchesKnownMicrosoftHost ||
                 matchesRegionalMicrosoftHost ||
-                matchesCiamTenantPattern) {
+                matchesCiamTenantPattern ||
+                matchesKnownAuthority) {
                 return;
             }
             // issuer validation fails if none of the above rules are satisfied
@@ -6295,7 +6340,7 @@
         };
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6329,7 +6374,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6586,7 +6631,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6807,7 +6852,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6923,7 +6968,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6938,7 +6983,7 @@
         },
     };
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7161,7 +7206,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7194,7 +7239,7 @@
         return Object.prototype.hasOwnProperty.call(params, "resource");
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7252,7 +7297,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7269,7 +7314,7 @@
         unexpectedError: unexpectedError
     });
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7380,35 +7425,40 @@
          * @param error
          */
         cacheFailedRequest(error) {
-            const lastRequests = this.getLastRequests();
-            if (lastRequests.errors.length >=
-                SERVER_TELEM_MAX_CACHED_ERRORS) {
-                // Remove a cached error to make room, first in first out
-                lastRequests.failedRequests.shift(); // apiId
-                lastRequests.failedRequests.shift(); // correlationId
-                lastRequests.errors.shift();
-            }
-            lastRequests.failedRequests.push(this.apiId, this.correlationId);
-            if (error instanceof Error && !!error && error.toString()) {
-                if (error instanceof AuthError) {
-                    if (error.subError) {
-                        lastRequests.errors.push(error.subError);
-                    }
-                    else if (error.errorCode) {
-                        lastRequests.errors.push(error.errorCode);
+            try {
+                const lastRequests = this.getLastRequests();
+                if (lastRequests.errors.length >=
+                    SERVER_TELEM_MAX_CACHED_ERRORS) {
+                    // Remove a cached error to make room, first in first out
+                    lastRequests.failedRequests.shift(); // apiId
+                    lastRequests.failedRequests.shift(); // correlationId
+                    lastRequests.errors.shift();
+                }
+                lastRequests.failedRequests.push(this.apiId, this.correlationId);
+                if (error instanceof Error && !!error && error.toString()) {
+                    if (error instanceof AuthError) {
+                        if (error.subError) {
+                            lastRequests.errors.push(error.subError);
+                        }
+                        else if (error.errorCode) {
+                            lastRequests.errors.push(error.errorCode);
+                        }
+                        else {
+                            lastRequests.errors.push(error.toString());
+                        }
                     }
                     else {
                         lastRequests.errors.push(error.toString());
                     }
                 }
                 else {
-                    lastRequests.errors.push(error.toString());
+                    lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
                 }
+                this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
             }
-            else {
-                lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
+            catch {
+                // Ignore telemetry cache failures to avoid masking the original auth error path.
             }
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
             return;
         }
         /**
@@ -7528,9 +7578,36 @@
         static makeExtraSkuString(params) {
             return makeExtraSkuString(params);
         }
+    }
+    /** @internal */
+    class StubServerTelemetryManager extends ServerTelemetryManager {
+        constructor() {
+            super({ clientId: "", apiId: 0, correlationId: "", forceRefresh: false }, {});
+        }
+        generateCurrentRequestHeaderValue() {
+            return "";
+        }
+        generateLastRequestHeaderValue() {
+            return "";
+        }
+        cacheFailedRequest() { }
+        incrementCacheHits() {
+            return 0;
+        }
+        clearTelemetryCache() { }
+        getRegionDiscoveryFields() {
+            return "";
+        }
+        updateRegionDiscoveryMetadata() { }
+        setCacheOutcome() { }
+        setNativeBrokerErrorCode() { }
+        getNativeBrokerErrorCode() {
+            return undefined;
+        }
+        clearNativeBrokerErrorCode() { }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7551,7 +7628,7 @@
         return new JoseHeaderError(code);
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7559,7 +7636,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7599,7 +7676,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.2 2026-05-19 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8212,7 +8289,6 @@
      */
     const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
     const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
-    const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
     /**
      * Helper functions in StandardInteractionClient class (msal-browser)
      */
@@ -8394,6 +8470,43 @@
         return new BrowserAuthError(errorCode, subError);
     }
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
+     * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
+     */
+    /**
+     * Returns a URL-safe plaintext decoded string from b64 encoded input.
