@azure/msal-browser 5.11.0 → 5.13.0

package/lib/custom-auth-path/msal-custom-auth.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.11.0 2026-05-19 */
+/*! @azure/msal-browser v5.13.0 2026-06-10 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -229,7 +229,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -281,7 +281,7 @@ const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -312,7 +312,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -332,7 +332,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -412,7 +412,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -435,7 +435,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -461,7 +461,7 @@ const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
 const issuerValidationFailed = "issuer_validation_failed";
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -500,7 +500,7 @@ const methodNotImplemented = "method_not_implemented";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -695,7 +695,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1044,8 +1044,14 @@ function addSshJwk(parameters, sshJwkString) {
  * @param serverTelemetryManager
  */
 function addServerTelemetry(parameters, serverTelemetryManager) {
-    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+    const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
+    const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
+    if (currentTelemetryHeader) {
+        parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
+    }
+    if (lastTelemetryHeader) {
+        parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
+    }
 }
 /**
  * Adds parameter that indicates to the server that throttling is supported
@@ -1084,34 +1090,12 @@ function addResource(parameters, resource) {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-/**
- * Canonicalizes a URL by making it lowercase and ensuring it ends with /
- * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
- * @param url - URL to canonicalize
- * @returns Canonicalized URL
- */
-function canonicalizeUrl(url) {
-    if (!url) {
-        return url;
-    }
-    let lowerCaseUrl = url.toLowerCase();
-    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
-    }
-    else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
-    }
-    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
-        lowerCaseUrl += "/";
-    }
-    return lowerCaseUrl;
-}
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -1164,36 +1148,71 @@ function mapToQueryString(parameters) {
     return queryParameterArray.join("&");
 }
 /**
- * Normalizes URLs for comparison by removing hash, canonicalizing,
- * and ensuring consistent URL encoding in query parameters.
- * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * Normalizes URLs for comparison per MDN & RFC 3986 standards:
+ * - Hash/fragment is removed
+ * - Scheme and host are lowercased (case-insensitive per spec)
+ * - Path and query parameters preserve original casing (case-sensitive per spec)
+ * - Percent-encoding in pathname is normalized (e.g., %27 and ' are treated equivalently)
+ * - Ensures pathname ends with /
+ * Throws a urlParseError if the provided URL is malformed and cannot be parsed.
  * @param url - URL to normalize
+ * @param logger - Optional logger used to log parse failures
+ * @param correlationId - Optional correlationId associated with the log entry
  * @returns Normalized URL string for comparison
  */
-function normalizeUrlForComparison(url) {
+function normalizeUrlForComparison(url, logger, correlationId) {
     if (!url) {
         return url;
     }
-    // Remove hash first
     const urlWithoutHash = url.split("#")[0];
+    if (!urlWithoutHash) {
+        return urlWithoutHash;
+    }
     try {
-        // Parse the URL to handle encoding consistently
         const urlObj = new URL(urlWithoutHash);
-        /*
-         * Reconstruct the URL with properly decoded query parameters
-         * This ensures that %27 and ' are treated as equivalent
-         */
-        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
-        // Apply canonicalization logic inline to avoid circular dependency
-        return canonicalizeUrl(normalizedUrl);
+        // Treat an empty query string (a bare trailing "?") as equivalent to no query
+        if (!urlObj.search) {
+            urlObj.search = "";
+        }
+        // Decode the pathname to normalize percent-encoding and ensure trailing slash
+        let pathname;
+        try {
+            pathname = decodeURIComponent(urlObj.pathname);
+        }
+        catch (e) {
+            pathname = urlObj.pathname;
+        }
+        if (!pathname.endsWith("/")) {
+            pathname += "/";
+        }
+        urlObj.pathname = pathname;
+        return urlObj.href;
+    }
+    catch (e) {
+        logger?.error("15apdm", correlationId || "");
+        throw createClientConfigurationError(urlParseError);
+    }
+}
+/**
+ * Validates that the provided value is a well-formed, parseable absolute URL.
+ * Throws a urlParseError if the value cannot be parsed by the URL API (e.g. the
+ * literal string "null", an empty string, or any malformed/relative URL). Use this
+ * to guard against persisting an invalid value (such as a redirect URL) to the cache.
