@azure/identity 4.0.2-alpha.20240123.2 → 4.1.0-alpha.20240125.3

package/dist/index.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var msalCommon = require('@azure/msal-node');
-var logger$p = require('@azure/logger');
+var logger$q = require('@azure/logger');
 var abortController = require('@azure/abort-controller');
 var coreUtil = require('@azure/core-util');
 var coreClient = require('@azure/core-client');
@@ -44,7 +44,7 @@ var child_process__namespace = /*#__PURE__*/_interopNamespaceDefault(child_proce
 /**
  * Current version of the `@azure/identity` package.
  */
-const SDK_VERSION = `4.0.2`;
+const SDK_VERSION = `4.1.0-beta.1`;
 /**
  * The default client ID for authentication
  * @internal
@@ -104,7 +104,7 @@ const CACHE_NON_CAE_SUFFIX = ".nocae";
 /**
  * The AzureLogger used for all clients within the identity package
  */
-const logger$o = logger$p.createClientLogger("identity");
+const logger$p = logger$q.createClientLogger("identity");
 /**
  * Separates a list of environment variable names into a plain object with two arrays: an array of missing environment variables and another array with assigned environment variables.
  * @param supportedEnvVars - List of environment variable names
@@ -144,7 +144,7 @@ function formatError(scope, error) {
  *   `[title] => [message]`
  *
  */
-function credentialLoggerInstance(title, parent, log = logger$o) {
+function credentialLoggerInstance(title, parent, log = logger$p) {
     const fullTitle = parent ? `${parent.fullTitle} ${title}` : title;
     function info(message) {
         log.info(`${fullTitle} =>`, message);
@@ -173,7 +173,7 @@ function credentialLoggerInstance(title, parent, log = logger$o) {
  *   `[title] => getToken() => [message]`
  *
  */
-function credentialLogger(title, log = logger$o) {
+function credentialLogger(title, log = logger$p) {
     const credLogger = credentialLoggerInstance(title, undefined, log);
     return Object.assign(Object.assign({}, credLogger), { parent: log, getToken: credentialLoggerInstance("=> getToken()", credLogger, log) });
 }
@@ -302,7 +302,7 @@ class AuthenticationRequiredError extends Error {
 /**
  * @internal
  */
-const logger$n = credentialLogger("IdentityUtils");
+const logger$o = credentialLogger("IdentityUtils");
 /**
  * Latest AuthenticationRecord version
  * @internal
@@ -314,7 +314,7 @@ const LatestAuthenticationRecordVersion = "1.0";
  */
 function ensureValidMsalToken(scopes, msalToken, getTokenOptions) {
     const error = (message) => {
-        logger$n.getToken.info(message);
+        logger$o.getToken.info(message);
         return new AuthenticationRequiredError({
             scopes: Array.isArray(scopes) ? scopes : [scopes],
             getTokenOptions,
@@ -414,17 +414,17 @@ function handleMsalError(scopes, error, getTokenOptions) {
         const msalError = error;
         switch (msalError.errorCode) {
             case "endpoints_resolution_error":
-                logger$n.info(formatError(scopes, error.message));
+                logger$o.info(formatError(scopes, error.message));
                 return new CredentialUnavailableError(error.message);
             case "device_code_polling_cancelled":
                 return new abortController.AbortError("The authentication has been aborted by the caller.");
             case "consent_required":
             case "interaction_required":
             case "login_required":
-                logger$n.info(formatError(scopes, `Authentication returned errorCode ${msalError.errorCode}`));
+                logger$o.info(formatError(scopes, `Authentication returned errorCode ${msalError.errorCode}`));
                 break;
             default:
-                logger$n.info(formatError(scopes, `Failed to acquire token: ${error.message}`));
+                logger$o.info(formatError(scopes, `Failed to acquire token: ${error.message}`));
                 break;
         }
     }
@@ -434,7 +434,7 @@ function handleMsalError(scopes, error, getTokenOptions) {
         return error;
     }
     if (error.name === "NativeAuthError") {
-        logger$n.info(formatError(scopes, `Error from the native broker: ${error.message} with status code: ${error.statusCode}`));
+        logger$o.info(formatError(scopes, `Error from the native broker: ${error.message} with status code: ${error.statusCode}`));
         return error;
     }
     return new AuthenticationRequiredError({ scopes, getTokenOptions, message: error.message });
@@ -703,7 +703,7 @@ class IdentityClient extends coreClient.ServiceClient {
         this.tokenCredentialOptions = Object.assign({}, options);
     }
     async sendTokenRequest(request) {
-        logger$o.info(`IdentityClient: sending token request to [${request.url}]`);
+        logger$p.info(`IdentityClient: sending token request to [${request.url}]`);
         const response = await this.sendRequest(request);
         if (response.bodyAsText && (response.status === 200 || response.status === 201)) {
             const parsedBody = JSON.parse(response.bodyAsText);
@@ -718,12 +718,12 @@ class IdentityClient extends coreClient.ServiceClient {
                 },
                 refreshToken: parsedBody.refresh_token,
             };
-            logger$o.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
+            logger$p.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
             return token;
         }
         else {
             const error = new AuthenticationError(response.status, response.bodyAsText);
-            logger$o.warning(`IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`);
+            logger$p.warning(`IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`);
             throw error;
         }
     }
@@ -731,7 +731,7 @@ class IdentityClient extends coreClient.ServiceClient {
         if (refreshToken === undefined) {
             return null;
         }
-        logger$o.info(`IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`);
+        logger$p.info(`IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`);
         const refreshParams = {
             grant_type: "refresh_token",
             client_id: clientId,
@@ -757,7 +757,7 @@ class IdentityClient extends coreClient.ServiceClient {
                     tracingOptions: updatedOptions.tracingOptions,
                 });
                 const response = await this.sendTokenRequest(request);
-                logger$o.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
+                logger$p.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
                 return response;
             }
             catch (err) {
@@ -766,11 +766,11 @@ class IdentityClient extends coreClient.ServiceClient {
                     // It's likely that the refresh token has expired, so
                     // return null so that the credential implementation will
                     // initiate the authentication flow again.
-                    logger$o.info(`IdentityClient: interaction required for client ID: ${clientId}`);
+                    logger$p.info(`IdentityClient: interaction required for client ID: ${clientId}`);
                     return null;
                 }
                 else {
-                    logger$o.warning(`IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`);
+                    logger$p.warning(`IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`);
                     throw err;
                 }
             }
@@ -879,10 +879,10 @@ class IdentityClient extends coreClient.ServiceClient {
             }
             const base64Metadata = accessToken.split(".")[1];
             const { appid, upn, tid, oid } = JSON.parse(Buffer.from(base64Metadata, "base64").toString("utf8"));
-            logger$o.info(`[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`);
+            logger$p.info(`[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`);
         }
         catch (e) {
-            logger$o.warning("allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:", e.message);
+            logger$p.warning("allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:", e.message);
         }
     }
 }
@@ -1115,7 +1115,7 @@ class MsalNode {
                 networkClient: this.identityClient,
                 loggerOptions: {
                     loggerCallback: defaultLoggerCallback(options.logger),
-                    logLevel: getMSALLogLevel(logger$p.getLogLevel()),
+                    logLevel: getMSALLogLevel(logger$q.getLogLevel()),
                     piiLoggingEnabled: (_a = options.loggingOptions) === null || _a === void 0 ? void 0 : _a.enableUnsafeSupportLogging,
                 },
             },
@@ -1352,7 +1352,7 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
 // Licensed under the MIT license.
 const CommonTenantId = "common";
 const AzureAccountClientId = "aebc6443-996d-45c2-90f0-388ff96faa56"; // VSC: 'aebc6443-996d-45c2-90f0-388ff96faa56'
-const logger$m = credentialLogger("VisualStudioCodeCredential");
+const logger$n = credentialLogger("VisualStudioCodeCredential");
 let findCredentials = undefined;
 const vsCodeCredentialControl = {
     setVsCodeCredentialFinder(finder) {
@@ -1405,7 +1405,7 @@ function getPropertyFromVSCode(property) {
         }
     }
     catch (e) {
-        logger$m.info(`Failed to load the Visual Studio Code configuration file. Error: ${e.message}`);
+        logger$n.info(`Failed to load the Visual Studio Code configuration file. Error: ${e.message}`);
         return;
     }
 }
@@ -1438,7 +1438,7 @@ class VisualStudioCodeCredential {
         const authorityHost = mapVSCodeAuthorityHosts[this.cloudName];
         this.identityClient = new IdentityClient(Object.assign({ authorityHost }, options));
         if (options && options.tenantId) {
-            checkTenantId(logger$m, options.tenantId);
+            checkTenantId(logger$n, options.tenantId);
             this.tenantId = options.tenantId;
         }
         else {
@@ -1478,7 +1478,7 @@ class VisualStudioCodeCredential {
     async getToken(scopes, options) {
         var _a, _b;
         await this.prepareOnce();
-        const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds, logger$m) || this.tenantId;
+        const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds, logger$n) || this.tenantId;
         if (findCredentials === undefined) {
             throw new CredentialUnavailableError([
                 "No implementation of `VisualStudioCodeCredential` is available.",
@@ -1492,7 +1492,7 @@ class VisualStudioCodeCredential {
         // Check to make sure the scope we get back is a valid scope
         if (!scopeString.match(/^[0-9a-zA-Z-.:/]+$/)) {
             const error = new Error("Invalid scope was specified by the user or calling client");
-            logger$m.getToken.info(formatError(scopes, error));
+            logger$n.getToken.info(formatError(scopes, error));
             throw error;
         }
         if (scopeString.indexOf("offline_access") < 0) {
@@ -1512,18 +1512,18 @@ class VisualStudioCodeCredential {
         if (refreshToken) {
             const tokenResponse = await this.identityClient.refreshAccessToken(tenantId, AzureAccountClientId, scopeString, refreshToken, undefined);
             if (tokenResponse) {
-                logger$m.getToken.info(formatSuccess(scopes));
+                logger$n.getToken.info(formatSuccess(scopes));
                 return tokenResponse.accessToken;
             }
             else {
                 const error = new CredentialUnavailableError("Could not retrieve the token associated with Visual Studio Code. Have you connected using the 'Azure Account' extension recently? To troubleshoot, visit https://aka.ms/azsdk/js/identity/vscodecredential/troubleshoot.");
-                logger$m.getToken.info(formatError(scopes, error));
+                logger$n.getToken.info(formatError(scopes, error));
                 throw error;
             }
         }
         else {
             const error = new CredentialUnavailableError("Could not retrieve the token associated with Visual Studio Code. Did you connect using the 'Azure Account' extension? To troubleshoot, visit https://aka.ms/azsdk/js/identity/vscodecredential/troubleshoot.");
-            logger$m.getToken.info(formatError(scopes, error));
+            logger$n.getToken.info(formatError(scopes, error));
             throw error;
         }
     }
@@ -1575,7 +1575,7 @@ function useIdentityPlugin(plugin) {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$6 = "ManagedIdentityCredential - AppServiceMSI 2017";
-const logger$l = credentialLogger(msiName$6);
+const logger$m = credentialLogger(msiName$6);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1616,22 +1616,22 @@ const appServiceMsi2017 = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$l.info(`${msiName$6}: Unavailable. Multiple scopes are not supported.`);
+            logger$m.info(`${msiName$6}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.MSI_ENDPOINT && env.MSI_SECRET);
         if (!result) {
-            logger$l.info(`${msiName$6}: Unavailable. The environment variables needed are: MSI_ENDPOINT and MSI_SECRET.`);
+            logger$m.info(`${msiName$6}: Unavailable. The environment variables needed are: MSI_ENDPOINT and MSI_SECRET.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (resourceId) {
-            logger$l.warning(`${msiName$6}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
+            logger$m.warning(`${msiName$6}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
-        logger$l.info(`${msiName$6}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
+        logger$m.info(`${msiName$6}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$5(scopes, clientId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -1643,7 +1643,7 @@ const appServiceMsi2017 = {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$5 = "ManagedIdentityCredential - CloudShellMSI";
-const logger$k = credentialLogger(msiName$5);
+const logger$l = credentialLogger(msiName$5);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1686,24 +1686,24 @@ const cloudShellMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$k.info(`${msiName$5}: Unavailable. Multiple scopes are not supported.`);
+            logger$l.info(`${msiName$5}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const result = Boolean(process.env.MSI_ENDPOINT);
         if (!result) {
-            logger$k.info(`${msiName$5}: Unavailable. The environment variable MSI_ENDPOINT is needed.`);
+            logger$l.info(`${msiName$5}: Unavailable. The environment variable MSI_ENDPOINT is needed.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (clientId) {
-            logger$k.warning(`${msiName$5}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
+            logger$l.warning(`${msiName$5}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
         }
         if (resourceId) {
-            logger$k.warning(`${msiName$5}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
+            logger$l.warning(`${msiName$5}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
         }
-        logger$k.info(`${msiName$5}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
+        logger$l.info(`${msiName$5}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$4(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -1715,7 +1715,7 @@ const cloudShellMsi = {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$4 = "ManagedIdentityCredential - IMDS";
-const logger$j = credentialLogger(msiName$4);
+const logger$k = credentialLogger(msiName$4);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1773,7 +1773,7 @@ const imdsMsi = {
     async isAvailable({ scopes, identityClient, clientId, resourceId, getTokenOptions = {}, }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$j.info(`${msiName$4}: Unavailable. Multiple scopes are not supported.`);
+            logger$k.info(`${msiName$4}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         // if the PodIdentityEndpoint environment variable was set no need to probe the endpoint, it can be assumed to exist
@@ -1801,39 +1801,39 @@ const imdsMsi = {
             request.allowInsecureConnection = true;
             let response;
             try {
-                logger$j.info(`${msiName$4}: Pinging the Azure IMDS endpoint`);
+                logger$k.info(`${msiName$4}: Pinging the Azure IMDS endpoint`);
                 response = await identityClient.sendRequest(request);
             }
             catch (err) {
                 // If the request failed, or Node.js was unable to establish a connection,
                 // or the host was down, we'll assume the IMDS endpoint isn't available.
                 if (coreUtil.isError(err)) {
-                    logger$j.verbose(`${msiName$4}: Caught error ${err.name}: ${err.message}`);
+                    logger$k.verbose(`${msiName$4}: Caught error ${err.name}: ${err.message}`);
                 }
                 // This is a special case for Docker Desktop which responds with a 403 with a message that contains "A socket operation was attempted to an unreachable network"
                 // rather than just timing out, as expected.
-                logger$j.info(`${msiName$4}: The Azure IMDS endpoint is unavailable`);
+                logger$k.info(`${msiName$4}: The Azure IMDS endpoint is unavailable`);
                 return false;
             }
             if (response.status === 403) {
                 if ((_b = response.bodyAsText) === null || _b === void 0 ? void 0 : _b.includes("A socket operation was attempted to an unreachable network")) {
-                    logger$j.info(`${msiName$4}: The Azure IMDS endpoint is unavailable`);
-                    logger$j.info(`${msiName$4}: ${response.bodyAsText}`);
+                    logger$k.info(`${msiName$4}: The Azure IMDS endpoint is unavailable`);
+                    logger$k.info(`${msiName$4}: ${response.bodyAsText}`);
                     return false;
                 }
             }
             // If we received any response, the endpoint is available
-            logger$j.info(`${msiName$4}: The Azure IMDS endpoint is available`);
+            logger$k.info(`${msiName$4}: The Azure IMDS endpoint is available`);
             return true;
         });
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (process.env.AZURE_POD_IDENTITY_AUTHORITY_HOST) {
-            logger$j.info(`${msiName$4}: Using the Azure IMDS endpoint coming from the environment variable AZURE_POD_IDENTITY_AUTHORITY_HOST=${process.env.AZURE_POD_IDENTITY_AUTHORITY_HOST}.`);
+            logger$k.info(`${msiName$4}: Using the Azure IMDS endpoint coming from the environment variable AZURE_POD_IDENTITY_AUTHORITY_HOST=${process.env.AZURE_POD_IDENTITY_AUTHORITY_HOST}.`);
         }
         else {
-            logger$j.info(`${msiName$4}: Using the default Azure IMDS endpoint ${imdsHost}.`);
+            logger$k.info(`${msiName$4}: Using the default Azure IMDS endpoint ${imdsHost}.`);
         }
         let nextDelayInMs = imdsMsiRetryConfig.startDelayInMs;
         for (let retries = 0; retries < imdsMsiRetryConfig.maxRetries; retries++) {
@@ -1858,7 +1858,7 @@ const imdsMsi = {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$3 = "ManagedIdentityCredential - Azure Arc MSI";
-const logger$i = credentialLogger(msiName$3);
+const logger$j = credentialLogger(msiName$3);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1932,12 +1932,12 @@ const arcMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$i.info(`${msiName$3}: Unavailable. Multiple scopes are not supported.`);
+            logger$j.info(`${msiName$3}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const result = Boolean(process.env.IMDS_ENDPOINT && process.env.IDENTITY_ENDPOINT);
         if (!result) {
-            logger$i.info(`${msiName$3}: The environment variables needed are: IMDS_ENDPOINT and IDENTITY_ENDPOINT`);
+            logger$j.info(`${msiName$3}: The environment variables needed are: IMDS_ENDPOINT and IDENTITY_ENDPOINT`);
         }
         return result;
     },
@@ -1945,12 +1945,12 @@ const arcMsi = {
         var _a;
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (clientId) {
-            logger$i.warning(`${msiName$3}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
+            logger$j.warning(`${msiName$3}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
         }
         if (resourceId) {
-            logger$i.warning(`${msiName$3}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
+            logger$j.warning(`${msiName$3}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
         }
-        logger$i.info(`${msiName$3}: Authenticating.`);
+        logger$j.info(`${msiName$3}: Authenticating.`);
         const requestOptions = Object.assign(Object.assign({ disableJsonStringifyOnBody: true, deserializationMapper: undefined, abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$2(scopes, clientId, resourceId)), { allowInsecureConnection: true });
         const filePath = await filePathRequest(identityClient, requestOptions);
         if (!filePath) {
@@ -2008,7 +2008,7 @@ class MsalClientAssertion extends MsalNode {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$h = credentialLogger("ClientAssertionCredential");
+const logger$i = credentialLogger("ClientAssertionCredential");
 /**
  * Authenticates a service principal with a JWT assertion.
  */
@@ -2031,7 +2031,7 @@ class ClientAssertionCredential {
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
         this.clientId = clientId;
         this.options = options;
-        this.msalFlow = new MsalClientAssertion(Object.assign(Object.assign({}, options), { logger: logger$h, clientId: this.clientId, tenantId: this.tenantId, tokenCredentialOptions: this.options, getAssertion }));
+        this.msalFlow = new MsalClientAssertion(Object.assign(Object.assign({}, options), { logger: logger$i, clientId: this.clientId, tenantId: this.tenantId, tokenCredentialOptions: this.options, getAssertion }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -2043,7 +2043,7 @@ class ClientAssertionCredential {
      */
     async getToken(scopes, options = {}) {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
-            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$h);
+            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$i);
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             return this.msalFlow.getToken(arrayScopes, newOptions);
         });
@@ -2065,7 +2065,7 @@ const SupportedWorkloadEnvironmentVariables = [
     "AZURE_CLIENT_ID",
     "AZURE_FEDERATED_TOKEN_FILE",
 ];
-const logger$g = credentialLogger(credentialName$3);
+const logger$h = credentialLogger(credentialName$3);
 /**
  * Workload Identity authentication is a feature in Azure that allows applications running on virtual machines (VMs)
  * to access other Azure resources without the need for a service principal or managed identity. With Workload Identity
@@ -2091,17 +2091,17 @@ class WorkloadIdentityCredential {
         this.cacheDate = undefined;
         // Logging environment variables for error details
         const assignedEnv = processEnvVars(SupportedWorkloadEnvironmentVariables).assigned.join(", ");
-        logger$g.info(`Found the following environment variables: ${assignedEnv}`);
+        logger$h.info(`Found the following environment variables: ${assignedEnv}`);
         const workloadIdentityCredentialOptions = options !== null && options !== void 0 ? options : {};
         const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;
         const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;
         this.federatedTokenFilePath =
             workloadIdentityCredentialOptions.tokenFilePath || process.env.AZURE_FEDERATED_TOKEN_FILE;
         if (tenantId) {
-            checkTenantId(logger$g, tenantId);
+            checkTenantId(logger$h, tenantId);
         }
         if (clientId && tenantId && this.federatedTokenFilePath) {
-            logger$g.info(`Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`);
+            logger$h.info(`Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`);
             this.client = new ClientAssertionCredential(tenantId, clientId, this.readFileContents.bind(this), options);
         }
     }
@@ -2120,10 +2120,10 @@ class WorkloadIdentityCredential {
       "AZURE_TENANT_ID",
       "AZURE_CLIENT_ID",
       "AZURE_FEDERATED_TOKEN_FILE". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot  `;
-            logger$g.info(errorMessage);
+            logger$h.info(errorMessage);
             throw new CredentialUnavailableError(errorMessage);
         }
-        logger$g.info("Invoking getToken() of Client Assertion Credential");
+        logger$h.info("Invoking getToken() of Client Assertion Credential");
         return this.client.getToken(scopes, options);
     }
     async readFileContents() {
@@ -2152,7 +2152,7 @@ class WorkloadIdentityCredential {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$2 = "ManagedIdentityCredential - Token Exchange";
-const logger$f = credentialLogger(msiName$2);
+const logger$g = credentialLogger(msiName$2);
 /**
  * Defines how to determine whether the token exchange MSI is available, and also how to retrieve a token from the token exchange MSI.
  */
@@ -2165,7 +2165,7 @@ function tokenExchangeMsi() {
                 env.AZURE_TENANT_ID &&
                 process.env.AZURE_FEDERATED_TOKEN_FILE);
             if (!result) {
-                logger$f.info(`${msiName$2}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
+                logger$g.info(`${msiName$2}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
             }
             return result;
         },
@@ -2192,7 +2192,7 @@ function tokenExchangeMsi() {
 //   curl --insecure $IDENTITY_ENDPOINT'?api-version=2019-07-01-preview&resource=https://vault.azure.net/' -H "Secret: $IDENTITY_HEADER"
 //
 const msiName$1 = "ManagedIdentityCredential - Fabric MSI";
-const logger$e = credentialLogger(msiName$1);
+const logger$f = credentialLogger(msiName$1);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -2236,22 +2236,22 @@ const fabricMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$e.info(`${msiName$1}: Unavailable. Multiple scopes are not supported.`);
+            logger$f.info(`${msiName$1}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER && env.IDENTITY_SERVER_THUMBPRINT);
         if (!result) {
-            logger$e.info(`${msiName$1}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
+            logger$f.info(`${msiName$1}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { scopes, identityClient, clientId, resourceId } = configuration;
         if (resourceId) {
-            logger$e.warning(`${msiName$1}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
+            logger$f.warning(`${msiName$1}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
-        logger$e.info([
+        logger$f.info([
             `${msiName$1}:`,
             "Using the endpoint and the secret coming from the environment variables:",
             `IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT},`,
@@ -2272,7 +2272,7 @@ const fabricMsi = {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName = "ManagedIdentityCredential - AppServiceMSI 2019";
-const logger$d = credentialLogger(msiName);
+const logger$e = credentialLogger(msiName);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -2316,19 +2316,19 @@ const appServiceMsi2019 = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$d.info(`${msiName}: Unavailable. Multiple scopes are not supported.`);
+            logger$e.info(`${msiName}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER);
         if (!result) {
-            logger$d.info(`${msiName}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT and IDENTITY_HEADER.`);
+            logger$e.info(`${msiName}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT and IDENTITY_HEADER.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
-        logger$d.info(`${msiName}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
+        logger$e.info(`${msiName}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -2339,7 +2339,7 @@ const appServiceMsi2019 = {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$c = credentialLogger("ManagedIdentityCredential");
+const logger$d = credentialLogger("ManagedIdentityCredential");
 /**
  * Attempts authentication using a managed identity available at the deployment environment.
  * This authentication type works in Azure VMs, App Service instances, Azure Functions applications,
@@ -2389,7 +2389,7 @@ class ManagedIdentityCredential {
             },
             system: {
                 loggerOptions: {
-                    logLevel: getMSALLogLevel(logger$p.getLogLevel()),
+                    logLevel: getMSALLogLevel(logger$q.getLogLevel()),
                 },
             },
         });
@@ -2485,7 +2485,7 @@ class ManagedIdentityCredential {
                     // It also means that the endpoint answered with either 200 or 201 (see the sendTokenRequest method),
                     // yet we had no access token. For this reason, we'll throw once with a specific message:
                     const error = new CredentialUnavailableError("The managed identity endpoint was reached, yet no tokens were received.");
-                    logger$c.getToken.info(formatError(scopes, error));
+                    logger$d.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 // Since `authenticateManagedIdentity` didn't throw, and the result was not null,
@@ -2497,10 +2497,10 @@ class ManagedIdentityCredential {
                 // We've previously determined that the endpoint was unavailable,
                 // either because it was unreachable or permanently unable to authenticate.
                 const error = new CredentialUnavailableError("The managed identity endpoint is not currently available");
-                logger$c.getToken.info(formatError(scopes, error));
+                logger$d.getToken.info(formatError(scopes, error));
                 throw error;
             }
-            logger$c.getToken.info(formatSuccess(scopes));
+            logger$d.getToken.info(formatSuccess(scopes));
             return result;
         }
         catch (err) {
@@ -2522,14 +2522,14 @@ class ManagedIdentityCredential {
             // we can safely assume the credential is unavailable.
             if (err.code === "ENETUNREACH") {
                 const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. Network unreachable. Message: ${err.message}`);
-                logger$c.getToken.info(formatError(scopes, error));
+                logger$d.getToken.info(formatError(scopes, error));
                 throw error;
             }
             // If either the host was unreachable,
             // we can safely assume the credential is unavailable.
             if (err.code === "EHOSTUNREACH") {
                 const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. No managed identity endpoint found. Message: ${err.message}`);
-                logger$c.getToken.info(formatError(scopes, error));
+                logger$d.getToken.info(formatError(scopes, error));
                 throw error;
             }
             // If err.statusCode has a value of 400, it comes from sendTokenRequest,
@@ -2542,7 +2542,7 @@ class ManagedIdentityCredential {
             if (err.statusCode === 403 || err.code === 403) {
                 if (err.message.includes("A socket operation was attempted to an unreachable network")) {
                     const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. Network unreachable. Message: ${err.message}`);
-                    logger$c.getToken.info(formatError(scopes, error));
+                    logger$d.getToken.info(formatError(scopes, error));
                     throw error;
                 }
             }
@@ -2569,7 +2569,7 @@ class ManagedIdentityCredential {
      */
     handleResult(scopes, result, getTokenOptions) {
         this.ensureValidMsalToken(scopes, result, getTokenOptions);
-        logger$c.getToken.info(formatSuccess(scopes));
+        logger$d.getToken.info(formatSuccess(scopes));
         return {
             token: result.accessToken,
             expiresOnTimestamp: result.expiresOn.getTime(),
@@ -2581,7 +2581,7 @@ class ManagedIdentityCredential {
      */
     ensureValidMsalToken(scopes, msalToken, getTokenOptions) {
         const error = (message) => {
-            logger$c.getToken.info(message);
+            logger$d.getToken.info(message);
             return new AuthenticationRequiredError({
                 scopes: Array.isArray(scopes) ? scopes : [scopes],
                 getTokenOptions,
@@ -2601,12 +2601,12 @@ class ManagedIdentityCredential {
     initializeSetAppTokenProvider() {
         if (!this.isAppTokenProviderInitialized) {
             this.confidentialApp.SetAppTokenProvider(async (appTokenProviderParameters) => {
-                logger$c.info(`SetAppTokenProvider invoked with parameters- ${JSON.stringify(appTokenProviderParameters)}`);
+                logger$d.info(`SetAppTokenProvider invoked with parameters- ${JSON.stringify(appTokenProviderParameters)}`);
                 const getTokenOptions = Object.assign({}, appTokenProviderParameters);
-                logger$c.info(`authenticateManagedIdentity invoked with scopes- ${JSON.stringify(appTokenProviderParameters.scopes)} and getTokenOptions - ${JSON.stringify(getTokenOptions)}`);
+                logger$d.info(`authenticateManagedIdentity invoked with scopes- ${JSON.stringify(appTokenProviderParameters.scopes)} and getTokenOptions - ${JSON.stringify(getTokenOptions)}`);
                 const resultToken = await this.authenticateManagedIdentity(appTokenProviderParameters.scopes, getTokenOptions);
                 if (resultToken) {
-                    logger$c.info(`SetAppTokenProvider will save the token in cache`);
+                    logger$d.info(`SetAppTokenProvider will save the token in cache`);
                     const expiresInSeconds = (resultToken === null || resultToken === void 0 ? void 0 : resultToken.expiresOnTimestamp)
                         ? Math.floor((resultToken.expiresOnTimestamp - Date.now()) / 1000)
                         : 0;
@@ -2616,7 +2616,7 @@ class ManagedIdentityCredential {
                     };
                 }
                 else {
-                    logger$c.info(`SetAppTokenProvider token has "no_access_token_returned" as the saved token`);
+                    logger$d.info(`SetAppTokenProvider token has "no_access_token_returned" as the saved token`);
                     return {
                         accessToken: "no_access_token_returned",
                         expiresInSeconds: 0,
@@ -2707,7 +2707,7 @@ const cliCredentialInternals = {
         });
     },
 };
-const logger$b = credentialLogger("AzureCliCredential");
+const logger$c = credentialLogger("AzureCliCredential");
 /**
  * This credential will use the currently logged-in user login information
  * via the Azure CLI ('az') commandline tool.
@@ -2725,7 +2725,7 @@ class AzureCliCredential {
      */
     constructor(options) {
         if (options === null || options === void 0 ? void 0 : options.tenantId) {
-            checkTenantId(logger$b, options === null || options === void 0 ? void 0 : options.tenantId);
+            checkTenantId(logger$c, options === null || options === void 0 ? void 0 : options.tenantId);
             this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         }
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
@@ -2742,14 +2742,14 @@ class AzureCliCredential {
     async getToken(scopes, options = {}) {
         const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds);
         if (tenantId) {
-            checkTenantId(logger$b, tenantId);
+            checkTenantId(logger$c, tenantId);
         }
         const scope = typeof scopes === "string" ? scopes : scopes[0];
-        logger$b.getToken.info(`Using the scope ${scope}`);
+        logger$c.getToken.info(`Using the scope ${scope}`);
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
             var _a, _b, _c, _d;
             try {
-                ensureValidScopeForDevTimeCreds(scope, logger$b);
+                ensureValidScopeForDevTimeCreds(scope, logger$c);
                 const resource = getScopeResource(scope);
                 const obj = await cliCredentialInternals.getAzureCliAccessToken(resource, tenantId, this.timeout);
                 const specificScope = (_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("(.*)az login --scope(.*)");
@@ -2757,23 +2757,217 @@ class AzureCliCredential {
                 const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("az:(.*)not found")) || ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'az' is not recognized"));
                 if (isNotInstallError) {
                     const error = new CredentialUnavailableError("Azure CLI could not be found. Please visit https://aka.ms/azure-cli for installation instructions and then, once installed, authenticate to your Azure account using 'az login'.");
-                    logger$b.getToken.info(formatError(scopes, error));
+                    logger$c.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 if (isLoginError) {
                     const error = new CredentialUnavailableError("Please run 'az login' from a command prompt to authenticate before using this credential.");
-                    logger$b.getToken.info(formatError(scopes, error));
+                    logger$c.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 try {
                     const responseData = obj.stdout;
-                    const response = JSON.parse(responseData);
+                    const response = this.parseRawResponse(responseData);
+                    logger$c.getToken.info(formatSuccess(scopes));
+                    return response;
+                }
+                catch (e) {
+                    if (obj.stderr) {
+                        throw new CredentialUnavailableError(obj.stderr);
+                    }
+                    throw e;
+                }
+            }
+            catch (err) {
+                const error = err.name === "CredentialUnavailableError"
+                    ? err
+                    : new CredentialUnavailableError(err.message || "Unknown error while trying to retrieve the access token");
+                logger$c.getToken.info(formatError(scopes, error));
+                throw error;
+            }
+        });
+    }
+    /**
+     * Parses the raw JSON response from the Azure CLI into a usable AccessToken object
+     *
+     * @param rawResponse - The raw JSON response from the Azure CLI
+     * @returns An access token with the expiry time parsed from the raw response
+     *
+     * The expiryTime of the credential's access token, in milliseconds, is calculated as follows:
+     *
+     * When available, expires_on (introduced in Azure CLI v2.54.0) will be preferred. Otherwise falls back to expiresOn.
+     */
+    parseRawResponse(rawResponse) {
+        const response = JSON.parse(rawResponse);
+        const token = response.accessToken;
+        // if available, expires_on will be a number representing seconds since epoch.
+        // ensure it's a number or NaN
+        let expiresOnTimestamp = Number.parseInt(response.expires_on, 10) * 1000;
+        if (!isNaN(expiresOnTimestamp)) {
+            logger$c.getToken.info("expires_on is available and is valid, using it");
+            return {
+                token,
+                expiresOnTimestamp,
+            };
+        }
+        // fallback to the older expiresOn - an RFC3339 date string
+        expiresOnTimestamp = new Date(response.expiresOn).getTime();
+        // ensure expiresOn is well-formatted
+        if (isNaN(expiresOnTimestamp)) {
+            throw new CredentialUnavailableError(`Unexpected response from Azure CLI when getting token. Expected "expiresOn" to be a RFC3339 date string. Got: "${response.expiresOn}"`);
+        }
+        return {
+            token,
+            expiresOnTimestamp,
+        };
+    }
+}
+
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+/**
+ * Mockable reference to the Developer CLI credential cliCredentialFunctions
+ * @internal
+ */
+const developerCliCredentialInternals = {
+    /**
+     * @internal
+     */
+    getSafeWorkingDir() {
+        if (process.platform === "win32") {
+            if (!process.env.SystemRoot) {
+                throw new Error("Azure Developer CLI credential expects a 'SystemRoot' environment variable");
+            }
+            return process.env.SystemRoot;
+        }
+        else {
+            return "/bin";
+        }
+    },
+    /**
+     * Gets the access token from Azure Developer CLI
+     * @param scopes - The scopes to use when getting the token
+     * @internal
+     */
+    async getAzdAccessToken(scopes, tenantId, timeout) {
+        let tenantSection = [];
+        if (tenantId) {
+            tenantSection = ["--tenant-id", tenantId];
+        }
+        return new Promise((resolve, reject) => {
+            try {
+                child_process.execFile("azd", [
+                    "auth",
+                    "token",
+                    "--output",
+                    "json",
+                    ...scopes.reduce((previous, current) => previous.concat("--scope", current), []),
+                    ...tenantSection,
+                ], {
+                    cwd: developerCliCredentialInternals.getSafeWorkingDir(),
+                    timeout,
+                }, (error, stdout, stderr) => {
+                    resolve({ stdout, stderr, error });
+                });
+            }
+            catch (err) {
+                reject(err);
+            }
+        });
+    },
+};
+const logger$b = credentialLogger("AzureDeveloperCliCredential");
+/**
+ * Azure Developer CLI is a command-line interface tool that allows developers to create, manage, and deploy
+ * resources in Azure. It's built on top of the Azure CLI and provides additional functionality specific
+ * to Azure developers. It allows users to authenticate as a user and/or a service principal against
+ * <a href="https://learn.microsoft.com/azure/active-directory/fundamentals/">Microsoft Entra ID</a>. The
+ * AzureDeveloperCliCredential authenticates in a development environment and acquires a token on behalf of
+ * the logged-in user or service principal in the Azure Developer CLI. It acts as the Azure Developer CLI logged in user or
+ * service principal and executes an Azure CLI command underneath to authenticate the application against
+ * Microsoft Entra ID.
+ *
+ * <h2> Configure AzureDeveloperCliCredential </h2>
+ *
+ * To use this credential, the developer needs to authenticate locally in Azure Developer CLI using one of the
+ * commands below:
+ *
+ * <ol>
+ *     <li>Run "azd auth login" in Azure Developer CLI to authenticate interactively as a user.</li>
+ *     <li>Run "azd auth login --client-id clientID --client-secret clientSecret
+ *     --tenant-id tenantID" to authenticate as a service principal.</li>
+ * </ol>
+ *
+ * You may need to repeat this process after a certain time period, depending on the refresh token validity in your
+ * organization. Generally, the refresh token validity period is a few weeks to a few months.
+ * AzureDeveloperCliCredential will prompt you to sign in again.
+ */
+class AzureDeveloperCliCredential {
+    /**
+     * Creates an instance of the {@link AzureDeveloperCliCredential}.
+     *
+     * To use this credential, ensure that you have already logged
+     * in via the 'azd' tool using the command "azd auth login" from the commandline.
+     *
+     * @param options - Options, to optionally allow multi-tenant requests.
+     */
+    constructor(options) {
+        if (options === null || options === void 0 ? void 0 : options.tenantId) {
+            checkTenantId(logger$b, options === null || options === void 0 ? void 0 : options.tenantId);
+            this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
+        }
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.timeout = options === null || options === void 0 ? void 0 : options.processTimeoutInMs;
+    }
+    /**
+     * Authenticates with Microsoft Entra ID and returns an access token if successful.
+     * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
+     *
+     * @param scopes - The list of scopes for which the token will have access.
+     * @param options - The options used to configure any requests this
+     *                TokenCredential implementation might make.
+     */
+    async getToken(scopes, options = {}) {
+        const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds);
+        if (tenantId) {
+            checkTenantId(logger$b, tenantId);
+        }
+        let scopeList;
+        if (typeof scopes === "string") {
+            scopeList = [scopes];
+        }
+        else {
+            scopeList = scopes;
+        }
+        logger$b.getToken.info(`Using the scopes ${scopes}`);
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
+            var _a, _b, _c, _d;
+            try {
+                scopeList.forEach((scope) => {
+                    ensureValidScopeForDevTimeCreds(scope, logger$b);
+                });
+                const obj = await developerCliCredentialInternals.getAzdAccessToken(scopeList, tenantId, this.timeout);
+                const isNotLoggedInError = ((_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("not logged in, run `azd login` to login")) ||
+                    ((_b = obj.stderr) === null || _b === void 0 ? void 0 : _b.match("not logged in, run `azd auth login` to login"));
+                const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("azd:(.*)not found")) ||
+                    ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'azd' is not recognized"));
+                if (isNotInstallError || (obj.error && obj.error.code === "ENOENT")) {
+                    const error = new CredentialUnavailableError("Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.");
+                    logger$b.getToken.info(formatError(scopes, error));
+                    throw error;
+                }
+                if (isNotLoggedInError) {
+                    const error = new CredentialUnavailableError("Please run 'azd auth login' from a command prompt to authenticate before using this credential. For more information, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.");
+                    logger$b.getToken.info(formatError(scopes, error));
+                    throw error;
+                }
+                try {
+                    const resp = JSON.parse(obj.stdout);
                     logger$b.getToken.info(formatSuccess(scopes));
-                    const returnValue = {
-                        token: response.accessToken,
-                        expiresOnTimestamp: new Date(response.expiresOn).getTime(),
+                    return {
+                        token: resp.token,
+                        expiresOnTimestamp: new Date(resp.expiresOn).getTime(),
                     };
-                    return returnValue;
                 }
                 catch (e) {
                     if (obj.stderr) {
@@ -3523,262 +3717,140 @@ class EnvironmentCredential {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
+const logger$4 = credentialLogger("DefaultAzureCredential");
 /**
- * Mockable reference to the Developer CLI credential cliCredentialFunctions
+ * Creates a {@link ManagedIdentityCredential} from the provided options.
+ * @param options - Options to configure the credential.
+ *
  * @internal
  */
-const developerCliCredentialInternals = {
-    /**
-     * @internal
-     */
-    getSafeWorkingDir() {
-        if (process.platform === "win32") {
-            if (!process.env.SystemRoot) {
-                throw new Error("Azure Developer CLI credential expects a 'SystemRoot' environment variable");
-            }
-            return process.env.SystemRoot;
-        }
-        else {
-            return "/bin";
-        }
-    },
-    /**
-     * Gets the access token from Azure Developer CLI
-     * @param scopes - The scopes to use when getting the token
-     * @internal
-     */
-    async getAzdAccessToken(scopes, tenantId, timeout) {
-        let tenantSection = [];
-        if (tenantId) {
-            tenantSection = ["--tenant-id", tenantId];
-        }
-        return new Promise((resolve, reject) => {
-            try {
-                child_process.execFile("azd", [
-                    "auth",
-                    "token",
-                    "--output",
-                    "json",
-                    ...scopes.reduce((previous, current) => previous.concat("--scope", current), []),
-                    ...tenantSection,
-                ], {
-                    cwd: developerCliCredentialInternals.getSafeWorkingDir(),
-                    timeout,
-                }, (error, stdout, stderr) => {
-                    resolve({ stdout, stderr, error });
-                });
-            }
-            catch (err) {
-                reject(err);
-            }
-        });
-    },
-};
-const logger$4 = credentialLogger("AzureDeveloperCliCredential");
+function createDefaultManagedIdentityCredential(options) {
+    var _a, _b, _c;
+    const managedIdentityClientId = (_a = options === null || options === void 0 ? void 0 : options.managedIdentityClientId) !== null && _a !== void 0 ? _a : process.env.AZURE_CLIENT_ID;
+    const workloadIdentityClientId = (_b = options === null || options === void 0 ? void 0 : options.workloadIdentityClientId) !== null && _b !== void 0 ? _b : managedIdentityClientId;
+    const managedResourceId = options === null || options === void 0 ? void 0 : options.managedIdentityResourceId;
+    const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;
+    const tenantId = (_c = options === null || options === void 0 ? void 0 : options.tenantId) !== null && _c !== void 0 ? _c : process.env.AZURE_TENANT_ID;
+    if (managedResourceId) {
+        const managedIdentityResourceIdOptions = Object.assign(Object.assign({}, options), { resourceId: managedResourceId });
+        return new ManagedIdentityCredential(managedIdentityResourceIdOptions);
+    }
+    if (workloadFile && workloadIdentityClientId) {
+        const workloadIdentityCredentialOptions = Object.assign(Object.assign({}, options), { tenantId: tenantId });
+        return new ManagedIdentityCredential(workloadIdentityClientId, workloadIdentityCredentialOptions);
+    }
+    if (managedIdentityClientId) {
+        const managedIdentityClientOptions = Object.assign(Object.assign({}, options), { clientId: managedIdentityClientId });
+        return new ManagedIdentityCredential(managedIdentityClientOptions);
+    }
+    // We may be able to return a UnavailableCredential here, but that may be a breaking change
+    return new ManagedIdentityCredential(options);
+}
 /**
- * Azure Developer CLI is a command-line interface tool that allows developers to create, manage, and deploy
- * resources in Azure. It's built on top of the Azure CLI and provides additional functionality specific
- * to Azure developers. It allows users to authenticate as a user and/or a service principal against
- * <a href="https://learn.microsoft.com/azure/active-directory/fundamentals/">Microsoft Entra ID</a>. The
- * AzureDeveloperCliCredential authenticates in a development environment and acquires a token on behalf of
- * the logged-in user or service principal in the Azure Developer CLI. It acts as the Azure Developer CLI logged in user or
- * service principal and executes an Azure CLI command underneath to authenticate the application against
- * Microsoft Entra ID.
+ * Creates a {@link WorkloadIdentityCredential} from the provided options.
+ * @param options - Options to configure the credential.
  *
- * <h2> Configure AzureDeveloperCliCredential </h2>
- *
- * To use this credential, the developer needs to authenticate locally in Azure Developer CLI using one of the
- * commands below:
- *
- * <ol>
- *     <li>Run "azd auth login" in Azure Developer CLI to authenticate interactively as a user.</li>
- *     <li>Run "azd auth login --client-id clientID --client-secret clientSecret
- *     --tenant-id tenantID" to authenticate as a service principal.</li>
- * </ol>
- *
- * You may need to repeat this process after a certain time period, depending on the refresh token validity in your
- * organization. Generally, the refresh token validity period is a few weeks to a few months.
- * AzureDeveloperCliCredential will prompt you to sign in again.
+ * @internal
  */
-class AzureDeveloperCliCredential {
-    /**
-     * Creates an instance of the {@link AzureDeveloperCliCredential}.
-     *
-     * To use this credential, ensure that you have already logged
-     * in via the 'azd' tool using the command "azd auth login" from the commandline.
-     *
-     * @param options - Options, to optionally allow multi-tenant requests.
-     */
-    constructor(options) {
-        if (options === null || options === void 0 ? void 0 : options.tenantId) {
-            checkTenantId(logger$4, options === null || options === void 0 ? void 0 : options.tenantId);
-            this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
-        }
-        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
-        this.timeout = options === null || options === void 0 ? void 0 : options.processTimeoutInMs;
+function createDefaultWorkloadIdentityCredential(options) {
+    var _a, _b, _c;
+    const managedIdentityClientId = (_a = options === null || options === void 0 ? void 0 : options.managedIdentityClientId) !== null && _a !== void 0 ? _a : process.env.AZURE_CLIENT_ID;
+    const workloadIdentityClientId = (_b = options === null || options === void 0 ? void 0 : options.workloadIdentityClientId) !== null && _b !== void 0 ? _b : managedIdentityClientId;
+    const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;
+    const tenantId = (_c = options === null || options === void 0 ? void 0 : options.tenantId) !== null && _c !== void 0 ? _c : process.env.AZURE_TENANT_ID;
+    if (workloadFile && workloadIdentityClientId) {
+        const workloadIdentityCredentialOptions = Object.assign(Object.assign({}, options), { tenantId, clientId: workloadIdentityClientId, tokenFilePath: workloadFile });
+        return new WorkloadIdentityCredential(workloadIdentityCredentialOptions);
     }
-    /**
-     * Authenticates with Microsoft Entra ID and returns an access token if successful.
-     * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
-     *
-     * @param scopes - The list of scopes for which the token will have access.
-     * @param options - The options used to configure any requests this
-     *                TokenCredential implementation might make.
-     */
-    async getToken(scopes, options = {}) {
-        const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds);
-        if (tenantId) {
-            checkTenantId(logger$4, tenantId);
-        }
-        let scopeList;
-        if (typeof scopes === "string") {
-            scopeList = [scopes];
-        }
-        else {
-            scopeList = scopes;
-        }
-        logger$4.getToken.info(`Using the scopes ${scopes}`);
-        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
-            var _a, _b, _c, _d;
-            try {
-                scopeList.forEach((scope) => {
-                    ensureValidScopeForDevTimeCreds(scope, logger$4);
-                });
-                const obj = await developerCliCredentialInternals.getAzdAccessToken(scopeList, tenantId, this.timeout);
-                const isNotLoggedInError = ((_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("not logged in, run `azd login` to login")) ||
-                    ((_b = obj.stderr) === null || _b === void 0 ? void 0 : _b.match("not logged in, run `azd auth login` to login"));
-                const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("azd:(.*)not found")) ||
-                    ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'azd' is not recognized"));
-                if (isNotInstallError || (obj.error && obj.error.code === "ENOENT")) {
-                    const error = new CredentialUnavailableError("Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.");
-                    logger$4.getToken.info(formatError(scopes, error));
-                    throw error;
-                }
-                if (isNotLoggedInError) {
-                    const error = new CredentialUnavailableError("Please run 'azd auth login' from a command prompt to authenticate before using this credential. For more information, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.");
-                    logger$4.getToken.info(formatError(scopes, error));
-                    throw error;
-                }
-                try {
-                    const resp = JSON.parse(obj.stdout);
-                    logger$4.getToken.info(formatSuccess(scopes));
-                    return {
-                        token: resp.token,
-                        expiresOnTimestamp: new Date(resp.expiresOn).getTime(),
-                    };
-                }
-                catch (e) {
-                    if (obj.stderr) {
-                        throw new CredentialUnavailableError(obj.stderr);
-                    }
-                    throw e;
-                }
-            }
-            catch (err) {
-                const error = err.name === "CredentialUnavailableError"
-                    ? err
-                    : new CredentialUnavailableError(err.message || "Unknown error while trying to retrieve the access token");
-                logger$4.getToken.info(formatError(scopes, error));
-                throw error;
-            }
-        });
+    if (tenantId) {
+        const workloadIdentityClientTenantOptions = Object.assign(Object.assign({}, options), { tenantId });
+        return new WorkloadIdentityCredential(workloadIdentityClientTenantOptions);
     }
+    // We may be able to return a UnavailableCredential here, but that may be a breaking change
+    return new WorkloadIdentityCredential(options);
 }
-
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT license.
 /**
- * A shim around ManagedIdentityCredential that adapts it to accept
- * `DefaultAzureCredentialOptions`.
+ * Creates a {@link AzureDeveloperCliCredential} from the provided options.
+ * @param options - Options to configure the credential.
  *
  * @internal
  */
-class DefaultManagedIdentityCredential extends ManagedIdentityCredential {
-    // Constructor overload with just the other default options
-    // Last constructor overload with Union of all options not required since the above two constructor overloads have optional properties
-    constructor(options) {
-        var _a, _b, _c;
-        const managedIdentityClientId = (_a = options === null || options === void 0 ? void 0 : options.managedIdentityClientId) !== null && _a !== void 0 ? _a : process.env.AZURE_CLIENT_ID;
-        const workloadIdentityClientId = (_b = options === null || options === void 0 ? void 0 : options.workloadIdentityClientId) !== null && _b !== void 0 ? _b : managedIdentityClientId;
-        const managedResourceId = options === null || options === void 0 ? void 0 : options.managedIdentityResourceId;
-        const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;
-        const tenantId = (_c = options === null || options === void 0 ? void 0 : options.tenantId) !== null && _c !== void 0 ? _c : process.env.AZURE_TENANT_ID;
-        // ManagedIdentityCredential throws if both the resourceId and the clientId are provided.
-        if (managedResourceId) {
-            const managedIdentityResourceIdOptions = Object.assign(Object.assign({}, options), { resourceId: managedResourceId });
-            super(managedIdentityResourceIdOptions);
-        }
-        else if (workloadFile && workloadIdentityClientId) {
-            const workloadIdentityCredentialOptions = Object.assign(Object.assign({}, options), { tenantId: tenantId });
-            super(workloadIdentityClientId, workloadIdentityCredentialOptions);
-        }
-        else if (managedIdentityClientId) {
-            const managedIdentityClientOptions = Object.assign(Object.assign({}, options), { clientId: managedIdentityClientId });
-            super(managedIdentityClientOptions);
-        }
-        else {
-            super(options);
-        }
-    }
+function createDefaultAzureDeveloperCliCredential(options = {}) {
+    const processTimeoutInMs = options.processTimeoutInMs;
+    return new AzureDeveloperCliCredential(Object.assign({ processTimeoutInMs }, options));
 }
 /**
- * A shim around WorkloadIdentityCredential that adapts it to accept
- * `DefaultAzureCredentialOptions`.
+ * Creates a {@link AzureCliCredential} from the provided options.
+ * @param options - Options to configure the credential.
  *
  * @internal
  */
-class DefaultWorkloadIdentityCredential extends WorkloadIdentityCredential {
-    // Constructor overload with just the other default options
-    // Last constructor overload with Union of all options not required since the above two constructor overloads have optional properties
-    constructor(options) {
-        var _a, _b, _c;
-        const managedIdentityClientId = (_a = options === null || options === void 0 ? void 0 : options.managedIdentityClientId) !== null && _a !== void 0 ? _a : process.env.AZURE_CLIENT_ID;
-        const workloadIdentityClientId = (_b = options === null || options === void 0 ? void 0 : options.workloadIdentityClientId) !== null && _b !== void 0 ? _b : managedIdentityClientId;
-        const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;
-        const tenantId = (_c = options === null || options === void 0 ? void 0 : options.tenantId) !== null && _c !== void 0 ? _c : process.env.AZURE_TENANT_ID;
-        if (workloadFile && workloadIdentityClientId) {
-            const workloadIdentityCredentialOptions = Object.assign(Object.assign({}, options), { tenantId, clientId: workloadIdentityClientId, tokenFilePath: workloadFile });
-            super(workloadIdentityCredentialOptions);
-        }
-        else if (tenantId) {
-            const workloadIdentityClientTenantOptions = Object.assign(Object.assign({}, options), { tenantId });
-            super(workloadIdentityClientTenantOptions);
-        }
-        else {
-            super(options);
-        }
-    }
+function createDefaultAzureCliCredential(options = {}) {
+    const processTimeoutInMs = options.processTimeoutInMs;
+    return new AzureCliCredential(Object.assign({ processTimeoutInMs }, options));
 }
-class DefaultAzureDeveloperCliCredential extends AzureDeveloperCliCredential {
-    constructor(options) {
-        super(Object.assign({ processTimeoutInMs: options === null || options === void 0 ? void 0 : options.processTimeoutInMs }, options));
-    }
+/**
+ * Creates a {@link AzurePowerShellCredential} from the provided options.
+ * @param options - Options to configure the credential.
+ *
+ * @internal
+ */
+function createDefaultAzurePowershellCredential(options = {}) {
+    const processTimeoutInMs = options.processTimeoutInMs;
+    return new AzurePowerShellCredential(Object.assign({ processTimeoutInMs }, options));
 }
-class DefaultAzureCliCredential extends AzureCliCredential {
-    constructor(options) {
-        super(Object.assign({ processTimeoutInMs: options === null || options === void 0 ? void 0 : options.processTimeoutInMs }, options));
-    }
+/**
+ * Creates an {@link EnvironmentCredential} from the provided options.
+ * @param options - Options to configure the credential.
+ *
+ * @internal
+ */
+function createEnvironmentCredential(options = {}) {
+    return new EnvironmentCredential(options);
 }
-class DefaultAzurePowershellCredential extends AzurePowerShellCredential {
-    constructor(options) {
-        super(Object.assign({ processTimeoutInMs: options === null || options === void 0 ? void 0 : options.processTimeoutInMs }, options));
+/**
+ * A no-op credential that logs the reason it was skipped if getToken is called.
+ * @internal
+ */
+class UnavailableDefaultCredential {
+    constructor(credentialName, message) {
+        this.credentialName = credentialName;
+        this.credentialUnavailableErrorMessage = message;
+    }
+    getToken() {
+        logger$4.getToken.info(`Skipping ${this.credentialName}, reason: ${this.credentialUnavailableErrorMessage}`);
+        return Promise.resolve(null);
     }
 }
-const defaultCredentials = [
-    EnvironmentCredential,
-    DefaultWorkloadIdentityCredential,
-    DefaultManagedIdentityCredential,
-    DefaultAzureCliCredential,
-    DefaultAzurePowershellCredential,
-    DefaultAzureDeveloperCliCredential,
-];
 /**
  * Provides a default {@link ChainedTokenCredential} configuration that should
  * work for most applications that use the Azure SDK.
  */
 class DefaultAzureCredential extends ChainedTokenCredential {
     constructor(options) {
-        super(...defaultCredentials.map((ctor) => new ctor(options)));
+        const credentialFunctions = [
+            createEnvironmentCredential,
+            createDefaultWorkloadIdentityCredential,
+            createDefaultManagedIdentityCredential,
+            createDefaultAzureCliCredential,
+            createDefaultAzurePowershellCredential,
+            createDefaultAzureDeveloperCliCredential,
+        ];
+        // DefaultCredential constructors should not throw, instead throwing on getToken() which is handled by ChainedTokenCredential.
+        // When adding new credentials to the default chain, consider:
+        // 1. Making the constructor parameters required and explicit
+        // 2. Validating any required parameters in the factory function
+        // 3. Returning a UnavailableDefaultCredential from the factory function if a credential is unavailable for any reason
+        const credentials = credentialFunctions.map((createCredentialFn) => {
+            try {
+                return createCredentialFn(options);
+            }
+            catch (err) {
+                logger$4.warning(`Skipped ${createCredentialFn.name} because of an error creating the credential: ${err}`);
+                return new UnavailableDefaultCredential(createCredentialFn.name, err.message);
+            }
+        });
+        super(...credentials);
     }
 }
 
@@ -4274,7 +4346,7 @@ exports.VisualStudioCodeCredential = VisualStudioCodeCredential;
 exports.WorkloadIdentityCredential = WorkloadIdentityCredential;
 exports.deserializeAuthenticationRecord = deserializeAuthenticationRecord;
 exports.getDefaultAzureCredential = getDefaultAzureCredential;
-exports.logger = logger$o;
+exports.logger = logger$p;
 exports.serializeAuthenticationRecord = serializeAuthenticationRecord;
 exports.useIdentityPlugin = useIdentityPlugin;
 //# sourceMappingURL=index.js.map