npm - @azure/msal-browser - Versions diffs - 5.12.0 → 5.13.0 - Mend

@azure/msal-browser 5.12.0 → 5.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (245) hide show

package/lib/custom-auth-path/msal-custom-auth.js CHANGED Viewed

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.12.0 2026-06-05 */
+/*! @azure/msal-browser v5.13.0 2026-06-10 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msalCustomAuth = {}));
 })(this, (function (exports) { 'use strict';
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -233,7 +233,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -285,7 +285,7 @@
     const RESOURCE = "resource";
     const CLI_DATA = "clidata";
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -316,7 +316,7 @@
         return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -336,7 +336,7 @@
         return new ClientConfigurationError(errorCode);
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -416,7 +416,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -439,7 +439,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -465,7 +465,7 @@
     const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
     const issuerValidationFailed = "issuer_validation_failed";
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -504,7 +504,7 @@
     const resourceParameterRequired = "resource_parameter_required";
     const misplacedResourceParam = "misplaced_resource_parameter";
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -699,7 +699,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1048,8 +1048,14 @@
      * @param serverTelemetryManager
      */
     function addServerTelemetry(parameters, serverTelemetryManager) {
-        parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-        parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+        const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
+        const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
+        if (currentTelemetryHeader) {
+            parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
+        }
+        if (lastTelemetryHeader) {
+            parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
+        }
     }
     /**
      * Adds parameter that indicates to the server that throttling is supported
@@ -1088,34 +1094,12 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    /**
-     * Canonicalizes a URL by making it lowercase and ensuring it ends with /
-     * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
-     * @param url - URL to canonicalize
-     * @returns Canonicalized URL
-     */
-    function canonicalizeUrl(url) {
-        if (!url) {
-            return url;
-        }
-        let lowerCaseUrl = url.toLowerCase();
-        if (StringUtils.endsWith(lowerCaseUrl, "?")) {
-            lowerCaseUrl = lowerCaseUrl.slice(0, -1);
-        }
-        else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
-            lowerCaseUrl = lowerCaseUrl.slice(0, -2);
-        }
-        if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
-            lowerCaseUrl += "/";
-        }
-        return lowerCaseUrl;
-    }
     /**
      * Parses hash string from given string. Returns empty string if no hash symbol is found.
      * @param hashString
@@ -1168,36 +1152,71 @@
         return queryParameterArray.join("&");
     }
     /**
-     * Normalizes URLs for comparison by removing hash, canonicalizing,
-     * and ensuring consistent URL encoding in query parameters.
-     * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+     * Normalizes URLs for comparison per MDN & RFC 3986 standards:
+     * - Hash/fragment is removed
+     * - Scheme and host are lowercased (case-insensitive per spec)
+     * - Path and query parameters preserve original casing (case-sensitive per spec)
+     * - Percent-encoding in pathname is normalized (e.g., %27 and ' are treated equivalently)
+     * - Ensures pathname ends with /
+     * Throws a urlParseError if the provided URL is malformed and cannot be parsed.
      * @param url - URL to normalize
+     * @param logger - Optional logger used to log parse failures
+     * @param correlationId - Optional correlationId associated with the log entry
      * @returns Normalized URL string for comparison
      */
-    function normalizeUrlForComparison(url) {
+    function normalizeUrlForComparison(url, logger, correlationId) {
         if (!url) {
             return url;
         }
-        // Remove hash first
         const urlWithoutHash = url.split("#")[0];
+        if (!urlWithoutHash) {
+            return urlWithoutHash;
+        }
         try {
-            // Parse the URL to handle encoding consistently
             const urlObj = new URL(urlWithoutHash);
-            /*
-             * Reconstruct the URL with properly decoded query parameters
-             * This ensures that %27 and ' are treated as equivalent
-             */
-            const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
-            // Apply canonicalization logic inline to avoid circular dependency
-            return canonicalizeUrl(normalizedUrl);
+            // Treat an empty query string (a bare trailing "?") as equivalent to no query
+            if (!urlObj.search) {
+                urlObj.search = "";
+            }
+            // Decode the pathname to normalize percent-encoding and ensure trailing slash
+            let pathname;
+            try {
+                pathname = decodeURIComponent(urlObj.pathname);
+            }
+            catch (e) {
+                pathname = urlObj.pathname;
+            }
+            if (!pathname.endsWith("/")) {
+                pathname += "/";
+            }
+            urlObj.pathname = pathname;
+            return urlObj.href;
         }
         catch (e) {
-            // Fallback to original logic if URL parsing fails
-            return canonicalizeUrl(urlWithoutHash);
+            logger?.error("15apdm", correlationId || "");
+            throw createClientConfigurationError(urlParseError);
+        }
+    }
+    /**
+     * Validates that the provided value is a well-formed, parseable absolute URL.
