npm - @azure/msal-browser - Versions diffs - 5.12.0 → 5.13.0 - Mend

@azure/msal-browser 5.12.0 → 5.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (245) hide show

package/lib/custom-auth-path/msal-custom-auth.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.12.0 2026-06-05 */
+/*! @azure/msal-browser v5.13.0 2026-06-10 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -229,7 +229,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -281,7 +281,7 @@ const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -312,7 +312,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -332,7 +332,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -412,7 +412,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -435,7 +435,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -461,7 +461,7 @@ const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
 const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
 const issuerValidationFailed = "issuer_validation_failed";
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -500,7 +500,7 @@ const methodNotImplemented = "method_not_implemented";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -695,7 +695,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1044,8 +1044,14 @@ function addSshJwk(parameters, sshJwkString) {
  * @param serverTelemetryManager
  */
 function addServerTelemetry(parameters, serverTelemetryManager) {
-    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+    const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
+    const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
+    if (currentTelemetryHeader) {
+        parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
+    }
+    if (lastTelemetryHeader) {
+        parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
+    }
 }
 /**
  * Adds parameter that indicates to the server that throttling is supported
@@ -1084,34 +1090,12 @@ function addResource(parameters, resource) {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-/**
- * Canonicalizes a URL by making it lowercase and ensuring it ends with /
- * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
- * @param url - URL to canonicalize
- * @returns Canonicalized URL
- */
-function canonicalizeUrl(url) {
-    if (!url) {
-        return url;
-    }
-    let lowerCaseUrl = url.toLowerCase();
-    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
-    }
-    else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
-        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
-    }
-    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
-        lowerCaseUrl += "/";
-    }
-    return lowerCaseUrl;
-}
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -1164,36 +1148,71 @@ function mapToQueryString(parameters) {
     return queryParameterArray.join("&");
 }
 /**
- * Normalizes URLs for comparison by removing hash, canonicalizing,
- * and ensuring consistent URL encoding in query parameters.
- * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * Normalizes URLs for comparison per MDN & RFC 3986 standards:
+ * - Hash/fragment is removed
+ * - Scheme and host are lowercased (case-insensitive per spec)
+ * - Path and query parameters preserve original casing (case-sensitive per spec)
+ * - Percent-encoding in pathname is normalized (e.g., %27 and ' are treated equivalently)
+ * - Ensures pathname ends with /
+ * Throws a urlParseError if the provided URL is malformed and cannot be parsed.
  * @param url - URL to normalize
+ * @param logger - Optional logger used to log parse failures
+ * @param correlationId - Optional correlationId associated with the log entry
  * @returns Normalized URL string for comparison
  */
-function normalizeUrlForComparison(url) {
+function normalizeUrlForComparison(url, logger, correlationId) {
     if (!url) {
         return url;
     }
-    // Remove hash first
     const urlWithoutHash = url.split("#")[0];
+    if (!urlWithoutHash) {
+        return urlWithoutHash;
+    }
     try {
-        // Parse the URL to handle encoding consistently
         const urlObj = new URL(urlWithoutHash);
-        /*
-         * Reconstruct the URL with properly decoded query parameters
-         * This ensures that %27 and ' are treated as equivalent
-         */
-        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
-        // Apply canonicalization logic inline to avoid circular dependency
-        return canonicalizeUrl(normalizedUrl);
+        // Treat an empty query string (a bare trailing "?") as equivalent to no query
+        if (!urlObj.search) {
+            urlObj.search = "";
+        }
+        // Decode the pathname to normalize percent-encoding and ensure trailing slash
+        let pathname;
+        try {
+            pathname = decodeURIComponent(urlObj.pathname);
+        }
+        catch (e) {
+            pathname = urlObj.pathname;
+        }
+        if (!pathname.endsWith("/")) {
+            pathname += "/";
+        }
+        urlObj.pathname = pathname;
+        return urlObj.href;
     }
     catch (e) {
-        // Fallback to original logic if URL parsing fails
-        return canonicalizeUrl(urlWithoutHash);
+        logger?.error("15apdm", correlationId || "");
+        throw createClientConfigurationError(urlParseError);
+    }
+}
+/**
+ * Validates that the provided value is a well-formed, parseable absolute URL.
