@microsoft/agents-hosting 1.6.1 → 1.7.0-beta.5.g67b2005119

package/dist/src/auth/jwt-middleware.js

@@ -8,12 +8,24 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authorizeJWT = void 0;
+exports.clearJwksClients = clearJwksClients;
 exports.buildJwksUri = buildJwksUri;
+exports.getJwksClient = getJwksClient;
 const authConfiguration_1 = require("./authConfiguration");
+const errorHelper_1 = require("../errorHelper");
+const agents_activity_1 = require("@microsoft/agents-activity");
 const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
 const logger = (0, agents_telemetry_1.debug)('agents:jwt-middleware');
+const jwksClients = new Map();
+const maxJwksClients = 100;
+/**
+ * Clears process-wide JWKS clients.
+ */
+function clearJwksClients() {
+    jwksClients.clear();
+}
 /**
  * Builds the JWKS URI for the given token issuer and auth configuration.
  * @param iss The token issuer claim.
@@ -26,6 +38,26 @@ function buildJwksUri(iss, authConfig) {
         ? 'https://login.botframework.com/v1/.well-known/keys'
         : `${(0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId)}/discovery/v2.0/keys`;
 }
+function getJwksClient(jwksUri) {
+    // Check if a client for this JWKS URI already exists in the cache.
+    let client = jwksClients.get(jwksUri);
+    if (!client) {
+        client = (0, jwks_rsa_1.default)({ jwksUri });
+        jwksClients.set(jwksUri, client);
+        while (jwksClients.size > maxJwksClients) {
+            const oldestKey = jwksClients.keys().next().value;
+            if (oldestKey === undefined) {
+                break;
+            }
+            jwksClients.delete(oldestKey);
+        }
+    }
+    else {
+        jwksClients.delete(jwksUri);
+        jwksClients.set(jwksUri, client);
+    }
+    return client;
+}
 /**
  * Verifies the JWT token.
  * @param raw The raw JWT token.
@@ -36,14 +68,14 @@ const verifyToken = async (raw, config) => {
     const payload = jsonwebtoken_1.default.decode(raw);
     logger.debug('jwt.decode ', JSON.stringify(payload));
     if (!payload) {
-        throw new Error('invalid token');
+        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.InvalidJwtToken);
     }
     const audience = payload.aud;
     const matchingEntry = config.connections && config.connections.size > 0
         ? [...config.connections.entries()].find(([_, configuration]) => configuration.clientId === audience)
         : undefined;
     if (!matchingEntry) {
-        const err = new Error('Audience mismatch');
+        const err = agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.JwtAudienceMismatch);
         logger.error(err.message, audience);
         throw err;
     }
@@ -51,8 +83,9 @@ const verifyToken = async (raw, config) => {
     logger.debug(`Audience found at key: ${key}`);
     const jwksUri = buildJwksUri(payload.iss, authConfig);
     logger.debug(`fetching keys from ${jwksUri}`);
-    const jwksClient = (0, jwks_rsa_1.default)({ jwksUri });
+    const jwksClient = getJwksClient(jwksUri);
     const getKey = (header, callback) => {
+        // Retrieve the public, issuer-wide signing key from the JWKS endpoint using the kid from the token header.
         jwksClient.getSigningKey(header.kid, (err, key) => {
             if (err) {
                 logger.error('jwksClient.getSigningKey ', JSON.stringify(err));
@@ -81,6 +114,68 @@ const verifyToken = async (raw, config) => {
         });
     });
 };
+/**
+ * Determines whether an `Authorization` header value is present (non-empty).
+ *
+ * The {@link Request} contract allows `string | string[] | undefined` because
+ * different web frameworks surface headers differently. This treats an empty
+ * string or empty array as "absent" so callers can distinguish a missing header
+ * (anonymous / 401) from a present-but-malformed one (always 401).
+ * @param authorization The raw `Authorization` header value.
+ * @returns `true` when a non-empty header value is present.
+ */
+function hasAuthorizationHeader(authorization) {
+    if (Array.isArray(authorization)) {
+        return authorization.some((value) => typeof value === 'string' && value.trim().length > 0);
+    }
+    return typeof authorization === 'string' && authorization.trim().length > 0;
+}
+/**
+ * Parses a single `Authorization` header value and returns its bearer token.
+ *
+ * Validates the `Bearer <token>` scheme, returning `undefined` for anything
+ * malformed (wrong scheme, missing token, or extra whitespace-delimited parts).
