@microsoft/agents-hosting 1.6.1 → 1.7.0-beta.1.g8bcd4f11a7

package/dist/src/auth/settings.d.ts

@@ -2,7 +2,19 @@
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-import type { ConnectionMapItem } from './msalConnectionManager';
+import type { MsalConnectionSettings } from './msal/msalConnectionSettings';
+import type { SidecarConnectionSettings } from './sidecar/sidecarConnectionSettings';
+export type { MsalConnectionSettings } from './msal/msalConnectionSettings';
+export type { SidecarConnectionSettings } from './sidecar/sidecarConnectionSettings';
+/**
+ * A single entry in the connections map used to route an inbound activity
+ * (matched by audience and/or serviceUrl) to a named connection.
+ */
+export interface ConnectionMapItem {
+    serviceUrl: string;
+    audience?: string;
+    connection: string;
+}
 export declare const DEFAULT_CONNECTION_MAP: ConnectionMapItem;
 export type ConnectionKeys = keyof Omit<AuthConfiguration, 'connections' | 'connectionsMap'>;
 export type ConnectionMapKeys = keyof ConnectionMapItem;
@@ -15,29 +27,40 @@ export interface LoadEnv {
 export declare function loadEnvSettings(callback: (key: string, value: string) => void): LoadEnv;
 export declare function applyDefaultSettings(config: AuthConfiguration): {
     /**
-     * The tenant ID for the authentication configuration.
-     */
-    tenantId?: string;
-    /**
-     * The client ID for the authentication configuration. Required in production.
+     * The connection registry: a map of connection name to that connection's settings.
+     *
+     * @remarks
+     * Each value is the {@link ConnectionSettings} for one connection (typed as {@link AuthConfiguration}
+     * for backward compatibility; only the connection-settings subset is consumed). An `AuthProvider` is
+     * created per entry by `AuthProviderFactory`, dispatched by `authType`.
      */
-    clientId?: string;
+    connections?: Map<string, AuthConfiguration>;
     /**
-     * The client secret for the authentication configuration.
+     * A list of connection map items to map service URLs to connection names.
      */
+    connectionsMap?: ConnectionMapItem[];
     clientSecret?: string;
+    certPemFile?: string;
+    certKeyFile?: string;
+    sendX5C?: boolean;
+    FICClientId?: string;
+    WIDAssertionFile?: string;
+    azureRegion?: string;
+    federatedTokenFile?: string;
+    idpmResource?: string;
+    federatedClientId?: string;
     /**
-     * The path to the certificate PEM file.
+     * The tenant ID for the authentication configuration.
      */
-    certPemFile?: string;
+    tenantId?: string;
     /**
-     * The path to the certificate key file.
+     * The client ID for the authentication configuration. Required in production.
      */
-    certKeyFile?: string;
+    clientId?: string;
     /**
-     * Indicates whether to send the X5C param or not (for SNI authentication).
+     * The authentication type for the connection.
      */
-    sendX5C?: boolean;
+    authType?: AuthType | string;
     /**
      * A list of valid issuers for the authentication configuration.
      */
@@ -46,12 +69,6 @@ export declare function applyDefaultSettings(config: AuthConfiguration): {
      * The connection name for the authentication configuration.
      */
     connectionName?: string;
-    /**
-     * @deprecated Use federatedClientId instead.
-     *
-     * The FIC (First-Party Integration Channel) client ID.
-     */
-    FICClientId?: string;
     /**
      * @deprecated Use authorityEndpoint instead.
      *
@@ -63,51 +80,6 @@ export declare function applyDefaultSettings(config: AuthConfiguration): {
      * see also https://learn.microsoft.com/entra/identity-platform/authentication-national-cloud
      */
     authority?: string;
-    /**
-     * @deprecated Use scopes instead.
-     */
-    scope?: string;
-    /**
-     * A map of connection names to their respective authentication configurations.
-     */
-    connections?: Map<string, AuthConfiguration>;
-    /**
-     * A list of connection map items to map service URLs to connection names.
-     */
-    connectionsMap?: ConnectionMapItem[];
-    /**
-     * An optional alternative blueprint Connection name used when constructing a connector client.
-     */
-    altBlueprintConnectionName?: string;
-    /**
-     * @deprecated Use `authType` set to `'WorkloadIdentity'` and `federatedTokenFile` instead.