+     * Throws a urlParseError if the value cannot be parsed by the URL API (e.g. the
+     * literal string "null", an empty string, or any malformed/relative URL). Use this
+     * to guard against persisting an invalid value (such as a redirect URL) to the cache.
+     * @param url - URL to validate
+     * @param logger - Optional logger used to log validation failures
+     * @param correlationId - Optional correlationId associated with the log entry
+     */
+    function validateUrl(url, logger, correlationId) {
+        try {
+            new URL(url);
+        }
+        catch (e) {
+            logger?.error("1lrjz7", correlationId || "");
+            throw createClientConfigurationError(urlParseError);
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1236,7 +1255,7 @@
         },
     };
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1284,7 +1303,7 @@
             // Remove LRU (first entry) if capacity exceeded
             if (correlationCache.size > CACHE_CAPACITY) {
                 const firstKey = correlationCache.keys().next().value;
-                if (firstKey) {
+                if (firstKey !== undefined) {
                     correlationCache.delete(firstKey);
                 }
             }
@@ -1497,12 +1516,12 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "16.7.0";
+    const version$1 = "16.8.0";
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1511,7 +1530,7 @@
         // AzureCloudInstance is not specified.
         None: "none"};
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1594,7 +1613,7 @@
         return updatedAccountInfo;
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1674,7 +1693,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1831,7 +1850,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1997,7 +2016,7 @@
         return null;
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2005,7 +2024,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2043,7 +2062,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2081,7 +2100,7 @@
         };
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2096,7 +2115,7 @@
         Ciam: 3,
     };
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2118,7 +2137,7 @@
         return null;
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2142,7 +2161,7 @@
         EAR: "EAR",
     };
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -2317,7 +2336,7 @@
             entity.hasOwnProperty("authorityType"));
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3448,7 +3467,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3462,7 +3481,7 @@
     const PerformanceEventStatus = {
         InProgress: 1};
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3517,7 +3536,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3612,7 +3631,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3639,7 +3658,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3704,7 +3723,7 @@
         return cachedAtSec > nowSeconds();
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3963,7 +3982,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4034,7 +4053,7 @@
     const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
     const SetUserData = "setUserData";
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4127,7 +4146,7 @@
         };
     };
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4207,7 +4226,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4258,7 +4277,7 @@
      */
     const interruptedUser = "interrupted_user";
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4326,7 +4345,7 @@
         return new InteractionRequiredAuthError(errorCode, errorMessage);
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4345,7 +4364,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4413,7 +4432,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4761,7 +4780,7 @@
         return baseAccount;
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4771,7 +4790,7 @@
         UPN: "UPN",
     };
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4789,7 +4808,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4810,7 +4829,7 @@
         };
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4896,7 +4915,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4927,7 +4946,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5041,7 +5060,7 @@
         return response;
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5053,7 +5072,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5063,7 +5082,7 @@
             response.hasOwnProperty("metadata"));
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5073,7 +5092,7 @@
             response.hasOwnProperty("error_description"));
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5178,7 +5197,7 @@
         },
     };
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6146,7 +6165,7 @@
         };
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6180,7 +6199,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6437,7 +6456,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6658,7 +6677,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6774,7 +6793,7 @@
         }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6789,7 +6808,7 @@
         },
     };
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7012,7 +7031,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7045,7 +7064,7 @@
         return Object.prototype.hasOwnProperty.call(params, "resource");
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7055,7 +7074,7 @@
      */
     const unexpectedError = "unexpected_error";
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7166,35 +7185,40 @@
          * @param error
          */
         cacheFailedRequest(error) {
-            const lastRequests = this.getLastRequests();