+ * Throws a urlParseError if the value cannot be parsed by the URL API (e.g. the
+ * literal string "null", an empty string, or any malformed/relative URL). Use this
+ * to guard against persisting an invalid value (such as a redirect URL) to the cache.
+ * @param url - URL to validate
+ * @param logger - Optional logger used to log validation failures
+ * @param correlationId - Optional correlationId associated with the log entry
+ */
+function validateUrl(url, logger, correlationId) {
+    try {
+        new URL(url);
+    }
+    catch (e) {
+        logger?.error("1lrjz7", correlationId || "");
+        throw createClientConfigurationError(urlParseError);
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1232,7 +1251,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1280,7 +1299,7 @@ function addLogToCache(correlationId, loggedMessage) {
         // Remove LRU (first entry) if capacity exceeded
         if (correlationCache.size > CACHE_CAPACITY) {
             const firstKey = correlationCache.keys().next().value;
-            if (firstKey) {
+            if (firstKey !== undefined) {
                 correlationCache.delete(firstKey);
             }
         }
@@ -1493,12 +1512,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.7.0";
+const version$1 = "16.8.0";
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1507,7 +1526,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1590,7 +1609,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1670,7 +1689,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1827,7 +1846,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1993,7 +2012,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2001,7 +2020,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2039,7 +2058,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2077,7 +2096,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2092,7 +2111,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2114,7 +2133,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2138,7 +2157,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2313,7 +2332,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3444,7 +3463,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3458,7 +3477,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3513,7 +3532,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3608,7 +3627,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3635,7 +3654,7 @@ function isOidcProtocolMode(config) {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3700,7 +3719,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3959,7 +3978,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4030,7 +4049,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4123,7 +4142,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4203,7 +4222,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4254,7 +4273,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4322,7 +4341,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4341,7 +4360,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4409,7 +4428,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4757,7 +4776,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4767,7 +4786,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4785,7 +4804,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4806,7 +4825,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4892,7 +4911,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4923,7 +4942,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5037,7 +5056,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5049,7 +5068,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5059,7 +5078,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5069,7 +5088,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5174,7 +5193,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6142,7 +6161,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6176,7 +6195,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6433,7 +6452,7 @@ class AuthorizationCodeClient {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6654,7 +6673,7 @@ class RefreshTokenClient {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6770,7 +6789,7 @@ class SilentFlowClient {
     }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6785,7 +6804,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7008,7 +7027,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7041,7 +7060,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7051,7 +7070,7 @@ function containsResourceParam(params) {
  */
 const unexpectedError = "unexpected_error";
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7162,35 +7181,40 @@ class ServerTelemetryManager {
      * @param error
      */
     cacheFailedRequest(error) {
-        const lastRequests = this.getLastRequests();
-        if (lastRequests.errors.length >=
-            SERVER_TELEM_MAX_CACHED_ERRORS) {
-            // Remove a cached error to make room, first in first out
-            lastRequests.failedRequests.shift(); // apiId
-            lastRequests.failedRequests.shift(); // correlationId
-            lastRequests.errors.shift();
-        }
-        lastRequests.failedRequests.push(this.apiId, this.correlationId);
-        if (error instanceof Error && !!error && error.toString()) {
-            if (error instanceof AuthError) {
-                if (error.subError) {
-                    lastRequests.errors.push(error.subError);
-                }
-                else if (error.errorCode) {
-                    lastRequests.errors.push(error.errorCode);
+        try {
+            const lastRequests = this.getLastRequests();
+            if (lastRequests.errors.length >=
+                SERVER_TELEM_MAX_CACHED_ERRORS) {
+                // Remove a cached error to make room, first in first out
+                lastRequests.failedRequests.shift(); // apiId
+                lastRequests.failedRequests.shift(); // correlationId
+                lastRequests.errors.shift();
+            }
+            lastRequests.failedRequests.push(this.apiId, this.correlationId);
+            if (error instanceof Error && !!error && error.toString()) {
+                if (error instanceof AuthError) {
+                    if (error.subError) {
+                        lastRequests.errors.push(error.subError);
+                    }
+                    else if (error.errorCode) {
+                        lastRequests.errors.push(error.errorCode);
+                    }
+                    else {
+                        lastRequests.errors.push(error.toString());
+                    }
                 }
                 else {
                     lastRequests.errors.push(error.toString());
                 }
             }
             else {
-                lastRequests.errors.push(error.toString());
+                lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
             }
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         }
-        else {
-            lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
+        catch {
+            // Ignore telemetry cache failures to avoid masking the original auth error path.
