@azure/msal-common 16.12.0 → 16.14.0

package/lib/{index-node-3p7V__ym.js → index-node-l_NIe8t5.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.12.0 2026-08-04 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 'use strict';
 
@@ -74,6 +74,7 @@ const invalidCacheEnvironment = "invalid_cache_environment";
 const noAccountFound = "no_account_found";
 const noCryptoObject = "no_crypto_object";
 const unexpectedCredentialType = "unexpected_credential_type";
+const dpopTokenTypeMismatch = "dpop_token_type_mismatch";
 const tokenRefreshRequired = "token_refresh_required";
 const tokenClaimsCnfRequiredForSignedJwt = "token_claims_cnf_required_for_signedjwt";
 const authorizationCodeMissingFromServerResponse = "authorization_code_missing_from_server_response";
@@ -96,6 +97,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     cannotRemoveEmptyScope: cannotRemoveEmptyScope,
     clientInfoDecodingError: clientInfoDecodingError,
     clientInfoEmptyError: clientInfoEmptyError,
+    dpopTokenTypeMismatch: dpopTokenTypeMismatch,
     emptyInputScopeSet: emptyInputScopeSet,
     endSessionEndpointNotSupported: endSessionEndpointNotSupported,
     endpointResolutionError: endpointResolutionError,
@@ -231,7 +233,6 @@ var AuthToken = /*#__PURE__*/Object.freeze({
 const AuthorityType = {
     Default: 0,
     Adfs: 1,
-    Dsts: 2,
     Ciam: 3,
 };
 
@@ -266,6 +267,7 @@ const invalidAuthorityMetadata = "invalid_authority_metadata";
 const untrustedAuthority = "untrusted_authority";
 const missingSshJwk = "missing_ssh_jwk";
 const missingSshKid = "missing_ssh_kid";
+const unsupportedAuthenticationScheme = "unsupported_authentication_scheme";
 const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
 const invalidAuthenticationHeader = "invalid_authentication_header";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
@@ -276,7 +278,9 @@ const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuratio
 const issuerValidationFailed = "issuer_validation_failed";
 const invalidResponseMode = "invalid_response_mode";
 const invalidDpopHtm = "invalid_dpop_htm";
-const invalidDpopHtu = "invalid_dpop_htu";
+const invalidDpopHtu = "invalid_dpop_htu";
+const invalidDpopNonce = "invalid_dpop_nonce";
+const dpopMissingResourceContext = "dpop_missing_resource_context";
 
 var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -285,6 +289,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     cannotAllowPlatformBroker: cannotAllowPlatformBroker,
     cannotSetOIDCOptions: cannotSetOIDCOptions,
     claimsRequestParsingError: claimsRequestParsingError,
+    dpopMissingResourceContext: dpopMissingResourceContext,
     emptyInputScopesError: emptyInputScopesError,
     invalidAuthenticationHeader: invalidAuthenticationHeader,
     invalidAuthorityMetadata: invalidAuthorityMetadata,
@@ -293,6 +298,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     invalidCodeChallengeMethod: invalidCodeChallengeMethod,
     invalidDpopHtm: invalidDpopHtm,
     invalidDpopHtu: invalidDpopHtu,
+    invalidDpopNonce: invalidDpopNonce,
     invalidPlatformBrokerConfiguration: invalidPlatformBrokerConfiguration,
     invalidRequestMethodForEAR: invalidRequestMethodForEAR,
     invalidResponseMode: invalidResponseMode,
@@ -304,6 +310,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     pkceParamsMissing: pkceParamsMissing,
     redirectUriEmpty: redirectUriEmpty,
     tokenRequestEmpty: tokenRequestEmpty,
+    unsupportedAuthenticationScheme: unsupportedAuthenticationScheme,
     untrustedAuthority: untrustedAuthority,
     urlEmptyError: urlEmptyError,
     urlParseError: urlParseError
@@ -417,7 +424,6 @@ const DEFAULT_AUTHORITY_HOST = "login.microsoftonline.com";
 const DEFAULT_COMMON_TENANT = "common";
 // ADFS String
 const ADFS = "adfs";
-const DSTS = "dstsv2";
 // Default AAD Instance Discovery Endpoint
 const AAD_INSTANCE_DISCOVERY_ENDPT = `${DEFAULT_AUTHORITY}discovery/instance?api-version=1.1&authorization_endpoint=`;
 // CIAM URL
@@ -487,6 +493,7 @@ const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, EMAIL_SCOPE];
 const HeaderNames = {
     CONTENT_TYPE: "Content-Type",
     CONTENT_LENGTH: "Content-Length",
+    DPOP: "DPoP",
     RETRY_AFTER: "Retry-After",
     CCS_HEADER: "X-AnchorMailbox",
     WWWAuthenticate: "WWW-Authenticate",
@@ -517,6 +524,7 @@ const ClaimsRequestKeys = {
     ID_TOKEN: "id_token",
     SIGNIN_STATE: "signin_state",
     LOGIN_HINT: "login_hint",
+    TENANT_REGION_SUB_SCOPE: "tenant_region_sub_scope",
 };
 /**
  * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
@@ -632,6 +640,7 @@ const SERVER_TELEM_UNKNOWN_ERROR = "unknown_error";
 const AuthenticationScheme = {
     BEARER: "Bearer",
     POP: "pop",
+    DPOP: "DPoP",
     SSH: "ssh-cert",
 };
 /**
@@ -694,6 +703,7 @@ const JsonWebTokenTypes = {
     Jwt: "JWT",
     Jwk: "JWK",
     Pop: "pop",
+    Dpop: "dpop+jwt",
 };
 const ONE_DAY_IN_MS = 86400000;
 // Token renewal offset default in seconds
@@ -739,7 +749,6 @@ var Constants = /*#__PURE__*/Object.freeze({