+ * @param headerValue A single `Authorization` header value.
+ * @returns The bearer token, or `undefined` if the value is absent or malformed.
+ */
+function parseBearerValue(headerValue) {
+    if (typeof headerValue !== 'string') {
+        return undefined;
+    }
+    const parts = headerValue.trim().split(/\s+/);
+    if (parts.length !== 2) {
+        return undefined;
+    }
+    const [scheme, token] = parts;
+    if (scheme.toLowerCase() !== 'bearer' || !token) {
+        return undefined;
+    }
+    return token;
+}
+/**
+ * Extracts the bearer token from a raw `Authorization` header value.
+ *
+ * On Node's core HTTP parser (which both Express and Fastify use) `Authorization`
+ * is always surfaced as a single string holding the *first* header line —
+ * duplicate `Authorization` headers are discarded, not comma-joined. The
+ * `string[]` case is handled only because the {@link Request} contract permits
+ * it for non-Node frameworks; when an array is supplied, every entry is inspected
+ * and the first valid `Bearer <token>` is returned (the bearer value is not
+ * assumed to be first). Returns `undefined` for anything malformed so the caller
+ * can emit a consistent 401 instead of throwing.
+ * @param authorization The raw `Authorization` header value.
+ * @returns The bearer token, or `undefined` if the header is absent or malformed.
+ */
+function extractBearerToken(authorization) {
+    const values = Array.isArray(authorization) ? authorization : [authorization];
+    for (const value of values) {
+        const token = parseBearerValue(value);
+        if (token) {
+            return token;
+        }
+    }
+    return undefined;
+}
 /**
  * Middleware to authorize JWT tokens.
  * @param authConfig The authentication configuration.
@@ -88,6 +183,7 @@ const verifyToken = async (raw, config) => {
  */
 const authorizeJWT = (authConfig) => {
     return async function (req, res, next) {
+        var _a, _b;
         let failed = false;
         logger.debug('authorizing jwt');
         if (req.method !== 'POST' && req.method !== 'GET') {
@@ -96,9 +192,8 @@ const authorizeJWT = (authConfig) => {
             res.status(405).send({ 'jwt-auth-error': 'Method not allowed' });
         }
         else {
-            const authHeader = req.headers.authorization;
-            if (authHeader) {
-                const token = authHeader.split(' ')[1]; // Extract the token from the Bearer string
+            const token = extractBearerToken(req.headers.authorization);
+            if (token) {
                 try {
                     const user = await verifyToken(token, authConfig);
                     logger.debug('token verified for ', user);
@@ -107,9 +202,23 @@ const authorizeJWT = (authConfig) => {
                 catch (err) {
                     failed = true;
                     logger.error(err);
-                    res.status(401).send({ 'jwt-auth-error': err.message });
+                    // Emit only the human-readable description rather than the
+                    // ExceptionHelper-formatted "[code] - description - helplink" string,
+                    // so the wire format does not leak internal error codes or help links.
+                    // Fall back to a stable string so a thrown non-Error (no description/
+                    // message) never serializes to an empty `{}` and drops the detail.
+                    const wireMessage = (_b = (_a = err === null || err === void 0 ? void 0 : err.description) !== null && _a !== void 0 ? _a : err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : 'unauthorized';
+                    res.status(401).send({ 'jwt-auth-error': wireMessage });
                 }
             }
+            else if (hasAuthorizationHeader(req.headers.authorization)) {
+                // Header is present but not a well-formed `Bearer <token>` (e.g. wrong
+                // scheme, missing token, or an array value). Respond with a consistent
+                // 401 rather than letting malformed input throw before authorization.
+                failed = true;
+                logger.warn('malformed authorization header');
+                res.status(401).send({ 'jwt-auth-error': 'invalid authorization header' });
+            }
             else {
                 if (!authConfig.clientId && process.env.NODE_ENV !== 'production') {
                     logger.info('using anonymous auth');

