@azure/msal-common 16.5.2 → 16.6.1

package/dist/error/ClientConfigurationErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -25,7 +25,8 @@ const invalidAuthenticationHeader = "invalid_authentication_header";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
-const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const issuerValidationFailed = "issuer_validation_failed";
 
-export { authorityMismatch, authorityUriInsecure, cannotAllowPlatformBroker, cannotSetOIDCOptions, claimsRequestParsingError, emptyInputScopesError, invalidAuthenticationHeader, invalidAuthorityMetadata, invalidClaims, invalidCloudDiscoveryMetadata, invalidCodeChallengeMethod, invalidRequestMethodForEAR, logoutRequestEmpty, missingNonceAuthenticationHeader, missingSshJwk, missingSshKid, pkceParamsMissing, redirectUriEmpty, tokenRequestEmpty, untrustedAuthority, urlEmptyError, urlParseError };
+export { authorityMismatch, authorityUriInsecure, cannotAllowPlatformBroker, cannotSetOIDCOptions, claimsRequestParsingError, emptyInputScopesError, invalidAuthenticationHeader, invalidAuthorityMetadata, invalidClaims, invalidCloudDiscoveryMetadata, invalidCodeChallengeMethod, invalidRequestMethodForEAR, issuerValidationFailed, logoutRequestEmpty, missingNonceAuthenticationHeader, missingSshJwk, missingSshKid, pkceParamsMissing, redirectUriEmpty, tokenRequestEmpty, untrustedAuthority, urlEmptyError, urlParseError };
 //# sourceMappingURL=ClientConfigurationErrorCodes.mjs.map

package/dist/error/ClientConfigurationErrorCodes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClientConfigurationErrorCodes.mjs","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,0BAA0B,GAAG,gCAAgC;AACnE,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,6BAA6B,GAAG,mCAAmC;AACzE,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB;AACjD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,gCAAgC,GACzC,sCAAsC;AACnC,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,iBAAiB,GAAG,qBAAqB;AAC/C,MAAM,0BAA0B,GAAG;;;;"}
+{"version":3,"file":"ClientConfigurationErrorCodes.mjs","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,0BAA0B,GAAG,gCAAgC;AACnE,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,6BAA6B,GAAG,mCAAmC;AACzE,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB;AACjD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,gCAAgC,GACzC,sCAAsC;AACnC,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,iBAAiB,GAAG,qBAAqB;AAC/C,MAAM,0BAA0B,GAAG,iCAAiC;AACpE,MAAM,sBAAsB,GAAG;;;;"}

package/dist/error/InteractionRequiredAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 import { interactionRequired, consentRequired, loginRequired, badToken, uxNotAllowed, interruptedUser } from './InteractionRequiredAuthErrorCodes.mjs';

package/dist/error/InteractionRequiredAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/JoseHeaderError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/JoseHeaderErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/NetworkError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/PlatformBrokerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/ServerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/index-node.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 export { AuthorizationCodeClient } from './client/AuthorizationCodeClient.mjs';
 export { RefreshTokenClient } from './client/RefreshTokenClient.mjs';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 export { AuthorizationCodeClient } from './client/AuthorizationCodeClient.mjs';
 export { RefreshTokenClient } from './client/RefreshTokenClient.mjs';

package/dist/logger/Logger.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/network/INetworkModule.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist/network/RequestThumbprint.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/network/ThrottlingUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { THROTTLING_PREFIX, HeaderNames, DEFAULT_THROTTLE_TIME_SECONDS, DEFAULT_MAX_THROTTLE_TIME_SECONDS } from '../utils/Constants.mjs';
 import { ServerError } from '../error/ServerError.mjs';

package/dist/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.5.2";
+const version = "16.6.1";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
 import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';

package/dist/protocol/Token.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { CcsCredentialType } from '../account/CcsCredential.mjs';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';

package/dist/request/AuthenticationHeaderParser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { HeaderNames } from '../utils/Constants.mjs';

package/dist/request/BaseAuthRequest.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';

