@equinor/fusion-framework-vite-plugin-spa 5.2.3 → 5.2.4-next.1

package/dist/{module-BR47HvRl.js → module-BnhyaZvt.js}

@@ -1,3 +1,5 @@
+import { t as trace, c as context } from './trace-api-DzxUyN-s.js';
+
 function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 }
@@ -2848,6 +2850,12 @@ class SemanticVersion extends semverExports.SemVer {
     }
 }
 
+/**
+ * Identifies an exporter-owned request so operational instrumentation does not instrument its own exports.
+ * Symbol properties survive object spreads without becoming HTTP headers or serialized payload fields.
+ */
+const telemetryExportRequest = Symbol('fusion.telemetry-export-request');
+
 /******************************************************************************
 Copyright (c) Microsoft Corporation.
 
@@ -3205,7 +3213,7 @@ function reportUnhandledError(err) {
     });
 }
 
-function noop() { }
+function noop$1() { }
 
 function errorContext(cb) {
     {
@@ -3354,9 +3362,9 @@ function defaultErrorHandler(err) {
 }
 var EMPTY_OBSERVER = {
     closed: true,
-    next: noop,
+    next: noop$1,
     error: defaultErrorHandler,
-    complete: noop,
+    complete: noop$1,
 };
 
 var observable = (function () { return (typeof Symbol === 'function' && Symbol.observable) || '@@observable'; })();
@@ -4021,6 +4029,12 @@ function mergeMap(project, resultSelector, concurrent) {
     return operate(function (source, subscriber) { return mergeInternals(source, subscriber, project, concurrent); });
 }
 
+function defer(observableFactory) {
+    return new Observable(function (subscriber) {
+        innerFrom(observableFactory()).subscribe(subscriber);
+    });
+}
+
 function filter(predicate, thisArg) {
     return operate(function (source, subscriber) {
         var index = 0;
@@ -4077,6 +4091,17 @@ function reduce(accumulator, seed) {
     return operate(scanInternals(accumulator, seed, arguments.length >= 2, false, true));
 }
 
+function finalize$1(callback) {
+    return operate(function (source, subscriber) {
+        try {
+            source.subscribe(subscriber);
+        }
+        finally {
+            subscriber.add(callback);
+        }
+    });
+}
+
 function switchMap(project, resultSelector) {
     return operate(function (source, subscriber) {
         var innerSubscriber = null;
@@ -4098,6 +4123,42 @@ function switchMap(project, resultSelector) {
     });
 }
 
+function tap(observerOrNext, error, complete) {
+    var tapObserver = isFunction(observerOrNext) || error || complete
+        ?
+            { next: observerOrNext, error: error, complete: complete }
+        : observerOrNext;
+    return tapObserver
+        ? operate(function (source, subscriber) {
+            var _a;
+            (_a = tapObserver.subscribe) === null || _a === void 0 ? void 0 : _a.call(tapObserver);
+            var isUnsub = true;
+            source.subscribe(createOperatorSubscriber(subscriber, function (value) {
+                var _a;
+                (_a = tapObserver.next) === null || _a === void 0 ? void 0 : _a.call(tapObserver, value);
+                subscriber.next(value);
+            }, function () {
+                var _a;
+                isUnsub = false;
+                (_a = tapObserver.complete) === null || _a === void 0 ? void 0 : _a.call(tapObserver);
+                subscriber.complete();
+            }, function (err) {
+                var _a;
+                isUnsub = false;
+                (_a = tapObserver.error) === null || _a === void 0 ? void 0 : _a.call(tapObserver, err);
+                subscriber.error(err);
+            }, function () {
+                var _a, _b;
+                if (isUnsub) {
+                    (_a = tapObserver.unsubscribe) === null || _a === void 0 ? void 0 : _a.call(tapObserver);
+                }
+                (_b = tapObserver.finalize) === null || _b === void 0 ? void 0 : _b.call(tapObserver);
+            }));
+        })
+        :
+            identity;
+}
+
 /**
  * Recursively assigns a configuration value to a nested object property.
  *
@@ -4870,6 +4931,20 @@ function unwrapMessage(message) {
     return typeof message === "string" ? message : message?.message;
 }
 /* A check holds no link back to the schema it is attached to — the same check instance is shared by every clone of that schema — so the owner is stamped onto the issues a check just raised, at the only point where both are in scope. Runs on the failure path only; `start` is the issue count from before the check ran. */
+/** The leading size checks of `defChecks` that set an upper bound, each paired with it. */
+function sizeCaps(defChecks) {
+    const caps = [];
+    for (const ch of defChecks ?? []) {
+        const d = ch._zod.def;
+        // a later check may rewrite the value
+        if (!/_(length|size)$|_equals$/.test(d.check))
+            break;
+        const max = d.maximum ?? d.length ?? d.size;
+        if (max >= 0)
+            caps.push([max, ch]);
+    }
+    return caps;
+}
 function attachSchema(issues, start, inst) {
     var _a;
     for (let i = start; i < issues.length; i++) {
@@ -6076,7 +6151,7 @@ class Doc {
 const version$3 = {
     major: 4,
     minor: 6,
-    patch: 5,
+    patch: 7,
 };
 
 const $ZodType = /*@__PURE__*/ $constructor("$ZodType", (inst, def) => {
@@ -6684,6 +6759,31 @@ const $ZodNever = /*@__PURE__*/ $constructor("$ZodNever", (inst, def) => {
         return payload;
     };
 });
+// an oversized container fails its leading size checks before any element is parsed
+function capSize(inst, size) {
+    const caps = sizeCaps(inst._zod.def.checks);
+    if (!caps.length)
+        return;
+    const cap = Math.min(...caps.map((c) => c[0]));
+    const parse = inst._zod.parse;
+    inst._zod.parse = (payload, ctx) => {
+        const n = size(payload.value);
+        if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+            for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+                if (n > max && ch._zod.def.when(payload)) {
+                    const start = payload.issues.length;
+                    ch._zod.check(payload);
+                    // the value is still the raw input, so no later check may read it
+                    payload.issues[start].continue = false;
+                    attachSchema(payload.issues, start, inst);
+                    return payload;
+                }
+            }
+        }
+        return parse(payload, ctx);
+    };
+}
+const arraySize = (input) => (Array.isArray(input) ? input.length : -1);
 function handleArrayResult(result, final, index) {
     if (result.issues.length) {
         final.issues.push(...prefixIssues(index, result.issues));
@@ -6729,6 +6829,7 @@ const $ZodArray = /*@__PURE__*/ $constructor("$ZodArray", (inst, def) => {
         }
         return payload; //handleArrayResultsAsync(parseResults, final);
     };
+    capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
     const isPresent = key in input;
@@ -11058,6 +11159,84 @@ const ZodIssueCode = {
     custom: "custom",
 };
 