     DEFAULT_MAX_THROTTLE_TIME_SECONDS: DEFAULT_MAX_THROTTLE_TIME_SECONDS,
     DEFAULT_THROTTLE_TIME_SECONDS: DEFAULT_THROTTLE_TIME_SECONDS,
     DEFAULT_TOKEN_RENEWAL_OFFSET_SEC: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
-    DSTS: DSTS,
     EMAIL_SCOPE: EMAIL_SCOPE,
     EncodingTypes: EncodingTypes,
     FORWARD_SLASH: FORWARD_SLASH,
@@ -971,10 +980,7 @@ class UrlString {
 // Build endpoint metadata dynamically to avoid string duplication
 const endpointHosts = [
     { host: "login.microsoftonline.com" },
-    {
-        host: "login.chinacloudapi.cn",
-        issuerHost: "login.partner.microsoftonline.cn", // Issuer differs
-    },
+    { host: "login.partner.microsoftonline.cn" },
     { host: "login.microsoftonline.us" },
     { host: "login.sovcloud-identity.fr" },
     { host: "login.sovcloud-identity.de" },
@@ -1048,15 +1054,6 @@ const rawMetdataJSON = {
                 preferred_cache: "login.sovcloud-identity.sg",
                 aliases: ["login.sovcloud-identity.sg"],
             },
-            {
-                preferred_network: "login.windows-ppe.net",
-                preferred_cache: "login.windows-ppe.net",
-                aliases: [
-                    "login.windows-ppe.net",
-                    "sts.windows-ppe.net",
-                    "login.microsoft-ppe.com",
-                ],
-            },
         ],
     },
 };
@@ -1160,8 +1157,6 @@ const AzureCloudInstance = {
     None: "none",
     // Microsoft Azure public cloud
     AzurePublic: "https://login.microsoftonline.com",
-    // Microsoft PPE
-    AzurePpe: "https://login.windows-ppe.net",
     // Microsoft Chinese national/regional cloud
     AzureChina: "https://login.chinacloudapi.cn",
     // Microsoft German national/regional cloud ("Black Forest")
@@ -1627,6 +1622,7 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
     if (refreshOn) {
         atEntity.refreshOn = refreshOn.toString();
     }
+    const normalizedTokenType = atEntity.tokenType?.toLowerCase();
     /*
      * Create Access Token With Auth Scheme instead of regular access token
      * Cast to lower to handle "bearer" from ADFS
@@ -1635,7 +1631,7 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
         AuthenticationScheme.BEARER.toLowerCase()) {
         atEntity.credentialType =
             CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-        switch (atEntity.tokenType) {
+        switch (normalizedTokenType) {
             case AuthenticationScheme.POP:
                 // Make sure keyId is present and add it to credential
                 const tokenClaims = extractTokenClaims(accessToken, base64Decode, correlationId);
@@ -1644,6 +1640,12 @@ function createAccessTokenEntity(homeAccountId, environment, accessToken, client
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
                 break;
+            case "dpop":
+                if (!keyId) {
+                    throw createClientAuthError(keyIdMissing, correlationId);
+                }
+                atEntity.keyId = keyId;
+                break;
             case AuthenticationScheme.SSH:
                 atEntity.keyId = keyId;
         }
@@ -1913,8 +1915,6 @@ class Authority {
             switch (pathSegments[0].toLowerCase()) {
                 case ADFS:
                     return AuthorityType.Adfs;
-                case DSTS:
-                    return AuthorityType.Dsts;
             }
         }
         return AuthorityType.Default;
@@ -3050,6 +3050,7 @@ const CLIENT_ASSERTION = "client_assertion";
 const CLIENT_ASSERTION_TYPE = "client_assertion_type";
 const TOKEN_TYPE = "token_type";
 const REQ_CNF = "req_cnf";
+const DPOP_JKT = "dpop_jkt";
 const OBO_ASSERTION = "assertion";
 const REQUESTED_TOKEN_USE = "requested_token_use";
 const ON_BEHALF_OF = "on_behalf_of";
@@ -3096,6 +3097,7 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     CODE_VERIFIER: CODE_VERIFIER,
     DEVICE_CODE: DEVICE_CODE,
     DOMAIN_HINT: DOMAIN_HINT,
+    DPOP_JKT: DPOP_JKT,
     EAR_JWE_CRYPTO: EAR_JWE_CRYPTO,
     EAR_JWK: EAR_JWK,
     ERROR: ERROR,
@@ -3463,8 +3465,8 @@ function createAccountEntityFromAccountInfo(accountInfo, cloudGraphHostName, msG
  * @param authType
  */
 function generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, correlationId, idTokenClaims) {
-    // since ADFS/DSTS do not have tid and does not set client_info
-    if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
+    // ADFS does not have tid and does not set client_info
+    if (authType !== AuthorityType.Adfs) {
         // for cases where there is clientInfo
         if (serverClientInfo) {
             try {
@@ -4015,11 +4017,15 @@ function addExtraParameters(parameters, extraParams) {
 }
 /**
  * Default optional idToken claims requested on all auth requests.
- * signin_state enables KMSI detection; login_hint enables login hint propagation.
+ * signin_state enables KMSI detection; login_hint enables login hint propagation;
+ * tenant_region_sub_scope identifies the sovereign enclave a tenant belongs to.
