@microsoft/rayfin-auth-provider-fabric 1.35.0-alpha.1412 → 1.35.0-beta.0

package/dist/embeddedFabricLogin.d.ts

@@ -4,17 +4,22 @@ import type { FabricAuthOptions } from './types.js';
  * Embedded-mode Fabric login — acquires a session via postMessage to the
  * parent Fabric Extension Host without opening a popup.
  *
- * 1. Clears any prior Rayfin session in this iframe (`auth.signOut()`)
- *    so a stale session from a previous Fabric user cannot be reused.
+ * 1. Discards any prior session when the host stamps no `?_fu=` hint (see below).
  * 2. Generates PKCE parameters in local variables (no `localStorage`).
  * 3. Sends `auth.requestHandoff` to the parent via `requestHandoff`.
  * 4. Receives the handoff code from the host's `AuthPlugin`.
  * 5. Exchanges the handoff code for tokens via `exchangeVerificationCode`.
- * 6. Creates a session via `createSessionFromTokenResponse` and marks
- *    embedded handoff as completed for this page load.
+ * 6. Creates a session via `createSessionFromTokenResponse`.
  *
  * The session is stored in the iframe's own `localStorage`.
  *
+ * **Sign-out is conditional.** This function used to sign out unconditionally, as the only defence
+ * against reusing a previous Fabric user's session — at the cost of destroying a valid session (and
+ * the serve cookie sealed to it) on every single embedded load. A host that stamps `?_fu=` gives the
+ * workload gate an identity to compare, so that defence is redundant and the sign-out is skipped. A
+ * host that does not is indistinguishable from the pre-feature world, so the original behaviour is
+ * kept for it rather than silently dropping the protection during version skew.
+ *
  * @param auth - Auth instance for token exchange and session management.
  * @param options - Fabric auth options (`returnOrigin` required).
  * @throws `AuthError` - On missing options, transport failure, or token exchange error.

package/dist/embeddedFabricLogin.js

@@ -3,21 +3,27 @@ import { createSessionFromTokenResponse } from '@microsoft/rayfin-auth/_internal
 import { AuthError, assertBrowser } from '@microsoft/rayfin-lib';
 import { requestHandoff } from './PostMessageAuthTransport.js';
 import { markEmbeddedHandoffCompleted } from './fabricAuthHelpers.js';
+import { hasFabricUserHint } from './fabricUserHint.js';
 /**
  * Embedded-mode Fabric login — acquires a session via postMessage to the
  * parent Fabric Extension Host without opening a popup.
  *
- * 1. Clears any prior Rayfin session in this iframe (`auth.signOut()`)
- *    so a stale session from a previous Fabric user cannot be reused.
+ * 1. Discards any prior session when the host stamps no `?_fu=` hint (see below).
  * 2. Generates PKCE parameters in local variables (no `localStorage`).
  * 3. Sends `auth.requestHandoff` to the parent via `requestHandoff`.
  * 4. Receives the handoff code from the host's `AuthPlugin`.
  * 5. Exchanges the handoff code for tokens via `exchangeVerificationCode`.
- * 6. Creates a session via `createSessionFromTokenResponse` and marks
- *    embedded handoff as completed for this page load.
+ * 6. Creates a session via `createSessionFromTokenResponse`.
  *
  * The session is stored in the iframe's own `localStorage`.
  *
+ * **Sign-out is conditional.** This function used to sign out unconditionally, as the only defence
+ * against reusing a previous Fabric user's session — at the cost of destroying a valid session (and
+ * the serve cookie sealed to it) on every single embedded load. A host that stamps `?_fu=` gives the
+ * workload gate an identity to compare, so that defence is redundant and the sign-out is skipped. A
+ * host that does not is indistinguishable from the pre-feature world, so the original behaviour is
+ * kept for it rather than silently dropping the protection during version skew.
+ *
  * @param auth - Auth instance for token exchange and session management.
  * @param options - Fabric auth options (`returnOrigin` required).
  * @throws `AuthError` - On missing options, transport failure, or token exchange error.
@@ -27,22 +33,16 @@ export async function embeddedFabricLogin(auth, options) {
     if (!options.returnOrigin) {
         throw new AuthError('returnOrigin is required for embedded Fabric authentication.', 'MISSING_RETURN_ORIGIN');
     }
-    // Embedded mode: the parent Fabric host is the source of truth for "who
-    // is signed in".  Discard any prior Rayfin session that may have been
-    // left behind in this iframe's localStorage by a previous Fabric user
-    // BEFORE we ask for a fresh handoff.  Without this, a Fabric user
-    // switch (User A → User B) would leave the SPA authenticated as
-    // User A because tryResumeSession would happily return the stale
-    // User A session and we would never reach the handoff path.
-    //
-    // Errors from signOut are swallowed: the stale token may already be
-    // invalid server-side, and the local clear (which signOut performs in
-    // its own catch block) is what actually matters here.
-    try {
-        await auth.signOut();
-    }
-    catch (signOutError) {
-        console.debug('[FabricAuth:embedded] Pre-handoff signOut failed (non-fatal); local session has been cleared', signOutError);
+    if (!hasFabricUserHint()) {
+        // Legacy host: nothing server-side is comparing identities, so fall back to discarding any prior
+        // session before the handoff. Errors are swallowed — the stale token may already be invalid
+        // server-side, and the local clear that signOut performs in its own catch is what matters.
+        try {
+            await auth.signOut();
+        }
+        catch (signOutError) {
+            console.debug('[FabricAuth:embedded] Pre-handoff signOut failed (non-fatal); local session has been cleared', signOutError);
+        }
     }
     // PKCE in local variables only — not persisted to localStorage.
     const codeVerifier = generateCodeVerifier();