package/dist/src/auth/jwt-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-middleware.js","sourceRoot":"","sources":["../../../src/auth/jwt-middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAiBH,oCAIC;AAnBD,2DAAyE;AAGzE,wDAA0D;AAC1D,gEAA6F;AAC7F,kEAAmD;AAEnD,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,uBAAuB,CAAC,CAAA;AAE7C;;;;;GAKG;AACH,SAAgB,YAAY,CAAE,GAAW,EAAE,UAA6B;;IACtE,OAAO,GAAG,KAAK,8BAA8B;QAC3C,CAAC,CAAC,oDAAoD;QACtD,CAAC,CAAC,GAAG,IAAA,oCAAgB,EAAC,MAAA,UAAU,CAAC,iBAAiB,mCAAI,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,sBAAsB,CAAA;AAC1H,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,MAAyB,EAAuB,EAAE;IACxF,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,GAAG,CAAe,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAA;IAE5B,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;QACrE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACrG,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACnC,MAAM,GAAG,CAAA;IACX,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,aAAa,CAAA;IACvC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IAE7C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAa,EAAE,UAAU,CAAC,CAAA;IAE/D,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAe,IAAA,kBAAO,EAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAEnD,MAAM,MAAM,GAAyB,CAAC,MAAiB,EAAE,QAAsB,EAAE,EAAE;QACjF,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAiB,EAAE,GAA2B,EAAQ,EAAE;YAC5F,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,YAAY,EAAE,CAAA;YACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,aAAa,GAAsB;QACvC,QAAQ,EAAE,CAAC,UAAU,CAAC,QAAS,EAAE,8BAA8B,CAAC;QAChE,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,GAAG;KACpB,CAAA;IAED,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,sBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACnD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChD,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAkB,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAAC,UAA6B,EAAE,EAAE;IAC5D,OAAO,KAAK,WAAW,GAAY,EAAE,GAAa,EAAE,IAAkB;QACpE,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,MAAM,GAAG,IAAI,CAAA;YACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAuB,CAAA;YACtD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,KAAK,GAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,2CAA2C;gBAC1F,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBACjD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;oBACzC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;gBACjB,CAAC;gBAAC,OAAO,GAAgB,EAAE,CAAC;oBAC1B,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACzD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;oBACnC,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;oBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,CAAC,CAAA;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,EAAE,CAAA;QACR,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA;AApCY,QAAA,YAAY,gBAoCxB"}
+{"version":3,"file":"jwt-middleware.js","sourceRoot":"","sources":["../../../src/auth/jwt-middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAkBH,4CAEC;AAQD,oCAIC;AAED,sCAkBC;AAlDD,2DAAyE;AAGzE,gDAAuC;AACvC,gEAA4D;AAC5D,wDAA0D;AAC1D,gEAA6F;AAC7F,kEAAmD;AAEnD,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,uBAAuB,CAAC,CAAA;AAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAA;AACjD,MAAM,cAAc,GAAG,GAAG,CAAA;AAE1B;;GAEG;AACH,SAAgB,gBAAgB;IAC9B,WAAW,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAE,GAAW,EAAE,UAA6B;;IACtE,OAAO,GAAG,KAAK,8BAA8B;QAC3C,CAAC,CAAC,oDAAoD;QACtD,CAAC,CAAC,GAAG,IAAA,oCAAgB,EAAC,MAAA,UAAU,CAAC,iBAAiB,mCAAI,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,sBAAsB,CAAA;AAC1H,CAAC;AAED,SAAgB,aAAa,CAAE,OAAe;IAC5C,mEAAmE;IACnE,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAA,kBAAO,EAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7B,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,OAAO,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAK;YACP,CAAC;YACD,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3B,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,MAAyB,EAAuB,EAAE;IACxF,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,GAAG,CAAe,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,eAAe,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAA;IAE5B,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;QACrE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACrG,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,mBAAmB,CAAC,CAAA;QAChF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACnC,MAAM,GAAG,CAAA;IACX,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,aAAa,CAAA;IACvC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IAE7C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAa,EAAE,UAAU,CAAC,CAAA;IAE/D,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAEzC,MAAM,MAAM,GAAyB,CAAC,MAAiB,EAAE,QAAsB,EAAE,EAAE;QACjF,2GAA2G;QAC3G,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAiB,EAAE,GAA2B,EAAQ,EAAE;YAC5F,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,YAAY,EAAE,CAAA;YACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,aAAa,GAAsB;QACvC,QAAQ,EAAE,CAAC,UAAU,CAAC,QAAS,EAAE,8BAA8B,CAAC;QAChE,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,GAAG;KACpB,CAAA;IAED,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,sBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACnD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChD,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAkB,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAE,aAA4C;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAE,WAA+B;IACxD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;IAC7B,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAChD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAE,aAA4C;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IAC7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAAC,UAA6B,EAAE,EAAE;IAC5D,OAAO,KAAK,WAAW,GAAY,EAAE,GAAgB,EAAE,IAAkB;;QACvE,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,MAAM,GAAG,IAAI,CAAA;YACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YAC3D,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBACjD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;oBACzC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;gBACjB,CAAC;gBAAC,OAAO,GAAgB,EAAE,CAAC;oBAC1B,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACjB,2DAA2D;oBAC3D,sEAAsE;oBACtE,uEAAuE;oBACvE,sEAAsE;oBACtE,mEAAmE;oBACnE,MAAM,WAAW,GAAW,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,WAAW,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,cAAc,CAAA;oBAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAA;gBACzD,CAAC;YACH,CAAC;iBAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7D,uEAAuE;gBACvE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,GAAG,IAAI,CAAA;gBACb,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,CAAC,CAAA;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;oBACnC,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;oBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,CAAC,CAAA;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,EAAE,CAAA;QACR,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA;AAhDY,QAAA,YAAY,gBAgDxB"}

