@azure/msal-common 16.16.1 → 16.16.2

package/dist-browser/logger/Logger.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/network/INetworkModule.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/network/RequestThumbprint.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { serializeAttributeTokens } from '../cache/utils/CacheHelpers.mjs';
 

package/dist-browser/network/ResponseHeaders.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/network/ThrottlingUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { THROTTLING_PREFIX, DEFAULT_THROTTLE_TIME_SECONDS, DEFAULT_MAX_THROTTLE_TIME_SECONDS, HeaderNames } from '../utils/Constants.mjs';
 import { ServerError } from '../error/ServerError.mjs';

package/dist-browser/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.16.1";
+const version = "16.16.2";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist-browser/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware, addPopupOriginCheckDone } from '../request/RequestParameterBuilder.mjs';
 import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';
@@ -194,13 +194,13 @@ function validateAuthorizationResponse(serverResponse, requestState, correlation
         decodedServerResponseState = decodeURIComponent(serverResponse.state);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId);
     }
     try {
         decodedRequestState = decodeURIComponent(requestState);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId);
     }
     if (decodedServerResponseState !== decodedRequestState) {
         throw createClientAuthError(stateMismatch, correlationId);

package/dist-browser/protocol/Authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Authorize.mjs","sources":["../../src/protocol/Authorize.ts"],"sourcesContent":[null],"names":["RequestParameterBuilder.addClientId","AADServerParamKeys.CLIENT_ID","RequestParameterBuilder.addScopes","RequestParameterBuilder.addResource","RequestParameterBuilder.addRedirectUri","RequestParameterBuilder.addCorrelationId","RequestParameterBuilder.addResponseMode","RequestParameterBuilder.addClientInfo","RequestParameterBuilder.addCliData","RequestParameterBuilder.addPrompt","RequestParameterBuilder.addDomainHint","RequestParameterBuilder.addSid","RequestParameterBuilder.addLoginHint","RequestParameterBuilder.addCcsOid","RequestParameterBuilder.addCcsUpn","RequestParameterBuilder.addNonce","RequestParameterBuilder.addState","RequestParameterBuilder.addBrokerParameters","RequestParameterBuilder.addClaims","AADServerParamKeys.INSTANCE_AWARE","RequestParameterBuilder.addInstanceAware","RequestParameterBuilder.addPopupOriginCheckDone","ClientAuthErrorCodes.authorizationCodeMissingFromServerResponse","ClientAuthErrorCodes.stateNotFound","ClientAuthErrorCodes.invalidState","ClientAuthErrorCodes.stateMismatch"],"mappings":";;;;;;;;;;;;;AAAA;;;AAGG;AA0BH;;;;;;;;AAQG;AACG,SAAU,qCAAqC,CACjD,WAAwB,EACxB,OAAsC,EACtC,MAAc,EACd,iBAAsC,EAAA;;AAGtC,IAAA,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAE5C,IAAA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C,IAAAA,WAAmC,CAC/B,UAAU,EACV,OAAO,CAAC,gBAAgB;AACpB,QAAA,OAAO,CAAC,oBAAoB,GAAGC,SAA4B,CAAC;QAC5D,WAAW,CAAC,QAAQ,CAC3B,CAAC;AAEF,IAAA,MAAM,aAAa,GAAG;AAClB,QAAA,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;AACzB,QAAA,IAAI,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;KAC1C,CAAC;IACFC,SAAiC,CAC7B,UAAU,EACV,aAAa,EACb,OAAO,CAAC,aAAa,EACrB,IAAI,EACJ,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAC3D,CAAC;IAEFC,WAAmC,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElEC,cAAsC,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AAExE,IAAAC,gBAAwC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;;IAGpEC,eAAuC,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;;AAG1E,IAAAC,aAAqC,CAAC,UAAU,CAAC,CAAC;;AAGlD,IAAAC,UAAkC,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,MAAM,EAAE;QAChBC,SAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AAC9D,QAAA,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;AAC3E,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,UAAU,EAAE;QACpBC,aAAqC,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACtE,iBAAiB,EAAE,SAAS,CACxB,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAC/B,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;;AAGD,IAAA,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,cAAc,EAAE;;QAE/C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE;;YAEpD,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;YAGJC,MAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACxD,iBAAiB,EAAE,SAAS,CACxB,EAAE,cAAc,EAAE,IAAI,EAAE,EACxB,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;aAAM,IAAI,OAAO,CAAC,OAAO,EAAE;YACxB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,qBAAqB,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9D,YAAA,IAAI,qBAAqB,IAAI,OAAO,CAAC,UAAU,EAAE;gBAC7C,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;gBAGJ,qBAAqB,GAAG,IAAI,CAAC;AAChC,YAAA,CAAA;;AAGD,YAAA,IAAI,qBAAqB,EAAE;gBACvB,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGJ,gBAAAC,YAAoC,CAChC,UAAU,EACV,qBAAqB,CACxB,CAAC;gBACF,iBAAiB,EAAE,SAAS,CACxB,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAC5B,aAAa,CAChB,CAAC;gBACF,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,OAAO,CAAC,aAAa,CAChC,CAAC;AACF,oBAAAC,SAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,gBAAA,CAAA;AACJ,YAAA,CAAA;iBAAM,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE;AAC1D;;;AAGG;gBACH,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGJ,gBAAAF,MAA8B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBACvD,iBAAiB,EAAE,SAAS,CACxB,EAAE,YAAY,EAAE,IAAI,EAAE,EACtB,aAAa,CAChB,CAAC;gBACF,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,OAAO,CAAC,aAAa,CAChC,CAAC;AACF,oBAAAE,SAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,gBAAA,CAAA;AACJ,YAAA,CAAA;iBAAM,IAAI,OAAO,CAAC,SAAS,EAAE;gBAC1B,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;gBAGJD,YAAoC,CAChC,UAAU,EACV,OAAO,CAAC,SAAS,CACpB,CAAC;gBACFE,SAAiC,CAC7B,UAAU,EACV,OAAO,CAAC,SAAS,CACpB,CAAC;gBACF,iBAAiB,EAAE,SAAS,CACxB,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAC9B,aAAa,CAChB,CAAC;AACL,YAAA,CAAA;AAAM,iBAAA,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;;gBAEjC,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;gBAGJF,YAAoC,CAChC,UAAU,EACV,OAAO,CAAC,OAAO,CAAC,QAAQ,CAC3B,CAAC;gBACF,iBAAiB,EAAE,SAAS,CACxB,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAC1B,aAAa,CAChB,CAAC;gBACF,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,OAAO,CAAC,aAAa,CAChC,CAAC;AACF,oBAAAC,SAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,gBAAA,CAAA;AACJ,YAAA,CAAA;AACJ,QAAA,CAAA;