@azure/msal-common 16.12.0 → 16.14.0

package/src/crypto/PublicJsonWebKey.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * Environment-neutral representation of the public asymmetric JWK fields
+ * used by token-binding implementations.
+ *
+ * @internal
+ */
+export type PublicJsonWebKey = {
+    alg?: string;
+    crv?: string;
+    e?: string;
+    ext?: boolean;
+    key_ops?: string[];
+    kid?: string;
+    kty?: string;
+    n?: string;
+    use?: string;
+    x?: string;
+    y?: string;
+};

package/src/error/ClientAuthErrorCodes.ts

@@ -27,6 +27,7 @@ export const invalidCacheEnvironment = "invalid_cache_environment";
 export const noAccountFound = "no_account_found";
 export const noCryptoObject = "no_crypto_object";
 export const unexpectedCredentialType = "unexpected_credential_type";
+export const dpopTokenTypeMismatch = "dpop_token_type_mismatch";
 export const tokenRefreshRequired = "token_refresh_required";
 export const tokenClaimsCnfRequiredForSignedJwt =
     "token_claims_cnf_required_for_signedjwt";

package/src/error/ClientConfigurationErrorCodes.ts

@@ -19,6 +19,8 @@ export const invalidAuthorityMetadata = "invalid_authority_metadata";
 export const untrustedAuthority = "untrusted_authority";
 export const missingSshJwk = "missing_ssh_jwk";
 export const missingSshKid = "missing_ssh_kid";
+export const unsupportedAuthenticationScheme =
+    "unsupported_authentication_scheme";
 export const missingNonceAuthenticationHeader =
     "missing_nonce_authentication_header";
 export const invalidAuthenticationHeader = "invalid_authentication_header";
@@ -32,3 +34,5 @@ export const issuerValidationFailed = "issuer_validation_failed";
 export const invalidResponseMode = "invalid_response_mode";
 export const invalidDpopHtm = "invalid_dpop_htm";
 export const invalidDpopHtu = "invalid_dpop_htu";
+export const invalidDpopNonce = "invalid_dpop_nonce";
+export const dpopMissingResourceContext = "dpop_missing_resource_context";

package/src/error/JoseHeaderErrorCodes.ts

@@ -5,3 +5,5 @@
 
 export const missingKidError = "missing_kid_error";
 export const missingAlgError = "missing_alg_error";
+export const missingJwkError = "missing_jwk_error";
+export const invalidJwkError = "invalid_jwk_error";

package/src/exports-common.ts

@@ -104,7 +104,14 @@ export {
     PkceCodes,
     DEFAULT_CRYPTO_IMPLEMENTATION,
     SignedHttpRequestParameters,
+    JsonWebTokenAlgorithms,
 } from "./crypto/ICrypto.js";
+export {
+    ITokenBindingKeyManager,
+    DEFAULT_TOKEN_BINDING_KEY_MANAGER,
+    TokenBindingKeyProvisioningParameters,
+} from "./crypto/ITokenBindingKeyManager.js";
+export { PublicJsonWebKey } from "./crypto/PublicJsonWebKey.js";
 
 export * as AuthorizeProtocol from "./protocol/Authorize.js";
 export * as TokenProtocol from "./protocol/Token.js";
@@ -127,6 +134,7 @@ export { AuthorizationCodePayload } from "./response/AuthorizationCodePayload.js
 export { AuthorizeResponse } from "./response/AuthorizeResponse.js";
 export { ServerAuthorizationTokenResponse } from "./response/ServerAuthorizationTokenResponse.js";
 export {
+    GenerateAuthenticationResultOptions,
     ResponseHandler,
     buildAccountToCache,
 } from "./response/ResponseHandler.js";

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.12.0";
+export const version = "16.14.0";

package/src/protocol/Token.ts

@@ -5,9 +5,14 @@
 
 import { CcsCredential, CcsCredentialType } from "../account/CcsCredential.js";
 import { buildClientInfoFromHomeAccountId } from "../account/ClientInfo.js";
+import { DpopProofGenerator } from "../crypto/DpopProofGenerator.js";
 import { Logger } from "../logger/Logger.js";
 import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
-import { HeaderNames, URL_FORM_CONTENT_TYPE } from "../utils/Constants.js";
+import {
+    AuthenticationScheme,
+    HeaderNames,
+    URL_FORM_CONTENT_TYPE,
+} from "../utils/Constants.js";
 import * as RequestParameterBuilder from "../request/RequestParameterBuilder.js";
 import * as UrlUtils from "../utils/UrlUtils.js";
 import { IPerformanceClient } from "../exports-browser-only.js";
@@ -29,6 +34,8 @@ import { invokeAsync } from "../utils/FunctionWrappers.js";
 import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
 import { CacheManager } from "../cache/CacheManager.js";
 import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { ITokenBindingKeyManager } from "../crypto/ITokenBindingKeyManager.js";
 