+/**
+ * Internal helper utilities for constructing and inspecting Redux-style
+ * lifecycle action types (`::request`, `::success`, `::failure`).
+ */
+/**
+ * Separates an action's base type from its lifecycle suffix.
+ */
+const actionSuffixDivider = '::';
+
+// biome-ignore-all lint/suspicious/noExplicitAny: ported redux-toolkit conditional-type dispatch logic (e.g. IsAny<T, ...>) requires real `any`, not `unknown`, to distinguish the two at the type level
+// biome-ignore-all lint/suspicious/noConfusingVoidType: `void` here is the ported redux-toolkit sentinel meaning "no payload type provided", distinct from `undefined` (see IfVoid in ts-helpers.ts) — replacing with `undefined` would change dispatch semantics
+/**
+ * taken from https://github.com/reduxjs/redux-toolkit/tree/master/packages/toolkit/src
+ */
+/**
+ * Creates the runtime action creator implementation shared by the overloads above.
+ *
+ * @param type - The action type to assign to created actions.
+ * @param prepareAction - An optional function that prepares payload, metadata, and errors.
+ * @returns A callable action creator with type and matching metadata.
+ * @throws {Error} When the prepare callback does not return an action object.
+ */
+function createAction(type, prepareAction) {
+    function actionCreator(...args) {
+        // Use the prepare callback when the caller needs custom payload construction.
+        if (prepareAction) {
+            const prepared = prepareAction(...args);
+            // Reject invalid prepare callbacks before reading their action fields.
+            if (!prepared) {
+                throw new Error('prepareAction did not return an object');
+            }
+            // Merge optional metadata and error fields into the prepared action.
+            return {
+                type,
+                payload: prepared.payload,
+                ...('meta' in prepared && { meta: prepared.meta }),
+                ...('error' in prepared && { error: prepared.error }),
+            };
+        }
+        return { type, payload: args[0] };
+    }
+    actionCreator.toString = () => `${type}`;
+    actionCreator.type = type;
+    actionCreator.match = (action) => action.type === type;
+    return actionCreator;
+}
+
+// biome-ignore-all lint/suspicious/noExplicitAny: generic constraints mirror create-action.ts's ported redux-toolkit PrepareAction<any> dispatch pattern
+/**
+ * Creates the runtime async action implementation shared by the overloads above.
+ *
+ * @param type - The base action type string.
+ * @param request - A prepare function for the request action payload.
+ * @param success - A prepare function for the success action payload.
+ * @param failure - An optional prepare function for the failure action payload.
+ * @returns An action creator with request, success, and optional failure actions.
+ */
+function createAsyncAction(type, request, success, failure) {
+    const action = createAction([type, 'request'].join(actionSuffixDivider), request);
+    // Attach the success action only when the caller supplied its prepare function.
+    if (success) {
+        // Add the success action while preserving the request creator's identity.
+        Object.assign(action, {
+            success: createAction([type, 'success'].join(actionSuffixDivider), success),
+        });
+    }
+    // Attach the failure action only for async workflows that support failure results.
+    if (failure) {
+        // Add the failure action alongside the existing request and success actions.
+        Object.assign(action, {
+            failure: createAction([type, 'failure'].join(actionSuffixDivider), failure),
+        });
+    }
+    // `action` is progressively mutated with `success`/`failure` properties above, so its static
+    // type can't reflect the final shape declared by this function's overload signatures.
+    return action;
+}
+
 var cjs;
 var hasRequiredCjs;
 
@@ -11202,6 +11381,13 @@ function requireCjs () {
 var cjsExports = requireCjs();
 var deepmerge = /*@__PURE__*/getDefaultExportFromCjs(cjsExports);
 
+/**
+ * Static, lowercase kebab-case label used for operational source kinds, modules and operations.
+ * Open-ended so any host or module can define its own labels, while the character set
+ * prevents URLs, user names, paths or payload fragments from becoming exported labels.
+ */
+const operationalIdentifier = string().regex(/^[a-z][a-z0-9-]*$/);
+
 /**
  * Enum representing the severity levels of telemetry items.
  *
@@ -11262,6 +11448,24 @@ const TelemetryItemNames = {
     MetadataError: 'TelemetryMetadataError',
 };
 
