@itwin/ecschema-rpcinterface-tests 5.13.0-dev.16 → 5.13.0-dev.18

package/lib/dist/bundled-tests.js

@@ -91445,6 +91445,8 @@ const COPYRIGHT_NOTICE = `Copyright © 2017-${new Date().getFullYear()} <a href=
 
 
 
+/** CSS class name applied to the notice element of a logo card created by [[IModelApp.makeLogoCard]]. */
+const logoCardNoticeClassName = "logo-cards";
 /**
  * Global singleton that connects the user interface with the iTwin.js services. There can be only one IModelApp active in a session. All
  * members of IModelApp are static, and it serves as a singleton object for gaining access to session information.
@@ -91957,10 +91959,21 @@ class IModelApp {
         }
         if (undefined !== opts.notice) {
             if (typeof opts.notice === "string")
-                IModelApp.makeHTMLElement("p", { parent: noticeCell, innerHTML: opts.notice, className: "logo-cards" });
+                IModelApp.makeHTMLElement("p", { parent: noticeCell, innerHTML: opts.notice, className: logoCardNoticeClassName });
             else
                 noticeCell.appendChild(opts.notice);
         }
+        else if (undefined !== opts.noticeLines) {
+            // A <p> cannot legally contain flow content, so use a <div> when a line is an element.
+            const containerTag = opts.noticeLines.some((line) => typeof line !== "string") ? "div" : "p";
+            const notice = IModelApp.makeHTMLElement(containerTag, { parent: noticeCell, className: logoCardNoticeClassName });
+            opts.noticeLines.forEach((line, index) => {
+                if (index > 0)
+                    notice.appendChild(IModelApp.makeHTMLElement("br"));
+                // Strings are appended as text nodes so they are never parsed as HTML.
+                notice.append(line);
+            });
+        }
         return card;
     }
     /** Make the logo card for the library itself. This card gets placed at the top of the stack.
@@ -93527,7 +93540,9 @@ let iModelJsCss = `
 
 .logo-cards {
   position:relative;
-  width:100%
+  width:100%;
+  margin-block-start:1em;
+  margin-block-end:1em
 }
 
 .imodeljs-modal-overlay {
@@ -93571,7 +93586,7 @@ let iModelJsCss = `
     max-width: calc(100% - (2 * var(--width-border))) !important;
     width: unset !important;
   }
-  .imodeljs-about .logo-card-message p {
+  .imodeljs-about .logo-card-message p, .imodeljs-about .logo-card-message .logo-cards {
     margin-block-end: 1em;
   }
   .imodeljs-about .logo-cards {
@@ -96217,9 +96232,12 @@ class Google3dTilesProvider {
             // Order by most occurances to least
             // See https://developers.google.com/maps/documentation/tile/create-renderer#display-attributions
             const sortedCopyrights = [...copyrightMap.entries()].sort((a, b) => b[1] - a[1]);
-            let copyrightMsg = "Data provided by:<br><ul>";
-            copyrightMsg += sortedCopyrights.map(([key]) => `<li>${key}</li>`).join("");
-            copyrightMsg += "</ul>";
+            const list = document.createElement("ul");
+            for (const [key] of sortedCopyrights) {
+                const item = document.createElement("li");
+                item.textContent = key;
+                list.appendChild(item);
+            }
             const iconSrc = document.createElement("img");
             iconSrc.src = `${_IModelApp__WEBPACK_IMPORTED_MODULE_8__.IModelApp.publicPath}images/GoogleMaps_Logo_Gray.svg`;
             iconSrc.style.padding = "10px 10px 5px 10px";
@@ -96227,7 +96245,7 @@ class Google3dTilesProvider {
                 iconSrc,
                 iconWidth: 98,
                 heading: "Google Photorealistic 3D Tiles",
-                notice: copyrightMsg
+                noticeLines: ["Data provided by:", list],
             }));
         }
     }
@@ -116617,7 +116635,7 @@ class GoogleMapsDecorator {
         const copyrightText = sortedCopyrights.map(([key]) => ` • ${key}`).join("");
         // Create and add element, offset to leave space for i.js and Google logos
         const elem = document.createElement("div");
-        elem.innerHTML = copyrightText;
+        elem.textContent = copyrightText;
         elem.style.color = "white";
         elem.style.fontSize = "11px";
         elem.style.textWrap = "wrap";
@@ -153464,6 +153482,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   OrbitGtTileTree: () => (/* binding */ OrbitGtTileTree),
 /* harmony export */   OrbitGtTreeReference: () => (/* binding */ OrbitGtTreeReference),
+/* harmony export */   computeOrthometricVerticalShift: () => (/* binding */ computeOrthometricVerticalShift),
 /* harmony export */   createOrbitGtTileTreeReference: () => (/* binding */ createOrbitGtTileTreeReference)
 /* harmony export */ });
 /* harmony import */ var _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @itwin/core-bentley */ "../../core/bentley/lib/esm/core-bentley.js");
@@ -153471,11 +153490,12 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(/*! @itwin/core-geometry */ "../../core/geometry/lib/esm/core-geometry.js");
 /* harmony import */ var _itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(/*! @itwin/core-orbitgt */ "../../core/orbitgt/lib/esm/core-orbitgt.js");
 /* harmony import */ var _BackgroundMapGeometry__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(/*! ../../BackgroundMapGeometry */ "../../core/frontend/lib/esm/BackgroundMapGeometry.js");
-/* harmony import */ var _DisplayStyleState__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(/*! ../../DisplayStyleState */ "../../core/frontend/lib/esm/DisplayStyleState.js");
-/* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(/*! ../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
-/* harmony import */ var _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(/*! ../../RealityDataSource */ "../../core/frontend/lib/esm/RealityDataSource.js");
-/* harmony import */ var _common_internal_render_MeshPrimitives__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__(/*! ../../common/internal/render/MeshPrimitives */ "../../core/frontend/lib/esm/common/internal/render/MeshPrimitives.js");
-/* harmony import */ var _tile_internal__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(/*! ../../tile/internal */ "../../core/frontend/lib/esm/tile/internal.js");
+/* harmony import */ var _common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(/*! ../../common/FrontendLoggerCategory */ "../../core/frontend/lib/esm/common/FrontendLoggerCategory.js");
+/* harmony import */ var _DisplayStyleState__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(/*! ../../DisplayStyleState */ "../../core/frontend/lib/esm/DisplayStyleState.js");
+/* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(/*! ../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
+/* harmony import */ var _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__(/*! ../../RealityDataSource */ "../../core/frontend/lib/esm/RealityDataSource.js");
+/* harmony import */ var _common_internal_render_MeshPrimitives__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(/*! ../../common/internal/render/MeshPrimitives */ "../../core/frontend/lib/esm/common/internal/render/MeshPrimitives.js");
+/* harmony import */ var _tile_internal__WEBPACK_IMPORTED_MODULE_10__ = __webpack_require__(/*! ../../tile/internal */ "../../core/frontend/lib/esm/tile/internal.js");
 /*---------------------------------------------------------------------------------------------
 * Copyright (c) Bentley Systems, Incorporated. All rights reserved.
 * See LICENSE.md in the project root for license terms and full copyright notice.
@@ -153493,6 +153513,7 @@ __webpack_require__.r(__webpack_exports__);
 
 
 
+
 const scratchRange = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Range3d.create();
 const scratchWorldFrustum = new _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Frustum();
 function compareSourceKeys(lhs, rhs) {
@@ -153556,7 +153577,7 @@ class OrbitGtTileTreeParams {
     id;
     modelId;
     iModel;
-    get priority() { return _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileLoadPriority.Context; }
+    get priority() { return _tile_internal__WEBPACK_IMPORTED_MODULE_10__.TileLoadPriority.Context; }
     constructor(rdSourceKey, iModel, modelId, location) {
         this.location = location;
         const key = rdSourceKey;
@@ -153565,10 +153586,10 @@ class OrbitGtTileTreeParams {
         this.iModel = iModel;
     }
 }
-class OrbitGtRootTile extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.Tile {
+class OrbitGtRootTile extends _tile_internal__WEBPACK_IMPORTED_MODULE_10__.Tile {
     _loadChildren(_resolve, _reject) { }
     async requestContent(_isCanceled) { return undefined; }
-    get channel() { return _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.tileAdmin.channels.getForHttp("itwinjs-orbitgit"); }
+    get channel() { return _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.tileAdmin.channels.getForHttp("itwinjs-orbitgit"); }
     async readContent(_data, _system, _isCanceled) { return {}; }
     freeMemory() { }
     constructor(params, tree) { super(params, tree); }
@@ -153638,7 +153659,7 @@ class TileSortProjector {
         coordinate.z = point.z;
     }
 }
-class OrbitGtTileGraphic extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileUsageMarker {
+class OrbitGtTileGraphic extends _tile_internal__WEBPACK_IMPORTED_MODULE_10__.TileUsageMarker {
     graphic;
     constructor(graphic, viewport, time) {
         super();
@@ -153649,7 +153670,7 @@ class OrbitGtTileGraphic extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.Til
         this.graphic[Symbol.dispose]();
     }
 }
-class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTree {
+class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_10__.TileTree {
     _dataManager;
     _centerOffset;
     _ecefTransform;
@@ -153665,7 +153686,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
         this._dataManager = _dataManager;
         this._centerOffset = _centerOffset;
         this._ecefTransform = _ecefTransform;
-        this._layerHandler = new _tile_internal__WEBPACK_IMPORTED_MODULE_9__.LayerTileTreeHandler(this);
+        this._layerHandler = new _tile_internal__WEBPACK_IMPORTED_MODULE_10__.LayerTileTreeHandler(this);
         this._tileParams = { contentId: "0", range: cloudRange, maximumSize: 256 };
         this.rootTile = new OrbitGtRootTile(this._tileParams, this);
     }
@@ -153714,7 +153735,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
         let totalPointCount = 0;
         const tileCount = frameData.tilesToRender.size();
         // Inform TileAdmin about tiles we are handling ourselves...