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE;YAC1B,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;YAGJD,YAAoC,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACpEE,SAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACjE,iBAAiB,EAAE,SAAS,CACxB,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAC9B,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACJ,IAAA,CAAA;AAAM,SAAA;QACH,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,KAAK,EAAE;QACfC,QAAgC,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/D,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,KAAK,EAAE;QACfC,QAAgC,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/D,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,gBAAgB,EAAE;AAC1B,QAAAC,mBAA2C,CACvC,UAAU,EACV,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,WAAW,CAC1B,CAAC;AACL,IAAA,CAAA;IAEDC,SAAiC,CAC7B,UAAU,EACV,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,kBAAkB,EAC9B,OAAO,CAAC,gBAAgB,CAC3B,CAAC;;IAGF,IACI,WAAW,CAAC,aAAa;SACxB,CAAC,OAAO,CAAC,oBAAoB;AAC1B,YAAA,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAC/CC,cAAiC,CACpC,CAAC,EACR;AACE,QAAAC,gBAAwC,CAAC,UAAU,CAAC,CAAC;AACxD,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,oBAAoB,EAAE;AAC9B,QAAAC,uBAA+C,CAAC,UAAU,CAAC,CAAC;AAC/D,IAAA,CAAA;AAED,IAAA,OAAO,UAAU,CAAC;AACtB,CAAC;AAED;;;;;;AAMG;AACG,SAAU,eAAe,CAC3B,SAAoB,EACpB,iBAAsC,EAAA;AAEtC,IAAA,MAAM,WAAW,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACxD,OAAO,SAAS,CAAC,iBAAiB,CAC9B,SAAS,CAAC,qBAAqB,EAC/B,WAAW,CACd,CAAC;AACN,CAAC;AAED;;;;;;AAMG;SACa,2BAA2B,CACvC,YAA+B,EAC/B,WAAmB,EACnB,aAAqB,EAAA;;AAGrB,IAAA,6BAA6B,CAAC,YAAY,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;;AAGxE,IAAA,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;QACpB,MAAM,qBAAqB,CACvBC,0CAA+D,EAC/D,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAED,IAAA,OAAO,YAAwC,CAAC;AACpD,CAAC;AAED;;;;;AAKG;SACa,6BAA6B,CACzC,cAAiC,EACjC,YAAoB,EACpB,aAAqB,EAAA;AAErB,IAAA,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE;QACxC,MAAM,cAAc,CAAC,KAAK;cACpB,qBAAqB,CACjBC,aAAkC,EAClC,aAAa,EACb,cAAc,CACjB;cACD,qBAAqB,CACjBA,aAAkC,EAClC,aAAa,EACb,cAAc,CACjB,CAAC;AACX,IAAA,CAAA;AAED,IAAA,IAAI,0BAAkC,CAAC;AACvC,IAAA,IAAI,mBAA2B,CAAC;IAEhC,IAAI;AACA,QAAA,0BAA0B,GAAG,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AACzE,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;AACR,QAAA,MAAM,qBAAqB,CACvBC,YAAiC,EACjC,aAAa,EACb,cAAc,CAAC,KAAK,CACvB,CAAC;AACL,IAAA,CAAA;IAED,IAAI;AACA,QAAA,mBAAmB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC1D,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;AACR,QAAA,MAAM,qBAAqB,CACvBA,YAAiC,EACjC,aAAa,EACb,cAAc,CAAC,KAAK,CACvB,CAAC;AACL,IAAA,CAAA;IAED,IAAI,0BAA0B,KAAK,mBAAmB,EAAE;QACpD,MAAM,qBAAqB,CACvBC,aAAkC,EAClC,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;;IAGD,IACI,cAAc,CAAC,KAAK;AACpB,QAAA,cAAc,CAAC,iBAAiB;QAChC,cAAc,CAAC,QAAQ,EACzB;AACE,QAAA,MAAM,aAAa,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;AACzD,QAAA,IACI,0BAA0B,CACtB,cAAc,CAAC,KAAK,EACpB,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,QAAQ,CAC1B,EACH;AACE,YAAA,MAAM,IAAI,4BAA4B,CAClC,cAAc,CAAC,KAAK,IAAI,EAAE,EAC1B,cAAc,CAAC,cAAc,IAAI,aAAa,EAC9C,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,SAAS,IAAI,EAAE,EAC9B,cAAc,CAAC,QAAQ,IAAI,EAAE,EAC7B,cAAc,CAAC,MAAM,IAAI,EAAE,EAC3B,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QAED,MAAM,IAAI,WAAW,CACjB,cAAc,CAAC,KAAK,IAAI,EAAE,EAC1B,cAAc,CAAC,cAAc,IAAI,aAAa,EAC9C,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,QAAQ,EACvB,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;;AAIG;AACH,SAAS,kBAAkB,CACvB,cAAiC,EAAA;IAEjC,MAAM,eAAe,GAAG,OAAO,CAAC;IAChC,MAAM,oBAAoB,GACtB,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;AAC3D,IAAA,OAAO,oBAAoB,IAAI,oBAAoB,IAAI,CAAC;AACpD,UAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAC/B,oBAAoB,GAAG,eAAe,CAAC,MAAM,CAChD;UACD,SAAS,CAAC;AACpB,CAAC;AAED;;;AAGG;AACH,SAAS,iBAAiB,CAAC,OAAoB,EAAA;AAC3C,IAAA,OAAO,OAAO,CAAC,aAAa,EAAE,GAAG,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoB,EAAA;IAC1C,OAAO,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,UAAU,IAAI,IAAI,CAAC;AAC1E;;;;"}
+{"version":3,"file":"Authorize.mjs","sources":["../../src/protocol/Authorize.ts"],"sourcesContent":[null],"names":["RequestParameterBuilder.addClientId","AADServerParamKeys.CLIENT_ID","RequestParameterBuilder.addScopes","RequestParameterBuilder.addResource","RequestParameterBuilder.addRedirectUri","RequestParameterBuilder.addCorrelationId","RequestParameterBuilder.addResponseMode","RequestParameterBuilder.addClientInfo","RequestParameterBuilder.addCliData","RequestParameterBuilder.addPrompt","RequestParameterBuilder.addDomainHint","RequestParameterBuilder.addSid","RequestParameterBuilder.addLoginHint","RequestParameterBuilder.addCcsOid","RequestParameterBuilder.addCcsUpn","RequestParameterBuilder.addNonce","RequestParameterBuilder.addState","RequestParameterBuilder.addBrokerParameters","RequestParameterBuilder.addClaims","AADServerParamKeys.INSTANCE_AWARE","RequestParameterBuilder.addInstanceAware","RequestParameterBuilder.addPopupOriginCheckDone","ClientAuthErrorCodes.authorizationCodeMissingFromServerResponse","ClientAuthErrorCodes.stateNotFound","ClientAuthErrorCodes.invalidState","ClientAuthErrorCodes.stateMismatch"],"mappings":";;;;;;;;;;;;;AAAA;;;AAGG;AA0BH;;;;;;;;AAQG;AACG,SAAU,qCAAqC,CACjD,WAAwB,EACxB,OAAsC,EACtC,MAAc,EACd,iBAAsC,EAAA;;AAGtC,IAAA,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAE5C,IAAA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C,IAAAA,WAAmC,CAC/B,UAAU,EACV,OAAO,CAAC,gBAAgB;AACpB,QAAA,OAAO,CAAC,oBAAoB,GAAGC,SAA4B,CAAC;QAC5D,WAAW,CAAC,QAAQ,CAC3B,CAAC;AAEF,IAAA,MAAM,aAAa,GAAG;AAClB,QAAA,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;AACzB,QAAA,IAAI,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;KAC1C,CAAC;IACFC,SAAiC,CAC7B,UAAU,EACV,aAAa,EACb,OAAO,CAAC,aAAa,EACrB,IAAI,EACJ,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAC3D,CAAC;IAEFC,WAAmC,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElEC,cAAsC,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AAExE,IAAAC,gBAAwC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;;IAGpEC,eAAuC,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;;AAG1E,IAAAC,aAAqC,CAAC,UAAU,CAAC,CAAC;;AAGlD,IAAAC,UAAkC,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,MAAM,EAAE;QAChBC,SAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AAC9D,QAAA,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;AAC3E,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,UAAU,EAAE;QACpBC,aAAqC,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACtE,iBAAiB,EAAE,SAAS,CACxB,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAC/B,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;;AAGD,IAAA,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,cAAc,EAAE;;QAE/C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE;;YAEpD,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;YAGJC,MAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACxD,iBAAiB,EAAE,SAAS,CACxB,EAAE,cAAc,EAAE,IAAI,EAAE,EACxB,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;aAAM,IAAI,OAAO,CAAC,OAAO,EAAE;YACxB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,qBAAqB,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9D,YAAA,IAAI,qBAAqB,IAAI,OAAO,CAAC,UAAU,EAAE;gBAC7C,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;gBAGJ,qBAAqB,GAAG,IAAI,CAAC;AAChC,YAAA,CAAA;;AAGD,YAAA,IAAI,qBAAqB,EAAE;gBACvB,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGJ,gBAAAC,YAAoC,CAChC,UAAU,EACV,qBAAqB,CACxB,CAAC;gBACF,iBAAiB,EAAE,SAAS,CACxB,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAC5B,aAAa,CAChB,CAAC;gBACF,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,OAAO,CAAC,aAAa,CAChC,CAAC;AACF,oBAAAC,SAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,gBAAA,CAAA;AACJ,YAAA,CAAA;iBAAM,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE;AAC1D;;;AAGG;gBACH,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGJ,gBAAAF,MAA8B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBACvD,iBAAiB,EAAE,SAAS,CACxB,EAAE,YAAY,EAAE,IAAI,EAAE,EACtB,aAAa,CAChB,CAAC;gBACF,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,OAAO,CAAC,aAAa,CAChC,CAAC;AACF,oBAAAE,SAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,gBAAA,CAAA;AACJ,YAAA,CAAA;iBAAM,IAAI,OAAO,CAAC,SAAS,EAAE;gBAC1B,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;gBAGJD,YAAoC,CAChC,UAAU,EACV,OAAO,CAAC,SAAS,CACpB,CAAC;gBACFE,SAAiC,CAC7B,UAAU,EACV,OAAO,CAAC,SAAS,CACpB,CAAC;gBACF,iBAAiB,EAAE,SAAS,CACxB,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAC9B,aAAa,CAChB,CAAC;AACL,YAAA,CAAA;AAAM,iBAAA,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;;gBAEjC,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;gBAGJF,YAAoC,CAChC,UAAU,EACV,OAAO,CAAC,OAAO,CAAC,QAAQ,CAC3B,CAAC;gBACF,iBAAiB,EAAE,SAAS,CACxB,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAC1B,aAAa,CAChB,CAAC;gBACF,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,OAAO,CAAC,aAAa,CAChC,CAAC;AACF,oBAAAC,SAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,gBAAA,CAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,gBAAA,CAAA;AACJ,YAAA,CAAA;AACJ,QAAA,CAAA;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE;YAC1B,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;YAGJD,YAAoC,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACpEE,SAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACjE,iBAAiB,EAAE,SAAS,CACxB,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAC9B,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACJ,IAAA,CAAA;AAAM,SAAA;QACH,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,KAAK,EAAE;QACfC,QAAgC,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/D,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,KAAK,EAAE;QACfC,QAAgC,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/D,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,gBAAgB,EAAE;AAC1B,QAAAC,mBAA2C,CACvC,UAAU,EACV,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,WAAW,CAC1B,CAAC;AACL,IAAA,CAAA;IAEDC,SAAiC,CAC7B,UAAU,EACV,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,kBAAkB,EAC9B,OAAO,CAAC,gBAAgB,CAC3B,CAAC;;IAGF,IACI,WAAW,CAAC,aAAa;SACxB,CAAC,OAAO,CAAC,oBAAoB;AAC1B,YAAA,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAC/CC,cAAiC,CACpC,CAAC,EACR;AACE,QAAAC,gBAAwC,CAAC,UAAU,CAAC,CAAC;AACxD,IAAA,CAAA;IAED,IAAI,OAAO,CAAC,oBAAoB,EAAE;AAC9B,QAAAC,uBAA+C,CAAC,UAAU,CAAC,CAAC;AAC/D,IAAA,CAAA;AAED,IAAA,OAAO,UAAU,CAAC;AACtB,CAAC;AAED;;;;;;AAMG;AACG,SAAU,eAAe,CAC3B,SAAoB,EACpB,iBAAsC,EAAA;AAEtC,IAAA,MAAM,WAAW,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACxD,OAAO,SAAS,CAAC,iBAAiB,CAC9B,SAAS,CAAC,qBAAqB,EAC/B,WAAW,CACd,CAAC;AACN,CAAC;AAED;;;;;;AAMG;SACa,2BAA2B,CACvC,YAA+B,EAC/B,WAAmB,EACnB,aAAqB,EAAA;;AAGrB,IAAA,6BAA6B,CAAC,YAAY,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;;AAGxE,IAAA,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;QACpB,MAAM,qBAAqB,CACvBC,0CAA+D,EAC/D,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AAED,IAAA,OAAO,YAAwC,CAAC;AACpD,CAAC;AAED;;;;;AAKG;SACa,6BAA6B,CACzC,cAAiC,EACjC,YAAoB,EACpB,aAAqB,EAAA;AAErB,IAAA,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE;QACxC,MAAM,cAAc,CAAC,KAAK;cACpB,qBAAqB,CACjBC,aAAkC,EAClC,aAAa,EACb,cAAc,CACjB;cACD,qBAAqB,CACjBA,aAAkC,EAClC,aAAa,EACb,cAAc,CACjB,CAAC;AACX,IAAA,CAAA;AAED,IAAA,IAAI,0BAAkC,CAAC;AACvC,IAAA,IAAI,mBAA2B,CAAC;IAEhC,IAAI;AACA,QAAA,0BAA0B,GAAG,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AACzE,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,MAAM,qBAAqB,CACvBC,YAAiC,EACjC,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;IAED,IAAI;AACA,QAAA,mBAAmB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC1D,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,MAAM,qBAAqB,CACvBA,YAAiC,EACjC,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;IAED,IAAI,0BAA0B,KAAK,mBAAmB,EAAE;QACpD,MAAM,qBAAqB,CACvBC,aAAkC,EAClC,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;;IAGD,IACI,cAAc,CAAC,KAAK;AACpB,QAAA,cAAc,CAAC,iBAAiB;QAChC,cAAc,CAAC,QAAQ,EACzB;AACE,QAAA,MAAM,aAAa,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;AACzD,QAAA,IACI,0BAA0B,CACtB,cAAc,CAAC,KAAK,EACpB,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,QAAQ,CAC1B,EACH;AACE,YAAA,MAAM,IAAI,4BAA4B,CAClC,cAAc,CAAC,KAAK,IAAI,EAAE,EAC1B,cAAc,CAAC,cAAc,IAAI,aAAa,EAC9C,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,SAAS,IAAI,EAAE,EAC9B,cAAc,CAAC,QAAQ,IAAI,EAAE,EAC7B,cAAc,CAAC,MAAM,IAAI,EAAE,EAC3B,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QAED,MAAM,IAAI,WAAW,CACjB,cAAc,CAAC,KAAK,IAAI,EAAE,EAC1B,cAAc,CAAC,cAAc,IAAI,aAAa,EAC9C,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,QAAQ,EACvB,aAAa,CAChB,CAAC;AACL,IAAA,CAAA;AACL,CAAC;AAED;;;;AAIG;AACH,SAAS,kBAAkB,CACvB,cAAiC,EAAA;IAEjC,MAAM,eAAe,GAAG,OAAO,CAAC;IAChC,MAAM,oBAAoB,GACtB,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;AAC3D,IAAA,OAAO,oBAAoB,IAAI,oBAAoB,IAAI,CAAC;AACpD,UAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAC/B,oBAAoB,GAAG,eAAe,CAAC,MAAM,CAChD;UACD,SAAS,CAAC;AACpB,CAAC;AAED;;;AAGG;AACH,SAAS,iBAAiB,CAAC,OAAoB,EAAA;AAC3C,IAAA,OAAO,OAAO,CAAC,aAAa,EAAE,GAAG,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoB,EAAA;IAC1C,OAAO,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,UAAU,IAAI,IAAI,CAAC;AAC1E;;;;"}