+ * @param url - URL to validate
+ * @param logger - Optional logger used to log validation failures
+ * @param correlationId - Optional correlationId associated with the log entry
+ */
+function validateUrl(url, logger, correlationId) {
+    try {
+        new URL(url);
     }
     catch (e) {
-        // Fallback to original logic if URL parsing fails
-        return canonicalizeUrl(urlWithoutHash);
+        logger?.error("1lrjz7", correlationId || "");
+        throw createClientConfigurationError(urlParseError);
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1232,7 +1251,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1280,7 +1299,7 @@ function addLogToCache(correlationId, loggedMessage) {
         // Remove LRU (first entry) if capacity exceeded
         if (correlationCache.size > CACHE_CAPACITY) {
             const firstKey = correlationCache.keys().next().value;
-            if (firstKey) {
+            if (firstKey !== undefined) {
                 correlationCache.delete(firstKey);
             }
         }
@@ -1493,12 +1512,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.6.2";
+const version$1 = "16.8.0";
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1507,7 +1526,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1590,7 +1609,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1670,7 +1689,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1827,7 +1846,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1993,7 +2012,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2001,7 +2020,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2039,7 +2058,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2077,7 +2096,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2092,7 +2111,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2114,7 +2133,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2138,7 +2157,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2313,7 +2332,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2453,8 +2472,8 @@ class CacheManager {
             return false;
         }
         if (!!tenantProfileFilter.username &&
-            !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
-                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+            !this.matchUsername(tenantProfile.username, tenantProfileFilter.username) &&
+            !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username)) {
             return false;
         }
         if (!!tenantProfileFilter.loginHint &&
@@ -3444,7 +3463,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3458,7 +3477,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3513,7 +3532,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3608,7 +3627,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3635,7 +3654,7 @@ function isOidcProtocolMode(config) {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3700,7 +3719,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3959,7 +3978,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4030,7 +4049,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4123,7 +4142,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4203,7 +4222,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4227,7 +4246,7 @@ const refreshTokenExpired = "refresh_token_expired";
  * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
  * @public
  */
-const uxNotAllowed = "ux_not_allowed";
+const uiNotAllowed = "ui_not_allowed";
 /**
  * Server-originated error code indicating interaction is required to complete the request.
  * @public
@@ -4254,7 +4273,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4268,7 +4287,7 @@ const InteractionRequiredServerErrorMessage = [
     consentRequired,
     loginRequired,
     badToken,
-    uxNotAllowed,
+    uiNotAllowed,
     interruptedUser,
 ];
 const InteractionRequiredAuthSubErrorMessage = [
@@ -4278,7 +4297,7 @@ const InteractionRequiredAuthSubErrorMessage = [
     "user_password_expired",
     "consent_required",
     "bad_token",
-    "ux_not_allowed",
+    "ui_not_allowed",
     "interrupted_user",
 ];
 /**
@@ -4322,7 +4341,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4341,7 +4360,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4409,7 +4428,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4757,7 +4776,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4767,7 +4786,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4785,7 +4804,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4806,7 +4825,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4892,7 +4911,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4923,7 +4942,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5037,7 +5056,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5049,7 +5068,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5059,7 +5078,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5069,7 +5088,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5174,7 +5193,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5731,7 +5750,7 @@ class Authority {
             }
         }
         // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
-        if (this.isInKnownAuthorities()) {
+        if (this.isInKnownAuthorities(this.hostnameAndPort)) {
             this.logger.verbose("0mt9al", this.correlationId);
             return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
         }
@@ -5798,13 +5817,14 @@ class Authority {
         return match;
     }
     /**
-     * Helper function to determine if this host is included in the knownAuthorities config option
+     * Helper function to determine if a host is included in the knownAuthorities config option.
      */
-    isInKnownAuthorities() {
+    isInKnownAuthorities(host) {
+        const normalizedHost = host.toLowerCase();
         const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
             return (authority &&
                 UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                    this.hostnameAndPort);
+                    normalizedHost);
         });
         return matches.length > 0;
     }
@@ -5881,6 +5901,10 @@ class Authority {
      *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
      *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
      *     path.
+     *  5. The issuer host is HTTPS and is explicitly listed in the
+     *     developer-configured `knownAuthorities`. This covers scenarios where
+     *     the OIDC discovery document returns an issuer host that differs from
+     *     the authority (e.g., a GUID-based issuer for a name-based CIAM authority).
      *
      * @param issuer The `issuer` value returned in the OIDC discovery document.
      * @throws ClientConfigurationError("issuer_validation_failed") on failure.
@@ -5917,11 +5941,19 @@ class Authority {
          * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
          */
         const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+        /*
+         * Rule 5: The issuer host is explicitly listed in the developer-configured
+         * knownAuthorities. This covers scenarios where the OIDC discovery document
+         * returns an issuer with a different host than the authority
+         * (e.g., a GUID-based issuer for a name-based authority).
+         */
+        const matchesKnownAuthority = issuerScheme === "https:" && this.isInKnownAuthorities(issuerHost);
         // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
         if (matchesAuthorityOrigin ||
             matchesKnownMicrosoftHost ||
             matchesRegionalMicrosoftHost ||
-            matchesCiamTenantPattern) {
+            matchesCiamTenantPattern ||
+            matchesKnownAuthority) {
             return;
         }
         // issuer validation fails if none of the above rules are satisfied
@@ -6129,7 +6161,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6163,7 +6195,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6420,7 +6452,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6641,7 +6673,7 @@ class RefreshTokenClient {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6757,7 +6789,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6772,7 +6804,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6995,7 +7027,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7028,7 +7060,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7038,7 +7070,7 @@ function containsResourceParam(params) {
  */
 const unexpectedError = "unexpected_error";
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7149,35 +7181,40 @@ class ServerTelemetryManager {
      * @param error
      */
     cacheFailedRequest(error) {
-        const lastRequests = this.getLastRequests();
-        if (lastRequests.errors.length >=
-            SERVER_TELEM_MAX_CACHED_ERRORS) {
-            // Remove a cached error to make room, first in first out
-            lastRequests.failedRequests.shift(); // apiId
-            lastRequests.failedRequests.shift(); // correlationId
-            lastRequests.errors.shift();
-        }
-        lastRequests.failedRequests.push(this.apiId, this.correlationId);
-        if (error instanceof Error && !!error && error.toString()) {
-            if (error instanceof AuthError) {
-                if (error.subError) {
-                    lastRequests.errors.push(error.subError);
-                }
-                else if (error.errorCode) {
-                    lastRequests.errors.push(error.errorCode);
+        try {
+            const lastRequests = this.getLastRequests();
+            if (lastRequests.errors.length >=
+                SERVER_TELEM_MAX_CACHED_ERRORS) {
+                // Remove a cached error to make room, first in first out
+                lastRequests.failedRequests.shift(); // apiId
+                lastRequests.failedRequests.shift(); // correlationId
+                lastRequests.errors.shift();
+            }
+            lastRequests.failedRequests.push(this.apiId, this.correlationId);
+            if (error instanceof Error && !!error && error.toString()) {
+                if (error instanceof AuthError) {
+                    if (error.subError) {
+                        lastRequests.errors.push(error.subError);
+                    }
+                    else if (error.errorCode) {
+                        lastRequests.errors.push(error.errorCode);
+                    }
+                    else {
+                        lastRequests.errors.push(error.toString());
+                    }
                 }
                 else {
                     lastRequests.errors.push(error.toString());
                 }
             }
             else {
-                lastRequests.errors.push(error.toString());
+                lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
             }
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         }
-        else {
-            lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
+        catch {
+            // Ignore telemetry cache failures to avoid masking the original auth error path.