  */
 const DEFAULT_ID_TOKEN_CLAIMS = {
     [ClaimsRequestKeys.SIGNIN_STATE]: { essential: false },
     [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
+    [ClaimsRequestKeys.TENANT_REGION_SUB_SCOPE]: {
+        essential: false,
+    },
 };
 /**
  * Parses a claims JSON string into an object, throwing a ClientConfigurationError
@@ -4038,7 +4044,7 @@ function parseClaims(claims, correlationId = "") {
         // Malformed JSON
         throw createClientConfigurationError(invalidClaims, correlationId);
     }
-    if (!isPlainObject(parsed)) {
+    if (!isPlainObject$1(parsed)) {
         // Valid JSON, but not an object (e.g. an array, a scalar, or the literal `null`).
         throw createClientConfigurationError(invalidClaims, correlationId);
     }
@@ -4049,7 +4055,7 @@ function parseClaims(claims, correlationId = "") {
  * @param value - The value to test
  * @returns True when value is a plain object that can be deep-merged
  */
-function isPlainObject(value) {
+function isPlainObject$1(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -4066,7 +4072,7 @@ function deepMergeClaims(baseClaims, claimsToMerge) {
     const merged = { ...baseClaims };
     for (const [key, mergeInValue] of Object.entries(claimsToMerge)) {
         const baseValue = merged[key];
-        if (isPlainObject(baseValue) && isPlainObject(mergeInValue)) {
+        if (isPlainObject$1(baseValue) && isPlainObject$1(mergeInValue)) {
             merged[key] = deepMergeClaims(baseValue, mergeInValue);
         }
         else {
@@ -4078,8 +4084,8 @@ function deepMergeClaims(baseClaims, claimsToMerge) {
 /**
  * Parses claims JSON, optionally deep-merges a second client-originated claims string
  * (`claimsToMerge`, e.g. `claimsFromClient`) with precedence on conflicting keys, merges
- * default optional idToken claims (signin_state, login_hint), and appends client
- * capabilities (xms_cc) to the access_token section.
+ * default optional idToken claims (signin_state, login_hint, tenant_region_sub_scope), and appends client
+ * capabilities (xms_cc) to the access_token section
  * Does not overwrite idToken claims already specified by the caller.
  * @param claims - Existing claims JSON string from the request (may be undefined)
  * @param clientCapabilities - Client capabilities array from configuration
@@ -4273,6 +4279,14 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Shared JOSE algorithm literals used by MSAL package internals.
+ * @internal
+ */
+const JsonWebTokenAlgorithms = {
+    ES256: "ES256",
+    RS256: "RS256",
+};
 /**
  * Default crypto implementation used when a platform-specific implementation has
  * not been provided.
@@ -4293,23 +4307,41 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     encodeKid: () => {
         throw createClientAuthError(methodNotImplemented, "");
     },
-    async getPublicKeyThumbprint() {
-        throw createClientAuthError(methodNotImplemented, "");
-    },
-    async removeTokenBindingKey() {
-        throw createClientAuthError(methodNotImplemented, "");
+    async removeTokenBindingKey(kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
     },
-    async clearKeystore() {
-        throw createClientAuthError(methodNotImplemented, "");
+    async clearKeystore(correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
     },
-    async signJwt() {
-        throw createClientAuthError(methodNotImplemented, "");
+    async signTokenBindingJwt(header, payload, kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
     },
     async hashString() {
         throw createClientAuthError(methodNotImplemented, "");
     },
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Default token-binding key manager used when a platform-specific implementation
+ * has not been provided.
+ * @internal
+ */
+const DEFAULT_TOKEN_BINDING_KEY_MANAGER = {
+    async provisionTokenBindingKey(request) {
+        throw createClientAuthError(methodNotImplemented, request.correlationId);
+    },
+    async removeTokenBindingKey(_kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
+    },
+    async getTokenBindingPublicKeyJwk(_kid, correlationId) {
+        throw createClientAuthError(methodNotImplemented, correlationId);
+    },
+};
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4600,7 +4632,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.12.0";
+const version = "16.14.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4660,9 +4692,10 @@ function createCacheError(e) {
  * @internal
  */
 class CacheManager {
-    constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
+    constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions, tokenBindingKeyManager) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
         this.commonLogger = logger.clone(name, version);
         this.staticAuthorityOptions = staticAuthorityOptions;
         this.performanceClient = performanceClient;
@@ -5010,16 +5043,9 @@ class CacheManager {
         // Access Token with Auth Scheme specific matching
         if (entity.credentialType ===
             CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
-            if (!!filter.tokenType &&
-                !this.matchTokenType(entity, filter.tokenType)) {
+            if (!this.matchAccessTokenWithAuthScheme(entity, filter)) {
                 return false;
             }
-            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-            if (filter.tokenType === AuthenticationScheme.SSH) {
-                if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
-                    return false;
-                }
-            }
         }
         // Additional cache key components matching (bidirectional isolation)
         const entityComponents = entity.additionalCacheKeyComponents;
@@ -5158,19 +5184,24 @@ class CacheManager {
         }
         this.removeItem(key, correlationId);
         this.performanceClient.incrementFields({ accessTokensRemoved: 1 }, correlationId);
-        // Remove Token Binding Key from key store for PoP Tokens Credentials
+        // Remove Token Binding Key from key store for token-bound access token credentials
         if (credential.credentialType.toLowerCase() ===
             CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
-            if (credential.tokenType === AuthenticationScheme.POP) {
-                const accessTokenWithAuthSchemeEntity = credential;
-                const kid = accessTokenWithAuthSchemeEntity.keyId;
-                if (kid) {
-                    void this.cryptoImpl
-                        .removeTokenBindingKey(kid, correlationId)
-                        .catch(() => {
-                        this.commonLogger.error(`Failed to remove token binding key '${kid}'`, correlationId);
