@azure/msal-common 15.13.0 → 15.13.2

package/lib/{index-node-D8Iaiqq3.js → index-node-BF0Vz18w.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.13.0 2025-09-24 */
+/*! @azure/msal-common v15.13.2 2025-11-19 */
 'use strict';
 'use strict';
 
@@ -433,7 +433,8 @@ const noNetworkConnectivity = "no_network_connectivity";
 const userCanceled = "user_canceled";
 const missingTenantIdError = "missing_tenant_id_error";
 const methodNotImplemented = "method_not_implemented";
-const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
+const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
+const platformBrokerError = "platform_broker_error";
 
 var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -472,6 +473,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     nonceMismatch: nonceMismatch,
     nullOrEmptyToken: nullOrEmptyToken,
     openIdConfigError: openIdConfigError,
+    platformBrokerError: platformBrokerError,
     requestCannotBeMade: requestCannotBeMade,
     stateMismatch: stateMismatch,
     stateNotFound: stateNotFound,
@@ -538,6 +540,7 @@ const ClientAuthErrorMessages = {
     [missingTenantIdError]: "A tenant id - not common, organizations, or consumers - must be specified when using the client_credentials flow.",
     [methodNotImplemented]: "This method has not been implemented",
     [nestedAppAuthBridgeDisabled]: "The nested app auth bridge is disabled",
+    [platformBrokerError]: "An error occurred in the native broker. See the platformBrokerError property for details.",
 };
 /**
  * String constants used by error codes and messages.
@@ -716,6 +719,10 @@ const ClientAuthErrorMessage = {
         code: nestedAppAuthBridgeDisabled,
         desc: ClientAuthErrorMessages[nestedAppAuthBridgeDisabled],
     },
+    platformBrokerError: {
+        code: platformBrokerError,
+        desc: ClientAuthErrorMessages[platformBrokerError],
+    },
 };
 /**
  * Error thrown when there is an error in the client code running on the browser.
@@ -754,6 +761,26 @@ function extractTokenClaims(encodedToken, base64Decode) {
         throw createClientAuthError(tokenParsingError);
     }
 }
+/**
+ * Check if the signin_state claim contains "kmsi"
+ * @param idTokenClaims
+ * @returns
+ */
+function isKmsi(idTokenClaims) {
+    if (!idTokenClaims.signin_state) {
+        return false;
+    }
+    /**
+     * Signin_state claim known values:
+     * dvc_mngd - device is managed
+     * dvc_dmjd - device is domain joined
+     * kmsi - user opted to "keep me signed in"
+     * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
+     */
+    const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
+    const kmsi = idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
+    return kmsi;
+}
 /**
  * decode a JWT
  *
@@ -796,7 +823,8 @@ var AuthToken = /*#__PURE__*/Object.freeze({
     __proto__: null,
     checkMaxAge: checkMaxAge,
     extractTokenClaims: extractTokenClaims,
-    getJWSPayload: getJWSPayload
+    getJWSPayload: getJWSPayload,
+    isKmsi: isKmsi
 });
 
 /*
@@ -3905,7 +3933,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "15.13.0";
+const version = "15.13.2";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4100,6 +4128,44 @@ class ScopeSet {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Function to build a client info object from server clientInfo string
+ * @param rawClientInfo
+ * @param crypto
+ */
+function buildClientInfo(rawClientInfo, base64Decode) {
+    if (!rawClientInfo) {
+        throw createClientAuthError(clientInfoEmptyError);
+    }
+    try {
+        const decodedClientInfo = base64Decode(rawClientInfo);
+        return JSON.parse(decodedClientInfo);
+    }
+    catch (e) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+}
+/**
+ * Function to build a client info object from cached homeAccountId string
+ * @param homeAccountId
+ */
+function buildClientInfoFromHomeAccountId(homeAccountId) {
