npm - @azure/msal-browser - Versions diffs - 5.7.0 → 5.9.0 - Mend

@azure/msal-browser 5.7.0 → 5.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (814) hide show

package/lib/msal-browser.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.7.0 2026-04-16 */
+/*! @azure/msal-browser v5.9.0 2026-04-28 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -234,7 +234,7 @@ const JsonWebTokenTypes$1 = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -286,7 +286,7 @@ const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -317,7 +317,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -337,7 +337,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -417,7 +417,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -440,7 +440,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -494,7 +494,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -582,7 +582,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userCanceled: userCanceled
 });
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -777,7 +777,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1166,7 +1166,7 @@ function addResource(parameters, resource) {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1275,7 +1275,7 @@ function normalizeUrlForComparison(url) {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1314,7 +1314,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1589,12 +1589,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.5.0";
+const version$1 = "16.5.2";
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1614,7 +1614,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1655,6 +1655,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             username: preferred_username || upn || "",
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            upn: upn,
         };
     }
     else {
@@ -1682,7 +1683,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     }
     // ID token claims override passed in account info and tenant profile
     if (idTokenClaims) {
-        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
         updatedAccountInfo = {
@@ -1696,7 +1697,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1776,7 +1777,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1933,7 +1934,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2090,7 +2091,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2098,7 +2099,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2136,7 +2137,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2174,7 +2175,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2189,7 +2190,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2211,7 +2212,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2235,7 +2236,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2410,7 +2411,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2448,8 +2449,10 @@ class CacheManager {
         const allAccounts = this.getAllAccounts(accountFilter, correlationId);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
-            const sortedAccounts = allAccounts.sort((account) => {
-                return account.idTokenClaims ? -1 : 1;
+            const sortedAccounts = allAccounts.sort((a, b) => {
+                const aHasClaims = a.idTokenClaims ? 1 : 0;
+                const bHasClaims = b.idTokenClaims ? 1 : 0;
+                return bHasClaims - aHasClaims;
             });
             return sortedAccounts[0];
         }
@@ -2547,6 +2550,19 @@ class CacheManager {
             !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
             return false;
         }
+        if (!!tenantProfileFilter.username &&
+            !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
+                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+            return false;
+        }
+        if (!!tenantProfileFilter.loginHint &&
+            !this.matchLoginHintWithTenantProfile(tenantProfile, tenantProfileFilter.loginHint)) {
+            return false;
+        }
+        if (!!tenantProfileFilter.upn &&
+            !(tenantProfile.upn === tenantProfileFilter.upn)) {
+            return false;
+        }
         return true;
     }
     idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -2561,7 +2577,8 @@ class CacheManager {
                 return false;
             }
             if (!!tenantProfileFilter.username &&
-                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {
+                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username) &&
+                !this.matchUsername(idTokenClaims.upn, tenantProfileFilter.username)) {
                 return false;
             }
             if (!!tenantProfileFilter.name &&
@@ -2662,10 +2679,6 @@ class CacheManager {
                 !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                 return;
             }
-            if (!!accountFilter.username &&
-                !this.matchUsername(entity.username, accountFilter.username)) {
-                return;
-            }
             if (!!accountFilter.environment &&
                 !this.matchEnvironment(entity, accountFilter.environment, correlationId)) {
                 return;
@@ -2686,6 +2699,9 @@ class CacheManager {