 /**
  * Creates default headers for requests to token endpoint
@@ -65,6 +72,42 @@ export function createTokenRequestHeaders(
     return headers;
 }
 
+/**
+ * Adds the DPoP proof header for token endpoint requests when DPoP is requested.
+ * @internal
+ */
+export async function addDpopTokenProofHeader(
+    headers: Record<string, string>,
+    request: BaseAuthRequest,
+    tokenEndpoint: string,
+    cryptoUtils: ICrypto,
+    tokenBindingKeyManager: ITokenBindingKeyManager
+): Promise<void> {
+    if (request.authenticationScheme !== AuthenticationScheme.DPOP) {
+        return;
+    }
+
+    const dpopProofGenerator = new DpopProofGenerator(
+        cryptoUtils,
+        tokenBindingKeyManager
+    );
+    const keyId = request.dpopJkt;
+    if (!keyId?.trim()) {
+        throw createClientAuthError(
+            ClientAuthErrorCodes.keyIdMissing,
+            request.correlationId
+        );
+    }
+
+    headers[HeaderNames.DPOP] = await dpopProofGenerator.generateTokenProof(
+        {
+            tokenEndpoint,
+        },
+        keyId,
+        request.correlationId
+    );
+}
+
 /**
  * Creates query string for the /token request
  * @param request

package/src/request/BaseAuthRequest.ts

@@ -87,6 +87,11 @@ export type BaseAuthRequest = {
      * Key ID to identify the public key for PoP token request
      */
     popKid?: string;
+    /**
+     * JWK thumbprint for the browser-managed DPoP key bound to this request.
+     * @internal
+     */
+    dpopJkt?: string;
     /**
      * Embedded client id. When specified, broker client id (brk_client_id) and redirect uri (brk_redirect_uri) params are set with values from the config, overriding the corresponding extra parameters, if present.
      */

package/src/request/CommonAuthorizationUrlRequest.ts

@@ -73,4 +73,9 @@ export type CommonAuthorizationUrlRequest = BaseAuthRequest & {
      * Indicates whether this authorization request is being initiated by a platform authentication broker instead of a standard web flow.
      */
     platformBroker?: boolean;
+    /**
+     * Precomputed req_cnf value for platform-broker PoP authorization requests.
+     * @internal
+     */
+    reqCnf?: string;
 };

package/src/request/RequestParameterBuilder.ts

@@ -491,11 +491,15 @@ export function addExtraParameters(
 
 /**
  * Default optional idToken claims requested on all auth requests.
- * signin_state enables KMSI detection; login_hint enables login hint propagation.
+ * signin_state enables KMSI detection; login_hint enables login hint propagation;
+ * tenant_region_sub_scope identifies the sovereign enclave a tenant belongs to.
  */
 const DEFAULT_ID_TOKEN_CLAIMS: Record<string, { essential: false }> = {
     [Constants.ClaimsRequestKeys.SIGNIN_STATE]: { essential: false },
     [Constants.ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
+    [Constants.ClaimsRequestKeys.TENANT_REGION_SUB_SCOPE]: {
+        essential: false,
+    },
 };
 
 /**
@@ -570,8 +574,8 @@ function deepMergeClaims(
 /**
  * Parses claims JSON, optionally deep-merges a second client-originated claims string
  * (`claimsToMerge`, e.g. `claimsFromClient`) with precedence on conflicting keys, merges
- * default optional idToken claims (signin_state, login_hint), and appends client
- * capabilities (xms_cc) to the access_token section.
+ * default optional idToken claims (signin_state, login_hint, tenant_region_sub_scope), and appends client
+ * capabilities (xms_cc) to the access_token section
  * Does not overwrite idToken claims already specified by the caller.
  * @param claims - Existing claims JSON string from the request (may be undefined)
  * @param clientCapabilities - Client capabilities array from configuration

package/src/response/AuthenticationResult.ts

@@ -14,6 +14,7 @@ import { AccountInfo } from "../account/AccountInfo.js";
  * - idToken                - Id token received as part of the response
  * - idTokenClaims          - MSAL-relevant ID token claims
  * - accessToken            - Access token or SSH certificate received as part of the response
+ * - dpopProof              - DPoP proof JWT to send with the access token for resource requests
  * - fromCache              - Boolean denoting whether token came from cache
  * - expiresOn              - Javascript Date object representing relative expiration of access token
  * - extExpiresOn           - Javascript Date object representing extended relative expiration of access token in case of server outage
@@ -31,6 +32,7 @@ export type AuthenticationResult = {
     idToken: string;
     idTokenClaims: object;
     accessToken: string;
+    dpopProof?: string;
     fromCache: boolean;
     expiresOn: Date | null;
     extExpiresOn?: Date;