+    if (!homeAccountId) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+    const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
+    return {
+        uid: clientInfoParts[0],
+        utid: clientInfoParts.length < 2
+            ? Constants.EMPTY_STRING
+            : clientInfoParts[1],
+    };
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4185,56 +4251,21 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-const cacheQuotaExceeded = "cache_quota_exceeded";
-const cacheErrorUnknown = "cache_error_unknown";
-
-var CacheErrorCodes = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    cacheErrorUnknown: cacheErrorUnknown,
-    cacheQuotaExceeded: cacheQuotaExceeded
-});
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CacheErrorMessages = {
-    [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
-    [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
-};
-/**
- * Error thrown when there is an error with the cache
- */
-class CacheError extends AuthError {
-    constructor(errorCode, errorMessage) {
-        const message = errorMessage ||
-            (CacheErrorMessages[errorCode]
-                ? CacheErrorMessages[errorCode]
-                : CacheErrorMessages[cacheErrorUnknown]);
-        super(`${errorCode}: ${message}`);
-        Object.setPrototypeOf(this, CacheError.prototype);
-        this.name = "CacheError";
-        this.errorCode = errorCode;
-        this.errorMessage = message;
-    }
-}
 /**
- * Helper function to wrap browser errors in a CacheError object
- * @param e
+ * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+ * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+ * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+ * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+ * Downcased to match the realm case-insensitive comparison requirements
+ * @param idTokenClaims
  * @returns
  */
-function createCacheError(e) {
-    if (!(e instanceof Error)) {
-        return new CacheError(cacheErrorUnknown);
-    }
-    if (e.name === "QuotaExceededError" ||
-        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
-        e.message.includes("exceeded the quota")) {
-        return new CacheError(cacheQuotaExceeded);
-    }
-    else {
-        return new CacheError(e.name, e.message);
+function getTenantIdFromIdTokenClaims(idTokenClaims) {
+    if (idTokenClaims) {
+        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
+        return tenantId || null;
     }
+    return null;
 }
 
 /*
@@ -4242,82 +4273,357 @@ function createCacheError(e) {
  * Licensed under the MIT License.
  */
 /**
- * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
+ * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
+ *
+ * Key : Value Schema
+ *
+ * Key: <home_account_id>-<environment>-<realm*>
+ *
+ * Value Schema:
+ * {
+ *      homeAccountId: home account identifier for the auth scheme,
+ *      environment: entity that issued the token, represented as a full host
+ *      realm: Full tenant or organizational identifier that the account belongs to
+ *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
+ *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
+ *      authorityType: Accounts authority type as a string
+ *      name: Full name for the account, including given name and family name,
+ *      lastModificationTime: last time this entity was modified in the cache
+ *      lastModificationApp:
+ *      nativeAccountId: Account identifier on the native device
+ *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
+ * }
  * @internal
  */
-class CacheManager {
-    constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
-        this.clientId = clientId;
-        this.cryptoImpl = cryptoImpl;
-        this.commonLogger = logger.clone(name, version);
-        this.staticAuthorityOptions = staticAuthorityOptions;
-        this.performanceClient = performanceClient;
+class AccountEntity {
+    /**
+     * Returns the AccountInfo interface for this account.