-            if (lastRequests.errors.length >=
-                SERVER_TELEM_MAX_CACHED_ERRORS) {
-                // Remove a cached error to make room, first in first out
-                lastRequests.failedRequests.shift(); // apiId
-                lastRequests.failedRequests.shift(); // correlationId
-                lastRequests.errors.shift();
-            }
-            lastRequests.failedRequests.push(this.apiId, this.correlationId);
-            if (error instanceof Error && !!error && error.toString()) {
-                if (error instanceof AuthError) {
-                    if (error.subError) {
-                        lastRequests.errors.push(error.subError);
-                    }
-                    else if (error.errorCode) {
-                        lastRequests.errors.push(error.errorCode);
+            try {
+                const lastRequests = this.getLastRequests();
+                if (lastRequests.errors.length >=
+                    SERVER_TELEM_MAX_CACHED_ERRORS) {
+                    // Remove a cached error to make room, first in first out
+                    lastRequests.failedRequests.shift(); // apiId
+                    lastRequests.failedRequests.shift(); // correlationId
+                    lastRequests.errors.shift();
+                }
+                lastRequests.failedRequests.push(this.apiId, this.correlationId);
+                if (error instanceof Error && !!error && error.toString()) {
+                    if (error instanceof AuthError) {
+                        if (error.subError) {
+                            lastRequests.errors.push(error.subError);
+                        }
+                        else if (error.errorCode) {
+                            lastRequests.errors.push(error.errorCode);
+                        }
+                        else {
+                            lastRequests.errors.push(error.toString());
+                        }
                     }
                     else {
                         lastRequests.errors.push(error.toString());
                     }
                 }
                 else {
-                    lastRequests.errors.push(error.toString());
+                    lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
                 }
+                this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
             }
-            else {
-                lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
+            catch {
+                // Ignore telemetry cache failures to avoid masking the original auth error path.
             }
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
             return;
         }
         /**
@@ -7314,9 +7338,36 @@
         static makeExtraSkuString(params) {
             return makeExtraSkuString(params);
         }
+    }
+    /** @internal */
+    class StubServerTelemetryManager extends ServerTelemetryManager {
+        constructor() {
+            super({ clientId: "", apiId: 0, correlationId: "", forceRefresh: false }, {});
+        }
+        generateCurrentRequestHeaderValue() {
+            return "";
+        }
+        generateLastRequestHeaderValue() {
+            return "";
+        }
+        cacheFailedRequest() { }
+        incrementCacheHits() {
+            return 0;
+        }
+        clearTelemetryCache() { }
+        getRegionDiscoveryFields() {
+            return "";
+        }
+        updateRegionDiscoveryMetadata() { }
+        setCacheOutcome() { }
+        setNativeBrokerErrorCode() { }
+        getNativeBrokerErrorCode() {
+            return undefined;
+        }
+        clearNativeBrokerErrorCode() { }
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7337,7 +7388,7 @@
         return new JoseHeaderError(code);
     }
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7345,7 +7396,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
-    /*! @azure/msal-common v16.7.0 2026-06-05 */
+    /*! @azure/msal-common v16.8.0 2026-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7780,7 +7831,7 @@
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "5.12.0";
+    const version = "5.13.0";
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8373,7 +8424,6 @@
      */
     const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
     const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
-    const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
     /**
      * Helper functions in StandardInteractionClient class (msal-browser)
      */
@@ -9448,10 +9498,15 @@
      * @param browserStorage - Browser cache manager instance for storing telemetry data
      * @param logger - Optional logger instance for verbose logging
      * @param forceRefresh - Optional flag to force refresh of telemetry data
+     * @param enabled - Optional flag to enable or disable server telemetry (default: true for custom_auth flows, false for standard flows)
      * @returns Configured ServerTelemetryManager instance
      */
-    function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh) {
+    function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh, enabled = true) {
         logger.verbose("initializeServerTelemetryManager called", correlationId);
+        if (!enabled) {
+            logger.verbose("Server telemetry is disabled in configuration. Skipping telemetry manager initialization.", correlationId);
+            return new StubServerTelemetryManager();
+        }
         const telemetryPayload = {
             clientId: clientId,
             correlationId: correlationId,
@@ -15011,6 +15066,15 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
+    /**
+     * Reason an old-schema cache entry was removed during migration.