-        _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.tileAdmin.addExternalTilesForUser(args.context.viewport, { requested: frameData.tilesToLoad.size() + (frameData.hasMissingData() ? 1 : 0), selected: tileCount, ready: tileCount });
+        _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.tileAdmin.addExternalTilesForUser(args.context.viewport, { requested: frameData.tilesToLoad.size() + (frameData.hasMissingData() ? 1 : 0), selected: tileCount, ready: tileCount });
         if (debugBuilder)
             debugBuilder.setSymbology(_itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.ColorDef.red, _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.ColorDef.red, 1);
         let minLevel = 100, maxLevel = -100;
@@ -153735,8 +153756,8 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
                 range.high.addInPlace(this._centerOffset);
                 const qParams = _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.QParams3d.fromRange(range, undefined, (tile.points8 != null) ? _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Quantization.rangeScale8 : _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Quantization.rangeScale16);
                 const featureTable = new _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.FeatureTable(1, this.modelId, _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.BatchType.Primary);
-                const features = new _common_internal_render_MeshPrimitives__WEBPACK_IMPORTED_MODULE_8__.Mesh.Features(featureTable);
-                const system = _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.renderSystem;
+                const features = new _common_internal_render_MeshPrimitives__WEBPACK_IMPORTED_MODULE_9__.Mesh.Features(featureTable);
+                const system = _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.renderSystem;
                 const voxelSize = (range.high.x - range.low.x) / 64;
                 features.add(new _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Feature(this.modelId), 1);
                 const tilePoints = (tile.points8 != null) ? tile.points8.toNativeBuffer() : tile.points16.toNativeBuffer();
@@ -153763,8 +153784,34 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
         }
         args.drawGraphics();
         if (frameData.hasMissingData()) {
-            this._dataManager.loadData(frameData).then(() => _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.tileAdmin.onTileLoad.raiseEvent(this.rootTile)).catch((_err) => undefined);
+            this._dataManager.loadData(frameData).then(() => _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.tileAdmin.onTileLoad.raiseEvent(this.rootTile)).catch((_err) => undefined);
+        }
+    }
+}
+/** Computes the vertical shift, in meters along geodetic up, to correctly place a point cloud whose CRS does not
+ * define a vertical datum, assuming its heights are orthometric (relative to the geoid).
+ *
+ * The shift is the difference between converting the point cloud's origin with its height treated as orthometric
+ * versus ellipsoidal (`heightAsEllipsoidalDbZ`, already computed by the caller). Returns zero if the shift cannot
+ * be computed or the iModel's converter makes no distinction between the two.
+ * Exported strictly for tests.
+ * @internal
+ */
+async function computeOrthometricVerticalShift(geoOrigin, heightAsEllipsoidalDbZ, iModel) {
+    const geoidConverter = iModel.noGcsDefined ? undefined : iModel.geoServices.getConverter({ horizontalCRS: { epsg: 4326 }, verticalCRS: { id: "GEOID" } });
+    if (undefined === geoidConverter)
+        return 0;
+    try {
+        const response = await geoidConverter.getIModelCoordinatesFromGeoCoordinates([geoOrigin]);
+        if (response.iModelCoords[0].s !== _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.GeoCoordStatus.Success) {
+            _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logWarning(_common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_5__.FrontendLoggerCategory.RealityData, `Failed to compute orthometric height correction for point cloud (status ${response.iModelCoords[0].s}); heights will be treated as ellipsoidal`);
+            return 0;
         }
+        return _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Point3d.fromJSON(response.iModelCoords[0].p).z - heightAsEllipsoidalDbZ;
+    }
+    catch (err) {
+        _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logError(_common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_5__.FrontendLoggerCategory.RealityData, err);
+        return 0;
     }
 }
 (function (OrbitGtTileTree) {
@@ -153790,7 +153837,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
         return isValidSASToken(props.sasToken);
     }
     async function createOrbitGtTileTree(rdSourceKey, iModel, modelId) {
-        const rdSource = await _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__.RealityDataSource.fromKey(rdSourceKey, iModel.iTwinId);
+        const rdSource = await _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__.RealityDataSource.fromKey(rdSourceKey, iModel.iTwinId);
         const isContextShare = rdSourceKey.provider === _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataProvider.ContextShare;
         const isTilestUrl = rdSourceKey.provider === _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataProvider.TilesetUrl;
         let blobStringUrl;
@@ -153801,7 +153848,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
             const docRootName = realityData.rootDocument;
             if (!docRootName)
                 return undefined;
-            const token = await _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.getAccessToken();
+            const token = await _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.getAccessToken();
             const blobUrl = await realityData.getBlobUrl(token, docRootName);
             blobStringUrl = blobUrl.toString();
         }
@@ -153809,7 +153856,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
             blobStringUrl = rdSourceKey.id;
         }
         else {
-            const orbitGtBlobProps = _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__.RealityDataSource.createOrbitGtBlobPropsFromKey(rdSourceKey);
+            const orbitGtBlobProps = _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__.RealityDataSource.createOrbitGtBlobPropsFromKey(rdSourceKey);
             if (orbitGtBlobProps === undefined)
                 return undefined;
             if (!isValidOrbitGtBlobProps(orbitGtBlobProps))
@@ -153844,7 +153891,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
             const wgs84CRS = "4978";
             await _itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.CRSManager.ENGINE.prepareForArea(wgs84CRS, new _itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.OrbitGtBounds());
             const pointCloudToEcef = transformFromOrbitGt(_itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.CRSManager.createTransform(pointCloudCRS, new _itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.OrbitGtCoordinate(pointCloudCenter.x, pointCloudCenter.y, pointCloudCenter.z), wgs84CRS));
-            const pointCloudCenterToEcef = pointCloudToEcef.multiplyTransformTransform(addCloudCenter);
+            let pointCloudCenterToEcef = pointCloudToEcef.multiplyTransformTransform(addCloudCenter);
             ecefTransform.setFrom(pointCloudCenterToEcef);
             let ecefToDb = iModel.getMapEcefToDb(0);
             // In initial publishing version the iModel ecef Transform was used to locate the reality model.
@@ -153864,7 +153911,21 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
                     const geoOrigin = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Point3d.create(cartographicOrigin.longitudeDegrees, cartographicOrigin.latitudeDegrees, cartographicOrigin.height);
                     const response = await geoConverter.getIModelCoordinatesFromGeoCoordinates([geoOrigin]);
                     if (response.iModelCoords[0].s === _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.GeoCoordStatus.Success) {
-                        const ecefToDbOrigin = await (0,_BackgroundMapGeometry__WEBPACK_IMPORTED_MODULE_4__.calculateEcefToDbTransformAtLocation)(_itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Point3d.fromJSON(response.iModelCoords[0].p), iModel);
+                        const dbOriginFromGcs = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Point3d.fromJSON(response.iModelCoords[0].p);
+                        // A projected CRS defines no vertical datum, so the point cloud's heights are conventionally orthometric -
+                        // but pointCloudToEcef above treated them as ellipsoidal. Correct the placement by the difference.
+                        // (A compound CRS also takes this path; that stays correct unless orbitgt gains a geoid model.)
+                        if (_itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.CRSManager.ENGINE.isProjectedCRS(pointCloudCRS)) {
+                            const verticalShift = await computeOrthometricVerticalShift(geoOrigin, dbOriginFromGcs.z, iModel);
+                            if (0 !== verticalShift) {
+                                const upVector = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Vector3d.createStartEnd(cartographicOrigin.toEcef(), _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Cartographic.fromRadians({ longitude: cartographicOrigin.longitude, latitude: cartographicOrigin.latitude, height: cartographicOrigin.height + 1 }).toEcef()).normalize();
+                                if (undefined !== upVector) {
+                                    pointCloudCenterToEcef = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Transform.createTranslation(upVector.scale(verticalShift)).multiplyTransformTransform(pointCloudCenterToEcef);
+                                    ecefTransform.setFrom(pointCloudCenterToEcef);
+                                }
+                            }
+                        }
+                        const ecefToDbOrigin = await (0,_BackgroundMapGeometry__WEBPACK_IMPORTED_MODULE_4__.calculateEcefToDbTransformAtLocation)(dbOriginFromGcs, iModel);
                         if (ecefToDbOrigin)
                             ecefToDb = ecefToDbOrigin;
                     }
@@ -153884,7 +153945,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
 /** Supplies a reality data [[TileTree]] from a URL. May be associated with a persistent [[GeometricModelState]], or attached at run-time via a [[ContextOrbitGtState]].
  * Exported strictly for tests.