package/dist/request/RequestParameterBuilder.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { OIDC_DEFAULT_SCOPES, ResponseMode, HeaderNames, CLIENT_INFO, ClaimsRequestKeys, PasswordGrantConstants, AuthenticationScheme, X_MS_LIB_CAPABILITY_VALUE } from '../utils/Constants.mjs';
 import { CLIENT_ID, BROKER_CLIENT_ID, REDIRECT_URI, RESPONSE_TYPE, RESPONSE_MODE, NATIVE_BROKER, SCOPE, POST_LOGOUT_URI, ID_TOKEN_HINT, DOMAIN_HINT, LOGIN_HINT, SID, CLAIMS, CLIENT_REQUEST_ID, X_CLIENT_SKU, X_CLIENT_VER, X_CLIENT_OS, X_CLIENT_CPU, X_APP_NAME, X_APP_VER, PROMPT, STATE, NONCE, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE, DEVICE_CODE, REFRESH_TOKEN, CODE_VERIFIER, CLIENT_SECRET, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, OBO_ASSERTION, REQUESTED_TOKEN_USE, GRANT_TYPE, CLI_DATA, INSTANCE_AWARE, TOKEN_TYPE, REQ_CNF, X_CLIENT_CURR_TELEM, X_CLIENT_LAST_TELEM, X_MS_LIB_CAPABILITY, LOGOUT_HINT, BROKER_REDIRECT_URI, EAR_JWK, EAR_JWE_CRYPTO, RESOURCE } from '../constants/AADServerParamKeys.mjs';

package/dist/request/ScopeSet.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist/response/ResponseHandler.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { updateAccountTenantProfileData, buildTenantProfile } from '../account/AccountInfo.mjs';
 import { extractTokenClaims, checkMaxAge, isKmsi } from '../account/AuthToken.mjs';

package/dist/telemetry/performance/PerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { getAndFlushLogsFromCache } from '../../logger/Logger.mjs';
 import { IntFields, PerformanceEventStatus, EXT_FIELD_PREFIX } from './PerformanceEvent.mjs';

package/dist/telemetry/performance/PerformanceEvent.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/telemetry/performance/PerformanceEvents.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/telemetry/performance/StubPerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { PerformanceEventStatus } from './PerformanceEvent.mjs';
 

package/dist/telemetry/server/ServerTelemetryManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { CacheOutcome, SERVER_TELEM_CACHE_KEY, CACHE_KEY_SEPARATOR, SERVER_TELEM_SCHEMA_VERSION, SERVER_TELEM_VALUE_SEPARATOR, SERVER_TELEM_CATEGORY_SEPARATOR, SERVER_TELEM_OVERFLOW_TRUE, SERVER_TELEM_OVERFLOW_FALSE, SERVER_TELEM_MAX_CACHED_ERRORS, SERVER_TELEM_UNKNOWN_ERROR, SERVER_TELEM_MAX_LAST_HEADER_BYTES } from '../../utils/Constants.mjs';
 import { AuthError } from '../../error/AuthError.mjs';

package/dist/url/UrlString.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist/utils/ClientAssertionUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/Constants.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/FunctionWrappers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/ProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { RESOURCE_DELIM } from './Constants.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist/utils/StringUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/TimeUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/UrlUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { StringUtils } from './StringUtils.mjs';

package/dist-browser/account/AccountInfo.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/account/AuthToken.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { tokenParsingError, nullOrEmptyToken, maxAgeTranspired } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/account/CcsCredential.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/account/ClientInfo.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { CLIENT_INFO_SEPARATOR } from '../utils/Constants.mjs';

package/dist-browser/account/TokenClaims.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/Authority.mjs

