@equinor/fusion-framework-vite-plugin-spa 4.0.7 → 4.0.9

package/dist/html/bootstrap.js

@@ -5218,6 +5218,79 @@ class BaseConfigBuilder {
     }
 }
 
+/**
+ * Error thrown when a required module fails to initialize within the expected
+ * timeout window.
+ *
+ * Indicates a circular dependency or a module that never resolves.
+ */
+class RequiredModuleTimeoutError extends Error {
+    constructor() {
+        super('Module initialization timed out');
+        this.name = 'RequiredModuleTimeoutError';
+    }
+}
+
+/** Shared base segment for module configurator lifecycle event names. */
+const ModuleConfiguratorEventBaseName = 'ModuleConfigurator';
+/**
+ * Event names emitted by `ModulesConfigurator` and its lifecycle phase helpers.
+ *
+ * Use this map instead of inline string literals when emitting or filtering
+ * configurator lifecycle events. Each value follows the
+ * `ModuleConfigurator.{name}.{state}` convention. The emitted names are still
+ * prefixed by `ModulesConfigurator::_registerEvent` at runtime.
+ */
+const ModuleConfiguratorEventName = {
+    ModuleConfigAdded: `${ModuleConfiguratorEventBaseName}.module.configAdded`,
+    OnConfiguredAdded: `${ModuleConfiguratorEventBaseName}.onConfigured.added`,
+    OnInitializedAdded: `${ModuleConfiguratorEventBaseName}.onInitialized.added`,
+    PluginAdded: `${ModuleConfiguratorEventBaseName}.plugin.added`,
+    InitializeConfigLoaded: `${ModuleConfiguratorEventBaseName}.config.loaded`,
+    InitializeInstanceInitialized: `${ModuleConfiguratorEventBaseName}.instance.initialized`,
+    Initialize: `${ModuleConfiguratorEventBaseName}.initialize.complete`,
+    ConfiguratorCreated: `${ModuleConfiguratorEventBaseName}.configurator.created`,
+    ConfiguratorFailed: `${ModuleConfiguratorEventBaseName}.configurator.failed`,
+    ModulePostConfigured: `${ModuleConfiguratorEventBaseName}.module.postConfigured`,
+    ModulePostConfigureError: `${ModuleConfiguratorEventBaseName}.module.postConfigureError`,
+    PostConfigureHooks: `${ModuleConfiguratorEventBaseName}.postConfigureHooks.started`,
+    PostConfigureHooksComplete: `${ModuleConfiguratorEventBaseName}.postConfigureHooks.complete`,
+    PostConfigureHooksError: `${ModuleConfiguratorEventBaseName}.postConfigureHooks.error`,
+    ModuleInitializeError: `${ModuleConfiguratorEventBaseName}.module.initializeError`,
+    ModuleInitializing: `${ModuleConfiguratorEventBaseName}.module.initializing`,
+    ProviderNotBaseModuleProvider: `${ModuleConfiguratorEventBaseName}.provider.invalidBase`,
+    ProviderVersionWarning: `${ModuleConfiguratorEventBaseName}.provider.versionMissing`,
+    ModuleInitialized: `${ModuleConfiguratorEventBaseName}.module.initialized`,
+    RequireInstanceModuleNotDefined: `${ModuleConfiguratorEventBaseName}.requireInstance.moduleNotDefined`,
+    RequireInstanceModuleAlreadyInitialized: `${ModuleConfiguratorEventBaseName}.requireInstance.moduleAlreadyInitialized`,
+    RequireInstanceAwaitingModule: `${ModuleConfiguratorEventBaseName}.requireInstance.awaitingModule`,
+    RequireInstanceTimeout: `${ModuleConfiguratorEventBaseName}.requireInstance.timeout`,
+    RequireInstanceModuleResolved: `${ModuleConfiguratorEventBaseName}.requireInstance.moduleResolved`,
+    ModuleInitializeComplete: `${ModuleConfiguratorEventBaseName}.modules.initializeComplete`,
+    InitializeComplete: `${ModuleConfiguratorEventBaseName}.initialize.instanceComplete`,
+    ConfiguratorPostInitializeStart: `${ModuleConfiguratorEventBaseName}.postInitialize.started`,
+    ModulePostInitializeStart: `${ModuleConfiguratorEventBaseName}.modulePostInitialize.started`,
+    ModulePostInitializeComplete: `${ModuleConfiguratorEventBaseName}.modulePostInitialize.complete`,
+    ModulePostInitializeError: `${ModuleConfiguratorEventBaseName}.modulePostInitialize.error`,
+    PostInitializeComplete: `${ModuleConfiguratorEventBaseName}.postInitialize.complete`,
+    PostInitializeCompleteNoHooks: `${ModuleConfiguratorEventBaseName}.postInitialize.noHooks`,
+    PostInitializeHooks: `${ModuleConfiguratorEventBaseName}.postInitializeHooks.started`,
+    PostInitializeHooksComplete: `${ModuleConfiguratorEventBaseName}.postInitializeHooks.complete`,
+    PostInitializeHooksError: `${ModuleConfiguratorEventBaseName}.postInitializeHooks.error`,
+    PluginsRegister: `${ModuleConfiguratorEventBaseName}.plugins.registering`,
+    PluginRegistered: `${ModuleConfiguratorEventBaseName}.plugin.registered`,
+    PluginRegisterError: `${ModuleConfiguratorEventBaseName}.plugin.registerError`,
+    PluginsRegistered: `${ModuleConfiguratorEventBaseName}.plugins.registered`,
+    Dispose: `${ModuleConfiguratorEventBaseName}.dispose.started`,
+    PluginsDisposing: `${ModuleConfiguratorEventBaseName}.plugins.disposing`,
+    PluginDisposed: `${ModuleConfiguratorEventBaseName}.plugin.disposed`,
+    PluginDisposeError: `${ModuleConfiguratorEventBaseName}.plugin.disposeError`,
+    ModulesDispose: `${ModuleConfiguratorEventBaseName}.modules.disposing`,
+    ModuleDisposed: `${ModuleConfiguratorEventBaseName}.module.disposed`,
+    ModuleDisposeError: `${ModuleConfiguratorEventBaseName}.module.disposeError`,
+    ModulesDisposed: `${ModuleConfiguratorEventBaseName}.modules.disposed`,
+};
+
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /**
  * Defines the severity levels for module events.
@@ -5238,6 +5311,170 @@ var ModuleEventLevel;
     ModuleEventLevel[ModuleEventLevel["Critical"] = 4] = "Critical";
 })(ModuleEventLevel || (ModuleEventLevel = {}));
 
+// biome-ignore-all lint/suspicious/noExplicitAny: internal type-erased dispatch — the configure phase coordinates opaque module configs without knowing their concrete shapes
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/**
+ * Creates the raw module config map by calling each module's `configure` factory.
+ *
+ * Runs all module `configure(ref)` calls concurrently via `mergeMap` and
+ * accumulates results into a single config object. The object is seeded with
+ * `onAfterConfiguration` and `onAfterInit` helpers that allow modules to
+ * register additional post-phase callbacks during configuration.
+ *
+ * @param ctx - The configure phase context.
+ * @param ref - Optional reference forwarded to each module's configure factory.
+ * @returns A promise resolving to the merged module config map.
+ * @internal
+ */
+async function createModuleConfigs(ctx, ref) {
+    const { modules, afterConfiguration, afterInit, registerEvent } = ctx;
+    const config$ = from(modules).pipe(mergeMap(async (module) => {
+        const configStart = performance.now();
+        try {
+            const configurator = await module.configure?.(ref);
+            const configLoadTime = Math.round(performance.now() - configStart);
+            registerEvent({
+                level: ModuleEventLevel.Debug,
+                name: ModuleConfiguratorEventName.ConfiguratorCreated,
+                message: `Configurator created for ${module.name} in ${configLoadTime}ms`,
+                properties: {
+                    moduleName: module.name,
+                    moduleVersion: module.version?.toString() || 'unknown',
+                    configLoadTime,
+                },
+                metric: configLoadTime,
+            });
+            return { [module.name]: configurator };
+        }
+        catch (err) {
+            registerEvent({
+                level: ModuleEventLevel.Error,
+                name: ModuleConfiguratorEventName.ConfiguratorFailed,
+                message: `Failed to create configurator for ${module.name}`,
+                properties: {
+                    moduleName: module.name,
+                    moduleVersion: module.version?.toString() || 'unknown',
+                },
+                metric: Math.round(performance.now() - configStart),
+                error: err,
+            });
+            throw err;
+        }
+    }), reduce((acc, module) => Object.assign(acc, module), 
+    // Seed the config object with hooks so modules can register post-phase callbacks
+    // during their own configure factory (a common pattern for cross-module wiring).
+    {
+        onAfterConfiguration(cb) {
+            afterConfiguration.push(cb);
+        },
+        onAfterInit(cb) {
+            afterInit.push(cb);
+        },
+    }));
+    return lastValueFrom(config$);
+}
+/**
+ * Runs the post-configure phase: calls each module's `postConfigure` hook and
+ * then invokes all registered `afterConfiguration` callbacks.
+ *
+ * Module `postConfigure` failures are caught individually and emitted as
+ * Warning events so one failing module cannot block others.
+ *
+ * @param ctx - The configure phase context.
+ * @param config - The merged module config map produced by {@link createModuleConfigs}.
+ * @returns A promise resolving when all post-configure hooks have settled.
+ * @internal
+ */
+async function runPostConfigureHooks(ctx, config) {
+    const { modules, afterConfiguration, registerEvent } = ctx;
+    // Run each module's postConfigure hook; failures are isolated so one
+    // failing module does not prevent others from completing post-configure.
+    await Promise.allSettled(modules
+        .filter((module) => !!module.postConfigure)
+        .map(async (module) => {
+        try {
+            const postConfigStart = performance.now();
+            await module.postConfigure?.(config);
+            registerEvent({
+                level: ModuleEventLevel.Debug,
+                name: ModuleConfiguratorEventName.ModulePostConfigured,
+                message: `Module ${module.name} post-configured successfully`,
+                properties: {
+                    moduleName: module.name,
+                    moduleVersion: module.version?.toString() || 'unknown',
+                    postConfigTime: Math.round(performance.now() - postConfigStart),
+                },
+            });
+        }
+        catch (err) {
+            registerEvent({
+                level: ModuleEventLevel.Warning,
+                name: ModuleConfiguratorEventName.ModulePostConfigureError,
+                message: `Module ${module.name} post-configure failed`,
+                properties: {
+                    moduleName: module.name,
+                    moduleVersion: module.version?.toString() || 'unknown',
+                },
+                error: err,
+            });
+        }
+    }));
+    if (!afterConfiguration.length)
+        return;
+    // Run all registered afterConfiguration callbacks. These were added either
+    // by addConfig's afterConfig or via config.onAfterConfiguration inside a
+    // module's configure factory.
+    try {
+        registerEvent({
+            level: ModuleEventLevel.Debug,
+            name: ModuleConfiguratorEventName.PostConfigureHooks,
+            message: `Post configure hooks [${afterConfiguration.length}] called`,
+        });
+        const postConfigHooksStart = performance.now();
+        await Promise.allSettled(afterConfiguration.map((x) => Promise.resolve(x(config))));
+        const postConfigHooksTime = Math.round(performance.now() - postConfigHooksStart);
+        registerEvent({
+            level: ModuleEventLevel.Debug,
+            name: ModuleConfiguratorEventName.PostConfigureHooksComplete,
+            message: 'Post configure hooks complete',
+            properties: {
+                count: afterConfiguration.length,
+                postConfigHooksTime,
+            },
+            metric: postConfigHooksTime,
+        });
+    }
+    catch (err) {
+        registerEvent({
+            level: ModuleEventLevel.Warning,
+            name: ModuleConfiguratorEventName.PostConfigureHooksError,
+            message: 'Post configure hook failed',
+            error: err,
+        });
+    }
+}
+/**
+ * Runs the full configure lifecycle phase for a set of modules.
+ *
+ * Orchestrates three sub-steps in order:
+ * 1. {@link createModuleConfigs} — call each module's `configure(ref)` factory.
+ * 2. Apply all user-registered config callbacks (`_configs`) sequentially.
+ * 3. {@link runPostConfigureHooks} — call `postConfigure` and `afterConfiguration` hooks.
+ *
+ * @param ctx - The configure phase context.
+ * @param ref - Optional reference forwarded through all configure hooks.
+ * @returns A promise resolving to the fully configured module config map.
+ */
+async function runConfigurePhase(ctx, ref) {
+    // Step 1: Create raw config objects for all registered modules
+    const config = await createModuleConfigs(ctx, ref);
+    // Step 2: Apply all user-registered configuration callbacks concurrently.
+    await Promise.all(ctx.configs.map((cb) => Promise.resolve(cb(config, ref))));
+    // Step 3: Run module postConfigure hooks and afterConfiguration callbacks
+    await runPostConfigureHooks(ctx, config);
+    return config;
+}
+
 /**
  * Abstract base class for Fusion Framework module providers.
  *
@@ -5325,37 +5562,624 @@ class BaseModuleProvider {
     }
 }
 
