@azure/identity 4.13.2 → 4.13.3

package/dist/commonjs/msal/nodeFlows/msalClient.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/msal/nodeFlows/msalClient.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport * as msal from \"@azure/msal-node\";\n\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport type { AuthenticationRecord, CertificateParts } from \"../types.js\";\nimport type { CredentialLogger } from \"../../util/logging.js\";\nimport { credentialLogger, formatSuccess } from \"../../util/logging.js\";\nimport type { PluginConfiguration } from \"./msalPlugins.js\";\nimport { msalPlugins } from \"./msalPlugins.js\";\nimport {\n  defaultLoggerCallback,\n  ensureValidMsalToken,\n  getAuthority,\n  getAuthorityHost,\n  getKnownAuthorities,\n  getMSALLogLevel,\n  handleMsalError,\n  msalToPublic,\n  publicToMsal,\n} from \"../utils.js\";\n\nimport { AuthenticationRequiredError } from \"../../errors.js\";\nimport type { BrokerOptions } from \"./brokerOptions.js\";\nimport type { DeviceCodePromptCallback } from \"../../credentials/deviceCodeCredentialOptions.js\";\nimport { IdentityClient } from \"../../client/identityClient.js\";\nimport type { InteractiveBrowserCredentialNodeOptions } from \"../../credentials/interactiveBrowserCredentialOptions.js\";\nimport type { TokenCachePersistenceOptions } from \"./tokenCachePersistenceOptions.js\";\nimport { calculateRegionalAuthority } from \"../../regionalAuthority.js\";\nimport { getLogLevel } from \"@azure/logger\";\nimport { resolveTenantId } from \"../../util/tenantIdUtils.js\";\n\n/**\n * The default logger used if no logger was passed in by the credential.\n */\nconst msalLogger = credentialLogger(\"MsalClient\");\n\n/**\n * Represents the options for acquiring a token using flows that support silent authentication.\n */\nexport interface GetTokenWithSilentAuthOptions extends GetTokenOptions {\n  /**\n   * Disables automatic authentication. If set to true, the method will throw an error if the user needs to authenticate.\n   *\n   * @remarks\n   *\n   * This option will be set to `false` when the user calls `authenticate` directly on a credential that supports it.\n   */\n  disableAutomaticAuthentication?: boolean;\n}\n\n/**\n * Represents the options for acquiring a token interactively.\n */\nexport interface GetTokenInteractiveOptions extends GetTokenWithSilentAuthOptions {\n  /**\n   * Window handle for parent window, required for WAM authentication.\n   */\n  parentWindowHandle?: Buffer;\n  /**\n   * Shared configuration options for browser customization\n   */\n  browserCustomizationOptions?: InteractiveBrowserCredentialNodeOptions[\"browserCustomizationOptions\"];\n  /**\n   * loginHint allows a user name to be pre-selected for interactive logins.\n   * Setting this option skips the account selection prompt and immediately attempts to login with the specified account.\n   */\n  loginHint?: string;\n}\n\n/**\n * Represents a client for interacting with the Microsoft Authentication Library (MSAL).\n */\nexport interface MsalClient {\n  /**\n   *\n   * Retrieves an access token by using the on-behalf-of flow and a client assertion callback of the calling service.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param userAssertionToken - The access token that was sent to the middle-tier API. This token must have an audience of the app making this OBO request.\n   * @param clientCredentials - The client secret OR client certificate OR client `getAssertion` callback.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenOnBehalfOf(\n    scopes: string[],\n    userAssertionToken: string,\n    clientCredentials: string | CertificateParts | (() => Promise<string>),\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves an access token by using an interactive prompt (InteractiveBrowserCredential).\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByInteractiveRequest(\n    scopes: string[],\n    options: GetTokenInteractiveOptions,\n  ): Promise<AccessToken>;\n  /**\n   * Retrieves an access token by using a user's username and password.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param username - The username provided by the developer.\n   * @param password - The user's password provided by the developer.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByUsernamePassword(\n    scopes: string[],\n    username: string,\n    password: string,\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n  /**\n   * Retrieves an access token by prompting the user to authenticate using a device code.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param userPromptCallback - The callback function that allows developers to customize the prompt message.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByDeviceCode(\n    scopes: string[],\n    userPromptCallback: DeviceCodePromptCallback,\n    options?: GetTokenWithSilentAuthOptions,\n  ): Promise<AccessToken>;\n  /**\n   * Retrieves an access token by using a client certificate.