             const tenantProfileFilter = {
                 localAccountId: accountFilter?.localAccountId,
                 name: accountFilter?.name,
+                username: accountFilter?.username,
+                loginHint: accountFilter?.loginHint,
+                upn: accountFilter?.upn,
             };
             const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                 return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -2936,11 +2952,11 @@ class CacheManager {
                 const numHomeIdTokens = homeIdTokenMap.size;
                 if (numHomeIdTokens < 1) {
                     this.commonLogger.info("0ooalx", correlationId);
-                    return idTokenMap.values().next().value;
+                    return idTokenMap.values().next().value ?? null;
                 }
                 else if (numHomeIdTokens === 1) {
                     this.commonLogger.info("1eq2vc", correlationId);
-                    return homeIdTokenMap.values().next().value;
+                    return homeIdTokenMap.values().next().value ?? null;
                 }
                 else {
                     // Multiple ID tokens for home tenant profile, remove all and return null
@@ -2956,7 +2972,7 @@ class CacheManager {
             return null;
         }
         this.commonLogger.info("1sm769", correlationId);
-        return idTokenMap.values().next().value;
+        return idTokenMap.values().next().value ?? null;
     }
     /**
      * Gets all idTokens matching the given filter
@@ -3269,6 +3285,17 @@ class CacheManager {
             typeof cachedUsername === "string" &&
             filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
     }
+    /**
+     * helper to match loginhints
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    matchLoginHintWithTenantProfile(tenantProfile, loginHintFilter) {
+        return (tenantProfile.loginHint === loginHintFilter ||
+            tenantProfile.username === loginHintFilter ||
+            tenantProfile.upn === loginHintFilter);
+    }
     /**
      * helper to match assertion
      * @param value
@@ -3361,6 +3388,10 @@ class CacheManager {
         if (tokenClaims.upn === loginHint) {
             return true;
         }
+        // check login hint against list of emails in token claims
+        if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
+            return true;
+        }
         return false;
     }
     /**
@@ -3512,7 +3543,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3563,7 +3594,7 @@ const IntFields = new Set([
     "redirectBridgeMessageVersion",
 ]);
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3618,7 +3649,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3713,7 +3744,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3740,7 +3771,7 @@ function isOidcProtocolMode(config) {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3805,7 +3836,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4064,7 +4095,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4135,7 +4166,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4228,7 +4259,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4308,7 +4339,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4372,7 +4403,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uxNotAllowed: uxNotAllowed
 });
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4440,7 +4471,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4459,7 +4490,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4527,7 +4558,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4875,7 +4906,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4885,7 +4916,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4903,7 +4934,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4924,7 +4955,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5010,7 +5041,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5041,7 +5072,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5155,7 +5186,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5167,7 +5198,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5177,7 +5208,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5187,7 +5218,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5292,7 +5323,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6112,7 +6143,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6146,7 +6177,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6403,7 +6434,7 @@ class AuthorizationCodeClient {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6624,7 +6655,7 @@ class RefreshTokenClient {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6740,7 +6771,7 @@ class SilentFlowClient {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6755,7 +6786,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6978,7 +7009,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7011,7 +7042,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7069,7 +7100,7 @@ class AuthenticationHeaderParser {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7086,7 +7117,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7347,7 +7378,7 @@ class ServerTelemetryManager {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7368,7 +7399,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7376,7 +7407,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7416,7 +7447,7 @@ class JoseHeader {