@@ -1,10 +1,10 @@
-/*! @azure/msal-common v16.5.2 2026-04-28 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 'use strict';
 import { AuthorityType } from './AuthorityType.mjs';
 import { isOpenIdConfigResponse } from './OpenIdConfigResponse.mjs';
 import { UrlString } from '../url/UrlString.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
-import { CIAM_AUTH_URL, DSTS, ADFS, AuthorityMetadataSource, AZURE_REGION_AUTO_DISCOVER_FLAG, RegionDiscoveryOutcomes, AAD_INSTANCE_DISCOVERY_ENDPT, INVALID_INSTANCE, DEFAULT_AUTHORITY_HOST, KNOWN_PUBLIC_CLOUDS, FORWARD_SLASH, AADAuthority, DEFAULT_COMMON_TENANT, REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX, AAD_TENANT_DOMAIN_SUFFIX } from '../utils/Constants.mjs';
+import { CIAM_AUTH_URL, DSTS, ADFS, AuthorityMetadataSource, AZURE_REGION_AUTO_DISCOVER_FLAG, RegionDiscoveryOutcomes, AAD_INSTANCE_DISCOVERY_ENDPT, INVALID_INSTANCE, DEFAULT_AUTHORITY_HOST, AAD_TENANT_DOMAIN_SUFFIX, KNOWN_PUBLIC_CLOUDS, FORWARD_SLASH, AADAuthority, DEFAULT_COMMON_TENANT, REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX } from '../utils/Constants.mjs';
 import { EndpointMetadata, getCloudDiscoveryMetadataFromHardcodedValues, getCloudDiscoveryMetadataFromNetworkResponse, InstanceDiscoveryMetadataAliases } from './AuthorityMetadata.mjs';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { ProtocolMode } from './ProtocolMode.mjs';
@@ -17,7 +17,7 @@ import { AuthorityUpdateCloudDiscoveryMetadata, AuthorityUpdateEndpointMetadata,
 import { invokeAsync } from '../utils/FunctionWrappers.mjs';
 import { generateAuthorityMetadataExpiresAt, updateAuthorityEndpointMetadata, isAuthorityMetadataExpired, updateCloudDiscoveryMetadata } from '../cache/utils/CacheHelpers.mjs';
 import { endpointResolutionError, endSessionEndpointNotSupported, openIdConfigError } from '../error/ClientAuthErrorCodes.mjs';
-import { invalidAuthorityMetadata, untrustedAuthority, invalidCloudDiscoveryMetadata } from '../error/ClientConfigurationErrorCodes.mjs';
+import { invalidAuthorityMetadata, untrustedAuthority, invalidCloudDiscoveryMetadata, issuerValidationFailed } from '../error/ClientConfigurationErrorCodes.mjs';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -272,7 +272,7 @@ class Authority {
         }, this.correlationId);
     }
     /**
-     * Returns metadata entity from cache if it exists, otherwiser returns a new metadata entity built
+     * Returns metadata entity from cache if it exists, otherwise returns a new metadata entity built
      * from the configured canonical authority
      * @returns
      */
@@ -341,6 +341,8 @@ class Authority {
         // Get metadata from network if local sources aren't available
         let metadata = await invokeAsync(this.getEndpointMetadataFromNetwork.bind(this), AuthorityGetEndpointMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
         if (metadata) {
+            // Validate the issuer returned by the OIDC discovery document.
+            this.validateIssuer(metadata.issuer);
             // If the user prefers to use an azure region replace the global endpoints with regional information.
             if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
                 metadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(metadata);
@@ -509,7 +511,7 @@ class Authority {
         throw createClientConfigurationError(untrustedAuthority);
     }
     updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
-        this.logger.verbose("0jhlgt", this.correlationId);
+        this.logger.verbose("1tpqlr", this.correlationId);
         this.logger.verbosePii("1fy7uz", this.correlationId);
         this.logger.verbosePii("08zabj", this.correlationId);
         this.logger.verbosePii("1o1kv3", this.correlationId);
@@ -706,6 +708,139 @@ class Authority {
     isAliasOfKnownMicrosoftAuthority(host) {
         return InstanceDiscoveryMetadataAliases.has(host);
     }
+    /**
+     * Validates the `issuer` returned by an OIDC discovery document against
+     * this authority, per
+     * https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
+     *
+     * The issuer is accepted when ANY of the following holds:
+     *  1. The issuer scheme + host + port match the authority's (path may
+     *     differ). Applies to all authorities.
+     *  2. The authority is a Microsoft cloud authority (public, sovereign,
+     *     or CIAM), the issuer is HTTPS, and the issuer host is in the known
+     *     Microsoft authority host set.
+     *  3. Same as (2), but the issuer host is a single-label regional variant
+     *     of a known Microsoft host (e.g. `westus.login.microsoftonline.com`).
+     *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
+     *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
+     *     path.
+     *
+     * @param issuer The `issuer` value returned in the OIDC discovery document.
+     * @throws ClientConfigurationError("issuer_validation_failed") on failure.
+     */
+    validateIssuer(issuer) {
+        if (!issuer) {
+            throw createClientConfigurationError(issuerValidationFailed);
+        }
+        // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
+        let issuerUrl;
+        try {
+            issuerUrl = new URL(issuer);
+        }
+        catch {