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param certificate - The client certificate used for authentication.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByClientCertificate(\n    scopes: string[],\n    certificate: CertificateParts,\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves an access token by using a client assertion.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param clientAssertion - The client `getAssertion` callback used for authentication.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByClientAssertion(\n    scopes: string[],\n    clientAssertion: () => Promise<string>,\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves an access token by using a client secret.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param clientSecret - The client secret of the application. This is a credential that the application can use to authenticate itself.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByClientSecret(\n    scopes: string[],\n    clientSecret: string,\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves an access token by using an authorization code flow.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param authorizationCode - An authorization code that was received from following the\n                              authorization code flow.  This authorization code must not\n                              have already been used to obtain an access token.\n   * @param redirectUri - The redirect URI that was used to request the authorization code.\n                        Must be the same URI that is configured for the App Registration.\n   * @param clientSecret - An optional client secret that was generated for the App Registration.\n   * @param options - Additional options that may be provided to the method.\n   */\n  getTokenByAuthorizationCode(\n    scopes: string[],\n    redirectUri: string,\n    authorizationCode: string,\n    clientSecret?: string,\n    options?: GetTokenWithSilentAuthOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves the last authenticated account. This method expects an authentication record to have been previously loaded.\n   *\n   * An authentication record could be loaded by calling the `getToken` method, or by providing an `authenticationRecord` when creating a credential.\n   */\n  getActiveAccount(): AuthenticationRecord | undefined;\n\n  /**\n   * Retrieves an access token using brokered authentication.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param useDefaultBrokerAccount - Whether to use the default broker account for authentication.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getBrokeredToken(\n    scopes: string[],\n    useDefaultBrokerAccount: boolean,\n    options?: GetTokenInteractiveOptions,\n  ): Promise<AccessToken>;\n}\n\n/**\n * Represents the options for configuring the MsalClient.\n */\nexport interface MsalClientOptions {\n  /**\n   * Parameters that enable WAM broker authentication in the InteractiveBrowserCredential.\n   */\n  brokerOptions?: BrokerOptions;\n\n  /**\n   * Parameters that enable token cache persistence in the Identity credentials.\n   */\n  tokenCachePersistenceOptions?: TokenCachePersistenceOptions;\n\n  /**\n   * Indicates if this is being used by VSCode credential.\n   */\n  isVSCodeCredential?: boolean;\n\n  /**\n   * A custom authority host.\n   */\n  authorityHost?: IdentityClient[\"tokenCredentialOptions\"][\"authorityHost\"];\n\n  /**\n   * Allows users to configure settings for logging policy options, allow logging account information and personally identifiable information for customer support.\n   */\n  loggingOptions?: IdentityClient[\"tokenCredentialOptions\"][\"loggingOptions\"];\n\n  /**\n   * The token credential options for the MsalClient.\n   */\n  tokenCredentialOptions?: IdentityClient[\"tokenCredentialOptions\"];\n\n  /**\n   * Determines whether instance discovery is disabled.\n   */\n  disableInstanceDiscovery?: boolean;\n\n  /**\n   * The logger for the MsalClient.\n   */\n  logger?: CredentialLogger;\n\n  /**\n   * The authentication record for the MsalClient.\n   */\n  authenticationRecord?: AuthenticationRecord;\n}\n\n/**\n * Generates the configuration for MSAL (Microsoft Authentication Library).\n *\n * @param clientId - The client ID of the application.\n * @param  tenantId - The tenant ID of the Azure Active Directory.\n * @param  msalClientOptions - Optional. Additional options for creating the MSAL client.\n * @returns  The MSAL configuration object.