         }
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return;
     }
     /**
@@ -7297,9 +7334,36 @@ class ServerTelemetryManager {
     static makeExtraSkuString(params) {
         return makeExtraSkuString(params);
     }
+}
+/** @internal */
+class StubServerTelemetryManager extends ServerTelemetryManager {
+    constructor() {
+        super({ clientId: "", apiId: 0, correlationId: "", forceRefresh: false }, {});
+    }
+    generateCurrentRequestHeaderValue() {
+        return "";
+    }
+    generateLastRequestHeaderValue() {
+        return "";
+    }
+    cacheFailedRequest() { }
+    incrementCacheHits() {
+        return 0;
+    }
+    clearTelemetryCache() { }
+    getRegionDiscoveryFields() {
+        return "";
+    }
+    updateRegionDiscoveryMetadata() { }
+    setCacheOutcome() { }
+    setNativeBrokerErrorCode() { }
+    getNativeBrokerErrorCode() {
+        return undefined;
+    }
+    clearNativeBrokerErrorCode() { }
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7320,7 +7384,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7328,7 +7392,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7763,7 +7827,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.11.0";
+const version = "5.13.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8356,7 +8420,6 @@ const SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
  */
 const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
 const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
-const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
 /**
  * Helper functions in StandardInteractionClient class (msal-browser)
  */
@@ -8657,6 +8720,43 @@ function createBrowserAuthError(errorCode, subError) {
     return new BrowserAuthError(errorCode, subError);
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
+ * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
+ */
+/**
+ * Returns a URL-safe plaintext decoded string from b64 encoded input.
+ * @param input
+ */
+function base64Decode(input) {
+    return new TextDecoder().decode(base64DecToArr(input));
+}
+/**
+ * Decodes base64 into Uint8Array
+ * @param base64String
+ */
+function base64DecToArr(base64String) {
+    let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
+    switch (encodedString.length % 4) {
+        case 0:
+            break;
+        case 2:
+            encodedString += "==";
+            break;
+        case 3:
+            encodedString += "=";
+            break;
+        default:
+            throw createBrowserAuthError(invalidBase64String);
+    }
+    const binString = atob(encodedString);
+    return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8701,43 +8801,6 @@ function base64EncArr(aBytes) {
     return btoa(binString);
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
- * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
- */
-/**
- * Returns a URL-safe plaintext decoded string from b64 encoded input.
- * @param input
- */
-function base64Decode(input) {
-    return new TextDecoder().decode(base64DecToArr(input));
-}
-/**
- * Decodes base64 into Uint8Array
- * @param base64String
- */
-function base64DecToArr(base64String) {
-    let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
-    switch (encodedString.length % 4) {
-        case 0:
-            break;
-        case 2:
-            encodedString += "==";
-            break;
-        case 3:
-            encodedString += "=";
-            break;
-        default:
-            throw createBrowserAuthError(invalidBase64String);
-    }
-    const binString = atob(encodedString);
-    return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -9206,7 +9269,7 @@ function cancelPendingBridgeResponse(logger, correlationId) {
         activeBridgeMonitor = null;
     }
 }
-async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient, experimentalConfig) {
+async function waitForBridgeResponse(timeoutMs, logger, request, performanceClient, experimentalConfig) {
     return new Promise((resolve, reject) => {
         logger.verbose("1rf6em", request.correlationId);
         const correlationId = request.correlationId;
@@ -9214,7 +9277,7 @@ async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request,
             redirectBridgeTimeoutMs: timeoutMs,
             lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false,
         }, correlationId);
-        const { libraryState } = parseRequestState(browserCrypto.base64Decode, request.state || "");
+        const { libraryState } = parseRequestState(base64Decode, request.state || "");
         const channel = new BroadcastChannel(libraryState.id);
         let responseString = undefined;
         let timedOut$1 = false;
@@ -9431,10 +9494,15 @@ function getRedirectUri(requestRedirectUri, clientConfigRedirectUri, logger, cor
  * @param browserStorage - Browser cache manager instance for storing telemetry data
  * @param logger - Optional logger instance for verbose logging
  * @param forceRefresh - Optional flag to force refresh of telemetry data
+ * @param enabled - Optional flag to enable or disable server telemetry (default: true for custom_auth flows, false for standard flows)
  * @returns Configured ServerTelemetryManager instance
  */
-function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh) {
+function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh, enabled = true) {
     logger.verbose("1p12tq", correlationId);
+    if (!enabled) {
+        logger.verbose("0tajnr", correlationId);
+        return new StubServerTelemetryManager();
+    }
     const telemetryPayload = {
         clientId: clientId,
         correlationId: correlationId,
@@ -14994,6 +15062,15 @@ function removeElementFromArray(array, element) {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Reason an old-schema cache entry was removed during migration.