package/dist/ensureSignedInWithFabric.d.ts

@@ -6,16 +6,14 @@ import type { FabricAuthOptions } from './types.js';
  * Implements a multi-step waterfall — the first step that succeeds short-circuits the rest:
  *
  * 1. **Already authenticated** — if `auth.getSession().isAuthenticated` is true,
- *    return the existing session immediately.  **Skipped on the first
- *    embedded call per page load** to avoid silently reusing a stale
- *    session belonging to a previously signed-in Fabric user.
+ *    return the existing session immediately.  On a legacy embedded host (one that
+ *    stamps no `?_fu=` hint) this is skipped on the first call per page load, so a
+ *    session belonging to a previously signed-in Fabric user cannot be reused.
  * 2. **Refresh token** — if a refresh token is available, attempt `auth.refreshSession()`.
  *    Return the refreshed session on success; continue on failure.
- *    Also skipped on the first embedded call per page load.
+ *    Subject to the same skip.
  * 3. **Embedded mode** — if running inside a Fabric iframe (`fabricEmbedded=true`),
  *    use `embeddedFabricLogin()` to acquire a session via `postMessage` handoff.
- *    `embeddedFabricLogin` performs a hard `auth.signOut()` before the
- *    handoff so the new session always reflects the current Fabric user.
  * 4. **Open Fabric broker** — no existing auth path available. Open the Fabric Portal
  *    in a new tab via `initiateFabricLogin()` and wait for the Fabric extension to post
  *    the handoff code via `postMessage`. The function exchanges the code internally