-                        this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
-                    });
+            const tokenType = credential.tokenType?.toLowerCase();
+            switch (tokenType) {
+                case AuthenticationScheme.POP:
+                case AuthenticationScheme.DPOP.toLowerCase(): {
+                    const accessTokenWithAuthSchemeEntity = credential;
+                    const kid = accessTokenWithAuthSchemeEntity.keyId;
+                    if (kid) {
+                        void this.tokenBindingKeyManager
+                            .removeTokenBindingKey(kid, correlationId)
+                            .catch(() => {
+                            this.commonLogger.error("Failed to remove token binding key", correlationId);
+                            this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
+                        });
+                    }
+                    break;
                 }
             }
         }
@@ -5336,7 +5367,9 @@ class CacheManager {
             realm: targetRealm || account.tenantId,
             target: scopes,
             tokenType: authScheme,
-            keyId: request.sshKid,
+            keyId: authScheme === AuthenticationScheme.SSH
+                ? request.sshKid
+                : undefined,
             additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
         const accessTokenKeys = (tokenKeys && tokenKeys.accessToken) ||
@@ -5698,7 +5731,28 @@ class CacheManager {
      * @param tokenType
      */
     matchTokenType(entity, tokenType) {
-        return !!(entity.tokenType && entity.tokenType === tokenType);
+        return !!(entity.tokenType &&
+            entity.tokenType.toLowerCase() === tokenType.toLowerCase());
+    }
+    matchAccessTokenWithAuthScheme(entity, filter) {
+        const normalizedFilterTokenType = filter.tokenType?.toLowerCase();
+        if (!!filter.tokenType &&
+            !this.matchTokenType(entity, filter.tokenType)) {
+            return false;
+        }
+        switch (normalizedFilterTokenType) {
+            case "dpop":
+            case AuthenticationScheme.SSH:
+                return this.matchKeyBoundAccessToken(entity, filter);
+            default:
+                return true;
+        }
+    }
+    matchKeyBoundAccessToken(entity, filter) {
+        if (!filter.keyId) {
+            return true;
+        }
+        return this.matchKeyId(entity, filter.keyId);
     }
     /**
      * Returns true if the credential's keyId matches the one in the request, false otherwise
@@ -5988,19 +6042,21 @@ const DEFAULT_TELEMETRY_OPTIONS = {
  * @returns Configuration
  * @internal
  */
-function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
+function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, tokenBindingKeyManager: tokenBindingKeyManager, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
     const loggerOptions = {
         ...DEFAULT_LOGGER_IMPLEMENTATION,
         ...userLoggerOption,
     };
+    const resolvedTokenBindingKeyManager = tokenBindingKeyManager || DEFAULT_TOKEN_BINDING_KEY_MANAGER;
     return {
         authOptions: buildAuthOptions(userAuthOptions),
         systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
         loggerOptions: loggerOptions,
         storageInterface: storageImplementation ||
-            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions, name, version), new StubPerformanceClient()),
+            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions, name, version), new StubPerformanceClient(), undefined, resolvedTokenBindingKeyManager),
         networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        tokenBindingKeyManager: resolvedTokenBindingKeyManager,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
         libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
         telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
@@ -6056,16 +6112,135 @@ function isOidcProtocolMode(config) {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const missingKidError = "missing_kid_error";
+const missingAlgError = "missing_alg_error";
+const missingJwkError = "missing_jwk_error";
+const invalidJwkError = "invalid_jwk_error";
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+class JoseHeaderError extends AuthError {
+    constructor(errorCode, correlationId, errorMessage) {
+        super(errorCode, correlationId, errorMessage);
+        this.name = "JoseHeaderError";
+        Object.setPrototypeOf(this, JoseHeaderError.prototype);
+    }
+}
+/** Returns JoseHeaderError object */
+function createJoseHeaderError(code, correlationId) {
+    return new JoseHeaderError(code, correlationId);
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Checks whether a value is a plain JSON-like object.
+ * Allows objects with null prototypes, but rejects arrays and object subclasses.
+ */
+function isPlainObject(value) {
+    if (typeof value !== "object" ||
+        value === null ||
+        Object.prototype.toString.call(value) !== "[object Object]") {
+        return false;
+    }
+    if (Object.getPrototypeOf(value) === null) {
+        return true;
+    }
+    let proto = value;
+    while (Object.getPrototypeOf(proto) !== null) {
+        proto = Object.getPrototypeOf(proto);
+    }
+    return Object.getPrototypeOf(value) === proto;
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class JoseHeader {
+    constructor(options, correlationId) {
+        if (typeof options.alg !== "string" || !options.alg) {
+            throw createJoseHeaderError(missingAlgError, correlationId);
+        }
+        this.typ = options.typ;
+        this.alg = options.alg;
+        this.kid = options.kid;
+        this.jwk = options.jwk;
+    }
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @param correlationId
+     * @returns
+     */
+    static getShrHeader(shrHeaderOptions, correlationId) {
+        // KeyID is required on the SHR header
+        if (!shrHeaderOptions.kid) {
+            throw createJoseHeaderError(missingKidError, correlationId);
+        }
+        // Alg is required on the SHR header
+        if (!shrHeaderOptions.alg) {
+            throw createJoseHeaderError(missingAlgError, correlationId);
+        }
+        return new JoseHeader({
+            // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
+            typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
+            kid: shrHeaderOptions.kid,
+            alg: shrHeaderOptions.alg,
+        }, correlationId);
+    }
+    /**
+     * Builds a DPoP formatted JOSE Header from the JOSE Header options provided.
+     * Throws if public JWK or algorithm aren't provided since they are required for DPoP.