  */
-class OrbitGtTreeReference extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.RealityModelTileTree.Reference {
+class OrbitGtTreeReference extends _tile_internal__WEBPACK_IMPORTED_MODULE_10__.RealityModelTileTree.Reference {
     treeOwner;
     _rdSourceKey;
     _modelId;
@@ -153897,15 +153958,15 @@ class OrbitGtTreeReference extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.R
             this._rdSourceKey = props.rdSourceKey;
         }
         else if (props.orbitGtBlob) {
-            this._rdSourceKey = _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__.RealityDataSource.createKeyFromOrbitGtBlobProps(props.orbitGtBlob);
+            this._rdSourceKey = _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__.RealityDataSource.createKeyFromOrbitGtBlobProps(props.orbitGtBlob);
         }
         else {
             // TODO: Maybe we should throw an exception
-            this._rdSourceKey = _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__.RealityDataSource.createKeyFromBlobUrl("", _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataProvider.OrbitGtBlob, _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataFormat.OPC);
+            this._rdSourceKey = _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__.RealityDataSource.createKeyFromBlobUrl("", _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataProvider.OrbitGtBlob, _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataFormat.OPC);
         }
         // ###TODO find compatible model Id
         let modelId = props.modelId;
-        if (undefined === modelId && this._source instanceof _DisplayStyleState__WEBPACK_IMPORTED_MODULE_5__.DisplayStyleState)
+        if (undefined === modelId && this._source instanceof _DisplayStyleState__WEBPACK_IMPORTED_MODULE_6__.DisplayStyleState)
             modelId = orbitGtTreeSupplier.findCompatibleContextRealityModelId(this._rdSourceKey, this._source);
         this._modelId = modelId ?? props.iModel.transientIds.getNext();
         const ogtTreeId = { rdSourceKey: this._rdSourceKey, modelId: this.modelId };
@@ -153920,11 +153981,15 @@ class OrbitGtTreeReference extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.R
         if (undefined === tree || hit.iModel !== tree.iModel)
             return undefined;
         const strings = [];
-        strings.push(_IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.localization.getLocalizedString("iModelJs:RealityModelTypes.OrbitGTPointCloud"));
+        strings.push(_IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.localization.getLocalizedString("iModelJs:RealityModelTypes.OrbitGTPointCloud"));
         if (this._name)
-            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.localization.getLocalizedString("iModelJs:TooltipInfo.Name")} ${this._name}`);
+            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.localization.getLocalizedString("iModelJs:TooltipInfo.Name")} ${this._name}`);
         const div = document.createElement("div");
-        div.innerHTML = strings.join("<br>");
+        strings.forEach((str, index) => {
+            if (index > 0)
+                div.appendChild(document.createElement("br"));
+            div.appendChild(document.createTextNode(str));
+        });
         return div;
     }
 }
@@ -155688,7 +155753,11 @@ class RealityTreeReference extends RealityModelTileTree.Reference {
                 if (-1 === key.indexOf("#")) // Avoid internal cesium
                     strings.push(`${key}: ${JSON.stringify(batch[key])}`);
         const div = document.createElement("div");
-        div.innerHTML = strings.join("<br>");
+        strings.forEach((str, index) => {
+            if (index > 0)
+                div.appendChild(document.createElement("br"));
+            div.appendChild(document.createTextNode(str));
+        });
         return div;
     }
     /** @deprecated in 5.0 - might be removed in next major version. Use [addAttributions] instead. */
@@ -156876,7 +156945,21 @@ class ArcGisUtilities {
     */
     static async validateSource(args) {
         const { source, ignoreCache, capabilitiesFilter } = args;
-        const metadata = await this.getServiceJson({ url: source.url, formatId: source.formatId, userName: source.userName, password: source.password, queryParams: source.collectQueryParams(), ignoreCache });
+        let metadata;
+        try {
+            metadata = await this.getServiceJson({ url: source.url, formatId: source.formatId, userName: source.userName, password: source.password, queryParams: source.collectQueryParams(), ignoreCache });
+        }
+        catch (err) {
+            if (err instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerUntrustedOriginError) {
+                let blockedOrigin;
+                try {
+                    blockedOrigin = new URL(err.url).origin;
+                }
+                catch { /* non-hierarchical URL */ }
+                return { status: _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerSourceStatus.UntrustedOrigin, blockedOrigin };
+            }
+            throw err;
+        }
         const json = metadata?.content;
         if (json === undefined) {
             return { status: _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerSourceStatus.InvalidUrl };
@@ -156939,6 +157022,9 @@ class ArcGisUtilities {
      * @param password Password to use for legacy token based security
      * @param ignoreCache Flag to skip cache lookup (i.e. force a new server request)
      * @param requireToken Flag to indicate if a token is required
+     * @throws [[MapLayerUntrustedOriginError]] if an NTLM/Negotiate challenge could not be answered because
+     * the URL's origin is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]);
+     * all other errors are caught and reported by returning `undefined`.
      */
     static async getServiceJson(args) {
         const { url, formatId, userName, password, queryParams, ignoreCache, requireToken } = args;
@@ -156974,8 +157060,17 @@ class ArcGisUtilities {
             }
             let response = await fetch(tmpUrl, { method: "GET" });
             if (response.status === 401 && !requireToken && (0,_request_utils__WEBPACK_IMPORTED_MODULE_3__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
-                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-                response = await fetch(tmpUrl, { method: "GET", credentials: "include" });
+                // fetch follows redirects transparently, so trust decisions target the final (post-redirect) URL.
+                const challengedUrl = response.url || tmpUrl.toString();
+                if (!_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.mapLayerFormatRegistry.isSsoAllowed(challengedUrl))
+                    throw new _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerUntrustedOriginError(challengedUrl);
+                _IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(challengedUrl);
+                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication).
+                response = await fetch(challengedUrl, {
+                    method: "GET",
+                    credentials: "include",
+                    redirect: _IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined,
+                });
             }
             // Append security token when corresponding error code is returned by ArcGIS service
             let errorCode = await ArcGisUtilities.checkForResponseErrorCode(response);
@@ -156997,8 +157092,10 @@ class ArcGisUtilities {
             ArcGisUtilities._serviceCache.set(url, (errorCode === undefined ? info : undefined));
             return info; // Always return json, even though it contains an error code.
         }
-        catch {
+        catch (err) {
             ArcGisUtilities._serviceCache.set(url, undefined);
+            if (err instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerUntrustedOriginError)
+                throw err; // propagate so callers can report the blocked origin
             return undefined;
         }
     }
@@ -157160,7 +157257,9 @@ class ArcGISImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODULE_0__.
         try {
             metadata = await _tile_internal__WEBPACK_IMPORTED_MODULE_0__.ArcGisUtilities.getServiceJson({ url: this._settings.url, formatId: this._settings.formatId, userName: this._settings.userName, password: this._settings.password, queryParams: this._settings.collectQueryParams() });
         }
-        catch {
+        catch (err) {
+            if (err instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerUntrustedOriginError)
+                this.reportBlockedOrigin(err.url);
         }
         if (metadata && metadata.accessTokenRequired) {
             const accessClient = _IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.mapLayerFormatRegistry.getAccessClient(this._settings.formatId);
@@ -157208,12 +157307,32 @@ class ArcGISImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODULE_0__.
             await this._firstRequestPromise;
         let response;
         try {
-            response = await fetch(urlObj, { ...options, credentials: this._includeUserCredentials ? "include" : undefined });
+            const requestUrl = urlObj.toString();
+            const includeCredentials = this.includeUserCredentials(requestUrl);
+            response = await fetch(urlObj, {
+                ...options,
+                credentials: includeCredentials ? "include" : undefined,
+                redirect: includeCredentials ? this.credentialedRedirect : options?.redirect,
+            });
+            if (includeCredentials)
+                this.checkCredentialedRedirect(requestUrl, response);
             if (response.status === 401 && !this._lastAccessToken && (0,_request_utils__WEBPACK_IMPORTED_MODULE_3__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
-                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-                response = await fetch(urlObj, { ...options, credentials: "include" });
-                if (response.status === 200) {
-                    this._includeUserCredentials = true; // avoid going through 401 challenges over and over
+                // fetch follows redirects transparently, so trust decisions target the final (post-redirect) URL.
+                const challengedUrl = response.url || requestUrl;
+                if (this.isSsoAllowed(challengedUrl)) {
+                    // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication).
+                    this.logUntrustedOriginUse(challengedUrl);
+                    response = await fetch(challengedUrl, {
+                        ...options,
+                        credentials: "include",
+                        redirect: _IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined,
+                    });
+                    if (response.status === 200) {
+                        this.recordSsoSucceeded(challengedUrl); // avoid going through 401 challenges over and over for this origin
+                    }
+                }
+                else {
+                    this.reportBlockedOrigin(challengedUrl);
                 }
             }
             if ((this._lastAccessToken && response.status === 400)
@@ -157426,8 +157545,12 @@ class ArcGISMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MOD
     }
     async initialize() {
         const metadata = await this.getServiceJson();
-        if (metadata?.content === undefined)
+        if (metadata?.content === undefined) {
+            // By returning (i.e., not throwing), we ensure the tile tree gets created and the current provider is preserved to report status.