\n */\nexport function generateMsalConfiguration(\n  clientId: string,\n  tenantId: string,\n  msalClientOptions: MsalClientOptions = {},\n): msal.Configuration {\n  const resolvedTenant = resolveTenantId(\n    msalClientOptions.logger ?? msalLogger,\n    tenantId,\n    clientId,\n  );\n\n  // TODO: move and reuse getIdentityClientAuthorityHost\n  const authority = getAuthority(resolvedTenant, getAuthorityHost(msalClientOptions));\n\n  const httpClient = new IdentityClient({\n    ...msalClientOptions.tokenCredentialOptions,\n    authorityHost: authority,\n    loggingOptions: msalClientOptions.loggingOptions,\n  });\n\n  const msalConfig: msal.Configuration = {\n    auth: {\n      clientId,\n      authority,\n      knownAuthorities: getKnownAuthorities(\n        resolvedTenant,\n        authority,\n        msalClientOptions.disableInstanceDiscovery,\n      ),\n    },\n    system: {\n      networkClient: httpClient,\n      loggerOptions: {\n        loggerCallback: defaultLoggerCallback(msalClientOptions.logger ?? msalLogger),\n        logLevel: getMSALLogLevel(getLogLevel()),\n        piiLoggingEnabled: msalClientOptions.loggingOptions?.enableUnsafeSupportLogging,\n      },\n    },\n  };\n  return msalConfig;\n}\n\n/**\n * Represents the state necessary for the MSAL (Microsoft Authentication Library) client to operate.\n * This includes the MSAL configuration, cached account information, Azure region, and a flag to disable automatic authentication.\n */\ninterface MsalClientState {\n  /** The configuration for the MSAL client. */\n  msalConfig: msal.Configuration;\n\n  /** The cached account information, or null if no account information is cached. */\n  cachedAccount: msal.AccountInfo | null;\n\n  /** Configured plugins */\n  pluginConfiguration: PluginConfiguration;\n\n  /** Claims received from challenges, cached for the next request */\n  cachedClaims?: string;\n\n  /** The logger instance */\n  logger: CredentialLogger;\n}\n\n/**\n * Creates an instance of the MSAL (Microsoft Authentication Library) client.\n *\n * @param clientId - The client ID of the application.\n * @param tenantId - The tenant ID of the Azure Active Directory.\n * @param createMsalClientOptions - Optional. Additional options for creating the MSAL client.\n * @returns An instance of the MSAL client.\n *\n * @public\n */\nexport function createMsalClient(\n  clientId: string,\n  tenantId: string,\n  createMsalClientOptions: MsalClientOptions = {},\n): MsalClient {\n  const state: MsalClientState = {\n    msalConfig: generateMsalConfiguration(clientId, tenantId, createMsalClientOptions),\n    cachedAccount: createMsalClientOptions.authenticationRecord\n      ? publicToMsal(createMsalClientOptions.authenticationRecord)\n      : null,\n    pluginConfiguration: msalPlugins.generatePluginConfiguration(createMsalClientOptions),\n    logger: createMsalClientOptions.logger ?? msalLogger,\n  };\n\n  const publicApps: Map<string, msal.PublicClientApplication> = new Map();\n  async function getPublicApp(\n    options: GetTokenOptions = {},\n  ): Promise<msal.PublicClientApplication> {\n    const appKey = options.enableCae ? \"CAE\" : \"default\";\n\n    let publicClientApp = publicApps.get(appKey);\n    if (publicClientApp) {\n      state.logger.getToken.info(\"Existing PublicClientApplication found in cache, returning it.\");\n      return publicClientApp;\n    }\n\n    // Initialize a new app and cache it\n    state.logger.getToken.info(\n      `Creating new PublicClientApplication with CAE ${options.enableCae ? \"enabled\" : \"disabled\"}.`,\n    );\n\n    const cachePlugin = options.enableCae\n      ? state.pluginConfiguration.cache.cachePluginCae\n      : state.pluginConfiguration.cache.cachePlugin;\n\n    state.msalConfig.auth.clientCapabilities = options.enableCae ? [\"cp1\"] : undefined;\n\n    publicClientApp = new msal.PublicClientApplication({\n      ...state.msalConfig,\n      broker: { nativeBrokerPlugin: state.pluginConfiguration.broker.nativeBrokerPlugin },\n      cache: { cachePlugin: await cachePlugin },\n    });\n\n    publicApps.set(appKey, publicClientApp);\n\n    return publicClientApp;\n  }\n\n  const confidentialApps: Map<string, msal.ConfidentialClientApplication> = new Map();\n  async function getConfidentialApp(\n    options: GetTokenOptions = {},\n  ): Promise<msal.ConfidentialClientApplication> {\n    const appKey = options.enableCae ? \"CAE\" : \"default\";\n\n    let confidentialClientApp = confidentialApps.get(appKey);\n    if (confidentialClientApp) {\n      state.logger.getToken.info(\n        \"Existing ConfidentialClientApplication found in cache, returning it.\",\n      );\n      return confidentialClientApp;\n    }\n\n    // Initialize a new app and cache it\n    state.logger.getToken.info(\n      `Creating new ConfidentialClientApplication with CAE ${\n        options.enableCae ? \"enabled\" : \"disabled\"\n      }.