-     *
-     * The path to K8s provided token.
-     */
-    WIDAssertionFile?: string;
-    /**
-     * The Azure region for ESTS-R regional token acquisition (e.g. 'westus', 'eastus').
-     * When set, MSAL routes token requests to the specified regional endpoint.
-     * See https://learn.microsoft.com/en-us/entra/msal/javascript/node/regional-authorities for details.
-     */
-    azureRegion?: string;
-    /**
-     * The authentication type for the connection.
-     */
-    authType?: AuthType | string;
-    /**
-     * The path to the federated token file used for Workload Identity authentication.
-     */
-    federatedTokenFile?: string;
-    /**
-     * Sets the resource URL for Identity Proxy Manager (IDPM).
-     *
-     * @remarks
-     * Set this to the appropriate resource identifier when the application is running in an environment,
-     * such as a Foundry container, that exposes Managed Identity through a container-specific IMDS endpoint.
-     * This setting is only meaningful when using Identity Proxy Manager (AuthType.IdentityProxyManager) for authentication.
-     */
-    idpmResource?: string;
     /**
      * Entra Authentication Endpoint to use.
      *
@@ -118,13 +90,36 @@ export declare function applyDefaultSettings(config: AuthConfiguration): {
      */
     authorityEndpoint?: string;
     /**
-     * The federated client ID for the authentication configuration, used for workload identity federation scenarios.
+     * @deprecated Use scopes instead.
      */
-    federatedClientId?: string;
+    scope?: string;
     /**
      * The scopes for the authentication configuration.
      */
     scopes?: string[];
+    /**
+     * An optional alternative blueprint Connection name used when constructing a connector client.
+     *
+     * @remarks
+     * Equivalent to the .NET `AlternateBlueprintConnectionName` connection setting. {@link alternateBlueprintConnectionName}
+     * is an alias of this property that matches the .NET name exactly; when both are provided this property takes precedence.
+     */
+    altBlueprintConnectionName?: string;
+    /**
+     * Alias of {@link altBlueprintConnectionName} named to match the .NET `AlternateBlueprintConnectionName`
+     * connection setting exactly.
+     *
+     * @remarks
+     * Provided for stricter .NET parity. The two properties are kept in sync during configuration normalization;
+     * {@link altBlueprintConnectionName} takes precedence when both are set.
+     */
+    alternateBlueprintConnectionName?: string;
+    sidecarBaseUrl?: string;
+    serviceName?: string;
+    blueprintServiceName?: string;
+    bypassLocalNetworkRestriction?: boolean;
+    requestTimeout?: number;
+    retryCount?: number;
 };
 /**
  * A type representing a parser settings object.
@@ -196,9 +191,16 @@ export declare const envParserUtils: {
  */
 export declare function resolveAuthority(authority?: string, tenantId?: string): string;
 /**
- * Represents the authentication configuration.
+ * Connection-level settings common to every authentication provider.
+ *
+ * @remarks
+ * Mirrors the .NET `Microsoft.Agents.Authentication.ConnectionSettingsBase` abstract class: these are
+ * the credential-agnostic properties shared by all connection types. Provider-specific settings
+ * extend this base (see {@link MsalConnectionSettings} for MSAL and {@link SidecarConnectionSettings}
+ * for the Entra sidecar). The active provider for a connection is selected
+ * by {@link ConnectionSettingsBase.authType | authType}; see `AuthProviderFactory`.
  */
-export interface AuthConfiguration {
+export interface ConnectionSettingsBase {
     /**
      * The tenant ID for the authentication configuration.
      */
@@ -208,21 +210,9 @@ export interface AuthConfiguration {
      */
     clientId?: string;
     /**
-     * The client secret for the authentication configuration.
-     */
-    clientSecret?: string;
-    /**
-     * The path to the certificate PEM file.
-     */
-    certPemFile?: string;
-    /**
-     * The path to the certificate key file.
-     */
-    certKeyFile?: string;
-    /**
-     * Indicates whether to send the X5C param or not (for SNI authentication).
+     * The authentication type for the connection.
      */
-    sendX5C?: boolean;
+    authType?: AuthType | string;
     /**
      * A list of valid issuers for the authentication configuration.
      */
@@ -231,12 +221,6 @@ export interface AuthConfiguration {
      * The connection name for the authentication configuration.