-// Generated by genversion.
-const version$8 = '6.0.0';
+/**
+ * Initializes a single module and emits a `[name, instance]` tuple when complete.
+ *
+ * Validates that the module exposes an `initialize` method, calls it with the
+ * provided context, and emits lifecycle events for start, completion, and any
+ * provider contract warnings.
+ *
+ * @internal
+ */
+async function initializeModule(module, ctx) {
+    const { config, ref, requireInstance, hasModule, registerEvent } = ctx;
+    const key = module.name;
+    if (!module.initialize) {
+        const error = new Error(`Module ${module.name} does not have initialize method`);
+        error.name = 'ModuleInitializeError';
+        registerEvent({
+            level: ModuleEventLevel.Error,
+            name: ModuleConfiguratorEventName.ModuleInitializeError,
+            message: error.message,
+            properties: {
+                moduleName: module.name,
+                moduleVersion: module.version?.toString() || 'unknown',
+            },
+            error,
+        });
+        throw error;
+    }
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.ModuleInitializing,
+        message: `Initializing module ${module.name}`,
+        properties: {
+            moduleName: module.name,
+            moduleVersion: module.version?.toString() || 'unknown',
+        },
+    });
+    const moduleInitStart = performance.now();
+    const instance = await module.initialize({
+        ref,
+        config: config[key],
+        requireInstance,
+        hasModule,
+    });
+    // Warn when providers deviate from the expected base class — these modules
+    // may lack version tracking and standard provider interfaces.
+    if (!(instance instanceof BaseModuleProvider)) {
+        registerEvent({
+            level: ModuleEventLevel.Warning,
+            name: ModuleConfiguratorEventName.ProviderNotBaseModuleProvider,
+            message: `Provider for module ${module.name} does not extend BaseModuleProvider`,
+            properties: {
+                moduleName: module.name,
+                moduleVersion: module.version?.toString() || 'unknown',
+            },
+        });
+    }
+    // Providers should expose a version string for diagnostics and compatibility checks.
+    // Warn when absent so module authors catch missing version early rather than at runtime.
+    const maybeVersioned = instance;
+    if (!maybeVersioned.version) {
+        registerEvent({
+            level: ModuleEventLevel.Warning,
+            name: ModuleConfiguratorEventName.ProviderVersionWarning,
+            message: `Provider for module ${module.name} does not expose version`,
+            properties: {
+                moduleName: module.name,
+                moduleVersion: module.version?.toString() || 'unknown',
+            },
+        });
+    }
+    const moduleInitTime = Math.round(performance.now() - moduleInitStart);
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.ModuleInitialized,
+        message: `Module ${module.name} initialized in ${moduleInitTime}ms`,
+        properties: {
+            moduleName: module.name,
+            moduleVersion: module.version?.toString() || 'unknown',
+            providerName: typeof instance,
+            providerVersion: maybeVersioned.version?.toString() || 'unknown',
+            moduleInitTime,
+        },
+        metric: moduleInitTime,
+    });
+    return [key, instance];
+}
+/**
+ * Creates a `requireInstance` resolver for use during module initialization.
+ *
+ * `requireInstance` is passed into each module's `initialize` call so it can
+ * declare dependencies on other modules without knowing whether those modules
+ * have already finished initializing. The resolver waits up to `wait` seconds
+ * for the target module to appear in the shared `instance$` subject.
+ *
+ * @param moduleNames - Names of all modules registered in this initialization run.
+ * @param instance$ - Shared subject accumulating initialized module instances.
+ * @param registerEvent - Function to emit lifecycle events.
+ * @returns A `requireInstance` function matching the shape expected by `ModuleInitializerArgs`.
+ * @internal
+ */
+function createRequireInstance(moduleNames, instance$, registerEvent) {
+    // The implementation signature is concrete (name: string) but the public contract
+    // must be the generic shape expected by ModuleInitializerArgs. Module names are
+    // always strings at runtime — the keyof-derived `string | number` constraint comes
+    // from TypeScript's keyof semantics, not actual usage.
+    return function requireInstance(name, wait = 60) {
+        // Fail fast if the caller requests a module that was never registered —
+        // this almost always indicates a misconfiguration rather than a timing issue.
+        if (!moduleNames.includes(name)) {
+            const error = new Error(`Cannot require [${String(name)}] since module is not defined!`);
+            error.name = 'ModuleNotDefinedError';
+            registerEvent({
+                level: ModuleEventLevel.Error,
+                name: ModuleConfiguratorEventName.RequireInstanceModuleNotDefined,
+                message: error.message,
+                properties: { moduleName: String(name), wait },
+                error,
+            });
+            throw error;
+        }
+        // Short-circuit: module is already in the accumulated instance object
+        if (instance$.value[name]) {
+            registerEvent({
+                level: ModuleEventLevel.Debug,
+                name: ModuleConfiguratorEventName.RequireInstanceModuleAlreadyInitialized,
+                message: `Module [${String(name)}] is already initialized, skipping queue`,
+                properties: { moduleName: String(name), wait },
+            });
+            return Promise.resolve(instance$.value[name]);
+        }
+        const requireStart = performance.now();
+        registerEvent({
+            level: ModuleEventLevel.Debug,
+            name: ModuleConfiguratorEventName.RequireInstanceAwaitingModule,
+            message: `Awaiting module [${String(name)}] initialization, timeout ${wait}s`,
+            properties: { moduleName: String(name), wait },
+        });
+        // Wait for the module to appear in the shared instance subject, up to `wait` seconds.
+        return firstValueFrom(instance$.pipe(
+        // Ignore emissions until the requested module has been added to the instance map.
+        filter((x) => !!x[name]), 
+        // Resolve the dependency promise with the provider instance, not the full module map.
+        map$1((x) => x[name]), 
+        // Convert unresolved dependencies into a typed timeout error with lifecycle diagnostics.
+        timeout({
+            // requireInstance accepts seconds; RxJS timeout expects milliseconds.
+            each: wait * 1000,
+            with: () => throwError(() => {
+                const error = new RequiredModuleTimeoutError();
+                registerEvent({
+                    level: ModuleEventLevel.Error,
+                    name: ModuleConfiguratorEventName.RequireInstanceTimeout,
+                    message: `Module [${String(name)}] initialization timed out after ${wait}s`,
+                    properties: { moduleName: String(name), wait },
+                    error,
+                });
+                return error;
+            }),
+        }), 
+        // Emit timing diagnostics only after the dependency has actually resolved.
+        tap(() => {
+            const requireTime = Math.round(performance.now() - requireStart);
+            registerEvent({
+                level: ModuleEventLevel.Debug,
+                name: ModuleConfiguratorEventName.RequireInstanceModuleResolved,
+                message: `Module [${String(name)}] required in ${requireTime}ms`,
+                properties: { moduleName: String(name), wait, requireTime },
+                metric: requireTime,
+            });
+        })));
+    };
+}
+/**
+ * Runs the initialize lifecycle phase for all registered modules.
+ *
+ * Initializes all modules **concurrently** using `mergeMap`. Cross-module
+ * dependency ordering is handled lazily through `requireInstance`, which
+ * waits for a peer module's `initialize` call to complete before resolving.
+ *
+ * Each initialized provider is accumulated into a shared `BehaviorSubject` so
+ * that `requireInstance` callers see updates as soon as a dependency is ready.
+ *
+ * @param ctx - The initialize phase context.
+ * @param config - The merged module config map produced by the configure phase.
+ * @param ref - Optional reference forwarded to each module's `initialize` call.
+ * @returns A promise resolving to the sealed map of initialized module providers.
+ * @throws {Error} When a module's `initialize` method is missing.
+ * @throws {RequiredModuleTimeoutError} When a required dependency does not
+ *   initialize within its timeout window.
+ */
+async function runInitializePhase(ctx, config, ref) {
+    const { modules, registerEvent } = ctx;
+    // Fast-path: no modules registered — return a sealed empty instance immediately
+    // to avoid a subscribe/lastValueFrom race on an already-completed observable.
+    if (modules.length === 0) {
+        return Object.seal({});
+    }
+    const moduleNames = modules.map((m) => m.name);
+    // Accumulates initialized module providers; BehaviorSubject lets requireInstance
+    // reactively wait for a dependency to appear without polling.
+    const instance$ = new BehaviorSubject({});
+    const hasModule = (name) => moduleNames.includes(name);
+    const requireInstance = createRequireInstance(moduleNames, instance$, registerEvent);
+    // Initialize all modules concurrently; modules that depend on peers will
+    // suspend inside requireInstance until the dependency resolves.
+    const init$ = from(modules).pipe(mergeMap((module) => initializeModule(module, { config, ref, requireInstance, hasModule, registerEvent })));
+    const initStart = performance.now();
+    // Accumulate module providers into the shared instance subject as each resolves.
+    // Completing the subject signals that all modules are initialized.
+    init$.subscribe({
+        next: ([name, module]) => {
+            instance$.next(Object.assign(instance$.value, { [name]: module }));
+        },
+        error: (err) => {
+            registerEvent({
+                level: ModuleEventLevel.Error,
+                name: ModuleConfiguratorEventName.ModuleInitializeError,
+                message: `Failed to initialize module ${err.name || 'unknown'}`,
+                error: err,
+            });
+            instance$.error(err);
+        },
+        complete: () => {
+            const loadTime = Math.round(performance.now() - initStart);
+            registerEvent({
+                level: ModuleEventLevel.Debug,
+                name: ModuleConfiguratorEventName.ModuleInitializeComplete,
+                message: `All modules initialized in ${loadTime}ms`,
+                properties: {
+                    modules: Object.keys(instance$.value).join(', '),
+                    loadTime,
+                },
+                metric: loadTime,
+            });
+            instance$.complete();
+        },
+    });
+    const instanceInitStart = performance.now();
+    const instance = await lastValueFrom(instance$);
+    const initTime = Math.round(performance.now() - instanceInitStart);
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.InitializeComplete,
+        message: `Modules instance created in ${initTime}ms`,
+        properties: {
+            modules: Object.keys(instance).join(', '),
+            initTime,
+        },
+        metric: initTime,
+    });
+    Object.seal(instance);
+    return instance;
+}
 