+            if (this.status === _tile_internal__WEBPACK_IMPORTED_MODULE_2__.MapLayerImageryProviderStatus.UntrustedOrigin)
+                return;
             throw new _itwin_core_common__WEBPACK_IMPORTED_MODULE_0__.ServerError(_itwin_core_bentley__WEBPACK_IMPORTED_MODULE_5__.IModelStatus.ValidationFailed, "");
+        }
         const json = metadata.content;
         if (json?.error?.code === _tile_internal__WEBPACK_IMPORTED_MODULE_2__.ArcGisErrorCode.TokenRequired
             || json?.error?.code === _tile_internal__WEBPACK_IMPORTED_MODULE_2__.ArcGisErrorCode.InvalidToken
@@ -157512,7 +157635,7 @@ class ArcGISMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MOD
     addLogoCards(cards) {
         if (!cards.dataset.arcGisLogoCard) {
             cards.dataset.arcGisLogoCard = "true";
-            cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.makeLogoCard({ heading: "ArcGIS", notice: this._copyrightText }));
+            cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.makeLogoCard({ heading: "ArcGIS", noticeLines: [this._copyrightText] }));
         }
     }
     async addAttributions(cards, _vp) {
@@ -157553,7 +157676,7 @@ class ArcGISMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MOD
         if (json && Array.isArray(json.results)) {
             for (const result of json.results) {
                 if (result.attributes !== undefined && result.attributes[result.displayFieldName] !== undefined) {
-                    const thisString = `${result.displayFieldName}: ${result.attributes[result.displayFieldName]}`;
+                    const thisString = `${(0,_tile_internal__WEBPACK_IMPORTED_MODULE_2__.escapeHtml)(String(result.displayFieldName))}: ${(0,_tile_internal__WEBPACK_IMPORTED_MODULE_2__.escapeHtml)(String(result.attributes[result.displayFieldName]))}`;
                     if (!stringSet.has(thisString)) {
                         strings.push(thisString);
                         stringSet.add(thisString);
@@ -157869,13 +157992,7 @@ class BingMapsImageryLayerProvider extends _tile_internal__WEBPACK_IMPORTED_MODU
         const copyrights = [];
         for (const match of matchingAttributions)
             copyrights.push(match.copyrightMessage);
-        let copyrightMsg = "";
-        for (let i = 0; i < copyrights.length; ++i) {
-            if (i > 0)
-                copyrightMsg += "<br>";
-            copyrightMsg += copyrights[i];
-        }
-        cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.makeLogoCard({ iconSrc: `${_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.publicPath}images/bing.svg`, heading: "Microsoft Bing", notice: copyrightMsg }));
+        cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.makeLogoCard({ iconSrc: `${_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.publicPath}images/bing.svg`, heading: "Microsoft Bing", noticeLines: copyrights }));
     }
     async addAttributions(cards, vp) {
         // eslint-disable-next-line @typescript-eslint/no-deprecated
@@ -158484,7 +158601,10 @@ class WmsMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODULE
             // Don't throw error if unauthorized status:
             // We want the tile tree to be created, so that end-user can get feedback on which layer is missing credentials.
             // When credentials will be provided, a new provider will be created, and initialization should be fine.
-            if (error?.status === 401) {
+            if (error instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerUntrustedOriginError) {
+                this.reportBlockedOrigin(error.url);
+            }
+            else if (error?.status === 401) {
                 this.setStatus(_tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerImageryProviderStatus.RequireAuth);
             }
             else {
@@ -158646,7 +158766,8 @@ class WmtsMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODUL
     }
     async initialize() {
         try {
-            this._capabilities = await _tile_internal__WEBPACK_IMPORTED_MODULE_2__.WmtsCapabilities.create(this._baseUrl);
+            const credentials = (this._settings.userName && this._settings.password ? { user: this._settings.userName, password: this._settings.password } : undefined);
+            this._capabilities = await _tile_internal__WEBPACK_IMPORTED_MODULE_2__.WmtsCapabilities.create(this._baseUrl, credentials);
             this.initPreferredTileMatrixSet();
             this.initPreferredStyle();
             this.initDisplayedLayer();
@@ -158659,7 +158780,10 @@ class WmtsMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODUL
             // Don't throw error if unauthorized status:
             // We want the tile tree to be created, so that end-user can get feedback on which layer is missing credentials.
             // When credentials will be provided, a new provider will be created, and initialization should be fine.
-            if (error?.status === 401) {
+            if (error instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_2__.MapLayerUntrustedOriginError) {
+                this.reportBlockedOrigin(error.url);
+            }
+            else if (error?.status === 401) {
                 this.setStatus(_tile_internal__WEBPACK_IMPORTED_MODULE_2__.MapLayerImageryProviderStatus.RequireAuth);
             }
             else {
@@ -159470,14 +159594,18 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   WmsUtilities: () => (/* binding */ WmsUtilities)
 /* harmony export */ });
-/* harmony import */ var _request_Request__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ../../../request/Request */ "../../core/frontend/lib/esm/request/Request.js");
-/* harmony import */ var _request_utils__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../../request/utils */ "../../core/frontend/lib/esm/request/utils.js");
+/* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ../../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
+/* harmony import */ var _request_Request__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../../request/Request */ "../../core/frontend/lib/esm/request/Request.js");
+/* harmony import */ var _request_utils__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(/*! ../../../request/utils */ "../../core/frontend/lib/esm/request/utils.js");
+/* harmony import */ var _tile_internal__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(/*! ../../../tile/internal */ "../../core/frontend/lib/esm/tile/internal.js");
 /*---------------------------------------------------------------------------------------------
 * Copyright (c) Bentley Systems, Incorporated. All rights reserved.
 * See LICENSE.md in the project root for license terms and full copyright notice.
 *--------------------------------------------------------------------------------------------*/
 
 
+
+
 /** @packageDocumentation
  * @module Tiles
  */
@@ -159494,16 +159622,35 @@ class WmsUtilities {
     static async fetchXml(url, credentials) {
         let headers;
         if (credentials && credentials.user && credentials.password) {
-            headers = new Headers();
-            (0,_request_utils__WEBPACK_IMPORTED_MODULE_1__.setBasicAuthorization)(headers, credentials);
+            // Basic credentials are considered settings-derived credentials for this source. When the registry is
+            // enforcing trusted origins, the source URL itself is the only implicitly trusted origin for basic auth;
+            // opaque/custom-protocol URLs have no network origin and must therefore be treated as untrusted.
+            const allowBasicAuth = !_IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins
+                || _IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.isCredentialsSharingAllowed(url, url);
+            if (allowBasicAuth) {
+                headers = new Headers();
+                (0,_request_utils__WEBPACK_IMPORTED_MODULE_2__.setBasicAuthorization)(headers, credentials);
+            }
         }
         let response = await fetch(url, { method: "GET", headers });
-        if (!credentials && response.status === 401 && (0,_request_utils__WEBPACK_IMPORTED_MODULE_1__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
-            // We got a http 401 challenge, lets try SSO (i.e. Windows Authentication)
-            response = await fetch(url, { method: "GET", credentials: "include" });
+        if (!headers && credentials && credentials.user && credentials.password && (response.status === 401 || response.status === 403)) {
+            throw new _tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerUntrustedOriginError(url);
+        }
+        if (!credentials && response.status === 401 && (0,_request_utils__WEBPACK_IMPORTED_MODULE_2__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
+            // fetch follows redirects transparently, so trust decisions target the final (post-redirect) URL.
+            const challengedUrl = response.url || url;
+            if (!_IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.isSsoAllowed(challengedUrl))
+                throw new _tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerUntrustedOriginError(challengedUrl);
+            _IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(challengedUrl);
+            // We got a http 401 challenge, lets try SSO (i.e. Windows Authentication).
+            response = await fetch(challengedUrl, {
+                method: "GET",
+                credentials: "include",
+                redirect: _IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined,
+            });
         }
         if (response.status !== 200)
-            throw new _request_Request__WEBPACK_IMPORTED_MODULE_0__.HttpResponseError(response.status, await response.text());
+            throw new _request_Request__WEBPACK_IMPORTED_MODULE_1__.HttpResponseError(response.status, await response.text());
         return response.text();
     }
 }
@@ -171917,6 +172064,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   MapLayerSourceStatus: () => (/* reexport safe */ _map_MapLayerSources__WEBPACK_IMPORTED_MODULE_86__.MapLayerSourceStatus),
 /* harmony export */   MapLayerSources: () => (/* reexport safe */ _map_MapLayerSources__WEBPACK_IMPORTED_MODULE_86__.MapLayerSources),
 /* harmony export */   MapLayerTileTreeReference: () => (/* reexport safe */ _map_MapLayerTileTreeReference__WEBPACK_IMPORTED_MODULE_64__.MapLayerTileTreeReference),
+/* harmony export */   MapLayerUntrustedOriginError: () => (/* reexport safe */ _map_MapLayerFormatRegistry__WEBPACK_IMPORTED_MODULE_42__.MapLayerUntrustedOriginError),
 /* harmony export */   MapTile: () => (/* reexport safe */ _map_MapTile__WEBPACK_IMPORTED_MODULE_70__.MapTile),
 /* harmony export */   MapTileLoader: () => (/* reexport safe */ _internal_tile_map_MapTileLoader__WEBPACK_IMPORTED_MODULE_72__.MapTileLoader),
 /* harmony export */   MapTileProjection: () => (/* reexport safe */ _map_MapTile__WEBPACK_IMPORTED_MODULE_70__.MapTileProjection),
@@ -171996,6 +172144,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   collectMaskRefs: () => (/* reexport safe */ _internal_tile_PrimaryTileTree__WEBPACK_IMPORTED_MODULE_82__.collectMaskRefs),