+     */
+    const MigrationRemovalReason = {
+        Invalid: "invalid",
+        TtlExpired: "ttlExpired",
+        DecryptFailed: "decryptFailed",
+        Expired: "expired",
+    };
     /**
      * This class implements the cache storage interface for MSAL through browser local or session storage.
      */
@@ -15080,7 +15144,10 @@
             const parsedValue = this.validateAndParseJson(rawValue || "");
             if (!parsedValue) {
                 this.browserStorage.removeItem(key);
-                return null;
+                return {
+                    entry: null,
+                    removalReason: MigrationRemovalReason.Invalid,
+                };
             }
             if (!parsedValue.lastUpdatedAt) {
                 // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
@@ -15089,26 +15156,42 @@
             }
             else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
                 this.browserStorage.removeItem(key);
-                this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-                return null;
+                return {
+                    entry: null,
+                    removalReason: MigrationRemovalReason.TtlExpired,
+                };
             }
-            const decryptedData = isEncrypted(parsedValue)
+            const wasEncrypted = isEncrypted(parsedValue);
+            const decryptedData = wasEncrypted
                 ? await this.browserStorage.decryptData(key, parsedValue, correlationId)
                 : parsedValue;
-            if (!decryptedData || !isCredentialEntity(decryptedData)) {
+            if (!decryptedData) {
                 this.browserStorage.removeItem(key);
-                this.performanceClient.incrementFields({ invalidCacheCount: 1 }, correlationId);
-                return null;
+                return {
+                    entry: null,
+                    removalReason: wasEncrypted
+                        ? MigrationRemovalReason.DecryptFailed
+                        : MigrationRemovalReason.Invalid,
+                };
+            }
+            if (!isCredentialEntity(decryptedData)) {
+                this.browserStorage.removeItem(key);
+                return {
+                    entry: null,
+                    removalReason: MigrationRemovalReason.Invalid,
+                };
             }
             if ((isAccessTokenEntity(decryptedData) ||
                 isRefreshTokenEntity(decryptedData)) &&
                 decryptedData.expiresOn &&
                 isTokenExpired(decryptedData.expiresOn, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
                 this.browserStorage.removeItem(key);
-                this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-                return null;
+                return {
+                    entry: null,
+                    removalReason: MigrationRemovalReason.Expired,
+                };
             }
-            return decryptedData;
+            return { entry: decryptedData };
         }
         /**
          * Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
@@ -15128,6 +15211,7 @@
                 const parsedValue = this.validateAndParseJson(rawValue || "");
                 if (!parsedValue) {
                     this.browserStorage.removeItem(accountKey);
+                    this.performanceClient.incrementFields({ invalidAcntCount: 1 }, correlationId);
                     removeElementFromArray(accountKeysToCheck, accountKey);
                     continue;
                 }
@@ -15140,6 +15224,7 @@
                 else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
                     // Cache expired remove account and associated tokens
                     await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
+                    this.performanceClient.incrementFields({ ttlExpiredAcntCount: 1 }, correlationId);
                     removeElementFromArray(accountKeysToCheck, accountKey);
                 }
                 else if (isEncrypted(parsedValue)) {
@@ -15147,7 +15232,9 @@
                     const decrypted = await this.browserStorage.decryptData(accountKey, parsedValue, correlationId);
                     if (!decrypted) {
                         this.browserStorage.removeItem(accountKey);
-                        this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
+                        this.performanceClient.incrementFields({
+                            decryptFailedAcntCount: 1,
+                        }, correlationId);
                         removeElementFromArray(accountKeysToCheck, accountKey);
                     }
                 }
@@ -15188,7 +15275,6 @@
                 });
                 this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
             }
-            this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
             this.browserStorage.removeItem(accountKey);
         }
         /**
@@ -15227,8 +15313,20 @@
             const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
             for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
                 this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
-                const oldSchemaData = (await this.updateOldEntry(idTokenKey, correlationId));
+                const result = await this.updateOldEntry(idTokenKey, correlationId);
+                const oldSchemaData = result.entry;
                 if (!oldSchemaData) {
+                    switch (result.removalReason) {
+                        case MigrationRemovalReason.TtlExpired:
+                            this.performanceClient.incrementFields({ ttlExpiredITCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.DecryptFailed:
+                            this.performanceClient.incrementFields({ decryptFailedITCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Invalid:
+                            this.performanceClient.incrementFields({ invalidITCount: 1 }, correlationId);
+                            break;
+                    }
                     removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
                     continue;
                 }
@@ -15307,8 +15405,23 @@
             const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
             for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
                 this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
-                const oldSchemaData = (await this.updateOldEntry(accessTokenKey, correlationId));
+                const result = await this.updateOldEntry(accessTokenKey, correlationId);
+                const oldSchemaData = result.entry;
                 if (!oldSchemaData) {
+                    switch (result.removalReason) {
+                        case MigrationRemovalReason.TtlExpired:
+                            this.performanceClient.incrementFields({ ttlExpiredATCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.DecryptFailed:
+                            this.performanceClient.incrementFields({ decryptFailedATCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Expired:
+                            this.performanceClient.incrementFields({ expiredATCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Invalid:
+                            this.performanceClient.incrementFields({ invalidATCount: 1 }, correlationId);
+                            break;
+                    }
                     removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
                     continue;
                 }
@@ -15354,8 +15467,23 @@
                 ...credentialKeysToMigrate.refreshToken,
             ]) {
                 this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
-                const oldSchemaData = (await this.updateOldEntry(refreshTokenKey, correlationId));
+                const result = await this.updateOldEntry(refreshTokenKey, correlationId);
+                const oldSchemaData = result.entry;
                 if (!oldSchemaData) {
+                    switch (result.removalReason) {
+                        case MigrationRemovalReason.TtlExpired:
+                            this.performanceClient.incrementFields({ ttlExpiredRTCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.DecryptFailed:
+                            this.performanceClient.incrementFields({ decryptFailedRTCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Expired:
+                            this.performanceClient.incrementFields({ expiredRTCount: 1 }, correlationId);
+                            break;
+                        case MigrationRemovalReason.Invalid:
+                            this.performanceClient.incrementFields({ invalidRTCount: 1 }, correlationId);
+                            break;
+                    }
                     removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
                     continue;
                 }
@@ -16753,7 +16881,7 @@
          */
         async acquireToken(silentRequest) {
             // Telemetry manager only used to increment cacheHits here
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
                 serverTelemetryManager,
                 requestAuthority: silentRequest.authority,
@@ -16829,7 +16957,7 @@
             // start the perf measurement
             const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
             const reqTimestamp = nowSeconds();
-            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 // initialize native request
                 const nativeRequest = await this.initializePlatformRequest(request);
@@ -16953,7 +17081,7 @@
             catch (e) {
                 // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
                 if (e instanceof NativeAuthError) {
-                    const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+                    const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
                     serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                     if (isFatalNativeAuthError(e)) {
                         throw e;
@@ -17000,7 +17128,7 @@
                 this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.", this.correlationId);
                 const response = await this.platformAuthProvider.sendMessage(request);
                 const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
-                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
                 serverTelemetryManager.clearNativeBrokerErrorCode();
                 this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
                 return authResult;
@@ -18007,6 +18135,7 @@
             nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
                 DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
             protocolMode: ProtocolMode.AAD,
+            serverTelemetryEnabled: false,
         };
         const providedSystemOptions = {
             ...DEFAULT_BROWSER_SYSTEM_OPTIONS,
@@ -18648,7 +18777,7 @@
          */
         async executeCodeFlow(request, popupParams, pkceCodes) {
             const correlationId = request.correlationId;
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const pkce = pkceCodes ||
                 (await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId));
             const popupRequest = {
@@ -18713,7 +18842,7 @@
             const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
             if (!serverParams.ear_jwe && serverParams.code) {
                 const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                    serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                    serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                     requestAuthority: request.authority,
                     requestAzureCloudOptions: request.azureCloudOptions,
                     requestExtraQueryParameters: request.extraQueryParameters,
@@ -18750,7 +18879,7 @@
         async logoutPopupAsync(validRequest, popupParams, requestAuthority, mainWindowRedirectUri) {
             this.logger.verbose("logoutPopupAsync called", this.correlationId);
             this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, InteractionType.Popup, validRequest);
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 // Clear cache on logout
                 await clearCacheOnLogout(this.browserStorage, this.browserCrypto, this.logger, this.correlationId, validRequest.account);
@@ -19034,7 +19163,7 @@
          */
         async executeCodeFlow(request) {
             const correlationId = request.correlationId;
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
             const redirectRequest = {
                 ...request,
@@ -19122,7 +19251,7 @@
         async handleRedirectPromise(request, pkceVerifier, parentMeasurement, options) {
             const originalTitle = document.title;
             document.title = "Microsoft Authentication";
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
             try {
                 const [serverParams, responseString] = this.getRedirectResponse(options?.hash || "");
@@ -19141,8 +19270,8 @@
                 }
                 // If navigateToLoginRequestUrl is true, get the url where the redirect request was initiated
                 const loginRequestUrl = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, this.correlationId, true) || "";
-                const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl);
-                const currentUrlNormalized = normalizeUrlForComparison(window.location.href);
+                const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl, this.logger, this.correlationId);
+                const currentUrlNormalized = normalizeUrlForComparison(window.location.href, this.logger, this.correlationId);
                 if (loginRequestUrlNormalized === currentUrlNormalized &&
                     navigateToLoginRequestUrl) {
                     // We are on the page we need to navigate to - handle hash
@@ -19175,8 +19304,8 @@
                      * The start page is expected to also call handleRedirectPromise which will process the hash in one of the checks above.