package/dist/ensureSignedInWithFabric.js

@@ -1,6 +1,7 @@
 import { AuthError, assertBrowser } from '@microsoft/rayfin-lib';
 import { embeddedFabricLogin } from './embeddedFabricLogin.js';
 import { hasEmbeddedHandoffCompleted, isEmbeddedMode, tryResumeSession, } from './fabricAuthHelpers.js';
+import { hasFabricUserHint } from './fabricUserHint.js';
 import { initiateFabricLogin } from './initiateFabricLogin.js';
 /**
  * Ensures the user is signed in via Fabric brokered authentication.
@@ -8,16 +9,14 @@ import { initiateFabricLogin } from './initiateFabricLogin.js';
  * Implements a multi-step waterfall — the first step that succeeds short-circuits the rest:
  *
  * 1. **Already authenticated** — if `auth.getSession().isAuthenticated` is true,
- *    return the existing session immediately.  **Skipped on the first
- *    embedded call per page load** to avoid silently reusing a stale
- *    session belonging to a previously signed-in Fabric user.
+ *    return the existing session immediately.  On a legacy embedded host (one that
+ *    stamps no `?_fu=` hint) this is skipped on the first call per page load, so a
+ *    session belonging to a previously signed-in Fabric user cannot be reused.
  * 2. **Refresh token** — if a refresh token is available, attempt `auth.refreshSession()`.
  *    Return the refreshed session on success; continue on failure.
- *    Also skipped on the first embedded call per page load.
+ *    Subject to the same skip.
  * 3. **Embedded mode** — if running inside a Fabric iframe (`fabricEmbedded=true`),
  *    use `embeddedFabricLogin()` to acquire a session via `postMessage` handoff.
- *    `embeddedFabricLogin` performs a hard `auth.signOut()` before the
- *    handoff so the new session always reflects the current Fabric user.
  * 4. **Open Fabric broker** — no existing auth path available. Open the Fabric Portal
  *    in a new tab via `initiateFabricLogin()` and wait for the Fabric extension to post
  *    the handoff code via `postMessage`. The function exchanges the code internally
@@ -66,23 +65,26 @@ import { initiateFabricLogin } from './initiateFabricLogin.js';
  */
 export async function ensureSignedInWithFabric(auth, options) {
     assertBrowser('ensureSignedInWithFabric');
-    // Steps 1-2: existing session or refresh.
-    // In embedded mode we MUST skip this on the first call per page load —
-    // the session in iframe localStorage may belong to a previously
-    // signed-in Fabric user.  After the first successful handoff this load
-    // (`hasEmbeddedHandoffCompleted()` is true) the cached session is the
-    // current user's, so resuming is safe and avoids redundant handoffs.
     const inEmbeddedMode = isEmbeddedMode(options);
-    const skipResume = inEmbeddedMode && !hasEmbeddedHandoffCompleted();
-    if (!skipResume) {
+    // Steps 1-2: existing session or refresh.
+    //
+    // A host that stamps `?_fu=` has already had its cookie identity-checked by the workload gate
+    // before this code ran — a cross-user cookie is cleared and a fresh sign-in bootstrap is served,
+    // overwriting this origin's persisted session — so resuming is safe from the first call.
+    //
+    // A host that stamps no hint is indistinguishable from the pre-feature world: nothing compared the
+    // identities, so the persisted session may belong to a previously signed-in Fabric user. There we
+    // keep the original behaviour and skip resume until a handoff has run this page load.
+    const skipResume = inEmbeddedMode && !hasFabricUserHint() && !hasEmbeddedHandoffCompleted();
+    if (skipResume) {
+        console.debug('[FabricAuth] Embedded host stamped no user hint — skipping session resume to avoid a stale cross-user session');
+    }
+    else {
         const resumed = await tryResumeSession(auth);
         if (resumed) {
             return resumed;
         }
     }
-    else {
-        console.debug('[FabricAuth] Embedded mode first load — skipping session resume to avoid stale cross-user session');
-    }
     // Step 3: Embedded mode — postMessage auth via parent iframe host
     if (inEmbeddedMode) {
         console.debug('[FabricAuth] Embedded mode detected, using postMessage auth');

package/dist/fabricAuthHelpers.d.ts

@@ -11,21 +11,17 @@ import type { FabricAuthOptions } from './types.js';
  */
 export declare function isEmbeddedMode(options: FabricAuthOptions): boolean;
 /**
- * Returns whether an embedded postMessage handoff has already completed
- * during the current page load.
+ * Returns whether an embedded postMessage handoff has already completed during this page load.
  */
 export declare function hasEmbeddedHandoffCompleted(): boolean;
 /**
- * Marks that an embedded postMessage handoff has completed for this page
- * load.  Subsequent calls to {@link tryResumeSession} will be allowed
- * (the established session is the current user's session).
+ * Marks that an embedded postMessage handoff has completed for this page load.
  */
 export declare function markEmbeddedHandoffCompleted(): void;
 /**
- * Test-only helper that clears the embedded-handoff completion flag.
- * Not exported from the package barrel.
+ * Clears the embedded-handoff completion flag.
  *
- * @internal
+ * @internal Test helper. Not exported from the package barrel.
  */
 export declare function resetEmbeddedHandoffStateForTests(): void;
 /**

package/dist/fabricAuthHelpers.js

@@ -12,43 +12,34 @@ export function isEmbeddedMode(options) {
     return sharedIsEmbeddedMode(options);
 }
 /**
- * Module-level flag tracking whether an embedded postMessage handoff has
- * already completed during the current page load.
+ * Tracks whether an embedded postMessage handoff has completed during the current page load.
  *
- * In embedded mode the parent Fabric host is the source of truth for "who
- * is signed in".  A stale Rayfin session left over from a previous user in
- * the iframe's `localStorage` must NOT be silently reused — otherwise
- * switching Fabric users without reloading the iframe leaves the SPA
- * authenticated as the previous user.
+ * Only consulted on the **legacy** embedded path — a host that stamps no `?_fu=` hint, and therefore
+ * gives the workload gate nothing to compare. There, a persisted session cannot be trusted to belong
+ * to the current Fabric user, so the first auth call per page load skips resume and forces a full
+ * handoff. Once that handoff has run, the stored session is known to be the current user's and later
+ * calls in the same load may resume it without thrashing the postMessage channel.
  *
- * On the first embedded auth call per page load we therefore skip
- * {@link tryResumeSession} and run the full sign-out + handoff path
- * inside {@link embeddedFabricLogin}.  Once that completes we set this
- * flag so subsequent calls (e.g. additional components asking for the
- * session) can reuse the freshly established session via
- * {@link tryResumeSession} without thrashing the postMessage channel.
+ * Hosts that do stamp a hint never reach this flag: the gate rejects a cross-user cookie before the
+ * app boots, so resume is safe from the first call.
  */
 let embeddedHandoffCompletedThisLoad = false;
 /**
- * Returns whether an embedded postMessage handoff has already completed
- * during the current page load.
+ * Returns whether an embedded postMessage handoff has already completed during this page load.
  */
 export function hasEmbeddedHandoffCompleted() {
     return embeddedHandoffCompletedThisLoad;
 }
 /**
- * Marks that an embedded postMessage handoff has completed for this page
- * load.  Subsequent calls to {@link tryResumeSession} will be allowed
- * (the established session is the current user's session).
+ * Marks that an embedded postMessage handoff has completed for this page load.
  */
 export function markEmbeddedHandoffCompleted() {
     embeddedHandoffCompletedThisLoad = true;
 }
 /**
- * Test-only helper that clears the embedded-handoff completion flag.
- * Not exported from the package barrel.
+ * Clears the embedded-handoff completion flag.
  *
- * @internal
+ * @internal Test helper. Not exported from the package barrel.
  */
 export function resetEmbeddedHandoffStateForTests() {
     embeddedHandoffCompletedThisLoad = false;

package/dist/fabricUserHint.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Fabric user-hint detection.
+ *
+ * The AppBackend host stamps an opaque `?_fu=` hint onto the embedded iframe URL, and the workload's
+ * static-hosting gate compares it against the hint sealed into the serve cookie. Its presence is the
+ * SDK's signal that **the host is new enough for cross-user protection to exist server-side**, and
+ * therefore that a persisted session may safely be resumed.
+ *
+ * When it is absent — an older AppBackend that does not stamp it, or a host that could not resolve
+ * the signed-in user — no server-side comparison is happening, so the SDK falls back to the original
+ * behaviour: discard any persisted session and run a full handoff on every embedded load. That is
+ * slower, but it is the only thing standing between a previous Fabric user's session and the current
+ * one on a host that cannot help.
+ *
+ * The URL value is captured eagerly at module load, so a client-side navigation that strips the query
+ * string does not make the SDK think the host got older mid-session and start signing the user out.
+ *
+ * That capture is deliberately held in module state rather than `sessionStorage`. Storage outlives a
+ * document, so a hint from an earlier load would still answer for a load the host never stamped — for
+ * example after a user switch where identity resolution failed — and the SDK would resume a persisted
+ * session that no server-side comparison ever vetted. Module state dies with the document, which is
+ * exactly the lifetime this signal is allowed to have.
+ *
+ * @internal Not exported from the package barrel.
+ */
+/**
+ * Captures the `?_fu=` value from the current URL.
+ *
+ * Called once at module load to snapshot the entry URL. Also the in-package injection point for
+ * tests; it is not exported from the barrel, so app code cannot use it to fake the signal.
+ *
+ * @returns `true` when the URL carried a hint, whether or not it had already been captured.
+ */
+export declare function persistFabricUserHintFromUrl(): boolean;
+/**
+ * Whether the host stamped a Fabric user hint for this app.
+ *
+ * Reports the entry URL captured at module load and nothing else. It deliberately does not re-read
+ * the live URL: on the client the hint's *presence* suppresses the cross-user sign-out, so a value
+ * added after load - by app routing, a query-preserving link, or anything else the gate never saw -
+ * would let the page vouch for itself. The server-side comparison has the opposite polarity, where a
+ * forged hint can only force a re-authentication, so this direction is the one that has to be sealed.
+ *
+ * @returns `true` when server-side identity gating is in play and a persisted session may be reused.
+ */
+export declare function hasFabricUserHint(): boolean;
+/**
+ * Clears the captured hint.
+ *
+ * @internal Test helper.
+ */
+export declare function clearFabricUserHint(): void;
+//# sourceMappingURL=fabricUserHint.d.ts.map

package/dist/fabricUserHint.js

@@ -0,0 +1,77 @@
+/**
+ * Fabric user-hint detection.
+ *
+ * The AppBackend host stamps an opaque `?_fu=` hint onto the embedded iframe URL, and the workload's
+ * static-hosting gate compares it against the hint sealed into the serve cookie. Its presence is the
+ * SDK's signal that **the host is new enough for cross-user protection to exist server-side**, and
+ * therefore that a persisted session may safely be resumed.
+ *
+ * When it is absent — an older AppBackend that does not stamp it, or a host that could not resolve
+ * the signed-in user — no server-side comparison is happening, so the SDK falls back to the original
+ * behaviour: discard any persisted session and run a full handoff on every embedded load. That is
+ * slower, but it is the only thing standing between a previous Fabric user's session and the current
+ * one on a host that cannot help.
+ *
+ * The URL value is captured eagerly at module load, so a client-side navigation that strips the query
+ * string does not make the SDK think the host got older mid-session and start signing the user out.
+ *
+ * That capture is deliberately held in module state rather than `sessionStorage`. Storage outlives a
+ * document, so a hint from an earlier load would still answer for a load the host never stamped — for
+ * example after a user switch where identity resolution failed — and the SDK would resume a persisted
+ * session that no server-side comparison ever vetted. Module state dies with the document, which is
+ * exactly the lifetime this signal is allowed to have.
+ *
+ * @internal Not exported from the package barrel.
+ */
+const USER_HINT_QUERY_PARAM = '_fu';
+// Scoped to this document. See the note above on why this is not persisted.
+let hintSeenThisDocument = false;
+/**
+ * Captures the `?_fu=` value from the current URL.
+ *
+ * Called once at module load to snapshot the entry URL. Also the in-package injection point for
+ * tests; it is not exported from the barrel, so app code cannot use it to fake the signal.
+ *
+ * @returns `true` when the URL carried a hint, whether or not it had already been captured.
+ */
+export function persistFabricUserHintFromUrl() {
+    if (typeof window === 'undefined') {
+        return false;
+    }
+    try {
+        const hint = new URLSearchParams(window.location.search).get(USER_HINT_QUERY_PARAM);
+        if (hint) {
+            hintSeenThisDocument = true;
+            return true;
+        }
+    }
+    catch {
+        // window.location may be unavailable in some non-browser hosts.
+    }
+    return false;
+}
+// Captured at module load so a session resumed before any auth call still sees the hint.
+persistFabricUserHintFromUrl();
+/**
+ * Whether the host stamped a Fabric user hint for this app.
+ *
+ * Reports the entry URL captured at module load and nothing else. It deliberately does not re-read
+ * the live URL: on the client the hint's *presence* suppresses the cross-user sign-out, so a value
+ * added after load - by app routing, a query-preserving link, or anything else the gate never saw -
+ * would let the page vouch for itself. The server-side comparison has the opposite polarity, where a
+ * forged hint can only force a re-authentication, so this direction is the one that has to be sealed.
+ *
+ * @returns `true` when server-side identity gating is in play and a persisted session may be reused.
+ */
+export function hasFabricUserHint() {
+    return hintSeenThisDocument;
+}
+/**
+ * Clears the captured hint.
+ *
+ * @internal Test helper.
+ */
+export function clearFabricUserHint() {
+    hintSeenThisDocument = false;
+}
+//# sourceMappingURL=fabricUserHint.js.map

package/dist/initEmbeddedAuth.d.ts

@@ -11,13 +11,11 @@ import type { FabricAuthOptions } from './types.js';
  * **Behaviour:**
  * - If `fabricEmbedded=true` is **not** in the URL and `options.fabricEmbedded`
  *   is not `true`, returns `null` immediately (no-op).
- * - On the first embedded call per page load, skips session resume to
- *   avoid silently reusing a stale session belonging to a previously
- *   signed-in Fabric user, and goes straight to the postMessage handoff.
- *   `embeddedFabricLogin` performs a hard `auth.signOut()` before the
- *   handoff so the new session always reflects the current Fabric user.
- * - On subsequent calls within the same page load, runs the standard
- *   resume waterfall (existing session → refresh token → handoff).
+ * - When the host stamps a `?_fu=` hint, runs the standard resume waterfall
+ *   (existing session → refresh token → handoff).
+ * - When it does not, skips resume on the first call per page load and goes
+ *   straight to the handoff, preserving the pre-hint protection against reusing
+ *   a previously signed-in Fabric user's session.
  *
  * Apps that also support the popup flow should continue to call
  * {@link ensureSignedInWithFabric} from a user-gesture handler for the

package/dist/initEmbeddedAuth.js

@@ -1,5 +1,6 @@
 import { embeddedFabricLogin } from './embeddedFabricLogin.js';
 import { hasEmbeddedHandoffCompleted, isEmbeddedMode, tryResumeSession, } from './fabricAuthHelpers.js';
+import { hasFabricUserHint } from './fabricUserHint.js';
 /**
  * Initializes embedded Fabric authentication if running inside an iframe
  * with `?fabricEmbedded=true`.
@@ -11,13 +12,11 @@ import { hasEmbeddedHandoffCompleted, isEmbeddedMode, tryResumeSession, } from '
  * **Behaviour:**
  * - If `fabricEmbedded=true` is **not** in the URL and `options.fabricEmbedded`
  *   is not `true`, returns `null` immediately (no-op).
- * - On the first embedded call per page load, skips session resume to
- *   avoid silently reusing a stale session belonging to a previously
- *   signed-in Fabric user, and goes straight to the postMessage handoff.
- *   `embeddedFabricLogin` performs a hard `auth.signOut()` before the
- *   handoff so the new session always reflects the current Fabric user.
- * - On subsequent calls within the same page load, runs the standard
- *   resume waterfall (existing session → refresh token → handoff).
+ * - When the host stamps a `?_fu=` hint, runs the standard resume waterfall
+ *   (existing session → refresh token → handoff).
+ * - When it does not, skips resume on the first call per page load and goes
+ *   straight to the handoff, preserving the pre-hint protection against reusing
+ *   a previously signed-in Fabric user's session.
  *
  * Apps that also support the popup flow should continue to call
  * {@link ensureSignedInWithFabric} from a user-gesture handler for the
@@ -31,20 +30,17 @@ export async function initEmbeddedAuth(auth, options) {
     if (!isEmbeddedMode(options)) {
         return null;
     }
-    // Steps 1-2: existing session or refresh.
-    // Skip on the first embedded call per page load — a session left in
-    // iframe localStorage may belong to a previously signed-in Fabric
-    // user, and silently resuming it would defeat the handoff.  Once
-    // `embeddedFabricLogin` has succeeded for this load, the cached
-    // session is the current user's and resuming is safe.
-    if (hasEmbeddedHandoffCompleted()) {
+    // Steps 1-2: existing session or refresh. Skipped on a legacy host (no `?_fu=` hint) until a
+    // handoff has run this page load, because nothing server-side compared the session's identity
+    // against the current Fabric user. See ensureSignedInWithFabric for the full reasoning.
+    if (hasFabricUserHint() || hasEmbeddedHandoffCompleted()) {
         const resumed = await tryResumeSession(auth);
         if (resumed) {
             return resumed;
         }
     }
     else {
-        console.debug('[FabricAuth:initEmbedded] First embedded call this page load — skipping session resume to avoid stale cross-user session');
+        console.debug('[FabricAuth:initEmbedded] Embedded host stamped no user hint — skipping session resume to avoid a stale cross-user session');
     }
     // Step 3: postMessage handoff (no popup, no window.open)
     console.debug('[FabricAuth:initEmbedded] Starting postMessage handoff flow');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microsoft/rayfin-auth-provider-fabric",
-  "version": "1.35.0-alpha.1412",
+  "version": "1.35.0-beta.0",
   "description": "Fabric brokered authentication provider for Rayfin SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,9 +13,9 @@
   ],
   "type": "module",
   "dependencies": {
-    "@microsoft/rayfin-auth": "1.35.0-alpha.1412",
-    "@microsoft/rayfin-lib": "1.35.0-alpha.1412",
-    "@microsoft/fabric-embedded-host": "1.35.0-alpha.1412"
+    "@microsoft/rayfin-auth": "1.35.0-beta.0",
+    "@microsoft/fabric-embedded-host": "1.35.0-beta.0",
+    "@microsoft/rayfin-lib": "1.35.0-beta.0"
   },
   "devDependencies": {
     "typescript": "^5.8.3",