         }
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return;
     }
     /**
@@ -7310,9 +7334,36 @@ class ServerTelemetryManager {
     static makeExtraSkuString(params) {
         return makeExtraSkuString(params);
     }
+}
+/** @internal */
+class StubServerTelemetryManager extends ServerTelemetryManager {
+    constructor() {
+        super({ clientId: "", apiId: 0, correlationId: "", forceRefresh: false }, {});
+    }
+    generateCurrentRequestHeaderValue() {
+        return "";
+    }
+    generateLastRequestHeaderValue() {
+        return "";
+    }
+    cacheFailedRequest() { }
+    incrementCacheHits() {
+        return 0;
+    }
+    clearTelemetryCache() { }
+    getRegionDiscoveryFields() {
+        return "";
+    }
+    updateRegionDiscoveryMetadata() { }
+    setCacheOutcome() { }
+    setNativeBrokerErrorCode() { }
+    getNativeBrokerErrorCode() {
+        return undefined;
+    }
+    clearNativeBrokerErrorCode() { }
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7333,7 +7384,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7341,7 +7392,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v16.7.0 2026-06-05 */
+/*! @azure/msal-common v16.8.0 2026-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7776,7 +7827,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.12.0";
+const version = "5.13.0";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8369,7 +8420,6 @@ const SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
  */
 const SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
 const SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
-const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
 /**
  * Helper functions in StandardInteractionClient class (msal-browser)
  */
@@ -9444,10 +9494,15 @@ function getRedirectUri(requestRedirectUri, clientConfigRedirectUri, logger, cor
  * @param browserStorage - Browser cache manager instance for storing telemetry data
  * @param logger - Optional logger instance for verbose logging
  * @param forceRefresh - Optional flag to force refresh of telemetry data
+ * @param enabled - Optional flag to enable or disable server telemetry (default: true for custom_auth flows, false for standard flows)
  * @returns Configured ServerTelemetryManager instance
  */
-function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh) {
+function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh, enabled = true) {
     logger.verbose("1p12tq", correlationId);
+    if (!enabled) {
+        logger.verbose("0tajnr", correlationId);
+        return new StubServerTelemetryManager();
+    }
     const telemetryPayload = {
         clientId: clientId,
         correlationId: correlationId,
@@ -15007,6 +15062,15 @@ function removeElementFromArray(array, element) {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Reason an old-schema cache entry was removed during migration.
+ */
+const MigrationRemovalReason = {
+    Invalid: "invalid",
+    TtlExpired: "ttlExpired",
+    DecryptFailed: "decryptFailed",
+    Expired: "expired",
+};
 /**
  * This class implements the cache storage interface for MSAL through browser local or session storage.