package/dist-browser/protocol/Token.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { CcsCredentialType } from '../account/CcsCredential.mjs';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';

package/dist-browser/request/AuthenticationHeaderParser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { HeaderNames } from '../utils/Constants.mjs';

package/dist-browser/request/BaseAuthRequest.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/request/RequestParameterBuilder.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { OIDC_DEFAULT_SCOPES, HeaderNames, CLIENT_INFO, PasswordGrantConstants, AuthenticationScheme, ResponseMode, X_MS_LIB_CAPABILITY_VALUE, ClaimsRequestKeys } from '../utils/Constants.mjs';
 import { X_APP_NAME, X_APP_VER, ATTRIBUTE_TOKENS, CODE, BROKER_CLIENT_ID, BROKER_REDIRECT_URI, CLAIMS, CLI_DATA, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, CLIENT_ID, CLIENT_SECRET, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE_VERIFIER, CLIENT_REQUEST_ID, DEVICE_CODE, DOMAIN_HINT, EAR_JWK, EAR_JWE_CRYPTO, GRANT_TYPE, ID_TOKEN_HINT, INSTANCE_AWARE, X_CLIENT_SKU, X_CLIENT_VER, X_CLIENT_OS, X_CLIENT_CPU, LOGIN_HINT, LOGOUT_HINT, NATIVE_BROKER, NONCE, OBO_ASSERTION, TOKEN_TYPE, REQ_CNF, POPUP_ORIGIN_CHECK_DONE, POST_LOGOUT_URI, PROMPT, REDIRECT_URI, REFRESH_TOKEN, REQUESTED_TOKEN_USE, RESOURCE, RESPONSE_MODE, RESPONSE_TYPE, SCOPE, X_CLIENT_CURR_TELEM, X_CLIENT_LAST_TELEM, SID, STATE, X_MS_LIB_CAPABILITY } from '../constants/AADServerParamKeys.mjs';

package/dist-browser/request/ScopeSet.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist-browser/response/ResponseHandler.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { updateAccountTenantProfileData, buildTenantProfile } from '../account/AccountInfo.mjs';
 import { extractTokenClaims, isKmsi } from '../account/AuthToken.mjs';

package/dist-browser/telemetry/performance/PerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { getAndFlushLogsFromCache } from '../../logger/Logger.mjs';
 import { IntFields, PerformanceEventStatus, EXT_FIELD_PREFIX } from './PerformanceEvent.mjs';

package/dist-browser/telemetry/performance/PerformanceEvent.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/telemetry/performance/PerformanceEvents.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/telemetry/performance/StubPerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { PerformanceEventStatus } from './PerformanceEvent.mjs';
 

package/dist-browser/telemetry/server/ServerTelemetryManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { CacheOutcome, SERVER_TELEM_CACHE_KEY, CACHE_KEY_SEPARATOR, SERVER_TELEM_SCHEMA_VERSION, SERVER_TELEM_CATEGORY_SEPARATOR, SERVER_TELEM_VALUE_SEPARATOR, SERVER_TELEM_MAX_CACHED_ERRORS, SERVER_TELEM_UNKNOWN_ERROR, SERVER_TELEM_MAX_LAST_HEADER_BYTES, SERVER_TELEM_OVERFLOW_TRUE, SERVER_TELEM_OVERFLOW_FALSE } from '../../utils/Constants.mjs';
 import { AuthError } from '../../error/AuthError.mjs';

package/dist-browser/url/UrlString.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';
@@ -9,6 +9,12 @@ import { urlEmptyError, urlParseError, authorityUriInsecure } from '../error/Cli
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+// Matches ASCII controls, space, DEL, backslash, or the userinfo separator (@).
+const UNSAFE_AUTHORITY = /[\x00-\x20\x7f\\@]/;
+const DEFAULT_PORTS = {
+    "https:": ":443",
+    "http:": ":80",
+};
 /**
  * Url object class which can perform various transformations on url strings.
  */
@@ -124,6 +130,29 @@ class UrlString {
             AbsolutePath: match[5],
             QueryString: match[7],
         };
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(this.urlString);
+        }
+        catch {
+            throw createClientConfigurationError(urlParseError, this.correlationId);
+        }
+        const host = urlComponents.HostNameAndPort?.toLowerCase();
+        const schemeAndAuthority = `${urlComponents.Protocol}//${host}`;
+        const defaultPort = DEFAULT_PORTS[parsedUrl.protocol] ?? "";
+        /*
+         * Cross-check the original host; reparsing parsedUrl would hide parser differences.
+         * URL has validated IPv6 syntax, so only bracketed hosts need a normalization comparison.
+         */
+        const hostMatches = host === parsedUrl.host ||
+            host === `${parsedUrl.host}${defaultPort}` ||
+            (host?.startsWith("[") &&
+                new URL(`${urlComponents.Protocol}//${host}`).host ===
+                    parsedUrl.host);
+        // Check authority ambiguity without restricting resource paths, queries, or fragments.
+        if (UNSAFE_AUTHORITY.test(schemeAndAuthority) || !hostMatches) {
+            throw createClientConfigurationError(urlParseError, this.correlationId);
+        }
         let pathSegments = urlComponents.AbsolutePath.split("/");
         pathSegments = pathSegments.filter((val) => val && val.length > 0); // remove empty elements
         urlComponents.PathSegments = pathSegments;