                      */
                     let processHashOnRedirect = true;
-                    if (!loginRequestUrl || loginRequestUrl === "null") {
-                        // Redirect to home page if login request url is null (real null or the string null)
+                    if (!loginRequestUrl) {
+                        // Redirect to home page if login request url is empty
                         const homepage = getHomepage();
                         // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                         this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, homepage, true);
@@ -19322,7 +19451,7 @@
         async logout(logoutRequest) {
             this.logger.verbose("logoutRedirect called", this.correlationId);
             const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, InteractionType.Redirect, logoutRequest);
                 // Clear cache on logout
@@ -19403,7 +19532,10 @@
          */
         getRedirectStartPage(requestStartPage) {
             const redirectStartPage = requestStartPage || window.location.href;
-            return UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+            const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+            // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
+            validateUrl(absoluteRedirectStartPage, this.logger, this.correlationId);
+            return absoluteRedirectStartPage;
         }
     }
@@ -19412,20 +19544,20 @@
      * Licensed under the MIT License.
      */
     /**
-     * Creates a hidden iframe to given URL using user-requested scopes as an id.
-     * @param urlNavigate
-     * @param userRequestScopes
+     * Navigates the given hidden iframe to the provided URL.
+     * @param frame
+     * @param requestUrl
      */
-    async function initiateCodeRequest(requestUrl, performanceClient, logger, correlationId) {
+    async function initiateCodeRequest(frame, requestUrl, logger, correlationId) {
         if (!requestUrl) {
             // Throw error if request URL is empty.
             logger.info("Navigate url is empty", correlationId);
             throw createBrowserAuthError(emptyNavigateUri);
         }
-        return invoke(loadFrameSync, SilentHandlerLoadFrameSync, logger, performanceClient, correlationId)(requestUrl);
+        frame.src = requestUrl;
+        return frame;
     }
-    async function initiateCodeFlowWithPost(config, authority, request, logger, performanceClient) {
-        const frame = createHiddenIframe();
+    async function initiateCodeFlowWithPost(frame, config, authority, request, logger, performanceClient) {
         if (!frame.contentDocument) {
             throw "No document associated with iframe!";
         }
@@ -19433,8 +19565,7 @@
         form.submit();
         return frame;
     }
-    async function initiateEarRequest(config, authority, request, logger, performanceClient) {
-        const frame = createHiddenIframe();
+    async function initiateEarRequest(frame, config, authority, request, logger, performanceClient) {
         if (!frame.contentDocument) {
             throw "No document associated with iframe!";
         }
@@ -19444,19 +19575,8 @@
     }
     /**
      * @hidden
-     * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
-     * @param urlNavigate
-     * @param frameName
-     * @param logger
-     */
-    function loadFrameSync(urlNavigate) {
-        const frameHandle = createHiddenIframe();
-        frameHandle.src = urlNavigate;
-        return frameHandle;
-    }
-    /**
-     * @hidden
-     * Creates a new hidden iframe or gets an existing one for silent token renewal.
+     * Creates a new hidden iframe for silent token renewal. Callers navigate it
+     * (set `src` or submit a form) after registering the response listener.