+// biome-ignore-all lint/suspicious/noExplicitAny: internal type-erased dispatch — the post-initialize phase forwards opaque instances without inspecting their concrete shapes
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /**
- * Error thrown when a required module fails to initialize within the specified timeout period.
+ * Runs the post-initialize lifecycle phase for all registered modules.
+ *
+ * Executes two sub-steps in order:
+ * 1. Calls each module's `postInitialize` hook (if defined) concurrently.
+ *    Individual failures are caught and emitted as Warning events so one
+ *    failing module cannot block others.
+ * 2. Runs all registered `afterInit` callbacks concurrently via `Promise.allSettled`.
+ *
+ * @param ctx - The post-initialize phase context.
+ * @param instance - The sealed module instance map produced by the initialize phase.
+ * @param ref - Optional reference forwarded to each module's `postInitialize` call.
+ * @returns A promise resolving when all post-initialize hooks and callbacks have settled.
+ */
+async function runPostInitializePhase(ctx, instance, ref) {
+    const { modules, afterInit, registerEvent } = ctx;
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.ConfiguratorPostInitializeStart,
+        message: `Post-initializing all modules [${Object.keys(instance).length}]`,
+        properties: { modules: Object.keys(instance).join(', ') },
+    });
+    // Run postInitialize hooks for modules that declare them. Failures are caught
+    // per-module via catchError so one failure does not abort the others.
+    const postInitialize$ = from(modules).pipe(filter((module) => !!module.postInitialize), tap((module) => {
+        registerEvent({
+            level: ModuleEventLevel.Debug,
+            name: ModuleConfiguratorEventName.ModulePostInitializeStart,
+            message: `Module ${module.name} is being post-initialized`,
+            properties: {
+                moduleName: module.name,
+                moduleVersion: module.version?.toString() || 'unknown',
+            },
+        });
+    }), mergeMap((module) => {
+        const postInitStart = performance.now();
+        return from(module.postInitialize({
+            ref,
+            modules: instance,
+            instance: instance[module.name],
+        })).pipe(tap(() => {
+            const postInitTime = Math.round(performance.now() - postInitStart);
+            registerEvent({
+                level: ModuleEventLevel.Debug,
+                name: ModuleConfiguratorEventName.ModulePostInitializeComplete,
+                message: `Module ${module.name} has been post-initialized in ${postInitTime}ms`,
+                metric: postInitTime,
+                properties: {
+                    moduleName: module.name,
+                    moduleVersion: module.version?.toString() || 'unknown',
+                    postInitTime,
+                },
+            });
+        }), defaultIfEmpty(null), catchError((err) => {
+            registerEvent({
+                level: ModuleEventLevel.Warning,
+                name: ModuleConfiguratorEventName.ModulePostInitializeError,
+                message: `Module ${module.name} post-initialize failed`,
+                properties: {
+                    moduleName: module.name,
+                    moduleVersion: module.version?.toString() || 'unknown',
+                },
+                error: err,
+            });
+            // Swallow module-level errors — a failing postInitialize should not
+            // prevent other modules from completing their post-initialize work.
+            return EMPTY;
+        }));
+    }), defaultIfEmpty(null));
+    const postInitStart = performance.now();
+    await lastValueFrom(postInitialize$);
+    const postInitTime = Math.round(performance.now() - postInitStart);
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.PostInitializeComplete,
+        message: `Post-initialization of all modules completed in ${postInitTime}ms`,
+        properties: { modules: Object.keys(instance).join(', '), postInitTime },
+        metric: postInitTime,
+    });
+    if (!afterInit.length) {
+        registerEvent({
+            level: ModuleEventLevel.Debug,
+            name: ModuleConfiguratorEventName.PostInitializeCompleteNoHooks,
+            message: 'Post-initialization complete',
+            properties: { modules: Object.keys(instance).join(', '), postInitCompleteTime: postInitTime },
+        });
+        return;
+    }
+    // Run all registered afterInit callbacks. These were added either by
+    // addConfig's afterInit or via onInitialized on the configurator.
+    try {
+        registerEvent({
+            level: ModuleEventLevel.Debug,
+            name: ModuleConfiguratorEventName.PostInitializeHooks,
+            message: `Executing post-initialize hooks [${afterInit.length}]`,
+            properties: { hooks: afterInit.map((x) => x.name || 'anonymous').join(', ') },
+        });
+        const afterInitStart = performance.now();
+        await Promise.allSettled(afterInit.map((x) => Promise.resolve(x(instance))));
+        const afterInitTime = Math.round(performance.now() - afterInitStart);
+        registerEvent({
+            level: ModuleEventLevel.Debug,
+            name: ModuleConfiguratorEventName.PostInitializeHooksComplete,
+            message: `Post-initialize hooks completed in ${afterInitTime}ms`,
+            properties: {
+                hooks: afterInit.map((x) => x.name || 'anonymous').join(', '),
+                afterInitTime,
+            },
+            metric: afterInitTime,
+        });
+    }
+    catch (err) {
+        registerEvent({
+            level: ModuleEventLevel.Warning,
+            name: ModuleConfiguratorEventName.PostInitializeHooksError,
+            message: 'Post-initialize hooks failed',
+            properties: { hooks: afterInit.map((x) => x.name || 'anonymous').join(', ') },
+            error: err,
+        });
+    }
+    const postInitCompleteTime = Math.round(performance.now() - postInitStart);
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.PostInitializeComplete,
+        message: 'Post-initialization complete',
+        properties: { modules: Object.keys(instance).join(', '), postInitCompleteTime },
+    });
+}
+
+// biome-ignore-all lint/suspicious/noExplicitAny: internal type-erased dispatch — plugins are registered with concrete module maps but stored erased by the orchestrator
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/**
+ * Checks whether a plugin return value should be treated as dispose-time cleanup.
  *
- * This error indicates that a module dependency was not available when expected,
- * typically due to initialization delays or circular dependencies.
+ * Plugins may return either a plain callback or an object with a `dispose` method.
+ * Any other value is ignored so plugin authors can return `undefined` when no
+ * cleanup is needed.
+ *
+ * @param value - Value returned by a registered plugin callback.
+ * @returns True when the value is a valid plugin teardown registration.
  */
-class RequiredModuleTimeoutError extends Error {
-    constructor() {
-        super('Module initialization timed out');
-        this.name = 'RequiredModuleTimeoutError';
+function isPluginTeardown(value) {
+    return (typeof value === 'function' ||
+        (typeof value === 'object' &&
+            value !== null &&
+            'dispose' in value &&
+            typeof value.dispose === 'function'));
+}
+/**
+ * Runs configurator plugins after modules are ready.
+ *
+ * The plugin phase is the final initialization step before `initialize()`
+ * resolves. Each plugin receives the sealed module instance map and optional
+ * initialization reference, which makes this phase suitable for application
+ * side effects such as telemetry bridges, global event listeners, and runtime
+ * subscriptions that require multiple initialized module providers.
+ *
+ * Plugin callbacks run concurrently. Failures are isolated and emitted as
+ * warning events so one failing side effect cannot block application rendering.
+ * Returned teardown callbacks are stored for the dispose phase and are invoked
+ * before module `dispose` hooks.
+ *
+ * @param ctx - The plugin phase context.
+ * @param modules - The initialized module instance map.
+ * @param ref - Optional reference forwarded from module initialization.
+ * @returns A promise resolving when all plugin callbacks have settled.
+ */
+async function runPluginPhase(ctx, modules, ref) {
+    const { plugins, teardowns, registerEvent } = ctx;
+    if (!plugins.length)
+        return;
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.PluginsRegister,
+        message: `Registering plugins [${plugins.length}]`,
+        properties: { count: plugins.length },
+    });
+    const pluginRegistrations = await Promise.all(plugins.map(async (plugin) => {
+        const pluginStart = performance.now();
+        const name = plugin.name || 'anonymous';
+        try {
+            const teardown = await plugin({ modules, ref });
+            const pluginTime = Math.round(performance.now() - pluginStart);
+            registerEvent({
+                level: ModuleEventLevel.Debug,
+                name: ModuleConfiguratorEventName.PluginRegistered,
+                message: `Plugin ${name} registered in ${pluginTime}ms`,
+                properties: { name, pluginTime },
+                metric: pluginTime,
+            });
+            return isPluginTeardown(teardown) ? teardown : undefined;
+        }
+        catch (err) {
+            registerEvent({
+                level: ModuleEventLevel.Warning,
+                name: ModuleConfiguratorEventName.PluginRegisterError,
+                message: `Plugin ${name} registration failed`,
+                properties: { name },
+                error: err,
+            });
+            return undefined;
+        }
+    }));
+    for (const teardown of pluginRegistrations) {
+        if (teardown) {
+            teardowns.push(teardown);
+        }
+    }
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.PluginsRegistered,
+        message: 'Plugin registration complete',
+        properties: { count: plugins.length, teardowns: teardowns.length },
+    });
+}
+
+function getPluginTeardownName(teardown) {
+    return typeof teardown === 'function' ? teardown.name || 'anonymous' : 'dispose';
+}
+async function runPluginTeardown(teardown) {
+    if (typeof teardown === 'function') {
+        await teardown();
+        return;
     }
+    await teardown.dispose();
 }
+/**
+ * Runs the dispose lifecycle phase for all registered modules.
+ *
+ * Calls each module's `dispose` hook (if defined) concurrently via
+ * `Promise.allSettled` so one failing module cannot block others from
+ * being torn down. After all hooks settle, the event stream is completed.
+ *
+ * @param ctx - The dispose phase context.
+ * @param instance - The initialized module instance map to tear down.
+ * @param ref - Optional reference forwarded to each module's `dispose` call.
+ * @returns A promise resolving when all module dispose hooks have settled and
+ *   the event stream has been completed.
+ */
+async function runDisposePhase(ctx, instance, ref) {
+    const { modules, registerEvent, event$, pluginTeardowns = [] } = ctx;
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.Dispose,
+        message: 'Disposing modules instance',
+        properties: { modules: Object.keys(instance).join(', ') },
+    });
+    if (pluginTeardowns.length) {
+        registerEvent({
+            level: ModuleEventLevel.Debug,
+            name: ModuleConfiguratorEventName.PluginsDisposing,
+            message: `Disposing plugins [${pluginTeardowns.length}]`,
+            properties: { count: pluginTeardowns.length },
+        });
+        // Tear down plugins before module providers so side effects can still access
+        // live providers while unsubscribing. LIFO mirrors common subscription stacks.
+        for (const teardown of pluginTeardowns.splice(0).reverse()) {
+            const name = getPluginTeardownName(teardown);
+            try {
+                await runPluginTeardown(teardown);
+                registerEvent({
+                    level: ModuleEventLevel.Debug,
+                    name: ModuleConfiguratorEventName.PluginDisposed,
+                    message: `Plugin ${name} disposed successfully`,
+                    properties: { name },
+                });
+            }
+            catch (err) {
+                registerEvent({
+                    level: ModuleEventLevel.Warning,
+                    name: ModuleConfiguratorEventName.PluginDisposeError,
+                    message: `Plugin ${name} dispose failed`,
+                    properties: { name },
+                    error: err,
+                });
+            }
+        }
+    }
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.ModulesDispose,
+        message: 'Disposing modules',
+        properties: { count: modules.length },
+    });
+    // Dispose all modules concurrently; failures are isolated per module so
+    // one bad teardown cannot leave other modules in an inconsistent state.
+    await Promise.allSettled(modules
+        .filter((module) => !!module.dispose)
+        .map(async (module) => {
+        if (!module.dispose)
+            return;
+        try {
+            await module.dispose({
+                ref,
+                modules: instance,
+                instance: instance[module.name],
+            });
+            registerEvent({
+                level: ModuleEventLevel.Debug,
+                name: ModuleConfiguratorEventName.ModuleDisposed,
+                message: `Module ${module.name} disposed successfully`,
+                properties: {
+                    moduleName: module.name,
+                    moduleVersion: module.version?.toString() || 'unknown',
+                },
+            });
+        }
+        catch (err) {
+            registerEvent({
+                level: ModuleEventLevel.Warning,
+                name: ModuleConfiguratorEventName.ModuleDisposeError,
+                message: `Module ${module.name} dispose failed`,
+                properties: {
+                    moduleName: module.name,
+                    moduleVersion: module.version?.toString() || 'unknown',
+                },
+                error: err,
+            });
+        }
+    }));
+    registerEvent({
+        level: ModuleEventLevel.Debug,
+        name: ModuleConfiguratorEventName.ModulesDisposed,
+        message: 'Module dispose complete',