`,\n    );\n\n    const cachePlugin = options.enableCae\n      ? state.pluginConfiguration.cache.cachePluginCae\n      : state.pluginConfiguration.cache.cachePlugin;\n\n    state.msalConfig.auth.clientCapabilities = options.enableCae ? [\"cp1\"] : undefined;\n\n    confidentialClientApp = new msal.ConfidentialClientApplication({\n      ...state.msalConfig,\n      broker: { nativeBrokerPlugin: state.pluginConfiguration.broker.nativeBrokerPlugin },\n      cache: { cachePlugin: await cachePlugin },\n    });\n\n    confidentialApps.set(appKey, confidentialClientApp);\n\n    return confidentialClientApp;\n  }\n\n  async function getTokenSilent(\n    app: msal.ConfidentialClientApplication | msal.PublicClientApplication,\n    scopes: string[],\n    options: GetTokenOptions = {},\n  ): Promise<msal.AuthenticationResult> {\n    if (state.cachedAccount === null) {\n      state.logger.getToken.info(\"No cached account found in local state.\");\n      throw new AuthenticationRequiredError({ scopes });\n    }\n\n    // Keep track and reuse the claims we received across challenges\n    if (options.claims) {\n      state.cachedClaims = options.claims;\n    }\n\n    const silentRequest: msal.SilentFlowRequest = {\n      account: state.cachedAccount,\n      scopes,\n      claims: state.cachedClaims,\n    };\n\n    if (state.pluginConfiguration.broker.isEnabled) {\n      silentRequest.extraQueryParameters ||= {};\n      if (state.pluginConfiguration.broker.enableMsaPassthrough) {\n        silentRequest.extraQueryParameters[\"msal_request_type\"] = \"consumer_passthrough\";\n      }\n    }\n\n    if (options.proofOfPossessionOptions) {\n      silentRequest.shrNonce = options.proofOfPossessionOptions.nonce;\n      silentRequest.authenticationScheme = \"pop\";\n      silentRequest.resourceRequestMethod = options.proofOfPossessionOptions.resourceRequestMethod;\n      silentRequest.resourceRequestUri = options.proofOfPossessionOptions.resourceRequestUrl;\n    }\n    state.logger.getToken.info(\"Attempting to acquire token silently\");\n    try {\n      return await app.acquireTokenSilent(silentRequest);\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  /**\n   * Builds an authority URL for the given request. The authority may be different than the one used when creating the MSAL client\n   * if the user is creating cross-tenant requests\n   */\n  function calculateRequestAuthority(options?: GetTokenOptions): string | undefined {\n    if (options?.tenantId) {\n      return getAuthority(options.tenantId, getAuthorityHost(createMsalClientOptions));\n    }\n    return state.msalConfig.auth.authority;\n  }\n\n  /**\n   * Performs silent authentication using MSAL to acquire an access token.\n   * If silent authentication fails, falls back to interactive authentication.\n   *\n   * @param msalApp - The MSAL application instance.\n   * @param scopes - The scopes for which to acquire the access token.\n   * @param options - The options for acquiring the access token.\n   * @param onAuthenticationRequired - A callback function to handle interactive authentication when silent authentication fails.\n   * @returns A promise that resolves to an AccessToken object containing the access token and its expiration timestamp.\n   */\n  async function withSilentAuthentication(\n    msalApp: msal.ConfidentialClientApplication | msal.PublicClientApplication,\n    scopes: Array<string>,\n    options: GetTokenWithSilentAuthOptions,\n    onAuthenticationRequired: () => Promise<msal.AuthenticationResult | null>,\n  ): Promise<AccessToken> {\n    let response: msal.AuthenticationResult | null = null;\n    try {\n      response = await getTokenSilent(msalApp, scopes, options);\n    } catch (e: any) {\n      if (e.name !== \"AuthenticationRequiredError\") {\n        throw e;\n      }\n      if (options.disableAutomaticAuthentication) {\n        throw new AuthenticationRequiredError({\n          scopes,\n          getTokenOptions: options,\n          message:\n            \"Automatic authentication has been disabled. You may call the authentication() method.\",\n        });\n      }\n    }\n\n    // Silent authentication failed\n    if (response === null) {\n      try {\n        response = await onAuthenticationRequired();\n      } catch (err: any) {\n        throw handleMsalError(scopes, err, options);\n      }\n    }\n\n    // At this point we should have a token, process it\n    ensureValidMsalToken(scopes, response, options);\n    state.cachedAccount = response?.account ?? null;\n\n    state.logger.getToken.info(formatSuccess(scopes));\n    return {\n      token: response.accessToken,\n      expiresOnTimestamp: response.expiresOn.getTime(),\n      refreshAfterTimestamp: response.refreshOn?.getTime(),\n      tokenType: response.tokenType,\n    } as AccessToken;\n  }\n\n  async function getTokenByClientSecret(\n    scopes: string[],\n    clientSecret: string,\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using client secret`);\n\n    state.msalConfig.auth.clientSecret = clientSecret;\n\n    const msalApp = await getConfidentialApp(options);\n\n    try {\n      const response = await msalApp.acquireTokenByClientCredential({\n        scopes,\n        authority: calculateRequestAuthority(options),\n        azureRegion: calculateRegionalAuthority(),\n        claims: options?.claims,\n      });\n      ensureValidMsalToken(scopes, response, options);\n      state.logger.getToken.info(formatSuccess(scopes));\n      return {\n        token: response.accessToken,\n        expiresOnTimestamp: response.expiresOn.getTime(),\n        refreshAfterTimestamp: response.refreshOn?.getTime(),\n        tokenType: response.tokenType,\n      } as AccessToken;\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  async function getTokenByClientAssertion(\n    scopes: string[],\n    clientAssertion: () => Promise<string>,\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using client assertion`);\n\n    state.msalConfig.auth.clientAssertion = clientAssertion;\n\n    const msalApp = await getConfidentialApp(options);\n\n    try {\n      const response = await msalApp.acquireTokenByClientCredential({\n        scopes,\n        authority: calculateRequestAuthority(options),\n        azureRegion: calculateRegionalAuthority(),\n        claims: options?.claims,\n        clientAssertion,\n      });\n      ensureValidMsalToken(scopes, response, options);\n\n      state.logger.getToken.info(formatSuccess(scopes));\n      return {\n        token: response.accessToken,\n        expiresOnTimestamp: response.expiresOn.getTime(),\n        refreshAfterTimestamp: response.refreshOn?.getTime(),\n        tokenType: response.tokenType,\n      } as AccessToken;\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  async function getTokenByClientCertificate(\n    scopes: string[],\n    certificate: CertificateParts,\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using client certificate`);\n\n    state.msalConfig.auth.clientCertificate = certificate;\n\n    const msalApp = await getConfidentialApp(options);\n    try {\n      const response = await msalApp.acquireTokenByClientCredential({\n        scopes,\n        authority: calculateRequestAuthority(options),\n        azureRegion: calculateRegionalAuthority(),\n        claims: options?.claims,\n      });\n      ensureValidMsalToken(scopes, response, options);\n\n      state.logger.getToken.info(formatSuccess(scopes));\n      return {\n        token: response.accessToken,\n        expiresOnTimestamp: response.expiresOn.getTime(),\n        refreshAfterTimestamp: response.refreshOn?.getTime(),\n        tokenType: response.tokenType,\n      } as AccessToken;\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  async function getTokenByDeviceCode(\n    scopes: string[],\n    deviceCodeCallback: DeviceCodePromptCallback,\n    options: GetTokenWithSilentAuthOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using device code`);\n\n    const msalApp = await getPublicApp(options);\n\n    return withSilentAuthentication(msalApp, scopes, options, () => {\n      const requestOptions: msal.DeviceCodeRequest = {\n        scopes,\n        cancel: options?.abortSignal?.aborted ?? false,\n        deviceCodeCallback,\n        authority: calculateRequestAuthority(options),\n        claims: options?.claims,\n      };\n      const deviceCodeRequest = msalApp.acquireTokenByDeviceCode(requestOptions);\n      if (options.abortSignal) {\n        options.abortSignal.addEventListener(\"abort\", () => {\n          requestOptions.cancel = true;\n        });\n      }\n\n      return deviceCodeRequest;\n    });\n  }\n\n  async function getTokenByUsernamePassword(\n    scopes: string[],\n    username: string,\n    password: string,\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using username and password`);\n\n    const msalApp = await getPublicApp(options);\n\n    return withSilentAuthentication(msalApp, scopes, options, () => {\n      const requestOptions: msal.UsernamePasswordRequest = {\n        scopes,\n        username,\n        password,\n        authority: calculateRequestAuthority(options),\n        claims: options?.claims,\n      };\n\n      return msalApp.acquireTokenByUsernamePassword(requestOptions);\n    });\n  }\n\n  function getActiveAccount(): AuthenticationRecord | undefined {\n    if (!state.cachedAccount) {\n      return undefined;\n    }\n    return msalToPublic(clientId, state.cachedAccount);\n  }\n\n  async function getTokenByAuthorizationCode(\n    scopes: string[],\n    redirectUri: string,\n    authorizationCode: string,\n    clientSecret?: string,\n    options: GetTokenWithSilentAuthOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using authorization code`);\n\n    let msalApp: msal.ConfidentialClientApplication | msal.PublicClientApplication;\n    if (clientSecret) {\n      // If a client secret is provided, we need to use a confidential client application\n      // See https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-access-token-with-a-client_secret\n      state.msalConfig.auth.clientSecret = clientSecret;\n      msalApp = await getConfidentialApp(options);\n    } else {\n      msalApp = await getPublicApp(options);\n    }\n\n    return withSilentAuthentication(msalApp, scopes, options, () => {\n      return msalApp.acquireTokenByCode({\n        scopes,\n        redirectUri,\n        code: authorizationCode,\n        authority: calculateRequestAuthority(options),\n        claims: options?.claims,\n      });\n    });\n  }\n\n  async function getTokenOnBehalfOf(\n    scopes: string[],\n    userAssertionToken: string,\n    clientCredentials: string | CertificateParts | (() => Promise<string>),\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    msalLogger.getToken.info(`Attempting to acquire token on behalf of another user`);\n\n    if (typeof clientCredentials === \"string\") {\n      // Client secret\n      msalLogger.getToken.info(`Using client secret for on behalf of flow`);\n      state.msalConfig.auth.clientSecret = clientCredentials;\n    } else if (typeof clientCredentials === \"function\") {\n      // Client Assertion\n      msalLogger.getToken.info(`Using client assertion callback for on behalf of flow`);\n      state.msalConfig.auth.clientAssertion = clientCredentials;\n    } else {\n      // Client certificate\n      msalLogger.getToken.info(`Using client certificate for on behalf of flow`);\n      state.msalConfig.auth.clientCertificate = clientCredentials;\n    }\n\n    const msalApp = await getConfidentialApp(options);\n    try {\n      const response = await msalApp.acquireTokenOnBehalfOf({\n        scopes,\n        authority: calculateRequestAuthority(options),\n        claims: options.claims,\n        oboAssertion: userAssertionToken,\n      });\n      ensureValidMsalToken(scopes, response, options);\n\n      msalLogger.getToken.info(formatSuccess(scopes));\n      return {\n        token: response.accessToken,\n        expiresOnTimestamp: response.expiresOn.getTime(),\n        refreshAfterTimestamp: response.refreshOn?.getTime(),\n        tokenType: response.tokenType,\n      } as AccessToken;\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  /**\n   * Creates a base interactive request configuration for MSAL interactive authentication.\n   * This is shared between interactive and brokered authentication flows.\n   */\n  function createBaseInteractiveRequest(\n    scopes: string[],\n    options: GetTokenInteractiveOptions,\n  ): msal.InteractiveRequest {\n    return {\n      openBrowser: async (url) => {\n        const open = await import(\"open\");\n        await open.default(url, { newInstance: true });\n      },\n      scopes,\n      authority: calculateRequestAuthority(options),\n      claims: options?.claims,\n      loginHint: options?.loginHint,\n      errorTemplate: options?.browserCustomizationOptions?.errorMessage,\n      successTemplate: options?.browserCustomizationOptions?.successMessage,\n      prompt: options?.loginHint ? \"login\" : \"select_account\",\n    };\n  }\n\n  /**\n   * @internal\n   */\n  async function getBrokeredTokenInternal(\n    scopes: string[],\n    useDefaultBrokerAccount: boolean,\n    options: GetTokenInteractiveOptions = {},\n  ): Promise<msal.AuthenticationResult> {\n    msalLogger.verbose(\"Authentication will resume through the broker\");\n\n    const app = await getPublicApp(options);\n\n    const interactiveRequest = createBaseInteractiveRequest(scopes, options);\n    if (state.pluginConfiguration.broker.parentWindowHandle) {\n      interactiveRequest.windowHandle = Buffer.from(\n        state.pluginConfiguration.broker.parentWindowHandle,\n      );\n    } else {\n      // this is a bug, as the pluginConfiguration handler should validate this case.\n      msalLogger.warning(\n        \"Parent window handle is not specified for the broker. This may cause unexpected behavior. Please provide the parentWindowHandle.\",\n      );\n    }\n\n    if (state.pluginConfiguration.broker.enableMsaPassthrough) {\n      (interactiveRequest.extraQueryParameters ??= {})[\"msal_request_type\"] =\n        \"consumer_passthrough\";\n    }\n    if (useDefaultBrokerAccount) {\n      interactiveRequest.prompt = \"none\";\n      msalLogger.verbose(\"Attempting broker authentication using the default broker account\");\n    } else {\n      msalLogger.verbose(\"Attempting broker authentication without the default broker account\");\n    }\n\n    if (options.proofOfPossessionOptions) {\n      interactiveRequest.shrNonce = options.proofOfPossessionOptions.nonce;\n      interactiveRequest.authenticationScheme = \"pop\";\n      interactiveRequest.resourceRequestMethod =\n        options.proofOfPossessionOptions.resourceRequestMethod;\n      interactiveRequest.resourceRequestUri = options.proofOfPossessionOptions.resourceRequestUrl;\n    }\n    try {\n      return await app.acquireTokenInteractive(interactiveRequest);\n    } catch (e: any) {\n      msalLogger.verbose(`Failed to authenticate through the broker: ${e.message}`);\n      if (options.disableAutomaticAuthentication) {\n        throw new AuthenticationRequiredError({\n          scopes,\n          getTokenOptions: options,\n          message: \"Cannot silently authenticate with default broker account.