      * @ignore
      */
     function createHiddenIframe() {
@@ -19535,7 +19655,7 @@
          */
         async executeCodeFlow(request) {
             let authClient;
-            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 // Initialize the client
                 authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
@@ -19577,11 +19697,22 @@
                 earJwk: earJwk,
                 codeChallenge: pkceCodes.challenge,
             };
-            const iframe = await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+            // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+            const iframe = createHiddenIframe();
             const responseType = this.config.auth.OIDCOptions.responseMode;
             let responseString;
             try {
-                responseString = await invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+                const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+                responsePromise.catch(() => {
+                    /*
+                     * If navigation below throws before responsePromise is awaited,
+                     * the listener still rejects on timeout. Swallow it here so it
+                     * does not surface as an unhandled rejection; the navigation
+                     * error is propagated instead.
+                     */
+                });
+                await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+                responseString = await responsePromise;
             }
             finally {
                 invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -19590,7 +19721,7 @@
             if (!serverParams.ear_jwe && serverParams.code) {
                 // If server doesn't support EAR, they may fallback to auth code flow instead
                 const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                    serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                    serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                     requestAuthority: request.authority,
                     requestAzureCloudOptions: request.azureCloudOptions,
                     requestExtraQueryParameters: request.extraQueryParameters,
@@ -19617,7 +19748,7 @@
             // Create silent request
             const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
-                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger),
+                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                 requestAuthority: silentRequest.authority,
                 requestAzureCloudOptions: silentRequest.azureCloudOptions,
                 requestExtraQueryParameters: silentRequest.extraQueryParameters,
@@ -19665,21 +19796,32 @@
                 ...request,
                 codeChallenge: pkceCodes.challenge,
             };
-            let iframe;
-            if (request.httpMethod === HttpMethod$1.POST) {
-                iframe = await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-            }
-            else {
-                // Create authorize request url
-                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-                // Get the frame handle for the silent request
-                iframe = await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId);
-            }
+            // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+            const iframe = createHiddenIframe();
             const responseType = this.config.auth.OIDCOptions.responseMode;
             // Wait for response from the redirect bridge.
             let responseString;
             try {
-                responseString = await invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+                const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+                responsePromise.catch(() => {
+                    /*
+                     * If URL creation or navigation below throws before
+                     * responsePromise is awaited, the listener still rejects on
+                     * timeout. Swallow it here so it does not surface as an
+                     * unhandled rejection; the navigation error is propagated
+                     * instead.
+                     */
+                });
+                if (request.httpMethod === HttpMethod$1.POST) {
+                    await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+                }
+                else {
+                    // Create authorize request url
+                    const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+                    // Navigate the iframe to the authorize request url
+                    await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, navigateUrl, this.logger, correlationId);
+                }
+                responseString = await responsePromise;
             }
             finally {
                 invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -19714,7 +19856,7 @@
                 // Make sure any passed redirectUri is converted to an absolute URL - redirectUri is not a required parameter for refresh token redemption so only include if explicitly provided
                 silentRequest.redirectUri = getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
             }
-            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             const refreshTokenClient = await this.createRefreshTokenClient({
                 serverTelemetryManager,
                 authorityUrl: silentRequest.authority,
@@ -19794,7 +19936,7 @@
              * Each auth request creates a new instance of *Client so we can safely use this.correlationId.
              */
             this.correlationId);
-            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             try {
                 // Create auth code request (PKCE not needed)
                 const authCodeRequest = {
@@ -20147,6 +20289,8 @@
             // Preflight request
             const correlationId = this.getRequestCorrelationId(request);
             this.logger.verbose("acquireTokenRedirect called", correlationId);
+            redirectPreflightCheck(this.initialized, this.config);
+            this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
             const atrMeasurement = this.performanceClient.startMeasurement(AcquireTokenPreRedirect, correlationId);
             atrMeasurement.add({
                 scenarioId: request.scenarioId,
@@ -20164,9 +20308,7 @@
                 return navigate;
             };
             try {
-                redirectPreflightCheck(this.initialized, this.config);
                 enforceResourceParameter(this.config.auth.isMcp, request);
-                this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Redirect, request);
                 let result;
                 if (this.platformAuthProvider &&