+/** Allowlisted operational context, captured before enrichment and preserved across relay. */
+const diagnosticContext = object({
+    schemaVersion: literal(1),
+    source: operationalIdentifier.optional(),
+    hostId: string(),
+    hostName: string().optional(),
+    hostVersion: string().optional(),
+    module: operationalIdentifier,
+    operation: operationalIdentifier,
+    outcome: _enum(['success', 'failure', 'cancelled']),
+    occurredAt: number().finite().nonnegative(),
+    unit: literal('ms'),
+    traceId: string().optional(),
+    spanId: string().optional(),
+    traceFlags: number().int().min(0).max(255).optional(),
+})
+    .strict();
+
 /**
  * Schema for a telemetry item, defining the structure and validation rules for telemetry data.
  *
@@ -11273,6 +11477,7 @@ const TelemetryItemNames = {
  */
 const TelemetryItemSchema = object({
     name: string().describe('The name of the telemetry item.'),
+    diagnostic: diagnosticContext.optional(),
     type: nativeEnum(TelemetryType).describe('The type of telemetry. Defaults to Custom.'),
     level: nativeEnum(TelemetryLevel)
         .optional()
@@ -11334,7 +11539,588 @@ const TelemetryCustomEventSchema = TelemetryEventSchema.extend({
     type: literal(TelemetryType.Custom),
 }).passthrough();
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/**
+ * Scope for built-in operational records: the host's own kind, when it classified itself,
+ * followed by `operational`. Built-in records never inherit a provider's custom default scope.
+ * @param source - Host identity captured by the composition root.
+ * @returns The record scope.
+ */
+function operationalScope(source) {
+    return source.source ? [source.source, 'operational'] : ['operational'];
+}
+
+/**
+ * Actions describing a telemetry provider's lifecycle, in-flight work and health.
+ *
+ * `initialize` and `dispose` are async actions: the request carries the shared operation
+ * promise, flows perform the work, and the success or failure action settles that promise.
+ */
+const telemetryProviderActions = {
+    /** Connects exporters, the parent relay and startup streams once. */
+    initialize: createAsyncAction('telemetry/initialize', (args, operation) => ({
+        payload: args,
+        meta: { operation },
+    }), () => ({ payload: undefined }), (error) => ({ payload: error })),
+    /** Drains owned work, closes delivery and shuts down exporters once. */
+    dispose: createAsyncAction('telemetry/dispose', (operation) => ({ payload: undefined, meta: { operation } }), () => ({ payload: undefined }), (error) => ({ payload: error })),
+    /** Delivery closed after bounded built-in enrichment drained; custom enrichment is canceled. */
+    close: createAction('telemetry/close'),
+    /** One metadata enrichment entered flight; built-in enrichment is awaited at shutdown. */
+    enrichmentStarted: createAction('telemetry/enrichment/started', (builtIn) => ({
+        payload: { builtIn },
+    })),
+    /** One metadata enrichment left flight. */
+    enrichmentSettled: createAction('telemetry/enrichment/settled', (builtIn) => ({
+        payload: { builtIn },
+    })),
+    /** Asynchronous processing entered flight for one adapter. */
+    processingStarted: createAction('telemetry/processing/started', (adapter) => ({
+        payload: adapter,
+    })),
+    /** Asynchronous processing left flight for one adapter. */
+    processingSettled: createAction('telemetry/processing/settled', (adapter) => ({
+        payload: adapter,
+    })),
+    /** A pipeline health failure occurred; occurrences are counted by message. */
+    failed: createAction('telemetry/failed', (error) => ({ payload: error })),
+};
+
+/**
+ * Creates the safe, versioned `diagnostic` envelope for a built-in record.
+ *
+ * Use it for operational notifications that have no measured duration, such as navigation
+ * or cache events; use `createOperationalRecords` for measured terminal outcomes. The envelope
+ * captures occurrence time and the active OpenTelemetry span now, so later enrichment or
+ * relaying cannot change where or when the outcome happened.
+ *
+ * @param args - Host identity and static operation identity.
+ * @returns A diagnostic envelope that passes the strict diagnostic schema.
+ * @throws {RangeError} When the source kind, module or operation is not a static identifier.
+ * @example
+ * ```ts
+ * telemetry.trackEvent({
+ *   name: 'Navigation::navigated',
+ *   level: TelemetryLevel.Information,
+ *   diagnostic: createDiagnosticContext({
+ *     source: telemetry.source,
+ *     module: 'navigation',
+ *     operation: 'notification',
+ *     outcome: 'success',
+ *   }),
+ * });
+ * ```
+ */
+function createDiagnosticContext(args) {
+    const { source, module, operation, outcome } = args;
+    // Host-defined labels are open-ended but must stay static identifiers; the kind is optional.
+    const invalid = [source.source, module, operation].some((label) => label !== undefined && !operationalIdentifier.safeParse(label).success);
+    // Reject before capture, so a dynamic label can never reach an exported record.
+    if (invalid) {
+        throw new RangeError('Invalid operational telemetry identifier');
+    }
+    const span = trace.getSpanContext(context.active());
+    // Host identity first; the fixed envelope fields cannot be overridden by it.
+    return {
+        ...source,
+        schemaVersion: 1,
+        module,
+        operation,
+        outcome,
+        occurredAt: Date.now(),
+        unit: 'ms',
+        // Correlate with the caller's active span only when one exists; never create spans.
+        ...(span ? { traceId: span.traceId, spanId: span.spanId, traceFlags: span.traceFlags } : {}),
+    };
+}
+
+/**
+ * Creates a terminal duration and, on failure, a controlled exception without copying payloads.
+ * @param args - Static operation identity, host identity, outcome, and elapsed milliseconds.
+ * @returns One duration metric and at most one sanitized exception.
+ * @throws {RangeError} When duration or static operation identifiers are invalid.
+ * @example
+ * ```ts
+ * const records = createOperationalRecords({
+ *   source: { source: 'app', hostId: crypto.randomUUID() },
+ *   module: 'host', operation: 'initialize', outcome: 'success', duration: 0,
+ * });
+ * ```
+ */
+function createOperationalRecords(args) {
+    // A finite, non-negative measurement keeps duration metrics meaningful; zero is valid.
+    if (!Number.isFinite(args.duration) || args.duration < 0) {
+        throw new RangeError('Invalid operational telemetry duration');
+    }
+    // Capture origin and existing correlation before asynchronous enrichment or relaying.
+    const diagnostic = createDiagnosticContext(args);
+    const name = `fusion.${args.module}.${args.operation}`;
+    // The measurement is not itself the error: its outcome marks a failure, and the exception
+    // alone carries Error severity, so each failure counts once in error views.
+    const metric = {
+        name: `${name}.duration`,
+        type: TelemetryType.Metric,
+        level: TelemetryLevel.Information,
+        value: args.duration,
+        scope: operationalScope(args.source),
+        diagnostic,
+        ...(args.properties ? { properties: { ...args.properties } } : {}),
+    };
+    // Success and cancellation do not fabricate exception records.
+    if (args.outcome !== 'failure') {
+        return [metric];
+    }
+    // The record name is built from validated static identifiers, so it is safe to name the
+    // failed operation; the original error, message and stack are never copied.
+    const exception = new Error(`${name} failed`);
+    exception.name = 'OperationalError';
+    exception.stack = undefined;
+    const failure = {
+        name: `${name}.failure`,
+        type: TelemetryType.Exception,
+        level: TelemetryLevel.Error,
+        exception: Object.freeze(exception),
+        scope: metric.scope,
+        diagnostic,
+        ...(args.properties ? { properties: { ...args.properties } } : {}),
+    };
+    return [metric, failure];
+}
+
+/** Named levels keep optional integrations independent of runtime enum imports. */
+const notificationLevels = {
+    debug: TelemetryLevel.Debug,
+    information: TelemetryLevel.Information,
+    warning: TelemetryLevel.Warning,
+    error: TelemetryLevel.Error,
+    critical: TelemetryLevel.Critical,
+};
+/**
+ * Creates a reporter for a module's built-in operational outcomes. Internal building block of
+ * `createOperationalTelemetry` and the shared HTTP and query integrations.
+ *
+ * Each measured report becomes one `fusion.<module>.<operation>.duration` metric, plus one
+ * sanitized `.failure` exception on failure; each notification becomes one
+ * `fusion.<module>.<operation>` event. Records carry only the safe `diagnostic` envelope and
+ * the provider's host identity, never arguments, payloads or original errors.
+ *
+ * The provider is resolved on every report, so a module can connect telemetry after
+ * initialization and disconnect it on teardown by returning `undefined`. Telemetry is
+ * optional: without a provider nothing is recorded. Delivery failures, including a custom
+ * provider without host `source` identity, never reach the business operation and produce
+ * one sanitized console warning per reporter.
+ *
+ * @param provider - Lazy provider resolution avoids startup dependency cycles.
+ * @returns A reporter accepting only allowlisted outcome inputs.
+ * @throws No errors escape; invalid providers are reported once outside the export pipeline.
+ */
+function createOperationalReporter(provider) {
+    let reported = false;
+    return (report) => {
+        try {
+            const target = provider();
+            // Optional telemetry must not impose a dependency on business operations.
+            if (!target) {
+                return;
+            }
+            // Refuse ambiguous ownership rather than inventing a source for a custom provider.
+            if (!target.source) {
+                throw new Error('Operational telemetry requires host source identity');
+            }
+            const source = target.source;
+            // Notifications have no measured duration, so they are events with the same envelope.
+            if ('notification' in report) {
+                target.trackEvent({
+                    name: `fusion.${report.module}.${report.operation}`,
+                    level: (typeof report.level === 'string' ? notificationLevels[report.level] : report.level) ??
+                        (report.outcome === 'failure' ? TelemetryLevel.Error : TelemetryLevel.Information),
+                    scope: operationalScope(source),
+                    diagnostic: createDiagnosticContext({ ...report, source }),
+                    ...(report.properties ? { properties: { ...report.properties } } : {}),
+                });
+                return;
+            }
+            // Failure records pair the terminal measurement with one controlled exception.
+            for (const record of createOperationalRecords({ ...report, source })) {
+                target.track(record);
+            }
+        }
+        catch {
+            // Delivery failures are diagnostic health, never recursive exported exceptions.
+            if (!reported) {
+                reported = true;
+                console.warn('Operational telemetry delivery failed');
+            }
+        }
+    };
+}
+
+/** Weak classifications shared across scopes without retaining or mutating business errors. */
+const operationalErrorState = {