  */
@@ -15076,7 +15140,10 @@ class BrowserCacheManager extends CacheManager {
         const parsedValue = this.validateAndParseJson(rawValue || "");
         if (!parsedValue) {
             this.browserStorage.removeItem(key);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Invalid,
+            };
         }
         if (!parsedValue.lastUpdatedAt) {
             // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
@@ -15085,26 +15152,42 @@ class BrowserCacheManager extends CacheManager {
         }
         else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
             this.browserStorage.removeItem(key);
-            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.TtlExpired,
+            };
         }
-        const decryptedData = isEncrypted(parsedValue)
+        const wasEncrypted = isEncrypted(parsedValue);
+        const decryptedData = wasEncrypted
             ? await this.browserStorage.decryptData(key, parsedValue, correlationId)
             : parsedValue;
-        if (!decryptedData || !isCredentialEntity(decryptedData)) {
+        if (!decryptedData) {
             this.browserStorage.removeItem(key);
-            this.performanceClient.incrementFields({ invalidCacheCount: 1 }, correlationId);
-            return null;
+            return {
+                entry: null,
+                removalReason: wasEncrypted
+                    ? MigrationRemovalReason.DecryptFailed
+                    : MigrationRemovalReason.Invalid,
+            };
+        }
+        if (!isCredentialEntity(decryptedData)) {
+            this.browserStorage.removeItem(key);
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Invalid,
+            };
         }
         if ((isAccessTokenEntity(decryptedData) ||
             isRefreshTokenEntity(decryptedData)) &&
             decryptedData.expiresOn &&
             isTokenExpired(decryptedData.expiresOn, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
             this.browserStorage.removeItem(key);
-            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Expired,
+            };
         }
-        return decryptedData;
+        return { entry: decryptedData };
     }
     /**
      * Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
@@ -15124,6 +15207,7 @@ class BrowserCacheManager extends CacheManager {
             const parsedValue = this.validateAndParseJson(rawValue || "");
             if (!parsedValue) {
                 this.browserStorage.removeItem(accountKey);
+                this.performanceClient.incrementFields({ invalidAcntCount: 1 }, correlationId);
                 removeElementFromArray(accountKeysToCheck, accountKey);
                 continue;
             }
@@ -15136,6 +15220,7 @@ class BrowserCacheManager extends CacheManager {
             else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
                 // Cache expired remove account and associated tokens
                 await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
+                this.performanceClient.incrementFields({ ttlExpiredAcntCount: 1 }, correlationId);
                 removeElementFromArray(accountKeysToCheck, accountKey);
             }
             else if (isEncrypted(parsedValue)) {
@@ -15143,7 +15228,9 @@ class BrowserCacheManager extends CacheManager {
                 const decrypted = await this.browserStorage.decryptData(accountKey, parsedValue, correlationId);
                 if (!decrypted) {
                     this.browserStorage.removeItem(accountKey);
-                    this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
+                    this.performanceClient.incrementFields({
+                        decryptFailedAcntCount: 1,
+                    }, correlationId);
                     removeElementFromArray(accountKeysToCheck, accountKey);
                 }
             }
@@ -15184,7 +15271,6 @@ class BrowserCacheManager extends CacheManager {
             });
             this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
         }
-        this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
         this.browserStorage.removeItem(accountKey);
     }
     /**
@@ -15223,8 +15309,20 @@ class BrowserCacheManager extends CacheManager {
         const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
         for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
             this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
-            const oldSchemaData = (await this.updateOldEntry(idTokenKey, correlationId));
+            const result = await this.updateOldEntry(idTokenKey, correlationId);
+            const oldSchemaData = result.entry;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields({ ttlExpiredITCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields({ decryptFailedITCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields({ invalidITCount: 1 }, correlationId);
+                        break;
+                }
                 removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
                 continue;
             }
@@ -15303,8 +15401,23 @@ class BrowserCacheManager extends CacheManager {
         const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
         for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
             this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
-            const oldSchemaData = (await this.updateOldEntry(accessTokenKey, correlationId));
+            const result = await this.updateOldEntry(accessTokenKey, correlationId);
+            const oldSchemaData = result.entry;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields({ ttlExpiredATCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields({ decryptFailedATCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Expired:
+                        this.performanceClient.incrementFields({ expiredATCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields({ invalidATCount: 1 }, correlationId);
+                        break;
+                }
                 removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
                 continue;
             }
@@ -15350,8 +15463,23 @@ class BrowserCacheManager extends CacheManager {
             ...credentialKeysToMigrate.refreshToken,