+     */
+    static getAccountInfo(accountEntity) {
+        return {
+            homeAccountId: accountEntity.homeAccountId,
+            environment: accountEntity.environment,
+            tenantId: accountEntity.realm,
+            username: accountEntity.username,
+            localAccountId: accountEntity.localAccountId,
+            loginHint: accountEntity.loginHint,
+            name: accountEntity.name,
+            nativeAccountId: accountEntity.nativeAccountId,
+            authorityType: accountEntity.authorityType,
+            // Deserialize tenant profiles array into a Map
+            tenantProfiles: new Map((accountEntity.tenantProfiles || []).map((tenantProfile) => {
+                return [tenantProfile.tenantId, tenantProfile];
+            })),
+            dataBoundary: accountEntity.dataBoundary,
+        };
     }
     /**
-     * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
-     * @param accountFilter - (Optional) filter to narrow down the accounts returned
-     * @returns Array of AccountInfo objects in cache
+     * Returns true if the account entity is in single tenant format (outdated), false otherwise
      */
-    getAllAccounts(accountFilter, correlationId) {
-        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
+    isSingleTenant() {
+        return !this.tenantProfiles;
     }
     /**
-     * Gets first tenanted AccountInfo object found based on provided filters
+     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
+     * @param accountDetails
      */
-    getAccountInfoFilteredBy(accountFilter, correlationId) {
-        if (Object.keys(accountFilter).length === 0 ||
-            Object.values(accountFilter).every((value) => !value)) {
-            this.commonLogger.warning("getAccountInfoFilteredBy: Account filter is empty or invalid, returning null");
-            return null;
-        }
-        const allAccounts = this.getAllAccounts(accountFilter, correlationId);
-        if (allAccounts.length > 1) {
-            // If one or more accounts are found, prioritize accounts that have an ID token
-            const sortedAccounts = allAccounts.sort((account) => {
-                return account.idTokenClaims ? -1 : 1;
-            });
-            return sortedAccounts[0];
+    static createAccount(accountDetails, authority, base64Decode) {
+        const account = new AccountEntity();
+        if (authority.authorityType === AuthorityType.Adfs) {
+            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
         }
-        else if (allAccounts.length === 1) {
-            // If only one account is found, return it regardless of whether a matching ID token was found
-            return allAccounts[0];
+        else if (authority.protocolMode === ProtocolMode.OIDC) {
+            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
         }
         else {
-            return null;
+            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
         }
-    }
-    /**
-     * Returns a single matching
-     * @param accountFilter
-     * @returns
-     */
-    getBaseAccountInfo(accountFilter, correlationId) {
-        const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
-        if (accountEntities.length > 0) {
-            return accountEntities[0].getAccountInfo();
+        let clientInfo;
+        if (accountDetails.clientInfo && base64Decode) {
+            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+            if (clientInfo.xms_tdbr) {
+                account.dataBoundary =
+                    clientInfo.xms_tdbr === "EU" ? "EU" : "None";
+            }
+        }
+        account.clientInfo = accountDetails.clientInfo;
+        account.homeAccountId = accountDetails.homeAccountId;
+        account.nativeAccountId = accountDetails.nativeAccountId;
+        const env = accountDetails.environment ||
+            (authority && authority.getPreferredCache());
+        if (!env) {
+            throw createClientAuthError(invalidCacheEnvironment);
+        }
+        account.environment = env;
+        // non AAD scenarios can have empty realm
+        account.realm =
+            clientInfo?.utid ||
+                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+                "";
+        // How do you account for MSA CID here?
+        account.localAccountId =
+            clientInfo?.uid ||
+                accountDetails.idTokenClaims?.oid ||
+                accountDetails.idTokenClaims?.sub ||
+                "";
+        /*
+         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+         * In most cases it will contain a single email. This field should not be relied upon if a custom
+         * policy is configured to return more than 1 email.
+         */
+        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
+            accountDetails.idTokenClaims?.upn;
+        const email = accountDetails.idTokenClaims?.emails
+            ? accountDetails.idTokenClaims.emails[0]
+            : null;
+        account.username = preferredUsername || email || "";
+        account.loginHint = accountDetails.idTokenClaims?.login_hint;
+        account.name = accountDetails.idTokenClaims?.name || "";
+        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
+        account.msGraphHost = accountDetails.msGraphHost;
+        if (accountDetails.tenantProfiles) {
+            account.tenantProfiles = accountDetails.tenantProfiles;
         }
         else {
-            return null;
+            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
+            account.tenantProfiles = [tenantProfile];
         }
+        return account;
     }
     /**