+        properties: { count: modules.length },
+    });
+    // Complete the event stream last so all dispose events are captured before
+    // any subscriber teardown triggered by completion.
+    event$.complete();
+}
+
+// Generated by genversion.
+const version$8 = '6.1.0';
+
+// biome-ignore-all lint/suspicious/noExplicitAny: internal type-erased dispatch arrays — callbacks are registered with concrete module types but stored erased; the orchestrator never inspects these shapes itself
+/* eslint-disable @typescript-eslint/no-explicit-any */
 /**
  * Core orchestrator that drives the module lifecycle in Fusion Framework.
  *
- * `ModulesConfigurator` manages the full configure → initialize → dispose pipeline
- * for a set of modules. Consumers register modules via {@link addConfig} or
- * {@link configure}, then call {@link initialize} to produce a sealed
- * {@link ModulesInstance} whose properties are the initialized module providers.
+ * `ModulesConfigurator` manages the full **configure → post-configure → initialize →
+ * post-initialize → plugin → dispose** pipeline for a set of modules. Consumers
+ * register modules via {@link addConfig} or {@link configure}, then call
+ * {@link initialize} to produce a sealed {@link ModulesInstance} whose properties
+ * are the initialized module providers.
+ *
+ * ### Lifecycle phases (in execution order)
+ *
+ * | # | Phase | Entry point | Description |
+ * |---|-------|-------------|-------------|
+ * | 1 | **Configure** | `_configure` | Each module's `configure()` factory creates a config builder; registered callbacks mutate it. |
+ * | 2 | **Post-configure** | `_postConfigure` (inside `_configure`) | `postConfigure()` hooks and `onConfigured` callbacks run. |
+ * | 3 | **Initialize** | `_initialize` | Modules are initialized concurrently; cross-module dependencies are resolved through `requireInstance`. |
+ * | 4 | **Post-initialize** | `_postInitialize` | `postInitialize()` hooks and `onInitialized` callbacks run. |
+ * | 5 | **Plugin** | `_registerPlugins` (inside `initialize`) | Registered application plugins connect side effects after modules are ready. |
+ * | 6 | **Dispose** | `dispose` | Plugin teardowns and module `dispose()` hooks run; the event stream is completed. |
  *
- * The lifecycle phases executed during {@link initialize} are:
+ * ### Registering phase callbacks
  *
- * 1. **Configure** – each module’s `configure()` factory creates a config builder;
- *    registered callbacks mutate it; `postConfigure()` hooks run.
- * 2. **Initialize** – modules are initialized concurrently via `initialize()`;
- *    cross-module dependencies are resolved through `requireInstance()`.
- * 3. **Post-initialize** – `postInitialize()` hooks and `onInitialized` callbacks run.
+ * - **Per-module callbacks**: use `addConfig({ module, configure, afterConfig, afterInit })`.
+ * - **Global post-configure**: use `onConfigured(cb)`.
+ * - **Global post-initialize**: use `onInitialized(cb)`.
+ * - **Plugins**: use `registerPlugin(cb)` to connect side effects before render.
  *
  * All lifecycle transitions emit {@link ModuleEvent} entries on the {@link event$}
  * observable for telemetry and debugging.
@@ -5376,57 +6200,97 @@ class RequiredModuleTimeoutError extends Error {
  */
 class ModulesConfigurator {
     /**
-     * The class name used for event naming. This static property ensures
-     * the name is preserved through compilation and minification.
+     * Class name used as a namespace prefix for all emitted lifecycle events.
+     * Preserved as a static string so minification cannot change it at runtime.
      */
     static className = 'ModulesConfigurator';
     get version() {
         return version$8;
     }
-    // Buffer up to 100 events to prevent memory leaks while ensuring telemetry can capture
-    // module events during configuration. Telemetry attaches via mapConfiguratorEvents and
-    // needs to replay events that occurred before it was ready.
-    // Memory usage: ~24KB for 100 events at ~240 bytes each.
+    // Buffer up to 100 events to prevent memory leaks while ensuring telemetry
+    // can capture events that fire before a telemetry subscriber attaches.
+    // mapConfiguratorEvents relies on replay to receive events emitted during
+    // configuration before telemetry is wired up.
+    // Memory bound: ~24 KB at ~240 bytes/event × 100 events.
     #event$ = new ReplaySubject(100);
     get event$() {
         return this.#event$.asObservable();
     }
     /**
-     * Array of configuration callbacks.
+     * Registered configure-phase callbacks.
+     * Each entry is added by {@link addConfig} when a `configure` callback is provided.
      * @protected
-     * @sealed
      */
     _configs = [];
     /**
-     * Array of callbacks to be executed after configuration.
+     * Registered post-configure callbacks.
+     * Populated by {@link onConfigured} and by `afterConfig` entries in {@link addConfig}.
+     * Also exposed on the config object as `config.onAfterConfiguration` so modules
+     * can register additional hooks during their own configure factory.
+     *
+     * Typed as `any` because this is an internal dispatch array: callbacks are registered
+     * with concrete module-specific types but stored erased — the orchestrator never
+     * inspects the config shape itself, it only forwards it at call time.
+     * @protected
      */
     _afterConfiguration = [];
     /**
-     * Array of callbacks to be executed after initialization.
+     * Registered post-initialize callbacks.
+     * Populated by {@link onInitialized} and by `afterInit` entries in {@link addConfig}.
+     * Also exposed on the config object as `config.onAfterInit`.
+     *
+     * Typed as `any` for the same reason as {@link _afterConfiguration} — type-erased
+     * internal dispatch; concrete instance types are known at registration but not stored.
+     * @protected
      */
     _afterInit = [];
     /**
-     * Set of modules.
+     * Registered plugin callbacks.
+     *
+     * Plugins run after all modules have initialized and before initialize resolves.
+     * Typed as `any` because callbacks are registered with concrete module maps but
+     * stored erased by the base orchestrator.
+     * @protected
+     */
+    _plugins = [];
+    /**
+     * Teardown callbacks returned by registered plugins.
+     *
+     * Consumed during dispose and cleared after execution so repeated dispose calls
+     * do not run plugin cleanup more than once.
+     * @protected
+     */
+    _pluginTeardowns = [];
+    /**
+     * Set of all registered module descriptors.
+     * Uses a `Set` for automatic deduplication — the same module registered twice
+     * is treated as a single registration.
+     * @protected
      */
     _modules;
     /**
-     * Constructs a new ModulesConfigurator instance.
-     * @param modules - Optional array of modules to initialize with.
+     * Creates a new `ModulesConfigurator` with an optional initial set of modules.
+     *
+     * @param modules - Optional array of module descriptors to pre-register.
      */
     constructor(modules) {
-        // Use Set for efficient lookups and automatic deduplication of modules
         this._modules = new Set(modules);
     }
     /**
-     * Gets the array of modules.
-     * @returns Array of modules.
+     * Returns all registered module descriptors as an ordered array.
+     *
+     * @returns Array of registered modules in insertion order.
      */
     get modules() {
         return [...this._modules];
     }
     /**
-     * Configures the modules with the provided configurators.
-     * @param configs - Array of module configurators.
+     * Registers one or more module configurators.
+     *
+     * Convenience wrapper around {@link addConfig} for registering multiple
+     * modules in a single call.
+     *
+     * @param configs - One or more module configurator descriptors.
      */
     configure(...configs) {
         for (const x of configs) {
@@ -5434,15 +6298,21 @@ class ModulesConfigurator {
         }
     }
     /**
-     * Adds a module configurator.
-     * @param config - Module configurator.
+     * Registers a single module configurator.
+     *
+     * Adds the module to the known module set and registers the optional
+     * `configure`, `afterConfig`, and `afterInit` callbacks into their
+     * respective lifecycle phase arrays.
+     *
+     * @param config - The module configurator descriptor to register.
+     * @template T - The module type being registered.
      */
     addConfig(config) {
         const { module, afterConfig, afterInit, configure } = config;
         this._modules.add(module);
         this._registerEvent({
             level: ModuleEventLevel.Debug,
-            name: 'moduleConfigAdded',
+            name: ModuleConfiguratorEventName.ModuleConfigAdded,
             message: `Module configurator added for ${module.name}`,
             properties: {
                 moduleName: module.name,
@@ -5452,19 +6322,28 @@ class ModulesConfigurator {
                 afterInit: !!afterInit,
             },
         });
-        configure && this._configs.push((config, ref) => configure(config[module.name], ref));
-        afterConfig && this._afterConfiguration.push((config) => afterConfig(config[module.name]));
-        afterInit && this._afterInit.push((instances) => afterInit(instances[module.name]));
+        // Register each optional callback into its corresponding lifecycle phase array
+        if (configure)
+            this._configs.push((cfg, ref) => configure(cfg[module.name], ref));
+        if (afterConfig)
+            this._afterConfiguration.push((cfg) => afterConfig(cfg[module.name]));
+        if (afterInit)
+            this._afterInit.push((instances) => afterInit(instances[module.name]));
     }
     /**
-     * Registers a callback to be executed after configuration.
-     * @param cb - Callback function.
+     * Registers a callback for the post-configure phase.
+     *
+     * The callback receives the merged module config map after all `configure`
+     * callbacks have run and before module initialization begins.
+     *
+     * @param cb - Callback receiving the merged module config map.
+     * @template T - Additional modules to include in the config type.
      */
     onConfigured(cb) {
         this._afterConfiguration.push(cb);
         this._registerEvent({
             level: ModuleEventLevel.Debug,
-            name: 'addOnConfigured',
+            name: ModuleConfiguratorEventName.OnConfiguredAdded,
             message: 'Added onConfigured callback',
             properties: {
                 count: this._afterConfiguration.length,
@@ -5473,14 +6352,19 @@ class ModulesConfigurator {
         });
     }
     /**
-     * Registers a callback to be executed after initialization.
-     * @param cb - Callback function.
+     * Registers a callback for the post-initialize phase.
+     *
+     * The callback receives the sealed module instance after all modules have
+     * been initialized and their `postInitialize` hooks have run.
+     *
+     * @param cb - Callback receiving the sealed module instance.
+     * @template T - Additional modules to include in the instance type.
      */
     onInitialized(cb) {
         this._afterInit.push(cb);
         this._registerEvent({
             level: ModuleEventLevel.Debug,
-            name: 'addOnInitialized',
+            name: ModuleConfiguratorEventName.OnInitializedAdded,
             message: 'Added onInitialized callback',
             properties: {
                 count: this._afterInit.length,
@@ -5489,9 +6373,51 @@ class ModulesConfigurator {
         });
     }
     /**
-     * Initializes the modules with the provided reference.
-     * @param ref - Reference object.
-     * @returns Promise that resolves to the initialized module instance.
+     * Registers a plugin that connects side effects after modules are initialized.
+     *
+     * The callback runs after `postInitialize` and `onInitialized` callbacks have
+     * settled, but before {@link initialize} resolves. Return a teardown callback
+     * to clean up subscriptions or listeners during {@link dispose}.
+     *
+     * @param cb - Plugin callback receiving the initialized module map and optional ref.
+     * @template T - Additional modules to include in the plugin module map.
+     * @example
+     * ```typescript
+     * function connectContextTelemetry(args: FrameworkPluginArgs<[EventModule, TelemetryModule]>) {
+     *   const teardown = args.modules.event.addEventListener('context:changed', (event) => {
+     *     args.modules.telemetry.track('context.changed', event.detail);
+     *   });
+     *
+     *   return teardown;
+     * }
+     *
+     * configurator.registerPlugin(connectContextTelemetry);
+     * ```
+     */
+    registerPlugin(cb) {
+        this._plugins.push(cb);
+        this._registerEvent({
+            level: ModuleEventLevel.Debug,
+            name: ModuleConfiguratorEventName.PluginAdded,
+            message: 'Added plugin callback',
+            properties: {
+                count: this._plugins.length,
+                name: cb.name || 'anonymous',
+            },
+        });
+    }
+    /**
+     * Runs the full configure → initialize pipeline and returns a sealed module instance.
+     *
+     * Execution order:
+     * 1. {@link _configure} — configure phase (creates config, applies callbacks, post-configure hooks).
+     * 2. {@link _initialize} — initialize phase (concurrent module init with `requireInstance`).
+     * 3. {@link _postInitialize} — post-initialize phase (`postInitialize` hooks + `onInitialized` callbacks).
+     * 4. {@link _registerPlugins} — plugin phase (`registerPlugin` callbacks connect side effects).
+     *
+     * @param ref - Optional reference forwarded to all module lifecycle hooks.
+     * @returns A promise resolving to the sealed, initialized module instance.
+     * @template T - Additional modules to merge into the instance type.
      */
     async initialize(ref) {
         const configStart = performance.now();
@@ -5499,7 +6425,7 @@ class ModulesConfigurator {
         const configLoadTime = Math.round(performance.now() - configStart);
         this._registerEvent({
             level: ModuleEventLevel.Debug,
-            name: 'initialize.configLoaded',
+            name: ModuleConfiguratorEventName.InitializeConfigLoaded,
             message: `Modules configured in ${configLoadTime}ms`,
             properties: {
                 modules: this.modules.map((m) => m.name).join(', '),