package/src/response/ResponseHandler.ts

@@ -28,6 +28,11 @@ import * as AccountEntityUtils from "../cache/utils/AccountEntityUtils.js";
 import * as CacheHelpers from "../cache/utils/CacheHelpers.js";
 import { ICrypto } from "../crypto/ICrypto.js";
 import { PopTokenGenerator } from "../crypto/PopTokenGenerator.js";
+import { DpopProofGenerator } from "../crypto/DpopProofGenerator.js";
+import {
+    DEFAULT_TOKEN_BINDING_KEY_MANAGER,
+    ITokenBindingKeyManager,
+} from "../crypto/ITokenBindingKeyManager.js";
 import {
     ClientAuthErrorCodes,
     createClientAuthError,
@@ -49,6 +54,15 @@ import { AuthenticationResult } from "./AuthenticationResult.js";
 import { AuthorizationCodePayload } from "./AuthorizationCodePayload.js";
 import { ServerAuthorizationTokenResponse } from "./ServerAuthorizationTokenResponse.js";
 
+/** @internal */
+export type GenerateAuthenticationResultOptions = {
+    idTokenClaims?: TokenClaims;
+    requestState?: RequestStateObject;
+    serverTokenResponse?: ServerAuthorizationTokenResponse;
+    requestId?: string;
+    tokenBindingKeyManager?: ITokenBindingKeyManager;
+};
+
 /**
  * Class that handles response parsing.
  * @internal
@@ -57,6 +71,7 @@ export class ResponseHandler {
     private clientId: string;
     private cacheStorage: CacheManager;
     private cryptoObj: ICrypto;
+    private tokenBindingKeyManager: ITokenBindingKeyManager;
     private logger: Logger;
     private homeAccountIdentifier: string;
     private performanceClient: IPerformanceClient;
@@ -70,11 +85,13 @@ export class ResponseHandler {
         logger: Logger,
         performanceClient: IPerformanceClient,
         serializableCache: ISerializableTokenCache | null,
-        persistencePlugin: ICachePlugin | null
+        persistencePlugin: ICachePlugin | null,
+        tokenBindingKeyManager: ITokenBindingKeyManager = DEFAULT_TOKEN_BINDING_KEY_MANAGER
     ) {
         this.clientId = clientId;
         this.cacheStorage = cacheStorage;
         this.cryptoObj = cryptoObj;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
         this.logger = logger;
         this.performanceClient = performanceClient;
         this.serializableCache = serializableCache;
@@ -236,7 +253,31 @@ export class ResponseHandler {
 
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
-            serverTokenResponse.key_id || request.sshKid || undefined;
+            serverTokenResponse.key_id ||
+            request.dpopJkt ||
+            request.sshKid ||
+            undefined;
+        if (
+            request.authenticationScheme === Constants.AuthenticationScheme.DPOP
+        ) {
+            if (
+                serverTokenResponse.token_type?.toLowerCase() !==
+                Constants.AuthenticationScheme.DPOP.toLowerCase()
+            ) {
+                this.performanceClient?.addFields(
+                    {
+                        dpopTokenTypeMismatch: serverTokenResponse.token_type,
+                    },
+                    request.correlationId
+                );
+                throw createClientAuthError(
+                    ClientAuthErrorCodes.dpopTokenTypeMismatch,
+                    request.correlationId
+                );
+            }
+            serverTokenResponse.token_type =
+                Constants.AuthenticationScheme.DPOP;
+        }
 
         // Compute components once for entity storage (fallback if hash not provided by client)
         const attributeTokenPartition = CacheHelpers.serializeAttributeTokens(
@@ -310,10 +351,12 @@ export class ResponseHandler {
                         false,
                         request,
                         this.performanceClient,
-                        idTokenClaims,
-                        requestStateObj,
-                        undefined,
-                        serverRequestId
+                        {
+                            idTokenClaims,
+                            requestState: requestStateObj,
+                            requestId: serverRequestId,
+                            tokenBindingKeyManager: this.tokenBindingKeyManager,
+                        }
                     );
                 }
             }
@@ -345,10 +388,13 @@ export class ResponseHandler {
             false,
             request,
             this.performanceClient,
-            idTokenClaims,
-            requestStateObj,
-            serverTokenResponse,
-            serverRequestId
+            {
+                idTokenClaims,
+                requestState: requestStateObj,
+                serverTokenResponse,
+                requestId: serverRequestId,
+                tokenBindingKeyManager: this.tokenBindingKeyManager,
+            }
         );
     }
 