      */
     connectionName?: string;
-    /**
-     * @deprecated Use federatedClientId instead.
-     *
-     * The FIC (First-Party Integration Channel) client ID.
-     */
-    FICClientId?: string;
     /**
      * @deprecated Use authorityEndpoint instead.
      *
@@ -249,67 +233,83 @@ export interface AuthConfiguration {
      */
     authority?: string;
     /**
-     * @deprecated Use scopes instead.
+     * Entra Authentication Endpoint to use.
+     *
+     * @remarks
+     * If not populated the Entra Public Cloud endpoint is assumed.
+     * This example of Public Cloud Endpoint is https://login.microsoftonline.com
+     * see also https://learn.microsoft.com/entra/identity-platform/authentication-national-cloud
      */
-    scope?: string;
+    authorityEndpoint?: string;
     /**
-     * A map of connection names to their respective authentication configurations.
+     * @deprecated Use scopes instead.
      */
-    connections?: Map<string, AuthConfiguration>;
+    scope?: string;
     /**
-     * A list of connection map items to map service URLs to connection names.
+     * The scopes for the authentication configuration.
      */
-    connectionsMap?: ConnectionMapItem[];
+    scopes?: string[];
     /**
      * An optional alternative blueprint Connection name used when constructing a connector client.
-     */
-    altBlueprintConnectionName?: string;
-    /**
-     * @deprecated Use `authType` set to `'WorkloadIdentity'` and `federatedTokenFile` instead.
      *
-     * The path to K8s provided token.
-     */
-    WIDAssertionFile?: string;
-    /**
-     * The Azure region for ESTS-R regional token acquisition (e.g. 'westus', 'eastus').
-     * When set, MSAL routes token requests to the specified regional endpoint.
-     * See https://learn.microsoft.com/en-us/entra/msal/javascript/node/regional-authorities for details.
-     */
-    azureRegion?: string;
-    /**
-     * The authentication type for the connection.
-     */
-    authType?: AuthType | string;
-    /**
-     * The path to the federated token file used for Workload Identity authentication.
+     * @remarks
+     * Equivalent to the .NET `AlternateBlueprintConnectionName` connection setting. {@link alternateBlueprintConnectionName}
+     * is an alias of this property that matches the .NET name exactly; when both are provided this property takes precedence.
      */
-    federatedTokenFile?: string;
+    altBlueprintConnectionName?: string;
     /**
-     * Sets the resource URL for Identity Proxy Manager (IDPM).
+     * Alias of {@link altBlueprintConnectionName} named to match the .NET `AlternateBlueprintConnectionName`
+     * connection setting exactly.
      *
      * @remarks
-     * Set this to the appropriate resource identifier when the application is running in an environment,
-     * such as a Foundry container, that exposes Managed Identity through a container-specific IMDS endpoint.
-     * This setting is only meaningful when using Identity Proxy Manager (AuthType.IdentityProxyManager) for authentication.
+     * Provided for stricter .NET parity. The two properties are kept in sync during configuration normalization;
+     * {@link altBlueprintConnectionName} takes precedence when both are set.
      */
-    idpmResource?: string;
+    alternateBlueprintConnectionName?: string;
+}
+/**
+ * The complete settings for a single connection, across every provider.
+ *
+ * @remarks
+ * This is the per-connection unit that an `AuthProvider` consumes: it combines the common base
+ * ({@link ConnectionSettingsBase}) with the MSAL settings ({@link MsalConnectionSettings}) and the
+ * Entra sidecar settings ({@link SidecarConnectionSettings}). The active provider for a connection is
+ * selected by `authType`, so only the subset of these properties relevant to that provider is used.
+ *
+ * Conceptually this is the consumer-facing counterpart to the {@link AuthConfiguration} *container*:
+ * each value in {@link AuthConfiguration.connections} is the settings for one connection. It parallels
+ * the .NET `IConnectionSettings` (a single connection's settings) as distinct from the connection
+ * registry. {@link AuthConfiguration} extends this type for backward compatibility (it doubles as the
+ * settings for the legacy single connection).
+ */
+export interface ConnectionSettings extends MsalConnectionSettings, SidecarConnectionSettings {
+}
+/**
+ * Represents the authentication configuration.