 /* harmony export */   compareMapLayer: () => (/* reexport safe */ _internal_render_webgl_MapLayerParams__WEBPACK_IMPORTED_MODULE_94__.compareMapLayer),
 /* harmony export */   computeCesiumTokenTimeoutInterval: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.computeCesiumTokenTimeoutInterval),
+/* harmony export */   computeOrthometricVerticalShift: () => (/* reexport safe */ _internal_tile_OrbitGtTileTree__WEBPACK_IMPORTED_MODULE_84__.computeOrthometricVerticalShift),
 /* harmony export */   createClassifierTileTreeReference: () => (/* reexport safe */ _internal_tile_ClassifierTileTree__WEBPACK_IMPORTED_MODULE_83__.createClassifierTileTreeReference),
 /* harmony export */   createDefaultViewFlagOverrides: () => (/* reexport safe */ _internal_tile_ViewFlagOverrides__WEBPACK_IMPORTED_MODULE_0__.createDefaultViewFlagOverrides),
 /* harmony export */   createGraphicFromDescription: () => (/* reexport safe */ _internal_tile_ImdlGraphicsCreator__WEBPACK_IMPORTED_MODULE_37__.createGraphicFromDescription),
@@ -172012,6 +172161,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   decodeMeshoptBuffer: () => (/* reexport safe */ _internal_tile_MeshoptCompression__WEBPACK_IMPORTED_MODULE_93__.decodeMeshoptBuffer),
 /* harmony export */   deflateCoordinates: () => (/* reexport safe */ _internal_tile_map_ImageryProviders_CoordinatesUtils__WEBPACK_IMPORTED_MODULE_47__.deflateCoordinates),
 /* harmony export */   disposeTileTreesForGeometricModels: () => (/* reexport safe */ _internal_tile_PrimaryTileTree__WEBPACK_IMPORTED_MODULE_82__.disposeTileTreesForGeometricModels),
+/* harmony export */   escapeHtml: () => (/* reexport safe */ _map_MapLayerImageryProvider__WEBPACK_IMPORTED_MODULE_49__.escapeHtml),
 /* harmony export */   getCesiumAccessClient: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.getCesiumAccessClient),
 /* harmony export */   getCesiumAccessTokenAndEndpointUrl: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.getCesiumAccessTokenAndEndpointUrl),
 /* harmony export */   getCesiumAssetUrl: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.getCesiumAssetUrl),
@@ -172031,7 +172181,8 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   readImdlContent: () => (/* reexport safe */ _ImdlReader__WEBPACK_IMPORTED_MODULE_35__.readImdlContent),
 /* harmony export */   readPntsColors: () => (/* reexport safe */ _internal_tile_PntsReader__WEBPACK_IMPORTED_MODULE_76__.readPntsColors),
 /* harmony export */   readPointCloudTileContent: () => (/* reexport safe */ _internal_tile_PntsReader__WEBPACK_IMPORTED_MODULE_76__.readPointCloudTileContent),
-/* harmony export */   tileTreeReferenceFromRenderGraphic: () => (/* reexport safe */ _RenderGraphicTileTree__WEBPACK_IMPORTED_MODULE_78__.tileTreeReferenceFromRenderGraphic)
+/* harmony export */   tileTreeReferenceFromRenderGraphic: () => (/* reexport safe */ _RenderGraphicTileTree__WEBPACK_IMPORTED_MODULE_78__.tileTreeReferenceFromRenderGraphic),
+/* harmony export */   tryGetOrigin: () => (/* reexport safe */ _map_MapLayerImageryProvider__WEBPACK_IMPORTED_MODULE_49__.tryGetOrigin)
 /* harmony export */ });
 /* harmony import */ var _internal_tile_ViewFlagOverrides__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ../internal/tile/ViewFlagOverrides */ "../../core/frontend/lib/esm/internal/tile/ViewFlagOverrides.js");
 /* harmony import */ var _map_MapCartoRectangle__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ./map/MapCartoRectangle */ "../../core/frontend/lib/esm/tile/map/MapCartoRectangle.js");
@@ -173730,7 +173881,8 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   MapLayerFormat: () => (/* binding */ MapLayerFormat),
-/* harmony export */   MapLayerFormatRegistry: () => (/* binding */ MapLayerFormatRegistry)
+/* harmony export */   MapLayerFormatRegistry: () => (/* binding */ MapLayerFormatRegistry),
+/* harmony export */   MapLayerUntrustedOriginError: () => (/* binding */ MapLayerUntrustedOriginError)
 /* harmony export */ });
 /* harmony import */ var _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @itwin/core-bentley */ "../../core/bentley/lib/esm/core-bentley.js");
 /* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
@@ -173745,7 +173897,7 @@ __webpack_require__.r(__webpack_exports__);
 
 
 
-const loggerCategory = "ArcGISFeatureProvider";
+const loggerCategory = "MapLayerFormatRegistry";
 /**
  * Class representing a map-layer format.
  * Each format has it's unique 'formatId' string, used to uniquely identify a format in the [[MapLayerFormatRegistry]].
@@ -173794,16 +173946,127 @@ class MapLayerFormat {
         return undefined;
     }
 }
+/** Error thrown when an NTLM or Negotiate http 401 challenge could not be answered because the request
+ * URL's origin is not listed in [[MapLayerFormatRegistry.trustedCredentialsOrigins]]
+ * (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+ * Thrown by the static map-layer utilities (e.g. capabilities / service-metadata fetches) that have no
+ * provider instance on which to report the blocked origin; callers convert it to
+ * [[MapLayerImageryProviderStatus.UntrustedOrigin]] (provider initialization) or
+ * [[MapLayerSourceStatus.UntrustedOrigin]] (source validation).
+ * @internal
+ */
+class MapLayerUntrustedOriginError extends Error {
+    /** The URL of the request whose authentication challenge was left unanswered. */
+    url;
+    constructor(url) {
+        super(`Authentication blocked: origin of '${url}' is not listed in MapLayerFormatRegistry.trustedCredentialsOrigins`);
+        this.url = url;
+    }
+}
 /**
  * A registry of MapLayerFormats identified by their unique format IDs. The registry can be accessed via [[IModelApp.mapLayerFormatRegistry]].
  * @public
  */
 class MapLayerFormatRegistry {
     _configOptions;
+    _trustedCredentialsOrigins = [];
+    /** Opt-in enforcement of origin restrictions on map-layer credentials.
+     * When enabled, map layer providers:
+     * - attach the basic-auth credentials stored in the layer settings only to requests targeting the origin
+     *   of the layer's settings URL or an origin listed in [[trustedCredentialsOrigins]];
+     * - retry a request with browser credentials included (i.e. SSO / Windows Authentication) after an NTLM
+     *   or Negotiate http 401 challenge only for origins explicitly listed in [[trustedCredentialsOrigins]]
+     *   (the settings-URL origin is NOT implicitly trusted for SSO, since map-layer URLs may originate from
+     *   untrusted user input while SSO shares the user's ambient identity).
+     * Default is false, preserving the legacy behavior of sending credentials to any request URL.
+     * @beta
+     */
+    restrictCredentialsToTrustedOrigins = false;
     constructor(opts) {
         this._configOptions = opts ?? {};
         _internal__WEBPACK_IMPORTED_MODULE_2__.internalMapLayerImageryFormats.forEach((format) => this.register(format));
     }
+    /** Origins (e.g. "https://tiles.example.com") to which map layer providers may send credentials —
+     * both the basic-auth credentials stored in the layer settings and browser credentials for
+     * SSO (i.e. Windows Authentication) retries after an NTLM or Negotiate http 401 challenge.
+     * Only enforced when [[restrictCredentialsToTrustedOrigins]] is enabled.
+     * For basic-auth, the origin of each map layer's settings URL is always implicitly trusted; for SSO,
+     * origins must be explicitly listed here.
+     * Entries are normalized to their origin (scheme + host + port); only `http:` and `https:` URLs are accepted,
+     * and any other entry is ignored and logged. Opaque schemes such as `file:`, `data:`, `about:` and custom
+     * Electron protocols are rejected because they all share the same serialized origin, so trusting one would
+     * trust every other.
+     * @beta
+     */
+    get trustedCredentialsOrigins() {
+        return this._trustedCredentialsOrigins;
+    }
+    set trustedCredentialsOrigins(origins) {
+        const normalized = [];
+        for (const entry of origins) {
+            const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(entry);
+            if (origin !== undefined)
+                normalized.push(origin);
+            else
+                _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logWarning(loggerCategory, `trustedCredentialsOrigins: ignoring '${entry}'; entries must be http or https URLs.`);
+        }
+        this._trustedCredentialsOrigins = normalized;
+    }
+    /** Returns true if a request to the given URL may be retried with browser credentials included
+     * (i.e. SSO / Windows Authentication) after an NTLM or Negotiate http 401 challenge.
+     * Always true unless [[restrictCredentialsToTrustedOrigins]] is enabled (opt-in).
+     * When enabled, the URL's origin must be explicitly listed in [[trustedCredentialsOrigins]];
+     * unlike basic-auth, the settings-URL origin is NOT implicitly trusted because SSO shares the user's
+     * ambient identity, and map-layer URLs may originate from untrusted user input.
+     * @internal
+     */
+    isSsoAllowed(url) {
+        if (!this.restrictCredentialsToTrustedOrigins)
+            return true;
+        const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(url);
+        // Entries are normalized to their origin by the [[trustedCredentialsOrigins]] setter.
+        return origin !== undefined && this._trustedCredentialsOrigins.includes(origin);
+    }
+    /** Returns true if the basic-auth credentials belonging to a map-layer source or settings URL may be
+     * attached to a request to the given URL. Always true unless [[restrictCredentialsToTrustedOrigins]]
+     * is enabled (opt-in). When enabled, the origin of `settingsUrl` is implicitly trusted (the credentials
+     * belong to that server); any other origin must be listed in [[trustedCredentialsOrigins]].
+     * @internal
+     */
+    isCredentialsSharingAllowed(url, settingsUrl) {
+        if (!this.restrictCredentialsToTrustedOrigins)
+            return true;
+        const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(url);
+        if (origin === undefined)
+            return false;
+        if (origin === (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(settingsUrl))
+            return true;
+        // Entries are normalized to their origin by the [[trustedCredentialsOrigins]] setter.
+        return this._trustedCredentialsOrigins.includes(origin);
+    }
+    /** Origins for which a "credentials sent to untrusted origin" warning was already logged;
+     * used to log the discovery warning only once per origin.
+     */
+    _untrustedUseLogged = new Set();
+    /** Logs a warning (once per origin) when credentials are sent to an origin that would be blocked
+     * if [[restrictCredentialsToTrustedOrigins]] were enabled.
+     * Helps applications discover the origins they need to whitelist before opting in to the restriction.
+     * If `settingsUrl` is supplied, requests sharing its origin are not logged, since that origin is
+     * implicitly trusted for basic-auth.