@@ -534,19 +580,26 @@ export class ResponseHandler {
         fromTokenCache: boolean,
         request: BaseAuthRequest,
         performanceClient: IPerformanceClient,
-        idTokenClaims?: TokenClaims,
-        requestState?: RequestStateObject,
-        serverTokenResponse?: ServerAuthorizationTokenResponse,
-        requestId?: string
+        options: GenerateAuthenticationResultOptions = {}
     ): Promise<AuthenticationResult> {
+        const {
+            idTokenClaims,
+            requestState,
+            serverTokenResponse,
+            requestId,
+            tokenBindingKeyManager = DEFAULT_TOKEN_BINDING_KEY_MANAGER,
+        } = options;
         let accessToken: string = "";
         let responseScopes: Array<string> = [];
         let expiresOn: Date | null = null;
         let extExpiresOn: Date | undefined;
         let refreshOn: Date | undefined;
         let familyId: string = "";
+        let dpopProof: string | undefined;
 
         if (cacheRecord.accessToken) {
+            const accessTokenType =
+                cacheRecord.accessToken.tokenType?.toLowerCase();
             /*
              * if the request object has `popKid` property, `signPopToken` will be set to false and
              * the token will be returned unsigned
@@ -557,7 +610,11 @@ export class ResponseHandler {
                 !request.popKid
             ) {
                 const popTokenGenerator: PopTokenGenerator =
-                    new PopTokenGenerator(cryptoObj, performanceClient);
+                    new PopTokenGenerator(
+                        cryptoObj,
+                        tokenBindingKeyManager,
+                        performanceClient
+                    );
                 const { secret, keyId } = cacheRecord.accessToken;
 
                 if (!keyId) {
@@ -575,6 +632,30 @@ export class ResponseHandler {
             } else {
                 accessToken = cacheRecord.accessToken.secret;
             }
+            if (
+                accessTokenType ===
+                Constants.AuthenticationScheme.DPOP.toLowerCase()
+            ) {
+                if (!cacheRecord.accessToken.keyId) {
+                    throw createClientAuthError(
+                        ClientAuthErrorCodes.keyIdMissing,
+                        request.correlationId
+                    );
+                }
+                const dpopProofGenerator = new DpopProofGenerator(
+                    cryptoObj,
+                    tokenBindingKeyManager
+                );
+                dpopProof = await dpopProofGenerator.generateResourceProof(
+                    {
+                        htu: request.resourceRequestUri,
+                        htm: request.resourceRequestMethod,
+                        accessToken: cacheRecord.accessToken.secret,
+                    },
+                    cacheRecord.accessToken.keyId,
+                    request.correlationId
+                );
+            }
             responseScopes = ScopeSet.fromString(
                 cacheRecord.accessToken.target,
                 request.correlationId
@@ -602,6 +683,19 @@ export class ResponseHandler {
         const uid = idTokenClaims?.oid || idTokenClaims?.sub || "";
         const tid = idTokenClaims?.tid || "";
 
+        /*
+         * Surface the sovereign enclave for telemetry. This runs for both freshly acquired
+         * and cache-served tokens because SilentFlowClient shares this method, so the field
+         * is present on silent requests that never hit the network.
+         */
+        const regionSubScope = idTokenClaims?.tenant_region_sub_scope;
+        if (typeof regionSubScope === "string") {
+            performanceClient?.addFields(
+                { regionSubScope },
+                request.correlationId
+            );
+        }
+
         // for hybrid + native bridge enablement, send back the native account Id
         if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
             // Set on deprecated top-level for downgrade compat
@@ -638,6 +732,7 @@ export class ResponseHandler {
             idToken: cacheRecord?.idToken?.secret || "",
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken,
+            dpopProof,
             fromCache: fromTokenCache,
             expiresOn: expiresOn,
             extExpiresOn: extExpiresOn,
@@ -645,7 +740,11 @@ export class ResponseHandler {
             correlationId: request.correlationId,
             requestId: requestId || "",
             familyId: familyId,
-            tokenType: cacheRecord.accessToken?.tokenType || "",
+            tokenType:
+                cacheRecord.accessToken?.tokenType?.toLowerCase() ===
+                Constants.AuthenticationScheme.DPOP.toLowerCase()
+                    ? Constants.AuthenticationScheme.DPOP
+                    : cacheRecord.accessToken?.tokenType || "",
             state: requestState ? requestState.userRequestState : "",
             cloudGraphHostName: cacheRecord.account?.cloudGraphHostName || "",
             msGraphHost: cacheRecord.account?.msGraphHost || "",

package/src/telemetry/performance/PerformanceEvent.ts

@@ -202,6 +202,16 @@ export type PerformanceEvent = {
      */
     cacheOutcome?: number;
 
+    /**
+     * Token binding key type used by crypto operations.
+     */
+    tokenBindingKeyType?: string;
+
+    /**
+     * JOSE algorithm used by token binding crypto operations.
+     */
+    tokenBindingKeyAlgorithm?: string;
+
     /**
      * Sub-measurements for internal use. To be deleted before flushing.
      */
@@ -434,11 +444,23 @@ export type PerformanceEvent = {
      */
     hasAttributeTokens?: boolean;
 
+    /**
+     * Mismatched token_type returned for a DPoP request.
+     */
+    dpopTokenTypeMismatch?: string;
+
     /**
      * Whether the user has "Keep Me Signed In" enabled
      */
     kmsi?: boolean;
 