+ *
+ * @remarks
+ * The agent-level authentication container. It owns the connection registry
+ * (`connections`/`connectionsMap`) and, for backward compatibility, also extends
+ * {@link ConnectionSettings} so the legacy single-connection shape (a flat config with `clientId`,
+ * `clientSecret`, etc.) keeps working — in that mode the top-level object *is* the one connection's
+ * settings. The active provider for each connection is dispatched by `authType` via
+ * `AuthProviderFactory`, so a single connection only uses the subset of these properties relevant to
+ * its provider.
+ */
+export interface AuthConfiguration extends ConnectionSettings {
     /**
-     * Entra Authentication Endpoint to use.
+     * The connection registry: a map of connection name to that connection's settings.
      *
      * @remarks
-     * If not populated the Entra Public Cloud endpoint is assumed.
-     * This example of Public Cloud Endpoint is https://login.microsoftonline.com
-     * see also https://learn.microsoft.com/entra/identity-platform/authentication-national-cloud
-     */
-    authorityEndpoint?: string;
-    /**
-     * The federated client ID for the authentication configuration, used for workload identity federation scenarios.
+     * Each value is the {@link ConnectionSettings} for one connection (typed as {@link AuthConfiguration}
+     * for backward compatibility; only the connection-settings subset is consumed). An `AuthProvider` is
+     * created per entry by `AuthProviderFactory`, dispatched by `authType`.
      */
-    federatedClientId?: string;
+    connections?: Map<string, AuthConfiguration>;
     /**
-     * The scopes for the authentication configuration.
+     * A list of connection map items to map service URLs to connection names.
      */
-    scopes?: string[];
+    connectionsMap?: ConnectionMapItem[];
 }
 /**
  * Supported authentication types for agent connections.
@@ -322,6 +322,15 @@ export declare enum AuthType {
     SystemManagedIdentity = "SystemManagedIdentity",
     FederatedCredentials = "FederatedCredentials",
     WorkloadIdentity = "WorkloadIdentity",
-    IdentityProxyManager = "IdentityProxyManager"
+    IdentityProxyManager = "IdentityProxyManager",
+    EntraAuthSideCar = "EntraAuthSideCar"
 }
-export {};
+/**
+ * Resolves the authentication type for a given authentication configuration.
+ * @remarks
+ * The function checks various properties of the `authConfig` object to determine the appropriate authentication type.
+ * It returns a string representing the resolved authentication type or 'unknown' if it cannot be determined.
+ * @param authConfig The authentication configuration object.
+ * @returns The resolved authentication type as a string or 'unknown' if it cannot be determined.
+ */
+export declare function resolveAuthType(authConfig?: AuthConfiguration): AuthType | string;

package/dist/src/auth/settings.js

@@ -9,7 +9,10 @@ exports.loadEnvSettings = loadEnvSettings;
 exports.applyDefaultSettings = applyDefaultSettings;
 exports.envParser = envParser;
 exports.resolveAuthority = resolveAuthority;
+exports.resolveAuthType = resolveAuthType;
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
+const agents_activity_1 = require("@microsoft/agents-activity");
+const errorHelper_1 = require("../errorHelper");
 const logger = (0, agents_telemetry_1.debug)('agents:authConfiguration');
 const DEFAULT_CONNECTION = 'serviceConnection';
 const AUTHORITY_DEFAULT = 'https://login.microsoftonline.com';
@@ -26,7 +29,7 @@ function loadEnvSettings(callback) {
     return env;
 }
 function applyDefaultSettings(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
     const settings = { ...config };
     (_a = settings.authorityEndpoint) !== null && _a !== void 0 ? _a : (settings.authorityEndpoint = (_b = settings.authority) !== null && _b !== void 0 ? _b : AUTHORITY_DEFAULT);
     (_c = settings.issuers) !== null && _c !== void 0 ? _c : (settings.issuers = getDefaultIssuers((_d = settings.tenantId) !== null && _d !== void 0 ? _d : '', settings.authorityEndpoint));
@@ -40,13 +43,18 @@ function applyDefaultSettings(config) {
     if (settings.authorityEndpoint) {
         settings.authority = settings.authorityEndpoint;
     }
-    if (!settings.clientId && ((_g = process.env.NODE_ENV) === null || _g === void 0 ? void 0 : _g.toLowerCase()) === 'production') {
-        throw new Error('ClientId required in production');
+    // .NET parity alias: keep altBlueprintConnectionName and alternateBlueprintConnectionName in sync.