+     * @param dpopHeaderOptions
+     * @param correlationId
+     * @returns
+     */
+    static getDpopHeader(dpopHeaderOptions, correlationId) {
+        if (!isPlainObject(dpopHeaderOptions.jwk)) {
+            throw createJoseHeaderError(missingJwkError, correlationId);
+        }
+        if (!dpopHeaderOptions.alg) {
+            throw createJoseHeaderError(missingAlgError, correlationId);
+        }
+        if (Object.keys(dpopHeaderOptions.jwk).length === 0) {
+            throw createJoseHeaderError(invalidJwkError, correlationId);
+        }
+        return new JoseHeader({
+            typ: JsonWebTokenTypes.Dpop,
+            alg: dpopHeaderOptions.alg,
+            jwk: dpopHeaderOptions.jwk,
+        }, correlationId);
+    }
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 const KeyLocation = {
     SW: "sw"};
+const SHR_TOKEN_BINDING_KEY_TYPE = "shr";
+const SHR_TOKEN_BINDING_KEY_ALGORITHM = JsonWebTokenAlgorithms.RS256;
 /** @internal */
 class PopTokenGenerator {
-    constructor(cryptoUtils, performanceClient) {
+    constructor(cryptoUtils, tokenBindingKeyManager, performanceClient) {
         this.cryptoUtils = cryptoUtils;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
         this.performanceClient = performanceClient;
     }
     /**
@@ -6088,7 +6263,11 @@ class PopTokenGenerator {
      * @returns
      */
     async generateKid(request) {
-        const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(request);
+        const kidThumbprint = await this.tokenBindingKeyManager.provisionTokenBindingKey({
+            correlationId: request.correlationId,
+            tokenBindingKeyType: SHR_TOKEN_BINDING_KEY_TYPE,
+            tokenBindingKeyAlgorithm: SHR_TOKEN_BINDING_KEY_ALGORITHM,
+        });
         return {
             kid: kidThumbprint,
             xms_ksl: KeyLocation.SW,
@@ -6118,7 +6297,17 @@ class PopTokenGenerator {
             ? new UrlString(resourceRequestUri, request.correlationId)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
-        return this.cryptoUtils.signJwt({
+        const publicKeyJwk = await this.tokenBindingKeyManager.getTokenBindingPublicKeyJwk(keyId, request.correlationId);
+        const encodedKeyIdThumbprint = this.cryptoUtils.base64UrlEncode(JSON.stringify({ kid: keyId }));
+        const shrAlgorithm = shrOptions?.header?.alg ||
+            publicKeyJwk.alg ||
+            SHR_TOKEN_BINDING_KEY_ALGORITHM;
+        const shrHeader = JoseHeader.getShrHeader({
+            ...shrOptions?.header,
+            alg: shrAlgorithm,
+            kid: encodedKeyIdThumbprint,
+        }, request.correlationId);
+        const shrPayload = {
             at: payload,
             ts: nowSeconds(),
             m: resourceRequestMethod?.toUpperCase(),
@@ -6130,7 +6319,154 @@ class PopTokenGenerator {
                 : undefined,
             client_claims: shrClaims || undefined,
             ...claims,
-        }, keyId, shrOptions, request.correlationId);
+            cnf: {
+                jwk: publicKeyJwk,
+            },
+        };
+        return this.cryptoUtils.signTokenBindingJwt(shrHeader, shrPayload, keyId, request.correlationId);
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DPOP_HTM_REGEX = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const DPOP_TOKEN_BINDING_KEY_TYPE = "dpop";
+const DPOP_JWT_HEADER_ALGORITHM = JsonWebTokenAlgorithms.ES256;
+function buildProofHeader(publicJwk, correlationId) {
+    return JoseHeader.getDpopHeader({
+        alg: DPOP_JWT_HEADER_ALGORITHM,
+        jwk: publicJwk,
+    }, correlationId);
+}
+function normalizeHtm(htm, correlationId) {
+    if (typeof htm !== "string" || !DPOP_HTM_REGEX.test(htm)) {
+        throw createClientConfigurationError(invalidDpopHtm, correlationId);
+    }
+    return htm.toUpperCase();
+}
+/**
+ * Normalizes a URL for use as the DPoP htu claim.
+ * Per RFC 9449 §4.2, htu is the target URI without query and fragment components.
+ * WHATWG URL serialization handles RFC 3986 syntax- and scheme-based normalization
+ * such as lowercasing scheme/host and eliding default ports.
+ */
+function normalizeHtu(url, correlationId) {
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(url);
+    }
+    catch {
+        throw createClientConfigurationError(urlParseError, correlationId);
+    }
+    if (!/^https:\/\//i.test(url) ||
+        parsedUrl.protocol !== "https:" ||
+        parsedUrl.username ||
+        parsedUrl.password) {
+        throw createClientConfigurationError(invalidDpopHtu, correlationId);
+    }
+    parsedUrl.search = "";
+    parsedUrl.hash = "";
+    return parsedUrl.href;
+}
+function validateDpopNonce(nonce, correlationId) {
+    if (nonce !== undefined && nonce.trim().length === 0) {
+        throw createClientConfigurationError(invalidDpopNonce, correlationId);
+    }
+}
+/**
+ * Builds RFC 9449 DPoP proof JWT payloads for token-endpoint and
+ * resource-endpoint proof bindings.
+ *
+ * Not exported from any public package entry point.
+ * This helper is internal-only until DPoP is wired into acquisition flows
+ * in a subsequent work item.
+ *
+ * DPoP proofs do not contain SHR fields (at, ts, m, u, p, q).
+ * @internal
+ */
+class DpopProofGenerator {
+    constructor(cryptoUtils, tokenBindingKeyManager) {
+        this.cryptoUtils = cryptoUtils;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
+    }
+    /**
+     * Provisions a fresh DPoP key and returns the RFC 7638 JWK thumbprint used
+     * as `dpop_jkt`.
