@azure/identity 4.13.0 → 4.13.2

package/dist/commonjs/credentials/workloadIdentityCredential.js

@@ -1,120 +1,134 @@
-"use strict";
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkloadIdentityCredential = exports.SupportedWorkloadEnvironmentVariables = void 0;
-const logging_js_1 = require("../util/logging.js");
-const clientAssertionCredential_js_1 = require("./clientAssertionCredential.js");
-const errors_js_1 = require("../errors.js");
-const tenantIdUtils_js_1 = require("../util/tenantIdUtils.js");
-const promises_1 = require("node:fs/promises");
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var workloadIdentityCredential_exports = {};
+__export(workloadIdentityCredential_exports, {
+  SupportedWorkloadEnvironmentVariables: () => SupportedWorkloadEnvironmentVariables,
+  WorkloadIdentityCredential: () => WorkloadIdentityCredential
+});
+module.exports = __toCommonJS(workloadIdentityCredential_exports);
+var import_logging = require("../util/logging.js");
+var import_clientAssertionCredential = require("./clientAssertionCredential.js");
+var import_errors = require("../errors.js");
+var import_tenantIdUtils = require("../util/tenantIdUtils.js");
+var import_promises = require("node:fs/promises");
 const credentialName = "WorkloadIdentityCredential";
-/**
- * Contains the list of all supported environment variable names so that an
- * appropriate error message can be generated when no credentials can be
- * configured.
- *
- * @internal
- */
-exports.SupportedWorkloadEnvironmentVariables = [
-    "AZURE_TENANT_ID",
-    "AZURE_CLIENT_ID",
-    "AZURE_FEDERATED_TOKEN_FILE",
+const SupportedWorkloadEnvironmentVariables = [
+  "AZURE_TENANT_ID",
+  "AZURE_CLIENT_ID",
+  "AZURE_FEDERATED_TOKEN_FILE"
 ];
-const logger = (0, logging_js_1.credentialLogger)(credentialName);
-/**
- * Workload Identity authentication is a feature in Azure that allows applications running on virtual machines (VMs)
- * to access other Azure resources without the need for a service principal or managed identity. With Workload Identity
- * authentication, applications authenticate themselves using their own identity, rather than using a shared service
- * principal or managed identity. Under the hood, Workload Identity authentication uses the concept of Service Account
- * Credentials (SACs), which are automatically created by Azure and stored securely in the VM. By using Workload
- * Identity authentication, you can avoid the need to manage and rotate service principals or managed identities for
- * each application on each VM. Additionally, because SACs are created automatically and managed by Azure, you don't
- * need to worry about storing and securing sensitive credentials themselves.
- * The WorkloadIdentityCredential supports Microsoft Entra Workload ID authentication on Azure Kubernetes and acquires
- * a token using the SACs available in the Azure Kubernetes environment.
- * Refer to <a href="https://learn.microsoft.com/azure/aks/workload-identity-overview">Microsoft Entra
- * Workload ID</a> for more information.
- */
+const logger = (0, import_logging.credentialLogger)(credentialName);
 class WorkloadIdentityCredential {
-    client;
-    azureFederatedTokenFileContent = undefined;
-    cacheDate = undefined;
-    federatedTokenFilePath;
-    /**
-     * WorkloadIdentityCredential supports Microsoft Entra Workload ID on Kubernetes.
-     *
-     * @param options - The identity client options to use for authentication.
-     */
-    constructor(options) {
-        // Logging environment variables for error details
-        const assignedEnv = (0, logging_js_1.processEnvVars)(exports.SupportedWorkloadEnvironmentVariables).assigned.join(", ");
-        logger.info(`Found the following environment variables: ${assignedEnv}`);
-        const workloadIdentityCredentialOptions = options ?? {};
-        const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;
-        const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;
-        this.federatedTokenFilePath =
-            workloadIdentityCredentialOptions.tokenFilePath || process.env.AZURE_FEDERATED_TOKEN_FILE;
-        if (tenantId) {
-            (0, tenantIdUtils_js_1.checkTenantId)(logger, tenantId);
-        }
-        if (!clientId) {
-            throw new errors_js_1.CredentialUnavailableError(`${credentialName}: is unavailable. clientId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_CLIENT_ID".
-        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`);
-        }
-        if (!tenantId) {
-            throw new errors_js_1.CredentialUnavailableError(`${credentialName}: is unavailable. tenantId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_TENANT_ID".
-        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`);
-        }
-        if (!this.federatedTokenFilePath) {
-            throw new errors_js_1.CredentialUnavailableError(`${credentialName}: is unavailable. federatedTokenFilePath is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_FEDERATED_TOKEN_FILE".