@@ -5513,7 +6439,7 @@ class ModulesConfigurator {
         const instanceLoadTime = Math.round(performance.now() - instanceStart);
         this._registerEvent({
             level: ModuleEventLevel.Debug,
-            name: 'initialize.instanceInitialized',
+            name: ModuleConfiguratorEventName.InitializeInstanceInitialized,
             message: `Modules initialized in ${instanceLoadTime}ms`,
             properties: {
                 modules: this.modules.map((m) => m.name).join(', '),
@@ -5525,7 +6451,7 @@ class ModulesConfigurator {
         const totalLoadTime = configLoadTime + instanceLoadTime;
         this._registerEvent({
             level: ModuleEventLevel.Information,
-            name: 'initialize',
+            name: ModuleConfiguratorEventName.Initialize,
             message: `initialize in ${totalLoadTime}ms`,
             properties: {
                 modules: this.modules.map((m) => m.name).join(', '),
@@ -5536,560 +6462,126 @@ class ModulesConfigurator {
             metric: totalLoadTime,
         });
         await this._postInitialize(instance, ref);
-        return Object.seal(Object.assign({}, instance, {
+        const modules = Object.seal(Object.assign({}, instance, {
             dispose: () => this.dispose(instance),
         }));
+        await this._registerPlugins(modules, ref);
+        return modules;
     }
     /**
-     * Registers a module event by namespacing it with the configurator class name.
+     * Namespaces and emits a lifecycle event into the internal event stream.
      *
-     * Event names are prefixed with the constructor name to create unique, namespaced
-     * event identifiers that prevent conflicts between different configurator instances.
-     * For example, "moduleConfigAdded" becomes "ModulesConfigurator::moduleConfigAdded".
+     * The event name is prefixed with the configurator class name (e.g.
+     * `"ModulesConfigurator::ModuleConfigurator.module.configAdded"`) to prevent
+     * name collisions between nested configurators.
      *
-     * @param event - The module event to register
+     * @param event - The lifecycle event to emit.
      * @protected
      */
     _registerEvent(event) {
-        // Split event name by '::' to handle already-namespaced events
+        // Split on '::' to avoid double-prefixing already-namespaced event names
         const nameParts = event.name.split('::');
         this.#event$.next({
             ...event,
-            // Prefix the event name with the configurator class name
             name: `${this.constructor.className}::${nameParts[nameParts.length - 1]}`,
         });
     }
     /**
-     * Configures the modules with the provided reference.
-     * @param ref - Reference object.
-     * @returns Promise that resolves to the module configuration.
+     * Runs the configure lifecycle phase.
+     *
+     * Delegates to {@link runConfigurePhase} which creates module config builders,
+     * applies registered callbacks, and runs post-configure hooks.
+     *
+     * Override this method in a subclass to customize the configure phase.
+     *
+     * @param ref - Optional reference forwarded to module configure factories.
+     * @returns A promise resolving to the merged module config map.
+     * @protected
      */
     async _configure(ref) {
-        const config = await this._createConfig(ref);
-        await Promise.all(this._configs.map((x) => Promise.resolve(x(config, ref))));
-        await this._postConfigure(config);
-        return config;
+        return runConfigurePhase({
+            modules: this.modules,
+            configs: this._configs,
+            afterConfiguration: this._afterConfiguration,
+            afterInit: this._afterInit,
+            registerEvent: this._registerEvent.bind(this),
+        }, ref);
     }
     /**
-     * Creates the module configuration with the provided reference.
-     * @param ref - Reference object.
-     * @returns Promise that resolves to the module configuration.
+     * Runs the initialize lifecycle phase.
+     *
+     * Delegates to {@link runInitializePhase} which initializes all modules
+     * concurrently and resolves cross-module dependencies through `requireInstance`.
+     *
+     * Override this method in a subclass to customize the initialize phase.
+     *
+     * @param config - The merged module config map from the configure phase.
+     * @param ref - Optional reference forwarded to each module's `initialize` call.
+     * @returns A promise resolving to the sealed map of initialized module providers.
+     * @protected
      */
-    _createConfig(ref) {
-        const { modules, _afterConfiguration, _afterInit } = this;
-        const config$ = from(modules).pipe(
-        // TODO: Add proper error handling for individual module config creation failures
-        mergeMap(async (module) => {
-            const configStart = performance.now();
-            try {
-                const configurator = await module.configure?.(ref);
-                const configLoadTime = Math.round(performance.now() - configStart);
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_createConfig.configuratorCreated',
-                    message: `Configurator created for ${module.name} in ${configLoadTime}ms`,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                        configLoadTime,
-                    },
-                    metric: configLoadTime,
-                });
-                return { [module.name]: configurator };
-            }
-            catch (err) {
-                this._registerEvent({
-                    level: ModuleEventLevel.Error,
-                    name: '_createConfig.configuratorFailed',
-                    message: `Failed to create configurator for ${module.name}`,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                    },
-                    metric: Math.round(performance.now() - configStart),
-                    error: err,
-                });
-                throw err;
-            }
-        }), reduce((acc, module) => Object.assign(acc, module), {
-            onAfterConfiguration(cb) {
-                _afterConfiguration.push(cb);
-            },
-            onAfterInit(cb) {
-                _afterInit.push(cb);
-            },
-        }));
-        return lastValueFrom(config$);
+    async _initialize(config, ref) {
+        return runInitializePhase({
+            modules: this.modules,
+            registerEvent: this._registerEvent.bind(this),
+        }, config, ref);
     }
     /**
-     * Executes post-configuration tasks.
-     * @param config - Module configuration.
-     * @returns Promise that resolves when post-configuration tasks are complete.
+     * Runs the post-initialize lifecycle phase.
+     *
+     * Delegates to {@link runPostInitializePhase} which calls each module's
+     * `postInitialize` hook and then runs all `onInitialized` callbacks.
+     *
+     * Override this method in a subclass to customize the post-initialize phase.
+     *
+     * @param instance - The sealed module instance from the initialize phase.
+     * @param ref - Optional reference forwarded to each module's `postInitialize` call.
+     * @protected
      */
-    async _postConfigure(config) {
-        const { modules, _afterConfiguration: afterConfiguration } = this;
-        await Promise.allSettled(modules
-            .filter((module) => !!module.postConfigure)
-            .map(async (module) => {
-            try {
-                const postConfigStart = performance.now();
-                await module.postConfigure?.(config);
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_postConfigure.modulePostConfigured',
-                    message: `Module ${module.name} post-configured successfully`,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                        postConfigTime: Math.round(performance.now() - postConfigStart),
-                    },
-                });
-            }
-            catch (err) {
-                this._registerEvent({
-                    level: ModuleEventLevel.Warning,
-                    name: '_postConfigure.modulePostConfigureError',
-                    message: `Module ${module.name} post-configure failed`,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                    },
-                    error: err,
-                });
-            }
-        }));
-        /** call all added post config hooks  */
-        if (afterConfiguration.length) {
-            try {
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_postConfigure.hooks',
-                    message: `Post configure hooks [${afterConfiguration.length}] called`,
-                });
-                const postConfigHooksStart = performance.now();
-                await Promise.allSettled(afterConfiguration.map((x) => Promise.resolve(x(config))));
-                const postConfigHooksTime = Math.round(performance.now() - postConfigHooksStart);
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_postConfigure.hooksComplete',
-                    message: 'Post configure hooks complete',
-                    properties: {
-                        count: afterConfiguration.length,
-                        postConfigHooksTime,
-                    },
-                    metric: postConfigHooksTime,
-                });
-            }
-            catch (err) {
-                this._registerEvent({
-                    level: ModuleEventLevel.Warning,
-                    name: '_postConfigure.hooksError',
-                    message: 'Post configure hook failed',
-                    error: err,
-                });
-            }
-        }
+    async _postInitialize(instance, ref) {
+        return runPostInitializePhase({
+            modules: this.modules,
+            afterInit: this._afterInit,
+            registerEvent: this._registerEvent.bind(this),
+        }, instance, ref);
     }
     /**
-     * Initializes the modules with the provided configuration and reference.
-     * @param config - Module configuration.
-     * @param ref - Reference object.
-     * @returns Promise that resolves to the initialized module instance.
+     * Runs the plugin lifecycle phase.
+     *
+     * Delegates to {@link runPluginPhase} which calls each registered plugin and
+     * stores returned teardown callbacks for dispose.
+     *
+     * Override this method in a subclass to customize plugin registration.
+     *
+     * @param instance - The sealed module instance from the initialize phase.
+     * @param ref - Optional reference forwarded to each plugin callback.
+     * @protected
      */
-    async _initialize(config, ref) {
-        const moduleNames = this.modules.map((m) => m.name);
-        const instance$ = new BehaviorSubject({});
-        /** Method to check if a module is defined */
-        const hasModule = (name) => moduleNames.includes(name);
-        /**
-         * Requires and returns an initialized module instance by its name.
-         *
-         * If the requested module is already initialized, returns it immediately as a resolved Promise.
-         * If the module is not yet initialized, waits for its initialization and resolves with the instance,
-         * or rejects with a timeout error if the module is not initialized within the specified time.
-         *
-         * Throws an error immediately if the requested module name is not defined in the current configuration.
-         * Also logs relevant events for debugging and error tracking.
-         *
-         * @template TKey - The key of the module to require, constrained to the keys of the combined modules instance type.
-         * @param name - The name of the module to require.
-         * @param wait - The maximum time to wait (in seconds) for the module to initialize before timing out. Defaults to 60 seconds.
-         * @returns A Promise that resolves with the initialized module instance of type `ModulesInstanceType<CombinedModules<T, TModules>>[TKey]`.
-         * @throws {Error} If the module name is not defined.
-         * @throws {RequiredModuleTimeoutError} If the module does not initialize within the specified timeout.
-         *
-         * @example
-         * ```typescript
-         * const myModule = await requireInstance('myModuleName', 30);
-         * ```
-         */
-        const requireInstance = (name, wait = 60) => {
-            /** if module name is not defined, throw error */
-            if (!moduleNames.includes(name)) {
-                const error = new Error(`Cannot require [${String(name)}] since module is not defined!`);
-                error.name = 'ModuleNotDefinedError';
-                this._registerEvent({
-                    level: ModuleEventLevel.Error,
-                    name: '_initialize.requireInstance.moduleNotDefined',
-                    message: error.message,
-                    properties: {
-                        moduleName: String(name),
-                        wait,
-                    },
-                    error,
-                });
-                throw error;
-            }
-            /** if module is already initialized, return it */
-            if (instance$.value[name]) {
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_initialize.requireInstance.moduleAlreadyInitialized',
-                    message: `Module [${String(name)}] is already initialized, skipping queue`,
-                    properties: {
-                        moduleName: String(name),
-                        wait,
-                    },
-                });
-                return Promise.resolve(instance$.value[name]);
-            }
-            const requireStart = performance.now();
-            this._registerEvent({
-                level: ModuleEventLevel.Debug,
-                name: '_initialize.requireInstance.awaiting',
-                message: `Awaiting module [${String(name)}] initialization, timeout ${wait}s`,
-                properties: {
-                    moduleName: String(name),
-                    wait,
-                },
-            });
-            return firstValueFrom(instance$.pipe(filter((x) => !!x[name]), map$1((x) => x[name]), timeout({
-                each: wait * 1000,
-                with: () => throwError(() => {
-                    const error = new RequiredModuleTimeoutError();
-                    this._registerEvent({
-                        level: ModuleEventLevel.Error,
-                        name: '_initialize.requireInstance.timeout',
-                        message: `Module [${String(name)}] initialization timed out after ${wait}s`,