package/dist-browser/url/UrlString.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"UrlString.mjs","sources":["../../src/url/UrlString.ts"],"sourcesContent":[null],"names":["ClientConfigurationErrorCodes.urlEmptyError","ClientConfigurationErrorCodes.urlParseError","ClientConfigurationErrorCodes.authorityUriInsecure","Constants.AADAuthority","Constants.FORWARD_SLASH"],"mappings":";;;;;;;AAAA;;;AAGG;AAUH;;AAEG;MACU,SAAS,CAAA;AAIlB,IAAA,IAAW,SAAS,GAAA;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAED,WAAA,CAAY,GAAW,EAAE,aAAqB,EAAA;AAC1C,QAAA,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;AACtB,QAAA,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;AACnC,QAAA,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;;YAElB,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YACpB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;AACpD,QAAA,CAAA;IACL,CAAC;AAED;;;AAGG;IACH,OAAO,eAAe,CAAC,GAAW,EAAA;AAC9B,QAAA,IAAI,GAAG,EAAE;AACL,YAAA,IAAI,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAErC,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;gBACzC,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,YAAA,CAAA;iBAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE;gBACjD,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,YAAA,CAAA;YAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;gBAC1C,YAAY,IAAI,GAAG,CAAC;AACvB,YAAA,CAAA;AAED,YAAA,OAAO,YAAY,CAAC;AACvB,QAAA,CAAA;AAED,QAAA,OAAO,GAAG,CAAC;IACf,CAAC;AAED;;AAEG;IACH,aAAa,GAAA;;AAET,QAAA,IAAI,UAAU,CAAC;QACf,IAAI;AACA,YAAA,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;AACxC,QAAA,CAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,MAAM,8BAA8B,CAChCC,aAA2C,EAC3C,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;;QAGD,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE;YACzD,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;;QAGD,IACI,CAAC,UAAU,CAAC,QAAQ;AACpB,YAAA,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,EAChD;YACE,MAAM,8BAA8B,CAChCC,oBAAkD,EAClD,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;IACL,CAAC;AAED;;;;AAIG;AACH,IAAA,OAAO,iBAAiB,CAAC,GAAW,EAAE,WAAmB,EAAA;QACrD,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,OAAO,GAAG,CAAC;AACd,QAAA,CAAA;AAED,QAAA,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACvB,cAAE,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,WAAW,CAAA,CAAE;AACzB,cAAE,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,WAAW,EAAE,CAAC;IAClC,CAAC;AAED;;;AAGG;IACH,OAAO,iBAAiB,CAAC,GAAW,EAAA;AAChC,QAAA,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;AAED;;;;AAIG;AACH,IAAA,iBAAiB,CAAC,QAAgB,EAAA;AAC9B,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAC1C,QAAA,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC;AACzC,QAAA,IACI,QAAQ;YACR,SAAS,CAAC,MAAM,KAAK,CAAC;aACrB,SAAS,CAAC,CAAC,CAAC,KAAKC,YAAsB,CAAC,MAAM;gBAC3C,SAAS,CAAC,CAAC,CAAC,KAAKA,YAAsB,CAAC,aAAa,CAAC,EAC5D;AACE,YAAA,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;AAC3B,QAAA,CAAA;QACD,OAAO,SAAS,CAAC,+BAA+B,CAC5C,SAAS,EACT,IAAI,CAAC,aAAa,CACrB,CAAC;IACN,CAAC;AAED;;;AAGG;IACH,gBAAgB,GAAA;;AAEZ,QAAA,MAAM,KAAK,GAAG,MAAM,CAChB,4DAA4D,CAC/D,CAAC;;QAGF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE;YACR,MAAM,8BAA8B,CAChCF,aAA2C,EAC3C,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;;AAGD,QAAA,MAAM,aAAa,GAAG;AAClB,YAAA,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAClB,YAAA,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AACzB,YAAA,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;AACtB,YAAA,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;SAChB,CAAC;QAEV,IAAI,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzD,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnE,QAAA,aAAa,CAAC,YAAY,GAAG,YAAY,CAAC;QAE1C,IACI,aAAa,CAAC,WAAW;AACzB,YAAA,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EACzC;AACE,YAAA,aAAa,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC,SAAS,CAC3D,CAAC,EACD,aAAa,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CACvC,CAAC;AACL,QAAA,CAAA;AACD,QAAA,OAAO,aAAa,CAAC;IACzB,CAAC;AAED,IAAA,OAAO,gBAAgB,CAAC,GAAW,EAAE,aAAqB,EAAA;AACtD,QAAA,MAAM,KAAK,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAEjD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,CAAC,KAAK,EAAE;YACR,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AAED,IAAA,OAAO,cAAc,CACjB,WAAmB,EACnB,OAAe,EACf,aAAqB,EAAA;QAErB,IAAI,WAAW,CAAC,CAAC,CAAC,KAAKG,aAAuB,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAClD,YAAA,MAAM,cAAc,GAAG,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAE9C,QACI,cAAc,CAAC,QAAQ;gBACvB,IAAI;AACJ,gBAAA,cAAc,CAAC,eAAe;AAC9B,gBAAA,WAAW,EACb;AACL,QAAA,CAAA;AAED,QAAA,OAAO,WAAW,CAAC;IACvB,CAAC;AAED,IAAA,OAAO,+BAA+B,CAClC,SAAe,EACf,aAAqB,EAAA;AAErB,QAAA,OAAO,IAAI,SAAS,CAChB,SAAS,CAAC,QAAQ;YACd,IAAI;AACJ,YAAA,SAAS,CAAC,eAAe;YACzB,GAAG;YACH,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EACpC,aAAa,CAChB,CAAC;IACN,CAAC;AACJ;;;;"}