-        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`);
-        }
-        logger.info(`Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`);
-        this.client = new clientAssertionCredential_js_1.ClientAssertionCredential(tenantId, clientId, this.readFileContents.bind(this), options);
+  client;
+  azureFederatedTokenFileContent = void 0;
+  cacheDate = void 0;
+  federatedTokenFilePath;
+  /**
+   * WorkloadIdentityCredential supports Microsoft Entra Workload ID on Kubernetes.
+   *
+   * @param options - The identity client options to use for authentication.
+   */
+  constructor(options) {
+    const assignedEnv = (0, import_logging.processEnvVars)(SupportedWorkloadEnvironmentVariables).assigned.join(", ");
+    logger.info(`Found the following environment variables: ${assignedEnv}`);
+    const workloadIdentityCredentialOptions = options ?? {};
+    const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;
+    const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;
+    this.federatedTokenFilePath = workloadIdentityCredentialOptions.tokenFilePath || process.env.AZURE_FEDERATED_TOKEN_FILE;
+    if (tenantId) {
+      (0, import_tenantIdUtils.checkTenantId)(logger, tenantId);
     }
-    /**
-     * Authenticates with Microsoft Entra ID and returns an access token if successful.
-     * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
-     *
-     * @param scopes - The list of scopes for which the token will have access.
-     * @param options - The options used to configure any requests this
-     *                TokenCredential implementation might make.
-     */
-    async getToken(scopes, options) {
-        if (!this.client) {
-            const errorMessage = `${credentialName}: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters. 
+    if (!clientId) {
+      throw new import_errors.CredentialUnavailableError(
+        `${credentialName}: is unavailable. clientId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_CLIENT_ID".
+        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
+      );
+    }
+    if (!tenantId) {
+      throw new import_errors.CredentialUnavailableError(
+        `${credentialName}: is unavailable. tenantId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_TENANT_ID".
+        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
+      );
+    }
+    if (!this.federatedTokenFilePath) {
+      throw new import_errors.CredentialUnavailableError(
+        `${credentialName}: is unavailable. federatedTokenFilePath is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_FEDERATED_TOKEN_FILE".
+        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
+      );
+    }
+    logger.info(
+      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`
+    );
+    this.client = new import_clientAssertionCredential.ClientAssertionCredential(
+      tenantId,
+      clientId,
+      this.readFileContents.bind(this),
+      options
+    );
+  }
+  /**
+   * Authenticates with Microsoft Entra ID and returns an access token if successful.
+   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
+   *
+   * @param scopes - The list of scopes for which the token will have access.
+   * @param options - The options used to configure any requests this
+   *                TokenCredential implementation might make.
+   */
+  async getToken(scopes, options) {
+    if (!this.client) {
+      const errorMessage = `${credentialName}: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters. 
       In DefaultAzureCredential and ManagedIdentityCredential, these can be provided as environment variables - 
       "AZURE_TENANT_ID",
       "AZURE_CLIENT_ID",
       "AZURE_FEDERATED_TOKEN_FILE". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`;
-            logger.info(errorMessage);
-            throw new errors_js_1.CredentialUnavailableError(errorMessage);
-        }
-        logger.info("Invoking getToken() of Client Assertion Credential");
-        return this.client.getToken(scopes, options);
+      logger.info(errorMessage);
+      throw new import_errors.CredentialUnavailableError(errorMessage);
+    }
+    logger.info("Invoking getToken() of Client Assertion Credential");
+    return this.client.getToken(scopes, options);
+  }
+  async readFileContents() {
+    if (this.cacheDate !== void 0 && Date.now() - this.cacheDate >= 1e3 * 60 * 5) {
+      this.azureFederatedTokenFileContent = void 0;
+    }
+    if (!this.federatedTokenFilePath) {
+      throw new import_errors.CredentialUnavailableError(
+        `${credentialName}: is unavailable. Invalid file path provided ${this.federatedTokenFilePath}.`
+      );
     }
-    async readFileContents() {
-        // Cached assertions expire after 5 minutes
-        if (this.cacheDate !== undefined && Date.now() - this.cacheDate >= 1000 * 60 * 5) {
-            this.azureFederatedTokenFileContent = undefined;
-        }
-        if (!this.federatedTokenFilePath) {
-            throw new errors_js_1.CredentialUnavailableError(`${credentialName}: is unavailable. Invalid file path provided ${this.federatedTokenFilePath}.`);
-        }
-        if (!this.azureFederatedTokenFileContent) {