+    cancellations: new WeakSet(),
+    reasons: new WeakMap(),
+};
+
+/**
+ * Classifies failure or cancellation through at most five wrapped causes.
+ * @param error - Original operation error.
+ * @returns Terminal outcome and an optional controlled reason.
+ */
+function classifyOperationalError(error) {
+    let current = error;
+    let reason;
+    // Bound traversal even for cyclic causes.
+    for (let depth = 0; depth < 5 && current && typeof current === 'object'; depth++) {
+        reason ??= operationalErrorState.reasons.get(current);
+        // A marked nested cancellation wins over a wrapping failure.
+        if (operationalErrorState.cancellations.has(current)) {
+            return { outcome: 'cancelled', reason };
+        }
+        current = 'cause' in current ? current.cause : undefined;
+    }
+    return { outcome: 'failure', reason };
+}
+
+/**
+ * Marks a deliberate cancellation without mutating the caller's error.
+ * @template T - Error object type.
+ * @param error - Original error.
+ * @param reason - Optional controlled reason code.
+ * @returns The original error.
+ */
+function markOperationalCancellation(error, reason) {
+    operationalErrorState.cancellations.add(error);
+    // Reason codes are optional; an existing classification must survive an unqualified mark.
+    if (reason) {
+        operationalErrorState.reasons.set(error, reason);
+    }
+    return error;
+}
+
+/**
+ * Associates a controlled reason code with an error without changing it.
+ * @template T - Error object type.
+ * @param error - Original error.
+ * @param reason - Static reason code, never error text.
+ * @returns The original error.
+ */
+function markOperationalReason(error, reason) {
+    operationalErrorState.reasons.set(error, reason);
+    return error;
+}
+
+const safeKey = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const safeVersion = /^[0-9A-Za-z][0-9A-Za-z.+-]{0,63}$/;
+/**
+ * Omits identity containing paths, URLs, whitespace or unbounded dynamic fragments.
+ * @param value - Candidate static identity.
+ * @param kind - Identifier or semantic-version-like identity.
+ * @returns Validated identity, or undefined when unsafe.
+ */
+function safeOperationalIdentity(value, kind = 'key') {
+    return typeof value === 'string' && (kind === 'key' ? safeKey : safeVersion).test(value)
+        ? value
+        : undefined;
+}
+
+const noop = () => undefined;
+/** Shared bounded operation lifecycle behind the public telemetry factory. */
+class OperationalTelemetryHandle {
+    module;
+    options;
+    parent;
+    /** {@inheritDoc OperationalTelemetry.classifyError} */
+    classifyError = classifyOperationalError;
+    /** {@inheritDoc OperationalTelemetry.markCancellation} */
+    markCancellation = markOperationalCancellation;
+    /** {@inheritDoc OperationalTelemetry.markReason} */
+    markReason = markOperationalReason;
+    /** {@inheritDoc OperationalTelemetry.safeIdentity} */
+    safeIdentity = safeOperationalIdentity;
+    #pending = new Set();
+    #busyChildren = new Set();
+    #teardowns = [];
+    #target;
+    #closed = false;
+    #warned = false;
+    #reporter;
+    /**
+     * Creates one scope; children resolve their target through the parent.
+     * @param module - Validated static module label.
+     * @param options - End-time identity.
+     * @param parent - Owning scope, when this is a child.
+     */
+    constructor(module, options, parent) {
+        this.module = module;
+        this.options = options;
+        this.parent = parent;
+        this.#reporter = createOperationalReporter(() => this.#resolve());
+    }
+    /** {@inheritDoc OperationalTelemetry.connected} */
+    get connected() {
+        return this.active;
+    }
+    /** {@inheritDoc OperationalTelemetry.active} */
+    get active() {
+        return this.#resolve() !== undefined;
+    }
+    /** {@inheritDoc OperationalTelemetry.pending} */
+    get pending() {
+        return this.#pending.size;
+    }
+    /** {@inheritDoc OperationalTelemetry.connect} */
+    connect = (target) => {
+        // Scope disposal is final, even if a host tries to reconnect it.
+        if (!this.#closed) {
+            this.#target = target;
+        }
+    };
+    /** {@inheritDoc OperationalTelemetry.disconnect} */
+    disconnect = () => {
+        this.close();
+    };
+    /** {@inheritDoc OperationalTelemetry.report} */
+    report = (report) => {
+        this.#reporter({ ...report, module: this.module });
+    };
+    /** {@inheritDoc OperationalTelemetry.createScope} */
+    createScope(options) {
+        const child = new OperationalTelemetryHandle(this.module, options, this);
+        // Children cannot revive closed ownership.
+        if (this.#closed) {
+            child.close();
+        }
+        return child;
+    }
+    /** {@inheritDoc OperationalTelemetry.start} */
+    start(operation, properties) {
+        return this.reserve(operation, properties) ?? noop;
+    }
+    /** {@inheritDoc OperationalTelemetry.reserve} */
+    reserve(operation, properties) {
+        // Absent or disposed telemetry retains no timers or observation work.
+        if (!this.active) {
+            return undefined;
+        }
+        // Hung operations must not grow an unbounded set of retained callbacks.
+        if (this.#pending.size >= 256) {
+            this.#warn('pending-operation capacity exceeded');
+            return undefined;
+        }
+        const started = performance.now();
+        const end = (outcome, extra) => {
+            // Only the first terminal path records, even when teardown races with completion.
+            if (!this.#pending.delete(end)) {
+                return;
+            }
+            this.#releaseParentIfIdle();
+            try {
+                // Terminal fields override late-resolved identity, which extends the initial summaries.
+                const fields = { ...properties, ...this.options?.identity?.(), ...extra };
+                this.report({
+                    operation,
+                    outcome,
+                    duration: Math.max(0, performance.now() - started),
+                    ...(Object.keys(fields).length ? { properties: fields } : {}),
+                });
+            }
+            catch {
+                this.#warn('identity resolution failed');
+            }
+        };
+        this.#pending.add(end);
+        this.#retainParent();
+        return end;
+    }
+    /** {@inheritDoc OperationalTelemetry.measure} */
+    measure(operation, properties) {
+        return (source) => defer(() => {
+            const end = this.reserve(operation, properties);
+            // With no retained timer, do not add observers to the business stream.
+            if (!end) {
+                return source;
+            }
+            let emitted = false;
+            // Linked operators preserve synchronous downstream unsubscription and original errors.
+            return source.pipe(tap({
+                next: () => {
+                    emitted = true;
+                },
+                error: (error) => {
+                    const { outcome, reason } = classifyOperationalError(error);
+                    end(outcome, reason ? { reason } : undefined);
+                },
+                complete: () => end('success'),
+            }), finalize$1(() => end(emitted ? 'success' : 'cancelled')));
+        });
+    }
+    /** {@inheritDoc OperationalTelemetry.notify} */
+    notify(operation, outcome, properties) {
+        this.report({
+            operation,
+            outcome,
+            properties,
+            notification: true,
+            level: outcome === 'failure' ? TelemetryLevel.Warning : TelemetryLevel.Information,
+        });
+    }
+    /** {@inheritDoc OperationalTelemetry.own} */
+    own(teardown) {
+        // Idle children can outlive an ancestor without being retained by it.
+        if (this.#isClosed()) {
+            this.#release(teardown);
+            return;
+        }
+        this.#teardowns.push(teardown);
+        this.#retainParent();
+    }
+    /** {@inheritDoc OperationalTelemetry.cancelPending} */
+    cancelPending(properties) {
+        // Each end removes itself, so iterate a stable snapshot.
+        for (const end of [...this.#pending]) {
+            end('cancelled', properties);
+        }
+    }
+    /** {@inheritDoc OperationalTelemetry.close} */
+    close(properties) {
+        // Repeated disposal must neither emit nor release resources twice.
+        if (this.#closed) {
+            return;
+        }
+        // Children need the live parent target to record their cancellations.
+        for (const child of [...this.#busyChildren]) {
+            child.close(properties);
+        }
+        this.cancelPending(properties);
+        this.#closed = true;
+        this.#target = undefined;
+        // Idle descendants resolve closure through their ancestor rather than being retained.
+        if (this.parent) {
+            this.parent.#busyChildren.delete(this);
+            this.parent.#releaseParentIfIdle();
+        }
+        const teardowns = this.#teardowns;
+        this.#teardowns = [];
+        // One failing observer must not prevent other observers from being released.
+        for (const teardown of teardowns) {
+            this.#release(teardown);
+        }
+    }
+    /**
+     * Resolves live ownership without retaining idle children.
+     * @returns The live ancestor's telemetry target, or undefined after closure.
+     */
+    #resolve() {
+        // Cleared targets alone cannot prevent a child from reconnecting after final disposal.
+        if (this.#closed) {
+            return undefined;
+        }
+        return this.parent ? this.parent.#resolve() : this.#target;
+    }
+    /**
+     * Includes closed idle ancestors, which are deliberately not retained in child sets.
+     * @returns Whether this scope or any ancestor has closed.
+     */
+    #isClosed() {
+        return this.#closed || (this.parent ? this.parent.#isClosed() : false);
+    }
+    /** Keeps every ancestor aware of owned work, including nested scopes. */
+    #retainParent() {
+        // Propagate busy ownership through all ancestors, not only the immediate parent.
+        if (this.parent) {
+            this.parent.#busyChildren.add(this);
+            this.parent.#retainParent();
+        }
+    }
+    /** Drops settled children so abandoned idle owners are not retained. */
+    #releaseParentIfIdle() {
+        // Retain only work or resources, never abandoned idle child handles.
+        if (!this.#pending.size && !this.#busyChildren.size && !this.#teardowns.length) {
+            // Settling the last descendant can also make its ancestors idle.
+            if (this.parent) {
+                this.parent.#busyChildren.delete(this);
+                this.parent.#releaseParentIfIdle();
+            }
+        }
+    }
+    /**
+     * Isolates resource failures so all owned observers are released.
+     * @param teardown - Owned diagnostic resource.
+     */
+    #release(teardown) {
+        try {
+            // Accept RxJS subscriptions without making plain teardowns allocate subscriptions.
+            if (typeof teardown === 'function') {
+                teardown();
+            }
+            else {
+                teardown.unsubscribe();
+            }
+        }
+        catch {
+            this.#warn('diagnostic teardown failed');
+        }
+    }
+    /**
+     * Bounds sanitized local diagnostics independently of exported operational records.
+     * @param reason - Static local diagnostic.