+    (_g = settings.altBlueprintConnectionName) !== null && _g !== void 0 ? _g : (settings.altBlueprintConnectionName = settings.alternateBlueprintConnectionName);
+    if (settings.altBlueprintConnectionName) {
+        settings.alternateBlueprintConnectionName = settings.altBlueprintConnectionName;
     }
-    const defaultConnections = ((_h = settings.connections) === null || _h === void 0 ? void 0 : _h.size)
+    if (!settings.clientId && ((_h = process.env.NODE_ENV) === null || _h === void 0 ? void 0 : _h.toLowerCase()) === 'production') {
+        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ClientIdRequiredInProduction);
+    }
+    const defaultConnections = ((_j = settings.connections) === null || _j === void 0 ? void 0 : _j.size)
         ? settings.connections
         : new Map([[DEFAULT_CONNECTION, { ...settings }]]);
-    const defaultConnectionsMap = ((_j = settings.connectionsMap) === null || _j === void 0 ? void 0 : _j.length)
+    const defaultConnectionsMap = ((_k = settings.connectionsMap) === null || _k === void 0 ? void 0 : _k.length)
         ? settings.connectionsMap
         : [exports.DEFAULT_CONNECTION_MAP];
     settings.connections = defaultConnections;
@@ -154,5 +162,41 @@ var AuthType;
     AuthType["FederatedCredentials"] = "FederatedCredentials";
     AuthType["WorkloadIdentity"] = "WorkloadIdentity";
     AuthType["IdentityProxyManager"] = "IdentityProxyManager";
+    AuthType["EntraAuthSideCar"] = "EntraAuthSideCar";
 })(AuthType || (exports.AuthType = AuthType = {}));
+/**
+ * Resolves the authentication type for a given authentication configuration.
+ * @remarks
+ * The function checks various properties of the `authConfig` object to determine the appropriate authentication type.
+ * It returns a string representing the resolved authentication type or 'unknown' if it cannot be determined.
+ * @param authConfig The authentication configuration object.
+ * @returns The resolved authentication type as a string or 'unknown' if it cannot be determined.
+ */
+function resolveAuthType(authConfig) {
+    if (!authConfig) {
+        return 'none';
+    }
+    if (authConfig.authType) {
+        return authConfig.authType;
+    }
+    if (authConfig.WIDAssertionFile !== undefined) {
+        return AuthType.WorkloadIdentity;
+    }
+    if (authConfig.federatedClientId !== undefined || authConfig.FICClientId !== undefined) {
+        return AuthType.FederatedCredentials;
+    }
+    if (authConfig.clientSecret !== undefined) {
+        return AuthType.ClientSecret;
+    }
+    if (authConfig.certPemFile !== undefined && authConfig.certKeyFile !== undefined) {
+        return AuthType.Certificate;
+    }
+    if (authConfig.clientSecret === undefined && authConfig.certPemFile === undefined && authConfig.certKeyFile === undefined) {
+        return AuthType.UserManagedIdentity;
+    }
+    if (authConfig.idpmResource !== undefined) {
+        return AuthType.IdentityProxyManager;
+    }
+    return 'unknown';
+}
 //# sourceMappingURL=settings.js.map

package/dist/src/auth/settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/auth/settings.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAmBH,0CAaC;AAED,oDAgCC;AAmBD,8BAwBC;AA4BD,4CAQC;AA/ID,kEAAmD;AAGnD,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,0BAA0B,CAAC,CAAA;AAEhD,MAAM,kBAAkB,GAAG,mBAAmB,CAAA;AAC9C,MAAM,iBAAiB,GAAG,mCAAmC,CAAA;AAEhD,QAAA,sBAAsB,GAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAA;AAS5G,SAAgB,eAAe,CAAE,QAA8C;IAC7E,MAAM,GAAG,GAAY,EAAE,CAAA;IACvB,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,EAAE,CAAA,EAAE,CAAC;YACtB,SAAQ;QACV,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;QAE5D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAgB,oBAAoB,CAAE,MAAyB;;IAC7D,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;IAC9B,MAAA,QAAQ,CAAC,iBAAiB,oCAA1B,QAAQ,CAAC,iBAAiB,GAAK,MAAA,QAAQ,CAAC,SAAS,mCAAI,iBAAiB,EAAA;IACtE,MAAA,QAAQ,CAAC,OAAO,oCAAhB,QAAQ,CAAC,OAAO,GAAK,iBAAiB,CAAC,MAAA,QAAQ,CAAC,QAAQ,mCAAI,EAAE,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAA;IAE3F,6BAA6B;IAC7B,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/B,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,iBAAiB,CAAA;IACnD,CAAC;IAED,IAAI,MAAA,QAAQ,CAAC,MAAM,0CAAE,MAAM,EAAE,CAAC;QAC5B,QAAQ,CAAC,KAAK,GAAG,MAAA,QAAQ,CAAC,MAAM,0CAAG,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/B,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,iBAAiB,CAAA;IACjD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAA,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,0CAAE,WAAW,EAAE,MAAK,YAAY,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,kBAAkB,GAAG,CAAA,MAAA,QAAQ,CAAC,WAAW,0CAAE,IAAI;QACnD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,kBAAkB,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,qBAAqB,GAAG,CAAA,MAAA,QAAQ,CAAC,cAAc,0CAAE,MAAM;QAC3D,CAAC,CAAC,QAAQ,CAAC,cAAc;QACzB,CAAC,CAAC,CAAC,8BAAsB,CAAC,CAAA;IAE5B,QAAQ,CAAC,WAAW,GAAG,kBAAkB,CAAA;IACzC,QAAQ,CAAC,cAAc,GAAG,qBAAqB,CAAA;IAC/C,OAAO,QAAQ,CAAA;AACjB,CAAC;AASD;;;;;;;;;GASG;AACH,SAAgB,SAAS,CAAoB,QAAyD;IACpG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAQ,CAAA;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAA;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC,EAAE,EAAuB,CAAC,CAAA;IAC3B,OAAO;QACL,IAAI;QACJ;;;;;WAKG;QACH,KAAK,CAAE,GAAM,EAAE,KAAa;;YAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,CAAA;YACX,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;YACrC,OAAO,EAAE,GAAG,EAAE,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,GAAG,mCAAI,KAAK,EAAE,KAAK,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,EAAE,CAAA;QAC5D,CAAC;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACU,QAAA,cAAc,GAAG;IAC5B;;;;OAIG;IACH,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,EAAE,CAA8C,MAAc,EAAE,GAAmC,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;CAC5J,CAAA;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAE,SAAkB,EAAE,QAAiB;IACrE,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,iBAAiB,CAAC,CAAA;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAA;IAC3C,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,kBAAkB,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAE,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAA;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACnD,GAAG,EAAE,CAAA;IACP,CAAC;IAED,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAE,QAAgB,EAAE,SAAiB;IAC7D,+FAA+F;IAC/F,MAAM,CAAC,GAAG,QAAQ,IAAI,SAAS,CAAA;IAC/B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO;QACL,8BAA8B;QAC9B,GAAG,gBAAgB,CAAC,yBAAyB,EAAE,CAAC,CAAC,GAAG;QACpD,GAAG,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO;KACzC,CAAA;AACH,CAAC;AA4ID;;GAEG;AACH,IAAY,QASX;AATD,WAAY,QAAQ;IAClB,uCAA2B,CAAA;IAC3B,6DAAiD,CAAA;IACjD,yCAA6B,CAAA;IAC7B,uDAA2C,CAAA;IAC3C,2DAA+C,CAAA;IAC/C,yDAA6C,CAAA;IAC7C,iDAAqC,CAAA;IACrC,yDAA6C,CAAA;AAC/C,CAAC,EATW,QAAQ,wBAAR,QAAQ,QASnB"}
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/auth/settings.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAmCH,0CAaC;AAED,oDAsCC;AAmBD,8BAwBC;AA4BD,4CAQC;AAqLD,0CA0BC;AApXD,kEAAmD;AACnD,gEAA4D;AAC5D,gDAAuC;AAOvC,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,0BAA0B,CAAC,CAAA;AAEhD,MAAM,kBAAkB,GAAG,mBAAmB,CAAA;AAC9C,MAAM,iBAAiB,GAAG,mCAAmC,CAAA;AAYhD,QAAA,sBAAsB,GAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAA;AAS5G,SAAgB,eAAe,CAAE,QAA8C;IAC7E,MAAM,GAAG,GAAY,EAAE,CAAA;IACvB,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,EAAE,CAAA,EAAE,CAAC;YACtB,SAAQ;QACV,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;QAE5D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAgB,oBAAoB,CAAE,MAAyB;;IAC7D,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;IAC