-     * Matches filtered account entities with cached ID tokens that match the tenant profile-specific account filters
-     * and builds the account info objects from the matching ID token's claims
-     * @param cachedAccounts
-     * @param accountFilter
-     * @returns Array of AccountInfo objects that match account and tenant profile filters
+     * Creates an AccountEntity object from AccountInfo
+     * @param accountInfo
+     * @param cloudGraphHostName
+     * @param msGraphHost
+     * @returns
      */
-    buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
-        return cachedAccounts.flatMap((accountEntity) => {
-            return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
-        });
-    }
-    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
-        let tenantedAccountInfo = null;
-        let idTokenClaims;
-        if (tenantProfileFilter) {
-            if (!this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter)) {
-                return null;
+    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
+        const account = new AccountEntity();
+        account.authorityType =
+            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.homeAccountId = accountInfo.homeAccountId;
+        account.localAccountId = accountInfo.localAccountId;
+        account.nativeAccountId = accountInfo.nativeAccountId;
+        account.realm = accountInfo.tenantId;
+        account.environment = accountInfo.environment;
+        account.username = accountInfo.username;
+        account.name = accountInfo.name;
+        account.loginHint = accountInfo.loginHint;
+        account.cloudGraphHostName = cloudGraphHostName;
+        account.msGraphHost = msGraphHost;
+        // Serialize tenant profiles map into an array
+        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
+        account.dataBoundary = accountInfo.dataBoundary;
+        return account;
+    }
+    /**
+     * Generate HomeAccountId from server response
+     * @param serverClientInfo
+     * @param authType
+     */
+    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
+        // since ADFS/DSTS do not have tid and does not set client_info
+        if (!(authType === AuthorityType.Adfs ||
+            authType === AuthorityType.Dsts)) {
+            // for cases where there is clientInfo
+            if (serverClientInfo) {
+                try {
+                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
+                    if (clientInfo.uid && clientInfo.utid) {
+                        return `${clientInfo.uid}.${clientInfo.utid}`;
+                    }
+                }
+                catch (e) { }
+            }
+            logger.warning("No client info in response");
+        }
+        // default to "sub" claim
+        return idTokenClaims?.sub || "";
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    static isAccountEntity(entity) {
+        if (!entity) {
+            return false;
+        }
+        return (entity.hasOwnProperty("homeAccountId") &&
+            entity.hasOwnProperty("environment") &&
+            entity.hasOwnProperty("realm") &&
+            entity.hasOwnProperty("localAccountId") &&
+            entity.hasOwnProperty("username") &&
+            entity.hasOwnProperty("authorityType"));
+    }
+    /**
+     * Helper function to determine whether 2 accountInfo objects represent the same account
+     * @param accountA
+     * @param accountB
+     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
+     */
+    static accountInfoIsEqual(accountA, accountB, compareClaims) {
+        if (!accountA || !accountB) {
+            return false;
+        }
+        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
+        if (compareClaims) {
+            const accountAClaims = (accountA.idTokenClaims ||
+                {});
+            const accountBClaims = (accountB.idTokenClaims ||
+                {});
+            // issued at timestamp and nonce are expected to change each time a new id token is acquired
+            claimsMatch =
+                accountAClaims.iat === accountBClaims.iat &&
+                    accountAClaims.nonce === accountBClaims.nonce;
+        }
+        return (accountA.homeAccountId === accountB.homeAccountId &&
+            accountA.localAccountId === accountB.localAccountId &&
+            accountA.username === accountB.username &&
+            accountA.tenantId === accountB.tenantId &&
+            accountA.loginHint === accountB.loginHint &&
+            accountA.environment === accountB.environment &&
+            accountA.nativeAccountId === accountB.nativeAccountId &&
+            claimsMatch);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const cacheQuotaExceeded = "cache_quota_exceeded";
+const cacheErrorUnknown = "cache_error_unknown";
+
+var CacheErrorCodes = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    cacheErrorUnknown: cacheErrorUnknown,
+    cacheQuotaExceeded: cacheQuotaExceeded
+});
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CacheErrorMessages = {
+    [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
+    [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
+};
+/**
+ * Error thrown when there is an error with the cache
+ */
+class CacheError extends AuthError {
+    constructor(errorCode, errorMessage) {
+        const message = errorMessage ||
+            (CacheErrorMessages[errorCode]
+                ? CacheErrorMessages[errorCode]
+                : CacheErrorMessages[cacheErrorUnknown]);
+        super(`${errorCode}: ${message}`);
+        Object.setPrototypeOf(this, CacheError.prototype);
+        this.name = "CacheError";
+        this.errorCode = errorCode;
+        this.errorMessage = message;
+    }
+}
+/**