-            const file = await (0, promises_1.readFile)(this.federatedTokenFilePath, "utf8");
-            const value = file.trim();
-            if (!value) {
-                throw new errors_js_1.CredentialUnavailableError(`${credentialName}: is unavailable. No content on the file ${this.federatedTokenFilePath}.`);
-            }
-            else {
-                this.azureFederatedTokenFileContent = value;
-                this.cacheDate = Date.now();
-            }
-        }
-        return this.azureFederatedTokenFileContent;
+    if (!this.azureFederatedTokenFileContent) {
+      const file = await (0, import_promises.readFile)(this.federatedTokenFilePath, "utf8");
+      const value = file.trim();
+      if (!value) {
+        throw new import_errors.CredentialUnavailableError(
+          `${credentialName}: is unavailable. No content on the file ${this.federatedTokenFilePath}.`
+        );
+      } else {
+        this.azureFederatedTokenFileContent = value;
+        this.cacheDate = Date.now();
+      }
     }
+    return this.azureFederatedTokenFileContent;
+  }
 }
-exports.WorkloadIdentityCredential = WorkloadIdentityCredential;
-//# sourceMappingURL=workloadIdentityCredential.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SupportedWorkloadEnvironmentVariables,
+  WorkloadIdentityCredential
+});
+//# sourceMappingURL=workloadIdentityCredential.js.map

package/dist/commonjs/credentials/workloadIdentityCredential.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"workloadIdentityCredential.js","sourceRoot":"","sources":["../../../src/credentials/workloadIdentityCredential.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAGlC,mDAAsE;AAEtE,iFAA2E;AAC3E,4CAA0D;AAE1D,+DAAyD;AACzD,+CAA4C;AAE5C,MAAM,cAAc,GAAG,4BAA4B,CAAC;AACpD;;;;;;GAMG;AACU,QAAA,qCAAqC,GAAG;IACnD,iBAAiB;IACjB,iBAAiB;IACjB,4BAA4B;CAC7B,CAAC;AACF,MAAM,MAAM,GAAG,IAAA,6BAAgB,EAAC,cAAc,CAAC,CAAC;AAChD;;;;;;;;;;;;;GAaG;AACH,MAAa,0BAA0B;IAC7B,MAAM,CAAwC;IAC9C,8BAA8B,GAAuB,SAAS,CAAC;IAC/D,SAAS,GAAuB,SAAS,CAAC;IAC1C,sBAAsB,CAAqB;IAEnD;;;;OAIG;IACH,YAAY,OAA2C;QACrD,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAA,2BAAc,EAAC,6CAAqC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,8CAA8C,WAAW,EAAE,CAAC,CAAC;QAEzE,MAAM,iCAAiC,GAAG,OAAO,IAAI,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,iCAAiC,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3F,MAAM,QAAQ,GAAG,iCAAiC,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3F,IAAI,CAAC,sBAAsB;YACzB,iCAAiC,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAC5F,IAAI,QAAQ,EAAE,CAAC;YACb,IAAA,gCAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc;qIAC4G,CAC9H,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc;qIAC4G,CAC9H,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc;qIAC4G,CAC9H,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,CACT,sDAAsD,QAAQ,eAAe,iCAAiC,CAAC,QAAQ,uCAAuC,CAC/J,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,wDAAyB,CACzC,QAAQ,EACR,QAAQ,EACR,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAChC,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAyB,EACzB,OAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,GAAG,cAAc;;;;iKAIqH,CAAC;YAC5J,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1B,MAAM,IAAI,sCAA0B,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,2CAA2C;QAC3C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC,8BAA8B,GAAG,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,gDAAgD,IAAI,CAAC,sBAAsB,GAAG,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,4CAA4C,IAAI,CAAC,sBAAsB,GAAG,CAC5F,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,8BAA8B,GAAG,KAAK,CAAC;gBAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAzGD,gEAyGC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { credentialLogger, processEnvVars } from \"../util/logging.js\";\n\nimport { ClientAssertionCredential } from \"./clientAssertionCredential.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport type { WorkloadIdentityCredentialOptions } from \"./workloadIdentityCredentialOptions.js\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { readFile } from \"node:fs/promises\";\n\nconst credentialName = \"WorkloadIdentityCredential\";\n/**\n * Contains the list of all supported environment variable names so that an\n * appropriate error message can be generated when no credentials can be\n * configured.\n *\n * @internal\n */\nexport const SupportedWorkloadEnvironmentVariables = [\n  \"AZURE_TENANT_ID\",\n  \"AZURE_CLIENT_ID\",\n  \"AZURE_FEDERATED_TOKEN_FILE\",\n];\nconst logger = credentialLogger(credentialName);\n/**\n * Workload Identity authentication is a feature in Azure that allows applications running on virtual machines (VMs)\n * to access other Azure resources without the need for a service principal or managed identity. With Workload Identity\n * authentication, applications authenticate themselves using their own identity, rather than using a shared service\n * principal or managed identity. Under the hood, Workload Identity authentication uses the concept of Service Account\n * Credentials (SACs), which are automatically created by Azure and stored securely in the VM. By using Workload\n * Identity authentication, you can avoid the need to manage and rotate service principals or managed identities for\n * each application on each VM. Additionally, because SACs are created automatically and managed by Azure, you don't\n * need to worry about storing and securing sensitive credentials themselves.