+    /**
+     * Sovereign enclave the authenticating tenant belongs to, taken verbatim from the
+     * `tenant_region_sub_scope` id token claim. Known values include "GCC", "DODCON"
+     * (GCC High) and "DOD".
+     */
+    regionSubScope?: string;
+
     /**
      * Cached SSO capability status from the most recent SSO verification
      */

package/src/utils/Constants.ts

@@ -10,7 +10,6 @@ export const DEFAULT_AUTHORITY_HOST = "login.microsoftonline.com";
 export const DEFAULT_COMMON_TENANT = "common";
 // ADFS String
 export const ADFS = "adfs";
-export const DSTS = "dstsv2";
 // Default AAD Instance Discovery Endpoint
 export const AAD_INSTANCE_DISCOVERY_ENDPT = `${DEFAULT_AUTHORITY}discovery/instance?api-version=1.1&authorization_endpoint=`;
 // CIAM URL
@@ -87,6 +86,7 @@ export const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, EMAIL_SCOPE];
 export const HeaderNames = {
     CONTENT_TYPE: "Content-Type",
     CONTENT_LENGTH: "Content-Length",
+    DPOP: "DPoP",
     RETRY_AFTER: "Retry-After",
     CCS_HEADER: "X-AnchorMailbox",
     WWWAuthenticate: "WWW-Authenticate",
@@ -124,6 +124,7 @@ export const ClaimsRequestKeys = {
     ID_TOKEN: "id_token",
     SIGNIN_STATE: "signin_state",
     LOGIN_HINT: "login_hint",
+    TENANT_REGION_SUB_SCOPE: "tenant_region_sub_scope",
 } as const;
 export type ClaimsRequestKeys =
     (typeof ClaimsRequestKeys)[keyof typeof ClaimsRequestKeys];
@@ -264,6 +265,7 @@ export const SERVER_TELEM_UNKNOWN_ERROR: string = "unknown_error";
 export const AuthenticationScheme = {
     BEARER: "Bearer",
     POP: "pop",
+    DPOP: "DPoP",
     SSH: "ssh-cert",
 } as const;
 export type AuthenticationScheme =
@@ -342,6 +344,7 @@ export const JsonWebTokenTypes = {
     Jwt: "JWT",
     Jwk: "JWK",
     Pop: "pop",
+    Dpop: "dpop+jwt",
 } as const;
 export type JsonWebTokenTypes =
     (typeof JsonWebTokenTypes)[keyof typeof JsonWebTokenTypes];

package/src/utils/ObjectUtils.ts

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * Checks whether a value is a plain JSON-like object.
+ * Allows objects with null prototypes, but rejects arrays and object subclasses.
+ */
+export function isPlainObject(
+    value: unknown
+): value is Record<string, unknown> {
+    if (
+        typeof value !== "object" ||
+        value === null ||
+        Object.prototype.toString.call(value) !== "[object Object]"
+    ) {
+        return false;
+    }
+
+    if (Object.getPrototypeOf(value) === null) {
+        return true;
+    }
+
+    let proto = value;
+    while (Object.getPrototypeOf(proto) !== null) {
+        proto = Object.getPrototypeOf(proto);
+    }
+
+    return Object.getPrototypeOf(value) === proto;
+}