+ * Helper function to wrap browser errors in a CacheError object
+ * @param e
+ * @returns
+ */
+function createCacheError(e) {
+    if (!(e instanceof Error)) {
+        return new CacheError(cacheErrorUnknown);
+    }
+    if (e.name === "QuotaExceededError" ||
+        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+        e.message.includes("exceeded the quota")) {
+        return new CacheError(cacheQuotaExceeded);
+    }
+    else {
+        return new CacheError(e.name, e.message);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
+ * @internal
+ */
+class CacheManager {
+    constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
+        this.clientId = clientId;
+        this.cryptoImpl = cryptoImpl;
+        this.commonLogger = logger.clone(name, version);
+        this.staticAuthorityOptions = staticAuthorityOptions;
+        this.performanceClient = performanceClient;
+    }
+    /**
+     * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
+     * @param accountFilter - (Optional) filter to narrow down the accounts returned
+     * @returns Array of AccountInfo objects in cache
+     */
+    getAllAccounts(accountFilter, correlationId) {
+        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
+    }
+    /**
+     * Gets first tenanted AccountInfo object found based on provided filters
+     */
+    getAccountInfoFilteredBy(accountFilter, correlationId) {
+        if (Object.keys(accountFilter).length === 0 ||
+            Object.values(accountFilter).every((value) => !value)) {
+            this.commonLogger.warning("getAccountInfoFilteredBy: Account filter is empty or invalid, returning null");
+            return null;
+        }
+        const allAccounts = this.getAllAccounts(accountFilter, correlationId);
+        if (allAccounts.length > 1) {
+            // If one or more accounts are found, prioritize accounts that have an ID token
+            const sortedAccounts = allAccounts.sort((account) => {
+                return account.idTokenClaims ? -1 : 1;
+            });
+            return sortedAccounts[0];
+        }
+        else if (allAccounts.length === 1) {
+            // If only one account is found, return it regardless of whether a matching ID token was found
+            return allAccounts[0];
+        }
+        else {
+            return null;
+        }
+    }
+    /**
+     * Returns a single matching
+     * @param accountFilter
+     * @returns
+     */
+    getBaseAccountInfo(accountFilter, correlationId) {
+        const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
+        if (accountEntities.length > 0) {
+            return AccountEntity.getAccountInfo(accountEntities[0]);
+        }
+        else {
+            return null;
+        }
+    }
+    /**
+     * Matches filtered account entities with cached ID tokens that match the tenant profile-specific account filters
+     * and builds the account info objects from the matching ID token's claims
+     * @param cachedAccounts
+     * @param accountFilter
+     * @returns Array of AccountInfo objects that match account and tenant profile filters
+     */
+    buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
+        return cachedAccounts.flatMap((accountEntity) => {
+            return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
+        });
+    }
+    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
+        let tenantedAccountInfo = null;
+        let idTokenClaims;
+        if (tenantProfileFilter) {
+            if (!this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter)) {
+                return null;
             }
         }
         const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
@@ -4333,7 +4639,7 @@ class CacheManager {
         return tenantedAccountInfo;
     }
     getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
-        const accountInfo = accountEntity.getAccountInfo();
+        const accountInfo = AccountEntity.getAccountInfo(accountEntity);
         let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
         const tokenKeys = this.getTokenKeys();
         // If a tenant ID was provided, only return the tenant profile for that tenant ID if it exists
@@ -4403,27 +4709,28 @@ class CacheManager {
     /**
      * saves a cache record
      * @param cacheRecord {CacheRecord}
-     * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
+     * @param kmsi - Keep Me Signed In
+     * @param storeInCache {?StoreInCache}
      */
-    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
+    async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
         if (!cacheRecord) {
             throw createClientAuthError(invalidCacheRecord);
         }
         try {
             if (!!cacheRecord.account) {
-                await this.setAccount(cacheRecord.account, correlationId);
+                await this.setAccount(cacheRecord.account, correlationId, kmsi);
             }
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                await this.setIdTokenCredential(cacheRecord.idToken, correlationId);
+                await this.setIdTokenCredential(cacheRecord.idToken, correlationId, kmsi);
             }
             if (!!cacheRecord.accessToken &&
                 storeInCache?.accessToken !== false) {
-                await this.saveAccessToken(cacheRecord.accessToken, correlationId);
+                await this.saveAccessToken(cacheRecord.accessToken, correlationId, kmsi);
             }
             if (!!cacheRecord.refreshToken &&
                 storeInCache?.refreshToken !== false) {
-                await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
+                await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId, kmsi);