package/dist/src/auth/msal/msalConnectionManager.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import { AuthConfiguration } from '../authConfiguration';
+import type { ConnectionMapItem } from '../settings';
+import { AuthProvider } from '../authProvider';
+import { ConnectionManager } from '../connectionManager';
+/**
+ * Connection manager backed by MSAL (and, for `EntraAuthSideCar` connections, the Entra sidecar
+ * provider). A thin convenience subclass of {@link ConnectionManager} that supplies the default
+ * provider factory and applies MSAL-specific connection defaults.
+ */
+export declare class MsalConnectionManager extends ConnectionManager {
+    constructor(connectionsConfigurations?: Map<string, AuthConfiguration>, connectionsMap?: ConnectionMapItem[], configuration?: AuthConfiguration);
+    protected applyConnectionDefaults(conn: AuthProvider): AuthProvider;
+}

package/dist/src/auth/msal/msalConnectionManager.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MsalConnectionManager = void 0;
+const authConfiguration_1 = require("../authConfiguration");
+const connectionManager_1 = require("../connectionManager");
+/**
+ * Connection manager backed by MSAL (and, for `EntraAuthSideCar` connections, the Entra sidecar
+ * provider). A thin convenience subclass of {@link ConnectionManager} that supplies the default
+ * provider factory and applies MSAL-specific connection defaults.
+ */
+class MsalConnectionManager extends connectionManager_1.ConnectionManager {
+    constructor(connectionsConfigurations = new Map(), connectionsMap = [], configuration = {}) {
+        super(connectionManager_1.defaultAuthProviderFactory, connectionsConfigurations, connectionsMap, configuration);
+    }
+    applyConnectionDefaults(conn) {
+        var _a, _b, _c, _d, _e, _f;
+        var _g, _h, _j, _k;
+        if (conn.connectionSettings) {
+            (_a = (_g = conn.connectionSettings).authorityEndpoint) !== null && _a !== void 0 ? _a : (_g.authorityEndpoint = conn.connectionSettings.authority || 'https://login.microsoftonline.com');
+            (_b = (_h = conn.connectionSettings).authority) !== null && _b !== void 0 ? _b : (_h.authority = conn.connectionSettings.authorityEndpoint);
+            (_c = (_j = conn.connectionSettings).issuers) !== null && _c !== void 0 ? _c : (_j.issuers = [
+                'https://api.botframework.com',
+                `${(0, authConfiguration_1.resolveAuthority)('https://sts.windows.net', conn.connectionSettings.tenantId)}/`,
+                `${(0, authConfiguration_1.resolveAuthority)(conn.connectionSettings.authorityEndpoint, conn.connectionSettings.tenantId)}/v2.0`
+            ]);
+            // For backward compatibility
+            if (conn.connectionSettings.federatedClientId) {
+                conn.connectionSettings.FICClientId = conn.connectionSettings.federatedClientId;
+            }