+ */
+const MigrationRemovalReason = {
+    Invalid: "invalid",
+    TtlExpired: "ttlExpired",
+    DecryptFailed: "decryptFailed",
+    Expired: "expired",
+};
 /**
  * This class implements the cache storage interface for MSAL through browser local or session storage.
  */
@@ -15063,7 +15140,10 @@ class BrowserCacheManager extends CacheManager {
         const parsedValue = this.validateAndParseJson(rawValue || "");
         if (!parsedValue) {
             this.browserStorage.removeItem(key);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Invalid,
+            };
         }
         if (!parsedValue.lastUpdatedAt) {
             // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
@@ -15072,25 +15152,42 @@ class BrowserCacheManager extends CacheManager {
         }
         else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
             this.browserStorage.removeItem(key);
-            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.TtlExpired,
+            };
         }
-        const decryptedData = isEncrypted(parsedValue)
+        const wasEncrypted = isEncrypted(parsedValue);
+        const decryptedData = wasEncrypted
             ? await this.browserStorage.decryptData(key, parsedValue, correlationId)
             : parsedValue;
-        if (!decryptedData || !isCredentialEntity(decryptedData)) {
-            this.performanceClient.incrementFields({ invalidCacheCount: 1 }, correlationId);
-            return null;
+        if (!decryptedData) {
+            this.browserStorage.removeItem(key);
+            return {
+                entry: null,
+                removalReason: wasEncrypted
+                    ? MigrationRemovalReason.DecryptFailed
+                    : MigrationRemovalReason.Invalid,
+            };
+        }
+        if (!isCredentialEntity(decryptedData)) {
+            this.browserStorage.removeItem(key);
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Invalid,
+            };
         }
         if ((isAccessTokenEntity(decryptedData) ||
             isRefreshTokenEntity(decryptedData)) &&
             decryptedData.expiresOn &&
             isTokenExpired(decryptedData.expiresOn, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
             this.browserStorage.removeItem(key);
-            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Expired,
+            };
         }
-        return decryptedData;
+        return { entry: decryptedData };
     }
     /**
      * Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
@@ -15109,6 +15206,8 @@ class BrowserCacheManager extends CacheManager {
             const rawValue = this.browserStorage.getItem(accountKey);
             const parsedValue = this.validateAndParseJson(rawValue || "");
             if (!parsedValue) {
+                this.browserStorage.removeItem(accountKey);
+                this.performanceClient.incrementFields({ invalidAcntCount: 1 }, correlationId);
                 removeElementFromArray(accountKeysToCheck, accountKey);
                 continue;
             }
@@ -15121,8 +15220,20 @@ class BrowserCacheManager extends CacheManager {
             else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
                 // Cache expired remove account and associated tokens
                 await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
+                this.performanceClient.incrementFields({ ttlExpiredAcntCount: 1 }, correlationId);
                 removeElementFromArray(accountKeysToCheck, accountKey);
             }
+            else if (isEncrypted(parsedValue)) {
+                // Remove accounts encrypted with a different key (session cookie expired/changed)
+                const decrypted = await this.browserStorage.decryptData(accountKey, parsedValue, correlationId);
+                if (!decrypted) {
+                    this.browserStorage.removeItem(accountKey);
+                    this.performanceClient.incrementFields({
+                        decryptFailedAcntCount: 1,
+                    }, correlationId);
+                    removeElementFromArray(accountKeysToCheck, accountKey);
+                }
+            }
         }
         this.setAccountKeys(accountKeysToCheck, correlationId, accountSchema);
     }
@@ -15160,7 +15271,6 @@ class BrowserCacheManager extends CacheManager {
             });
             this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
         }
-        this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
         this.browserStorage.removeItem(accountKey);
     }
     /**
@@ -15199,8 +15309,20 @@ class BrowserCacheManager extends CacheManager {
         const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
         for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
             this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
-            const oldSchemaData = (await this.updateOldEntry(idTokenKey, correlationId));
+            const result = await this.updateOldEntry(idTokenKey, correlationId);
+            const oldSchemaData = result.entry;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields({ ttlExpiredITCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields({ decryptFailedITCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields({ invalidITCount: 1 }, correlationId);
+                        break;
+                }
                 removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
                 continue;
             }
@@ -15279,8 +15401,23 @@ class BrowserCacheManager extends CacheManager {
         const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
         for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
             this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
-            const oldSchemaData = (await this.updateOldEntry(accessTokenKey, correlationId));
+            const result = await this.updateOldEntry(accessTokenKey, correlationId);
+            const oldSchemaData = result.entry;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields({ ttlExpiredATCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields({ decryptFailedATCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Expired:
+                        this.performanceClient.incrementFields({ expiredATCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields({ invalidATCount: 1 }, correlationId);
+                        break;
+                }
                 removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
                 continue;
             }
@@ -15326,8 +15463,23 @@ class BrowserCacheManager extends CacheManager {
             ...credentialKeysToMigrate.refreshToken,
         ]) {
             this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
-            const oldSchemaData = (await this.updateOldEntry(refreshTokenKey, correlationId));
+            const result = await this.updateOldEntry(refreshTokenKey, correlationId);
+            const oldSchemaData = result.entry;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields({ ttlExpiredRTCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields({ decryptFailedRTCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Expired:
+                        this.performanceClient.incrementFields({ expiredRTCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields({ invalidRTCount: 1 }, correlationId);
+                        break;
+                }
                 removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
                 continue;
             }
@@ -16652,7 +16804,7 @@ const USER_CANCEL = "USER_CANCEL";
 const NO_NETWORK = "NO_NETWORK";
 const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
-const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
+const UI_NOT_ALLOWED = "UI_NOT_ALLOWED";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16707,8 +16859,8 @@ function createNativeAuthError(code, description, ext) {
                 return createBrowserAuthError(userCancelled);
             case NO_NETWORK:
                 return createBrowserAuthError(noNetworkConnectivity);
-            case UX_NOT_ALLOWED:
-                return createInteractionRequiredAuthError(uxNotAllowed);
+            case UI_NOT_ALLOWED:
+                return createInteractionRequiredAuthError(uiNotAllowed);
         }
     }
     return new NativeAuthError(code, description, ext);
@@ -16725,7 +16877,7 @@ class SilentCacheClient extends StandardInteractionClient {
      */
     async acquireToken(silentRequest) {
         // Telemetry manager only used to increment cacheHits here
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
             serverTelemetryManager,
             requestAuthority: silentRequest.authority,
@@ -16801,7 +16953,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // start the perf measurement
         const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
         const reqTimestamp = nowSeconds();
-        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // initialize native request
             const nativeRequest = await this.initializePlatformRequest(request);
@@ -16925,7 +17077,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         catch (e) {
             // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
             if (e instanceof NativeAuthError) {
-                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                 if (isFatalNativeAuthError(e)) {
                     throw e;
@@ -16939,7 +17091,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             noHistory: false,
         };
         const redirectUri = navigateToLoginRequestUrl
-            ? window.location.href
+            ? UrlString.getAbsoluteUrl(request.redirectStartPage || window.location.href, getCurrentUri())
             : getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
         rootMeasurement.end({ success: true });
         await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
@@ -16972,7 +17124,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             this.logger.verbose("003x5a", this.correlationId);
             const response = await this.platformAuthProvider.sendMessage(request);
             const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
-            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             serverTelemetryManager.clearNativeBrokerErrorCode();
             this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
             return authResult;
@@ -17979,6 +18131,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
         protocolMode: ProtocolMode.AAD,
+        serverTelemetryEnabled: false,
     };
     const providedSystemOptions = {
         ...DEFAULT_BROWSER_SYSTEM_OPTIONS,
@@ -18508,10 +18661,11 @@ function isPlatformAuthAllowed(config, logger, correlationId, platformAuthProvid
  * Licensed under the MIT License.
  */
 class PopupClient extends StandardInteractionClient {
-    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, correlationId, platformAuthHandler) {
+    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, correlationId, platformAuthHandler, waitForPopupResponseHook) {
         super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthHandler);
         this.nativeStorage = nativeStorageImpl;
         this.eventHandler = eventHandler;
+        this.waitForPopupResponseHook = waitForPopupResponseHook;
     }
     /**
      * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
@@ -18619,7 +18773,7 @@ class PopupClient extends StandardInteractionClient {
      */
     async executeCodeFlow(request, popupParams, pkceCodes) {
         const correlationId = request.correlationId;
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const pkce = pkceCodes ||
             (await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId));
         const popupRequest = {
@@ -18645,7 +18799,7 @@ class PopupClient extends StandardInteractionClient {
                 const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, correlationId, InteractionType.Popup, { popupWindow }, null);
                 // Wait for the redirect bridge response
-                const responseString = await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+                const responseString = await this.waitForPopupResponse(request, popupWindow, popupParams.popupWindowParent);
                 const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
                 return await invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
             }
@@ -18680,11 +18834,11 @@ class PopupClient extends StandardInteractionClient {
         const form = await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, popupRequest, this.performanceClient);
+        const responseString = await invokeAsync(this.waitForPopupResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupRequest, popupWindow, popupParams.popupWindowParent);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
                 requestExtraQueryParameters: request.extraQueryParameters,
@@ -18705,7 +18859,7 @@ class PopupClient extends StandardInteractionClient {
         const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
         form.submit();
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient);
+        const responseString = await invokeAsync(this.waitForPopupResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(request, popupWindow, popupParams.popupWindowParent);
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
@@ -18721,7 +18875,7 @@ class PopupClient extends StandardInteractionClient {
     async logoutPopupAsync(validRequest, popupParams, requestAuthority, mainWindowRedirectUri) {
         this.logger.verbose("0b7yrk", this.correlationId);
         this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, InteractionType.Popup, validRequest);
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // Clear cache on logout
             await clearCacheOnLogout(this.browserStorage, this.browserCrypto, this.logger, this.correlationId, validRequest.account);
@@ -18762,7 +18916,7 @@ class PopupClient extends StandardInteractionClient {
             // Open the popup window to requestUrl.