             }
             if (!!cacheRecord.appMetadata) {
                 this.setAppMetadata(cacheRecord.appMetadata, correlationId);
@@ -4443,7 +4750,7 @@ class CacheManager {
      * saves access token credential
      * @param credential
      */
-    async saveAccessToken(credential, correlationId) {
+    async saveAccessToken(credential, correlationId, kmsi) {
         const accessTokenFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -4468,7 +4775,7 @@ class CacheManager {
                 }
             }
         });
-        await this.setAccessTokenCredential(credential, correlationId);
+        await this.setAccessTokenCredential(credential, correlationId, kmsi);
     }
     /**
      * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
@@ -5528,44 +5835,6 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Function to build a client info object from server clientInfo string
- * @param rawClientInfo
- * @param crypto
- */
-function buildClientInfo(rawClientInfo, base64Decode) {
-    if (!rawClientInfo) {
-        throw createClientAuthError(clientInfoEmptyError);
-    }
-    try {
-        const decodedClientInfo = base64Decode(rawClientInfo);
-        return JSON.parse(decodedClientInfo);
-    }
-    catch (e) {
-        throw createClientAuthError(clientInfoDecodingError);
-    }
-}
-/**
- * Function to build a client info object from cached homeAccountId string
- * @param homeAccountId
- */
-function buildClientInfoFromHomeAccountId(homeAccountId) {
-    if (!homeAccountId) {
-        throw createClientAuthError(clientInfoDecodingError);
-    }
-    const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
-    return {
-        uid: clientInfoParts[0],
-        utid: clientInfoParts.length < 2
-            ? Constants.EMPTY_STRING
-            : clientInfoParts[1],
-    };
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6326,246 +6595,6 @@ class BaseClient {
     }
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
- * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
- * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
- * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
- * Downcased to match the realm case-insensitive comparison requirements
- * @param idTokenClaims
- * @returns
- */
-function getTenantIdFromIdTokenClaims(idTokenClaims) {
-    if (idTokenClaims) {
-        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
-        return tenantId || null;
-    }
-    return null;
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
- *
- * Key : Value Schema
- *
- * Key: <home_account_id>-<environment>-<realm*>
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
- *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
- *      authorityType: Accounts authority type as a string
- *      name: Full name for the account, including given name and family name,
- *      lastModificationTime: last time this entity was modified in the cache
- *      lastModificationApp:
- *      nativeAccountId: Account identifier on the native device
- *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
- * }
- * @internal
- */
-class AccountEntity {
-    /**
-     * Returns the AccountInfo interface for this account.
-     */
-    getAccountInfo() {
-        return {
-            homeAccountId: this.homeAccountId,
-            environment: this.environment,
-            tenantId: this.realm,
-            username: this.username,
-            localAccountId: this.localAccountId,
-            loginHint: this.loginHint,
-            name: this.name,
-            nativeAccountId: this.nativeAccountId,
-            authorityType: this.authorityType,
-            // Deserialize tenant profiles array into a Map
-            tenantProfiles: new Map((this.tenantProfiles || []).map((tenantProfile) => {
-                return [tenantProfile.tenantId, tenantProfile];
-            })),
-            dataBoundary: this.dataBoundary,
-        };
-    }
-    /**
-     * Returns true if the account entity is in single tenant format (outdated), false otherwise
-     */
-    isSingleTenant() {
-        return !this.tenantProfiles;
-    }
-    /**
-     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-     * @param accountDetails
-     */
-    static createAccount(accountDetails, authority, base64Decode) {
-        const account = new AccountEntity();
-        if (authority.authorityType === AuthorityType.Adfs) {
-            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
-        }
-        else if (authority.protocolMode === ProtocolMode.OIDC) {
-            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        }
-        else {
-            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
-        }
-        let clientInfo;
-        if (accountDetails.clientInfo && base64Decode) {
-            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
-            if (clientInfo.xms_tdbr) {
-                account.dataBoundary =
-                    clientInfo.xms_tdbr === "EU" ? "EU" : "None";
-            }
-        }
-        account.clientInfo = accountDetails.clientInfo;
-        account.homeAccountId = accountDetails.homeAccountId;
-        account.nativeAccountId = accountDetails.nativeAccountId;
-        const env = accountDetails.environment ||
-            (authority && authority.getPreferredCache());
-        if (!env) {
-            throw createClientAuthError(invalidCacheEnvironment);
-        }
-        account.environment = env;
-        // non AAD scenarios can have empty realm
-        account.realm =
-            clientInfo?.utid ||
-                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
-                "";
-        // How do you account for MSA CID here?