-                        properties: {
-                            moduleName: String(name),
-                            wait,
-                        },
-                        error,
-                    });
-                    return error;
-                }),
-            }), tap(() => {
-                const requireTime = Math.round(performance.now() - requireStart);
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_initialize.requireInstance.moduleResolved',
-                    message: `Module [${String(name)}] required in ${requireTime}ms`,
-                    properties: {
-                        moduleName: String(name),
-                        wait,
-                        requireTime,
-                    },
-                    metric: requireTime,
-                });
-            })));
-        };
-        // Create observable stream to initialize modules concurrently
-        // Each module goes through: validation -> initialization -> result mapping
-        const init$ = from(this.modules).pipe(
-        /** Process each module individually through initialization pipeline */
-        mergeMap((module) => {
-            const key = module.name;
-            if (!module.initialize) {
-                const error = new Error(`Module ${module.name} does not have initialize method`);
-                error.name = 'ModuleInitializeError';
-                this._registerEvent({
-                    level: ModuleEventLevel.Error,
-                    name: '_initialize.moduleInitializeError',
-                    message: error.message,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                    },
-                    error,
-                });
-                throw error;
-            }
-            this._registerEvent({
-                level: ModuleEventLevel.Debug,
-                name: '_initialize.moduleInitializing',
-                message: `Initializing module ${module.name}`,
-                properties: {
-                    moduleName: module.name,
-                    moduleVersion: module.version?.toString() || 'unknown',
-                },
-            });
-            const moduleInitStart = performance.now();
-            return from(
-            // TODO: Replace Promise.resolve + from() with toObservable() for better RxJS patterns
-            Promise.resolve(module.initialize({
-                ref,
-                config: config[key],
-                // @ts-ignore
-                requireInstance,
-                hasModule,
-            }))).pipe(map$1((instance) => {
-                if (!(instance instanceof BaseModuleProvider)) {
-                    this._registerEvent({
-                        level: ModuleEventLevel.Warning,
-                        name: '_initialize.providerNotBaseModuleProvider',
-                        message: `Provider for module ${module.name} does not extend BaseModuleProvider`,
-                        properties: {
-                            moduleName: module.name,
-                            moduleVersion: module.version?.toString() || 'unknown',
-                        },
-                    });
-                }
-                if (!instance.version) {
-                    this._registerEvent({
-                        level: ModuleEventLevel.Warning,
-                        name: '_initialize.providerVersionWarning',
-                        message: `Provider for module ${module.name} does not expose version`,
-                        properties: {
-                            moduleName: module.name,
-                            moduleVersion: module.version?.toString() || 'unknown',
-                        },
-                    });
-                }
-                const moduleInitTime = Math.round(performance.now() - moduleInitStart);
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_initialize.moduleInitialized',
-                    message: `Module ${module.name} initialized in ${moduleInitTime}ms`,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                        providerName: typeof instance,
-                        providerVersion: instance.version?.toString() || 'unknown',
-                        moduleInitTime,
-                    },
-                    metric: moduleInitTime,
-                });
-                return [key, instance];
-            }));
-        }));
-        const initStart = performance.now();
-        // Subscribe to module initialization stream and accumulate results
-        // Each successful initialization updates the shared instance object
-        init$
-            .pipe(
-        /** ensure that the stream is completed even if there are no modules to initialize */
-        defaultIfEmpty([]))
-            .subscribe({
-            next: ([name, module]) => {
-                // Accumulate initialized modules into the shared instance object
-                instance$.next(Object.assign(instance$.value, { [name]: module }));
-            },
-            error: (err) => {
-                this._registerEvent({
-                    level: ModuleEventLevel.Error,
-                    name: '_initialize.moduleInitializationError',
-                    message: `Failed to initialize module ${err.name || 'unknown'}`,
-                    error: err,
-                });
-                instance$.error(err);
-            },
-            complete: () => {
-                const loadTime = Math.round(performance.now() - initStart);
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_initialize.moduleInitializationComplete',
-                    message: `All modules initialized in ${loadTime}ms`,
-                    properties: {
-                        modules: Object.keys(instance$.value).join(', '),
-                        loadTime,
-                    },
-                    metric: loadTime,
-                });
-                return instance$.complete();
-            },
-        });
-        /** await creation of all instances */
-        const initStartTime = performance.now();
-        const instance = await lastValueFrom(instance$);
-        const initTime = Math.round(performance.now() - initStartTime);
-        this._registerEvent({
-            level: ModuleEventLevel.Debug,
-            name: '_initialize.complete',
-            message: `Modules instance created in ${initTime}ms`,
-            properties: {
-                modules: Object.keys(instance).join(', '),
-                initTime,
-            },
-            metric: initTime,
-        });
-        Object.seal(instance);
-        return instance;
+    async _registerPlugins(instance, ref) {
+        return runPluginPhase({
+            plugins: this._plugins,
+            teardowns: this._pluginTeardowns,
+            registerEvent: this._registerEvent.bind(this),
+        }, instance, ref);
     }
     /**
-     * Executes post-initialization tasks.
-     * @param instance - Initialized module instance.
-     * @param ref - Reference object.
+     * Tears down all modules managed by this configurator.
+     *
+     * Delegates to {@link runDisposePhase} which calls each module's `dispose`
+     * hook and then completes the internal event stream.
+     *
+     * @param instance - The initialized module instance to tear down.
+     * @param ref - Optional reference forwarded to module dispose hooks.
+     * @returns A promise resolving when all modules have been disposed.
      */
-    async _postInitialize(instance, ref) {
-        const { modules, _afterInit: afterInit } = this;
-        const postInitialize$ = from(modules).pipe(filter((module) => !!module.postInitialize), tap((module) => {
-            this._registerEvent({
-                level: ModuleEventLevel.Debug,
-                name: '_postInitialize.modulePostInitializing',
-                message: `Module ${module.name} is being post-initialized`,
-                properties: {
-                    moduleName: module.name,
-                    moduleVersion: module.version?.toString() || 'unknown',
-                },
-            });
-        }), mergeMap((module) => {
-            const postInitStart = performance.now();
-            return from(module.postInitialize({
-                ref,
-                modules: instance,
-                instance: instance[module.name],
-            })).pipe(tap(() => {
-                const postInitTime = Math.round(performance.now() - postInitStart);
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_postInitialize.modulePostInitialized',
-                    message: `Module ${module.name} has been post-initialized in ${postInitTime}ms`,
-                    metric: postInitTime,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                        postInitTime,
-                    },
-                });
-            }), defaultIfEmpty(null), catchError((err) => {
-                this._registerEvent({
-                    level: ModuleEventLevel.Warning,
-                    name: '_postInitialize.modulePostInitializeError',
-                    message: `Module ${module.name} post-initialize failed`,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                    },
-                    error: err,
-                });
-                return EMPTY;
-            }));
-        }), defaultIfEmpty(null));
-        this._registerEvent({
-            level: ModuleEventLevel.Debug,
-            name: '_postInitialize.modulesPostInitializing',
-            message: `Post-initializing all modules [${Object.keys(instance).length}]`,
-            properties: {
-                modules: Object.keys(instance).join(', '),
-            },
-        });
-        const postInitStart = performance.now();
-        await lastValueFrom(postInitialize$);
-        const postInitTime = Math.round(performance.now() - postInitStart);
-        this._registerEvent({
-            level: ModuleEventLevel.Debug,
-            name: '_postInitialize.modulesPostInitializeComplete',
-            message: `Post-initialization of all modules completed in ${postInitTime}ms`,
-            properties: {
-                modules: Object.keys(instance).join(', '),
-                postInitTime: postInitTime,
-            },
-            metric: postInitTime,
-        });
-        if (afterInit.length) {
-            try {
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_postInitialize.afterInitHooks',
-                    message: `Executing post-initialize hooks [${afterInit.length}]`,
-                    properties: {
-                        hooks: afterInit.map((x) => x.name || 'anonymous').join(', '),
-                    },
-                });
-                const afterInitStart = performance.now();
-                await Promise.allSettled(afterInit.map((x) => Promise.resolve(x(instance))));
-                const afterInitTime = Math.round(performance.now() - afterInitStart);
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: '_postInitialize.afterInitHooksComplete',
-                    message: `Post-initialize hooks completed in ${afterInitTime}ms`,
-                    properties: {
-                        hooks: afterInit.map((x) => x.name || 'anonymous').join(', '),
-                        afterInitTime,
-                    },
-                    metric: afterInitTime,
-                });
-            }
-            catch (err) {
-                this._registerEvent({
-                    level: ModuleEventLevel.Warning,
-                    name: '_postInitialize.afterInitHooksError',
-                    message: 'Post-initialize hooks failed',
-                    properties: {
-                        hooks: afterInit.map((x) => x.name || 'anonymous').join(', '),
-                    },
-                    error: err,
-                });
-            }
-        }
-        const postInitCompleteTime = Math.round(performance.now() - postInitStart);
-        this._registerEvent({
-            level: ModuleEventLevel.Debug,
-            name: '_postInitialize.complete',
-            message: 'Post-initialization complete',
-            properties: {
-                modules: Object.keys(instance).join(', '),
-                postInitCompleteTime,
-            },
-        });
-    }
-    /**
-     * Disposes all modules managed by this configurator.\n   *\n   * Calls each module\u2019s `dispose` hook (if defined) and completes the\n   * internal event stream. After disposal the configurator should not be reused.\n   *\n   * @param instance - The initialized modules instance to tear down.\n   * @param ref - Optional reference object forwarded to module dispose hooks.\n   */
     async dispose(instance, ref) {
-        this._registerEvent({
-            level: ModuleEventLevel.Debug,
-            name: 'dispose',
-            message: 'Disposing modules instance',
-            properties: {
-                modules: Object.keys(instance).join(', '),
-            },
-        });
-        await Promise.allSettled(this.modules
-            .filter((module) => !!module.dispose)
-            .map(async (module) => {
-            if (!module.dispose)
-                return;
-            try {
-                await module.dispose({
-                    ref,
-                    modules: instance,
-                    instance: instance[module.name],
-                });
-                this._registerEvent({
-                    level: ModuleEventLevel.Debug,
-                    name: 'dispose.moduleDisposed',
-                    message: `Module ${module.name} disposed successfully`,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                    },
-                });
-            }
-            catch (err) {
-                this._registerEvent({
-                    level: ModuleEventLevel.Warning,
-                    name: 'dispose.moduleDisposeError',
-                    message: `Module ${module.name} dispose failed`,
-                    properties: {
-                        moduleName: module.name,
-                        moduleVersion: module.version?.toString() || 'unknown',
-                    },
-                    error: err,
-                });
-            }
-        }));
-        this.#event$.complete();
+        return runDisposePhase({
+            modules: this.modules,
+            registerEvent: this._registerEvent.bind(this),
+            // ReplaySubject extends Subject — dispose only needs .complete() which both have.
+            event$: this.#event$,
+            pluginTeardowns: this._pluginTeardowns,
+        }, instance, ref);
     }
 }
 