+            if ((_d = conn.connectionSettings.scopes) === null || _d === void 0 ? void 0 : _d.length) {
+                conn.connectionSettings.scope = (_e = conn.connectionSettings.scopes) === null || _e === void 0 ? void 0 : _e[0];
+            }
+            if (conn.connectionSettings.authorityEndpoint) {
+                conn.connectionSettings.authority = conn.connectionSettings.authorityEndpoint;
+            }
+            // .NET parity alias: keep altBlueprintConnectionName and alternateBlueprintConnectionName in sync.
+            (_f = (_k = conn.connectionSettings).altBlueprintConnectionName) !== null && _f !== void 0 ? _f : (_k.altBlueprintConnectionName = conn.connectionSettings.alternateBlueprintConnectionName);
+            if (conn.connectionSettings.altBlueprintConnectionName) {
+                conn.connectionSettings.alternateBlueprintConnectionName = conn.connectionSettings.altBlueprintConnectionName;
+            }
+        }
+        return conn;
+    }
+}
+exports.MsalConnectionManager = MsalConnectionManager;
+//# sourceMappingURL=msalConnectionManager.js.map

package/dist/src/auth/msal/msalConnectionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalConnectionManager.js","sourceRoot":"","sources":["../../../../src/auth/msal/msalConnectionManager.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,4DAA0E;AAG1E,4DAAoF;AAEpF;;;;GAIG;AACH,MAAa,qBAAsB,SAAQ,qCAAiB;IAC1D,YACE,4BAA4D,IAAI,GAAG,EAAE,EACrE,iBAAsC,EAAE,EACxC,gBAAmC,EAAE;QACrC,KAAK,CAAC,8CAA0B,EAAE,yBAAyB,EAAE,cAAc,EAAE,aAAa,CAAC,CAAA;IAC7F,CAAC;IAES,uBAAuB,CAAE,IAAkB;;;QACnD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,YAAA,IAAI,CAAC,kBAAkB,EAAC,iBAAiB,uCAAjB,iBAAiB,GAAK,IAAI,CAAC,kBAAkB,CAAC,SAAS,IAAI,mCAAmC,EAAA;YACtH,YAAA,IAAI,CAAC,kBAAkB,EAAC,SAAS,uCAAT,SAAS,GAAK,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAA;YAC/E,YAAA,IAAI,CAAC,kBAAkB,EAAC,OAAO,uCAAP,OAAO,GAAK;gBAClC,8BAA8B;gBAC9B,GAAG,IAAA,oCAAgB,EAAC,yBAAyB,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG;gBACnF,GAAG,IAAA,oCAAgB,EAAC,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO;aACxG,EAAA;YACD,6BAA6B;YAC7B,IAAI,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;gBAC9C,IAAI,CAAC,kBAAkB,CAAC,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAA;YACjF,CAAC;YAED,IAAI,MAAA,IAAI,CAAC,kBAAkB,CAAC,MAAM,0CAAE,MAAM,EAAE,CAAC;gBAC3C,IAAI,CAAC,kBAAkB,CAAC,KAAK,GAAG,MAAA,IAAI,CAAC,kBAAkB,CAAC,MAAM,0CAAG,CAAC,CAAC,CAAA;YACrE,CAAC;YAED,IAAI,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;gBAC9C,IAAI,CAAC,kBAAkB,CAAC,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAA;YAC/E,CAAC;YAED,mGAAmG;YACnG,YAAA,IAAI,CAAC,kBAAkB,EAAC,0BAA0B,uCAA1B,0BAA0B,GAAK,IAAI,CAAC,kBAAkB,CAAC,gCAAgC,EAAA;YAC/G,IAAI,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,EAAE,CAAC;gBACvD,IAAI,CAAC,kBAAkB,CAAC,gCAAgC,GAAG,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAAA;YAC/G,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAvCD,sDAuCC"}

package/dist/src/auth/msal/msalConnectionSettings.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import type { ConnectionSettingsBase } from '../settings';
+/**
+ * Connection settings for the MSAL-backed authentication providers (the default providers used for
+ * every {@link AuthType} except `EntraAuthSideCar`).
+ *
+ * @remarks
+ * Mirrors the .NET `Microsoft.Agents.Authentication.Msal.Model.ConnectionSettings` class. Node.js uses
+ * PEM certificate files (`certPemFile`/`certKeyFile`) rather than the Windows certificate store, so the
+ * .NET `CertThumbprint`/`CertSubjectName`/`CertStoreName`/`ValidCertificateOnly` settings have no JS
+ * equivalent; all other MSAL properties map one-to-one.
+ */
+export interface MsalConnectionSettings extends ConnectionSettingsBase {
+    /**
+     * The client secret for the authentication configuration.
+     */
+    clientSecret?: string;
+    /**
+     * The path to the certificate PEM file.
+     */
+    certPemFile?: string;
+    /**
+     * The path to the certificate key file.
+     */
+    certKeyFile?: string;
+    /**
+     * Indicates whether to send the X5C param or not (for SNI authentication).
+     */
+    sendX5C?: boolean;
+    /**
+     * @deprecated Use federatedClientId instead.
+     *
+     * The FIC (First-Party Integration Channel) client ID.
+     */
+    FICClientId?: string;
+    /**
+     * @deprecated Use `authType` set to `'WorkloadIdentity'` and `federatedTokenFile` instead.
+     *
+     * The path to K8s provided token.
+     */
+    WIDAssertionFile?: string;
+    /**
+     * The Azure region for ESTS-R regional token acquisition (e.g. 'westus', 'eastus').
+     * When set, MSAL routes token requests to the specified regional endpoint.
+     * See https://learn.microsoft.com/en-us/entra/msal/javascript/node/regional-authorities for details.
+     */
+    azureRegion?: string;
+    /**
+     * The path to the federated token file used for Workload Identity authentication.
+     */
+    federatedTokenFile?: string;
+    /**
+     * Sets the resource URL for Identity Proxy Manager (IDPM).
+     *
+     * @remarks
+     * Set this to the appropriate resource identifier when the application is running in an environment,
+     * such as a Foundry container, that exposes Managed Identity through a container-specific IMDS endpoint.
+     * This setting is only meaningful when using Identity Proxy Manager (AuthType.IdentityProxyManager) for authentication.
+     */
+    idpmResource?: string;
+    /**
+     * The federated client ID for the authentication configuration, used for workload identity federation scenarios.
+     */
+    federatedClientId?: string;
+}

package/dist/src/auth/msal/msalConnectionSettings.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=msalConnectionSettings.js.map