-        account.localAccountId =
-            clientInfo?.uid ||
-                accountDetails.idTokenClaims?.oid ||
-                accountDetails.idTokenClaims?.sub ||
-                "";
-        /*
-         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-         * In most cases it will contain a single email. This field should not be relied upon if a custom
-         * policy is configured to return more than 1 email.
-         */
-        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
-            accountDetails.idTokenClaims?.upn;
-        const email = accountDetails.idTokenClaims?.emails
-            ? accountDetails.idTokenClaims.emails[0]
-            : null;
-        account.username = preferredUsername || email || "";
-        account.loginHint = accountDetails.idTokenClaims?.login_hint;
-        account.name = accountDetails.idTokenClaims?.name || "";
-        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
-        account.msGraphHost = accountDetails.msGraphHost;
-        if (accountDetails.tenantProfiles) {
-            account.tenantProfiles = accountDetails.tenantProfiles;
-        }
-        else {
-            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
-            account.tenantProfiles = [tenantProfile];
-        }
-        return account;
-    }
-    /**
-     * Creates an AccountEntity object from AccountInfo
-     * @param accountInfo
-     * @param cloudGraphHostName
-     * @param msGraphHost
-     * @returns
-     */
-    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
-        const account = new AccountEntity();
-        account.authorityType =
-            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        account.homeAccountId = accountInfo.homeAccountId;
-        account.localAccountId = accountInfo.localAccountId;
-        account.nativeAccountId = accountInfo.nativeAccountId;
-        account.realm = accountInfo.tenantId;
-        account.environment = accountInfo.environment;
-        account.username = accountInfo.username;
-        account.name = accountInfo.name;
-        account.loginHint = accountInfo.loginHint;
-        account.cloudGraphHostName = cloudGraphHostName;
-        account.msGraphHost = msGraphHost;
-        // Serialize tenant profiles map into an array
-        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
-        account.dataBoundary = accountInfo.dataBoundary;
-        return account;
-    }
-    /**
-     * Generate HomeAccountId from server response
-     * @param serverClientInfo
-     * @param authType
-     */
-    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
-        // since ADFS/DSTS do not have tid and does not set client_info
-        if (!(authType === AuthorityType.Adfs ||
-            authType === AuthorityType.Dsts)) {
-            // for cases where there is clientInfo
-            if (serverClientInfo) {
-                try {
-                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
-                    if (clientInfo.uid && clientInfo.utid) {
-                        return `${clientInfo.uid}.${clientInfo.utid}`;
-                    }
-                }
-                catch (e) { }
-            }
-            logger.warning("No client info in response");
-        }
-        // default to "sub" claim
-        return idTokenClaims?.sub || "";
-    }
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isAccountEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("localAccountId") &&
-            entity.hasOwnProperty("username") &&
-            entity.hasOwnProperty("authorityType"));
-    }
-    /**
-     * Helper function to determine whether 2 accountInfo objects represent the same account
-     * @param accountA
-     * @param accountB
-     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
-     */
-    static accountInfoIsEqual(accountA, accountB, compareClaims) {
-        if (!accountA || !accountB) {
-            return false;
-        }
-        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
-        if (compareClaims) {
-            const accountAClaims = (accountA.idTokenClaims ||
-                {});
