@azure/msal-common 16.5.0 → 16.5.2

package/dist-browser/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
 import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';

package/dist-browser/protocol/Token.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { CcsCredentialType } from '../account/CcsCredential.mjs';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';

package/dist-browser/request/AuthenticationHeaderParser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { HeaderNames } from '../utils/Constants.mjs';

package/dist-browser/request/BaseAuthRequest.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/request/RequestParameterBuilder.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { OIDC_DEFAULT_SCOPES, ResponseMode, HeaderNames, CLIENT_INFO, ClaimsRequestKeys, PasswordGrantConstants, AuthenticationScheme, X_MS_LIB_CAPABILITY_VALUE } from '../utils/Constants.mjs';
 import { CLIENT_ID, BROKER_CLIENT_ID, REDIRECT_URI, RESPONSE_TYPE, RESPONSE_MODE, NATIVE_BROKER, SCOPE, POST_LOGOUT_URI, ID_TOKEN_HINT, DOMAIN_HINT, LOGIN_HINT, SID, CLAIMS, CLIENT_REQUEST_ID, X_CLIENT_SKU, X_CLIENT_VER, X_CLIENT_OS, X_CLIENT_CPU, X_APP_NAME, X_APP_VER, PROMPT, STATE, NONCE, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE, DEVICE_CODE, REFRESH_TOKEN, CODE_VERIFIER, CLIENT_SECRET, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, OBO_ASSERTION, REQUESTED_TOKEN_USE, GRANT_TYPE, CLI_DATA, INSTANCE_AWARE, TOKEN_TYPE, REQ_CNF, X_CLIENT_CURR_TELEM, X_CLIENT_LAST_TELEM, X_MS_LIB_CAPABILITY, LOGOUT_HINT, BROKER_REDIRECT_URI, EAR_JWK, EAR_JWE_CRYPTO, RESOURCE } from '../constants/AADServerParamKeys.mjs';

package/dist-browser/request/ScopeSet.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist-browser/response/ResponseHandler.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { updateAccountTenantProfileData, buildTenantProfile } from '../account/AccountInfo.mjs';
 import { extractTokenClaims, checkMaxAge, isKmsi } from '../account/AuthToken.mjs';

package/dist-browser/telemetry/performance/PerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { getAndFlushLogsFromCache } from '../../logger/Logger.mjs';
 import { IntFields, PerformanceEventStatus, EXT_FIELD_PREFIX } from './PerformanceEvent.mjs';

package/dist-browser/telemetry/performance/PerformanceEvent.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/telemetry/performance/PerformanceEvents.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/telemetry/performance/StubPerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { PerformanceEventStatus } from './PerformanceEvent.mjs';
 

package/dist-browser/telemetry/server/ServerTelemetryManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { CacheOutcome, SERVER_TELEM_CACHE_KEY, CACHE_KEY_SEPARATOR, SERVER_TELEM_SCHEMA_VERSION, SERVER_TELEM_VALUE_SEPARATOR, SERVER_TELEM_CATEGORY_SEPARATOR, SERVER_TELEM_OVERFLOW_TRUE, SERVER_TELEM_OVERFLOW_FALSE, SERVER_TELEM_MAX_CACHED_ERRORS, SERVER_TELEM_UNKNOWN_ERROR, SERVER_TELEM_MAX_LAST_HEADER_BYTES } from '../../utils/Constants.mjs';
 import { AuthError } from '../../error/AuthError.mjs';

package/dist-browser/url/UrlString.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist-browser/utils/ClientAssertionUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/Constants.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/FunctionWrappers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/ProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { RESOURCE_DELIM } from './Constants.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist-browser/utils/StringUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/TimeUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/UrlUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { StringUtils } from './StringUtils.mjs';

package/lib/index-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 'use strict';
 
-var indexNode = require('./index-node-Du5Fgpah.js');
+var indexNode = require('./index-node-ByMjZ1FK.js');
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/lib/{index-node-Du5Fgpah.js → index-node-ByMjZ1FK.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.5.0 2026-04-16 */
+/*! @azure/msal-common v16.5.2 2026-04-28 */
 'use strict';
 'use strict';
 