+     * @param input
+     */
+    function base64Decode(input) {
+        return new TextDecoder().decode(base64DecToArr(input));
+    }
+    /**
+     * Decodes base64 into Uint8Array
+     * @param base64String
+     */
+    function base64DecToArr(base64String) {
+        let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
+        switch (encodedString.length % 4) {
+            case 0:
+                break;
+            case 2:
+                encodedString += "==";
+                break;
+            case 3:
+                encodedString += "=";
+                break;
+            default:
+                throw createBrowserAuthError(invalidBase64String);
+        }
+        const binString = atob(encodedString);
+        return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
+    }
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8653,43 +8766,6 @@
         return btoa(binString);
     }
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
-     * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
-     */
-    /**
-     * Returns a URL-safe plaintext decoded string from b64 encoded input.
-     * @param input
-     */
-    function base64Decode(input) {
-        return new TextDecoder().decode(base64DecToArr(input));
-    }
-    /**
-     * Decodes base64 into Uint8Array
-     * @param base64String
-     */
-    function base64DecToArr(base64String) {
-        let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
-        switch (encodedString.length % 4) {
-            case 0:
-                break;
-            case 2:
-                encodedString += "==";
-                break;
-            case 3:
-                encodedString += "=";
-                break;
-            default:
-                throw createBrowserAuthError(invalidBase64String);
-        }
-        const binString = atob(encodedString);
-        return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
-    }
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -9108,6 +9184,16 @@
             contentWindow.history.replaceState(null, "", `${contentWindow.location.origin}${contentWindow.location.pathname}${contentWindow.location.search}`);
         }
     }
+    /**
+     * Strips both hash and query string from the given window's URL by replacing
+     * with origin + pathname only. Used to remove auth response parameters
+     * (auth code, state, etc.) before the window is closed or navigated away.
+     */
+    function clearAuthResponseFromUrl(contentWindow) {
+        if (typeof contentWindow.history?.replaceState === "function") {
+            contentWindow.history.replaceState(null, "", `${contentWindow.location.origin}${contentWindow.location.pathname}`);
+        }
+    }
     /**
      * Replaces current hash with hash from provided url
      */
@@ -9166,7 +9252,7 @@
             activeBridgeMonitor = null;
         }
     }
-    async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient, experimentalConfig) {
+    async function waitForBridgeResponse(timeoutMs, logger, request, performanceClient, experimentalConfig) {
         return new Promise((resolve, reject) => {
             logger.verbose("1rf6em", request.correlationId);
             const correlationId = request.correlationId;
@@ -9174,7 +9260,7 @@
                 redirectBridgeTimeoutMs: timeoutMs,
                 lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false,
             }, correlationId);
-            const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
+            const { libraryState } = parseRequestState(base64Decode, request.state || "");
             const channel = new BroadcastChannel(libraryState.id);
             let responseString = undefined;
             let timedOut$1 = false;
@@ -9362,6 +9448,7 @@
         blockRedirectInIframe: blockRedirectInIframe,
         blockReloadInHiddenIframes: blockReloadInHiddenIframes,
         cancelPendingBridgeResponse: cancelPendingBridgeResponse,
+        clearAuthResponseFromUrl: clearAuthResponseFromUrl,
         clearHash: clearHash,
         createGuid: createGuid,
         getCurrentUri: getCurrentUri,
@@ -10536,7 +10623,7 @@
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "5.11.0";
+    const version = "5.13.0";
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10558,6 +10645,15 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
+    /**
+     * Reason an old-schema cache entry was removed during migration.
+     */
+    const MigrationRemovalReason = {
+        Invalid: "invalid",
+        TtlExpired: "ttlExpired",
+        DecryptFailed: "decryptFailed",
+        Expired: "expired",
+    };
     /**
      * This class implements the cache storage interface for MSAL through browser local or session storage.