+{"version":3,"file":"UrlString.mjs","sources":["../../src/url/UrlString.ts"],"sourcesContent":[null],"names":["ClientConfigurationErrorCodes.urlEmptyError","ClientConfigurationErrorCodes.urlParseError","ClientConfigurationErrorCodes.authorityUriInsecure","Constants.AADAuthority","Constants.FORWARD_SLASH"],"mappings":";;;;;;;AAAA;;;AAGG;AAUH;AACA,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAC9C,MAAM,aAAa,GAA2B;AAC1C,IAAA,QAAQ,EAAE,MAAM;AAChB,IAAA,OAAO,EAAE,KAAK;CACjB,CAAC;AAEF;;AAEG;MACU,SAAS,CAAA;AAIlB,IAAA,IAAW,SAAS,GAAA;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAED,WAAA,CAAY,GAAW,EAAE,aAAqB,EAAA;AAC1C,QAAA,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;AACtB,QAAA,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;AACnC,QAAA,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;;YAElB,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YACpB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;AACpD,QAAA,CAAA;IACL,CAAC;AAED;;;AAGG;IACH,OAAO,eAAe,CAAC,GAAW,EAAA;AAC9B,QAAA,IAAI,GAAG,EAAE;AACL,YAAA,IAAI,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAErC,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;gBACzC,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,YAAA,CAAA;iBAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE;gBACjD,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,YAAA,CAAA;YAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;gBAC1C,YAAY,IAAI,GAAG,CAAC;AACvB,YAAA,CAAA;AAED,YAAA,OAAO,YAAY,CAAC;AACvB,QAAA,CAAA;AAED,QAAA,OAAO,GAAG,CAAC;IACf,CAAC;AAED;;AAEG;IACH,aAAa,GAAA;;AAET,QAAA,IAAI,UAAU,CAAC;QACf,IAAI;AACA,YAAA,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;AACxC,QAAA,CAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,MAAM,8BAA8B,CAChCC,aAA2C,EAC3C,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;;QAGD,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE;YACzD,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;;QAGD,IACI,CAAC,UAAU,CAAC,QAAQ;AACpB,YAAA,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,EAChD;YACE,MAAM,8BAA8B,CAChCC,oBAAkD,EAClD,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;IACL,CAAC;AAED;;;;AAIG;AACH,IAAA,OAAO,iBAAiB,CAAC,GAAW,EAAE,WAAmB,EAAA;QACrD,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,OAAO,GAAG,CAAC;AACd,QAAA,CAAA;AAED,QAAA,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACvB,cAAE,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,WAAW,CAAA,CAAE;AACzB,cAAE,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,WAAW,EAAE,CAAC;IAClC,CAAC;AAED;;;AAGG;IACH,OAAO,iBAAiB,CAAC,GAAW,EAAA;AAChC,QAAA,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;AAED;;;;AAIG;AACH,IAAA,iBAAiB,CAAC,QAAgB,EAAA;AAC9B,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAC1C,QAAA,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC;AACzC,QAAA,IACI,QAAQ;YACR,SAAS,CAAC,MAAM,KAAK,CAAC;aACrB,SAAS,CAAC,CAAC,CAAC,KAAKC,YAAsB,CAAC,MAAM;gBAC3C,SAAS,CAAC,CAAC,CAAC,KAAKA,YAAsB,CAAC,aAAa,CAAC,EAC5D;AACE,YAAA,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;AAC3B,QAAA,CAAA;QACD,OAAO,SAAS,CAAC,+BAA+B,CAC5C,SAAS,EACT,IAAI,CAAC,aAAa,CACrB,CAAC;IACN,CAAC;AAED;;;AAGG;IACH,gBAAgB,GAAA;;AAEZ,QAAA,MAAM,KAAK,GAAG,MAAM,CAChB,4DAA4D,CAC/D,CAAC;;QAGF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE;YACR,MAAM,8BAA8B,CAChCF,aAA2C,EAC3C,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;;AAGD,QAAA,MAAM,aAAa,GAAG;AAClB,YAAA,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAClB,YAAA,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AACzB,YAAA,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;AACtB,YAAA,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;SAChB,CAAC;AAEV,QAAA,IAAI,SAAc,CAAC;QACnB,IAAI;YACA,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACvC,QAAA,CAAA;QAAC,MAAM;YACJ,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC;QAC1D,MAAM,kBAAkB,GAAG,CAAA,EAAG,aAAa,CAAC,QAAQ,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAC;QAChE,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC5D;;;AAGG;AACH,QAAA,MAAM,WAAW,GACb,IAAI,KAAK,SAAS,CAAC,IAAI;AACvB,YAAA,IAAI,KAAK,CAAA,EAAG,SAAS,CAAC,IAAI,CAAA,EAAG,WAAW,CAAA,CAAE;AAC1C,aAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC;gBAClB,IAAI,GAAG,CAAC,CAAA,EAAG,aAAa,CAAC,QAAQ,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAC,CAAC,IAAI;oBAC9C,SAAS,CAAC,IAAI,CAAC,CAAC;;QAG5B,IAAI,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE;YAC3D,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,IAAI,CAAC,aAAa,CACrB,CAAC;AACL,QAAA,CAAA;QAED,IAAI,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzD,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnE,QAAA,aAAa,CAAC,YAAY,GAAG,YAAY,CAAC;QAE1C,IACI,aAAa,CAAC,WAAW;AACzB,YAAA,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EACzC;AACE,YAAA,aAAa,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC,SAAS,CAC3D,CAAC,EACD,aAAa,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CACvC,CAAC;AACL,QAAA,CAAA;AACD,QAAA,OAAO,aAAa,CAAC;IACzB,CAAC;AAED,IAAA,OAAO,gBAAgB,CAAC,GAAW,EAAE,aAAqB,EAAA;AACtD,QAAA,MAAM,KAAK,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAEjD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,CAAC,KAAK,EAAE;YACR,MAAM,8BAA8B,CAChCA,aAA2C,EAC3C,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AAED,QAAA,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AAED,IAAA,OAAO,cAAc,CACjB,WAAmB,EACnB,OAAe,EACf,aAAqB,EAAA;QAErB,IAAI,WAAW,CAAC,CAAC,CAAC,KAAKG,aAAuB,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAClD,YAAA,MAAM,cAAc,GAAG,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAE9C,QACI,cAAc,CAAC,QAAQ;gBACvB,IAAI;AACJ,gBAAA,cAAc,CAAC,eAAe;AAC9B,gBAAA,WAAW,EACb;AACL,QAAA,CAAA;AAED,QAAA,OAAO,WAAW,CAAC;IACvB,CAAC;AAED,IAAA,OAAO,+BAA+B,CAClC,SAAe,EACf,aAAqB,EAAA;AAErB,QAAA,OAAO,IAAI,SAAS,CAChB,SAAS,CAAC,QAAQ;YACd,IAAI;AACJ,YAAA,SAAS,CAAC,eAAe;YACzB,GAAG;YACH,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EACpC,aAAa,CAChB,CAAC;IACN,CAAC;AACJ;;;;"}