             const popupWindow = this.openPopup(logoutUri, popupParams);
             this.eventHandler.emitEvent(EventType.POPUP_OPENED, validRequest.correlationId, InteractionType.Popup, { popupWindow }, null);
-            await waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, this.browserCrypto, validRequest, this.performanceClient).catch(() => {
+            await this.waitForPopupResponse(validRequest, popupWindow, popupParams.popupWindowParent).catch(() => {
                 // Swallow any errors related to monitoring the window. Server logout is best effort
             });
             if (mainWindowRedirectUri) {
@@ -18841,6 +18995,19 @@ class PopupClient extends StandardInteractionClient {
             if (!popupWindow) {
                 throw createBrowserAuthError(emptyWindowError);
             }
+            try {
+                popupWindow.document.title = "Microsoft Authentication";
+            }
+            catch (e) {
+                if (typeof DOMException !== "undefined" &&
+                    e instanceof DOMException &&
+                    e.name === "SecurityError") {
+                    // Cross-origin - title cannot be set
+                }
+                else {
+                    this.logger.verbose("1s1yfs", this.correlationId);
+                }
+            }
             if (popupWindow.focus) {
                 popupWindow.focus();
             }
@@ -18919,6 +19086,12 @@ class PopupClient extends StandardInteractionClient {
         const homeAccountId = request.account && request.account.homeAccountId;
         return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
     }
+    async waitForPopupResponse(request, popupWindow, popupWindowParent) {
+        if (this.waitForPopupResponseHook) {
+            return this.waitForPopupResponseHook(request, popupWindow, popupWindowParent);
+        }
+        return waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, request, this.performanceClient);
+    }
 }
 
 /*
@@ -18986,7 +19159,7 @@ class RedirectClient extends StandardInteractionClient {
      */
     async executeCodeFlow(request) {
         const correlationId = request.correlationId;
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
         const redirectRequest = {
             ...request,
@@ -19072,7 +19245,9 @@ class RedirectClient extends StandardInteractionClient {
      * @param options {HandleRedirectPromiseOptions} options for handling redirect promise
      */
     async handleRedirectPromise(request, pkceVerifier, parentMeasurement, options) {
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const originalTitle = document.title;
+        document.title = "Microsoft Authentication";
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
         try {
             const [serverParams, responseString] = this.getRedirectResponse(options?.hash || "");
@@ -19091,8 +19266,8 @@ class RedirectClient extends StandardInteractionClient {
             }
             // If navigateToLoginRequestUrl is true, get the url where the redirect request was initiated
             const loginRequestUrl = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, this.correlationId, true) || "";
-            const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl);
-            const currentUrlNormalized = normalizeUrlForComparison(window.location.href);
+            const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl, this.logger, this.correlationId);
+            const currentUrlNormalized = normalizeUrlForComparison(window.location.href, this.logger, this.correlationId);
             if (loginRequestUrlNormalized === currentUrlNormalized &&
                 navigateToLoginRequestUrl) {
                 // We are on the page we need to navigate to - handle hash
@@ -19125,8 +19300,8 @@ class RedirectClient extends StandardInteractionClient {
                  * The start page is expected to also call handleRedirectPromise which will process the hash in one of the checks above.
                  */
                 let processHashOnRedirect = true;
-                if (!loginRequestUrl || loginRequestUrl === "null") {
-                    // Redirect to home page if login request url is null (real null or the string null)
+                if (!loginRequestUrl) {
+                    // Redirect to home page if login request url is empty
                     const homepage = getHomepage();
                     // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                     this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, homepage, true);
@@ -19154,6 +19329,9 @@ class RedirectClient extends StandardInteractionClient {
             }
             throw e;
         }
+        finally {
+            document.title = originalTitle;
+        }
     }
     /**
      * Gets the response hash for a redirect request
@@ -19269,7 +19447,7 @@ class RedirectClient extends StandardInteractionClient {
     async logout(logoutRequest) {
         this.logger.verbose("1rkurh", this.correlationId);
         const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, InteractionType.Redirect, logoutRequest);
             // Clear cache on logout
@@ -19350,7 +19528,10 @@ class RedirectClient extends StandardInteractionClient {
      */
     getRedirectStartPage(requestStartPage) {
         const redirectStartPage = requestStartPage || window.location.href;
-        return UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+        const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+        // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
+        validateUrl(absoluteRedirectStartPage, this.logger, this.correlationId);
+        return absoluteRedirectStartPage;
     }
 }
 
@@ -19359,20 +19540,20 @@ class RedirectClient extends StandardInteractionClient {
  * Licensed under the MIT License.
  */
 /**
- * Creates a hidden iframe to given URL using user-requested scopes as an id.
- * @param urlNavigate
- * @param userRequestScopes
+ * Navigates the given hidden iframe to the provided URL.