package/types/authority/Authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Authority.d.ts","sourceRoot":"","sources":["../../src/authority/Authority.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAEH,oBAAoB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAKtC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAY9D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EACH,gBAAgB,EAEhB,sBAAsB,EACzB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAKpF;;;;GAIG;AACH,qBAAa,SAAS;IAElB,OAAO,CAAC,mBAAmB,CAAY;IAEvC,OAAO,CAAC,gCAAgC,CAAc;IAEtD,SAAS,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAE3C,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC;IAEtC,OAAO,CAAC,gBAAgB,CAAmB;IAE3C,OAAO,CAAC,QAAQ,CAA0B;IAE1C,OAAO,CAAC,eAAe,CAAkB;IAElC,uBAAuB,EAAE,uBAAuB,CAAC;IAExD,OAAO,CAAC,MAAM,CAAS;IAEvB,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAEhC,OAAO,CAAC,eAAe,CAAU;IAEjC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAMjC;gBAGC,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAChC,YAAY,EAAE,aAAa,EAC3B,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,kBAAkB,EACrC,eAAe,CAAC,EAAE,OAAO;IAwB7B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAqBxB,IAAW,aAAa,IAAI,aAAa,CAExC;IAED;;OAEG;IACH,IAAW,YAAY,IAAI,YAAY,CAEtC;IAED;;OAEG;IACH,IAAW,OAAO,IAAI,gBAAgB,CAErC;IAED;;OAEG;IACH,IAAW,kBAAkB,IAAI,MAAM,CAEtC;IAED;;OAEG;IACH,IAAW,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAIxC;IAED;;OAEG;IACH,IAAW,+BAA+B,IAAI,IAAI,CAOjD;IAED;;OAEG;IACH,IAAW,eAAe,IAAI,MAAM,CAEnC;IAED;;OAEG;IACH,IAAW,MAAM,IAAI,MAAM,CAE1B;IAED;;OAEG;IACH,IAAW,qBAAqB,IAAI,MAAM,CASzC;IAED;;OAEG;IACH,IAAW,aAAa,IAAI,MAAM,CASjC;IAED,IAAW,kBAAkB,IAAI,MAAM,CAWtC;IAED;;OAEG;IACH,IAAW,kBAAkB,IAAI,MAAM,CAgBtC;IAED;;OAEG;IACH,IAAW,qBAAqB,IAAI,MAAM,CASzC;IAED;;OAEG;IACH,IAAW,OAAO,IAAI,MAAM,CAS3B;IAED;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAIrB;;;OAGG;IACH,OAAO,CAAC,WAAW;IA8CnB;;OAEG;IACH,SAAS,KAAK,kCAAkC,IAAI,MAAM,CAWzD;IAED;;OAEG;IACH,iBAAiB,IAAI,OAAO;IAI5B;;;OAGG;IACU,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiCnD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IA+B5B;;;OAGG;YACW,sBAAsB;IA8EpC;;;;;OAKG;IACH,OAAO,CAAC,sCAAsC;IAmE9C;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAiBrC;;;;OAIG;YACW,8BAA8B;IAwC5C;;OAEG;IACH,OAAO,CAAC,sCAAsC;IAQ9C;;;OAGG;YACW,qCAAqC;IAqDnD;;;;;OAKG;YACW,4BAA4B;IAkC1C,OAAO,CAAC,4CAA4C;IAwFpD;;OAEG;IACH,OAAO,CAAC,mCAAmC;IAqE3C;;;;OAIG;YACW,oCAAoC;IA6GlD;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CACpB,eAAe,EAAE,MAAM,EACvB,iBAAiB,CAAC,EAAE,iBAAiB,GACtC,MAAM;IAkBT;;;OAGG;IACH,MAAM,CAAC,oCAAoC,CACvC,IAAI,EAAE,MAAM,GACb,sBAAsB;IAQzB;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAa3B;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B;;;OAGG;IACH,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIvD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,cAAc;IAqFtB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;;OAIG;IACH,OAAO,CAAC,4BAA4B;IASpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,wBAAwB;IAoDhC;;;;;OAKG;IACH,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;OAKG;IACH,MAAM,CAAC,4BAA4B,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,MAAM,GACrB,MAAM;IA4BT;;;;;OAKG;IACH,MAAM,CAAC,8BAA8B,CACjC,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACtB,oBAAoB;IA4BvB;;;;;;;;OAQG;IACH,MAAM,CAAC,sBAAsB,CACzB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACtB,MAAM;CAmBZ;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACtB,MAAM,GAAG,SAAS,CAsBpB;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAI/D;AAED,wBAAgB,2BAA2B,CACvC,WAAW,EAAE,OAAO,CAAC,gBAAgB,CAAC,GACvC,sBAAsB,CAqBxB"}
+{"version":3,"file":"Authority.d.ts","sourceRoot":"","sources":["../../src/authority/Authority.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAEH,oBAAoB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAKtC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAY9D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EACH,gBAAgB,EAEhB,sBAAsB,EACzB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAKpF;;;;GAIG;AACH,qBAAa,SAAS;IAElB,OAAO,CAAC,mBAAmB,CAAY;IAEvC,OAAO,CAAC,gCAAgC,CAAc;IAEtD,SAAS,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAE3C,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC;IAEtC,OAAO,CAAC,gBAAgB,CAAmB;IAE3C,OAAO,CAAC,QAAQ,CAA0B;IAE1C,OAAO,CAAC,eAAe,CAAkB;IAElC,uBAAuB,EAAE,uBAAuB,CAAC;IAExD,OAAO,CAAC,MAAM,CAAS;IAEvB,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAEhC,OAAO,CAAC,eAAe,CAAU;IAEjC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAMjC;gBAGC,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAChC,YAAY,EAAE,aAAa,EAC3B,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,kBAAkB,EACrC,eAAe,CAAC,EAAE,OAAO;IAwB7B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAmBxB,IAAW,aAAa,IAAI,aAAa,CAExC;IAED;;OAEG;IACH,IAAW,YAAY,IAAI,YAAY,CAEtC;IAED;;OAEG;IACH,IAAW,OAAO,IAAI,gBAAgB,CAErC;IAED;;OAEG;IACH,IAAW,kBAAkB,IAAI,MAAM,CAEtC;IAED;;OAEG;IACH,IAAW,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAIxC;IAED;;OAEG;IACH,IAAW,+BAA+B,IAAI,IAAI,CAOjD;IAED;;OAEG;IACH,IAAW,eAAe,IAAI,MAAM,CAEnC;IAED;;OAEG;IACH,IAAW,MAAM,IAAI,MAAM,CAE1B;IAED;;OAEG;IACH,IAAW,qBAAqB,IAAI,MAAM,CASzC;IAED;;OAEG;IACH,IAAW,aAAa,IAAI,MAAM,CASjC;IAED,IAAW,kBAAkB,IAAI,MAAM,CAWtC;IAED;;OAEG;IACH,IAAW,kBAAkB,IAAI,MAAM,CAgBtC;IAED;;OAEG;IACH,IAAW,qBAAqB,IAAI,MAAM,CASzC;IAED;;OAEG;IACH,IAAW,OAAO,IAAI,MAAM,CAS3B;IAED;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAIrB;;;OAGG;IACH,OAAO,CAAC,WAAW;IA8CnB;;OAEG;IACH,SAAS,KAAK,kCAAkC,IAAI,MAAM,CAWzD;IAED;;OAEG;IACH,iBAAiB,IAAI,OAAO;IAI5B;;;OAGG;IACU,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiCnD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IA+B5B;;;OAGG;YACW,sBAAsB;IA8EpC;;;;;OAKG;IACH,OAAO,CAAC,sCAAsC;IAmE9C;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAiBrC;;;;OAIG;YACW,8BAA8B;IAwC5C;;OAEG;IACH,OAAO,CAAC,sCAAsC;IAQ9C;;;OAGG;YACW,qCAAqC;IAqDnD;;;;;OAKG;YACW,4BAA4B;IAkC1C,OAAO,CAAC,4CAA4C;IAwFpD;;OAEG;IACH,OAAO,CAAC,mCAAmC;IAqE3C;;;;OAIG;YACW,oCAAoC;IA6GlD;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CACpB,eAAe,EAAE,MAAM,EACvB,iBAAiB,CAAC,EAAE,iBAAiB,GACtC,MAAM;IAkBT;;;OAGG;IACH,MAAM,CAAC,oCAAoC,CACvC,IAAI,EAAE,MAAM,GACb,sBAAsB;IAQzB;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAa3B;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B;;;OAGG;IACH,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIvD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,cAAc;IAqFtB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;;OAIG;IACH,OAAO,CAAC,4BAA4B;IASpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,wBAAwB;IAoDhC;;;;;OAKG;IACH,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;OAKG;IACH,MAAM,CAAC,4BAA4B,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,MAAM,GACrB,MAAM;IA4BT;;;;;OAKG;IACH,MAAM,CAAC,8BAA8B,CACjC,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACtB,oBAAoB;IA4BvB;;;;;;;;OAQG;IACH,MAAM,CAAC,sBAAsB,CACzB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACtB,MAAM;CAmBZ;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACtB,MAAM,GAAG,SAAS,CAsBpB;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAI/D;AAED,wBAAgB,2BAA2B,CACvC,WAAW,EAAE,OAAO,CAAC,gBAAgB,CAAC,GACvC,sBAAsB,CAqBxB"}