-            const accountBClaims = (accountB.idTokenClaims ||
-                {});
-            // issued at timestamp and nonce are expected to change each time a new id token is acquired
-            claimsMatch =
-                accountAClaims.iat === accountBClaims.iat &&
-                    accountAClaims.nonce === accountBClaims.nonce;
-        }
-        return (accountA.homeAccountId === accountB.homeAccountId &&
-            accountA.localAccountId === accountB.localAccountId &&
-            accountA.username === accountB.username &&
-            accountA.tenantId === accountB.tenantId &&
-            accountA.loginHint === accountB.loginHint &&
-            accountA.environment === accountB.environment &&
-            accountA.nativeAccountId === accountB.nativeAccountId &&
-            claimsMatch);
-    }
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6967,14 +6996,14 @@ class ResponseHandler {
             if (handlingRefreshTokenResponse &&
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
-                const key = this.cacheStorage.generateAccountKey(cacheRecord.account.getAccountInfo());
+                const key = this.cacheStorage.generateAccountKey(AccountEntity.getAccountInfo(cacheRecord.account));
                 const account = this.cacheStorage.getAccount(key, request.correlationId);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, request.storeInCache);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), request.storeInCache);
         }
         finally {
             if (this.persistencePlugin &&
@@ -7121,7 +7150,7 @@ class ResponseHandler {
                 serverTokenResponse?.spa_accountid;
         }
         const accountInfo = cacheRecord.account
-            ? updateAccountTenantProfileData(cacheRecord.account.getAccountInfo(), undefined, // tenantProfile optional
+            ? updateAccountTenantProfileData(AccountEntity.getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
             idTokenClaims, cacheRecord.idToken?.secret)
             : null;
         return {
@@ -8043,6 +8072,48 @@ class AuthenticationHeaderParser {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Converts a numeric tag to a string representation
+ * @param tag - The numeric tag to convert
+ * @returns The string representation of the tag
+ */
+function tagToString(tag) {
+    if (tag === 0) {
+        return "UNTAG";
+    }
+    const tagSymbolSpace = "abcdefghijklmnopqrstuvwxyz0123456789****************************";
+    let tagBuffer = "*****";
+    const chars = [
+        tagSymbolSpace[(tag >> 24) & 0x3f],
+        tagSymbolSpace[(tag >> 18) & 0x3f],
+        tagSymbolSpace[(tag >> 12) & 0x3f],
+        tagSymbolSpace[(tag >> 6) & 0x3f],
+        tagSymbolSpace[(tag >> 0) & 0x3f],
+    ];
+    tagBuffer = chars.join("");
+    return tagBuffer;
+}
+/**
+ * Error class for MSAL Runtime errors that preserves detailed broker information
+ */
+class PlatformBrokerError extends AuthError {
+    constructor(errorStatus, errorContext, errorCode, errorTag) {
+        const tagString = tagToString(errorTag);
+        const enhancedErrorContext = errorContext
+            ? `${errorContext} (Error Code: ${errorCode}, Tag: ${tagString})`
+            : `(Error Code: ${errorCode}, Tag: ${tagString})`;
+        super(errorStatus, enhancedErrorContext);
+        this.name = "PlatformBrokerError";
+        this.statusCode = errorCode;
+        this.tag = tagString;
+        Object.setPrototypeOf(this, PlatformBrokerError.prototype);
+    }
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8364,6 +8435,7 @@ exports.PerformanceEventAbbreviations = PerformanceEventAbbreviations;
 exports.PerformanceEventStatus = PerformanceEventStatus;
 exports.PerformanceEvents = PerformanceEvents;
 exports.PersistentCacheKeys = PersistentCacheKeys;
+exports.PlatformBrokerError = PlatformBrokerError;
 exports.PopTokenGenerator = PopTokenGenerator;
 exports.PromptValue = PromptValue;
 exports.ProtocolMode = ProtocolMode;
@@ -8408,4 +8480,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-D8Iaiqq3.js.map
+//# sourceMappingURL=index-node-BF0Vz18w.js.map