@azure/msal-common 16.6.1 → 16.6.3

package/dist-browser/error/NetworkError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/PlatformBrokerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ServerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/index-browser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 export { AuthorizationCodeClient } from './client/AuthorizationCodeClient.mjs';
 export { RefreshTokenClient } from './client/RefreshTokenClient.mjs';

package/dist-browser/index.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 export { AuthorizationCodeClient } from './client/AuthorizationCodeClient.mjs';
 export { RefreshTokenClient } from './client/RefreshTokenClient.mjs';

package/dist-browser/log-strings-mapping.json

@@ -1,6 +1,6 @@
 {
-  "timestamp": "2026-05-11T21:49:18.480Z",
-  "packageVersion": "16.6.1",
+  "timestamp": "2026-05-28T17:17:46.334Z",
+  "packageVersion": "16.6.3",
   "totalStrings": 96,
   "mappings": {
     "1ub6wv": {

package/dist-browser/logger/Logger.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/network/INetworkModule.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/network/RequestThumbprint.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/network/ThrottlingUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { THROTTLING_PREFIX, HeaderNames, DEFAULT_THROTTLE_TIME_SECONDS, DEFAULT_MAX_THROTTLE_TIME_SECONDS } from '../utils/Constants.mjs';
 import { ServerError } from '../error/ServerError.mjs';

package/dist-browser/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.6.1";
+const version = "16.6.3";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist-browser/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
 import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';

package/dist-browser/protocol/Token.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { CcsCredentialType } from '../account/CcsCredential.mjs';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';

package/dist-browser/request/AuthenticationHeaderParser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { HeaderNames } from '../utils/Constants.mjs';

package/dist-browser/request/BaseAuthRequest.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/request/RequestParameterBuilder.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { OIDC_DEFAULT_SCOPES, ResponseMode, HeaderNames, CLIENT_INFO, ClaimsRequestKeys, PasswordGrantConstants, AuthenticationScheme, X_MS_LIB_CAPABILITY_VALUE } from '../utils/Constants.mjs';
 import { CLIENT_ID, BROKER_CLIENT_ID, REDIRECT_URI, RESPONSE_TYPE, RESPONSE_MODE, NATIVE_BROKER, SCOPE, POST_LOGOUT_URI, ID_TOKEN_HINT, DOMAIN_HINT, LOGIN_HINT, SID, CLAIMS, CLIENT_REQUEST_ID, X_CLIENT_SKU, X_CLIENT_VER, X_CLIENT_OS, X_CLIENT_CPU, X_APP_NAME, X_APP_VER, PROMPT, STATE, NONCE, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE, DEVICE_CODE, REFRESH_TOKEN, CODE_VERIFIER, CLIENT_SECRET, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, OBO_ASSERTION, REQUESTED_TOKEN_USE, GRANT_TYPE, CLI_DATA, INSTANCE_AWARE, TOKEN_TYPE, REQ_CNF, X_CLIENT_CURR_TELEM, X_CLIENT_LAST_TELEM, X_MS_LIB_CAPABILITY, LOGOUT_HINT, BROKER_REDIRECT_URI, EAR_JWK, EAR_JWE_CRYPTO, RESOURCE } from '../constants/AADServerParamKeys.mjs';

package/dist-browser/request/ScopeSet.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist-browser/response/ResponseHandler.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { updateAccountTenantProfileData, buildTenantProfile } from '../account/AccountInfo.mjs';
 import { extractTokenClaims, checkMaxAge, isKmsi } from '../account/AuthToken.mjs';

package/dist-browser/telemetry/performance/PerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { getAndFlushLogsFromCache } from '../../logger/Logger.mjs';
 import { IntFields, PerformanceEventStatus, EXT_FIELD_PREFIX } from './PerformanceEvent.mjs';

package/dist-browser/telemetry/performance/PerformanceEvent.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/telemetry/performance/PerformanceEvents.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/telemetry/performance/StubPerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { PerformanceEventStatus } from './PerformanceEvent.mjs';
 