+     * @internal
+     */
+    logUntrustedOriginUse(url, settingsUrl) {
+        if (this.restrictCredentialsToTrustedOrigins)
+            return; // restriction active; nothing to preview
+        const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(url) ?? url;
+        if (settingsUrl !== undefined && origin === (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(settingsUrl))
+            return; // implicitly trusted for basic-auth
+        if (this._untrustedUseLogged.has(origin) || this._trustedCredentialsOrigins.includes(origin))
+            return;
+        this._untrustedUseLogged.add(origin);
+        _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logWarning(loggerCategory, `Credentials sent to origin '${origin}' which is not in MapLayerFormatRegistry.trustedCredentialsOrigins; `
+            + "this request would be blocked if restrictCredentialsToTrustedOrigins were enabled.");
+    }
     _formats = new Map();
     isRegistered(formatId) { return this._formats.get(formatId) !== undefined; }
     register(formatClass) {
@@ -173969,6 +174232,14 @@ class WmsMapLayerFormat extends ImageryMapLayerFormat {
             return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.Valid, subLayers };
         }
         catch (err) {
+            if (err instanceof _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerUntrustedOriginError) {
+                let blockedOrigin;
+                try {
+                    blockedOrigin = new URL(err.url).origin;
+                }
+                catch { /* non-hierarchical URL */ }
+                return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.UntrustedOrigin, blockedOrigin };
+            }
             let status = _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidUrl;
             if (err?.status === 401) {
                 status = ((userName && password) ? _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidCredentials : _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.RequireAuth);
@@ -174034,6 +174305,14 @@ class WmtsMapLayerFormat extends ImageryMapLayerFormat {
             return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.Valid, subLayers };
         }
         catch (err) {
+            if (err instanceof _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerUntrustedOriginError) {
+                let blockedOrigin;
+                try {
+                    blockedOrigin = new URL(err.url).origin;
+                }
+                catch { /* non-hierarchical URL */ }
+                return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.UntrustedOrigin, blockedOrigin };
+            }
             let status = _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidUrl;
             if (err?.status === 401) {
                 status = ((userName && password) ? _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidCredentials : _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.RequireAuth);
@@ -174098,7 +174377,9 @@ const internalMapLayerImageryFormats = [WmsMapLayerFormat, WmtsMapLayerFormat, A
 __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   MapLayerImageryProvider: () => (/* binding */ MapLayerImageryProvider),
-/* harmony export */   MapLayerImageryProviderStatus: () => (/* binding */ MapLayerImageryProviderStatus)
+/* harmony export */   MapLayerImageryProviderStatus: () => (/* binding */ MapLayerImageryProviderStatus),
+/* harmony export */   escapeHtml: () => (/* binding */ escapeHtml),
+/* harmony export */   tryGetOrigin: () => (/* binding */ tryGetOrigin)
 /* harmony export */ });
 /* harmony import */ var _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @itwin/core-bentley */ "../../core/bentley/lib/esm/core-bentley.js");
 /* harmony import */ var _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! @itwin/core-common */ "../../core/common/lib/esm/core-common.js");
@@ -174125,6 +174406,34 @@ __webpack_require__.r(__webpack_exports__);
 const tileImageSize = 256, untiledImageSize = 256;
 const earthRadius = 6378137;
 const doDebugToolTips = false;
+/** Escapes HTML metacharacters so the text renders literally when assigned to `innerHTML`.
+ * Use for any server- or user-supplied string that ends up in the map tooltip, which is rendered
+ * as HTML by [[MapLayerTileTreeReference.getToolTip]].
+ * @internal
+ */
+function escapeHtml(text) {
+    return text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+/** Returns the origin (scheme + host + port) of the given URL, or undefined if it cannot be parsed or does
+ * not denote a distinct network origin.
+ *
+ * Only `http:` and `https:` URLs yield an origin. Every other scheme is rejected because opaque URLs
+ * — `file:`, `data:`, `about:`, `blob:null`, and the custom protocols Electron hosts commonly register —
+ * all serialize to the literal string `"null"`. Comparing those would make unrelated URLs look same-origin,
+ * so a single trusted entry could unlock all of them. Callers use this for credential-trust decisions, and
+ * returning `undefined` keeps those decisions fail-closed.
+ * @internal
+ */
+function tryGetOrigin(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    return (parsed.protocol === "http:" || parsed.protocol === "https:") ? parsed.origin : undefined;
+}
 /** The status of the map layer imagery provider that lets you know if authentication is needed to request tiles.
  * @public
  */
@@ -174132,6 +174441,12 @@ var MapLayerImageryProviderStatus;
 (function (MapLayerImageryProviderStatus) {
     MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["Valid"] = 0] = "Valid";
     MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["RequireAuth"] = 1] = "RequireAuth";
+    /** A request received an authentication challenge, but credentials were withheld because the request origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * The blocked origins are available via [[MapLayerImageryProvider.blockedOrigins]].
+     * @beta
+     */
+    MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["UntrustedOrigin"] = 2] = "UntrustedOrigin";
 })(MapLayerImageryProviderStatus || (MapLayerImageryProviderStatus = {}));
 /** Abstract class for map layer imagery providers.
  * Map layer imagery providers request and provide tile images and other data. Each map layer from a separate source needs its own imagery provider object.
@@ -174149,7 +174464,41 @@ class MapLayerImageryProvider {
     /** @internal */
     _status = MapLayerImageryProviderStatus.Valid;
     /** @internal */
-    _includeUserCredentials = false;
+    _blockedOrigins = new Set();
+    /** Origins of requests for which credentials were withheld because they are not trusted
+     * (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Populated when [[status]] transitions to [[MapLayerImageryProviderStatus.UntrustedOrigin]];
+     * [[onStatusChanged]] is raised again each time a new origin is added. Cleared by [[resetStatus]].
+     * @beta
+     */
+    get blockedOrigins() { return [...this._blockedOrigins]; }
+    /** Origins for which a previous SSO handshake (i.e. Windows Authentication) succeeded.
+     * Browser credentials are only included for subsequent requests targeting these origins,
+     * so that a successful handshake with one host does not leak credentials to other hosts
+     * this provider may contact.
+     * @internal
+     */
+    _ssoSucceededOrigins = new Set();
+    /** Returns true if browser credentials should be included for the given URL because a previous
+     * SSO handshake succeeded for its origin AND the origin is still allowed by the current policy
+     * (see [[MapLayerFormatRegistry.isSsoAllowed]]). Re-checking the policy ensures a handshake recorded
+     * while enforcement was disabled — or before an origin was removed from
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]] — does not keep latching credentials on.
+     * @internal
+     */
+    includeUserCredentials(url) {
+        const origin = tryGetOrigin(url);
+        return origin !== undefined && this._ssoSucceededOrigins.has(origin) && this.isSsoAllowed(url);
+    }
+    /** Records that an SSO handshake succeeded for the given URL's origin, so subsequent requests
+     * to that origin include browser credentials without going through another 401 challenge.
+     * @internal
+     */
+    recordSsoSucceeded(url) {
+        const origin = tryGetOrigin(url);
+        if (origin !== undefined)
+            this._ssoSucceededOrigins.add(origin);
+    }
     /** @internal */
     onFirstRequestCompleted = new _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.BeEvent();
     /** @internal */
@@ -174165,7 +174514,17 @@ class MapLayerImageryProvider {
      * @public
      */
     get supportsMapFeatureInfo() { return false; }
-    resetStatus() { this.setStatus(MapLayerImageryProviderStatus.Valid); }
+    /** Reset the provider's status to [[MapLayerImageryProviderStatus.Valid]] and clear the list of
+     * [[blockedOrigins]] accumulated while in the [[MapLayerImageryProviderStatus.UntrustedOrigin]] state.
+     * Raises [[onStatusChanged]] if the status actually changes.
+     * Typically called after the user has provided credentials or the application has updated
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]], so that subsequent requests are re-attempted.
+     * @beta
+     */
+    resetStatus() {
+        this._blockedOrigins.clear();
+        this.setStatus(MapLayerImageryProviderStatus.Valid);
+    }
     /** @internal */
     get tileSize() { return this._usesCachedTiles ? tileImageSize : untiledImageSize; }
     /** @internal */
@@ -174339,6 +174698,32 @@ class MapLayerImageryProvider {
             (0,_request_utils__WEBPACK_IMPORTED_MODULE_6__.setBasicAuthorization)(headers, this._settings.userName, this._settings.password);
         }
     }
+    /** Returns true if the given URL has the same origin as this layer's settings URL.
+     * Used to avoid leaking credentials to third-party hosts.
+     * @internal
+     */
+    matchesSettingsUrlOrigin(url) {
+        const origin = tryGetOrigin(url);
+        return origin !== undefined && origin === tryGetOrigin(this._settings.url);
+    }
+    /** Returns true if the basic-auth credentials from the layer settings may be attached to a request to the given URL.
+     * Always true unless [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled (opt-in).
+     * When enabled, the origin of this layer's settings URL is implicitly trusted (the credentials belong to that
+     * server); other origins must be listed in [[MapLayerFormatRegistry.trustedCredentialsOrigins]].
+     * See [[MapLayerFormatRegistry.isCredentialsSharingAllowed]].
+     * @internal
+     */
+    isCredentialsSharingAllowed(url) {
+        return _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.isCredentialsSharingAllowed(url, this._settings.url);
+    }
+    /** Returns true if a request to the given URL may be retried with browser credentials included
+     * (i.e. SSO / Windows Authentication) after an NTLM or Negotiate http 401 challenge.
+     * See [[MapLayerFormatRegistry.isSsoAllowed]].