@@ -21820,7 +22312,7 @@ class HttpClientConfigurator {
 }
 
 // Generated by genversion.
-const version$6 = '8.0.1';
+const version$6 = '8.0.2';
 
 /**
  * Thrown when `createClient(name)` is called with an unknown client key.
@@ -24129,7 +24621,7 @@ class TelemetryConfigurator extends BaseConfigBuilder {
 }
 
 // Generated by genversion.
-const version$5 = '5.0.2';
+const version$5 = '6.0.0';
 
 /**
  * Enum representing the severity levels of telemetry items.
@@ -25062,7 +25554,7 @@ configurator, options) => {
     });
 };
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -25289,7 +25781,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -25341,7 +25833,7 @@ const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -25372,7 +25864,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25392,7 +25884,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -25472,7 +25964,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25495,7 +25987,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -25517,9 +26009,10 @@ const missingSshKid = "missing_ssh_kid";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
-const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const issuerValidationFailed = "issuer_validation_failed";
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -25558,7 +26051,7 @@ const methodNotImplemented = "method_not_implemented";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25753,7 +26246,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26142,7 +26635,7 @@ function addResource(parameters, resource) {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26251,7 +26744,7 @@ function normalizeUrlForComparison(url) {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26290,7 +26783,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26551,12 +27044,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$4 = "16.5.2";
+const version$4 = "16.6.1";
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26565,7 +27058,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -26648,7 +27141,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26728,7 +27221,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26885,7 +27378,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26971,6 +27464,15 @@ const rawMetdataJSON = {
                 preferred_cache: "login.sovcloud-identity.sg",
                 aliases: ["login.sovcloud-identity.sg"],
             },
+            {
+                preferred_network: "login.windows-ppe.net",
+                preferred_cache: "login.windows-ppe.net",
+                aliases: [
+                    "login.windows-ppe.net",
+                    "sts.windows-ppe.net",
+                    "login.microsoft-ppe.com",
+                ],
+            },
         ],
     },
 };
@@ -27042,7 +27544,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27050,7 +27552,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27088,7 +27590,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27126,7 +27628,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27141,7 +27643,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27163,7 +27665,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -27187,7 +27689,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -27362,7 +27864,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28493,7 +28995,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -28507,7 +29009,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28562,7 +29064,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28657,7 +29159,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -28684,7 +29186,7 @@ function isOidcProtocolMode(config) {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -28749,7 +29251,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29008,7 +29510,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -29079,7 +29581,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -29172,7 +29674,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29252,7 +29754,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -29303,7 +29805,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29371,7 +29873,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29390,7 +29892,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29458,7 +29960,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29806,7 +30308,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -29816,7 +30318,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -29834,7 +30336,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -29855,7 +30357,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29941,7 +30443,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29972,7 +30474,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -30086,7 +30588,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -30098,7 +30600,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -30108,7 +30610,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -30118,7 +30620,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -30223,7 +30725,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -30478,7 +30980,7 @@ class Authority {
         }, this.correlationId);
     }
     /**
-     * Returns metadata entity from cache if it exists, otherwiser returns a new metadata entity built
+     * Returns metadata entity from cache if it exists, otherwise returns a new metadata entity built
      * from the configured canonical authority
      * @returns
      */
@@ -30547,6 +31049,8 @@ class Authority {
         // Get metadata from network if local sources aren't available
         let metadata = await invokeAsync(this.getEndpointMetadataFromNetwork.bind(this), AuthorityGetEndpointMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
         if (metadata) {
+            // Validate the issuer returned by the OIDC discovery document.
+            this.validateIssuer(metadata.issuer);
             // If the user prefers to use an azure region replace the global endpoints with regional information.
             if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
                 metadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(metadata);
@@ -30715,7 +31219,7 @@ class Authority {
         throw createClientConfigurationError(untrustedAuthority);
     }
     updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
-        this.logger.verbose("0jhlgt", this.correlationId);
+        this.logger.verbose("1tpqlr", this.correlationId);
         this.logger.verbosePii("1fy7uz", this.correlationId);
         this.logger.verbosePii("08zabj", this.correlationId);
         this.logger.verbosePii("1o1kv3", this.correlationId);
@@ -30912,6 +31416,139 @@ class Authority {
     isAliasOfKnownMicrosoftAuthority(host) {
         return InstanceDiscoveryMetadataAliases.has(host);
     }
+    /**
+     * Validates the `issuer` returned by an OIDC discovery document against
+     * this authority, per
+     * https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
+     *
+     * The issuer is accepted when ANY of the following holds:
+     *  1. The issuer scheme + host + port match the authority's (path may
+     *     differ). Applies to all authorities.
+     *  2. The authority is a Microsoft cloud authority (public, sovereign,
+     *     or CIAM), the issuer is HTTPS, and the issuer host is in the known
+     *     Microsoft authority host set.
+     *  3. Same as (2), but the issuer host is a single-label regional variant
+     *     of a known Microsoft host (e.g. `westus.login.microsoftonline.com`).
+     *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
+     *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
+     *     path.
+     *
+     * @param issuer The `issuer` value returned in the OIDC discovery document.
+     * @throws ClientConfigurationError("issuer_validation_failed") on failure.
+     */
+    validateIssuer(issuer) {
+        if (!issuer) {
+            throw createClientConfigurationError(issuerValidationFailed);
+        }
+        // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
+        let issuerUrl;
+        try {
+            issuerUrl = new URL(issuer);
+        }
+        catch {
+            throw createClientConfigurationError(issuerValidationFailed);
+        }
+        const issuerScheme = issuerUrl.protocol;
+        const issuerHost = issuerUrl.host;
+        const authorityScheme = (this.canonicalAuthorityUrlComponents.Protocol || "").toLowerCase();
+        const authorityHost = (this.canonicalAuthorityUrlComponents.HostNameAndPort || "").toLowerCase();
+        // Rule 1: Same scheme and host
+        const matchesAuthorityOrigin = this.matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost);
+        // Rule 2: The issuer host is a well-known Microsoft authority host (HTTPS only)
+        const matchesKnownMicrosoftHost = issuerScheme === "https:" &&
+            this.isAliasOfKnownMicrosoftAuthority(issuerHost);
+        /*
+         * Rule 3: The issuer host is a regional variant ({region}.{host}) of a well-known host
+         * (HTTPS only). E.g. westus2.login.microsoft.com
+         */
+        const matchesRegionalMicrosoftHost = issuerScheme === "https:" &&
+            this.matchesRegionalMicrosoftHost(issuerHost);
+        /*
+         * Rule 4: CIAM-specific validation. In a CIAM scenario the issuer is expected to
+         * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
+         */
+        const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+        // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
+        if (matchesAuthorityOrigin ||
+            matchesKnownMicrosoftHost ||
+            matchesRegionalMicrosoftHost ||
+            matchesCiamTenantPattern) {
+            return;
+        }
+        // issuer validation fails if none of the above rules are satisfied
+        throw createClientConfigurationError(issuerValidationFailed);
+    }
+    /**
+     * Rule 1: The issuer scheme + host (and port) match the authority's. Path
+     * may differ. Applies to all authorities.
+     */
+    matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost) {
+        return issuerScheme === authorityScheme && issuerHost === authorityHost;
+    }
+    /**
+     * Rule 3: The issuer host is a regional variant
+     * (`{region}.{host}`) of a known Microsoft authority host.
+     * E.g. `westus2.login.microsoft.com`.
+     */
+    matchesRegionalMicrosoftHost(issuerHost) {
+        const firstDot = issuerHost.indexOf(".");
+        if (firstDot > 0 && firstDot < issuerHost.length - 1) {
+            const hostWithoutRegion = issuerHost.substring(firstDot + 1);
+            return this.isAliasOfKnownMicrosoftAuthority(hostWithoutRegion);
+        }
+        return false;
+    }
+    /**
+     * Rule 4: The issuer matches one of the well-known CIAM tenant patterns
+     * (`https://{tenant}.ciamlogin.com[/{tenant}[.onmicrosoft.com][/v2.0]]`).
+     *
+     * The bare tenant name is extracted from the authority's first path segment
+     * when available (stripping the `.onmicrosoft.com` suffix that
+     * `transformCIAMAuthority` adds), or otherwise from the leftmost label of
+     * the authority host (to support CIAM custom domain scenarios).
+     *
+     * Both `/{tenant}` and `/{tenant}.onmicrosoft.com` path forms are accepted
+     * because the OIDC issuer may use either form depending on the authority URL
+     * that was used to trigger discovery.
+     */
+    matchesCiamTenantPattern(issuerUrl, authorityHost, authorityPathSegments) {
+        /*
+         * authorityPathSegments[0] is the first path segment of the *authority
+         * URL* after transformCIAMAuthority runs (e.g. "contoso.onmicrosoft.com").
+         * Additional CIAM issuer path segments such as "/v2.0" are part of the
+         * issuer string, not the authority URL's PathSegments.
+         */
+        const pathSegment = authorityPathSegments[0];
+        /*
+         * Extract the bare tenant name: strip the .onmicrosoft.com suffix when
+         * present (introduced by transformCIAMAuthority), or fall back to the
+         * first label of the authority hostname for non-transformed/custom-domain
+         * CIAM authorities.
+         */
+        const tenantName = pathSegment
+            ? pathSegment.endsWith(AAD_TENANT_DOMAIN_SUFFIX)
+                ? pathSegment.slice(0, -AAD_TENANT_DOMAIN_SUFFIX.length)
+                : pathSegment
+            : authorityHost.split(".")[0];
+        if (!tenantName) {
+            return false;
+        }
+        const ciamBaseURL = `https://${tenantName}${CIAM_AUTH_URL}`;
+        const validCiamPatterns = [
+            ciamBaseURL,
+            `${ciamBaseURL}/${tenantName}`,
+            `${ciamBaseURL}/${tenantName}/v2.0`,
+            `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}`,
+            `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}/v2.0`, // https://{tenant}.ciamlogin.com/{tenant}.onmicrosoft.com/v2.0
+        ];
+        /*
+         * Compose the canonical issuer string from URL components and strip any
+         * trailing slashes from the path so it can be compared to the pattern set.
+         */
+        const issuerPath = issuerUrl.pathname.replace(/\/+$/, "");
+        const normalizedIssuer = `${issuerUrl.protocol}//${issuerUrl.host}${issuerPath}`;
+        return validCiamPatterns.some((pattern) => pattern === normalizedIssuer);
+    }
     /**
      * Checks whether the provided host is that of a public cloud authority
      *
@@ -31043,7 +31680,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31077,7 +31714,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31334,7 +31971,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31555,7 +32192,7 @@ class RefreshTokenClient {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31671,7 +32308,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31686,7 +32323,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31909,7 +32546,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -31942,7 +32579,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -31952,7 +32589,7 @@ function containsResourceParam(params) {
  */
 const unexpectedError = "unexpected_error";
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32213,7 +32850,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32234,7 +32871,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -32242,7 +32879,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32282,7 +32919,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -32410,7 +33047,7 @@ const DecryptEarResponse = "decryptEarResponse";
  */
 const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32433,7 +33070,7 @@ function createBrowserAuthError(errorCode, subError) {
     return new BrowserAuthError(errorCode, subError);
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32619,7 +33256,7 @@ const iFrameRenewalPolicies = [
     CacheLookupPolicy.RefreshTokenAndNetwork,
 ];
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -32664,7 +33301,7 @@ function base64EncArr(aBytes) {
     return btoa(binString);
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -32717,7 +33354,7 @@ const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
 const timedOut = "timed_out";
 const emptyResponse = "empty_response";
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -32756,7 +33393,7 @@ function base64DecToArr(base64String) {
     return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33054,7 +33691,7 @@ async function hashString(plainText) {
     return urlEncodeArr(hashBytes);
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33074,7 +33711,7 @@ function createBrowserConfigurationAuthError(errorCode) {
     return new BrowserConfigurationAuthError(errorCode, getDefaultErrorMessage(errorCode));
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -33082,7 +33719,7 @@ function createBrowserConfigurationAuthError(errorCode) {
 const storageNotSupported = "storage_not_supported";
 const inMemRedirectUnavailable = "in_mem_redirect_unavailable";
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33417,7 +34054,7 @@ function createGuid() {
     return createNewGuid();
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33620,7 +34257,7 @@ class DatabaseStorage {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -33666,7 +34303,7 @@ class MemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33807,7 +34444,7 @@ class AsyncMemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -33990,7 +34627,7 @@ function getSortedObjectString(obj) {
     return JSON.stringify(obj, Object.keys(obj).sort());
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -34037,7 +34674,7 @@ const LocalStorageUpdated = "localStorageUpdated";
  */
 const SsoCapable = "ssoCapable";
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -34067,7 +34704,7 @@ function getTokenKeysCacheKey(clientId, schema = CREDENTIAL_SCHEMA_VERSION) {
     return `${PREFIX}.${schema}.${TOKEN_KEYS}.${clientId}`;
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -34158,7 +34795,7 @@ function getCookieExpirationTime(cookieLifeDays) {
     return expr.toUTCString();
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -34200,7 +34837,7 @@ function getTokenKeys(clientId, storage, schemaVersion) {
     };
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -34211,7 +34848,7 @@ function isEncrypted(data) {
         data.hasOwnProperty("data"));
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -34503,7 +35140,7 @@ class LocalStorage {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -34545,7 +35182,7 @@ class SessionStorage {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -34573,12 +35210,12 @@ const EventType = {
     BROKER_CONNECTION_ESTABLISHED: "msal:brokerConnectionEstablished",
 };
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version$3 = "5.9.0";
+const version$3 = "5.10.1";
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -34595,7 +35232,7 @@ function removeElementFromArray(array, element) {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35632,22 +36269,9 @@ class BrowserCacheManager extends CacheManager {
      * @param generateKey
      */
     getTemporaryCache(cacheKey, correlationId, generateKey) {
+        this.logger.trace("1ordf8", correlationId);
         const key = generateKey ? this.generateCacheKey(cacheKey) : cacheKey;
-        const value = this.temporaryCacheStorage.getItem(key);
-        if (!value) {
-            // If temp cache item not found in session/memory, check local storage for items set by old versions
-            if (this.cacheConfig.cacheLocation ===
-                BrowserCacheLocation.LocalStorage) {
-                const item = this.browserStorage.getItem(key);
-                if (item) {
-                    this.logger.trace("1yt61y", correlationId);
-                    return item;
-                }
-            }
-            this.logger.trace("1qhy81", correlationId);
-            return null;
-        }
-        return value;
+        return this.temporaryCacheStorage.getItem(key);
     }
     /**
      * Sets the cache item with the key and value given.
@@ -35960,7 +36584,7 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient, even
     return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger, performanceClient, eventHandler);
 };
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -36007,7 +36631,7 @@ function getActiveAccount(browserStorage, correlationId) {
     return browserStorage.getActiveAccount(correlationId);
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36111,7 +36735,7 @@ class EventHandler {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36246,7 +36870,7 @@ async function clearCacheOnLogout(browserStorage, browserCrypto, logger, correla
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36324,7 +36948,7 @@ function validateRequestMethod(interactionRequest, protocolMode) {
     return httpMethod;
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36528,7 +37152,7 @@ async function initializeAuthorizationRequest(request, interactionType, config,
     return validatedRequest;
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36552,7 +37176,7 @@ function extractBrowserRequestState(browserCrypto, state) {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36591,7 +37215,7 @@ function validateInteractionType(response, browserCrypto, interactionType) {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36680,7 +37304,7 @@ class InteractionHandler {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -36689,7 +37313,7 @@ const contentError = "ContentError";
 const pageException = "PageException";
 const userSwitch = "user_switch";
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -36702,7 +37326,7 @@ const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
 const UX_NOT_ALLOWED = "UX_NOT_ALLOWED";
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36764,7 +37388,7 @@ function createNativeAuthError(code, description, ext) {
     return new NativeAuthError(code, description, ext);
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -36813,7 +37437,7 @@ class SilentCacheClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -37444,7 +38068,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -37744,7 +38368,7 @@ async function handleResponseEAR(request, response, apiId, config, authority, br
     return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, apiId, additionalData, undefined, undefined, undefined, undefined));
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -37799,7 +38423,7 @@ async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceCl
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -37842,7 +38466,7 @@ class NavigationClient {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -37963,7 +38587,7 @@ function getHeaderDict(headers) {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38091,7 +38715,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
     return overlayedConfig;
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38352,7 +38976,7 @@ class PlatformAuthExtensionHandler {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38502,7 +39126,7 @@ class PlatformAuthDOMHandler {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout) {
     logger.trace("134j0v", correlationId);
     const enablePlatformBrokerDOMSupport = isDomEnabledForPlatformAuth();
@@ -38579,7 +39203,7 @@ function isPlatformAuthAllowed(config, logger, correlationId, platformAuthProvid
     return true;
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -38999,7 +39623,7 @@ class PopupClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39434,7 +40058,7 @@ class RedirectClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39511,7 +40135,7 @@ function removeHiddenIframe(iframe) {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39718,7 +40342,7 @@ class SilentIframeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39783,7 +40407,7 @@ class SilentRefreshClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39796,7 +40420,7 @@ class HybridSpaAuthorizationCodeClient extends AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -39867,7 +40491,7 @@ class SilentAuthCodeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
     const frameInstances = 
     // @ts-ignore
@@ -39883,7 +40507,7 @@ function collectInstanceStats(currentClientId, performanceEvent, logger, correla
     });
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41370,7 +41994,7 @@ function checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheL
     return isSilentlyResolvable && tryIframeRenewal;
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41467,7 +42091,7 @@ class BaseOperatingContext {
     }
 }
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41514,7 +42138,7 @@ StandardOperatingContext.MODULE_NAME = "";
  */
 StandardOperatingContext.ID = "StandardOperatingContext";
 