package/dist-browser/telemetry/server/ServerTelemetryManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { CacheOutcome, SERVER_TELEM_CACHE_KEY, CACHE_KEY_SEPARATOR, SERVER_TELEM_SCHEMA_VERSION, SERVER_TELEM_VALUE_SEPARATOR, SERVER_TELEM_CATEGORY_SEPARATOR, SERVER_TELEM_OVERFLOW_TRUE, SERVER_TELEM_OVERFLOW_FALSE, SERVER_TELEM_MAX_CACHED_ERRORS, SERVER_TELEM_UNKNOWN_ERROR, SERVER_TELEM_MAX_LAST_HEADER_BYTES } from '../../utils/Constants.mjs';
 import { AuthError } from '../../error/AuthError.mjs';

package/dist-browser/url/UrlString.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist-browser/utils/ClientAssertionUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/Constants.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/FunctionWrappers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/ProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { RESOURCE_DELIM } from './Constants.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist-browser/utils/StringUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/TimeUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/UrlUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { StringUtils } from './StringUtils.mjs';

package/lib/index-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 'use strict';
 
-var indexNode = require('./index-node-Cr_rbZzO.js');
+var indexNode = require('./index-node-DD7cL05m.js');
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/lib/{index-node-Cr_rbZzO.js → index-node-DD7cL05m.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.3 2026-05-28 */
 'use strict';
 'use strict';
 
@@ -293,6 +293,7 @@ const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
 const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
 const issuerValidationFailed = "issuer_validation_failed";
 
 var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
@@ -308,6 +309,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     invalidClaims: invalidClaims,
     invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
     invalidCodeChallengeMethod: invalidCodeChallengeMethod,
+    invalidPlatformBrokerConfiguration: invalidPlatformBrokerConfiguration,
     invalidRequestMethodForEAR: invalidRequestMethodForEAR,
     issuerValidationFailed: issuerValidationFailed,
     logoutRequestEmpty: logoutRequestEmpty,
@@ -2408,7 +2410,7 @@ class Authority {
             }
         }
         // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
-        if (this.isInKnownAuthorities()) {
+        if (this.isInKnownAuthorities(this.hostnameAndPort)) {
             this.logger.verbose("The host is included in knownAuthorities. Creating new cloud discovery metadata from the host.", this.correlationId);
             return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
         }
@@ -2476,13 +2478,14 @@ class Authority {
         return match;
     }
     /**
-     * Helper function to determine if this host is included in the knownAuthorities config option
+     * Helper function to determine if a host is included in the knownAuthorities config option.
      */
-    isInKnownAuthorities() {
+    isInKnownAuthorities(host) {
+        const normalizedHost = host.toLowerCase();
         const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
             return (authority &&
                 UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                    this.hostnameAndPort);
+                    normalizedHost);
         });
         return matches.length > 0;
     }
@@ -2559,6 +2562,10 @@ class Authority {
      *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
      *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
      *     path.
+     *  5. The issuer host is HTTPS and is explicitly listed in the
+     *     developer-configured `knownAuthorities`. This covers scenarios where
+     *     the OIDC discovery document returns an issuer host that differs from
+     *     the authority (e.g., a GUID-based issuer for a name-based CIAM authority).
      *
      * @param issuer The `issuer` value returned in the OIDC discovery document.
      * @throws ClientConfigurationError("issuer_validation_failed") on failure.
@@ -2595,11 +2602,19 @@ class Authority {
          * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
          */
         const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+        /*
+         * Rule 5: The issuer host is explicitly listed in the developer-configured
+         * knownAuthorities. This covers scenarios where the OIDC discovery document
+         * returns an issuer with a different host than the authority
+         * (e.g., a GUID-based issuer for a name-based authority).
+         */
+        const matchesKnownAuthority = issuerScheme === "https:" && this.isInKnownAuthorities(issuerHost);
         // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
         if (matchesAuthorityOrigin ||
             matchesKnownMicrosoftHost ||
             matchesRegionalMicrosoftHost ||
-            matchesCiamTenantPattern) {
+            matchesCiamTenantPattern ||
+            matchesKnownAuthority) {
             return;
         }
         // issuer validation fails if none of the above rules are satisfied
@@ -4411,7 +4426,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.6.1";
+const version = "16.6.3";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8039,4 +8054,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-Cr_rbZzO.js.map
+//# sourceMappingURL=index-node-DD7cL05m.js.map