      */
@@ -10627,7 +10723,10 @@
             const parsedValue = this.validateAndParseJson(rawValue || "");
             if (!parsedValue) {
                 this.browserStorage.removeItem(key);
-                return null;
+                return {
+                    entry: null,
+                    removalReason: MigrationRemovalReason.Invalid,
+                };
             }
             if (!parsedValue.lastUpdatedAt) {
                 // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
@@ -10636,25 +10735,42 @@
             }
             else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
                 this.browserStorage.removeItem(key);
-                this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-                return null;
+                return {
+                    entry: null,
+                    removalReason: MigrationRemovalReason.TtlExpired,
+                };
             }
-            const decryptedData = isEncrypted(parsedValue)
+            const wasEncrypted = isEncrypted(parsedValue);
+            const decryptedData = wasEncrypted
                 ? await this.browserStorage.decryptData(key, parsedValue, correlationId)
                 : parsedValue;
-            if (!decryptedData || !isCredentialEntity(decryptedData)) {
-                this.performanceClient.incrementFields({ invalidCacheCount: 1 }, correlationId);
-                return null;
+            if (!decryptedData) {
+                this.browserStorage.removeItem(key);
+                return {
+                    entry: null,
+                    removalReason: wasEncrypted
+                        ? MigrationRemovalReason.DecryptFailed
+                        : MigrationRemovalReason.Invalid,
+                };
+            }
+            if (!isCredentialEntity(decryptedData)) {
+                this.browserStorage.removeItem(key);
+                return {
+                    entry: null,
+                    removalReason: MigrationRemovalReason.Invalid,
+                };
             }
             if ((isAccessTokenEntity(decryptedData) ||
                 isRefreshTokenEntity(decryptedData)) &&
                 decryptedData.expiresOn &&
                 isTokenExpired(decryptedData.expiresOn, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
                 this.browserStorage.removeItem(key);
-                this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-                return null;
+                return {
+                    entry: null,
+                    removalReason: MigrationRemovalReason.Expired,
+                };
             }
-            return decryptedData;
+            return { entry: decryptedData };
         }
         /**
          * Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
@@ -10673,6 +10789,8 @@
                 const rawValue = this.browserStorage.getItem(accountKey);
                 const parsedValue = this.validateAndParseJson(rawValue || "");
                 if (!parsedValue) {
+                    this.browserStorage.removeItem(accountKey);
+                    this.performanceClient.incrementFields({ invalidAcntCount: 1 }, correlationId);
                     removeElementFromArray(accountKeysToCheck, accountKey);
                     continue;
                 }
@@ -10685,8 +10803,20 @@
                 else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
                     // Cache expired remove account and associated tokens
                     await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
+                    this.performanceClient.incrementFields({ ttlExpiredAcntCount: 1 }, correlationId);
                     removeElementFromArray(accountKeysToCheck, accountKey);
                 }
+                else if (isEncrypted(parsedValue)) {
+                    // Remove accounts encrypted with a different key (session cookie expired/changed)
+                    const decrypted = await this.browserStorage.decryptData(accountKey, parsedValue, correlationId);
+                    if (!decrypted) {
+                        this.browserStorage.removeItem(accountKey);
+                        this.performanceClient.incrementFields({
+                            decryptFailedAcntCount: 1,
+                        }, correlationId);
+                        removeElementFromArray(accountKeysToCheck, accountKey);
+                    }
+                }
             }
             this.setAccountKeys(accountKeysToCheck, correlationId, accountSchema);
         }
@@ -10724,7 +10854,6 @@
                 });
                 this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
             }
-            this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
             this.browserStorage.removeItem(accountKey);
         }
         /**
@@ -10763,8 +10892,20 @@
             const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
             for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
                 this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
-                const oldSchemaData = (await this.updateOldEntry(idTokenKey, correlationId));
+                const result = await this.updateOldEntry(idTokenKey, correlationId);
+                const oldSchemaData = result.entry;
                 if (!oldSchemaData) {
+                    switch (result.removalReason) {
+                        case MigrationRemovalReason.TtlExpired:
+                            this.performanceClient.incrementFields({ ttlExpiredITCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.DecryptFailed:
+                            this.performanceClient.incrementFields({ decryptFailedITCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Invalid:
+                            this.performanceClient.incrementFields({ invalidITCount: 1 }, correlationId);
+                            break;
+                    }
                     removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
                     continue;
                 }
@@ -10843,8 +10984,23 @@
             const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
             for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
                 this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
-                const oldSchemaData = (await this.updateOldEntry(accessTokenKey, correlationId));
+                const result = await this.updateOldEntry(accessTokenKey, correlationId);
+                const oldSchemaData = result.entry;