9B,MAAA,QAAQ,CAAC,iBAAiB,oCAA1B,QAAQ,CAAC,iBAAiB,GAAK,MAAA,QAAQ,CAAC,SAAS,mCAAI,iBAAiB,EAAA;IACtE,MAAA,QAAQ,CAAC,OAAO,oCAAhB,QAAQ,CAAC,OAAO,GAAK,iBAAiB,CAAC,MAAA,QAAQ,CAAC,QAAQ,mCAAI,EAAE,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAA;IAE3F,6BAA6B;IAC7B,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/B,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,iBAAiB,CAAA;IACnD,CAAC;IAED,IAAI,MAAA,QAAQ,CAAC,MAAM,0CAAE,MAAM,EAAE,CAAC;QAC5B,QAAQ,CAAC,KAAK,GAAG,MAAA,QAAQ,CAAC,MAAM,0CAAG,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/B,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,iBAAiB,CAAA;IACjD,CAAC;IAED,mGAAmG;IACnG,MAAA,QAAQ,CAAC,0BAA0B,oCAAnC,QAAQ,CAAC,0BAA0B,GAAK,QAAQ,CAAC,gCAAgC,EAAA;IACjF,IAAI,QAAQ,CAAC,0BAA0B,EAAE,CAAC;QACxC,QAAQ,CAAC,gCAAgC,GAAG,QAAQ,CAAC,0BAA0B,CAAA;IACjF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAA,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,0CAAE,WAAW,EAAE,MAAK,YAAY,EAAE,CAAC;QAC/E,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,4BAA4B,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,kBAAkB,GAAG,CAAA,MAAA,QAAQ,CAAC,WAAW,0CAAE,IAAI;QACnD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,kBAAkB,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,qBAAqB,GAAG,CAAA,MAAA,QAAQ,CAAC,cAAc,0CAAE,MAAM;QAC3D,CAAC,CAAC,QAAQ,CAAC,cAAc;QACzB,CAAC,CAAC,CAAC,8BAAsB,CAAC,CAAA;IAE5B,QAAQ,CAAC,WAAW,GAAG,kBAAkB,CAAA;IACzC,QAAQ,CAAC,cAAc,GAAG,qBAAqB,CAAA;IAC/C,OAAO,QAAQ,CAAA;AACjB,CAAC;AASD;;;;;;;;;GASG;AACH,SAAgB,SAAS,CAAoB,QAAyD;IACpG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAQ,CAAA;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAA;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC,EAAE,EAAuB,CAAC,CAAA;IAC3B,OAAO;QACL,IAAI;QACJ;;;;;WAKG;QACH,KAAK,CAAE,GAAM,EAAE,KAAa;;YAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,CAAA;YACX,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;YACrC,OAAO,EAAE,GAAG,EAAE,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,GAAG,mCAAI,KAAK,EAAE,KAAK,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,EAAE,CAAA;QAC5D,CAAC;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACU,QAAA,cAAc,GAAG;IAC5B;;;;OAIG;IACH,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,EAAE,CAA8C,MAAc,EAAE,GAAmC,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;CAC5J,CAAA;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAE,SAAkB,EAAE,QAAiB;IACrE,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,iBAAiB,CAAC,CAAA;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAA;IAC3C,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,kBAAkB,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAE,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAA;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACnD,GAAG,EAAE,CAAA;IACP,CAAC;IAED,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAE,QAAgB,EAAE,SAAiB;IAC7D,+FAA+F;IAC/F,MAAM,CAAC,GAAG,QAAQ,IAAI,SAAS,CAAA;IAC/B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO;QACL,8BAA8B;QAC9B,GAAG,gBAAgB,CAAC,yBAAyB,EAAE,CAAC,CAAC,GAAG;QACpD,GAAG,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO;KACzC,CAAA;AACH,CAAC;AAwID;;GAEG;AACH,IAAY,QAUX;AAVD,WAAY,QAAQ;IAClB,uCAA2B,CAAA;IAC3B,6DAAiD,CAAA;IACjD,yCAA6B,CAAA;IAC7B,uDAA2C,CAAA;IAC3C,2DAA+C,CAAA;IAC/C,yDAA6C,CAAA;IAC7C,iDAAqC,CAAA;IACrC,yDAA6C,CAAA;IAC7C,iDAAqC,CAAA;AACvC,CAAC,EAVW,QAAQ,wBAAR,QAAQ,QAUnB;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAE,UAA8B;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,QAAQ,CAAA;IAC5B,CAAC;IACD,IAAI,UAAU,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,gBAAgB,CAAA;IAClC,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACvF,OAAO,QAAQ,CAAC,oBAAoB,CAAA;IACtC,CAAC;IACD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC,YAAY,CAAA;IAC9B,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,WAAW,CAAA;IAC7B,CAAC;IACD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC1H,OAAO,QAAQ,CAAC,mBAAmB,CAAA;IACrC,CAAC;IACD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC,oBAAoB,CAAA;IACtC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/src/auth/sidecar/sidecarAuthProvider.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import { AuthConfiguration } from '../authConfiguration';