+            throw createClientConfigurationError(issuerValidationFailed);
+        }
+        const issuerScheme = issuerUrl.protocol;
+        const issuerHost = issuerUrl.host;
+        const authorityScheme = (this.canonicalAuthorityUrlComponents.Protocol || "").toLowerCase();
+        const authorityHost = (this.canonicalAuthorityUrlComponents.HostNameAndPort || "").toLowerCase();
+        // Rule 1: Same scheme and host
+        const matchesAuthorityOrigin = this.matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost);
+        // Rule 2: The issuer host is a well-known Microsoft authority host (HTTPS only)
+        const matchesKnownMicrosoftHost = issuerScheme === "https:" &&
+            this.isAliasOfKnownMicrosoftAuthority(issuerHost);
+        /*
+         * Rule 3: The issuer host is a regional variant ({region}.{host}) of a well-known host
+         * (HTTPS only). E.g. westus2.login.microsoft.com
+         */
+        const matchesRegionalMicrosoftHost = issuerScheme === "https:" &&
+            this.matchesRegionalMicrosoftHost(issuerHost);
+        /*
+         * Rule 4: CIAM-specific validation. In a CIAM scenario the issuer is expected to
+         * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
+         */
+        const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+        // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
+        if (matchesAuthorityOrigin ||
+            matchesKnownMicrosoftHost ||
+            matchesRegionalMicrosoftHost ||
+            matchesCiamTenantPattern) {
+            return;
+        }
+        // issuer validation fails if none of the above rules are satisfied
+        throw createClientConfigurationError(issuerValidationFailed);
+    }
+    /**
+     * Rule 1: The issuer scheme + host (and port) match the authority's. Path
+     * may differ. Applies to all authorities.
+     */
+    matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost) {
+        return issuerScheme === authorityScheme && issuerHost === authorityHost;
+    }
+    /**
+     * Rule 3: The issuer host is a regional variant
+     * (`{region}.{host}`) of a known Microsoft authority host.
+     * E.g. `westus2.login.microsoft.com`.
+     */
+    matchesRegionalMicrosoftHost(issuerHost) {
+        const firstDot = issuerHost.indexOf(".");
+        if (firstDot > 0 && firstDot < issuerHost.length - 1) {
+            const hostWithoutRegion = issuerHost.substring(firstDot + 1);
+            return this.isAliasOfKnownMicrosoftAuthority(hostWithoutRegion);
+        }
+        return false;
+    }
+    /**
+     * Rule 4: The issuer matches one of the well-known CIAM tenant patterns
+     * (`https://{tenant}.ciamlogin.com[/{tenant}[.onmicrosoft.com][/v2.0]]`).
+     *
+     * The bare tenant name is extracted from the authority's first path segment
+     * when available (stripping the `.onmicrosoft.com` suffix that
+     * `transformCIAMAuthority` adds), or otherwise from the leftmost label of
+     * the authority host (to support CIAM custom domain scenarios).
+     *
+     * Both `/{tenant}` and `/{tenant}.onmicrosoft.com` path forms are accepted
+     * because the OIDC issuer may use either form depending on the authority URL
+     * that was used to trigger discovery.
+     */
+    matchesCiamTenantPattern(issuerUrl, authorityHost, authorityPathSegments) {
+        /*
+         * authorityPathSegments[0] is the first path segment of the *authority
+         * URL* after transformCIAMAuthority runs (e.g. "contoso.onmicrosoft.com").
+         * Additional CIAM issuer path segments such as "/v2.0" are part of the
+         * issuer string, not the authority URL's PathSegments.
+         */
+        const pathSegment = authorityPathSegments[0];
+        /*
+         * Extract the bare tenant name: strip the .onmicrosoft.com suffix when
+         * present (introduced by transformCIAMAuthority), or fall back to the
+         * first label of the authority hostname for non-transformed/custom-domain
+         * CIAM authorities.
+         */
+        const tenantName = pathSegment
+            ? pathSegment.endsWith(AAD_TENANT_DOMAIN_SUFFIX)
+                ? pathSegment.slice(0, -AAD_TENANT_DOMAIN_SUFFIX.length)
+                : pathSegment
+            : authorityHost.split(".")[0];
+        if (!tenantName) {
+            return false;
+        }
+        const ciamBaseURL = `https://${tenantName}${CIAM_AUTH_URL}`;
+        const validCiamPatterns = [
+            ciamBaseURL,
+            `${ciamBaseURL}/${tenantName}`,
+            `${ciamBaseURL}/${tenantName}/v2.0`,
+            `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}`,
+            `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}/v2.0`, // https://{tenant}.ciamlogin.com/{tenant}.onmicrosoft.com/v2.0
+        ];
+        /*
+         * Compose the canonical issuer string from URL components and strip any
+         * trailing slashes from the path so it can be compared to the pattern set.
+         */
+        const issuerPath = issuerUrl.pathname.replace(/\/+$/, "");
+        const normalizedIssuer = `${issuerUrl.protocol}//${issuerUrl.host}${issuerPath}`;
+        return validCiamPatterns.some((pattern) => pattern === normalizedIssuer);
+    }
     /**
      * Checks whether the provided host is that of a public cloud authority
      *