                 if (!oldSchemaData) {
+                    switch (result.removalReason) {
+                        case MigrationRemovalReason.TtlExpired:
+                            this.performanceClient.incrementFields({ ttlExpiredATCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.DecryptFailed:
+                            this.performanceClient.incrementFields({ decryptFailedATCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Expired:
+                            this.performanceClient.incrementFields({ expiredATCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Invalid:
+                            this.performanceClient.incrementFields({ invalidATCount: 1 }, correlationId);
+                            break;
+                    }
                     removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
                     continue;
                 }
@@ -10890,8 +11046,23 @@
                 ...credentialKeysToMigrate.refreshToken,
             ]) {
                 this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
-                const oldSchemaData = (await this.updateOldEntry(refreshTokenKey, correlationId));
+                const result = await this.updateOldEntry(refreshTokenKey, correlationId);
+                const oldSchemaData = result.entry;
                 if (!oldSchemaData) {
+                    switch (result.removalReason) {
+                        case MigrationRemovalReason.TtlExpired:
+                            this.performanceClient.incrementFields({ ttlExpiredRTCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.DecryptFailed:
+                            this.performanceClient.incrementFields({ decryptFailedRTCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Expired:
+                            this.performanceClient.incrementFields({ expiredRTCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Invalid:
+                            this.performanceClient.incrementFields({ invalidRTCount: 1 }, correlationId);
+                            break;
+                    }
                     removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
                     continue;
                 }
@@ -12091,10 +12262,15 @@
      * @param browserStorage - Browser cache manager instance for storing telemetry data
      * @param logger - Optional logger instance for verbose logging
      * @param forceRefresh - Optional flag to force refresh of telemetry data
+     * @param enabled - Optional flag to enable or disable server telemetry (default: true for custom_auth flows, false for standard flows)
      * @returns Configured ServerTelemetryManager instance
      */
-    function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh) {
+    function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh, enabled = true) {
         logger.verbose("1p12tq", correlationId);
+        if (!enabled) {
+            logger.verbose("0tajnr", correlationId);
+            return new StubServerTelemetryManager();
+        }
         const telemetryPayload = {
             clientId: clientId,
             correlationId: correlationId,
@@ -12630,7 +12806,7 @@
     const NO_NETWORK = "NO_NETWORK";
     const DISABLED = "DISABLED";
     const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
-    const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
+    const UI_NOT_ALLOWED = "UI_NOT_ALLOWED";
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12685,8 +12861,8 @@
                     return createBrowserAuthError(userCancelled);
                 case NO_NETWORK:
                     return createBrowserAuthError(noNetworkConnectivity);
-                case UX_NOT_ALLOWED:
-                    return createInteractionRequiredAuthError(uxNotAllowed);
+                case UI_NOT_ALLOWED:
+                    return createInteractionRequiredAuthError(uiNotAllowed);
             }
         }
         return new NativeAuthError(code, description, ext);
@@ -12703,7 +12879,7 @@
          */
         async acquireToken(silentRequest) {
             // Telemetry manager only used to increment cacheHits here
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
                 serverTelemetryManager,
                 requestAuthority: silentRequest.authority,
@@ -12779,7 +12955,7 @@
             // start the perf measurement
             const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
             const reqTimestamp = nowSeconds();
-            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 // initialize native request
                 const nativeRequest = await this.initializePlatformRequest(request);
@@ -12903,7 +13079,7 @@
             catch (e) {
                 // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
                 if (e instanceof NativeAuthError) {
-                    const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+                    const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
                     serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                     if (isFatalNativeAuthError(e)) {
                         throw e;
@@ -12917,7 +13093,7 @@
                 noHistory: false,
             };
             const redirectUri = navigateToLoginRequestUrl
-                ? window.location.href
+                ? UrlString.getAbsoluteUrl(request.redirectStartPage || window.location.href, getCurrentUri())
                 : getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
             rootMeasurement.end({ success: true });
             await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
@@ -12950,7 +13126,7 @@
                 this.logger.verbose("003x5a", this.correlationId);
                 const response = await this.platformAuthProvider.sendMessage(request);
                 const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
-                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
                 serverTelemetryManager.clearNativeBrokerErrorCode();
                 this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
                 return authResult;
@@ -13957,6 +14133,7 @@
             nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
                 DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
             protocolMode: ProtocolMode.AAD,
+            serverTelemetryEnabled: false,
         };
         const providedSystemOptions = {
             ...DEFAULT_BROWSER_SYSTEM_OPTIONS,
@@ -14503,10 +14680,11 @@
      * Licensed under the MIT License.