     }
 }
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9833,8 +9864,8 @@ var BrowserRootPerformanceEvents = /*#__PURE__*/Object.freeze({
 const PREFIX = "msal";
 const BROWSER_PREFIX = "browser";
 const CACHE_KEY_SEPARATOR = "|";
-const CREDENTIAL_SCHEMA_VERSION = 2;
-const ACCOUNT_SCHEMA_VERSION = 2;
+const CREDENTIAL_SCHEMA_VERSION = 3;
+const ACCOUNT_SCHEMA_VERSION = 3;
 const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
 const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
 const BROWSER_PERF_ENABLED_KEY = `${PREFIX}.${BROWSER_PREFIX}.performance.enabled`;
@@ -9871,14 +9902,20 @@ class CookieStorage {
         return Promise.resolve();
     }
     getItem(key) {
-        const name = `${encodeURIComponent(key)}`;
+        const name = encodeURIComponent(key);
         const cookieList = document.cookie.split(";");
         for (let i = 0; i < cookieList.length; i++) {
-            const cookie = cookieList[i];
-            const [key, ...rest] = decodeURIComponent(cookie).trim().split("=");
-            const value = rest.join("=");
-            if (key === name) {
-                return value;
+            const cookie = cookieList[i].trim();
+            const eqIndex = cookie.indexOf("=");
+            const rawKey = eqIndex === -1 ? cookie : cookie.substring(0, eqIndex);
+            if (rawKey === name) {
+                const rawValue = eqIndex === -1 ? "" : cookie.substring(eqIndex + 1);
+                try {
+                    return decodeURIComponent(rawValue);
+                }
+                catch {
+                    return rawValue;
+                }
             }
         }
         return "";
@@ -9909,8 +9946,15 @@ class CookieStorage {
         const cookieList = document.cookie.split(";");
         const keys = [];
         cookieList.forEach((cookie) => {
-            const cookieParts = decodeURIComponent(cookie).trim().split("=");
-            keys.push(cookieParts[0]);
+            const trimmed = cookie.trim();
+            const eqIndex = trimmed.indexOf("=");
+            const rawKey = eqIndex === -1 ? trimmed : trimmed.substring(0, eqIndex);
+            try {
+                keys.push(decodeURIComponent(rawKey));
+            }
+            catch {
+                // Skip cookies with malformed percent-encoded sequences in the key
+            }
         });
         return keys;
     }
@@ -10341,7 +10385,7 @@ const EventType = {
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.7.0";
+const version = "5.9.0";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10624,7 +10668,9 @@ class BrowserCacheManager extends CacheManager {
                 }
                 await this.setUserData(newIdTokenKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
                 this.performanceClient.incrementFields({ migratedITCount: 1 }, correlationId);
-                currentCredentialKeys.idToken.push(newIdTokenKey);
+                if (!currentCredentialKeys.idToken.includes(newIdTokenKey)) {
+                    currentCredentialKeys.idToken.push(newIdTokenKey);
+                }
             }
         }
         this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
@@ -11473,10 +11519,8 @@ class BrowserCacheManager extends CacheManager {
         return `${PREFIX}.${this.clientId}.${key}`;
     }
     /**
-     * Cache Key: msal.<schema_version>-<home_account_id>-<environment>-<credential_type>-<client_id or familyId>-<realm>-<scopes>-<claims hash>-<scheme>
-     * IdToken Example: uid.utid-login.microsoftonline.com-idtoken-app_client_id-contoso.com
-     * AccessToken Example: uid.utid-login.microsoftonline.com-accesstoken-app_client_id-contoso.com-scope1 scope2--pop
-     * RefreshToken Example: uid.utid-login.microsoftonline.com-refreshtoken-1-contoso.com
+     * Generate Credential Key. All changes to the key REQUIRE a schema version update.
+     * Cache Key: msal.<schema_version>|<home_account_id>|<environment>|<credential_type>|<client_id or familyId>|<realm>|<scopes>|<scheme>
      * @param credentialEntity
      * @returns
      */
@@ -12688,13 +12732,14 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         try {
             const silentRequest = this.createSilentCacheRequest(request, account);
             const result = await this.silentCacheClient.acquireToken(silentRequest);
-            const fullAccount = {
-                ...account,
-                idTokenClaims: result?.idTokenClaims,
-                idToken: result?.idToken,
-            };
+            const idToken = this.browserStorage.getIdToken(account, this.correlationId, this.browserStorage.getTokenKeys(), account.tenantId);
+            const idTokenClaims = extractTokenClaims(idToken?.secret || "", base64Decode);
+            const fullAccount = updateAccountTenantProfileData(account, undefined, // tenantProfile optional
+            idTokenClaims, idToken?.secret);
             return {
                 ...result,
+                idToken: idToken?.secret || "",