+     */
+    async generateJkt(correlationId = "") {
+        return this.tokenBindingKeyManager.provisionTokenBindingKey({
+            tokenBindingKeyType: DPOP_TOKEN_BINDING_KEY_TYPE,
+            tokenBindingKeyAlgorithm: DPOP_JWT_HEADER_ALGORITHM,
+            correlationId,
+        });
+    }
+    /**
+     * Builds RFC 9449 claims for a token-endpoint DPoP proof.
+     * - htm is always "POST" because token endpoint requests use HTTP POST (RFC 9449 §5).
+     * - htu is the normalized token endpoint URI (query and fragment stripped).
+     * - jti is a fresh CSPRNG-backed unique identifier for every proof.
+     */
+    buildTokenProofClaims(params, correlationId = "") {
+        validateDpopNonce(params.nonce, correlationId);
+        const claims = {
+            jti: this.cryptoUtils.createNewGuid(),
+            htm: "POST",
+            htu: normalizeHtu(params.tokenEndpoint, correlationId),
+            iat: nowSeconds(),
+        };
+        if (params.nonce !== undefined) {
+            claims.nonce = params.nonce;
+        }
+        return claims;
+    }
+    /**
+     * Builds and signs a compact DPoP proof JWT for a token-endpoint request.
+     */
+    async generateTokenProof(params, keyId, correlationId = "") {
+        return this.generateProof(this.buildTokenProofClaims(params, correlationId), keyId, correlationId);
+    }
+    /**
+     * Builds RFC 9449 claims for a resource-endpoint DPoP proof.
+     * - htm is uppercased per RFC 9449 §4.2.
+     * - htu is the normalized resource URI (query and fragment stripped).
+     * - ath is the base64url-encoded SHA-256 hash of the ASCII access token.
+     * - jti is a fresh CSPRNG-backed unique identifier for every proof.
+     */
+    buildResourceProofClaims(params, correlationId = "") {
+        validateDpopNonce(params.nonce, correlationId);
+        const claims = {
+            jti: this.cryptoUtils.createNewGuid(),
+            htm: normalizeHtm(params.htm, correlationId),
+            htu: normalizeHtu(params.htu, correlationId),
+            ath: params.ath,
+            iat: nowSeconds(),
+        };
+        if (params.nonce !== undefined) {
+            claims.nonce = params.nonce;
+        }
+        return claims;
+    }
+    /**
+     * Builds and signs a compact DPoP proof JWT for a resource request.
+     */
+    async generateResourceProof(params, keyId, correlationId = "") {
+        const { htu, htm, nonce } = params;
+        if (!htu || !htm) {
+            throw createClientConfigurationError(dpopMissingResourceContext, correlationId);
+        }
+        const ath = await this.cryptoUtils.hashString(params.accessToken);
+        return this.generateProof(this.buildResourceProofClaims({
+            htu,
+            htm,
+            ath,
+            nonce,
+        }, correlationId), keyId, correlationId);
+    }
+    async generateProof(claims, keyId, correlationId) {
+        const publicJwk = await this.tokenBindingKeyManager.getTokenBindingPublicKeyJwk(keyId, correlationId);
+        return this.cryptoUtils.signTokenBindingJwt(buildProofHeader(publicJwk, correlationId), claims, keyId, correlationId);
     }
 }
 
@@ -6364,10 +6700,11 @@ var ProtocolUtils = /*#__PURE__*/Object.freeze({
  * @internal
  */
 class ResponseHandler {
-    constructor(clientId, cacheStorage, cryptoObj, logger, performanceClient, serializableCache, persistencePlugin) {
+    constructor(clientId, cacheStorage, cryptoObj, logger, performanceClient, serializableCache, persistencePlugin, tokenBindingKeyManager = DEFAULT_TOKEN_BINDING_KEY_MANAGER) {
         this.clientId = clientId;
         this.cacheStorage = cacheStorage;
         this.cryptoObj = cryptoObj;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
         this.logger = logger;
         this.performanceClient = performanceClient;
         this.serializableCache = serializableCache;
@@ -6441,7 +6778,21 @@ class ResponseHandler {
         }
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
-            serverTokenResponse.key_id || request.sshKid || undefined;
+            serverTokenResponse.key_id ||
+                request.dpopJkt ||
+                request.sshKid ||
+                undefined;
+        if (request.authenticationScheme === AuthenticationScheme.DPOP) {
+            if (serverTokenResponse.token_type?.toLowerCase() !==
+                AuthenticationScheme.DPOP.toLowerCase()) {
+                this.performanceClient?.addFields({
+                    dpopTokenTypeMismatch: serverTokenResponse.token_type,
+                }, request.correlationId);
+                throw createClientAuthError(dpopTokenTypeMismatch, request.correlationId);
+            }
+            serverTokenResponse.token_type =
+                AuthenticationScheme.DPOP;
+        }
         // Compute components once for entity storage (fallback if hash not provided by client)
         const attributeTokenPartition = serializeAttributeTokens(request.attributeTokens);
         const cacheKeyComponents = additionalCacheKeyComponents ??