+ * @param frame
+ * @param requestUrl
  */
-async function initiateCodeRequest(requestUrl, performanceClient, logger, correlationId) {
+async function initiateCodeRequest(frame, requestUrl, logger, correlationId) {
     if (!requestUrl) {
         // Throw error if request URL is empty.
         logger.info("1l7hyp", correlationId);
         throw createBrowserAuthError(emptyNavigateUri);
     }
-    return invoke(loadFrameSync, SilentHandlerLoadFrameSync, logger, performanceClient, correlationId)(requestUrl);
+    frame.src = requestUrl;
+    return frame;
 }
-async function initiateCodeFlowWithPost(config, authority, request, logger, performanceClient) {
-    const frame = createHiddenIframe();
+async function initiateCodeFlowWithPost(frame, config, authority, request, logger, performanceClient) {
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -19380,8 +19561,7 @@ async function initiateCodeFlowWithPost(config, authority, request, logger, perf
     form.submit();
     return frame;
 }
-async function initiateEarRequest(config, authority, request, logger, performanceClient) {
-    const frame = createHiddenIframe();
+async function initiateEarRequest(frame, config, authority, request, logger, performanceClient) {
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -19391,24 +19571,14 @@ async function initiateEarRequest(config, authority, request, logger, performanc
 }
 /**
  * @hidden
- * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
- * @param urlNavigate
- * @param frameName
- * @param logger
- */
-function loadFrameSync(urlNavigate) {
-    const frameHandle = createHiddenIframe();
-    frameHandle.src = urlNavigate;
-    return frameHandle;
-}
-/**
- * @hidden
- * Creates a new hidden iframe or gets an existing one for silent token renewal.
+ * Creates a new hidden iframe for silent token renewal. Callers navigate it
+ * (set `src` or submit a form) after registering the response listener.
  * @ignore
  */
 function createHiddenIframe() {
     const authFrame = document.createElement("iframe");
     authFrame.className = "msalSilentIframe";
+    authFrame.title = "Microsoft Authentication";
     authFrame.style.visibility = "hidden";
     authFrame.style.position = "absolute";
     authFrame.style.width = authFrame.style.height = "0";
@@ -19434,10 +19604,11 @@ function removeHiddenIframe(iframe) {
  * Licensed under the MIT License.
  */
 class SilentIframeClient extends StandardInteractionClient {
-    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, correlationId, platformAuthProvider) {
+    constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, correlationId, platformAuthProvider, waitForIframeResponseHook) {
         super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthProvider);
         this.apiId = apiId;
         this.nativeStorage = nativeStorageImpl;
+        this.waitForIframeResponseHook = waitForIframeResponseHook;
     }
     /**
      * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none or prompt=no_session
@@ -19480,7 +19651,7 @@ class SilentIframeClient extends StandardInteractionClient {
      */
     async executeCodeFlow(request) {
         let authClient;
-        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // Initialize the client
             authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
@@ -19522,11 +19693,22 @@ class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        const iframe = await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
         const responseType = this.config.auth.OIDCOptions.responseMode;
         let responseString;
         try {
-            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+            const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If navigation below throws before responsePromise is awaited,
+                 * the listener still rejects on timeout. Swallow it here so it
+                 * does not surface as an unhandled rejection; the navigation
+                 * error is propagated instead.
+                 */
+            });
+            await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+            responseString = await responsePromise;
         }
         finally {
             invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -19535,7 +19717,7 @@ class SilentIframeClient extends StandardInteractionClient {
         if (!serverParams.ear_jwe && serverParams.code) {
             // If server doesn't support EAR, they may fallback to auth code flow instead
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
                 requestExtraQueryParameters: request.extraQueryParameters,
@@ -19562,7 +19744,7 @@ class SilentIframeClient extends StandardInteractionClient {
         // Create silent request
         const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
         const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
-            serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger),
+            serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
             requestAuthority: silentRequest.authority,
             requestAzureCloudOptions: silentRequest.azureCloudOptions,
             requestExtraQueryParameters: silentRequest.extraQueryParameters,
@@ -19610,21 +19792,32 @@ class SilentIframeClient extends StandardInteractionClient {
             ...request,
             codeChallenge: pkceCodes.challenge,
         };
-        let iframe;
-        if (request.httpMethod === HttpMethod$1.POST) {
-            iframe = await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-        }
-        else {
-            // Create authorize request url
-            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-            // Get the frame handle for the silent request
-            iframe = await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId);
-        }
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
         let responseString;
         try {
-            responseString = await invokeAsync(waitForBridgeResponse, SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(this.config.system.iframeBridgeTimeout, this.logger, this.browserCrypto, request, this.performanceClient, this.config.experimental);
+            const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If URL creation or navigation below throws before
+                 * responsePromise is awaited, the listener still rejects on
+                 * timeout. Swallow it here so it does not surface as an
+                 * unhandled rejection; the navigation error is propagated
+                 * instead.
