@azure/identity 4.0.1-alpha.20240112.2 → 4.0.1-alpha.20240117.2

package/dist/index.js

@@ -190,7 +190,7 @@ function formatSuccess(scope) {
  */
 function formatError(scope, error) {
     let message = "ERROR.";
-    if (scope?.length) {
+    if (scope === null || scope === void 0 ? void 0 : scope.length) {
         message += ` Scopes: ${Array.isArray(scope) ? scope.join(", ") : scope}.`;
     }
     return `${message} Error message: ${typeof error === "string" ? error : error.message}.`;
@@ -234,11 +234,7 @@ function credentialLoggerInstance(title, parent, log = logger$n) {
  */
 function credentialLogger(title, log = logger$n) {
     const credLogger = credentialLoggerInstance(title, undefined, log);
-    return {
-        ...credLogger,
-        parent: log,
-        getToken: credentialLoggerInstance("=> getToken()", credLogger, log),
-    };
+    return Object.assign(Object.assign({}, credLogger), { parent: log, getToken: credentialLoggerInstance("=> getToken()", credLogger, log) });
 }
 
 // Copyright (c) Microsoft Corporation.
@@ -429,7 +425,7 @@ class MsalBaseUtilities {
      * If the token received is invalid, an error will be thrown depending on what's missing.
      */
     handleResult(scopes, clientId, result, getTokenOptions) {
-        if (result?.account) {
+        if (result === null || result === void 0 ? void 0 : result.account) {
             this.account = msalToPublic(clientId, result.account);
         }
         ensureValidMsalToken(scopes, this.logger, result, getTokenOptions);
@@ -478,11 +474,7 @@ class MsalBaseUtilities {
 // transformations.ts
 function publicToMsal(account) {
     const [environment] = account.authority.match(/([a-z]*\.[a-z]*\.[a-z]*)/) || [""];
-    return {
-        ...account,
-        localAccountId: account.homeAccountId,
-        environment,
-    };
+    return Object.assign(Object.assign({}, account), { localAccountId: account.homeAccountId, environment });
 }
 function msalToPublic(clientId, account) {
     const record = {
@@ -551,6 +543,7 @@ function createConfigurationErrorMessage(tenantId) {
  * @internal
  */
 function processMultiTenantRequest(tenantId, getTokenOptions, additionallyAllowedTenantIds = [], logger) {
+    var _a;
     let resolvedTenantId;
     if (process.env.AZURE_IDENTITY_DISABLE_MULTITENANTAUTH) {
         resolvedTenantId = tenantId;
@@ -559,14 +552,14 @@ function processMultiTenantRequest(tenantId, getTokenOptions, additionallyAllowe
         resolvedTenantId = tenantId;
     }
     else {
-        resolvedTenantId = getTokenOptions?.tenantId ?? tenantId;
+        resolvedTenantId = (_a = getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.tenantId) !== null && _a !== void 0 ? _a : tenantId;
     }
     if (tenantId &&
         resolvedTenantId !== tenantId &&
         !additionallyAllowedTenantIds.includes("*") &&
         !additionallyAllowedTenantIds.some((t) => t.localeCompare(resolvedTenantId) === 0)) {
         const message = createConfigurationErrorMessage(tenantId);
-        logger?.info(message);
+        logger === null || logger === void 0 ? void 0 : logger.info(message);
         throw new CredentialUnavailableError(message);
     }
     return resolvedTenantId;
@@ -704,13 +697,13 @@ const noCorrelationId = "noCorrelationId";
  */
 function getIdentityClientAuthorityHost(options) {
     // The authorityHost can come from options or from the AZURE_AUTHORITY_HOST environment variable.
-    let authorityHost = options?.authorityHost;
+    let authorityHost = options === null || options === void 0 ? void 0 : options.authorityHost;
     // The AZURE_AUTHORITY_HOST environment variable can only be provided in Node.js.
     if (coreUtil.isNode) {
-        authorityHost = authorityHost ?? process.env.AZURE_AUTHORITY_HOST;
+        authorityHost = authorityHost !== null && authorityHost !== void 0 ? authorityHost : process.env.AZURE_AUTHORITY_HOST;
     }
     // If the authorityHost is not provided, we use the default one from the public cloud: https://login.microsoftonline.com
-    return authorityHost ?? DefaultAuthorityHost;
+    return authorityHost !== null && authorityHost !== void 0 ? authorityHost : DefaultAuthorityHost;
 }
 /**
  * The network module used by the Identity credentials.
@@ -721,30 +714,25 @@ function getIdentityClientAuthorityHost(options) {
  */
 class IdentityClient extends coreClient.ServiceClient {
     constructor(options) {
+        var _a, _b;
         const packageDetails = `azsdk-js-identity/${SDK_VERSION}`;
-        const userAgentPrefix = options?.userAgentOptions?.userAgentPrefix
+        const userAgentPrefix = ((_a = options === null || options === void 0 ? void 0 : options.userAgentOptions) === null || _a === void 0 ? void 0 : _a.userAgentPrefix)
             ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}`
             : `${packageDetails}`;
         const baseUri = getIdentityClientAuthorityHost(options);
         if (!baseUri.startsWith("https:")) {
             throw new Error("The authorityHost address must use the 'https' protocol.");
         }
-        super({
-            requestContentType: "application/json; charset=utf-8",
-            retryOptions: {
+        super(Object.assign(Object.assign({ requestContentType: "application/json; charset=utf-8", retryOptions: {
                 maxRetries: 3,
-            },
-            ...options,
-            userAgentOptions: {
+            } }, options), { userAgentOptions: {
                 userAgentPrefix,
-            },
-            baseUri,
-        });
+            }, baseUri }));
         this.authorityHost = baseUri;
         this.abortControllers = new Map();
-        this.allowLoggingAccountIdentifiers = options?.loggingOptions?.allowLoggingAccountIdentifiers;
+        this.allowLoggingAccountIdentifiers = (_b = options === null || options === void 0 ? void 0 : options.loggingOptions) === null || _b === void 0 ? void 0 : _b.allowLoggingAccountIdentifiers;
         // used for WorkloadIdentity
-        this.tokenCredentialOptions = { ...options };
+        this.tokenCredentialOptions = Object.assign({}, options);
     }
     async sendTokenRequest(request) {
         logger$n.info(`IdentityClient: sending token request to [${request.url}]`);
@@ -852,10 +840,8 @@ class IdentityClient extends coreClient.ServiceClient {
         this.abortControllers.set(key, undefined);
     }
     getCorrelationId(options) {
-        const parameter = options?.body
-            ?.split("&")
-            .map((part) => part.split("="))
-            .find(([key]) => key === "client-request-id");
+        var _a;
+        const parameter = (_a = options === null || options === void 0 ? void 0 : options.body) === null || _a === void 0 ? void 0 : _a.split("&").map((part) => part.split("=")).find(([key]) => key === "client-request-id");
         return parameter && parameter.length ? parameter[1] || noCorrelationId : noCorrelationId;
     }
     // The MSAL network module methods follow
@@ -863,8 +849,8 @@ class IdentityClient extends coreClient.ServiceClient {
         const request = coreRestPipeline.createPipelineRequest({
             url,
             method: "GET",
-            body: options?.body,
-            headers: coreRestPipeline.createHttpHeaders(options?.headers),
+            body: options === null || options === void 0 ? void 0 : options.body,
+            headers: coreRestPipeline.createHttpHeaders(options === null || options === void 0 ? void 0 : options.headers),
             abortSignal: this.generateAbortSignal(noCorrelationId),
         });
         const response = await this.sendRequest(request);
@@ -879,8 +865,8 @@ class IdentityClient extends coreClient.ServiceClient {
         const request = coreRestPipeline.createPipelineRequest({
             url,
             method: "POST",
-            body: options?.body,
-            headers: coreRestPipeline.createHttpHeaders(options?.headers),
+            body: options === null || options === void 0 ? void 0 : options.body,
+            headers: coreRestPipeline.createHttpHeaders(options === null || options === void 0 ? void 0 : options.headers),
             // MSAL doesn't send the correlation ID on the get requests.
             abortSignal: this.generateAbortSignal(this.getCorrelationId(options)),
         });
@@ -1094,34 +1080,29 @@ const msalNodeFlowNativeBrokerControl = {
  */
 class MsalNode extends MsalBaseUtilities {
     constructor(options) {
+        var _a, _b, _c, _d, _e, _f, _g;
         super(options);
         this.app = {};
         this.caeApp = {};
         this.requiresConfidential = false;
         this.msalConfig = this.defaultNodeMsalConfig(options);
         this.tenantId = resolveTenantId(options.logger, options.tenantId, options.clientId);
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.tokenCredentialOptions?.additionallyAllowedTenants);
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds((_a = options === null || options === void 0 ? void 0 : options.tokenCredentialOptions) === null || _a === void 0 ? void 0 : _a.additionallyAllowedTenants);
         this.clientId = this.msalConfig.auth.clientId;
-        if (options?.getAssertion) {
+        if (options === null || options === void 0 ? void 0 : options.getAssertion) {
             this.getAssertion = options.getAssertion;
         }
-        this.enableBroker = options?.brokerOptions?.enabled;
-        this.enableMsaPassthrough = options?.brokerOptions?.legacyEnableMsaPassthrough;
-        this.parentWindowHandle = options.brokerOptions?.parentWindowHandle;
+        this.enableBroker = (_b = options === null || options === void 0 ? void 0 : options.brokerOptions) === null || _b === void 0 ? void 0 : _b.enabled;
+        this.enableMsaPassthrough = (_c = options === null || options === void 0 ? void 0 : options.brokerOptions) === null || _c === void 0 ? void 0 : _c.legacyEnableMsaPassthrough;
+        this.parentWindowHandle = (_d = options.brokerOptions) === null || _d === void 0 ? void 0 : _d.parentWindowHandle;
         // If persistence has been configured
-        if (persistenceProvider !== undefined && options.tokenCachePersistenceOptions?.enabled) {
-            const nonCaeOptions = {
-                name: `${options.tokenCachePersistenceOptions.name}.${CACHE_NON_CAE_SUFFIX}`,
-                ...options.tokenCachePersistenceOptions,
-            };
-            const caeOptions = {
-                name: `${options.tokenCachePersistenceOptions.name}.${CACHE_CAE_SUFFIX}`,
-                ...options.tokenCachePersistenceOptions,
-            };
+        if (persistenceProvider !== undefined && ((_e = options.tokenCachePersistenceOptions) === null || _e === void 0 ? void 0 : _e.enabled)) {
+            const nonCaeOptions = Object.assign({ name: `${options.tokenCachePersistenceOptions.name}.${CACHE_NON_CAE_SUFFIX}` }, options.tokenCachePersistenceOptions);
+            const caeOptions = Object.assign({ name: `${options.tokenCachePersistenceOptions.name}.${CACHE_CAE_SUFFIX}` }, options.tokenCachePersistenceOptions);
             this.createCachePlugin = () => persistenceProvider(nonCaeOptions);
             this.createCachePluginCae = () => persistenceProvider(caeOptions);
         }
-        else if (options.tokenCachePersistenceOptions?.enabled) {
+        else if ((_f = options.tokenCachePersistenceOptions) === null || _f === void 0 ? void 0 : _f.enabled) {
             throw new Error([
                 "Persistent token caching was requested, but no persistence provider was configured.",
                 "You must install the identity-cache-persistence plugin package (`npm install --save @azure/identity-cache-persistence`)",
@@ -1138,7 +1119,7 @@ class MsalNode extends MsalBaseUtilities {
                 "`useIdentityPlugin(createNativeBrokerPlugin())` before using `enableBroker`.",
             ].join(" "));
         }
-        this.azureRegion = options.regionalAuthority ?? process.env.AZURE_REGIONAL_AUTHORITY_NAME;
+        this.azureRegion = (_g = options.regionalAuthority) !== null && _g !== void 0 ? _g : process.env.AZURE_REGIONAL_AUTHORITY_NAME;
         if (this.azureRegion === RegionalAuthority.AutoDiscoverRegion) {
             this.azureRegion = "AUTO_DISCOVER";
         }
@@ -1147,15 +1128,12 @@ class MsalNode extends MsalBaseUtilities {
      * Generates a MSAL configuration that generally works for Node.js
      */
     defaultNodeMsalConfig(options) {
+        var _a;
         const clientId = options.clientId || DeveloperSignOnClientId;
         const tenantId = resolveTenantId(options.logger, options.tenantId, options.clientId);
         this.authorityHost = options.authorityHost || process.env.AZURE_AUTHORITY_HOST;
         const authority = getAuthority(tenantId, this.authorityHost);
-        this.identityClient = new IdentityClient({
-            ...options.tokenCredentialOptions,
-            authorityHost: authority,
-            loggingOptions: options.loggingOptions,
-        });
+        this.identityClient = new IdentityClient(Object.assign(Object.assign({}, options.tokenCredentialOptions), { authorityHost: authority, loggingOptions: options.loggingOptions }));
         const clientCapabilities = [];
         return {
             auth: {
@@ -1170,7 +1148,7 @@ class MsalNode extends MsalBaseUtilities {
                 loggerOptions: {
                     loggerCallback: defaultLoggerCallback(options.logger),
                     logLevel: getMSALLogLevel(logger$o.getLogLevel()),
-                    piiLoggingEnabled: options.loggingOptions?.enableUnsafeSupportLogging,
+                    piiLoggingEnabled: (_a = options.loggingOptions) === null || _a === void 0 ? void 0 : _a.enableUnsafeSupportLogging,
                 },
             },
         };
@@ -1194,21 +1172,21 @@ class MsalNode extends MsalBaseUtilities {
      * Prepares the MSAL applications.
      */
     async init(options) {
-        if (options?.abortSignal) {
+        if (options === null || options === void 0 ? void 0 : options.abortSignal) {
             options.abortSignal.addEventListener("abort", () => {
                 // This will abort any pending request in the IdentityClient,
                 // based on the received or generated correlationId
                 this.identityClient.abortRequests(options.correlationId);
             });
         }
-        const app = options?.enableCae ? this.caeApp : this.app;
-        if (options?.enableCae) {
+        const app = (options === null || options === void 0 ? void 0 : options.enableCae) ? this.caeApp : this.app;
+        if (options === null || options === void 0 ? void 0 : options.enableCae) {
             this.msalConfig.auth.clientCapabilities = ["cp1"];
         }
         if (app.public || app.confidential) {
             return;
         }
-        if (options?.enableCae && this.createCachePluginCae !== undefined) {
+        if ((options === null || options === void 0 ? void 0 : options.enableCae) && this.createCachePluginCae !== undefined) {
             this.msalConfig.cache = {
                 cachePlugin: await this.createCachePluginCae(),
             };
@@ -1227,7 +1205,7 @@ class MsalNode extends MsalBaseUtilities {
                 this.logger.warning("Parent window handle is not specified for the broker. This may cause unexpected behavior. Please provide the parentWindowHandle.");
             }
         }
-        if (options?.enableCae) {
+        if (options === null || options === void 0 ? void 0 : options.enableCae) {
             this.caeApp.public = new msalCommon__namespace.PublicClientApplication(this.msalConfig);
         }
         else {
@@ -1240,7 +1218,7 @@ class MsalNode extends MsalBaseUtilities {
         if (this.msalConfig.auth.clientSecret ||
             this.msalConfig.auth.clientAssertion ||
             this.msalConfig.auth.clientCertificate) {
-            if (options?.enableCae) {
+            if (options === null || options === void 0 ? void 0 : options.enableCae) {
                 this.caeApp.confidential = new msalCommon__namespace.ConfidentialClientApplication(this.msalConfig);
             }
             else {
@@ -1265,7 +1243,7 @@ class MsalNode extends MsalBaseUtilities {
                 .catch(reject);
             if (abortSignal) {
                 abortSignal.addEventListener("abort", () => {
-                    onCancel?.();
+                    onCancel === null || onCancel === void 0 ? void 0 : onCancel();
                 });
             }
         });
@@ -1278,7 +1256,7 @@ class MsalNode extends MsalBaseUtilities {
             return this.account;
         }
         const cache = this.getApp("confidentialFirst", enableCae).getTokenCache();
-        const accountsByTenant = await cache?.getAllAccounts();
+        const accountsByTenant = await (cache === null || cache === void 0 ? void 0 : cache.getAllAccounts());
         if (!accountsByTenant) {
             return;
         }
@@ -1300,7 +1278,8 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
      * Attempts to retrieve a token from cache.
      */
     async getTokenSilent(scopes, options) {
-        await this.getActiveAccount(options?.enableCae);
+        var _a, _b, _c;
+        await this.getActiveAccount(options === null || options === void 0 ? void 0 : options.enableCae);
         if (!this.account) {
             throw new AuthenticationRequiredError({
                 scopes,
@@ -1311,10 +1290,10 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
         const silentRequest = {
             // To be able to re-use the account, the Token Cache must also have been provided.
             account: publicToMsal(this.account),
-            correlationId: options?.correlationId,
+            correlationId: options === null || options === void 0 ? void 0 : options.correlationId,
             scopes,
-            authority: options?.authority,
-            claims: options?.claims,
+            authority: options === null || options === void 0 ? void 0 : options.authority,
+            claims: options === null || options === void 0 ? void 0 : options.claims,
         };
         if (hasNativeBroker() && this.enableBroker) {
             if (!silentRequest.tokenQueryParameters) {
@@ -1336,10 +1315,8 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
              * `authenticationRecord` parameter. See issue - https://github.com/Azure/azure-sdk-for-js/issues/24349#issuecomment-1496715651
              * This workaround serves as a workaround for silent authentication not happening when authenticationRecord is passed.
              */
-            await this.getApp("publicFirst", options?.enableCae)
-                ?.getTokenCache()
-                .getAllAccounts();
-            const response = (await this.getApp("confidential", options?.enableCae)?.acquireTokenSilent(silentRequest)) ?? (await this.getApp("public", options?.enableCae).acquireTokenSilent(silentRequest));
+            await ((_a = this.getApp("publicFirst", options === null || options === void 0 ? void 0 : options.enableCae)) === null || _a === void 0 ? void 0 : _a.getTokenCache().getAllAccounts());
+            const response = (_c = (await ((_b = this.getApp("confidential", options === null || options === void 0 ? void 0 : options.enableCae)) === null || _b === void 0 ? void 0 : _b.acquireTokenSilent(silentRequest)))) !== null && _c !== void 0 ? _c : (await this.getApp("public", options === null || options === void 0 ? void 0 : options.enableCae).acquireTokenSilent(silentRequest));
             return this.handleResult(scopes, this.clientId, response || undefined);
         }
         catch (err) {
@@ -1354,7 +1331,7 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
         const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds) ||
             this.tenantId;
         options.authority = getAuthority(tenantId, this.authorityHost);
-        options.correlationId = options?.correlationId || this.generateUuid();
+        options.correlationId = (options === null || options === void 0 ? void 0 : options.correlationId) || this.generateUuid();
         await this.init(options);
         try {
             // MSAL now caches tokens based on their claims,
@@ -1374,7 +1351,7 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
             if (err.name !== "AuthenticationRequiredError") {
                 throw err;
             }
-            if (options?.disableAutomaticAuthentication) {
+            if (options === null || options === void 0 ? void 0 : options.disableAutomaticAuthentication) {
                 throw new AuthenticationRequiredError({
                     scopes,
                     getTokenOptions: options,
@@ -1475,10 +1452,7 @@ class VisualStudioCodeCredential {
         this.cloudName = (getPropertyFromVSCode("azure.cloud") || "AzureCloud");
         // Picking an authority host based on the cloud name.
         const authorityHost = mapVSCodeAuthorityHosts[this.cloudName];
-        this.identityClient = new IdentityClient({
-            authorityHost,
-            ...options,
-        });
+        this.identityClient = new IdentityClient(Object.assign({ authorityHost }, options));
         if (options && options.tenantId) {
             checkTenantId(logger$m, options.tenantId);
             this.tenantId = options.tenantId;
@@ -1486,7 +1460,7 @@ class VisualStudioCodeCredential {
         else {
             this.tenantId = CommonTenantId;
         }
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
         checkUnsupportedTenant(this.tenantId);
     }
     /**
@@ -1518,6 +1492,7 @@ class VisualStudioCodeCredential {
      *                `TokenCredential` implementation might make.
      */
     async getToken(scopes, options) {
+        var _a, _b;
         await this.prepareOnce();
         const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds, logger$m) || this.tenantId;
         if (findCredentials === undefined) {
@@ -1549,7 +1524,7 @@ class VisualStudioCodeCredential {
         // ]
         const credentials = await findCredentials();
         // If we can't find the credential based on the name, we'll pick the first one available.
-        const { password: refreshToken } = credentials.find(({ account }) => account === this.cloudName) ?? credentials[0] ?? {};
+        const { password: refreshToken } = (_b = (_a = credentials.find(({ account }) => account === this.cloudName)) !== null && _a !== void 0 ? _a : credentials[0]) !== null && _b !== void 0 ? _b : {};
         if (refreshToken) {
             const tokenResponse = await this.identityClient.refreshAccessToken(tenantId, AzureAccountClientId, scopeString, refreshToken, undefined);
             if (tokenResponse) {
@@ -1673,12 +1648,9 @@ const appServiceMsi2017 = {
             logger$l.warning(`${msiName$6}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
         logger$l.info(`${msiName$6}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
-        const request = coreRestPipeline.createPipelineRequest({
-            abortSignal: getTokenOptions.abortSignal,
-            ...prepareRequestOptions$5(scopes, clientId),
+        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$5(scopes, clientId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
-            allowInsecureConnection: true,
-        });
+            allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
         return (tokenResponse && tokenResponse.accessToken) || null;
     },
@@ -1748,12 +1720,9 @@ const cloudShellMsi = {
             logger$k.warning(`${msiName$5}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
         }
         logger$k.info(`${msiName$5}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
-        const request = coreRestPipeline.createPipelineRequest({
-            abortSignal: getTokenOptions.abortSignal,
-            ...prepareRequestOptions$4(scopes, clientId, resourceId),
+        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$4(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
-            allowInsecureConnection: true,
-        });
+            allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
         return (tokenResponse && tokenResponse.accessToken) || null;
     },
@@ -1767,6 +1736,7 @@ const logger$j = credentialLogger(msiName$4);
  * Generates the options used on the request for an access token.
  */
 function prepareRequestOptions$3(scopes, clientId, resourceId, options) {
+    var _a;
     const resource = mapScopesToResource(scopes);
     if (!resource) {
         throw new Error(`${msiName$4}: Multiple scopes are not supported.`);
@@ -1789,7 +1759,7 @@ function prepareRequestOptions$3(scopes, clientId, resourceId, options) {
         const params = new URLSearchParams(queryParameters);
         query = `?${params.toString()}`;
     }
-    const url = new URL(imdsEndpointPath, process.env.AZURE_POD_IDENTITY_AUTHORITY_HOST ?? imdsHost);
+    const url = new URL(imdsEndpointPath, (_a = process.env.AZURE_POD_IDENTITY_AUTHORITY_HOST) !== null && _a !== void 0 ? _a : imdsHost);
     const rawHeaders = {
         Accept: "application/json",
         Metadata: "true",
@@ -1834,6 +1804,7 @@ const imdsMsi = {
             skipQuery: true,
         });
         return tracingClient.withSpan("ManagedIdentityCredential-pingImdsEndpoint", getTokenOptions, async (options) => {
+            var _a, _b;
             requestOptions.tracingOptions = options.tracingOptions;
             // Create a request with a timeout since we expect that
             // not having a "Metadata" header should cause an error to be
@@ -1841,7 +1812,7 @@ const imdsMsi = {
             const request = coreRestPipeline.createPipelineRequest(requestOptions);
             // Default to 1000 if the default of 0 is used.
             // Negative values can still be used to disable the timeout.
-            request.timeout = options.requestOptions?.timeout || 1000;
+            request.timeout = ((_a = options.requestOptions) === null || _a === void 0 ? void 0 : _a.timeout) || 1000;
             // This MSI uses the imdsEndpoint to get the token, which only uses http://
             request.allowInsecureConnection = true;
             let response;
@@ -1861,7 +1832,7 @@ const imdsMsi = {
                 return false;
             }
             if (response.status === 403) {
-                if (response.bodyAsText?.includes("A socket operation was attempted to an unreachable network")) {
+                if ((_b = response.bodyAsText) === null || _b === void 0 ? void 0 : _b.includes("A socket operation was attempted to an unreachable network")) {
                     logger$j.info(`${msiName$4}: The Azure IMDS endpoint is unavailable`);
                     logger$j.info(`${msiName$4}: ${response.bodyAsText}`);
                     return false;
@@ -1883,11 +1854,7 @@ const imdsMsi = {
         let nextDelayInMs = imdsMsiRetryConfig.startDelayInMs;
         for (let retries = 0; retries < imdsMsiRetryConfig.maxRetries; retries++) {
             try {
-                const request = coreRestPipeline.createPipelineRequest({
-                    abortSignal: getTokenOptions.abortSignal,
-                    ...prepareRequestOptions$3(scopes, clientId, resourceId),
-                    allowInsecureConnection: true,
-                });
+                const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$3(scopes, clientId, resourceId)), { allowInsecureConnection: true }));
                 const tokenResponse = await identityClient.sendTokenRequest(request);
                 return (tokenResponse && tokenResponse.accessToken) || null;
             }
@@ -1991,6 +1958,7 @@ const arcMsi = {
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
+        var _a;
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (clientId) {
             logger$i.warning(`${msiName$3}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
@@ -1999,24 +1967,16 @@ const arcMsi = {
             logger$i.warning(`${msiName$3}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
         }
         logger$i.info(`${msiName$3}: Authenticating.`);
-        const requestOptions = {
-            disableJsonStringifyOnBody: true,
-            deserializationMapper: undefined,
-            abortSignal: getTokenOptions.abortSignal,
-            ...prepareRequestOptions$2(scopes, clientId, resourceId),
-            allowInsecureConnection: true,
-        };
+        const requestOptions = Object.assign(Object.assign({ disableJsonStringifyOnBody: true, deserializationMapper: undefined, abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$2(scopes, clientId, resourceId)), { allowInsecureConnection: true });
         const filePath = await filePathRequest(identityClient, requestOptions);
         if (!filePath) {
             throw new Error(`${msiName$3}: Failed to find the token file.`);
         }
         const key = await readFileAsync$1(filePath, { encoding: "utf-8" });
-        requestOptions.headers?.set("Authorization", `Basic ${key}`);
-        const request = coreRestPipeline.createPipelineRequest({
-            ...requestOptions,
+        (_a = requestOptions.headers) === null || _a === void 0 ? void 0 : _a.set("Authorization", `Basic ${key}`);
+        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({}, requestOptions), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
-            allowInsecureConnection: true,
-        });
+            allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
         return (tokenResponse && tokenResponse.accessToken) || null;
     },
@@ -2084,17 +2044,10 @@ class ClientAssertionCredential {
             throw new Error("ClientAssertionCredential: tenantId, clientId, and clientAssertion are required parameters.");
         }
         this.tenantId = tenantId;
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
         this.clientId = clientId;
         this.options = options;
-        this.msalFlow = new MsalClientAssertion({
-            ...options,
-            logger: logger$h,
-            clientId: this.clientId,
-            tenantId: this.tenantId,
-            tokenCredentialOptions: this.options,
-            getAssertion,
-        });
+        this.msalFlow = new MsalClientAssertion(Object.assign(Object.assign({}, options), { logger: logger$h, clientId: this.clientId, tenantId: this.tenantId, tokenCredentialOptions: this.options, getAssertion }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -2155,7 +2108,7 @@ class WorkloadIdentityCredential {
         // Logging environment variables for error details
         const assignedEnv = processEnvVars(SupportedWorkloadEnvironmentVariables).assigned.join(", ");
         logger$g.info(`Found the following environment variables: ${assignedEnv}`);
-        const workloadIdentityCredentialOptions = options ?? {};
+        const workloadIdentityCredentialOptions = options !== null && options !== void 0 ? options : {};
         const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;
         const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;
         this.federatedTokenFilePath =
@@ -2235,13 +2188,7 @@ function tokenExchangeMsi() {
         async getToken(configuration, getTokenOptions = {}) {
             const { scopes, clientId } = configuration;
             const identityClientTokenCredentialOptions = {};
-            const workloadIdentityCredential = new WorkloadIdentityCredential({
-                clientId,
-                tenantId: process.env.AZURE_TENANT_ID,
-                tokenFilePath: process.env.AZURE_FEDERATED_TOKEN_FILE,
-                ...identityClientTokenCredentialOptions,
-                disableInstanceDiscovery: true,
-            });
+            const workloadIdentityCredential = new WorkloadIdentityCredential(Object.assign(Object.assign({ clientId, tenantId: process.env.AZURE_TENANT_ID, tokenFilePath: process.env.AZURE_FEDERATED_TOKEN_FILE }, identityClientTokenCredentialOptions), { disableInstanceDiscovery: true }));
             const token = await workloadIdentityCredential.getToken(scopes, getTokenOptions);
             return token;
         },
@@ -2327,12 +2274,7 @@ const fabricMsi = {
             "IDENTITY_HEADER=[REDACTED] and",
             "IDENTITY_SERVER_THUMBPRINT=[REDACTED].",
         ].join(" "));
-        const request = coreRestPipeline.createPipelineRequest({
-            abortSignal: getTokenOptions.abortSignal,
-            ...prepareRequestOptions$1(scopes, clientId, resourceId),
-            // The service fabric MSI endpoint will be HTTPS (however, the certificate will be self-signed).
-            // allowInsecureConnection: true
-        });
+        const request = coreRestPipeline.createPipelineRequest(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$1(scopes, clientId, resourceId)));
         request.agent = new https.Agent({
             // This is necessary because Service Fabric provides a self-signed certificate.
             // The alternative path is to verify the certificate using the IDENTITY_SERVER_THUMBPRINT env variable.
@@ -2403,12 +2345,9 @@ const appServiceMsi2019 = {
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         logger$d.info(`${msiName}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
-        const request = coreRestPipeline.createPipelineRequest({
-            abortSignal: getTokenOptions.abortSignal,
-            ...prepareRequestOptions(scopes, clientId, resourceId),
+        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
-            allowInsecureConnection: true,
-        });
+            allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
         return (tokenResponse && tokenResponse.accessToken) || null;
     },
@@ -2431,6 +2370,7 @@ class ManagedIdentityCredential {
      * @hidden
      */
     constructor(clientIdOrOptions, options) {
+        var _a;
         this.isEndpointUnavailable = null;
         this.isAppTokenProviderInitialized = false;
         let _options;
@@ -2439,28 +2379,25 @@ class ManagedIdentityCredential {
             _options = options;
         }
         else {
-            this.clientId = clientIdOrOptions?.clientId;
+            this.clientId = clientIdOrOptions === null || clientIdOrOptions === void 0 ? void 0 : clientIdOrOptions.clientId;
             _options = clientIdOrOptions;
         }
-        this.resourceId = _options?.resourceId;
+        this.resourceId = _options === null || _options === void 0 ? void 0 : _options.resourceId;
         // For JavaScript users.
         if (this.clientId && this.resourceId) {
             throw new Error(`${ManagedIdentityCredential.name} - Client Id and Resource Id can't be provided at the same time.`);
         }
         this.identityClient = new IdentityClient(_options);
-        this.isAvailableIdentityClient = new IdentityClient({
-            ..._options,
-            retryOptions: {
+        this.isAvailableIdentityClient = new IdentityClient(Object.assign(Object.assign({}, _options), { retryOptions: {
                 maxRetries: 0,
-            },
-        });
+            } }));
         /**  authority host validation and metadata discovery to be skipped in managed identity
          * since this wasn't done previously before adding token cache support
          */
         this.confidentialApp = new msalCommon.ConfidentialClientApplication({
             auth: {
                 authority: "https://login.microsoftonline.com/managed_identity",
-                clientId: this.clientId ?? DeveloperSignOnClientId,
+                clientId: (_a = this.clientId) !== null && _a !== void 0 ? _a : DeveloperSignOnClientId,
                 clientSecret: "dummy-secret",
                 cloudDiscoveryMetadata: '{"tenant_discovery_endpoint":"https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration","api-version":"1.1","metadata":[{"preferred_network":"login.microsoftonline.com","preferred_cache":"login.windows.net","aliases":["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"]},{"preferred_network":"login.partner.microsoftonline.cn","preferred_cache":"login.partner.microsoftonline.cn","aliases":["login.partner.microsoftonline.cn","login.chinacloudapi.cn"]},{"preferred_network":"login.microsoftonline.de","preferred_cache":"login.microsoftonline.de","aliases":["login.microsoftonline.de"]},{"preferred_network":"login.microsoftonline.us","preferred_cache":"login.microsoftonline.us","aliases":["login.microsoftonline.us","login.usgovcloudapi.net"]},{"preferred_network":"login-us.microsoftonline.com","preferred_cache":"login-us.microsoftonline.com","aliases":["login-us.microsoftonline.com"]}]}',
                 authorityMetadata: '{"token_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/token","token_endpoint_auth_methods_supported":["client_secret_post","private_key_jwt","client_secret_basic"],"jwks_uri":"https://login.microsoftonline.com/common/discovery/v2.0/keys","response_modes_supported":["query","fragment","form_post"],"subject_types_supported":["pairwise"],"id_token_signing_alg_values_supported":["RS256"],"response_types_supported":["code","id_token","code id_token","id_token token"],"scopes_supported":["openid","profile","email","offline_access"],"issuer":"https://login.microsoftonline.com/{tenantid}/v2.0","request_uri_parameter_supported":false,"userinfo_endpoint":"https://graph.microsoft.com/oidc/userinfo","authorization_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/authorize","device_authorization_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/devicecode","http_logout_supported":true,"frontchannel_logout_supported":true,"end_session_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/logout","claims_supported":["sub","iss","cloud_instance_name","cloud_instance_host_name","cloud_graph_host_name","msgraph_host","aud","exp","iat","auth_time","acr","nonce","preferred_username","name","tid","ver","at_hash","c_hash","email"],"kerberos_endpoint":"https://login.microsoftonline.com/common/kerberos","tenant_region_scope":null,"cloud_instance_name":"microsoftonline.com","cloud_graph_host_name":"graph.windows.net","msgraph_host":"graph.microsoft.com","rbac_url":"https://pas.windows.net"}',
@@ -2547,15 +2484,13 @@ class ManagedIdentityCredential {
                 else {
                     const appTokenParameters = {
                         correlationId: this.identityClient.getCorrelationId(),
-                        tenantId: options?.tenantId || "managed_identity",
+                        tenantId: (options === null || options === void 0 ? void 0 : options.tenantId) || "managed_identity",
                         scopes: Array.isArray(scopes) ? scopes : [scopes],
-                        claims: options?.claims,
+                        claims: options === null || options === void 0 ? void 0 : options.claims,
                     };
                     // Added a check to see if SetAppTokenProvider was already defined.
                     this.initializeSetAppTokenProvider();
-                    const authenticationResult = await this.confidentialApp.acquireTokenByClientCredential({
-                        ...appTokenParameters,
-                    });
+                    const authenticationResult = await this.confidentialApp.acquireTokenByClientCredential(Object.assign({}, appTokenParameters));
                     result = this.handleResult(scopes, authenticationResult || undefined);
                 }
                 if (result === null) {
@@ -2683,18 +2618,16 @@ class ManagedIdentityCredential {
         if (!this.isAppTokenProviderInitialized) {
             this.confidentialApp.SetAppTokenProvider(async (appTokenProviderParameters) => {
                 logger$c.info(`SetAppTokenProvider invoked with parameters- ${JSON.stringify(appTokenProviderParameters)}`);
-                const getTokenOptions = {
-                    ...appTokenProviderParameters,
-                };
+                const getTokenOptions = Object.assign({}, appTokenProviderParameters);
                 logger$c.info(`authenticateManagedIdentity invoked with scopes- ${JSON.stringify(appTokenProviderParameters.scopes)} and getTokenOptions - ${JSON.stringify(getTokenOptions)}`);
                 const resultToken = await this.authenticateManagedIdentity(appTokenProviderParameters.scopes, getTokenOptions);
                 if (resultToken) {
                     logger$c.info(`SetAppTokenProvider will save the token in cache`);
-                    const expiresInSeconds = resultToken?.expiresOnTimestamp
+                    const expiresInSeconds = (resultToken === null || resultToken === void 0 ? void 0 : resultToken.expiresOnTimestamp)
                         ? Math.floor((resultToken.expiresOnTimestamp - Date.now()) / 1000)
                         : 0;
                     return {
-                        accessToken: resultToken?.token,
+                        accessToken: resultToken === null || resultToken === void 0 ? void 0 : resultToken.token,
                         expiresInSeconds,
                     };
                 }
@@ -2807,12 +2740,12 @@ class AzureCliCredential {
      * @param options - Options, to optionally allow multi-tenant requests.
      */
     constructor(options) {
-        if (options?.tenantId) {
-            checkTenantId(logger$b, options?.tenantId);
-            this.tenantId = options?.tenantId;
+        if (options === null || options === void 0 ? void 0 : options.tenantId) {
+            checkTenantId(logger$b, options === null || options === void 0 ? void 0 : options.tenantId);
+            this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         }
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
-        this.timeout = options?.processTimeoutInMs;
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.timeout = options === null || options === void 0 ? void 0 : options.processTimeoutInMs;
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -2830,13 +2763,14 @@ class AzureCliCredential {
         const scope = typeof scopes === "string" ? scopes : scopes[0];
         logger$b.getToken.info(`Using the scope ${scope}`);
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
+            var _a, _b, _c, _d;
             try {
                 ensureValidScopeForDevTimeCreds(scope, logger$b);
                 const resource = getScopeResource(scope);
                 const obj = await cliCredentialInternals.getAzureCliAccessToken(resource, tenantId, this.timeout);
-                const specificScope = obj.stderr?.match("(.*)az login --scope(.*)");
-                const isLoginError = obj.stderr?.match("(.*)az login(.*)") && !specificScope;
-                const isNotInstallError = obj.stderr?.match("az:(.*)not found") || obj.stderr?.startsWith("'az' is not recognized");
+                const specificScope = (_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("(.*)az login --scope(.*)");
+                const isLoginError = ((_b = obj.stderr) === null || _b === void 0 ? void 0 : _b.match("(.*)az login(.*)")) && !specificScope;
+                const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("az:(.*)not found")) || ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'az' is not recognized"));
                 if (isNotInstallError) {
                     const error = new CredentialUnavailableError("Azure CLI could not be found. Please visit https://aka.ms/azure-cli for installation instructions and then, once installed, authenticate to your Azure account using 'az login'.");
                     logger$b.getToken.info(formatError(scopes, error));
@@ -2988,12 +2922,12 @@ class AzurePowerShellCredential {
      * @param options - Options, to optionally allow multi-tenant requests.
      */
     constructor(options) {
-        if (options?.tenantId) {
-            checkTenantId(logger$a, options?.tenantId);
-            this.tenantId = options?.tenantId;
+        if (options === null || options === void 0 ? void 0 : options.tenantId) {
+            checkTenantId(logger$a, options === null || options === void 0 ? void 0 : options.tenantId);
+            this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         }
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
-        this.timeout = options?.processTimeoutInMs;
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.timeout = options === null || options === void 0 ? void 0 : options.processTimeoutInMs;
     }
     /**
      * Gets the access token from Azure PowerShell
@@ -3287,14 +3221,12 @@ class ClientCertificateCredential {
             throw new Error(`${credentialName$2}: tenantId and clientId are required parameters.`);
         }
         this.tenantId = tenantId;
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
-        const configuration = {
-            ...(typeof certificatePathOrConfiguration === "string"
-                ? {
-                    certificatePath: certificatePathOrConfiguration,
-                }
-                : certificatePathOrConfiguration),
-        };
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        const configuration = Object.assign({}, (typeof certificatePathOrConfiguration === "string"
+            ? {
+                certificatePath: certificatePathOrConfiguration,
+            }
+            : certificatePathOrConfiguration));
         const certificate = configuration
             .certificate;
         const certificatePath = configuration.certificatePath;
@@ -3304,15 +3236,10 @@ class ClientCertificateCredential {
         if (certificate && certificatePath) {
             throw new Error(`${credentialName$2}: To avoid unexpected behaviors, providing both the contents of a PEM certificate and the path to a PEM certificate is forbidden. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.`);
         }
-        this.msalFlow = new MsalClientCertificate({
-            ...options,
-            configuration,
+        this.msalFlow = new MsalClientCertificate(Object.assign(Object.assign({}, options), { configuration,
             logger: logger$8,
             clientId,
-            tenantId,
-            sendCertificateChain: options.sendCertificateChain,
-            tokenCredentialOptions: options,
-        });
+            tenantId, sendCertificateChain: options.sendCertificateChain, tokenCredentialOptions: options }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -3389,15 +3316,11 @@ class ClientSecretCredential {
             throw new Error("ClientSecretCredential: tenantId, clientId, and clientSecret are required parameters. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.");
         }
         this.tenantId = tenantId;
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
-        this.msalFlow = new MsalClientSecret({
-            ...options,
-            logger: logger$7,
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.msalFlow = new MsalClientSecret(Object.assign(Object.assign({}, options), { logger: logger$7,
             clientId,
             tenantId,
-            clientSecret,
-            tokenCredentialOptions: options,
-        });
+            clientSecret, tokenCredentialOptions: options }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -3434,11 +3357,11 @@ class MsalUsernamePassword extends MsalNode {
                 scopes,
                 username: this.username,
                 password: this.password,
-                correlationId: options?.correlationId,
-                authority: options?.authority,
-                claims: options?.claims,
+                correlationId: options === null || options === void 0 ? void 0 : options.correlationId,
+                authority: options === null || options === void 0 ? void 0 : options.authority,
+                claims: options === null || options === void 0 ? void 0 : options.claims,
             };
-            const result = await this.getApp("public", options?.enableCae).acquireTokenByUsernamePassword(requestOptions);
+            const result = await this.getApp("public", options === null || options === void 0 ? void 0 : options.enableCae).acquireTokenByUsernamePassword(requestOptions);
             return this.handleResult(scopes, this.clientId, result || undefined);
         }
         catch (error) {
@@ -3473,16 +3396,12 @@ class UsernamePasswordCredential {
             throw new Error("UsernamePasswordCredential: tenantId, clientId, username and password are required parameters. To troubleshoot, visit https://aka.ms/azsdk/js/identity/usernamepasswordcredential/troubleshoot.");
         }
         this.tenantId = tenantId;
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
-        this.msalFlow = new MsalUsernamePassword({
-            ...options,
-            logger: logger$6,
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.msalFlow = new MsalUsernamePassword(Object.assign(Object.assign({}, options), { logger: logger$6,
             clientId,
             tenantId,
             username,
-            password,
-            tokenCredentialOptions: options || {},
-        });
+            password, tokenCredentialOptions: options || {} }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -3525,7 +3444,8 @@ const AllSupportedEnvironmentVariables = [
     "AZURE_ADDITIONALLY_ALLOWED_TENANTS",
 ];
 function getAdditionallyAllowedTenants() {
-    const additionallyAllowedValues = process.env.AZURE_ADDITIONALLY_ALLOWED_TENANTS ?? "";
+    var _a;
+    const additionallyAllowedValues = (_a = process.env.AZURE_ADDITIONALLY_ALLOWED_TENANTS) !== null && _a !== void 0 ? _a : "";
     return additionallyAllowedValues.split(";");
 }
 const credentialName$1 = "EnvironmentCredential";
@@ -3566,7 +3486,7 @@ class EnvironmentCredential {
         logger$5.info(`Found the following environment variables: ${assigned}`);
         const tenantId = process.env.AZURE_TENANT_ID, clientId = process.env.AZURE_CLIENT_ID, clientSecret = process.env.AZURE_CLIENT_SECRET;
         const additionallyAllowedTenantIds = getAdditionallyAllowedTenants();
-        const newOptions = { ...options, additionallyAllowedTenantIds };
+        const newOptions = Object.assign(Object.assign({}, options), { additionallyAllowedTenantIds });
         if (tenantId) {
             checkTenantId(logger$5, tenantId);
         }
@@ -3706,12 +3626,12 @@ class AzureDeveloperCliCredential {
      * @param options - Options, to optionally allow multi-tenant requests.
      */
     constructor(options) {
-        if (options?.tenantId) {
-            checkTenantId(logger$4, options?.tenantId);
-            this.tenantId = options?.tenantId;
+        if (options === null || options === void 0 ? void 0 : options.tenantId) {
+            checkTenantId(logger$4, options === null || options === void 0 ? void 0 : options.tenantId);
+            this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         }
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
-        this.timeout = options?.processTimeoutInMs;
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.timeout = options === null || options === void 0 ? void 0 : options.processTimeoutInMs;
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -3735,15 +3655,16 @@ class AzureDeveloperCliCredential {
         }
         logger$4.getToken.info(`Using the scopes ${scopes}`);
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
+            var _a, _b, _c, _d;
             try {
                 scopeList.forEach((scope) => {
                     ensureValidScopeForDevTimeCreds(scope, logger$4);
                 });
                 const obj = await developerCliCredentialInternals.getAzdAccessToken(scopeList, tenantId, this.timeout);
-                const isNotLoggedInError = obj.stderr?.match("not logged in, run `azd login` to login") ||
-                    obj.stderr?.match("not logged in, run `azd auth login` to login");
-                const isNotInstallError = obj.stderr?.match("azd:(.*)not found") ||
-                    obj.stderr?.startsWith("'azd' is not recognized");
+                const isNotLoggedInError = ((_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("not logged in, run `azd login` to login")) ||
+                    ((_b = obj.stderr) === null || _b === void 0 ? void 0 : _b.match("not logged in, run `azd auth login` to login"));
+                const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("azd:(.*)not found")) ||
+                    ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'azd' is not recognized"));
                 if (isNotInstallError || (obj.error && obj.error.code === "ENOENT")) {
                     const error = new CredentialUnavailableError("Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.");
                     logger$4.getToken.info(formatError(scopes, error));
@@ -3792,34 +3713,23 @@ class DefaultManagedIdentityCredential extends ManagedIdentityCredential {
     // Constructor overload with just the other default options
     // Last constructor overload with Union of all options not required since the above two constructor overloads have optional properties
     constructor(options) {
-        const managedIdentityClientId = options?.managedIdentityClientId ??
-            process.env.AZURE_CLIENT_ID;
-        const workloadIdentityClientId = options?.workloadIdentityClientId ??
-            managedIdentityClientId;
-        const managedResourceId = options
-            ?.managedIdentityResourceId;
+        var _a, _b, _c;
+        const managedIdentityClientId = (_a = options === null || options === void 0 ? void 0 : options.managedIdentityClientId) !== null && _a !== void 0 ? _a : process.env.AZURE_CLIENT_ID;
+        const workloadIdentityClientId = (_b = options === null || options === void 0 ? void 0 : options.workloadIdentityClientId) !== null && _b !== void 0 ? _b : managedIdentityClientId;
+        const managedResourceId = options === null || options === void 0 ? void 0 : options.managedIdentityResourceId;
         const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;
-        const tenantId = options?.tenantId ?? process.env.AZURE_TENANT_ID;
+        const tenantId = (_c = options === null || options === void 0 ? void 0 : options.tenantId) !== null && _c !== void 0 ? _c : process.env.AZURE_TENANT_ID;
         // ManagedIdentityCredential throws if both the resourceId and the clientId are provided.
         if (managedResourceId) {
-            const managedIdentityResourceIdOptions = {
-                ...options,
-                resourceId: managedResourceId,
-            };
+            const managedIdentityResourceIdOptions = Object.assign(Object.assign({}, options), { resourceId: managedResourceId });
             super(managedIdentityResourceIdOptions);
         }
         else if (workloadFile && workloadIdentityClientId) {
-            const workloadIdentityCredentialOptions = {
-                ...options,
-                tenantId: tenantId,
-            };
+            const workloadIdentityCredentialOptions = Object.assign(Object.assign({}, options), { tenantId: tenantId });
             super(workloadIdentityClientId, workloadIdentityCredentialOptions);
         }
         else if (managedIdentityClientId) {
-            const managedIdentityClientOptions = {
-                ...options,
-                clientId: managedIdentityClientId,
-            };
+            const managedIdentityClientOptions = Object.assign(Object.assign({}, options), { clientId: managedIdentityClientId });
             super(managedIdentityClientOptions);
         }
         else {
@@ -3837,26 +3747,17 @@ class DefaultWorkloadIdentityCredential extends WorkloadIdentityCredential {
     // Constructor overload with just the other default options
     // Last constructor overload with Union of all options not required since the above two constructor overloads have optional properties
     constructor(options) {
-        const managedIdentityClientId = options?.managedIdentityClientId ??
-            process.env.AZURE_CLIENT_ID;
-        const workloadIdentityClientId = options?.workloadIdentityClientId ??
-            managedIdentityClientId;
+        var _a, _b, _c;
+        const managedIdentityClientId = (_a = options === null || options === void 0 ? void 0 : options.managedIdentityClientId) !== null && _a !== void 0 ? _a : process.env.AZURE_CLIENT_ID;
+        const workloadIdentityClientId = (_b = options === null || options === void 0 ? void 0 : options.workloadIdentityClientId) !== null && _b !== void 0 ? _b : managedIdentityClientId;
         const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;
-        const tenantId = options?.tenantId ?? process.env.AZURE_TENANT_ID;
+        const tenantId = (_c = options === null || options === void 0 ? void 0 : options.tenantId) !== null && _c !== void 0 ? _c : process.env.AZURE_TENANT_ID;
         if (workloadFile && workloadIdentityClientId) {
-            const workloadIdentityCredentialOptions = {
-                ...options,
-                tenantId,
-                clientId: workloadIdentityClientId,
-                tokenFilePath: workloadFile,
-            };
+            const workloadIdentityCredentialOptions = Object.assign(Object.assign({}, options), { tenantId, clientId: workloadIdentityClientId, tokenFilePath: workloadFile });
             super(workloadIdentityCredentialOptions);
         }
         else if (tenantId) {
-            const workloadIdentityClientTenantOptions = {
-                ...options,
-                tenantId,
-            };
+            const workloadIdentityClientTenantOptions = Object.assign(Object.assign({}, options), { tenantId });
             super(workloadIdentityClientTenantOptions);
         }
         else {
@@ -3866,26 +3767,17 @@ class DefaultWorkloadIdentityCredential extends WorkloadIdentityCredential {
 }
 class DefaultAzureDeveloperCliCredential extends AzureDeveloperCliCredential {
     constructor(options) {
-        super({
-            processTimeoutInMs: options?.processTimeoutInMs,
-            ...options,
-        });
+        super(Object.assign({ processTimeoutInMs: options === null || options === void 0 ? void 0 : options.processTimeoutInMs }, options));
     }
 }
 class DefaultAzureCliCredential extends AzureCliCredential {
     constructor(options) {
-        super({
-            processTimeoutInMs: options?.processTimeoutInMs,
-            ...options,
-        });
+        super(Object.assign({ processTimeoutInMs: options === null || options === void 0 ? void 0 : options.processTimeoutInMs }, options));
     }
 }
 class DefaultAzurePowershellCredential extends AzurePowerShellCredential {
     constructor(options) {
-        super({
-            processTimeoutInMs: options?.processTimeoutInMs,
-            ...options,
-        });
+        super(Object.assign({ processTimeoutInMs: options === null || options === void 0 ? void 0 : options.processTimeoutInMs }, options));
     }
 }
 const defaultCredentials = [
@@ -3922,22 +3814,24 @@ const interactiveBrowserMockable = {
  */
 class MsalOpenBrowser extends MsalNode {
     constructor(options) {
+        var _a, _b;
         super(options);
         this.loginHint = options.loginHint;
-        this.errorTemplate = options.browserCustomizationOptions?.errorMessage;
-        this.successTemplate = options.browserCustomizationOptions?.successMessage;
+        this.errorTemplate = (_a = options.browserCustomizationOptions) === null || _a === void 0 ? void 0 : _a.errorMessage;
+        this.successTemplate = (_b = options.browserCustomizationOptions) === null || _b === void 0 ? void 0 : _b.successMessage;
         this.logger = credentialLogger("Node.js MSAL Open Browser");
     }
     async doGetToken(scopes, options) {
+        var _a;
         try {
             const interactiveRequest = {
                 openBrowser: async (url) => {
                     await interactiveBrowserMockable.open(url, { wait: true, newInstance: true });
                 },
                 scopes,
-                authority: options?.authority,
-                claims: options?.claims,
-                correlationId: options?.correlationId,
+                authority: options === null || options === void 0 ? void 0 : options.authority,
+                claims: options === null || options === void 0 ? void 0 : options.claims,
+                correlationId: options === null || options === void 0 ? void 0 : options.correlationId,
                 loginHint: this.loginHint,
                 errorTemplate: this.errorTemplate,
                 successTemplate: this.successTemplate,
@@ -3952,14 +3846,14 @@ class MsalOpenBrowser extends MsalNode {
                     this.logger.warning("Parent window handle is not specified for the broker. This may cause unexpected behavior. Please provide the parentWindowHandle.");
                 }
                 if (this.enableMsaPassthrough) {
-                    (interactiveRequest.tokenQueryParameters ?? (interactiveRequest.tokenQueryParameters = {}))["msal_request_type"] =
+                    ((_a = interactiveRequest.tokenQueryParameters) !== null && _a !== void 0 ? _a : (interactiveRequest.tokenQueryParameters = {}))["msal_request_type"] =
                         "consumer_passthrough";
                 }
             }
             if (hasNativeBroker() && !this.enableBroker) {
                 this.logger.verbose("Authentication will resume normally without the broker, since it's not enabled");
             }
-            const result = await this.getApp("public", options?.enableCae).acquireTokenInteractive(interactiveRequest);
+            const result = await this.getApp("public", options === null || options === void 0 ? void 0 : options.enableCae).acquireTokenInteractive(interactiveRequest);
             if (result.fromNativeBroker) {
                 this.logger.verbose(`This result is returned from native broker`);
             }
@@ -3992,41 +3886,31 @@ class InteractiveBrowserCredential {
      * @param options - Options for configuring the client which makes the authentication requests.
      */
     constructor(options) {
+        var _a, _b, _c;
         const redirectUri = typeof options.redirectUri === "function"
             ? options.redirectUri()
             : options.redirectUri || "http://localhost";
-        this.tenantId = options?.tenantId;
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
+        this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
         const ibcNodeOptions = options;
-        if (ibcNodeOptions?.brokerOptions?.enabled) {
-            if (!ibcNodeOptions?.brokerOptions?.parentWindowHandle) {
+        if ((_a = ibcNodeOptions === null || ibcNodeOptions === void 0 ? void 0 : ibcNodeOptions.brokerOptions) === null || _a === void 0 ? void 0 : _a.enabled) {
+            if (!((_b = ibcNodeOptions === null || ibcNodeOptions === void 0 ? void 0 : ibcNodeOptions.brokerOptions) === null || _b === void 0 ? void 0 : _b.parentWindowHandle)) {
                 throw new Error("In order to do WAM authentication, `parentWindowHandle` under `brokerOptions` is a required parameter");
             }
             else {
-                this.msalFlow = new MsalOpenBrowser({
-                    ...options,
-                    tokenCredentialOptions: options,
-                    logger: logger$3,
-                    redirectUri,
-                    browserCustomizationOptions: ibcNodeOptions?.browserCustomizationOptions,
-                    brokerOptions: {
+                this.msalFlow = new MsalOpenBrowser(Object.assign(Object.assign({}, options), { tokenCredentialOptions: options, logger: logger$3,
+                    redirectUri, browserCustomizationOptions: ibcNodeOptions === null || ibcNodeOptions === void 0 ? void 0 : ibcNodeOptions.browserCustomizationOptions, brokerOptions: {
                         enabled: true,
                         parentWindowHandle: ibcNodeOptions.brokerOptions.parentWindowHandle,
-                        legacyEnableMsaPassthrough: ibcNodeOptions.brokerOptions?.legacyEnableMsaPassthrough,
-                    },
-                });
+                        legacyEnableMsaPassthrough: (_c = ibcNodeOptions.brokerOptions) === null || _c === void 0 ? void 0 : _c.legacyEnableMsaPassthrough,
+                    } }));
             }
         }
         else {
-            this.msalFlow = new MsalOpenBrowser({
-                ...options,
-                tokenCredentialOptions: options,
-                logger: logger$3,
-                redirectUri,
-                browserCustomizationOptions: ibcNodeOptions?.browserCustomizationOptions,
-            });
+            this.msalFlow = new MsalOpenBrowser(Object.assign(Object.assign({}, options), { tokenCredentialOptions: options, logger: logger$3,
+                redirectUri, browserCustomizationOptions: ibcNodeOptions === null || ibcNodeOptions === void 0 ? void 0 : ibcNodeOptions.browserCustomizationOptions }));
         }
-        this.disableAutomaticAuthentication = options?.disableAutomaticAuthentication;
+        this.disableAutomaticAuthentication = options === null || options === void 0 ? void 0 : options.disableAutomaticAuthentication;
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -4044,10 +3928,7 @@ class InteractiveBrowserCredential {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
             newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$3);
             const arrayScopes = ensureScopes(scopes);
-            return this.msalFlow.getToken(arrayScopes, {
-                ...newOptions,
-                disableAutomaticAuthentication: this.disableAutomaticAuthentication,
-            });
+            return this.msalFlow.getToken(arrayScopes, Object.assign(Object.assign({}, newOptions), { disableAutomaticAuthentication: this.disableAutomaticAuthentication }));
         });
     }
     /**
@@ -4089,12 +3970,12 @@ class MsalDeviceCode extends MsalNode {
                 deviceCodeCallback: this.userPromptCallback,
                 scopes,
                 cancel: false,
-                correlationId: options?.correlationId,
-                authority: options?.authority,
-                claims: options?.claims,
+                correlationId: options === null || options === void 0 ? void 0 : options.correlationId,
+                authority: options === null || options === void 0 ? void 0 : options.authority,
+                claims: options === null || options === void 0 ? void 0 : options.claims,
             };
-            const promise = this.getApp("public", options?.enableCae).acquireTokenByDeviceCode(requestOptions);
-            const deviceResponse = await this.withCancellation(promise, options?.abortSignal, () => {
+            const promise = this.getApp("public", options === null || options === void 0 ? void 0 : options.enableCae).acquireTokenByDeviceCode(requestOptions);
+            const deviceResponse = await this.withCancellation(promise, options === null || options === void 0 ? void 0 : options.abortSignal, () => {
                 requestOptions.cancel = true;
             });
             return this.handleResult(scopes, this.clientId, deviceResponse || undefined);
@@ -4141,15 +4022,10 @@ class DeviceCodeCredential {
      * @param options - Options for configuring the client which makes the authentication requests.
      */
     constructor(options) {
-        this.tenantId = options?.tenantId;
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
-        this.msalFlow = new MsalDeviceCode({
-            ...options,
-            logger: logger$2,
-            userPromptCallback: options?.userPromptCallback || defaultDeviceCodePromptCallback,
-            tokenCredentialOptions: options || {},
-        });
-        this.disableAutomaticAuthentication = options?.disableAutomaticAuthentication;
+        this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.msalFlow = new MsalDeviceCode(Object.assign(Object.assign({}, options), { logger: logger$2, userPromptCallback: (options === null || options === void 0 ? void 0 : options.userPromptCallback) || defaultDeviceCodePromptCallback, tokenCredentialOptions: options || {} }));
+        this.disableAutomaticAuthentication = options === null || options === void 0 ? void 0 : options.disableAutomaticAuthentication;
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -4167,10 +4043,7 @@ class DeviceCodeCredential {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
             newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$2);
             const arrayScopes = ensureScopes(scopes);
-            return this.msalFlow.getToken(arrayScopes, {
-                ...newOptions,
-                disableAutomaticAuthentication: this.disableAutomaticAuthentication,
-            });
+            return this.msalFlow.getToken(arrayScopes, Object.assign(Object.assign({}, newOptions), { disableAutomaticAuthentication: this.disableAutomaticAuthentication }));
         });
     }
     /**
@@ -4218,13 +4091,13 @@ class MsalAuthorizationCode extends MsalNode {
     }
     async doGetToken(scopes, options) {
         try {
-            const result = await this.getApp("confidentialFirst", options?.enableCae).acquireTokenByCode({
+            const result = await this.getApp("confidentialFirst", options === null || options === void 0 ? void 0 : options.enableCae).acquireTokenByCode({
                 scopes,
                 redirectUri: this.redirectUri,
                 code: this.authorizationCode,
-                correlationId: options?.correlationId,
-                authority: options?.authority,
-                claims: options?.claims,
+                correlationId: options === null || options === void 0 ? void 0 : options.correlationId,
+                authority: options === null || options === void 0 ? void 0 : options.authority,
+                claims: options === null || options === void 0 ? void 0 : options.claims,
             });
             // The Client Credential flow does not return an account,
             // so each time getToken gets called, we will have to acquire a new token through the service.
@@ -4269,17 +4142,10 @@ class AuthorizationCodeCredential {
         }
         // TODO: Validate tenant if provided
         this.tenantId = tenantId;
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.additionallyAllowedTenants);
-        this.msalFlow = new MsalAuthorizationCode({
-            ...options,
-            clientSecret,
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.msalFlow = new MsalAuthorizationCode(Object.assign(Object.assign({}, options), { clientSecret,
             clientId,
-            tenantId,
-            tokenCredentialOptions: options || {},
-            logger: logger$1,
-            redirectUri: this.redirectUri,
-            authorizationCode: this.authorizationCode,
-        });
+            tenantId, tokenCredentialOptions: options || {}, logger: logger$1, redirectUri: this.redirectUri, authorizationCode: this.authorizationCode }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -4294,10 +4160,7 @@ class AuthorizationCodeCredential {
             const tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds);
             newOptions.tenantId = tenantId;
             const arrayScopes = ensureScopes(scopes);
-            return this.msalFlow.getToken(arrayScopes, {
-                ...newOptions,
-                disableAutomaticAuthentication: this.disableAutomaticAuthentication,
-            });
+            return this.msalFlow.getToken(arrayScopes, Object.assign(Object.assign({}, newOptions), { disableAutomaticAuthentication: this.disableAutomaticAuthentication }));
         });
     }
 }
@@ -4374,11 +4237,7 @@ class OnBehalfOfCredential {
         }
         this.tenantId = tenantId;
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(additionallyAllowedTenantIds);
-        this.msalFlow = new MsalOnBehalfOf({
-            ...this.options,
-            logger,
-            tokenCredentialOptions: this.options,
-        });
+        this.msalFlow = new MsalOnBehalfOf(Object.assign(Object.assign({}, this.options), { logger, tokenCredentialOptions: this.options }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.