@@ -6476,7 +6827,12 @@ class ResponseHandler {
                     this.performanceClient?.addFields({
                         acntLoggedOut: true,
                     }, request.correlationId);
-                    return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, undefined, serverRequestId);
+                    return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, {
+                        idTokenClaims,
+                        requestState: requestStateObj,
+                        requestId: serverRequestId,
+                        tokenBindingKeyManager: this.tokenBindingKeyManager,
+                    });
                 }
             }
             await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), apiId, request.storeInCache);
@@ -6489,7 +6845,13 @@ class ResponseHandler {
                 await this.persistencePlugin.afterCacheAccess(cacheContext);
             }
         }
-        return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, serverTokenResponse, serverRequestId);
+        return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, {
+            idTokenClaims,
+            requestState: requestStateObj,
+            serverTokenResponse,
+            requestId: serverRequestId,
+            tokenBindingKeyManager: this.tokenBindingKeyManager,
+        });
     }
     /**
      * Generates CacheRecord
@@ -6585,14 +6947,17 @@ class ResponseHandler {
      * @param fromTokenCache
      * @param stateString
      */
-    static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, performanceClient, idTokenClaims, requestState, serverTokenResponse, requestId) {
+    static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, performanceClient, options = {}) {
+        const { idTokenClaims, requestState, serverTokenResponse, requestId, tokenBindingKeyManager = DEFAULT_TOKEN_BINDING_KEY_MANAGER, } = options;
         let accessToken = "";
         let responseScopes = [];
         let expiresOn = null;
         let extExpiresOn;
         let refreshOn;
         let familyId = "";
+        let dpopProof;
         if (cacheRecord.accessToken) {
+            const accessTokenType = cacheRecord.accessToken.tokenType?.toLowerCase();
             /*
              * if the request object has `popKid` property, `signPopToken` will be set to false and
              * the token will be returned unsigned
@@ -6600,7 +6965,7 @@ class ResponseHandler {
             if (cacheRecord.accessToken.tokenType ===
                 AuthenticationScheme.POP &&
                 !request.popKid) {
-                const popTokenGenerator = new PopTokenGenerator(cryptoObj, performanceClient);
+                const popTokenGenerator = new PopTokenGenerator(cryptoObj, tokenBindingKeyManager, performanceClient);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
                     throw createClientAuthError(keyIdMissing, request.correlationId);
@@ -6610,6 +6975,18 @@ class ResponseHandler {
             else {
                 accessToken = cacheRecord.accessToken.secret;
             }
+            if (accessTokenType ===
+                AuthenticationScheme.DPOP.toLowerCase()) {
+                if (!cacheRecord.accessToken.keyId) {
+                    throw createClientAuthError(keyIdMissing, request.correlationId);
+                }
+                const dpopProofGenerator = new DpopProofGenerator(cryptoObj, tokenBindingKeyManager);
+                dpopProof = await dpopProofGenerator.generateResourceProof({
+                    htu: request.resourceRequestUri,
+                    htm: request.resourceRequestMethod,
+                    accessToken: cacheRecord.accessToken.secret,
+                }, cacheRecord.accessToken.keyId, request.correlationId);
+            }
             responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target, request.correlationId).asArray();
             // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
             expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
@@ -6626,6 +7003,15 @@ class ResponseHandler {
         }
         const uid = idTokenClaims?.oid || idTokenClaims?.sub || "";
         const tid = idTokenClaims?.tid || "";
+        /*
+         * Surface the sovereign enclave for telemetry. This runs for both freshly acquired
+         * and cache-served tokens because SilentFlowClient shares this method, so the field
+         * is present on silent requests that never hit the network.
+         */
+        const regionSubScope = idTokenClaims?.tenant_region_sub_scope;
+        if (typeof regionSubScope === "string") {
+            performanceClient?.addFields({ regionSubScope }, request.correlationId);
+        }
         // for hybrid + native bridge enablement, send back the native account Id
         if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
             // Set on deprecated top-level for downgrade compat
@@ -6654,6 +7040,7 @@ class ResponseHandler {
             idToken: cacheRecord?.idToken?.secret || "",
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken,
+            dpopProof,
             fromCache: fromTokenCache,
             expiresOn: expiresOn,
             extExpiresOn: extExpiresOn,
@@ -6661,7 +7048,10 @@ class ResponseHandler {
             correlationId: request.correlationId,
             requestId: requestId || "",
             familyId: familyId,
-            tokenType: cacheRecord.accessToken?.tokenType || "",
+            tokenType: cacheRecord.accessToken?.tokenType?.toLowerCase() ===
+                AuthenticationScheme.DPOP.toLowerCase()
+                ? AuthenticationScheme.DPOP
+                : cacheRecord.accessToken?.tokenType || "",
             state: requestState ? requestState.userRequestState : "",
             cloudGraphHostName: cacheRecord.account?.cloudGraphHostName || "",
             msGraphHost: cacheRecord.account?.msGraphHost || "",
@@ -6907,6 +7297,23 @@ function createTokenRequestHeaders(logger, preventCorsPreflight, ccsCred) {
     }
     return headers;
 }
+/**
+ * Adds the DPoP proof header for token endpoint requests when DPoP is requested.
+ * @internal
+ */
+async function addDpopTokenProofHeader(headers, request, tokenEndpoint, cryptoUtils, tokenBindingKeyManager) {
+    if (request.authenticationScheme !== AuthenticationScheme.DPOP) {
+        return;
+    }
+    const dpopProofGenerator = new DpopProofGenerator(cryptoUtils, tokenBindingKeyManager);
+    const keyId = request.dpopJkt;
+    if (!keyId?.trim()) {
+        throw createClientAuthError(keyIdMissing, request.correlationId);
+    }
+    headers[HeaderNames.DPOP] = await dpopProofGenerator.generateTokenProof({
+        tokenEndpoint,
+    }, keyId, request.correlationId);
+}
 /**
  * Creates query string for the /token request
  * @param request
@@ -6995,6 +7402,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
 
 var Token = /*#__PURE__*/Object.freeze({
     __proto__: null,
+    addDpopTokenProofHeader: addDpopTokenProofHeader,
     createTokenQueryParameters: createTokenQueryParameters,
     createTokenRequestHeaders: createTokenRequestHeaders,
     executePostToTokenEndpoint: executePostToTokenEndpoint,
@@ -7049,7 +7457,7 @@ class AuthorizationCodeClient {
         const response = await invokeAsync(this.executeTokenRequest.bind(this), AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request, this.serverTelemetryManager);
         // Retrieve requestId from response headers
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
-        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
+        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin, this.config.tokenBindingKeyManager);
         // Validate response. This function throws a server error if an error is returned by the server.