+     */
+    #warn(reason) {
+        // Local diagnostic failures cannot amplify into repeated warnings or exported records.
+        if (!this.#warned) {
+            this.#warned = true;
+            console.warn(`Operational telemetry for ${this.module}: ${reason}`);
+        }
+    }
+}
+
+/**
+ * Creates the operational telemetry handle a module uses to report safe outcomes.
+ *
+ * This is the common wiring pattern for framework modules: the provider owns the handle,
+ * the module connects it after initialization, and teardown disconnects it. A measured report
+ * becomes one `fusion.<module>.<operation>.duration` metric, plus one sanitized `.failure`
+ * exception on failure; a notification becomes one `fusion.<module>.<operation>` event.
+ * Telemetry stays optional: until connected, nothing is recorded. Delivery failures never
+ * reach the business operation and produce one sanitized console warning per handle.
+ *
+ * @param module - Static kebab-case module label, such as `signalr`.
+ * @param options - Optional static identity resolved when measured operations end.
+ * @returns A disconnected handle.
+ * @throws {RangeError} When `module` is not a static kebab-case identifier.
+ * @example
+ * ```ts
+ * class SignalRProvider extends BaseModuleProvider<Config> implements TelemetryConnectable {
+ *   #telemetry = createOperationalTelemetry('signalr');
+ *
+ *   constructor(config: Config) {
+ *     super({ version, config });
+ *     this._addTeardown(() => this.#telemetry.disconnect());
+ *   }
+ *
+ *   connectTelemetry(telemetry: ITelemetryProvider | undefined): void {
+ *     this.#telemetry.connect(telemetry);
+ *   }
+ *
+ *   async connect(): Promise<void> {
+ *     const started = performance.now();
+ *     await this.#start();
+ *     this.#telemetry.report({ operation: 'connect', outcome: 'success', duration: performance.now() - started });
+ *   }
+ * }
+ *
+ * // Module descriptor: connect after initialization, so startup never waits for telemetry.
+ * postInitialize: async ({ instance, modules }) => instance.connectTelemetry?.(modules.telemetry),
+ * ```
+ */
+function createOperationalTelemetry(module, options) {
+    // A dynamic label would leak into every record name, so reject it when the handle is created.
+    if (!operationalIdentifier.safeParse(module).success) {
+        throw new RangeError('Invalid operational telemetry module');
+    }
+    return new OperationalTelemetryHandle(module, options);
+}
+
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11388,7 +12174,7 @@ const RESOURCE = "resource";
 const CLI_DATA = "clidata";
 const ATTRIBUTE_TOKENS = "attribute_tokens";
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11622,7 +12408,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11651,7 +12437,7 @@ function createAuthError(code, correlationId, additionalMessage) {
     return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage$1(code));
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11674,7 +12460,7 @@ function createClientAuthError(errorCode, correlationId, additionalMessage) {
     return new ClientAuthError(errorCode, correlationId, additionalMessage);
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11712,7 +12498,7 @@ const methodNotImplemented = "method_not_implemented";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11750,7 +12536,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11816,7 +12602,7 @@ function getJWSPayload(authToken, correlationId) {
     return matches[2];
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11904,7 +12690,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11918,7 +12704,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11940,7 +12726,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11964,7 +12750,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /**
  * Returns the AccountInfo interface for this account.
  * @internal
@@ -12153,7 +12939,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12163,7 +12949,7 @@ function isAccountEntity(entity) {
  */
 const unexpectedError = "unexpected_error";
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12183,7 +12969,7 @@ function createClientConfigurationError(errorCode, correlationId) {
     return new ClientConfigurationError(errorCode, correlationId);
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12214,7 +13000,7 @@ const invalidDpopHtu = "invalid_dpop_htu";
 const invalidDpopNonce = "invalid_dpop_nonce";
 const dpopMissingResourceContext = "dpop_missing_resource_context";
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12226,7 +13012,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12306,7 +13092,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12464,7 +13250,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12618,7 +13404,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12627,7 +13413,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12637,7 +13423,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12647,7 +13433,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12718,7 +13504,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12811,7 +13597,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -12922,7 +13708,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12987,7 +13773,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13274,7 +14060,7 @@ function serializeAttributeTokens(attributeTokens) {
     return [...attributeTokens].sort().join(" ");
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14242,7 +15028,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14276,7 +15062,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14472,7 +15258,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -14958,7 +15744,7 @@ function addAttributeTokens(parameters, attributeTokens) {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -15080,7 +15866,7 @@ function validateUrl(url, logger, correlationId) {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -15128,7 +15914,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -15151,7 +15937,7 @@ const DEFAULT_TOKEN_BINDING_KEY_MANAGER = {
     },
 };
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -15426,12 +16212,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$2 = "16.14.2";
+const version$2 = "16.14.3";
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -15439,7 +16225,7 @@ const version$2 = "16.14.2";
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -15477,7 +16263,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16664,7 +17450,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -16678,7 +17464,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16736,7 +17522,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16834,7 +17620,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -16861,7 +17647,7 @@ function isOidcProtocolMode(config) {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16882,7 +17668,7 @@ function createJoseHeaderError(code, correlationId) {
     return new JoseHeaderError(code, correlationId);
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -16907,7 +17693,7 @@ function isPlainObject(value) {
     return Object.getPrototypeOf(value) === proto;
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -16917,7 +17703,7 @@ const missingAlgError = "missing_alg_error";
 const missingJwkError = "missing_jwk_error";
 const invalidJwkError = "invalid_jwk_error";
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -16983,7 +17769,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17084,7 +17870,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17229,7 +18015,7 @@ class DpopProofGenerator {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -17280,7 +18066,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17347,7 +18133,7 @@ function createInteractionRequiredAuthError(errorCode, correlationId, errorMessa
     return new InteractionRequiredAuthError(errorCode, correlationId, errorMessage);
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17366,7 +18152,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17437,7 +18223,7 @@ function parseRequestState(base64Decode, state, correlationId) {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17865,7 +18651,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -17875,7 +18661,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -17894,7 +18680,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint, fmiP
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -17918,7 +18704,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18004,7 +18790,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18035,7 +18821,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18168,7 +18954,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18432,7 +19218,7 @@ class AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18659,7 +19445,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -18894,7 +19680,7 @@ class RefreshTokenClient {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19187,7 +19973,7 @@ class StubServerTelemetryManager extends ServerTelemetryManager {
     clearNativeBrokerErrorCode() { }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19314,7 +20100,7 @@ class SilentFlowClient {
     }
 }
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19330,7 +20116,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v16.14.2 2026-10-02 */
+/*! @azure/msal-common v16.14.3 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19363,7 +20149,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -19504,7 +20290,7 @@ const DecryptEarResponse = "decryptEarResponse";
  */
 const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19527,7 +20313,7 @@ function createBrowserAuthError(errorCode, correlationId, subError) {
     return new BrowserAuthError(errorCode, correlationId, subError);
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -19585,7 +20371,7 @@ const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
 const timedOut = "timed_out";
 const emptyResponse = "empty_response";
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19624,7 +20410,7 @@ function base64DecToArr(base64String) {
     return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -19810,7 +20596,7 @@ const iFrameRenewalPolicies = [
     CacheLookupPolicy.RefreshTokenAndNetwork,
 ];
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -19855,7 +20641,7 @@ function base64EncArr(aBytes) {
     return btoa(binString);
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20202,7 +20988,7 @@ async function computeJwkThumbprint(publicJwk, correlationId) {
     return hashString(thumbprintJson);
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20222,7 +21008,7 @@ function createBrowserConfigurationAuthError(errorCode, correlationId) {
     return new BrowserConfigurationAuthError(errorCode, correlationId, getDefaultErrorMessage(errorCode));
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -20230,7 +21016,7 @@ function createBrowserConfigurationAuthError(errorCode, correlationId) {
 const storageNotSupported = "storage_not_supported";
 const inMemRedirectUnavailable = "in_mem_redirect_unavailable";
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20571,7 +21357,7 @@ function createGuid() {
     return createNewGuid();
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20774,7 +21560,7 @@ class DatabaseStorage {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -20820,7 +21606,7 @@ class MemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -20958,7 +21744,7 @@ class AsyncMemoryStorage {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21106,7 +21892,7 @@ TokenBindingKeyManager.TOKEN_BINDING_KEY_USAGES = [