-/*! @azure/msal-browser v5.9.0 2026-04-28 */
+/*! @azure/msal-browser v5.10.1 2026-05-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -41812,6 +42436,7 @@ const FUSION_CORRELATION_ID = '';
 class MsalClient extends PublicClientApplication {
     #tenantId;
     #clientId;
+    #cacheLookupPolicy;
     /**
      * Creates a new MSAL client instance.
      *
@@ -41821,6 +42446,7 @@ class MsalClient extends PublicClientApplication {
         super(config);
         this.#tenantId = config.auth?.tenantId;
         this.#clientId = config.auth?.clientId;
+        this.#cacheLookupPolicy = config.cacheLookupPolicy;
     }
     /**
      * Tenant identifier for the configured Azure AD tenant.
@@ -41975,7 +42601,11 @@ class MsalClient extends PublicClientApplication {
             if (request.account) {
                 try {
                     this.getLogger().verbose('Attempting to acquire token silently', request.correlationId || FUSION_CORRELATION_ID);
-                    return await this.acquireTokenSilent(request);
+                    return await this.acquireTokenSilent({
+                        // Instance-level policy is the default; request-level cacheLookupPolicy takes precedence
+                        cacheLookupPolicy: this.#cacheLookupPolicy,
+                        ...request,
+                    });
                 }
                 catch {
                     // Silent acquisition failed - fall back to interactive
@@ -42089,7 +42719,7 @@ const createClientLogCallback = (provider, metadata, scope) => {
 };
 
 // Generated by genversion.
-const version$2 = '8.0.4';
+const version$2 = '9.0.0';
 
 /**
  * Zod schema for telemetry configuration validation.
@@ -42116,6 +42746,10 @@ const MsalConfigSchema = z.object({
     redirectUri: z.string().optional(),
     loginHint: z.string().optional(),
     authCode: z.string().optional(),
+    cacheLookupPolicy: z
+        .custom((val) => typeof val === 'number' &&
+        Object.values(CacheLookupPolicy).includes(val))
+        .optional(),
     version: z.string().transform((x) => String(semver.coerce(x))),
     telemetry: TelemetryConfigSchema,
 });
@@ -42158,6 +42792,8 @@ class MsalConfigurator extends BaseConfigBuilder {
                 return telemetry;
             }
         });
+        // Default cache lookup policy to AccessTokenAndRefreshToken to avoid iframe fallback delays
+        this._set('cacheLookupPolicy', async () => CacheLookupPolicy.AccessTokenAndRefreshToken);
     }
     /**
      * Sets the MSAL client configuration for authentication.
@@ -42183,6 +42819,33 @@ class MsalConfigurator extends BaseConfigBuilder {
         this.#msalConfig = config;
         return this;
     }
+    /**
+     * Sets the cache lookup policy used for every silent token acquisition.
+     *
+     * Controls whether MSAL falls back to a hidden iframe when the refresh token
+     * fails. Defaults to `CacheLookupPolicy.AccessTokenAndRefreshToken`, which skips
+     * the iframe step and fails immediately with `InteractionRequiredAuthError` when
+     * the refresh token is revoked — avoiding the ~10–20 s `monitor_window_timeout`
+     * delay caused by MSAL's built-in iframe fallback.
+     *
+     * Set to `CacheLookupPolicy.Default` to restore MSAL's full waterfall:
+     * cache → refresh token → iframe.
+     *
+     * @param policy - Cache lookup policy to apply
+     * @returns The configurator instance for method chaining
+     *
+     * @example
+     * ```typescript
+     * import { CacheLookupPolicy } from '@azure/msal-browser';
+     *
+     * // Restore MSAL's built-in iframe fallback (not recommended for most apps)
+     * configurator.setCacheLookupPolicy(CacheLookupPolicy.Default);
+     * ```
+     */
+    setCacheLookupPolicy(policy) {
+        this._set('cacheLookupPolicy', async () => policy);
+        return this;
+    }
     /**
      * Sets a backend-issued authorization code for token exchange.
      *
@@ -42389,6 +43052,10 @@ class MsalConfigurator extends BaseConfigBuilder {
                     },
                 };
             }
+            // Apply silent cache lookup policy if configured
+            if (config.cacheLookupPolicy !== undefined) {
+                clientConfig.cacheLookupPolicy = config.cacheLookupPolicy;
+            }
             // Instantiate MSAL client with fully configured options
             config.client = new MsalClient(clientConfig);
         }
@@ -46869,7 +47536,7 @@ async function registerServiceWorker(framework) {
 }
 
 // Generated by genversion.
-const version = '4.0.7';
+const version = '4.0.9';
 
 // Allow dynamic import without vite
 const importWithoutVite = (path) => import(/* @vite-ignore */ path);