+import { AuthProvider } from '../authProvider';
+/**
+ * Authentication provider that delegates token acquisition to the Microsoft Entra Agent ID
+ * sidecar (agent container). This replaces MSAL at the connection layer, using the sidecar's
+ * `/AuthorizationHeaderUnauthenticated/{serviceName}` endpoint for app-only and agentic identity
+ * flows. The sidecar performs the full Blueprint→Instance→User chain internally; no MSAL exchange is
+ * performed in-process.
+ */
+export declare class SidecarAuthProvider implements AuthProvider {
+    readonly connectionSettings?: AuthConfiguration;
+    private readonly _settings;
+    private readonly _httpClient;
+    private readonly _tokenCache;
+    /**
+     * Creates a new {@link SidecarAuthProvider}.
+     * @param connectionSettings The connection authentication configuration.
+     */
+    constructor(connectionSettings?: AuthConfiguration);
+    /**
+     * Acquires an app-only access token from the sidecar.
+     * @param scope The scope for the token.
+     */
+    getAccessToken(scope: string): Promise<string>;
+    /**
+     * Acquires an app-only access token from the sidecar.
+     * @param authConfig The authentication configuration. Ignored by the sidecar provider, which
+     * owns the credential and derives the token from its configured service name; accepted only to
+     * satisfy the {@link AuthProvider} overload.
+     * @param scope The scope for the token.
+     */
+    getAccessToken(authConfig: AuthConfiguration, scope: string): Promise<string>;
+    /**
+     * Acquires the Blueprint (agent application) token from the sidecar.
+     * @param tenantId The tenant ID.
+     * @param agentAppInstanceId The agent instance ID (from the inbound activity); maps to `AgentIdentity`.
+     */
+    getAgenticApplicationToken(tenantId: string, agentAppInstanceId: string): Promise<string>;
+    /**
+     * Acquires the autonomous agent (instance) token from the sidecar for the configured resource.
+     * @param tenantId The tenant ID.
+     * @param agentAppInstanceId The agent instance ID (from the inbound activity); maps to `AgentIdentity`.
+     */
+    getAgenticInstanceToken(tenantId: string, agentAppInstanceId: string): Promise<string>;
+    /**
+     * Acquires the agentic user token from the sidecar for the configured resource.
+     * @param tenantId The tenant ID.
+     * @param agentAppInstanceId The agent instance ID (from the inbound activity); maps to `AgentIdentity`.
+     * @param upn The agentic user identifier. A GUID is sent as `AgentUserId`; otherwise as `AgentUsername`.
+     * @param scopes The OAuth scopes to request.
+     */
+    getAgenticUserToken(tenantId: string, agentAppInstanceId: string, upn: string, scopes: string[]): Promise<string>;
+    /**
+     * On-behalf-of token exchange — not supported by the sidecar provider in Phase 1.
+     */
+    acquireTokenOnBehalfOf(scopes: string[], oboAssertion: string): Promise<string>;
+    acquireTokenOnBehalfOf(authConfig: AuthConfiguration, scopes: string[], oboAssertion: string): Promise<string>;
+    /**
+     * Checks sidecar availability via the `/healthz` endpoint.
+     * @returns `true` when the sidecar is reachable and healthy.
+     */
+    isHealthy(): Promise<boolean>;
+    private ensureConnectionSettings;
+    private getCachedToken;
+    private cacheGet;
+    private cacheSet;
+    private pruneExpiredEntries;
+    private evictNearestExpiry;
+    private static buildCacheKey;
+}