     "verify",
 ];
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21242,7 +22028,7 @@ class CryptoOps {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21289,7 +22075,7 @@ const LocalStorageUpdated = "localStorageUpdated";
  */
 const SsoCapable = "ssoCapable";
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21318,7 +22104,7 @@ function getTokenKeysCacheKey(clientId, schema = CREDENTIAL_SCHEMA_VERSION) {
     return `${PREFIX}.${schema}.${TOKEN_KEYS}.${clientId}`;
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21409,7 +22195,7 @@ function getCookieExpirationTime(cookieLifeDays) {
     return expr.toUTCString();
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21451,7 +22237,7 @@ function getTokenKeys(clientId, storage, schemaVersion) {
     };
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21462,7 +22248,7 @@ function isEncrypted(data) {
         data.hasOwnProperty("data"));
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21832,7 +22618,7 @@ class LocalStorage {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -21874,7 +22660,7 @@ class SessionStorage {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21902,12 +22688,12 @@ const EventType = {
     BROKER_CONNECTION_ESTABLISHED: "msal:brokerConnectionEstablished",
 };
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version$1 = "5.25.0";
+const version$1 = "5.26.0";
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -21924,7 +22710,7 @@ function removeElementFromArray(array, element) {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23370,7 +24156,7 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient, even
     return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger, performanceClient, eventHandler, staticAuthorityOptions, tokenBindingKeyManager);
 };
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -23417,7 +24203,7 @@ function getActiveAccount(browserStorage, correlationId) {
     return browserStorage.getActiveAccount(correlationId);
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23521,7 +24307,7 @@ class EventHandler {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23664,7 +24450,7 @@ async function clearCacheOnLogout(browserStorage, browserCrypto, logger, correla
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -23802,7 +24588,7 @@ function validateRequestMethod(interactionRequest, protocolMode) {
     return httpMethod;
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24009,7 +24795,56 @@ async function initializeAuthorizationRequest(request, interactionType, config,
     return validatedRequest;
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns true when the supplied user agent is using Safari
+ *
+ * @internal
+ */
+function isSafari(userAgent = typeof navigator !== "undefined"
+    ? navigator.userAgent
+    : "") {
+    if (/OPR\/|OPiOS|PhantomJS|SamsungBrowser|Edge|EdgiOS|EdgA/.test(userAgent)) {
+        return false;
+    }
+    const browserNavigator = typeof navigator !== "undefined"
+        ? navigator
+        : undefined;
+    if (/Edg/.test(userAgent) ||
+        browserNavigator?.userAgentData?.brands?.some((brand) => brand?.brand === "Microsoft Edge")) {
+        return false;
+    }
+    if (/Electron|CriOS|Chrome|Trident|FxiOS|Firefox/.test(userAgent)) {
+        return false;
+    }
+    return /Safari/.test(userAgent) || /AppleWebKit/.test(userAgent);
+}
+/**
+ * Returns true when EAR should be used for the current request.
+ *
+ * Safari cannot complete EAR's cross-origin form POST, so requests configured
+ * for EAR transparently use authorization code flow instead.
+ *
+ * @internal
+ */
+function shouldUseEar(protocolMode, logger, performanceClient, correlationId, userAgent) {
+    if (protocolMode !== ProtocolMode.EAR) {
+        return false;
+    }
+    if (!isSafari(userAgent)) {
+        return true;
+    }
+    logger.verbose("0wirye", correlationId);
+    performanceClient.addFields({ "ext.earFallbackReason": "safari" }, correlationId);
+    return false;
+}
+
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -24027,7 +24862,7 @@ async function initializeAuthorizationRequest(request, interactionType, config,
  */
 const POPUP_RELAY_RESPONSE_TYPE = "msal:popup-relay-response:v1";
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24133,7 +24968,7 @@ async function waitForPopupRelayResponse(timeoutMs, logger, request, popupWindow
     });
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24157,7 +24992,7 @@ function extractBrowserRequestState(browserCrypto, state, correlationId) {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24196,7 +25031,7 @@ function validateInteractionType(response, browserCrypto, interactionType, corre
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24285,7 +25120,7 @@ class InteractionHandler {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24330,7 +25165,7 @@ function createPlatformAuthExtraParametersNoCache(extraParametersNoCache, isProo
     };
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -24339,7 +25174,7 @@ const contentError = "ContentError";
 const pageException = "PageException";
 const userSwitch = "user_switch";
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -24352,7 +25187,7 @@ const DISABLED = "DISABLED";
 const ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
 const UI_NOT_ALLOWED = "UI_NOT_ALLOWED";
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24424,7 +25259,7 @@ function createNativeAuthError(code, correlationId, description, ext) {
     return error;
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24473,7 +25308,7 @@ class SilentCacheClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25199,7 +26034,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25512,7 +26347,7 @@ async function handleResponseEAR(request, response, apiId, config, authority, br
     return (await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, apiId, additionalData, undefined, undefined, undefined, undefined));
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25567,7 +26402,7 @@ async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceCl
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25610,7 +26445,7 @@ class NavigationClient {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25757,7 +26592,7 @@ function getHeaderDict(headers) {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25888,7 +26723,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
     return overlayedConfig;
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26263,7 +27098,7 @@ class PlatformAuthExtensionHandler {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26514,7 +27349,7 @@ class PlatformAuthDOMHandler {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout, enablePlatformBrokerDOMSupport) {
     logger.trace("134j0v", correlationId);
     const discoveryMeasurement = performanceClient.startMeasurement(PlatformAuthProviderDiscovery, correlationId);
@@ -26616,7 +27451,7 @@ function isPlatformAuthAllowed(config, logger, correlationId, platformAuthProvid
     return true;
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -26719,7 +27554,7 @@ class PopupClient extends StandardInteractionClient {
         }
         const isPlatformBroker = isPlatformAuthAllowed(this.config, this.logger, this.correlationId, this.platformAuthProvider, request.authenticationScheme);
         validRequest.platformBroker = isPlatformBroker;
-        if (this.config.system.protocolMode === ProtocolMode.EAR) {
+        if (shouldUseEar(this.config.system.protocolMode, this.logger, this.performanceClient, this.correlationId)) {
             return this.executeEarFlow(validRequest, popupParams, pkceCodes);
         }
         else {
@@ -27125,7 +27960,7 @@ class PopupClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27175,7 +28010,7 @@ class RedirectClient extends StandardInteractionClient {
         // Clear temporary cache if the back button is clicked during the redirect flow.
         window.addEventListener("pageshow", handleBackButton);
         try {
-            const redirectOperation = this.config.system.protocolMode === ProtocolMode.EAR
+            const redirectOperation = shouldUseEar(this.config.system.protocolMode, this.logger, this.performanceClient, this.correlationId)
                 ? this.executeEarFlow(validRequest)
                 : this.executeCodeFlow(validRequest);
             await Promise.race([redirectOperation, backButtonCancellation]);
@@ -27575,7 +28410,7 @@ class RedirectClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27641,7 +28476,7 @@ function removeHiddenIframe(iframe) {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27681,7 +28516,7 @@ class SilentIframeClient extends StandardInteractionClient {
         const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
         silentRequest.platformBroker = isPlatformAuthAllowed(this.config, this.logger, this.correlationId, this.platformAuthProvider, silentRequest.authenticationScheme);
         preconnect(silentRequest.authority);
-        if (this.config.system.protocolMode === ProtocolMode.EAR) {
+        if (shouldUseEar(this.config.system.protocolMode, this.logger, this.performanceClient, this.correlationId)) {
             return this.executeEarFlow(silentRequest);
         }
         else {
@@ -27879,7 +28714,7 @@ class SilentIframeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27946,7 +28781,7 @@ class SilentRefreshClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -27959,7 +28794,7 @@ class HybridSpaAuthorizationCodeClient extends AuthorizationCodeClient {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28032,7 +28867,7 @@ class SilentAuthCodeClient extends StandardInteractionClient {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
     const frameInstances = 
     // @ts-ignore
@@ -28048,7 +28883,7 @@ function collectInstanceStats(currentClientId, performanceEvent, logger, correla
     });
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -28066,14 +28901,20 @@ function resolveSilentRequestPreparation(input, platformAuthProvider, logger, pe
     return prepareRequest(input);
 }
 /**
- * Preserves the standard web thumbprint and caller-owned request references.
+ * Extends the web thumbprint with silent-flow options while preserving caller-owned references.
  */
 function prepareWebSilentRequest({ request, account, correlationId, config, }) {
     const thumbprint = getRequestThumbprint(config.auth.clientId, {
         ...request,
         authority: request.authority || config.auth.authority}, account.homeAccountId);
     return {
-        key: JSON.stringify(thumbprint),
+        key: JSON.stringify({
+            ...thumbprint,
+            forceRefresh: !!request.forceRefresh,
+            cacheLookupPolicy: request.cacheLookupPolicy ?? CacheLookupPolicy.Default,
+            extraParameters: canonicalizeStringDict(request.extraParameters),
+            extraQueryParameters: canonicalizeStringDict(request.extraQueryParameters),
+        }),
         request,
         account,
     };
@@ -28167,7 +29008,7 @@ function canonicalizeStringDict(values = {}) {
         .map((key) => [key, values[key]]);
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29669,7 +30510,7 @@ function checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheL
     return isSilentlyResolvable && tryIframeRenewal;
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29774,7 +30615,7 @@ class BaseOperatingContext {
     }
 }
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -29821,7 +30662,7 @@ StandardOperatingContext.MODULE_NAME = "";
  */
 StandardOperatingContext.ID = "StandardOperatingContext";
 