      */
     class PopupClient extends StandardInteractionClient {
-        constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, correlationId, platformAuthHandler) {
+        constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, correlationId, platformAuthHandler, waitForPopupResponseHook) {
             super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthHandler);
             this.nativeStorage = nativeStorageImpl;
             this.eventHandler = eventHandler;
+            this.waitForPopupResponseHook = waitForPopupResponseHook;
         }
         /**
          * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
@@ -14614,7 +14792,7 @@
          */
         async executeCodeFlow(request, popupParams, pkceCodes) {
             const correlationId = request.correlationId;
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const pkce = pkceCodes ||
                 (await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId));
             const popupRequest = {
@@ -14640,7 +14818,7 @@
                     const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
                     this.eventHandler.emitEvent(EventType.POPUP_OPENED, correlationId, exports.InteractionType.Popup, { popupWindow }, null);
                     // Wait for the redirect bridge response
-                    const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+                    const responseString = await this.waitForPopupResponse(request, popupWindow, popupParams.popupWindowParent);
                     const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
                     return await invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
                 }
@@ -14675,11 +14853,11 @@
             const form = await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient);
             form.submit();
             // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest, this.performanceClient);
+            const responseString = await invokeAsync(this.waitForPopupResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupRequest, popupWindow, popupParams.popupWindowParent);
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
             if (!serverParams.ear_jwe && serverParams.code) {
                 const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                    serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                    serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                     requestAuthority: request.authority,
                     requestAzureCloudOptions: request.azureCloudOptions,
                     requestExtraQueryParameters: request.extraQueryParameters,
@@ -14700,7 +14878,7 @@
             const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
             form.submit();
             // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+            const responseString = await invokeAsync(this.waitForPopupResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(request, popupWindow, popupParams.popupWindowParent);
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
             return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
@@ -14716,7 +14894,7 @@
         async logoutPopupAsync(validRequest, popupParams, requestAuthority, mainWindowRedirectUri) {
             this.logger.verbose("0b7yrk", this.correlationId);
             this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, exports.InteractionType.Popup, validRequest);
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 // Clear cache on logout
                 await clearCacheOnLogout(this.browserStorage, this.browserCrypto, this.logger, this.correlationId, validRequest.account);
@@ -14757,7 +14935,7 @@
                 // Open the popup window to requestUrl.
                 const popupWindow = this.openPopup(logoutUri, popupParams);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, validRequest.correlationId, exports.InteractionType.Popup, { popupWindow }, null);
-                await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest, this.performanceClient).catch(() => {
+                await this.waitForPopupResponse(validRequest, popupWindow, popupParams.popupWindowParent).catch(() => {
                     // Swallow any errors related to monitoring the window. Server logout is best effort
                 });
                 if (mainWindowRedirectUri) {
@@ -14836,6 +15014,19 @@
                 if (!popupWindow) {
                     throw createBrowserAuthError(emptyWindowError);
                 }
+                try {
+                    popupWindow.document.title = "Microsoft Authentication";
+                }
+                catch (e) {
+                    if (typeof DOMException !== "undefined" &&
+                        e instanceof DOMException &&
+                        e.name === "SecurityError") {
+                        // Cross-origin - title cannot be set
+                    }
+                    else {
+                        this.logger.verbose("1s1yfs", this.correlationId);
+                    }
+                }
                 if (popupWindow.focus) {
                     popupWindow.focus();
                 }
@@ -14914,6 +15105,12 @@
             const homeAccountId = request.account && request.account.homeAccountId;
             return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
         }
+        async waitForPopupResponse(request, popupWindow, popupWindowParent) {
+            if (this.waitForPopupResponseHook) {
+                return this.waitForPopupResponseHook(request, popupWindow, popupWindowParent);
+            }
+            return waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, request, this.performanceClient);
+        }
     }
     /*
@@ -14981,7 +15178,7 @@
          */
         async executeCodeFlow(request) {
             const correlationId = request.correlationId;
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
             const redirectRequest = {
                 ...request,
@@ -15067,7 +15264,9 @@
          * @param options {HandleRedirectPromiseOptions} options for handling redirect promise
          */
         async handleRedirectPromise(request, pkceVerifier, parentMeasurement, options) {
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const originalTitle = document.title;
+            document.title = "Microsoft Authentication";
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
             try {
                 const [serverParams, responseString] = this.getRedirectResponse(options?.hash || "");
@@ -15086,8 +15285,8 @@
                 }
                 // If navigateToLoginRequestUrl is true, get the url where the redirect request was initiated
                 const loginRequestUrl = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, this.correlationId, true) || "";
-                const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl);
-                const currentUrlNormalized = normalizeUrlForComparison(window.location.href);
+                const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl, this.logger, this.correlationId);
+                const currentUrlNormalized = normalizeUrlForComparison(window.location.href, this.logger, this.correlationId);
                 if (loginRequestUrlNormalized === currentUrlNormalized &&
                     navigateToLoginRequestUrl) {
                     // We are on the page we need to navigate to - handle hash
@@ -15120,8 +15319,8 @@
                      * The start page is expected to also call handleRedirectPromise which will process the hash in one of the checks above.