\n * The WorkloadIdentityCredential supports Microsoft Entra Workload ID authentication on Azure Kubernetes and acquires\n * a token using the SACs available in the Azure Kubernetes environment.\n * Refer to <a href=\"https://learn.microsoft.com/azure/aks/workload-identity-overview\">Microsoft Entra\n * Workload ID</a> for more information.\n */\nexport class WorkloadIdentityCredential implements TokenCredential {\n  private client: ClientAssertionCredential | undefined;\n  private azureFederatedTokenFileContent: string | undefined = undefined;\n  private cacheDate: number | undefined = undefined;\n  private federatedTokenFilePath: string | undefined;\n\n  /**\n   * WorkloadIdentityCredential supports Microsoft Entra Workload ID on Kubernetes.\n   *\n   * @param options - The identity client options to use for authentication.\n   */\n  constructor(options?: WorkloadIdentityCredentialOptions) {\n    // Logging environment variables for error details\n    const assignedEnv = processEnvVars(SupportedWorkloadEnvironmentVariables).assigned.join(\", \");\n    logger.info(`Found the following environment variables: ${assignedEnv}`);\n\n    const workloadIdentityCredentialOptions = options ?? {};\n    const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;\n    const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;\n    this.federatedTokenFilePath =\n      workloadIdentityCredentialOptions.tokenFilePath || process.env.AZURE_FEDERATED_TOKEN_FILE;\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    if (!clientId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. clientId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_CLIENT_ID\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n      );\n    }\n\n    if (!tenantId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. tenantId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_TENANT_ID\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n      );\n    }\n\n    if (!this.federatedTokenFilePath) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. federatedTokenFilePath is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_FEDERATED_TOKEN_FILE\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n      );\n    }\n\n    logger.info(\n      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`,\n    );\n    this.client = new ClientAssertionCredential(\n      tenantId,\n      clientId,\n      this.readFileContents.bind(this),\n      options,\n    );\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options?: GetTokenOptions,\n  ): Promise<AccessToken> {\n    if (!this.client) {\n      const errorMessage = `${credentialName}: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters. \n      In DefaultAzureCredential and ManagedIdentityCredential, these can be provided as environment variables - \n      \"AZURE_TENANT_ID\",\n      \"AZURE_CLIENT_ID\",\n      \"AZURE_FEDERATED_TOKEN_FILE\". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`;\n      logger.info(errorMessage);\n      throw new CredentialUnavailableError(errorMessage);\n    }\n    logger.info(\"Invoking getToken() of Client Assertion Credential\");\n    return this.client.getToken(scopes, options);\n  }\n\n  private async readFileContents(): Promise<string> {\n    // Cached assertions expire after 5 minutes\n    if (this.cacheDate !== undefined && Date.now() - this.cacheDate >= 1000 * 60 * 5) {\n      this.azureFederatedTokenFileContent = undefined;\n    }\n    if (!this.federatedTokenFilePath) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. Invalid file path provided ${this.federatedTokenFilePath}.`,\n      );\n    }\n    if (!this.azureFederatedTokenFileContent) {\n      const file = await readFile(this.federatedTokenFilePath, \"utf8\");\n      const value = file.trim();\n      if (!value) {\n        throw new CredentialUnavailableError(\n          `${credentialName}: is unavailable. No content on the file ${this.federatedTokenFilePath}.`,\n        );\n      } else {\n        this.azureFederatedTokenFileContent = value;\n        this.cacheDate = Date.now();\n      }\n    }\n    return this.azureFederatedTokenFileContent;\n  }\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/workloadIdentityCredential.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { credentialLogger, processEnvVars } from \"../util/logging.js\";\n\nimport { ClientAssertionCredential } from \"#platform/credentials/clientAssertionCredential\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport type { WorkloadIdentityCredentialOptions } from \"./workloadIdentityCredentialOptions.js\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { readFile } from \"node:fs/promises\";\n\nconst credentialName = \"WorkloadIdentityCredential\";\n/**\n * Contains the list of all supported environment variable names so that an\n * appropriate error message can be generated when no credentials can be\n * configured.