package/dist-browser/utils/ClientAssertionUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/Constants.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/FunctionWrappers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35,7 +35,8 @@ const invoke = (callback, eventName, logger, telemetryClient, correlationId) =>
         catch (e) {
             logger.trace(`0cfd8i ${eventName}`, correlationId);
             try {
-                logger.trace(JSON.stringify(e), correlationId);
+                // Prevent numeric error details from being treated as minified log hashes.
+                logger.tracePii(`028ef8 ${JSON.stringify(e)}`, correlationId);
             }
             catch (e) {
                 logger.trace("00dty7", correlationId);
@@ -79,7 +80,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
             .catch((e) => {
             logger.trace(`0cfd8i ${eventName}`, correlationId);
             try {
-                logger.trace(JSON.stringify(e), correlationId);
+                logger.tracePii(`028ef8 ${JSON.stringify(e)}`, correlationId);
             }
             catch (e) {
                 logger.trace("00dty7", correlationId);

package/dist-browser/utils/FunctionWrappers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"FunctionWrappers.mjs","sources":["../../src/utils/FunctionWrappers.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAKH;;;;;;;;;;AAUG;AACH;AACO,MAAM,MAAM,GAAG,CAClB,QAA2B,EAC3B,SAAiB,EACjB,MAAc,EACd,eAAmC,EACnC,aAAqB,KACrB;AACA,IAAA,OAAO,CAAC,GAAG,IAAO,KAAO;QACrB,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAuB,aAAY,CAAE,CAAA;QAClD,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CACpD,SAAS,EACT,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,aAAa,EAAE;;AAEf,YAAA,eAAe,CAAC,eAAe,CAC3B,EAAE,CAAC,CAAA,IAAA,EAAO,SAAS,CAAA,SAAA,CAAW,GAAG,CAAC,EAAE,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QACD,IAAI;AACA,YAAA,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACjC,eAAe,CAAC,GAAG,CAAC;AAChB,gBAAA,OAAO,EAAE,IAAI;AAChB,aAAA,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAA,aAAmC,CAAA,CAAG;AACnD,YAAA,OAAO,MAAM,CAAC;AACjB,QAAA,CAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,eAAoC,CAAA,CAAA;YACjD,IAAI;AACA,gBAAA,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAClD,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,MAAM,CAAC,KAAK,CAAC;AAChB,YAAA,CAAA;YACD,eAAe,CAAC,GAAG,CACf;AACI,gBAAA,OAAO,EAAE,KAAK;aACjB,EACD,CAAC,CACJ,CAAC;AACF,YAAA,MAAM,CAAC,CAAC;AACX,QAAA,CAAA;AACL,IAAA,CAAC,CAAC;AACN,EAAE;AAEF;;;;;;;;;;;AAWG;AACH;AACO,MAAM,WAAW,GAAG,CACvB,QAAoC,EACpC,SAAiB,EACjB,MAAc,EACd,eAAmC,EACnC,aAAqB,KACrB;AACA,IAAA,OAAO,CAAC,GAAG,IAAO,KAAgB;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAuB,aAAY,CAAE,CAAA;QAClD,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CACpD,SAAS,EACT,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,aAAa,EAAE;;AAEf,YAAA,eAAe,CAAC,eAAe,CAC3B,EAAE,CAAC,CAAA,IAAA,EAAO,SAAS,CAAA,SAAA,CAAW,GAAG,CAAC,EAAE,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACD,QAAA,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC;AACnB,aAAA,IAAI,CAAC,CAAC,QAAQ,KAAI;YACf,MAAM,CAAC,KAAK,CACR,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAA,aAAmC,CAAA,CAAG;YAG1C,eAAe,CAAC,GAAG,CAAC;AAChB,gBAAA,OAAO,EAAE,IAAI;AAChB,aAAA,CAAC,CAAC;AACH,YAAA,OAAO,QAAQ,CAAC;AACpB,QAAA,CAAC,CAAC;AACD,aAAA,KAAK,CAAC,CAAC,CAAC,KAAI;YACT,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,eAAoC,CAAA,CAAA;YACjD,IAAI;AACA,gBAAA,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAClD,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,MAAM,CAAC,KAAK,CACR;AAGP,YAAA,CAAA;YACD,eAAe,CAAC,GAAG,CACf;AACI,gBAAA,OAAO,EAAE,KAAK;aACjB,EACD,CAAC,CACJ,CAAC;AACF,YAAA,MAAM,CAAC,CAAC;AACZ,QAAA,CAAC,CAAC,CAAC;AACX,IAAA,CAAC,CAAC;AACN;;;;"}
+{"version":3,"file":"FunctionWrappers.mjs","sources":["../../src/utils/FunctionWrappers.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAKH;;;;;;;;;;AAUG;AACH;AACO,MAAM,MAAM,GAAG,CAClB,QAA2B,EAC3B,SAAiB,EACjB,MAAc,EACd,eAAmC,EACnC,aAAqB,KACrB;AACA,IAAA,OAAO,CAAC,GAAG,IAAO,KAAO;QACrB,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAuB,aAAY,CAAE,CAAA;QAClD,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CACpD,SAAS,EACT,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,aAAa,EAAE;;AAEf,YAAA,eAAe,CAAC,eAAe,CAC3B,EAAE,CAAC,CAAA,IAAA,EAAO,SAAS,CAAA,SAAA,CAAW,GAAG,CAAC,EAAE,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QACD,IAAI;AACA,YAAA,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACjC,eAAe,CAAC,GAAG,CAAC;AAChB,gBAAA,OAAO,EAAE,IAAI;AAChB,aAAA,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAA,aAAmC,CAAA,CAAG;AACnD,YAAA,OAAO,MAAM,CAAC;AACjB,QAAA,CAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,eAAoC,CAAA,CAAA;YACjD,IAAI;;AAEA,gBAAA,MAAM,CAAC,QAAQ,CACX,CAAA,OAAA,EAAA,IAAA,CAAA,SAAwB,CAAA,CAAA,CAAA,CAAA,CAAA,EAAA,aACxB,CAAA,CAAA;AAEP,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,MAAM,CAAC,KAAK,CAAC;AAChB,YAAA,CAAA;YACD,eAAe,CAAC,GAAG,CACf;AACI,gBAAA,OAAO,EAAE,KAAK;aACjB,EACD,CAAC,CACJ,CAAC;AACF,YAAA,MAAM,CAAC,CAAC;AACX,QAAA,CAAA;AACL,IAAA,CAAC,CAAC;AACN,EAAE;AAEF;;;;;;;;;;;AAWG;AACH;AACO,MAAM,WAAW,GAAG,CACvB,QAAoC,EACpC,SAAiB,EACjB,MAAc,EACd,eAAmC,EACnC,aAAqB,KACrB;AACA,IAAA,OAAO,CAAC,GAAG,IAAO,KAAgB;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAuB,aAAY,CAAE,CAAA;QAClD,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CACpD,SAAS,EACT,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,aAAa,EAAE;;AAEf,YAAA,eAAe,CAAC,eAAe,CAC3B,EAAE,CAAC,CAAA,IAAA,EAAO,SAAS,CAAA,SAAA,CAAW,GAAG,CAAC,EAAE,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACD,QAAA,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC;AACnB,aAAA,IAAI,CAAC,CAAC,QAAQ,KAAI;YACf,MAAM,CAAC,KAAK,CACR,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAA,aAAmC,CAAA,CAAG;YAG1C,eAAe,CAAC,GAAG,CAAC;AAChB,gBAAA,OAAO,EAAE,IAAI;AAChB,aAAA,CAAC,CAAC;AACH,YAAA,OAAO,QAAQ,CAAC;AACpB,QAAA,CAAC,CAAC;AACD,aAAA,KAAK,CAAC,CAAC,CAAC,KAAI;YACT,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,eAAoC,CAAA,CAAA;YACjD,IAAI;AACA,gBAAA,MAAM,CAAC,QAAQ,CACX,CAAA,OAAA,EAAA,IAAA,CAAA,SAAwB,CAAA,CAAA,CAAA,CAAA,CAAA,EAAA,aACxB,CAAA,CAAA;AAEP,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,MAAM,CAAC,KAAK,CACR;AAGP,YAAA,CAAA;YACD,eAAe,CAAC,GAAG,CACf;AACI,gBAAA,OAAO,EAAE,KAAK;aACjB,EACD,CAAC,CACJ,CAAC;AACF,YAAA,MAAM,CAAC,CAAC;AACZ,QAAA,CAAC,CAAC,CAAC;AACX,IAAA,CAAC,CAAC;AACN;;;;"}

package/dist-browser/utils/ObjectUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/ProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { RESOURCE_DELIM } from './Constants.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist-browser/utils/StringUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/TimeUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/UrlUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';

package/lib/index-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 'use strict';
 