                      */
                     let processHashOnRedirect = true;
-                    if (!loginRequestUrl || loginRequestUrl === "null") {
-                        // Redirect to home page if login request url is null (real null or the string null)
+                    if (!loginRequestUrl) {
+                        // Redirect to home page if login request url is empty
                         const homepage = getHomepage();
                         // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                         this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, homepage, true);
@@ -15149,6 +15348,9 @@
                 }
                 throw e;
             }
+            finally {
+                document.title = originalTitle;
+            }
         }
         /**
          * Gets the response hash for a redirect request
@@ -15264,7 +15466,7 @@
         async logout(logoutRequest) {
             this.logger.verbose("1rkurh", this.correlationId);
             const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, exports.InteractionType.Redirect, logoutRequest);
                 // Clear cache on logout
@@ -15345,7 +15547,10 @@
          */
         getRedirectStartPage(requestStartPage) {
             const redirectStartPage = requestStartPage || window.location.href;
-            return UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+            const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+            // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
+            validateUrl(absoluteRedirectStartPage, this.logger, this.correlationId);
+            return absoluteRedirectStartPage;
         }
     }
@@ -15354,20 +15559,20 @@
      * Licensed under the MIT License.
      */
     /**
-     * Creates a hidden iframe to given URL using user-requested scopes as an id.
-     * @param urlNavigate
-     * @param userRequestScopes
+     * Navigates the given hidden iframe to the provided URL.
+     * @param frame
+     * @param requestUrl
      */
-    async function initiateCodeRequest(requestUrl, performanceClient, logger, correlationId) {
+    async function initiateCodeRequest(frame, requestUrl, logger, correlationId) {
         if (!requestUrl) {
             // Throw error if request URL is empty.
             logger.info("1l7hyp", correlationId);
             throw createBrowserAuthError(emptyNavigateUri);
         }
-        return invoke(loadFrameSync, SilentHandlerLoadFrameSync, logger, performanceClient, correlationId)(requestUrl);
+        frame.src = requestUrl;
+        return frame;
     }
-    async function initiateCodeFlowWithPost(config, authority, request, logger, performanceClient) {
-        const frame = createHiddenIframe();
+    async function initiateCodeFlowWithPost(frame, config, authority, request, logger, performanceClient) {
         if (!frame.contentDocument) {
             throw "No document associated with iframe!";
         }
@@ -15375,8 +15580,7 @@
         form.submit();
         return frame;
     }
-    async function initiateEarRequest(config, authority, request, logger, performanceClient) {
-        const frame = createHiddenIframe();
+    async function initiateEarRequest(frame, config, authority, request, logger, performanceClient) {
         if (!frame.contentDocument) {
             throw "No document associated with iframe!";
         }
@@ -15386,24 +15590,14 @@
     }
     /**
      * @hidden
-     * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
-     * @param urlNavigate
-     * @param frameName
-     * @param logger
-     */
-    function loadFrameSync(urlNavigate) {
-        const frameHandle = createHiddenIframe();
-        frameHandle.src = urlNavigate;
-        return frameHandle;
-    }
-    /**
-     * @hidden
-     * Creates a new hidden iframe or gets an existing one for silent token renewal.
+     * Creates a new hidden iframe for silent token renewal. Callers navigate it
+     * (set `src` or submit a form) after registering the response listener.
      * @ignore
      */
     function createHiddenIframe() {
         const authFrame = document.createElement("iframe");
         authFrame.className = "msalSilentIframe";
+        authFrame.title = "Microsoft Authentication";
         authFrame.style.visibility = "hidden";
         authFrame.style.position = "absolute";
         authFrame.style.width = authFrame.style.height = "0";
@@ -15429,10 +15623,11 @@
      * Licensed under the MIT License.