\n *\n * @internal\n */\nexport const SupportedWorkloadEnvironmentVariables = [\n  \"AZURE_TENANT_ID\",\n  \"AZURE_CLIENT_ID\",\n  \"AZURE_FEDERATED_TOKEN_FILE\",\n];\nconst logger = credentialLogger(credentialName);\n/**\n * Workload Identity authentication is a feature in Azure that allows applications running on virtual machines (VMs)\n * to access other Azure resources without the need for a service principal or managed identity. With Workload Identity\n * authentication, applications authenticate themselves using their own identity, rather than using a shared service\n * principal or managed identity. Under the hood, Workload Identity authentication uses the concept of Service Account\n * Credentials (SACs), which are automatically created by Azure and stored securely in the VM. By using Workload\n * Identity authentication, you can avoid the need to manage and rotate service principals or managed identities for\n * each application on each VM. Additionally, because SACs are created automatically and managed by Azure, you don't\n * need to worry about storing and securing sensitive credentials themselves.\n * The WorkloadIdentityCredential supports Microsoft Entra Workload ID authentication on Azure Kubernetes and acquires\n * a token using the SACs available in the Azure Kubernetes environment.\n * Refer to <a href=\"https://learn.microsoft.com/azure/aks/workload-identity-overview\">Microsoft Entra\n * Workload ID</a> for more information.\n */\nexport class WorkloadIdentityCredential implements TokenCredential {\n  private client: ClientAssertionCredential | undefined;\n  private azureFederatedTokenFileContent: string | undefined = undefined;\n  private cacheDate: number | undefined = undefined;\n  private federatedTokenFilePath: string | undefined;\n\n  /**\n   * WorkloadIdentityCredential supports Microsoft Entra Workload ID on Kubernetes.\n   *\n   * @param options - The identity client options to use for authentication.\n   */\n  constructor(options?: WorkloadIdentityCredentialOptions) {\n    // Logging environment variables for error details\n    const assignedEnv = processEnvVars(SupportedWorkloadEnvironmentVariables).assigned.join(\", \");\n    logger.info(`Found the following environment variables: ${assignedEnv}`);\n\n    const workloadIdentityCredentialOptions = options ?? {};\n    const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;\n    const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;\n    this.federatedTokenFilePath =\n      workloadIdentityCredentialOptions.tokenFilePath || process.env.AZURE_FEDERATED_TOKEN_FILE;\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    if (!clientId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. clientId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_CLIENT_ID\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n      );\n    }\n\n    if (!tenantId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. tenantId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_TENANT_ID\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n      );\n    }\n\n    if (!this.federatedTokenFilePath) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. federatedTokenFilePath is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_FEDERATED_TOKEN_FILE\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n      );\n    }\n\n    logger.info(\n      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`,\n    );\n    this.client = new ClientAssertionCredential(\n      tenantId,\n      clientId,\n      this.readFileContents.bind(this),\n      options,\n    );\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options?: GetTokenOptions,\n  ): Promise<AccessToken> {\n    if (!this.client) {\n      const errorMessage = `${credentialName}: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters. \n      In DefaultAzureCredential and ManagedIdentityCredential, these can be provided as environment variables - \n      \"AZURE_TENANT_ID\",\n      \"AZURE_CLIENT_ID\",\n      \"AZURE_FEDERATED_TOKEN_FILE\". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`;\n      logger.info(errorMessage);\n      throw new CredentialUnavailableError(errorMessage);\n    }\n    logger.info(\"Invoking getToken() of Client Assertion Credential\");\n    return this.client.getToken(scopes, options);\n  }\n\n  private async readFileContents(): Promise<string> {\n    // Cached assertions expire after 5 minutes\n    if (this.cacheDate !== undefined && Date.now() - this.cacheDate >= 1000 * 60 * 5) {\n      this.azureFederatedTokenFileContent = undefined;\n    }\n    if (!this.federatedTokenFilePath) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. Invalid file path provided ${this.federatedTokenFilePath}.`,\n      );\n    }\n    if (!this.azureFederatedTokenFileContent) {\n      const file = await readFile(this.federatedTokenFilePath, \"utf8\");\n      const value = file.trim();\n      if (!value) {\n        throw new CredentialUnavailableError(\n          `${credentialName}: is unavailable. No content on the file ${this.federatedTokenFilePath}.