package/types/authority/AuthorityMetadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorityMetadata.d.ts","sourceRoot":"","sources":["../../src/authority/AuthorityMetadata.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,KAAK,WAAW,GAAG;IACf,gBAAgB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAA;KAAE,CAAC;IAC1D,yBAAyB,EAAE,8BAA8B,CAAC;CAC7D,CAAC;AAkCF,eAAO,MAAM,cAAc,EAAE,WAoE5B,CAAC;AAEF,eAAO,MAAM,gBAAgB;;CAAkC,CAAC;AAChE,eAAO,MAAM,yBAAyB,gCACM,CAAC;AAE7C,eAAO,MAAM,gCAAgC,EAAE,GAAG,CAAC,MAAM,CAAa,CAAC;AASvE;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACvC,sBAAsB,EAAE,sBAAsB,EAC9C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACtB,MAAM,EAAE,CA2BV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAClC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,aAAa,CAAC,EAAE,MAAM,EACtB,sBAAsB,CAAC,EAAE,sBAAsB,EAAE,EACjD,MAAM,CAAC,EAAE,uBAAuB,GACjC,MAAM,EAAE,GAAG,IAAI,CA0BjB;AAED;;GAEG;AACH,wBAAgB,4CAA4C,CACxD,aAAa,EAAE,MAAM,GACtB,sBAAsB,GAAG,IAAI,CAM/B;AAED;;;;GAIG;AACH,wBAAgB,4CAA4C,CACxD,QAAQ,EAAE,sBAAsB,EAAE,EAClC,aAAa,EAAE,MAAM,GACtB,sBAAsB,GAAG,IAAI,CAS/B"}
+{"version":3,"file":"AuthorityMetadata.d.ts","sourceRoot":"","sources":["../../src/authority/AuthorityMetadata.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,KAAK,WAAW,GAAG;IACf,gBAAgB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAA;KAAE,CAAC;IAC1D,yBAAyB,EAAE,8BAA8B,CAAC;CAC7D,CAAC;AA+BF,eAAO,MAAM,cAAc,EAAE,WA2D5B,CAAC;AAEF,eAAO,MAAM,gBAAgB;;CAAkC,CAAC;AAChE,eAAO,MAAM,yBAAyB,gCACM,CAAC;AAE7C,eAAO,MAAM,gCAAgC,EAAE,GAAG,CAAC,MAAM,CAAa,CAAC;AASvE;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACvC,sBAAsB,EAAE,sBAAsB,EAC9C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACtB,MAAM,EAAE,CA2BV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAClC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,aAAa,CAAC,EAAE,MAAM,EACtB,sBAAsB,CAAC,EAAE,sBAAsB,EAAE,EACjD,MAAM,CAAC,EAAE,uBAAuB,GACjC,MAAM,EAAE,GAAG,IAAI,CA0BjB;AAED;;GAEG;AACH,wBAAgB,4CAA4C,CACxD,aAAa,EAAE,MAAM,GACtB,sBAAsB,GAAG,IAAI,CAM/B;AAED;;;;GAIG;AACH,wBAAgB,4CAA4C,CACxD,QAAQ,EAAE,sBAAsB,EAAE,EAClC,aAAa,EAAE,MAAM,GACtB,sBAAsB,GAAG,IAAI,CAS/B"}