@@ -3018,6 +3018,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             username: preferred_username || upn || "",
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            upn: upn,
         };
     }
     else {
@@ -3045,7 +3046,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     }
     // ID token claims override passed in account info and tenant profile
     if (idTokenClaims) {
-        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
         updatedAccountInfo = {
@@ -4264,7 +4265,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.5.0";
+const version = "16.5.2";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4351,8 +4352,10 @@ class CacheManager {
         const allAccounts = this.getAllAccounts(accountFilter, correlationId);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
-            const sortedAccounts = allAccounts.sort((account) => {
-                return account.idTokenClaims ? -1 : 1;
+            const sortedAccounts = allAccounts.sort((a, b) => {
+                const aHasClaims = a.idTokenClaims ? 1 : 0;
+                const bHasClaims = b.idTokenClaims ? 1 : 0;
+                return bHasClaims - aHasClaims;
             });
             return sortedAccounts[0];
         }
@@ -4450,6 +4453,19 @@ class CacheManager {
             !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
             return false;
         }
+        if (!!tenantProfileFilter.username &&
+            !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
+                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+            return false;
+        }
+        if (!!tenantProfileFilter.loginHint &&
+            !this.matchLoginHintWithTenantProfile(tenantProfile, tenantProfileFilter.loginHint)) {
+            return false;
+        }
+        if (!!tenantProfileFilter.upn &&
+            !(tenantProfile.upn === tenantProfileFilter.upn)) {
+            return false;
+        }
         return true;
     }
     idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -4464,7 +4480,8 @@ class CacheManager {
                 return false;
             }
             if (!!tenantProfileFilter.username &&
-                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {
+                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username) &&
+                !this.matchUsername(idTokenClaims.upn, tenantProfileFilter.username)) {
                 return false;
             }
             if (!!tenantProfileFilter.name &&
@@ -4565,10 +4582,6 @@ class CacheManager {
                 !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                 return;
             }
-            if (!!accountFilter.username &&
-                !this.matchUsername(entity.username, accountFilter.username)) {
-                return;
-            }
             if (!!accountFilter.environment &&
                 !this.matchEnvironment(entity, accountFilter.environment, correlationId)) {
                 return;
@@ -4589,6 +4602,9 @@ class CacheManager {
             const tenantProfileFilter = {
                 localAccountId: accountFilter?.localAccountId,
                 name: accountFilter?.name,
+                username: accountFilter?.username,
+                loginHint: accountFilter?.loginHint,
+                upn: accountFilter?.upn,
             };
             const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                 return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -4839,11 +4855,11 @@ class CacheManager {
                 const numHomeIdTokens = homeIdTokenMap.size;
                 if (numHomeIdTokens < 1) {
                     this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result", correlationId);
-                    return idTokenMap.values().next().value;
+                    return idTokenMap.values().next().value ?? null;
                 }
                 else if (numHomeIdTokens === 1) {
                     this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile", correlationId);
-                    return homeIdTokenMap.values().next().value;
+                    return homeIdTokenMap.values().next().value ?? null;
                 }
                 else {
                     // Multiple ID tokens for home tenant profile, remove all and return null
@@ -4859,7 +4875,7 @@ class CacheManager {
             return null;
         }
         this.commonLogger.info("CacheManager:getIdToken - Returning ID token", correlationId);
-        return idTokenMap.values().next().value;
+        return idTokenMap.values().next().value ?? null;
     }
     /**
      * Gets all idTokens matching the given filter
@@ -5172,6 +5188,17 @@ class CacheManager {
             typeof cachedUsername === "string" &&
             filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
     }
+    /**
+     * helper to match loginhints
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    matchLoginHintWithTenantProfile(tenantProfile, loginHintFilter) {
+        return (tenantProfile.loginHint === loginHintFilter ||
+            tenantProfile.username === loginHintFilter ||
+            tenantProfile.upn === loginHintFilter);
+    }
     /**
      * helper to match assertion
      * @param value
@@ -5264,6 +5291,10 @@ class CacheManager {
         if (tokenClaims.upn === loginHint) {
             return true;
         }
+        // check login hint against list of emails in token claims
+        if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
+            return true;
+        }
         return false;
     }
     /**
@@ -7862,4 +7893,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-Du5Fgpah.js.map
+//# sourceMappingURL=index-node-ByMjZ1FK.js.map