+                 */
+            });
+            if (request.httpMethod === HttpMethod$1.POST) {
+                await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+            }
+            else {
+                // Create authorize request url
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+                // Navigate the iframe to the authorize request url
+                await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, navigateUrl, this.logger, correlationId);
+            }
+            responseString = await responsePromise;
         }
         finally {
             invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -19632,6 +19825,12 @@ class SilentIframeClient extends StandardInteractionClient {
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
         return { serverParams, pkceCodes, silentRequest };
     }
+    async waitForIframeResponse(iframe, request) {
+        if (this.waitForIframeResponseHook) {
+            return this.waitForIframeResponseHook(iframe, request);
+        }
+        return waitForBridgeResponse(this.config.system.iframeBridgeTimeout, this.logger, request, this.performanceClient, this.config.experimental);
+    }
 }
 
 /*
@@ -19653,7 +19852,7 @@ class SilentRefreshClient extends StandardInteractionClient {
             // Make sure any passed redirectUri is converted to an absolute URL - redirectUri is not a required parameter for refresh token redemption so only include if explicitly provided
             silentRequest.redirectUri = getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
         }
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const refreshTokenClient = await this.createRefreshTokenClient({
             serverTelemetryManager,
             authorityUrl: silentRequest.authority,
@@ -19733,7 +19932,7 @@ class SilentAuthCodeClient extends StandardInteractionClient {
          * Each auth request creates a new instance of *Client so we can safely use this.correlationId.
          */
         this.correlationId);
-        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // Create auth code request (PKCE not needed)
             const authCodeRequest = {
@@ -20086,6 +20285,8 @@ class StandardController {
         // Preflight request
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.verbose("0os66p", correlationId);
+        redirectPreflightCheck(this.initialized, this.config);
+        this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
         const atrMeasurement = this.performanceClient.startMeasurement(AcquireTokenPreRedirect, correlationId);
         atrMeasurement.add({
             scenarioId: request.scenarioId,
@@ -20103,9 +20304,7 @@ class StandardController {
             return navigate;
         };
         try {
-            redirectPreflightCheck(this.initialized, this.config);
             enforceResourceParameter(this.config.auth.isMcp, request);
-            this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Redirect, request);
             let result;
             if (this.platformAuthProvider &&
@@ -20833,7 +21032,7 @@ class StandardController {
      * @param correlationId
      */
     createPopupClient(correlationId) {
-        return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider);
+        return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider, this.operatingContext.getResponseHandlers()?.waitForPopupResponse);
     }
     /**
      * Returns new instance of the Redirect Interaction Client
@@ -20847,7 +21046,7 @@ class StandardController {
      * @param correlationId
      */
     createSilentIframeClient(correlationId) {
-        return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider);
+        return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider, this.operatingContext.getResponseHandlers()?.waitForIframeResponse);
     }
     /**
      * Returns new instance of the Silent Cache Interaction Client
@@ -21616,7 +21815,7 @@ class BaseOperatingContext {
                 return;
         }
     }
-    constructor(config) {
+    constructor(config, responseHandlers) {
         /*
          * If loaded in an environment where window is not available,
          * set internal flag to false so that further requests fail.
@@ -21624,6 +21823,7 @@ class BaseOperatingContext {
          */
         this.browserEnvironment = typeof window !== "undefined";
         this.config = buildConfiguration(config, this.browserEnvironment);
+        this.responseHandlers = responseHandlers;
         let sessionStorage;
         try {
             sessionStorage = window[BrowserCacheLocation.SessionStorage];
@@ -21660,6 +21860,13 @@ class BaseOperatingContext {
     getConfig() {
         return this.config;
     }
+    /**
+     * Returns the internal response handlers supplied by PublicClientApplication, if any.
+     * @returns AuthResponseHandlers | undefined
+     */
+    getResponseHandlers() {
+        return this.responseHandlers;
+    }
     /**
      * Returns the MSAL Logger
      * @returns Logger
@@ -22024,7 +22231,48 @@ class PublicClientApplication {
     constructor(configuration, controller) {
         this.controller =
             controller ||
-                new StandardController(new StandardOperatingContext(configuration));
+                new StandardController(new StandardOperatingContext(configuration, {
+                    waitForPopupResponse: this.waitForPopupResponse.bind(this),
+                    waitForIframeResponse: this.waitForIframeResponse.bind(this),
+                }));
+    }
+    /**
+     * Waits for the auth response from a popup window opened by MSAL.
+     *
+     * The default implementation delegates to MSAL's `BroadcastChannel`-based bridge.
+     * Subclasses must return the raw response string (hash/query/fragment), or reject
+     * with an `AuthError` on failure.
+     *
+     * @internal
+     * @param request The in-flight authorization or end-session request.
+     * @param popupWindow The popup window opened by MSAL.
+     * @param popupWindowParent The parent window that opened the popup.
+     */
+    async waitForPopupResponse(request, 
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    popupWindow, 
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    popupWindowParent) {
+        const controller = this.controller;
+        return waitForBridgeResponse(controller.getConfiguration().system.popupBridgeTimeout, controller.getLogger(), request, controller.getPerformanceClient());
+    }
+    /**
+     * Waits for the auth response from a hidden iframe used by MSAL silent flows.
+     *
+     * The default implementation delegates to MSAL's `BroadcastChannel`-based bridge.
+     * Subclasses must return the raw response string (hash/query/fragment), or reject
+     * with an `AuthError` on failure.
+     *
+     * @internal
+     * @param iframe The hidden iframe MSAL attached to the document.
+     * @param request The in-flight authorization request.
+     */
+    async waitForIframeResponse(
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    iframe, request) {
+        const controller = this.controller;
+        const config = controller.getConfiguration();
+        return waitForBridgeResponse(config.system.iframeBridgeTimeout, controller.getLogger(), request, controller.getPerformanceClient(), config.experimental);
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension