@azure/msal-common 16.15.0 → 16.16.1

package/dist/error/CacheError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { cacheErrorUnknown, cacheQuotaExceeded } from './CacheErrorCodes.mjs';
 import * as CacheErrorCodes from './CacheErrorCodes.mjs';

package/dist/error/CacheErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/ClientAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/ClientAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/ClientConfigurationError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/ClientConfigurationErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/InteractionRequiredAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 import { interactionRequired, consentRequired, loginRequired, badToken, uiNotAllowed, interruptedUser } from './InteractionRequiredAuthErrorCodes.mjs';

package/dist/error/InteractionRequiredAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/JoseHeaderError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/JoseHeaderErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/NetworkError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/PlatformBrokerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/error/ServerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/index-node.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };
@@ -39,6 +39,7 @@ export { Constants };
 export { DEFAULT_CRYPTO_IMPLEMENTATION, JsonWebTokenAlgorithms } from './crypto/ICrypto.mjs';
 export { DEFAULT_SYSTEM_OPTIONS, buildClientConfiguration } from './config/ClientConfiguration.mjs';
 export { DEFAULT_TOKEN_BINDING_KEY_MANAGER } from './crypto/ITokenBindingKeyManager.mjs';
+export { DpopProofGenerator, normalizeDpopResourceRequestContext } from './crypto/DpopProofGenerator.mjs';
 export { IntFields, PerformanceEventStatus } from './telemetry/performance/PerformanceEvent.mjs';
 export { InteractionRequiredAuthError, createInteractionRequiredAuthError } from './error/InteractionRequiredAuthError.mjs';
 import * as InteractionRequiredAuthErrorCodes from './error/InteractionRequiredAuthErrorCodes.mjs';

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/logger/Logger.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/network/INetworkModule.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist/network/RequestThumbprint.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { serializeAttributeTokens } from '../cache/utils/CacheHelpers.mjs';
 

package/dist/network/ResponseHeaders.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/network/ThrottlingUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { THROTTLING_PREFIX, DEFAULT_THROTTLE_TIME_SECONDS, DEFAULT_MAX_THROTTLE_TIME_SECONDS, HeaderNames } from '../utils/Constants.mjs';
 import { ServerError } from '../error/ServerError.mjs';

package/dist/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.15.0";
+const version = "16.16.1";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware, addPopupOriginCheckDone } from '../request/RequestParameterBuilder.mjs';
 import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';

package/dist/protocol/Token.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { CcsCredentialType } from '../account/CcsCredential.mjs';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';

package/dist/request/AuthenticationHeaderParser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { HeaderNames } from '../utils/Constants.mjs';

package/dist/request/BaseAuthRequest.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';

package/dist/request/RequestParameterBuilder.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { OIDC_DEFAULT_SCOPES, HeaderNames, CLIENT_INFO, PasswordGrantConstants, AuthenticationScheme, ResponseMode, X_MS_LIB_CAPABILITY_VALUE, ClaimsRequestKeys } from '../utils/Constants.mjs';
 import { X_APP_NAME, X_APP_VER, ATTRIBUTE_TOKENS, CODE, BROKER_CLIENT_ID, BROKER_REDIRECT_URI, CLAIMS, CLI_DATA, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, CLIENT_ID, CLIENT_SECRET, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE_VERIFIER, CLIENT_REQUEST_ID, DEVICE_CODE, DOMAIN_HINT, EAR_JWK, EAR_JWE_CRYPTO, GRANT_TYPE, ID_TOKEN_HINT, INSTANCE_AWARE, X_CLIENT_SKU, X_CLIENT_VER, X_CLIENT_OS, X_CLIENT_CPU, LOGIN_HINT, LOGOUT_HINT, NATIVE_BROKER, NONCE, OBO_ASSERTION, TOKEN_TYPE, REQ_CNF, POPUP_ORIGIN_CHECK_DONE, POST_LOGOUT_URI, PROMPT, REDIRECT_URI, REFRESH_TOKEN, REQUESTED_TOKEN_USE, RESOURCE, RESPONSE_MODE, RESPONSE_TYPE, SCOPE, X_CLIENT_CURR_TELEM, X_CLIENT_LAST_TELEM, SID, STATE, X_MS_LIB_CAPABILITY } from '../constants/AADServerParamKeys.mjs';

package/dist/request/ScopeSet.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist/response/ResponseHandler.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { updateAccountTenantProfileData, buildTenantProfile } from '../account/AccountInfo.mjs';
 import { extractTokenClaims, isKmsi } from '../account/AuthToken.mjs';

package/dist/telemetry/performance/PerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { getAndFlushLogsFromCache } from '../../logger/Logger.mjs';
 import { IntFields, PerformanceEventStatus, EXT_FIELD_PREFIX } from './PerformanceEvent.mjs';

package/dist/telemetry/performance/PerformanceEvent.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/telemetry/performance/PerformanceEvents.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/telemetry/performance/StubPerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { PerformanceEventStatus } from './PerformanceEvent.mjs';
 

package/dist/telemetry/server/ServerTelemetryManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { CacheOutcome, SERVER_TELEM_CACHE_KEY, CACHE_KEY_SEPARATOR, SERVER_TELEM_SCHEMA_VERSION, SERVER_TELEM_CATEGORY_SEPARATOR, SERVER_TELEM_VALUE_SEPARATOR, SERVER_TELEM_MAX_CACHED_ERRORS, SERVER_TELEM_UNKNOWN_ERROR, SERVER_TELEM_MAX_LAST_HEADER_BYTES, SERVER_TELEM_OVERFLOW_TRUE, SERVER_TELEM_OVERFLOW_FALSE } from '../../utils/Constants.mjs';
 import { AuthError } from '../../error/AuthError.mjs';

package/dist/url/UrlString.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist/utils/ClientAssertionUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/Constants.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/FunctionWrappers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/ObjectUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/ProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { RESOURCE_DELIM } from './Constants.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist/utils/StringUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/TimeUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/UrlUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';

package/dist-browser/account/AccountInfo.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { isKmsi } from './AuthToken.mjs';
 

package/dist-browser/account/AuthToken.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { tokenParsingError, nullOrEmptyToken } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/account/CcsCredential.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/account/ClientInfo.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { CLIENT_INFO_SEPARATOR } from '../utils/Constants.mjs';

package/dist-browser/account/TokenClaims.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/Authority.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { AuthorityType } from './AuthorityType.mjs';
 import { isOpenIdConfigResponse } from './OpenIdConfigResponse.mjs';

package/dist-browser/authority/AuthorityFactory.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { Authority, formatAuthorityUri } from './Authority.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist-browser/authority/AuthorityMetadata.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { UrlString } from '../url/UrlString.mjs';
 import { AuthorityMetadataSource } from '../utils/Constants.mjs';

package/dist-browser/authority/AuthorityOptions.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/AuthorityType.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/CloudInstanceDiscoveryErrorResponse.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/CloudInstanceDiscoveryResponse.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/OpenIdConfigResponse.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/ProtocolMode.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/RegionDiscovery.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { IMDS_VERSION, HTTP_SUCCESS, RegionDiscoverySources, HTTP_BAD_REQUEST, IMDS_ENDPOINT, IMDS_TIMEOUT } from '../utils/Constants.mjs';
 import { RegionDiscoveryGetRegionFromIMDS, RegionDiscoveryGetCurrentVersion } from '../telemetry/performance/PerformanceEvents.mjs';

package/dist-browser/cache/CacheManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.15.0 2026-10-27 */
+/*! @azure/msal-common v16.16.1 2026-11-06 */
 'use strict';
 import { updateAccountTenantProfileData } from '../account/AccountInfo.mjs';
 import { extractTokenClaims } from '../account/AuthToken.mjs';
@@ -260,6 +260,7 @@ class CacheManager {
         };
         const tokenKeys = this.getTokenKeys();
         const currentScopes = ScopeSet.fromString(credential.target, correlationId);
+        const accessTokenKeysToRemove = [];
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                 return;
@@ -269,10 +270,13 @@ class CacheManager {
                 this.credentialMatchesFilter(tokenEntity, accessTokenFilter, correlationId)) {
                 const tokenScopeSet = ScopeSet.fromString(tokenEntity.target, correlationId);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                    this.removeAccessToken(key, correlationId);
+                    accessTokenKeysToRemove.push(key);
                 }
             }
         });
+        for (const key of accessTokenKeysToRemove) {
+            await this.removeAccessTokenAndTokenBindingKey(key, correlationId, credential.keyId);
+        }
         await this.setAccessTokenCredential(credential, correlationId, kmsi, additionalCacheKeyHash);
     }
     /**
@@ -471,19 +475,25 @@ class CacheManager {
      * @param account
      */
     removeAccount(account, correlationId) {
-        this.removeAccountContext(account, correlationId);
         const accountKeys = this.getAccountKeys();
         const keyFilter = (key) => {
             return (key.includes(account.homeAccountId) &&
                 key.includes(account.environment));
         };
+        this.getTokenKeys()
+            .idToken.filter(keyFilter)
+            .forEach((key) => {
+            this.removeIdToken(key, correlationId);
+        });
+        this.removeAccountContext(account, correlationId);
         accountKeys.filter(keyFilter).forEach((key) => {
             this.removeItem(key, correlationId);
             this.performanceClient.incrementFields({ accountsRemoved: 1 }, correlationId);
         });
     }
     /**
-     * Removes credentials associated with the provided account
+     * Removes access and refresh tokens associated with the provided account,
+     * preserving the account and its ID tokens.
      * @param account
      */
     removeAccountContext(account, correlationId) {
@@ -492,9 +502,6 @@ class CacheManager {
             return (key.includes(account.homeAccountId) &&
                 key.includes(account.environment));
         };
-        allTokenKeys.idToken.filter(keyFilter).forEach((key) => {
-            this.removeIdToken(key, correlationId);
-        });
         allTokenKeys.accessToken.filter(keyFilter).forEach((key) => {
             this.removeAccessToken(key, correlationId);
         });
@@ -508,12 +515,32 @@ class CacheManager {
      * @param correlationId
      */
     removeAccessToken(key, correlationId) {
+        const credential = this.removeAccessTokenCredential(key, correlationId);
+        if (credential) {
+            void this.removeTokenBindingKeyForCredential(credential, correlationId);
+        }
+    }
+    /**
+     * Removes an access token and waits for any unreferenced token-binding key
+     * cleanup. Internal callers that require deterministic cleanup should use
+     * this method instead of the synchronous public cache contract.
+     */
+    async removeAccessTokenAndTokenBindingKey(key, correlationId, preservedKeyId) {
+        const credential = this.removeAccessTokenCredential(key, correlationId);
+        if (credential) {
+            await this.removeTokenBindingKeyForCredential(credential, correlationId, preservedKeyId);
+        }
+    }
+    removeAccessTokenCredential(key, correlationId) {
         const credential = this.getAccessTokenCredential(key, correlationId);
         if (!credential) {
-            return;
+            return null;
         }
         this.removeItem(key, correlationId);
         this.performanceClient.incrementFields({ accessTokensRemoved: 1 }, correlationId);
+        return credential;
+    }
+    async removeTokenBindingKeyForCredential(credential, correlationId, preservedKeyId) {
         // Remove Token Binding Key from key store for token-bound access token credentials
         if (credential.credentialType.toLowerCase() ===
             CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
@@ -523,19 +550,28 @@ class CacheManager {
                 case AuthenticationScheme.DPOP.toLowerCase(): {
                     const accessTokenWithAuthSchemeEntity = credential;
                     const kid = accessTokenWithAuthSchemeEntity.keyId;
-                    if (kid) {
-                        void this.tokenBindingKeyManager
-                            .removeTokenBindingKey(kid, correlationId)
-                            .catch(() => {
+                    if (kid &&
+                        kid !== preservedKeyId &&
+                        !this.isTokenBindingKeyReferenced(kid, correlationId)) {
+                        try {
+                            await this.tokenBindingKeyManager.removeTokenBindingKey(kid, correlationId);
+                        }
+                        catch {
                             this.commonLogger.error("0id34f", correlationId);
                             this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
-                        });
+                        }
                     }
                     break;
                 }
             }
         }
     }
+    isTokenBindingKeyReferenced(keyId, correlationId) {
+        return this.getTokenKeys().accessToken.some((accessTokenKey) => {
+            const accessToken = this.getAccessTokenCredential(accessTokenKey, correlationId);
+            return accessToken?.keyId === keyId;
+        });
+    }
     /**
      * Removes all app metadata objects from cache.
      */
@@ -674,6 +710,7 @@ class CacheManager {
         const scopes = ScopeSet.createSearchScopes(request.scopes, correlationId);
         const authScheme = request.authenticationScheme ||
             AuthenticationScheme.BEARER;
+        const normalizedAuthScheme = authScheme.toLowerCase();
         /*
          * Distinguish between Bearer and PoP/SSH token cache types
          * Cast to lowercase to handle "bearer" from ADFS
@@ -699,7 +736,10 @@ class CacheManager {
             tokenType: authScheme,
             keyId: authScheme === AuthenticationScheme.SSH
                 ? request.sshKid
-                : undefined,
+                : normalizedAuthScheme ===
+                    AuthenticationScheme.DPOP.toLowerCase()
+                    ? request.popKid || request.dpopJkt
+                    : undefined,
             additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
         const accessTokenKeys = (tokenKeys && tokenKeys.accessToken) ||