         ]) {
             this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
-            const oldSchemaData = (await this.updateOldEntry(refreshTokenKey, correlationId));
+            const result = await this.updateOldEntry(refreshTokenKey, correlationId);
+            const oldSchemaData = result.entry;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields({ ttlExpiredRTCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields({ decryptFailedRTCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Expired:
+                        this.performanceClient.incrementFields({ expiredRTCount: 1 }, correlationId);
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields({ invalidRTCount: 1 }, correlationId);
+                        break;
+                }
                 removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
                 continue;
             }
@@ -16749,7 +16877,7 @@ class SilentCacheClient extends StandardInteractionClient {
      */
     async acquireToken(silentRequest) {
         // Telemetry manager only used to increment cacheHits here
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const clientConfig = await invokeAsync(this.getClientConfiguration.bind(this), StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
             serverTelemetryManager,
             requestAuthority: silentRequest.authority,
@@ -16825,7 +16953,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // start the perf measurement
         const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
         const reqTimestamp = nowSeconds();
-        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // initialize native request
             const nativeRequest = await this.initializePlatformRequest(request);
@@ -16949,7 +17077,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         catch (e) {
             // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
             if (e instanceof NativeAuthError) {
-                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+                const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                 if (isFatalNativeAuthError(e)) {
                     throw e;
@@ -16996,7 +17124,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             this.logger.verbose("003x5a", this.correlationId);
             const response = await this.platformAuthProvider.sendMessage(request);
             const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
-            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+            const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
             serverTelemetryManager.clearNativeBrokerErrorCode();
             this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
             return authResult;
@@ -18003,6 +18131,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
         nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
         protocolMode: ProtocolMode.AAD,
+        serverTelemetryEnabled: false,
     };
     const providedSystemOptions = {
         ...DEFAULT_BROWSER_SYSTEM_OPTIONS,
@@ -18644,7 +18773,7 @@ class PopupClient extends StandardInteractionClient {
      */
     async executeCodeFlow(request, popupParams, pkceCodes) {
         const correlationId = request.correlationId;
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const pkce = pkceCodes ||
             (await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId));
         const popupRequest = {
@@ -18709,7 +18838,7 @@ class PopupClient extends StandardInteractionClient {
         const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
         if (!serverParams.ear_jwe && serverParams.code) {
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
                 requestExtraQueryParameters: request.extraQueryParameters,
@@ -18746,7 +18875,7 @@ class PopupClient extends StandardInteractionClient {
     async logoutPopupAsync(validRequest, popupParams, requestAuthority, mainWindowRedirectUri) {
         this.logger.verbose("0b7yrk", this.correlationId);
         this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, InteractionType.Popup, validRequest);
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // Clear cache on logout
             await clearCacheOnLogout(this.browserStorage, this.browserCrypto, this.logger, this.correlationId, validRequest.account);
@@ -19030,7 +19159,7 @@ class RedirectClient extends StandardInteractionClient {
      */
     async executeCodeFlow(request) {
         const correlationId = request.correlationId;
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
         const redirectRequest = {
             ...request,
@@ -19118,7 +19247,7 @@ class RedirectClient extends StandardInteractionClient {
     async handleRedirectPromise(request, pkceVerifier, parentMeasurement, options) {
         const originalTitle = document.title;
         document.title = "Microsoft Authentication";
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
         try {
             const [serverParams, responseString] = this.getRedirectResponse(options?.hash || "");
@@ -19137,8 +19266,8 @@ class RedirectClient extends StandardInteractionClient {
             }
             // If navigateToLoginRequestUrl is true, get the url where the redirect request was initiated
             const loginRequestUrl = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, this.correlationId, true) || "";
-            const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl);
-            const currentUrlNormalized = normalizeUrlForComparison(window.location.href);
+            const loginRequestUrlNormalized = normalizeUrlForComparison(loginRequestUrl, this.logger, this.correlationId);
+            const currentUrlNormalized = normalizeUrlForComparison(window.location.href, this.logger, this.correlationId);
             if (loginRequestUrlNormalized === currentUrlNormalized &&
                 navigateToLoginRequestUrl) {
                 // We are on the page we need to navigate to - handle hash
@@ -19171,8 +19300,8 @@ class RedirectClient extends StandardInteractionClient {
                  * The start page is expected to also call handleRedirectPromise which will process the hash in one of the checks above.