package/dist/src/auth/msal/msalConnectionSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalConnectionSettings.js","sourceRoot":"","sources":["../../../../src/auth/msal/msalConnectionSettings.ts"],"names":[],"mappings":";AAAA;;;GAGG"}

package/dist/src/auth/{msalTokenCredential.d.ts → msal/msalTokenCredential.d.ts}

@@ -1,5 +1,5 @@
 import { GetTokenOptions, TokenCredential } from '@azure/core-auth';
-import { AuthConfiguration } from './';
+import { AuthConfiguration } from '../authConfiguration';
 /**
  * Token credential implementation that uses MSAL (Microsoft Authentication Library) to acquire access tokens.
  * Implements the Azure Core Auth TokenCredential interface for authentication scenarios.

package/dist/src/auth/{msalTokenCredential.js → msal/msalTokenCredential.js}

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MsalTokenCredential = void 0;
-const _1 = require("./");
+const msalTokenProvider_1 = require("./msalTokenProvider");
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
 const logger = (0, agents_telemetry_1.debug)('agents:msal');
 /**
@@ -25,7 +25,7 @@ class MsalTokenCredential {
     async getToken(scopes, options) {
         logger.debug('getToken scopes=%o', scopes);
         const scope = scopes[0].substring(0, scopes[0].lastIndexOf('/'));
-        const token = await new _1.MsalTokenProvider().getAccessToken(this.authConfig, scope);
+        const token = await new msalTokenProvider_1.MsalTokenProvider().getAccessToken(this.authConfig, scope);
         return {
             token,
             expiresOnTimestamp: Date.now() + 10000

package/dist/src/auth/msal/msalTokenCredential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalTokenCredential.js","sourceRoot":"","sources":["../../../../src/auth/msal/msalTokenCredential.ts"],"names":[],"mappings":";;;AAEA,2DAAuD;AACvD,kEAAmD;AAEnD,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,aAAa,CAAC,CAAA;AAEnC;;;GAGG;AACH,MAAa,mBAAmB;IAC9B;;;OAGG;IACH,YAAqB,UAA6B;QAA7B,eAAU,GAAV,UAAU,CAAmB;IAAG,CAAC;IAEtD;;;;;OAKG;IACI,KAAK,CAAC,QAAQ,CAAE,MAAgB,EAAE,OAAyB;QAChE,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,qCAAiB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAClF,OAAO;YACL,KAAK;YACL,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACvC,CAAA;IACH,CAAC;CACF;AAtBD,kDAsBC"}

package/dist/src/auth/{msalTokenProvider.d.ts → msal/msalTokenProvider.d.ts}

@@ -2,15 +2,35 @@
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-import { AuthConfiguration } from './authConfiguration';
-import { AuthProvider } from './authProvider';
+import { AuthConfiguration } from '../authConfiguration';
+import { AuthProvider } from '../authProvider';
 /**
  * Provides tokens using MSAL.
  */
 export declare class MsalTokenProvider implements AuthProvider {
-    private readonly _agenticTokenCache;
+    private static readonly _accessTokenCache;
+    private static readonly _agenticTokenCache;
+    private static readonly _confidentialClients;
+    private static readonly _maxConfidentialClients;
     readonly connectionSettings?: AuthConfiguration;
     constructor(connectionSettings?: AuthConfiguration);
+    /**
+     * Clears process-wide auth caches.
+     */
+    static clearSharedCaches(): void;
+    private static cacheKey;
+    private static digest;
+    private getOrCreateConfidentialClient;
+    private getFileCacheIdentity;
+    private getAccessTokenCacheKey;
+    private cacheAccessToken;
+    private cacheAgenticToken;
+    private cacheAgenticAuthenticationResult;
+    private getAgenticTokenCacheKey;
+    private getTokenCacheTtlSeconds;
+    private getJwtExpiresAtMs;
+    private getClientSecretClient;
+    private getCertificateClient;
     /**
      * Gets an access token using the auth configuration from the MsalTokenProvider instance and the provided scope.
      * @param scope The scope for the token.