`,\n        );\n      } else {\n        this.azureFederatedTokenFileContent = value;\n        this.cacheDate = Date.now();\n      }\n    }\n    return this.azureFederatedTokenFileContent;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,qBAAiD;AAEjD,uCAA0C;AAC1C,oBAA2C;AAE3C,2BAA8B;AAC9B,sBAAyB;AAEzB,MAAM,iBAAiB;AAQhB,MAAM,wCAAwC;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AACF;AACA,MAAM,aAAS,iCAAiB,cAAc;AAevC,MAAM,2BAAsD;AAAA,EACzD;AAAA,EACA,iCAAqD;AAAA,EACrD,YAAgC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,YAAY,SAA6C;AAEvD,UAAM,kBAAc,+BAAe,qCAAqC,EAAE,SAAS,KAAK,IAAI;AAC5F,WAAO,KAAK,8CAA8C,WAAW,EAAE;AAEvE,UAAM,oCAAoC,WAAW,CAAC;AACtD,UAAM,WAAW,kCAAkC,YAAY,QAAQ,IAAI;AAC3E,UAAM,WAAW,kCAAkC,YAAY,QAAQ,IAAI;AAC3E,SAAK,yBACH,kCAAkC,iBAAiB,QAAQ,IAAI;AACjE,QAAI,UAAU;AACZ,8CAAc,QAAQ,QAAQ;AAAA,IAChC;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA;AAAA,MAEnB;AAAA,IACF;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA;AAAA,MAEnB;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,wBAAwB;AAChC,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA;AAAA,MAEnB;AAAA,IACF;AAEA,WAAO;AAAA,MACL,sDAAsD,QAAQ,eAAe,kCAAkC,QAAQ;AAAA,IACzH;AACA,SAAK,SAAS,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,KAAK,IAAI;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,SACX,QACA,SACsB;AACtB,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,eAAe,GAAG,cAAc;AAAA;AAAA;AAAA;AAAA;AAKtC,aAAO,KAAK,YAAY;AACxB,YAAM,IAAI,yCAA2B,YAAY;AAAA,IACnD;AACA,WAAO,KAAK,oDAAoD;AAChE,WAAO,KAAK,OAAO,SAAS,QAAQ,OAAO;AAAA,EAC7C;AAAA,EAEA,MAAc,mBAAoC;AAEhD,QAAI,KAAK,cAAc,UAAa,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,KAAK,GAAG;AAChF,WAAK,iCAAiC;AAAA,IACxC;AACA,QAAI,CAAC,KAAK,wBAAwB;AAChC,YAAM,IAAI;AAAA,QACR,GAAG,cAAc,gDAAgD,KAAK,sBAAsB;AAAA,MAC9F;AAAA,IACF;AACA,QAAI,CAAC,KAAK,gCAAgC;AACxC,YAAM,OAAO,UAAM,0BAAS,KAAK,wBAAwB,MAAM;AAC/D,YAAM,QAAQ,KAAK,KAAK;AACxB,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,GAAG,cAAc,4CAA4C,KAAK,sBAAsB;AAAA,QAC1F;AAAA,MACF,OAAO;AACL,aAAK,iCAAiC;AACtC,aAAK,YAAY,KAAK,IAAI;AAAA,MAC5B;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AACF;",
+  "names": []
+}

package/dist/commonjs/credentials/workloadIdentityCredentialOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workloadIdentityCredentialOptions.d.ts","sourceRoot":"","sources":["../../../src/credentials/workloadIdentityCredentialOptions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAEhG;;GAEG;AACH,MAAM,WAAW,iCACf,SAAQ,iCAAiC,EACvC,0BAA0B;IAC5B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"workloadIdentityCredentialOptions.d.ts","sourceRoot":"","sources":["../../../src/credentials/workloadIdentityCredentialOptions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAEhG;;GAEG;AACH,MAAM,WAAW,iCACf,SAAQ,iCAAiC,EAAE,0BAA0B;IACrE;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}

package/dist/commonjs/credentials/workloadIdentityCredentialOptions.js

@@ -1,5 +1,16 @@
-"use strict";
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=workloadIdentityCredentialOptions.js.map
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var workloadIdentityCredentialOptions_exports = {};
+module.exports = __toCommonJS(workloadIdentityCredentialOptions_exports);
+//# sourceMappingURL=workloadIdentityCredentialOptions.js.map

package/dist/commonjs/credentials/workloadIdentityCredentialOptions.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"workloadIdentityCredentialOptions.js","sourceRoot":"","sources":["../../../src/credentials/workloadIdentityCredentialOptions.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AuthorityValidationOptions } from \"./authorityValidationOptions.js\";\nimport type { MultiTenantTokenCredentialOptions } from \"./multiTenantTokenCredentialOptions.js\";\n\n/**\n * Options for the {@link WorkloadIdentityCredential}\n */\nexport interface WorkloadIdentityCredentialOptions\n  extends MultiTenantTokenCredentialOptions,\n    AuthorityValidationOptions {\n  /**\n   * ID of the application's Microsoft Entra tenant. Also called its directory ID.\n   */\n  tenantId?: string;\n  /**\n   * The client ID of a Microsoft Entra app registration.\n   */\n  clientId?: string;\n  /**\n   * The path to a file containing a Kubernetes service account token that authenticates the identity.\n   */\n  tokenFilePath?: string;\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/workloadIdentityCredentialOptions.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AuthorityValidationOptions } from \"./authorityValidationOptions.js\";\nimport type { MultiTenantTokenCredentialOptions } from \"./multiTenantTokenCredentialOptions.js\";\n\n/**\n * Options for the {@link WorkloadIdentityCredential}\n */\nexport interface WorkloadIdentityCredentialOptions\n  extends MultiTenantTokenCredentialOptions, AuthorityValidationOptions {\n  /**\n   * ID of the application's Microsoft Entra tenant. Also called its directory ID.\n   */\n  tenantId?: string;\n  /**\n   * The client ID of a Microsoft Entra app registration.\n   */\n  clientId?: string;\n  /**\n   * The path to a file containing a Kubernetes service account token that authenticates the identity.\n   */\n  tokenFilePath?: string;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;AAAA;AAAA;",