         responseHandler.validateTokenResponse(response.body, request.correlationId);
         return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, authCodePayload, undefined, undefined, undefined, requestId);
@@ -7091,6 +7499,7 @@ class AuthorizationCodeClient {
             }
         }
         const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, ccsCredential || request.ccsCredential);
+        await addDpopTokenProofHeader(headers, request, endpoint, this.cryptoUtils, this.config.tokenBindingKeyManager);
         const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
         return invokeAsync(executePostToTokenEndpoint, AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, serverTelemetryManager);
     }
@@ -7150,7 +7559,7 @@ class AuthorizationCodeClient {
         addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
         addClientInfo(parameters);
         if (request.authenticationScheme === AuthenticationScheme.POP) {
-            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
+            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.config.tokenBindingKeyManager, this.performanceClient);
             let reqCnfData;
             if (!request.popKid) {
                 const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
@@ -7295,7 +7704,7 @@ class RefreshTokenClient {
         const response = await invokeAsync(this.executeTokenRequest.bind(this), RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
         // Retrieve requestId from response headers
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
-        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
+        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin, this.config.tokenBindingKeyManager);
         responseHandler.validateTokenResponse(response.body, request.correlationId);
         return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, undefined, undefined, true, request.forceCache, requestId);
     }
@@ -7371,6 +7780,12 @@ class RefreshTokenClient {
                 type: CcsCredentialType.HOME_ACCOUNT_ID,
             },
         };
+        if (refreshTokenRequest.authenticationScheme ===
+            AuthenticationScheme.DPOP &&
+            !refreshTokenRequest.dpopJkt) {
+            const dpopProofGenerator = new DpopProofGenerator(this.cryptoUtils, this.config.tokenBindingKeyManager);
+            refreshTokenRequest.dpopJkt = await dpopProofGenerator.generateJkt(request.correlationId);
+        }
         try {
             return await invokeAsync(this.acquireToken.bind(this), RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest, apiId);
         }
@@ -7396,6 +7811,7 @@ class RefreshTokenClient {
         const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
         const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
         const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, request.ccsCredential);
+        await addDpopTokenProofHeader(headers, request, endpoint, this.cryptoUtils, this.config.tokenBindingKeyManager);
         const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
         return invokeAsync(executePostToTokenEndpoint, RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, this.serverTelemetryManager);
     }
@@ -7436,7 +7852,7 @@ class RefreshTokenClient {
             addClientAssertionType(parameters, clientAssertion.assertionType);
         }
         if (request.authenticationScheme === AuthenticationScheme.POP) {
-            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
+            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.config.tokenBindingKeyManager, this.performanceClient);
             let reqCnfData;
             if (!request.popKid) {
                 const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
@@ -7554,6 +7970,22 @@ class SilentFlowClient {
             lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
             // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
         }
+        const cachedAccessTokenType = cachedAccessToken.tokenType?.toLowerCase();
+        if (cachedAccessTokenType === AuthenticationScheme.DPOP.toLowerCase()) {
+            if (!cachedAccessToken.keyId) {
+                this.logger.info("SilentFlowClient:acquireCachedToken - Cached DPoP access token is missing keyId; refresh required", request.correlationId);
+                this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+                throw createClientAuthError(tokenRefreshRequired, request.correlationId);
+            }
+            try {
+                await this.config.tokenBindingKeyManager.getTokenBindingPublicKeyJwk(cachedAccessToken.keyId, request.correlationId);
+            }
+            catch {
+                this.logger.info("SilentFlowClient:acquireCachedToken - Local DPoP key was not found for cached access token; refresh required", request.correlationId);
+                this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+                throw createClientAuthError(tokenRefreshRequired, request.correlationId);
+            }
+        }
         const environment = request.authority || this.authority.getPreferredCache();
         const cacheRecord = {
             account: this.cacheManager.getAccount(this.cacheManager.generateAccountKey(request.account), request.correlationId),
@@ -7589,7 +8021,10 @@ class SilentFlowClient {
         if (cacheRecord.idToken) {
             idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode, request.correlationId);
         }
-        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
+        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, {
+            idTokenClaims,
+            tokenBindingKeyManager: this.config.tokenBindingKeyManager,
+        });
     }
 }
 
@@ -8286,12 +8721,14 @@ exports.ClientConfigurationErrorCodes = ClientConfigurationErrorCodes;
 exports.Constants = Constants;
 exports.DEFAULT_CRYPTO_IMPLEMENTATION = DEFAULT_CRYPTO_IMPLEMENTATION;
 exports.DEFAULT_SYSTEM_OPTIONS = DEFAULT_SYSTEM_OPTIONS;
+exports.DEFAULT_TOKEN_BINDING_KEY_MANAGER = DEFAULT_TOKEN_BINDING_KEY_MANAGER;
 exports.DefaultStorageClass = DefaultStorageClass;
 exports.EXT_FIELD_PREFIX = EXT_FIELD_PREFIX;
 exports.IntFields = IntFields;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
 exports.InteractionRequiredAuthErrorCodes = InteractionRequiredAuthErrorCodes;
-exports.JsonWebTokenTypes = JsonWebTokenTypes;
+exports.JoseHeader = JoseHeader;
+exports.JsonWebTokenAlgorithms = JsonWebTokenAlgorithms;
 exports.Logger = Logger;
 exports.NetworkError = NetworkError;
 exports.PerformanceEventStatus = PerformanceEventStatus;
@@ -8340,4 +8777,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-3p7V__ym.js.map
+//# sourceMappingURL=index-node-l_NIe8t5.js.map