-/*! @azure/msal-browser v5.25.0 2026-10-06 */
+/*! @azure/msal-browser v5.26.0 2026-10-21 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -30453,7 +31294,7 @@ const createClientLogCallback = (provider, metadata, scope) => {
 };
 
 // Generated by genversion.
-const version = '12.0.1';
+const version = '12.1.0-next.0';
 
 /**
  * Zod schema for telemetry configuration validation.
@@ -31696,6 +32537,8 @@ class MsalProvider extends BaseModuleProvider {
     #client;
     #telemetry;
     #requiresAuth;
+    /** Safe operational outcomes; never carries accounts, scopes, codes, tokens or raw errors. */
+    #operational = createOperationalTelemetry('msal');
     #authCode;
     #loginHint;
     /**
@@ -31770,6 +32613,9 @@ class MsalProvider extends BaseModuleProvider {
         });
         this.#requiresAuth = config.requiresAuth;
         this.#telemetry = config.telemetry;
+        this.#operational.connect(config.telemetry?.provider);
+        // In-flight flows must not report into a torn-down telemetry host.
+        this._addTeardown(() => this.#operational.disconnect());
         this.#loginHint = config.loginHint;
         // Extract auth code from config if present
         // This will be used during initialize to exchange for tokens
@@ -31825,6 +32671,7 @@ class MsalProvider extends BaseModuleProvider {
         // Priority 0: Exchange auth code if provided by backend
         // This must happen before the requiresAuth check so tokens are cached
         if (this.#authCode) {
+            const exchangeStarted = performance.now();
             try {
                 this._trackEvent('initialize.exchanging-auth-code', TelemetryLevel.Information);
                 // Use MSAL's acquireTokenByCode to exchange backend auth code for tokens
@@ -31846,21 +32693,22 @@ class MsalProvider extends BaseModuleProvider {
                 // Successfully exchanged auth code - set active account
                 if (result.account) {
                     this.#client.setActiveAccount(result.account);
-                    this._trackEvent('initialize.auth-code-exchanged-account', TelemetryLevel.Information, {
-                        properties: {
-                            username: result.account.username,
-                        },
-                    });
+                    // Account identifiers are never recorded; the event only marks the transition.
+                    this._trackEvent('initialize.auth-code-exchanged-account', TelemetryLevel.Information);
                 }
+                this.#operational.report({
+                    operation: 'exchange-auth-code',
+                    outcome: 'success',
+                    duration: performance.now() - exchangeStarted,
+                });
             }
-            catch (error) {
-                // Auth code exchange failed - log and fall back to standard flows
-                this._trackException('initialize.auth-code-exchange-failed', TelemetryLevel.Warning, {
-                    exception: error instanceof Error ? error : new Error(String(error)),
-                    properties: {
-                        message: error instanceof Error ? error.message : String(error),
-                        reason: 'Auth code exchange failed, falling back to standard authentication flows',
-                    },
+            catch {
+                // Auth code exchange failed - record a sanitized outcome and fall back to standard flows.
+                // The original error may describe the code or account, so it is never recorded.
+                this.#operational.report({
+                    operation: 'exchange-auth-code',
+                    outcome: 'failure',
+                    duration: performance.now() - exchangeStarted,
                 });
                 // Continue to requiresAuth check - will trigger standard login if needed
             }
@@ -31879,11 +32727,7 @@ class MsalProvider extends BaseModuleProvider {
                 // Successfully authenticated via redirect - set as active account
                 // This means the user was redirected to Microsoft and came back authenticated
                 this.#client.setActiveAccount(handleRedirectResult.account);
-                this._trackEvent('initialize.active-account-set-by-callback', TelemetryLevel.Information, {
-                    properties: {
-                        username: handleRedirectResult.account.username,
-                    },
-                });
+                this._trackEvent('initialize.active-account-set-by-callback', TelemetryLevel.Information);
             }
             else if (!this.#client.hasValidClaims) {
                 // Priority 2: No valid session found - attempt automatic login
@@ -31895,11 +32739,7 @@ class MsalProvider extends BaseModuleProvider {
                 if (loginResult?.account) {
                     // Automatic login successful - set as active account
                     this.#client.setActiveAccount(loginResult.account);
-                    this._trackEvent('initialize.active-account-set-by-login', TelemetryLevel.Information, {
-                        properties: {
-                            username: loginResult.account.username,
-                        },
-                    });
+                    this._trackEvent('initialize.active-account-set-by-login', TelemetryLevel.Information);
                 }
             }
             // Priority 3: If hasValidClaims is true, user is already authenticated - no action needed
@@ -31974,8 +32814,8 @@ class MsalProvider extends BaseModuleProvider {
         // Extract caller-provided scopes from either new format (request.scopes) or legacy format (scopes)
         const candidateScopes = inputRequest?.scopes ?? options?.scopes ?? [];
         const scopes = candidateScopes.length > 0 ? candidateScopes : defaultScopes.length > 0 ? defaultScopes : [];
-        // Prepare telemetry properties for this token acquisition attempt
-        const telemetryProperties = { behavior, silent, scopes };
+        // Flow flags only; scopes identify the requested resources and are never recorded.
+        const telemetryProperties = { behavior, silent };
         // Track usage of deprecated legacy scopes format for migration monitoring
         if (options?.scopes) {
             this._trackEvent('acquireToken.legacy-scopes-provided', TelemetryLevel.Warning, {
@@ -31987,7 +32827,7 @@ class MsalProvider extends BaseModuleProvider {
             // Fall back to the client-id-derived default scope when one is available
             if (defaultScopes.length > 0) {
                 this._trackEvent('acquireToken.missing-scope.defaulted', TelemetryLevel.Warning, {
-                    properties: { ...telemetryProperties, defaultScopes },
+                    properties: telemetryProperties,
                 });
             }
             else {
@@ -32000,10 +32840,11 @@ class MsalProvider extends BaseModuleProvider {
                 // This allows us to monitor how often empty scopes are provided before enforcing validation
             }
         }
+        // Token acquisition for telemetry delivery belongs to the export and is never recorded,
+        // otherwise each export would produce a record to export in turn.
+        const operational = options && telemetryExportRequest in options ? undefined : this.#operational;
+        const started = performance.now();
         try {
-            const measurement = this._trackMeasurement('acquireToken', TelemetryLevel.Information, {
-                properties: telemetryProperties,
-            });
             // Merge account, original request options, and resolved scopes.
             // Account ensures context awareness, request preserves custom options, scopes uses resolved value.
             const result = await this.#client.acquireToken({
@@ -32011,23 +32852,29 @@ class MsalProvider extends BaseModuleProvider {
                 silent,
                 request: { ...inputRequest, account, scopes },
             });
-            measurement?.measure();
+            operational?.report({
+                operation: 'acquire-token',
+                outcome: 'success',
+                duration: performance.now() - started,
+            });
             return result;
         }
         catch (error) {
             // Inside MSAL's hidden iframe, silent acquisition may fail and the client
             // would fall back to acquireTokenRedirect which throws "block_iframe_reload".
-            // Suppress this — the parent frame handles interactive auth.
+            // Suppress this — the parent frame handles interactive auth, so it is not a failure.
+            operational?.report({
+                operation: 'acquire-token',
+                outcome: inIframe || isUserCancellation(error) ? 'cancelled' : 'failure',
+                duration: performance.now() - started,
+            });
+            // The hidden iframe defers to the parent frame instead of rethrowing.
             if (inIframe) {
                 this._trackEvent('acquireToken.suppressed-in-iframe', TelemetryLevel.Debug, {
                     properties: telemetryProperties,
                 });
                 return undefined;
             }
-            this._trackException('acquireToken-failed', TelemetryLevel.Error, {
-                exception: error,
-                properties: telemetryProperties,
-            });
             throw error;
         }
     }
@@ -32094,7 +32941,8 @@ class MsalProvider extends BaseModuleProvider {
         // Determine if silent login is possible based on available account/hint information
         // Silent login requires either an account object or a loginHint to work
         const canLoginSilently = silent && (request.account || request.loginHint);
-        const telemetryProperties = { behavior, silent, canLoginSilently, scopes: request.scopes };
+        // Flow flags only; scopes identify the requested resources and are never recorded.
+        const telemetryProperties = { behavior, silent, canLoginSilently: Boolean(canLoginSilently) };
         // Default to active account if no account/hint provided in request
         // This allows silent login to work automatically with existing authentication state
         request.account ??= this.account ?? undefined;
@@ -32108,19 +32956,49 @@ class MsalProvider extends BaseModuleProvider {
         this._trackEvent('login', TelemetryLevel.Information, {
             properties: telemetryProperties,
         });
+        const started = performance.now();
+        try {
+            const result = await this.#login(request, behavior, Boolean(canLoginSilently));
+            this.#operational.report({
+                operation: 'login',
+                outcome: 'success',
+                duration: performance.now() - started,
+            });
+            return result;
+        }
+        catch (error) {
+            this.#operational.report({
+                operation: 'login',
+                outcome: isUserCancellation(error) ? 'cancelled' : 'failure',
+                duration: performance.now() - started,
+            });
+            throw error;
+        }
+    }
+    /**
+     * Runs the silent-then-interactive login flow measured by {@link login}.
+     * @param request - Resolved login request.
+     * @param behavior - Interactive fallback behavior.
+     * @param canLoginSilently - Whether a silent attempt is possible.
+     * @returns The login result, or `undefined` for a redirect that navigates away.
+     * @throws The original MSAL error, or an error for an unsupported behavior.
+     */
+    async #login(request, behavior, canLoginSilently) {
         // Attempt silent authentication first if conditions are met
         // This provides better UX by avoiding unnecessary popups/redirects
         if (canLoginSilently) {
             try {
                 return await this.#client.ssoSilent(request);
             }
-            catch (error) {
-                // Silent login failed - track for monitoring but continue to interactive flow
-                this._trackException('login.silent-failed', TelemetryLevel.Warning, {
-                    exception: error,
-                    properties: telemetryProperties,
+            catch {
+                // Silent login failed - a recoverable degradation, recorded without the original error,
+                // which may contain account hints. Fall through to interactive authentication.
+                this.#operational.report({
+                    notification: true,
+                    operation: 'silent-login-fallback',
+                    outcome: 'failure',
+                    level: TelemetryLevel.Warning,
                 });
-                // Fall through to interactive authentication
             }
         }
         // Perform interactive authentication based on specified behavior
@@ -32161,20 +33039,25 @@ class MsalProvider extends BaseModuleProvider {
      * ```
      */
     async logout(options) {
-        this._trackEvent('logout', TelemetryLevel.Information, {
-            properties: {
-                redirectUri: options?.redirectUri,
-            },
-        });
+        // Redirect URIs can carry paths and query data, so the event only marks the transition.
+        this._trackEvent('logout', TelemetryLevel.Information);
+        const started = performance.now();
         try {
             // Logout the specific account (or current account if none specified)
             await this.#client.logout({ account: this.account ?? undefined, ...options });
+            this.#operational.report({
+                operation: 'logout',
+                outcome: 'success',
+                duration: performance.now() - started,
+            });
             return true; // Success
         }
-        catch (error) {
-            // Logout failed - track error but don't throw to avoid breaking app flow
-            this._trackException('logout.failed', TelemetryLevel.Error, {
-                exception: error,
+        catch {
+            // Logout failed - record a sanitized outcome but don't throw to avoid breaking app flow
+            this.#operational.report({
+                operation: 'logout',
+                outcome: 'failure',
+                duration: performance.now() - started,
             });
         }
         return false; // Failed
@@ -32203,27 +33086,29 @@ class MsalProvider extends BaseModuleProvider {
      * ```
      */
     async handleRedirect() {
+        const started = performance.now();
         try {
             // Process any pending redirect from authentication flow
             const result = await this.client.handleRedirectPromise();
-            // Only track/log when a redirect result is actually returned
+            // Processing ran even without a pending redirect, so success is measured either way;
+            // otherwise failures would be over-represented in the outcome ratio.
+            this.#operational.report({
+                operation: 'handle-redirect',
+                outcome: 'success',
+                duration: performance.now() - started,
+            });
+            // The legacy event marks only a completed redirect flow, without account identifiers.
             if (result) {
-                // Track successful redirect completion for monitoring
-                this._trackEvent('handleRedirect.success', TelemetryLevel.Information, {
-                    properties: {
-                        username: result.account?.username,
-                    },
-                });
+                this._trackEvent('handleRedirect.success', TelemetryLevel.Information);
             }
             return result;
         }
         catch (error) {
-            this._trackException('handleRedirect.failed', TelemetryLevel.Warning, {
-                exception: error instanceof Error ? error : new Error(String(error)),
-                properties: {
-                    message: error instanceof Error ? error.message : String(error),
-                    reason: 'Redirect response could not be processed; continuing with standard authentication',
-                },
+            // The response could not be processed; standard authentication continues.
+            this.#operational.report({
+                operation: 'handle-redirect',
+                outcome: isUserCancellation(error) ? 'cancelled' : 'failure',
+                duration: performance.now() - started,
             });
             return null;
         }
@@ -32349,7 +33234,20 @@ class MsalProvider extends BaseModuleProvider {
         });
     }
 }
+/**
+ * Detects MSAL's user-cancellation error, an intended stop rather than a failure.
+ * @param error - Error thrown by an MSAL flow.
+ * @returns `true` when the user closed or cancelled the interaction.
+ */
+function isUserCancellation(error) {
+    return error?.errorCode === 'user_cancelled';
+}
 