+  "names": []
+}

package/dist/commonjs/errors.js

@@ -1,146 +1,145 @@
-"use strict";
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthenticationRequiredError = exports.AggregateAuthenticationError = exports.AggregateAuthenticationErrorName = exports.AuthenticationError = exports.AuthenticationErrorName = exports.CredentialUnavailableError = exports.CredentialUnavailableErrorName = void 0;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var errors_exports = {};
+__export(errors_exports, {
+  AggregateAuthenticationError: () => AggregateAuthenticationError,
+  AggregateAuthenticationErrorName: () => AggregateAuthenticationErrorName,
+  AuthenticationError: () => AuthenticationError,
+  AuthenticationErrorName: () => AuthenticationErrorName,
+  AuthenticationRequiredError: () => AuthenticationRequiredError,
+  CredentialUnavailableError: () => CredentialUnavailableError,
+  CredentialUnavailableErrorName: () => CredentialUnavailableErrorName
+});
+module.exports = __toCommonJS(errors_exports);
 function isErrorResponse(errorResponse) {
-    return (errorResponse &&
-        typeof errorResponse.error === "string" &&
-        typeof errorResponse.error_description === "string");
+  return errorResponse && typeof errorResponse.error === "string" && typeof errorResponse.error_description === "string";
 }
-/**
- * The Error.name value of an CredentialUnavailable
- */
-exports.CredentialUnavailableErrorName = "CredentialUnavailableError";
-/**
- * This signifies that the credential that was tried in a chained credential
- * was not available to be used as the credential. Rather than treating this as
- * an error that should halt the chain, it's caught and the chain continues
- */
+const CredentialUnavailableErrorName = "CredentialUnavailableError";
 class CredentialUnavailableError extends Error {
-    constructor(message, options) {
-        super(message, options);
-        this.name = exports.CredentialUnavailableErrorName;
-    }
+  constructor(message, options) {
+    super(message, options);
+    this.name = CredentialUnavailableErrorName;
+  }
 }
-exports.CredentialUnavailableError = CredentialUnavailableError;
-/**
- * The Error.name value of an AuthenticationError
- */
-exports.AuthenticationErrorName = "AuthenticationError";
-/**
- * Provides details about a failure to authenticate with Azure Active
- * Directory.  The `errorResponse` field contains more details about
- * the specific failure.
- */
+const AuthenticationErrorName = "AuthenticationError";
 class AuthenticationError extends Error {
-    /**
-     * The HTTP status code returned from the authentication request.
-     */
-    statusCode;
-    /**
-     * The error response details.
-     */
-    errorResponse;
-    constructor(statusCode, errorBody, options) {
-        let errorResponse = {
-            error: "unknown",
-            errorDescription: "An unknown error occurred and no additional details are available.",
-        };
-        if (isErrorResponse(errorBody)) {
-            errorResponse = convertOAuthErrorResponseToErrorResponse(errorBody);
-        }
-        else if (typeof errorBody === "string") {
-            try {
-                // Most error responses will contain JSON-formatted error details
-                // in the response body
-                const oauthErrorResponse = JSON.parse(errorBody);
-                errorResponse = convertOAuthErrorResponseToErrorResponse(oauthErrorResponse);
-            }
-            catch (e) {
-                if (statusCode === 400) {
-                    errorResponse = {
-                        error: "invalid_request",
-                        errorDescription: `The service indicated that the request was invalid.\n\n${errorBody}`,
-                    };
-                }
-                else {
-                    errorResponse = {
-                        error: "unknown_error",
-                        errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}`,
-                    };
-                }
-            }
-        }
-        else {
-            errorResponse = {
-                error: "unknown_error",
-                errorDescription: "An unknown error occurred and no additional details are available.",
-            };
+  /**
+   * The HTTP status code returned from the authentication request.
+   */
+  statusCode;
+  /**
+   * The error response details.
+   */
+  errorResponse;
+  constructor(statusCode, errorBody, options) {
+    let errorResponse = {
+      error: "unknown",
+      errorDescription: "An unknown error occurred and no additional details are available."
+    };
+    if (isErrorResponse(errorBody)) {
+      errorResponse = convertOAuthErrorResponseToErrorResponse(errorBody);
+    } else if (typeof errorBody === "string") {
+      try {
+        const oauthErrorResponse = JSON.parse(errorBody);
+        errorResponse = convertOAuthErrorResponseToErrorResponse(oauthErrorResponse);
+      } catch (e) {
+        if (statusCode === 400) {
+          errorResponse = {
+            error: "invalid_request",
+            errorDescription: `The service indicated that the request was invalid.
+
+${errorBody}`
+          };
+        } else {
+          errorResponse = {
+            error: "unknown_error",
+            errorDescription: `An unknown error has occurred. Response body:
+
+${errorBody}`
+          };
         }
-        super(`${errorResponse.error} Status code: ${statusCode}\nMore details:\n${errorResponse.errorDescription},`, options);
-        this.statusCode = statusCode;
-        this.errorResponse = errorResponse;
-        // Ensure that this type reports the correct name
-        this.name = exports.AuthenticationErrorName;
+      }
+    } else {
+      errorResponse = {
+        error: "unknown_error",
+        errorDescription: "An unknown error occurred and no additional details are available."
+      };
     }
+    super(
+      `${errorResponse.error} Status code: ${statusCode}
+More details:
+${errorResponse.errorDescription},`,
+      options
+    );
+    this.statusCode = statusCode;
+    this.errorResponse = errorResponse;
+    this.name = AuthenticationErrorName;
+  }
 }
-exports.AuthenticationError = AuthenticationError;
-/**
- * The Error.name value of an AggregateAuthenticationError
- */
-exports.AggregateAuthenticationErrorName = "AggregateAuthenticationError";
-/**
- * Provides an `errors` array containing {@link AuthenticationError} instance
- * for authentication failures from credentials in a {@link ChainedTokenCredential}.
- */
+const AggregateAuthenticationErrorName = "AggregateAuthenticationError";
 class AggregateAuthenticationError extends Error {
-    /**
-     * The array of error objects that were thrown while trying to authenticate
-     * with the credentials in a {@link ChainedTokenCredential}.
-     */
-    errors;
-    constructor(errors, errorMessage) {
-        const errorDetail = errors.join("\n");
-        super(`${errorMessage}\n${errorDetail}`);
-        this.errors = errors;
-        // Ensure that this type reports the correct name
-        this.name = exports.AggregateAuthenticationErrorName;
-    }
+  /**
+   * The array of error objects that were thrown while trying to authenticate
+   * with the credentials in a {@link ChainedTokenCredential}.
+   */
+  errors;
+  constructor(errors, errorMessage) {
+    const errorDetail = errors.join("\n");
+    super(`${errorMessage}
+${errorDetail}`);
+    this.errors = errors;
+    this.name = AggregateAuthenticationErrorName;
+  }
 }
-exports.AggregateAuthenticationError = AggregateAuthenticationError;
 function convertOAuthErrorResponseToErrorResponse(errorBody) {
-    return {
-        error: errorBody.error,
-        errorDescription: errorBody.error_description,
-        correlationId: errorBody.correlation_id,
-        errorCodes: errorBody.error_codes,
-        timestamp: errorBody.timestamp,
-        traceId: errorBody.trace_id,
-    };
+  return {
+    error: errorBody.error,
+    errorDescription: errorBody.error_description,
+    correlationId: errorBody.correlation_id,
+    errorCodes: errorBody.error_codes,
+    timestamp: errorBody.timestamp,
+    traceId: errorBody.trace_id
+  };
 }
-/**
- * Error used to enforce authentication after trying to retrieve a token silently.
- */
 class AuthenticationRequiredError extends Error {
-    /**
-     * The list of scopes for which the token will have access.
-     */
-    scopes;
-    /**
-     * The options passed to the getToken request.
-     */
-    getTokenOptions;
-    constructor(
-    /**
-     * Optional parameters. A message can be specified. The {@link GetTokenOptions} of the request can also be specified to more easily associate the error with the received parameters.
-     */
-    options) {
-        super(options.message, options.cause ? { cause: options.cause } : undefined);
-        this.scopes = options.scopes;
-        this.getTokenOptions = options.getTokenOptions;
-        this.name = "AuthenticationRequiredError";
-    }
+  /**
+   * The list of scopes for which the token will have access.
+   */
+  scopes;
+  /**
+   * The options passed to the getToken request.
+   */
+  getTokenOptions;
+  constructor(options) {
+    super(options.message, options.cause ? { cause: options.cause } : void 0);
+    this.scopes = options.scopes;
+    this.getTokenOptions = options.getTokenOptions;
+    this.name = "AuthenticationRequiredError";
+  }
 }
-exports.AuthenticationRequiredError = AuthenticationRequiredError;
-//# sourceMappingURL=errors.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AggregateAuthenticationError,
+  AggregateAuthenticationErrorName,
+  AuthenticationError,
+  AuthenticationErrorName,
+  AuthenticationRequiredError,
+  CredentialUnavailableError,
+  CredentialUnavailableErrorName
+});
+//# sourceMappingURL=errors.js.map