+     * @internal
+     */
+    isSsoAllowed(url) {
+        return _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.isSsoAllowed(url);
+    }
     /** @internal */
     async makeTileRequest(url, timeoutMs, authorization) {
         // We want to complete the first request before letting other requests go;
@@ -174358,40 +174743,132 @@ class MapLayerImageryProvider {
             throw new Error("fetch call failed");
         return response;
     }
+    /** Records the given URL's origin and transitions the status to [[MapLayerImageryProviderStatus.UntrustedOrigin]].
+     * Called when a request received an authentication challenge that could not be answered because the origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Raises [[onStatusChanged]] on the status transition, and again whenever a new origin is added.
+     * @internal
+     */
+    reportBlockedOrigin(url) {
+        const origin = tryGetOrigin(url) ?? url;
+        const isNewOrigin = !this._blockedOrigins.has(origin);
+        this._blockedOrigins.add(origin);
+        if (this._status !== MapLayerImageryProviderStatus.UntrustedOrigin)
+            this.setStatus(MapLayerImageryProviderStatus.UntrustedOrigin);
+        else if (isNewOrigin)
+            this.onStatusChanged.raiseEvent(this); // status unchanged, but a new origin was blocked
+    }
+    /** Logs a warning (once per origin, app-wide) when credentials are sent to an origin that would be blocked
+     * if [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] were enabled.
+     * Helps applications discover the origins they need to whitelist before opting in to the restriction.
+     * See [[MapLayerFormatRegistry.logUntrustedOriginUse]].
+     * @internal
+     */
+    logUntrustedOriginUse(url) {
+        _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(url);
+    }
+    /** The redirect policy to apply to a request that carries browser credentials (see [[includeUserCredentials]]).
+     *
+     * When [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled, redirects are refused
+     * outright (`"error"`). `fetch` cannot be asked to follow only same-origin redirects, and by the time a
+     * followed redirect can be inspected the credentials have already been delivered to the destination — so
+     * refusing is the only way to honour the guarantee that credentials reach none but the origins listed in
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]]. Legitimate same-origin redirects fail as a result;
+     * that is the cost of the opt-in restriction.
+     *
+     * When the restriction is disabled (the default), redirects are followed as before and
+     * [[checkCredentialedRedirect]] reports the destination after the fact.
+     * @internal
+     */
+    get credentialedRedirect() {
+        return _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined;
+    }
+    /** Detects that a request carrying browser credentials (see [[includeUserCredentials]]) was transparently
+     * redirected to a different origin, and reports or logs that origin.
+     *
+     * This is a **best-effort, after-the-fact** signal used only while
+     * [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is disabled, where credentialed requests
+     * still follow redirects (see [[credentialedRedirect]]). It cannot prevent the exposure — the credentials
+     * have already been sent — and it does not fire at all when the destination denies CORS, because `fetch`
+     * then rejects instead of returning a `Response`. The destination origin is never latched as SSO-succeeded,
+     * so credentials do not keep flowing to it.
+     * @internal
+     */
+    checkCredentialedRedirect(requestedUrl, response) {
+        const finalOrigin = tryGetOrigin(response.url);
+        if (!response.url || finalOrigin === undefined || finalOrigin === tryGetOrigin(requestedUrl))
+            return;
+        if (!this.isSsoAllowed(response.url))
+            this.reportBlockedOrigin(response.url);
+        else
+            this.logUntrustedOriginUse(response.url); // no-op when the restriction is enabled
+    }
     /** @internal */
     async makeRequest(url, timeoutMs, authorization) {
         let response;
         let headers;
         let hasCreds = false;
+        // Whether this request had basic-auth credentials of its own to offer. Requests carrying a caller-supplied
+        // `authorization` are excluded: those bypass the origin policy entirely.
+        const hasSettingsCreds = !authorization && !!this._settings.userName && !!this._settings.password;
         if (authorization) {
             headers = new Headers();
             headers.set("Authorization", authorization);
         }
-        else if (this._settings.userName && this._settings.password) {
-            hasCreds = true;
-            headers = new Headers();
-            this.setRequestAuthorization(headers);
+        else if (hasSettingsCreds) {
+            if (this.isCredentialsSharingAllowed(url)) {
+                hasCreds = true;
+                headers = new Headers();
+                this.setRequestAuthorization(headers);
+                if (!this.matchesSettingsUrlOrigin(url))
+                    this.logUntrustedOriginUse(url);
+            }
         }
+        const includeCredentials = this.includeUserCredentials(url);
         const opts = {
             method: "GET",
             headers,
-            credentials: this._includeUserCredentials ? "include" : undefined,
+            credentials: includeCredentials ? "include" : undefined,
+            redirect: includeCredentials ? this.credentialedRedirect : undefined,
         };
         if (timeoutMs !== undefined)
             (0,_request_utils__WEBPACK_IMPORTED_MODULE_6__.setRequestTimeout)(opts, timeoutMs);
         response = await fetch(url, opts);
+        if (includeCredentials)
+            this.checkCredentialedRedirect(url, response);
+        // fetch follows redirects transparently, so all trust decisions below target the final
+        // (post-redirect) URL reported by the response, not the URL we asked for.
+        const challengedUrl = response.url || url;
         if (response.status === 401
             && (0,_request_utils__WEBPACK_IMPORTED_MODULE_6__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])
-            && !this._includeUserCredentials
+            && !includeCredentials
             && !hasCreds) {
-            // Removed the previous headers and make sure "include" credentials is set
-            opts.headers = undefined;
-            opts.credentials = "include";
-            // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-            response = await fetch(url, opts);
-            if (response.status === 200) {
-                this._includeUserCredentials = true; // avoid going through 401 challenges over and over
+            if (this.isSsoAllowed(challengedUrl)) {
+                // Removed the previous headers and make sure "include" credentials is set
+                opts.headers = undefined;
+                opts.credentials = "include";
+                // A Negotiate/NTLM handshake is normally a same-URL 401 round-trip, but in legacy mode we preserve
+                // the previous behavior and allow the browser to follow redirects after the authenticated retry.
+                opts.redirect = _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined;
+                this.logUntrustedOriginUse(challengedUrl);
+                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
+                response = await fetch(challengedUrl, opts);
+                if (response.status === 200) {
+                    this.recordSsoSucceeded(challengedUrl); // avoid going through 401 challenges over and over for this origin
+                }
             }
+            else {
+                this.reportBlockedOrigin(challengedUrl);
+            }
+        }
+        else if ((response.status === 401 || response.status === 403) && hasSettingsCreds && !this.isCredentialsSharingAllowed(challengedUrl)) {
+            // Some servers answer an unauthenticated request with 403 (Forbidden) rather than a 401 challenge;
+            // since this request could not present its credentials to the challenging origin, either status most
+            // likely results from that. The permission is recomputed for the challenged URL rather than reusing the
+            // decision made for the requested one: `fetch` strips the Authorization header when it follows a
+            // cross-origin redirect, so a trusted request can still arrive unauthenticated at an untrusted origin,
+            // and conversely a request that started out untrusted may end up at an origin that is trusted.
+            this.reportBlockedOrigin(challengedUrl);
         }
         return response;
     }
@@ -174423,16 +174900,28 @@ class MapLayerImageryProvider {
     }
     /** @internal */
     async toolTipFromUrl(strings, url) {
-        const headers = new Headers();
-        this.setRequestAuthorization(headers);
+        let headers;
+        if (this.isCredentialsSharingAllowed(url)) {
+            headers = new Headers();
+            this.setRequestAuthorization(headers);
+        }
         try {
+            const includeCredentials = this.includeUserCredentials(url);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
-                credentials: this._includeUserCredentials ? "include" : undefined,
+                credentials: includeCredentials ? "include" : undefined,
+                redirect: includeCredentials ? this.credentialedRedirect : undefined,
             });
-            const text = await response.text();
-            if (undefined !== text) {
+            if (includeCredentials)
+                this.checkCredentialedRedirect(url, response);
+            let text = await response.text();
+            if (text) {
+                // Tooltip content (e.g. WMS GetFeatureInfo responses) is rendered as HTML downstream and may
+                // deliberately contain markup; text from origins not trusted for credentials is escaped.
+                // fetch follows redirects transparently, so the text may come from a different origin than requested.
+                if (!this.isCredentialsSharingAllowed(response.url || url))
+                    text = escapeHtml(text);
                 strings.push(text);
             }
         }
@@ -174612,6 +175101,12 @@ var MapLayerSourceStatus;
     /** Format is not compatible with the URL provided.
      */
     MapLayerSourceStatus[MapLayerSourceStatus["IncompatibleFormat"] = 7] = "IncompatibleFormat";
+    /** Authentication could not be attempted because the source's origin is not trusted
+     * (see [MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]($frontend)). Add the origin to
+     * [MapLayerFormatRegistry.trustedCredentialsOrigins]($frontend) rather than prompting for credentials.
+     * @beta
+     */
+    MapLayerSourceStatus[MapLayerSourceStatus["UntrustedOrigin"] = 8] = "UntrustedOrigin";
 })(MapLayerSourceStatus || (MapLayerSourceStatus = {}));
 /** A source for map layers. These may be catalogued for convenient use by users or applications.