      */
     class SilentIframeClient extends StandardInteractionClient {
-        constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, correlationId, platformAuthProvider) {
+        constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, correlationId, platformAuthProvider, waitForIframeResponseHook) {
             super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthProvider);
             this.apiId = apiId;
             this.nativeStorage = nativeStorageImpl;
+            this.waitForIframeResponseHook = waitForIframeResponseHook;
         }
         /**
          * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none or prompt=no_session
@@ -15475,7 +15670,7 @@
          */
         async executeCodeFlow(request) {
             let authClient;
-            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 // Initialize the client
                 authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
@@ -15517,11 +15712,22 @@
                 earJwk: earJwk,
                 codeChallenge: pkceCodes.challenge,
             };
-            const iframe = await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+            // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+            const iframe = createHiddenIframe();
             const responseType = this.config.auth.OIDCOptions.responseMode;
             let responseString;
             try {
-                responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+                const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+                responsePromise.catch(() => {
+                    /*
+                     * If navigation below throws before responsePromise is awaited,
+                     * the listener still rejects on timeout. Swallow it here so it
+                     * does not surface as an unhandled rejection; the navigation
+                     * error is propagated instead.
+                     */
+                });
+                await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+                responseString = await responsePromise;
             }
             finally {
                 invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -15530,7 +15736,7 @@
             if (!serverParams.ear_jwe && serverParams.code) {
                 // If server doesn't support EAR, they may fallback to auth code flow instead
                 const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                    serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                    serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                     requestAuthority: request.authority,
                     requestAzureCloudOptions: request.azureCloudOptions,
                     requestExtraQueryParameters: request.extraQueryParameters,
@@ -15557,7 +15763,7 @@
             // Create silent request
             const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, exports.InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
-                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger),
+                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                 requestAuthority: silentRequest.authority,
                 requestAzureCloudOptions: silentRequest.azureCloudOptions,
                 requestExtraQueryParameters: silentRequest.extraQueryParameters,
@@ -15605,21 +15811,32 @@
                 ...request,
                 codeChallenge: pkceCodes.challenge,
             };
-            let iframe;
-            if (request.httpMethod === HttpMethod.POST) {
-                iframe = await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-            }
-            else {
-                // Create authorize request url
-                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-                // Get the frame handle for the silent request
-                iframe = await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId);
-            }
+            // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+            const iframe = createHiddenIframe();
             const responseType = this.config.auth.OIDCOptions.responseMode;
             // Wait for response from the redirect bridge.
             let responseString;
             try {
-                responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+                const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+                responsePromise.catch(() => {
+                    /*
+                     * If URL creation or navigation below throws before
+                     * responsePromise is awaited, the listener still rejects on
+                     * timeout. Swallow it here so it does not surface as an
+                     * unhandled rejection; the navigation error is propagated
+                     * instead.
+                     */
+                });
+                if (request.httpMethod === HttpMethod.POST) {
+                    await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+                }
+                else {
+                    // Create authorize request url
+                    const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+                    // Navigate the iframe to the authorize request url
+                    await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, navigateUrl, this.logger, correlationId);
+                }
+                responseString = await responsePromise;
             }
             finally {
                 invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -15627,6 +15844,12 @@
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
             return { serverParams, pkceCodes, silentRequest };
         }
+        async waitForIframeResponse(iframe, request) {
+            if (this.waitForIframeResponseHook) {
+                return this.waitForIframeResponseHook(iframe, request);
+            }
+            return waitForBridgeResponse(this.config.system.iframeBridgeTimeout, this.logger, request, this.performanceClient, this.config.experimental);
+        }
     }
     /*
@@ -15648,7 +15871,7 @@
                 // Make sure any passed redirectUri is converted to an absolute URL - redirectUri is not a required parameter for refresh token redemption so only include if explicitly provided
                 silentRequest.redirectUri = getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
             }
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const refreshTokenClient = await this.createRefreshTokenClient({
                 serverTelemetryManager,
                 authorityUrl: silentRequest.authority,
@@ -15728,7 +15951,7 @@
              * Each auth request creates a new instance of *Client so we can safely use this.correlationId.