-var indexNode = require('./index-node-CLM4E-dZ.js');
+var indexNode = require('./index-node-PSDxoU6m.js');
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/lib/{index-node-CLM4E-dZ.js → index-node-PSDxoU6m.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.1 2026-11-06 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 'use strict';
 
@@ -821,6 +821,12 @@ var Constants = /*#__PURE__*/Object.freeze({
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+// Matches ASCII controls, space, DEL, backslash, or the userinfo separator (@).
+const UNSAFE_AUTHORITY = /[\x00-\x20\x7f\\@]/;
+const DEFAULT_PORTS = {
+    "https:": ":443",
+    "http:": ":80",
+};
 /**
  * Url object class which can perform various transformations on url strings.
  */
@@ -936,6 +942,29 @@ class UrlString {
             AbsolutePath: match[5],
             QueryString: match[7],
         };
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(this.urlString);
+        }
+        catch {
+            throw createClientConfigurationError(urlParseError, this.correlationId);
+        }
+        const host = urlComponents.HostNameAndPort?.toLowerCase();
+        const schemeAndAuthority = `${urlComponents.Protocol}//${host}`;
+        const defaultPort = DEFAULT_PORTS[parsedUrl.protocol] ?? "";
+        /*
+         * Cross-check the original host; reparsing parsedUrl would hide parser differences.
+         * URL has validated IPv6 syntax, so only bracketed hosts need a normalization comparison.
+         */
+        const hostMatches = host === parsedUrl.host ||
+            host === `${parsedUrl.host}${defaultPort}` ||
+            (host?.startsWith("[") &&
+                new URL(`${urlComponents.Protocol}//${host}`).host ===
+                    parsedUrl.host);
+        // Check authority ambiguity without restricting resource paths, queries, or fragments.
+        if (UNSAFE_AUTHORITY.test(schemeAndAuthority) || !hostMatches) {
+            throw createClientConfigurationError(urlParseError, this.correlationId);
+        }
         let pathSegments = urlComponents.AbsolutePath.split("/");
         pathSegments = pathSegments.filter((val) => val && val.length > 0); // remove empty elements
         urlComponents.PathSegments = pathSegments;
@@ -1318,7 +1347,8 @@ const invoke = (callback, eventName, logger, telemetryClient, correlationId) =>
         catch (e) {
             logger.trace(`Error occurred in '${eventName}'`, correlationId);
             try {
-                logger.trace(JSON.stringify(e), correlationId);
+                // Prevent numeric error details from being treated as minified log hashes.
+                logger.tracePii(`Error details: '${JSON.stringify(e)}'`, correlationId);
             }
             catch (e) {
                 logger.trace("Unable to print error message.", correlationId);
@@ -1362,7 +1392,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
             .catch((e) => {
             logger.trace(`Error occurred in '${eventName}'`, correlationId);
             try {
-                logger.trace(JSON.stringify(e), correlationId);
+                logger.tracePii(`Error details: '${JSON.stringify(e)}'`, correlationId);
             }
             catch (e) {
                 logger.trace("Unable to print error message.", correlationId);
@@ -1379,6 +1409,20 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+// Starts with an ASCII letter; remaining characters are ASCII letters, digits, or hyphens.
+const REGION_NAME_PATTERN = /^[a-z][a-z0-9-]*$/i;
+// A region becomes a DNS label, limited to 63 octets by RFC 1035 section 2.3.4.
+const MAX_REGION_NAME_LENGTH = 63;
+/**
+ * Whether a region can safely be used as a single DNS label.
+ */
+function isValidRegion(region) {
+    return (typeof region === "string" &&
+        region.length <= MAX_REGION_NAME_LENGTH &&
+        REGION_NAME_PATTERN.test(region) &&
+        // Keep the trailing-hyphen rule explicit rather than complicating the pattern.
+        !region.endsWith("-"));
+}
 class RegionDiscovery {
     constructor(networkInterface, logger, performanceClient, correlationId) {
         this.networkInterface = networkInterface;
@@ -1438,12 +1482,16 @@ class RegionDiscovery {
             regionDiscoveryMetadata.region_source =
                 RegionDiscoverySources.ENVIRONMENT_VARIABLE;
         }
-        // If no region was auto detected from the environment or from the IMDS endpoint, mark the attempt as a FAILED_AUTO_DETECTION
-        if (!autodetectedRegionName) {
+        // Untrusted discovery values must be a single DNS label before becoming a host prefix.
+        if (!autodetectedRegionName || !isValidRegion(autodetectedRegionName)) {
+            if (autodetectedRegionName) {
+                this.logger.warning("Region discovery returned an invalid region. Using the global authority.", this.correlationId);
+            }
             regionDiscoveryMetadata.region_source =
                 RegionDiscoverySources.FAILED_AUTO_DETECTION;
+            return null;
         }
-        return autodetectedRegionName || null;
+        return autodetectedRegionName;
     }
     /**
      * Make the call to the IMDS endpoint
@@ -2724,6 +2772,9 @@ class Authority {
      * @param region string
      */
     static buildRegionalAuthorityString(host, region, correlationId, queryString) {
+        if (!isValidRegion(region)) {
+            throw createClientConfigurationError(urlParseError, correlationId);
+        }
         // Create and validate a Url string object with the initial authority string
         const authorityUrlInstance = new UrlString(host, correlationId);
         authorityUrlInstance.validateAsUri();
@@ -2734,7 +2785,7 @@ class Authority {
         }
         // Include the query string portion of the url
         const url = UrlString.constructAuthorityUriFromObject({
-            ...authorityUrlInstance.getUrlComponents(),
+            ...authorityUrlParts,
             HostNameAndPort: hostNameAndPort,
         }, correlationId).urlString;
         // Add the query string if a query string was provided
@@ -4663,7 +4714,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.16.1";
+const version = "16.16.2";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7590,7 +7641,8 @@ class AuthorizationCodeClient {
             throw createClientAuthError(requestCannotBeMade, request.correlationId);
         }
         // Check for new cloud instance
-        if (authCodePayload && authCodePayload.cloud_instance_host_name) {
+        if (this.config.authOptions.instanceAware === true &&
+            authCodePayload?.cloud_instance_host_name) {
             await invokeAsync(this.updateTokenEndpointAuthority.bind(this), UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodePayload.cloud_instance_host_name, request.correlationId);
         }
         const reqTimestamp = nowSeconds();
@@ -8369,13 +8421,13 @@ function validateAuthorizationResponse(serverResponse, requestState, correlation
         decodedServerResponseState = decodeURIComponent(serverResponse.state);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId);
     }
     try {
         decodedRequestState = decodeURIComponent(requestState);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId);
     }
     if (decodedServerResponseState !== decodedRequestState) {
         throw createClientAuthError(stateMismatch, correlationId);
@@ -8927,4 +8979,4 @@ exports.normalizeDpopResourceRequestContext = normalizeDpopResourceRequestContex
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-CLM4E-dZ.js.map
+//# sourceMappingURL=index-node-PSDxoU6m.js.map