                  */
                 let processHashOnRedirect = true;
-                if (!loginRequestUrl || loginRequestUrl === "null") {
-                    // Redirect to home page if login request url is null (real null or the string null)
+                if (!loginRequestUrl) {
+                    // Redirect to home page if login request url is empty
                     const homepage = getHomepage();
                     // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                     this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, homepage, true);
@@ -19318,7 +19447,7 @@ class RedirectClient extends StandardInteractionClient {
     async logout(logoutRequest) {
         this.logger.verbose("1rkurh", this.correlationId);
         const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, InteractionType.Redirect, logoutRequest);
             // Clear cache on logout
@@ -19399,7 +19528,10 @@ class RedirectClient extends StandardInteractionClient {
      */
     getRedirectStartPage(requestStartPage) {
         const redirectStartPage = requestStartPage || window.location.href;
-        return UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+        const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+        // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
+        validateUrl(absoluteRedirectStartPage, this.logger, this.correlationId);
+        return absoluteRedirectStartPage;
     }
 }
@@ -19408,20 +19540,20 @@ class RedirectClient extends StandardInteractionClient {
  * Licensed under the MIT License.
  */
 /**
- * Creates a hidden iframe to given URL using user-requested scopes as an id.
- * @param urlNavigate
- * @param userRequestScopes
+ * Navigates the given hidden iframe to the provided URL.
+ * @param frame
+ * @param requestUrl
  */
-async function initiateCodeRequest(requestUrl, performanceClient, logger, correlationId) {
+async function initiateCodeRequest(frame, requestUrl, logger, correlationId) {
     if (!requestUrl) {
         // Throw error if request URL is empty.
         logger.info("1l7hyp", correlationId);
         throw createBrowserAuthError(emptyNavigateUri);
     }
-    return invoke(loadFrameSync, SilentHandlerLoadFrameSync, logger, performanceClient, correlationId)(requestUrl);
+    frame.src = requestUrl;
+    return frame;
 }
-async function initiateCodeFlowWithPost(config, authority, request, logger, performanceClient) {
-    const frame = createHiddenIframe();
+async function initiateCodeFlowWithPost(frame, config, authority, request, logger, performanceClient) {
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -19429,8 +19561,7 @@ async function initiateCodeFlowWithPost(config, authority, request, logger, perf
     form.submit();
     return frame;
 }
-async function initiateEarRequest(config, authority, request, logger, performanceClient) {
-    const frame = createHiddenIframe();
+async function initiateEarRequest(frame, config, authority, request, logger, performanceClient) {
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -19440,19 +19571,8 @@ async function initiateEarRequest(config, authority, request, logger, performanc
 }
 /**
  * @hidden
- * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
- * @param urlNavigate
- * @param frameName
- * @param logger
- */
-function loadFrameSync(urlNavigate) {
-    const frameHandle = createHiddenIframe();
-    frameHandle.src = urlNavigate;
-    return frameHandle;
-}
-/**
- * @hidden
- * Creates a new hidden iframe or gets an existing one for silent token renewal.
+ * Creates a new hidden iframe for silent token renewal. Callers navigate it
+ * (set `src` or submit a form) after registering the response listener.