              */
             this.correlationId);
-            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 // Create auth code request (PKCE not needed)
                 const authCodeRequest = {
@@ -16093,6 +16316,8 @@
             // Preflight request
             const correlationId = this.getRequestCorrelationId(request);
             this.logger.verbose("0os66p", correlationId);
+            redirectPreflightCheck(this.initialized, this.config);
+            this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
             const atrMeasurement = this.performanceClient.startMeasurement(AcquireTokenPreRedirect, correlationId);
             atrMeasurement.add({
                 scenarioId: request.scenarioId,
@@ -16110,9 +16335,7 @@
                 return navigate;
             };
             try {
-                redirectPreflightCheck(this.initialized, this.config);
                 enforceResourceParameter(this.config.auth.isMcp, request);
-                this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, exports.InteractionType.Redirect, request);
                 let result;
                 if (this.platformAuthProvider &&
@@ -16840,7 +17063,7 @@
          * @param correlationId
          */
         createPopupClient(correlationId) {
-            return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider);
+            return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider, this.operatingContext.getResponseHandlers()?.waitForPopupResponse);
         }
         /**
          * Returns new instance of the Redirect Interaction Client
@@ -16854,7 +17077,7 @@
          * @param correlationId
          */
         createSilentIframeClient(correlationId) {
-            return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider);
+            return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider, this.operatingContext.getResponseHandlers()?.waitForIframeResponse);
         }
         /**
          * Returns new instance of the Silent Cache Interaction Client
@@ -17328,7 +17551,7 @@
                     return;
             }
         }
-        constructor(config) {
+        constructor(config, responseHandlers) {
             /*
              * If loaded in an environment where window is not available,
              * set internal flag to false so that further requests fail.
@@ -17336,6 +17559,7 @@
              */
             this.browserEnvironment = typeof window !== "undefined";
             this.config = buildConfiguration(config, this.browserEnvironment);
+            this.responseHandlers = responseHandlers;
             let sessionStorage;
             try {
                 sessionStorage = window[BrowserCacheLocation.SessionStorage];
@@ -17372,6 +17596,13 @@
         getConfig() {
             return this.config;
         }
+        /**
+         * Returns the internal response handlers supplied by PublicClientApplication, if any.
+         * @returns AuthResponseHandlers | undefined
+         */
+        getResponseHandlers() {
+            return this.responseHandlers;
+        }
         /**
          * Returns the MSAL Logger
          * @returns Logger
@@ -18393,7 +18624,48 @@
         constructor(configuration, controller) {
             this.controller =
                 controller ||
-                    new StandardController(new StandardOperatingContext(configuration));
+                    new StandardController(new StandardOperatingContext(configuration, {
+                        waitForPopupResponse: this.waitForPopupResponse.bind(this),
+                        waitForIframeResponse: this.waitForIframeResponse.bind(this),
+                    }));
+        }
+        /**
+         * Waits for the auth response from a popup window opened by MSAL.
+         *
+         * The default implementation delegates to MSAL's `BroadcastChannel`-based bridge.
+         * Subclasses must return the raw response string (hash/query/fragment), or reject
+         * with an `AuthError` on failure.
+         *
+         * @internal
+         * @param request The in-flight authorization or end-session request.
+         * @param popupWindow The popup window opened by MSAL.
+         * @param popupWindowParent The parent window that opened the popup.
+         */
+        async waitForPopupResponse(request,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        popupWindow,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        popupWindowParent) {
+            const controller = this.controller;
+            return waitForBridgeResponse(controller.getConfiguration().system.popupBridgeTimeout, controller.getLogger(), request, controller.getPerformanceClient());
+        }
+        /**
+         * Waits for the auth response from a hidden iframe used by MSAL silent flows.
+         *
+         * The default implementation delegates to MSAL's `BroadcastChannel`-based bridge.
+         * Subclasses must return the raw response string (hash/query/fragment), or reject
+         * with an `AuthError` on failure.
+         *
+         * @internal
+         * @param iframe The hidden iframe MSAL attached to the document.
+         * @param request The in-flight authorization request.
+         */
+        async waitForIframeResponse(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        iframe, request) {
+            const controller = this.controller;
+            const config = controller.getConfiguration();
+            return waitForBridgeResponse(config.system.iframeBridgeTimeout, controller.getLogger(), request, controller.getPerformanceClient(), config.experimental);
         }
         /**
          * Initializer function to perform async startup tasks such as connecting to WAM extension