  * @public
@@ -174899,10 +175394,8 @@ class MapLayerTileTreeReference extends _internal__WEBPACK_IMPORTED_MODULE_3__.T
         const tree = this.treeOwner.tileTree;
         if (undefined === tree || hit.iModel !== tree.iModel || tree.modelId !== hit.sourceId)
             return undefined;
-        const strings = [];
-        strings.push(`Map Layer: ${this._layerSettings.name}`);
         const div = document.createElement("div");
-        div.innerHTML = strings.join("<br>");
+        div.textContent = `Map Layer: ${this._layerSettings.name}`;
         return div;
     }
     decorate(_context) {
@@ -176611,7 +177104,9 @@ class MapTileTreeReference extends _internal__WEBPACK_IMPORTED_MODULE_7__.TileTr
         let carto;
         const strings = [];
         const getTooltipFunc = async (imageryTreeRef, quadId, cartoGraphic, imageryTree) => {
-            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_4__.IModelApp.localization.getLocalizedString("iModelJs:MapLayers.ImageryLayer")}: ${imageryTreeRef.layerSettings.name}`);
+            // innerHTML is used below because imageryLoader.getToolTip may deliberately supply markup.
+            const layerName = (0,_internal__WEBPACK_IMPORTED_MODULE_7__.escapeHtml)(imageryTreeRef.layerSettings.name);
+            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_4__.IModelApp.localization.getLocalizedString("iModelJs:MapLayers.ImageryLayer")}: ${layerName}`);
             carto = cartoGraphic;
             await imageryTree.imageryLoader.getToolTip(strings, quadId, cartoGraphic, imageryTree);
         };
@@ -334493,7 +334988,7 @@ var loadLanguages = instance.loadLanguages;
 (module) {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@itwin/core-frontend","version":"5.13.0-dev.16","description":"iTwin.js frontend components","main":"lib/cjs/core-frontend.js","module":"lib/esm/core-frontend.js","typings":"lib/cjs/core-frontend","license":"MIT","scripts":{"build":"npm run -s copy:public && npm run -s build:cjs && npm run -s build:esm && npm run -s build:workers && npm run -s copy:draco","build:cjs":"npm run -s copy:js:cjs && tsc 1>&2 --outDir lib/cjs","build:esm":"npm run -s copy:js:esm && tsc 1>&2 --module ES2022 --outDir lib/esm","clean":"rimraf -g lib .rush/temp/package-deps*.json","copy:public":"cpx \\"./src/public/**/*\\" ./lib/public","copy:js:cjs":"cpx \\"./src/**/*.js\\" ./lib/cjs","copy:js:esm":"cpx \\"./src/**/*.js\\" ./lib/esm","copy:draco":"cpx \\"./node_modules/@loaders.gl/draco/dist/libs/*\\" ./lib/public/scripts","docs":"betools docs --json=../../generated-docs/core/core-frontend/file.json --tsIndexFile=./core-frontend.ts --onlyJson --excludes=webgl/**/*,**/map/*.d.ts,**/tile/*.d.ts,**/*-css.ts && npm run -s extract","extract":"betools extract --fileExt=ts --extractFrom=./src/test/example-code --recursive --out=../../generated-docs/extract","extract-api":"betools extract-api --entry=core-frontend && npm run extract-extension-api","extract-extension-api":"eslint --no-inline-config -c extraction.eslint.config.js  \\"./src/**/*.ts\\" 1>&2","lint":"eslint \\"./src/**/*.ts\\" 1>&2","lint-fix":"eslint --fix -f visualstudio \\"./src/**/*.ts\\" 1>&2","lint-deprecation":"eslint --fix -f visualstudio --no-inline-config -c ../../common/config/eslint/eslint.config.deprecation-policy.js \\"./src/**/*.ts\\"","pseudolocalize":"betools pseudolocalize --englishDir ./src/public/locales/en --out ./public/locales/en-PSEUDO","test":"npm run build:test-worker && vitest --run","cover":"npm run build:test-worker && vitest --run","build:test-worker":"vite build --config ./src/test/worker/vite.config.mts 1>&2","build:workers":"rimraf lib/workers/webpack && vite build --config ./src/workers/ImdlParser/vite.config.mts 1>&2"},"repository":{"type":"git","url":"https://github.com/iTwin/itwinjs-core.git","directory":"core/frontend"},"keywords":["Bentley","BIM","iModel","digital-twin","iTwin"],"author":{"name":"Bentley Systems, Inc.","url":"http://www.bentley.com"},"peerDependencies":{"@itwin/appui-abstract":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*"},"//devDependencies":["NOTE: All peerDependencies should also be listed as devDependencies since peerDependencies are not considered by npm install","NOTE: All tools used by scripts in this package must be listed as devDependencies"],"devDependencies":{"@bentley/aec-units-schema":"^1.0.3","@bentley/formats-schema":"^1.0.0","@bentley/units-schema":"^1.0.11","@itwin/appui-abstract":"workspace:*","@itwin/build-tools":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*","@itwin/object-storage-core":"^3.0.4","@itwin/eslint-plugin":"^6.0.0","@types/node":"~20.17.0","@types/sinon":"^17.0.2","@vitest/browser-playwright":"^4.1.10","@vitest/coverage-v8":"^4.1.10","cpx2":"^8.0.0","eslint":"^9.31.0","playwright":"~1.56.1","rimraf":"^6.0.1","sinon":"^17.0.2","typescript":"~5.6.2","vite":"^6.4.3","vitest":"^4.1.10","vite-plugin-static-copy":"2.2.0"},"//dependencies":["NOTE: these dependencies should be only for things that DO NOT APPEAR IN THE API","NOTE: core-frontend should remain UI technology agnostic, so no react/angular dependencies are allowed"],"dependencies":{"@itwin/core-i18n":"workspace:*","@itwin/webgl-compatibility":"workspace:*","@loaders.gl/core":"~4.3.4","@loaders.gl/draco":"~4.3.4","fuse.js":"^3.3.0","wms-capabilities":"0.4.0"}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@itwin/core-frontend","version":"5.13.0-dev.18","description":"iTwin.js frontend components","main":"lib/cjs/core-frontend.js","module":"lib/esm/core-frontend.js","typings":"lib/cjs/core-frontend","license":"MIT","scripts":{"build":"npm run -s copy:public && npm run -s build:cjs && npm run -s build:esm && npm run -s build:workers && npm run -s copy:draco","build:cjs":"npm run -s copy:js:cjs && tsc 1>&2 --outDir lib/cjs","build:esm":"npm run -s copy:js:esm && tsc 1>&2 --module ES2022 --outDir lib/esm","clean":"rimraf -g lib .rush/temp/package-deps*.json","copy:public":"cpx \\"./src/public/**/*\\" ./lib/public","copy:js:cjs":"cpx \\"./src/**/*.js\\" ./lib/cjs","copy:js:esm":"cpx \\"./src/**/*.js\\" ./lib/esm","copy:draco":"cpx \\"./node_modules/@loaders.gl/draco/dist/libs/*\\" ./lib/public/scripts","docs":"betools docs --json=../../generated-docs/core/core-frontend/file.json --tsIndexFile=./core-frontend.ts --onlyJson --excludes=webgl/**/*,**/map/*.d.ts,**/tile/*.d.ts,**/*-css.ts && npm run -s extract","extract":"betools extract --fileExt=ts --extractFrom=./src/test/example-code --recursive --out=../../generated-docs/extract","extract-api":"betools extract-api --entry=core-frontend && npm run extract-extension-api","extract-extension-api":"eslint --no-inline-config -c extraction.eslint.config.js  \\"./src/**/*.ts\\" 1>&2","lint":"eslint \\"./src/**/*.ts\\" 1>&2","lint-fix":"eslint --fix -f visualstudio \\"./src/**/*.ts\\" 1>&2","lint-deprecation":"eslint --fix -f visualstudio --no-inline-config -c ../../common/config/eslint/eslint.config.deprecation-policy.js \\"./src/**/*.ts\\"","pseudolocalize":"betools pseudolocalize --englishDir ./src/public/locales/en --out ./public/locales/en-PSEUDO","test":"npm run build:test-worker && vitest --run","cover":"npm run build:test-worker && vitest --run","build:test-worker":"vite build --config ./src/test/worker/vite.config.mts 1>&2","build:workers":"rimraf lib/workers/webpack && vite build --config ./src/workers/ImdlParser/vite.config.mts 1>&2"},"repository":{"type":"git","url":"https://github.com/iTwin/itwinjs-core.git","directory":"core/frontend"},"keywords":["Bentley","BIM","iModel","digital-twin","iTwin"],"author":{"name":"Bentley Systems, Inc.","url":"http://www.bentley.com"},"peerDependencies":{"@itwin/appui-abstract":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*"},"//devDependencies":["NOTE: All peerDependencies should also be listed as devDependencies since peerDependencies are not considered by npm install","NOTE: All tools used by scripts in this package must be listed as devDependencies"],"devDependencies":{"@bentley/aec-units-schema":"^1.0.3","@bentley/formats-schema":"^1.0.0","@bentley/units-schema":"^1.0.11","@itwin/appui-abstract":"workspace:*","@itwin/build-tools":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*","@itwin/object-storage-core":"^3.0.4","@itwin/eslint-plugin":"^6.0.0","@types/node":"~20.17.0","@types/sinon":"^17.0.2","@vitest/browser-playwright":"^4.1.10","@vitest/coverage-v8":"^4.1.10","cpx2":"^8.0.0","eslint":"^9.31.0","playwright":"~1.56.1","rimraf":"^6.0.1","sinon":"^17.0.2","typescript":"~5.6.2","vite":"^6.4.3","vitest":"^4.1.10","vite-plugin-static-copy":"2.2.0"},"//dependencies":["NOTE: these dependencies should be only for things that DO NOT APPEAR IN THE API","NOTE: core-frontend should remain UI technology agnostic, so no react/angular dependencies are allowed"],"dependencies":{"@itwin/core-i18n":"workspace:*","@itwin/webgl-compatibility":"workspace:*","@loaders.gl/core":"~4.3.4","@loaders.gl/draco":"~4.3.4","fuse.js":"^3.3.0","wms-capabilities":"0.4.0"}}');
 
 /***/ }