@chemmangat/msal-next 5.1.0 → 5.2.1

package/CHANGELOG.md

@@ -2,6 +2,53 @@
 
 All notable changes to this project will be documented in this file.
 
+## [5.2.1] - 2026-04-07
+
+### 🐛 Bug Fix
+
+#### `createAuthMiddleware` now importable from `@chemmangat/msal-next/middleware`
+
+`createAuthMiddleware` was previously bundled inside `dist/index.mjs` which carries a `"use client"` directive. Importing it in `middleware.ts` caused Next.js to throw:
+
+> "Attempted to call createAuthMiddleware() from the server but createAuthMiddleware is on the client."
+
+It now has its own edge-compatible entry point with no React, no `@azure/msal-browser`, and no `"use client"` — only `next/server`.
+
+**Migration** (update your import):
+```ts
+// Before
+import { createAuthMiddleware } from '@chemmangat/msal-next';
+
+// After
+import { createAuthMiddleware } from '@chemmangat/msal-next/middleware';
+```
+
+Also fixed `tenantValidator.ts` to use `import type` for its `@azure/msal-browser` and `types.ts` imports, ensuring those never get bundled into the middleware output.
+
+---
+
+
+
+### 🔧 Compatibility
+
+#### Support for `@azure/msal-browser` v5.x and `@azure/msal-react` v4.x / v5.x
+
+Peer dependency ranges updated to include the latest MSAL major versions:
+
+```json
+"@azure/msal-browser": "^3.11.0 || ^4.0.0 || ^5.0.0",
+"@azure/msal-react": "^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0"
+```
+
+Breaking changes in `msal-browser` v5 are handled transparently at runtime — no changes required in your app code.
+
+**What changed internally:**
+
+- `handleRedirectPromise()` now receives an options object on v5 (`navigateToLoginRequestUrl` moved here from config)
+- `storeAuthStateInCookie` and `navigateToLoginRequestUrl` are conditionally omitted from the MSAL config object when running on v5 (both were removed from `BrowserAuthOptions`/`CacheOptions`)
+- `EventType.LOGIN_SUCCESS` payload is now `AccountInfo` on v5 (was `AuthenticationResult` on v3/v4) — handled with a runtime type guard
+- `EventType.LOGIN_FAILURE` was removed in v5; login failures now surface as `ACQUIRE_TOKEN_FAILURE` — both are handled
+
 ## [5.1.0] - 2026-03-17
 
 ### ✨ New Features