  * @ignore
  */
 function createHiddenIframe() {
@@ -19531,7 +19651,7 @@ class SilentIframeClient extends StandardInteractionClient {
      */
     async executeCodeFlow(request) {
         let authClient;
-        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // Initialize the client
             authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
@@ -19573,11 +19693,22 @@ class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        const iframe = await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
         const responseType = this.config.auth.OIDCOptions.responseMode;
         let responseString;
         try {
-            responseString = await invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+            const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If navigation below throws before responsePromise is awaited,
+                 * the listener still rejects on timeout. Swallow it here so it
+                 * does not surface as an unhandled rejection; the navigation
+                 * error is propagated instead.
+                 */
+            });
+            await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
+            responseString = await responsePromise;
         }
         finally {
             invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -19586,7 +19717,7 @@ class SilentIframeClient extends StandardInteractionClient {
         if (!serverParams.ear_jwe && serverParams.code) {
             // If server doesn't support EAR, they may fallback to auth code flow instead
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
-                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger),
+                serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
                 requestExtraQueryParameters: request.extraQueryParameters,
@@ -19613,7 +19744,7 @@ class SilentIframeClient extends StandardInteractionClient {
         // Create silent request
         const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
         const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
-            serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger),
+            serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled),
             requestAuthority: silentRequest.authority,
             requestAzureCloudOptions: silentRequest.azureCloudOptions,
             requestExtraQueryParameters: silentRequest.extraQueryParameters,
@@ -19661,21 +19792,32 @@ class SilentIframeClient extends StandardInteractionClient {
             ...request,
             codeChallenge: pkceCodes.challenge,
         };
-        let iframe;
-        if (request.httpMethod === HttpMethod$1.POST) {
-            iframe = await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-        }
-        else {
-            // Create authorize request url
-            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-            // Get the frame handle for the silent request
-            iframe = await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId);
-        }
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
         let responseString;
         try {
-            responseString = await invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+            const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If URL creation or navigation below throws before
+                 * responsePromise is awaited, the listener still rejects on
+                 * timeout. Swallow it here so it does not surface as an
+                 * unhandled rejection; the navigation error is propagated
+                 * instead.
+                 */
+            });
+            if (request.httpMethod === HttpMethod$1.POST) {
+                await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+            }
+            else {
+                // Create authorize request url
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+                // Navigate the iframe to the authorize request url
+                await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, navigateUrl, this.logger, correlationId);
+            }
+            responseString = await responsePromise;
         }
         finally {
             invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
@@ -19710,7 +19852,7 @@ class SilentRefreshClient extends StandardInteractionClient {
             // Make sure any passed redirectUri is converted to an absolute URL - redirectUri is not a required parameter for refresh token redemption so only include if explicitly provided
             silentRequest.redirectUri = getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
         }
-        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         const refreshTokenClient = await this.createRefreshTokenClient({
             serverTelemetryManager,
             authorityUrl: silentRequest.authority,
@@ -19790,7 +19932,7 @@ class SilentAuthCodeClient extends StandardInteractionClient {
          * Each auth request creates a new instance of *Client so we can safely use this.correlationId.
          */
         this.correlationId);
-        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger);
+        const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, undefined, this.config.system.serverTelemetryEnabled);
         try {
             // Create auth code request (PKCE not needed)
             const authCodeRequest = {
@@ -20143,6 +20285,8 @@ class StandardController {
         // Preflight request
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.verbose("0os66p", correlationId);
+        redirectPreflightCheck(this.initialized, this.config);
+        this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
         const atrMeasurement = this.performanceClient.startMeasurement(AcquireTokenPreRedirect, correlationId);
         atrMeasurement.add({
             scenarioId: request.scenarioId,
@@ -20160,9 +20304,7 @@ class StandardController {
             return navigate;
         };
         try {
-            redirectPreflightCheck(this.initialized, this.config);
             enforceResourceParameter(this.config.auth.isMcp, request);
-            this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Redirect, request);
             let result;
             if (this.platformAuthProvider &&