+/**
+ * Providers this module created, so host disposal tears down only its own instances and
+ * their telemetry, never a provider supplied or shared by another host.
+ */
+const ownedProviders = new WeakMap();
 /**
  * MSAL authentication module definition.
  *
@@ -32394,10 +33292,15 @@ const module$1 = {
         }
         // Create new MSAL provider instance
         const provider = new MsalProvider(config);
+        ownedProviders.set(provider, provider);
         // Initialize the provider (handles redirect callbacks, SSO, etc.)
         await provider.initialize();
         return provider;
     },
+    dispose: ({ instance }) => {
+        ownedProviders.get(instance)?.dispose();
+        ownedProviders.delete(instance);
+    },
 };
 /**
  * Enables MSAL authentication module in the framework.
@@ -32443,5 +33346,5 @@ const configureMsal = (configure) => ({
     configure,
 });
 
-export { TelemetryEventSchema as $, reduce as A, lastValueFrom as B, filter as C, BaseModuleProvider as D, EMPTY_SUBSCRIPTION as E, catchError as F, of as G, object as H, _instanceof as I, _enum as J, string as K, boolean as L, ModuleEventLevel as M, record as N, Observable as O, union as P, __rest as Q, __assign as R, Subscription as S, switchMap as T, observeOn as U, deepmerge as V, BaseConfigBuilder as W, TelemetryExceptionSchema as X, TelemetryItemNames as Y, TelemetryType as Z, __extends as _, __values as a, TelemetryMetricSchema as a0, TelemetryCustomEventSchema as a1, array as a2, TelemetryLevel as a3, enableMSAL as a4, MsalConfigurator as a5, module$1 as a6, arrRemove as b, createErrorClass as c, __spreadArray as d, errorContext as e, __read as f, SafeSubscriber as g, EmptyError as h, isFunction as i, executeSchedule as j, innerFrom as k, createOperatorSubscriber as l, map as m, mergeMap as n, operate as o, identity as p, isArrayLike as q, isScheduler as r, popScheduler as s, popNumber as t, EMPTY as u, from as v, mergeInternals as w, scanInternals as x, noop as y, popResultSelector as z };
-//# sourceMappingURL=module-BR47HvRl.js.map
+export { operationalIdentifier as $, popResultSelector as A, reduce as B, lastValueFrom as C, filter as D, EMPTY_SUBSCRIPTION as E, tap as F, BaseModuleProvider as G, catchError as H, of as I, object as J, _instanceof as K, _enum as L, ModuleEventLevel as M, string as N, Observable as O, boolean as P, record as Q, union as R, Subscription as S, finalize$1 as T, __rest as U, __assign as V, switchMap as W, observeOn as X, deepmerge as Y, BaseConfigBuilder as Z, __extends as _, __values as a, defer as a0, TelemetryExceptionSchema as a1, TelemetryItemNames as a2, TelemetryType as a3, telemetryProviderActions as a4, operationalScope as a5, createOperationalTelemetry as a6, TelemetryEventSchema as a7, TelemetryMetricSchema as a8, TelemetryCustomEventSchema as a9, createOperationalRecords as aa, TelemetryLevel as ab, createDiagnosticContext as ac, createAction as ad, createAsyncAction as ae, array as af, enableMSAL as ag, MsalConfigurator as ah, module$1 as ai, arrRemove as b, createErrorClass as c, __spreadArray as d, errorContext as e, __read as f, SafeSubscriber as g, EmptyError as h, isFunction as i, executeSchedule as j, innerFrom as k, createOperatorSubscriber as l, map as m, mergeMap as n, operate as o, identity as p, from as q, popScheduler as r, isArrayLike as s, telemetryExportRequest as t, isScheduler as u, popNumber as v, EMPTY as w, noop$1 as x, mergeInternals as y, scanInternals as z };
+//# sourceMappingURL=module-BnhyaZvt.js.map