+                idTokenClaims: idTokenClaims,
                 account: fullAccount,
             };
         }
@@ -12817,7 +12862,8 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
         await this.cacheAccount(baseAccount, isKmsi(idTokenClaims));
-        await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
+        await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.tenantId, reqTimestamp, authority.getPreferredCache() // environment
+        );
         return result;
     }
     /**
@@ -12956,8 +13002,8 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param tenantId
      * @param reqTimestamp
      */
-    cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, responseAccessToken, tenantId, reqTimestamp) {
-        const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, request.authority, response.id_token || "", request.clientId, idTokenClaims.tid || "");
+    async cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, tenantId, reqTimestamp, environment) {
+        const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, environment, response.id_token || "", request.clientId, idTokenClaims.tid || "");
         // cache accessToken in inmemory storage
         const expiresIn = request.tokenType === AuthenticationScheme$1.POP
             ? SHR_NONCE_VALIDITY
@@ -12966,9 +13012,13 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
                 : response.expires_in) || 0;
         const tokenExpirationSeconds = reqTimestamp + expiresIn;
         const responseScopes = this.generateScopes(response.scope, request.scope);
-        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+        // save idtoken credential in configured browser storage
+        if (!!cachedIdToken && request.storeInCache?.idToken !== false) {
+            await this.browserStorage.setIdTokenCredential(cachedIdToken, this.correlationId, isKmsi(idTokenClaims));
+        }
+        // save access token credential in memory storage
         const nativeCacheRecord = {
-            idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
         return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), this.apiId, request.storeInCache);
@@ -13829,7 +13879,7 @@ class PlatformAuthExtensionHandler {
         this.messageChannel = new MessageChannel();
         this.windowListener = this.onWindowMessage.bind(this); // Window event callback doesn't have access to 'this' unless it's bound
         this.performanceClient = performanceClient;
-        this.handshakeEvent = performanceClient.startMeasurement(NativeMessageHandlerHandshake);
+        this.handshakeEvent = this.performanceClient.startMeasurement(NativeMessageHandlerHandshake);
         this.platformAuthType =
             PlatformAuthConstants.PLATFORM_EXTENSION_PROVIDER;
     }
@@ -16570,9 +16620,25 @@ class StandardController {
         const accountEntity = createAccountEntityFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
         await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims), ApiId.hydrateCache);
         if (result.fromPlatformBroker) {
-            this.logger.verbose("1fxyu8", result.correlationId);
-            // Tokens from native broker are stored in-memory
-            return this.nativeInternalStorage.hydrateCache(result, request);
+            this.logger.verbose("1i5atf", result.correlationId);
+            // Create idToken entity and store in browser storage
+            const idTokenEntity = createIdTokenEntity(result.account.homeAccountId, result.account.environment, result.idToken, this.config.auth.clientId, result.tenantId);
+            // Create accessToken entity and store in native internal storage
+            const accessTokenEntity = createAccessTokenEntity(result.account.homeAccountId, result.account.environment, result.accessToken, this.config.auth.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn
+                ? toSecondsFromDate(result.expiresOn)
+                : 0, result.extExpiresOn
+                ? toSecondsFromDate(result.extExpiresOn)
+                : 0, base64Decode, undefined, // refreshOn
+            result.tokenType, undefined, // userAssertionHash
+            request.sshKid);
+            if (request.resource) {
+                accessTokenEntity.resource = request.resource;
+            }
+            const kmsi = isKmsi(result.idTokenClaims);
+            // Store idToken in browser storage
+            await this.browserStorage.setIdTokenCredential(idTokenEntity, result.correlationId, kmsi);
+            // Store accessToken in native internal storage
+            await this.nativeInternalStorage.setAccessTokenCredential(accessTokenEntity, result.correlationId, kmsi);
         }
         else {
             return this.browserStorage.hydrateCache(result, request);
@@ -16636,7 +16702,9 @@ class StandardController {
                 loginHint: request.loginHint,
                 sid: request.sid,
             }) ||
-            this.getActiveAccount();
+            (!request.loginHint && !request.sid
+                ? this.getActiveAccount()
+                : null);
         return (account && account.nativeAccountId) || "";
     }
     /**