package/types/authority/AuthorityOptions.d.ts

@@ -18,7 +18,6 @@ export type StaticAuthorityOptions = Partial<Pick<AuthorityOptions, "knownAuthor
 export declare const AzureCloudInstance: {
     readonly None: "none";
     readonly AzurePublic: "https://login.microsoftonline.com";
-    readonly AzurePpe: "https://login.windows-ppe.net";
     readonly AzureChina: "https://login.chinacloudapi.cn";
     readonly AzureGermany: "https://login.microsoftonline.de";
     readonly AzureUsGovernment: "https://login.microsoftonline.us";

package/types/authority/AuthorityOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorityOptions.d.ts","sourceRoot":"","sources":["../../src/authority/AuthorityOptions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,CACxC,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAC7C,GAAG;IACA,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;CAkBrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAC1B,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"AuthorityOptions.d.ts","sourceRoot":"","sources":["../../src/authority/AuthorityOptions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,CACxC,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAC7C,GAAG;IACA,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;CAerB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAC1B,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC"}

package/types/authority/AuthorityType.d.ts

@@ -4,7 +4,6 @@
 export declare const AuthorityType: {
     readonly Default: 0;
     readonly Adfs: 1;
-    readonly Dsts: 2;
     readonly Ciam: 3;
 };
 export type AuthorityType = (typeof AuthorityType)[keyof typeof AuthorityType];

package/types/authority/AuthorityType.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorityType.d.ts","sourceRoot":"","sources":["../../src/authority/AuthorityType.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"AuthorityType.d.ts","sourceRoot":"","sources":["../../src/authority/AuthorityType.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,eAAO,MAAM,aAAa;;;;CAIhB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC"}

package/types/cache/CacheManager.d.ts

@@ -1,6 +1,7 @@
 import { AccountInfo } from "../account/AccountInfo.js";
 import { StaticAuthorityOptions } from "../authority/AuthorityOptions.js";
 import { ICrypto } from "../crypto/ICrypto.js";
+import { ITokenBindingKeyManager } from "../crypto/ITokenBindingKeyManager.js";
 import { Logger } from "../logger/Logger.js";
 import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
 import { StoreInCache } from "../request/StoreInCache.js";
@@ -24,10 +25,11 @@ import { AccountFilter, AppMetadataCache, AppMetadataFilter, CredentialFilter, T
 export declare abstract class CacheManager implements ICacheManager {
     protected clientId: string;
     protected cryptoImpl: ICrypto;
+    protected tokenBindingKeyManager: ITokenBindingKeyManager;
     private commonLogger;
     private staticAuthorityOptions?;
     protected performanceClient: IPerformanceClient;
-    constructor(clientId: string, cryptoImpl: ICrypto, logger: Logger, performanceClient: IPerformanceClient, staticAuthorityOptions?: StaticAuthorityOptions);
+    constructor(clientId: string, cryptoImpl: ICrypto, logger: Logger, performanceClient: IPerformanceClient, staticAuthorityOptions: StaticAuthorityOptions | undefined, tokenBindingKeyManager: ITokenBindingKeyManager);
     /**
      * fetch the account entity from the platform cache
      *  @param accountKey
@@ -427,6 +429,8 @@ export declare abstract class CacheManager implements ICacheManager {
      * @param tokenType
      */
     private matchTokenType;
+    private matchAccessTokenWithAuthScheme;
+    private matchKeyBoundAccessToken;
     /**
      * Returns true if the credential's keyId matches the one in the request, false otherwise
      * @param entity