\",\n        });\n      }\n      // If we tried to use the default broker account and failed, fall back to interactive authentication\n      if (useDefaultBrokerAccount) {\n        return getBrokeredTokenInternal(scopes, false, options);\n      } else {\n        throw e;\n      }\n    }\n  }\n\n  /**\n   * A helper function that supports brokered authentication through the MSAL's public application.\n   *\n   * When useDefaultBrokerAccount is true, the method will attempt to authenticate using the default broker account.\n   * If the default broker account is not available, the method will fall back to interactive authentication.\n   */\n  async function getBrokeredToken(\n    scopes: string[],\n    useDefaultBrokerAccount: boolean,\n    options: GetTokenInteractiveOptions = {},\n  ): Promise<AccessToken> {\n    msalLogger.getToken.info(\n      `Attempting to acquire token using brokered authentication with useDefaultBrokerAccount: ${useDefaultBrokerAccount}`,\n    );\n    const response = await getBrokeredTokenInternal(scopes, useDefaultBrokerAccount, options);\n    ensureValidMsalToken(scopes, response, options);\n    state.cachedAccount = response?.account ?? null;\n\n    state.logger.getToken.info(formatSuccess(scopes));\n    return {\n      token: response.accessToken,\n      expiresOnTimestamp: response.expiresOn.getTime(),\n      refreshAfterTimestamp: response.refreshOn?.getTime(),\n      tokenType: response.tokenType,\n    } as AccessToken;\n  }\n\n  async function getTokenByInteractiveRequest(\n    scopes: string[],\n    options: GetTokenInteractiveOptions = {},\n  ): Promise<AccessToken> {\n    msalLogger.getToken.info(`Attempting to acquire token interactively`);\n\n    const app = await getPublicApp(options);\n\n    return withSilentAuthentication(app, scopes, options, async () => {\n      const interactiveRequest = createBaseInteractiveRequest(scopes, options);\n\n      if (state.pluginConfiguration.broker.isEnabled) {\n        return getBrokeredTokenInternal(\n          scopes,\n          state.pluginConfiguration.broker.useDefaultBrokerAccount ?? false,\n          options,\n        );\n      }\n      if (options.proofOfPossessionOptions) {\n        interactiveRequest.shrNonce = options.proofOfPossessionOptions.nonce;\n        interactiveRequest.authenticationScheme = \"pop\";\n        interactiveRequest.resourceRequestMethod =\n          options.proofOfPossessionOptions.resourceRequestMethod;\n        interactiveRequest.resourceRequestUri = options.proofOfPossessionOptions.resourceRequestUrl;\n      }\n      return app.acquireTokenInteractive(interactiveRequest);\n    });\n  }\n\n  return {\n    getActiveAccount,\n    getBrokeredToken,\n    getTokenByClientSecret,\n    getTokenByClientAssertion,\n    getTokenByClientCertificate,\n    getTokenByDeviceCode,\n    getTokenByUsernamePassword,\n    getTokenByAuthorizationCode,\n    getTokenOnBehalfOf,\n    getTokenByInteractiveRequest,\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,WAAsB;AAKtB,qBAAgD;AAEhD,yBAA4B;AAC5B,mBAUO;AAEP,oBAA4C;AAG5C,4BAA+B;AAG/B,+BAA2C;AAC3C,oBAA4B;AAC5B,2BAAgC;AAKhC,MAAM,iBAAa,iCAAiB,YAAY;AA4OzC,SAAS,0BACd,UACA,UACA,oBAAuC,CAAC,GACpB;AACpB,QAAM,qBAAiB;AAAA,IACrB,kBAAkB,UAAU;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AAGA,QAAM,gBAAY,2BAAa,oBAAgB,+BAAiB,iBAAiB,CAAC;AAElF,QAAM,aAAa,IAAI,qCAAe;AAAA,IACpC,GAAG,kBAAkB;AAAA,IACrB,eAAe;AAAA,IACf,gBAAgB,kBAAkB;AAAA,EACpC,CAAC;AAED,QAAM,aAAiC;AAAA,IACrC,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,sBAAkB;AAAA,QAChB;AAAA,QACA;AAAA,QACA,kBAAkB;AAAA,MACpB;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,eAAe;AAAA,MACf,eAAe;AAAA,QACb,oBAAgB,oCAAsB,kBAAkB,UAAU,UAAU;AAAA,QAC5E,cAAU,kCAAgB,2BAAY,CAAC;AAAA,QACvC,mBAAmB,kBAAkB,gBAAgB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAiCO,SAAS,iBACd,UACA,UACA,0BAA6C,CAAC,GAClC;AACZ,QAAM,QAAyB;AAAA,IAC7B,YAAY,0BAA0B,UAAU,UAAU,uBAAuB;AAAA,IACjF,eAAe,wBAAwB,2BACnC,2BAAa,wBAAwB,oBAAoB,IACzD;AAAA,IACJ,qBAAqB,+BAAY,4BAA4B,uBAAuB;AAAA,IACpF,QAAQ,wBAAwB,UAAU;AAAA,EAC5C;AAEA,QAAM,aAAwD,oBAAI,IAAI;AACtE,iBAAe,aACb,UAA2B,CAAC,GACW;AACvC,UAAM,SAAS,QAAQ,YAAY,QAAQ;AAE3C,QAAI,kBAAkB,WAAW,IAAI,MAAM;AAC3C,QAAI,iBAAiB;AACnB,YAAM,OAAO,SAAS,KAAK,gEAAgE;AAC3F,aAAO;AAAA,IACT;AAGA,UAAM,OAAO,SAAS;AAAA,MACpB,iDAAiD,QAAQ,YAAY,YAAY,UAAU;AAAA,IAC7F;AAEA,UAAM,cAAc,QAAQ,YACxB,MAAM,oBAAoB,MAAM,iBAChC,MAAM,oBAAoB,MAAM;AAEpC,UAAM,WAAW,KAAK,qBAAqB,QAAQ,YAAY,CAAC,KAAK,IAAI;AAEzE,sBAAkB,IAAI,KAAK,wBAAwB;AAAA,MACjD,GAAG,MAAM;AAAA,MACT,QAAQ,EAAE,oBAAoB,MAAM,oBAAoB,OAAO,mBAAmB;AAAA,MAClF,OAAO,EAAE,aAAa,MAAM,YAAY;AAAA,IAC1C,CAAC;AAED,eAAW,IAAI,QAAQ,eAAe;AAEtC,WAAO;AAAA,EACT;AAEA,QAAM,mBAAoE,oBAAI,IAAI;AAClF,iBAAe,mBACb,UAA2B,CAAC,GACiB;AAC7C,UAAM,SAAS,QAAQ,YAAY,QAAQ;AAE3C,QAAI,wBAAwB,iBAAiB,IAAI,MAAM;AACvD,QAAI,uBAAuB;AACzB,YAAM,OAAO,SAAS;AAAA,QACpB;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAGA,UAAM,OAAO,SAAS;AAAA,MACpB,uDACE,QAAQ,YAAY,YAAY,UAClC;AAAA,IACF;AAEA,UAAM,cAAc,QAAQ,YACxB,MAAM,oBAAoB,MAAM,iBAChC,MAAM,oBAAoB,MAAM;AAEpC,UAAM,WAAW,KAAK,qBAAqB,QAAQ,YAAY,CAAC,KAAK,IAAI;AAEzE,4BAAwB,IAAI,KAAK,8BAA8B;AAAA,MAC7D,GAAG,MAAM;AAAA,MACT,QAAQ,EAAE,oBAAoB,MAAM,oBAAoB,OAAO,mBAAmB;AAAA,MAClF,OAAO,EAAE,aAAa,MAAM,YAAY;AAAA,IAC1C,CAAC;AAED,qBAAiB,IAAI,QAAQ,qBAAqB;AAElD,WAAO;AAAA,EACT;AAEA,iBAAe,eACb,KACA,QACA,UAA2B,CAAC,GACQ;AACpC,QAAI,MAAM,kBAAkB,MAAM;AAChC,YAAM,OAAO,SAAS,KAAK,yCAAyC;AACpE,YAAM,IAAI,0CAA4B,EAAE,OAAO,CAAC;AAAA,IAClD;AAGA,QAAI,QAAQ,QAAQ;AAClB,YAAM,eAAe,QAAQ;AAAA,IAC/B;AAEA,UAAM,gBAAwC;AAAA,MAC5C,SAAS,MAAM;AAAA,MACf;AAAA,MACA,QAAQ,MAAM;AAAA,IAChB;AAEA,QAAI,MAAM,oBAAoB,OAAO,WAAW;AAC9C,oBAAc,yBAAyB,CAAC;AACxC,UAAI,MAAM,oBAAoB,OAAO,sBAAsB;AACzD,sBAAc,qBAAqB,mBAAmB,IAAI;AAAA,MAC5D;AAAA,IACF;AAEA,QAAI,QAAQ,0BAA0B;AACpC,oBAAc,WAAW,QAAQ,yBAAyB;AAC1D,oBAAc,uBAAuB;AACrC,oBAAc,wBAAwB,QAAQ,yBAAyB;AACvE,oBAAc,qBAAqB,QAAQ,yBAAyB;AAAA,IACtE;AACA,UAAM,OAAO,SAAS,KAAK,sCAAsC;AACjE,QAAI;AACF,aAAO,MAAM,IAAI,mBAAmB,aAAa;AAAA,IACnD,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAMA,WAAS,0BAA0B,SAA+C;AAChF,QAAI,SAAS,UAAU;AACrB,iBAAO,2BAAa,QAAQ,cAAU,+BAAiB,uBAAuB,CAAC;AAAA,IACjF;AACA,WAAO,MAAM,WAAW,KAAK;AAAA,EAC/B;AAYA,iBAAe,yBACb,SACA,QACA,SACA,0BACsB;AACtB,QAAI,WAA6C;AACjD,QAAI;AACF,iBAAW,MAAM,eAAe,SAAS,QAAQ,OAAO;AAAA,IAC1D,SAAS,GAAQ;AACf,UAAI,EAAE,SAAS,+BAA+B;AAC5C,cAAM;AAAA,MACR;AACA,UAAI,QAAQ,gCAAgC;AAC1C,cAAM,IAAI,0CAA4B;AAAA,UACpC;AAAA,UACA,iBAAiB;AAAA,UACjB,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AAGA,QAAI,aAAa,MAAM;AACrB,UAAI;AACF,mBAAW,MAAM,yBAAyB;AAAA,MAC5C,SAAS,KAAU;AACjB,kBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,MAC5C;AAAA,IACF;AAGA,2CAAqB,QAAQ,UAAU,OAAO;AAC9C,UAAM,gBAAgB,UAAU,WAAW;AAE3C,UAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,WAAO;AAAA,MACL,OAAO,SAAS;AAAA,MAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,MAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,MACnD,WAAW,SAAS;AAAA,IACtB;AAAA,EACF;AAEA,iBAAe,uBACb,QACA,cACA,UAA2B,CAAC,GACN;AACtB,UAAM,OAAO,SAAS,KAAK,iDAAiD;AAE5E,UAAM,WAAW,KAAK,eAAe;AAErC,UAAM,UAAU,MAAM,mBAAmB,OAAO;AAEhD,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,+BAA+B;AAAA,QAC5D;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,iBAAa,qDAA2B;AAAA,QACxC,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,6CAAqB,QAAQ,UAAU,OAAO;AAC9C,YAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,QAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,QACnD,WAAW,SAAS;AAAA,MACtB;AAAA,IACF,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,iBAAe,0BACb,QACA,iBACA,UAA2B,CAAC,GACN;AACtB,UAAM,OAAO,SAAS,KAAK,oDAAoD;AAE/E,UAAM,WAAW,KAAK,kBAAkB;AAExC,UAAM,UAAU,MAAM,mBAAmB,OAAO;AAEhD,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,+BAA+B;AAAA,QAC5D;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,iBAAa,qDAA2B;AAAA,QACxC,QAAQ,SAAS;AAAA,QACjB;AAAA,MACF,CAAC;AACD,6CAAqB,QAAQ,UAAU,OAAO;AAE9C,YAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,QAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,QACnD,WAAW,SAAS;AAAA,MACtB;AAAA,IACF,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,iBAAe,4BACb,QACA,aACA,UAA2B,CAAC,GACN;AACtB,UAAM,OAAO,SAAS,KAAK,sDAAsD;AAEjF,UAAM,WAAW,KAAK,oBAAoB;AAE1C,UAAM,UAAU,MAAM,mBAAmB,OAAO;AAChD,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,+BAA+B;AAAA,QAC5D;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,iBAAa,qDAA2B;AAAA,QACxC,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,6CAAqB,QAAQ,UAAU,OAAO;AAE9C,YAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,QAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,QACnD,WAAW,SAAS;AAAA,MACtB;AAAA,IACF,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,iBAAe,qBACb,QACA,oBACA,UAAyC,CAAC,GACpB;AACtB,UAAM,OAAO,SAAS,KAAK,+CAA+C;AAE1E,UAAM,UAAU,MAAM,aAAa,OAAO;AAE1C,WAAO,yBAAyB,SAAS,QAAQ,SAAS,MAAM;AAC9D,YAAM,iBAAyC;AAAA,QAC7C;AAAA,QACA,QAAQ,SAAS,aAAa,WAAW;AAAA,QACzC;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,QAAQ,SAAS;AAAA,MACnB;AACA,YAAM,oBAAoB,QAAQ,yBAAyB,cAAc;AACzE,UAAI,QAAQ,aAAa;AACvB,gBAAQ,YAAY,iBAAiB,SAAS,MAAM;AAClD,yBAAe,SAAS;AAAA,QAC1B,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,iBAAe,2BACb,QACA,UACA,UACA,UAA2B,CAAC,GACN;AACtB,UAAM,OAAO,SAAS,KAAK,yDAAyD;AAEpF,UAAM,UAAU,MAAM,aAAa,OAAO;AAE1C,WAAO,yBAAyB,SAAS,QAAQ,SAAS,MAAM;AAC9D,YAAM,iBAA+C;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,QAAQ,SAAS;AAAA,MACnB;AAEA,aAAO,QAAQ,+BAA+B,cAAc;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,WAAS,mBAAqD;AAC5D,QAAI,CAAC,MAAM,eAAe;AACxB,aAAO;AAAA,IACT;AACA,eAAO,2BAAa,UAAU,MAAM,aAAa;AAAA,EACnD;AAEA,iBAAe,4BACb,QACA,aACA,mBACA,cACA,UAAyC,CAAC,GACpB;AACtB,UAAM,OAAO,SAAS,KAAK,sDAAsD;AAEjF,QAAI;AACJ,QAAI,cAAc;AAGhB,YAAM,WAAW,KAAK,eAAe;AACrC,gBAAU,MAAM,mBAAmB,OAAO;AAAA,IAC5C,OAAO;AACL,gBAAU,MAAM,aAAa,OAAO;AAAA,IACtC;AAEA,WAAO,yBAAyB,SAAS,QAAQ,SAAS,MAAM;AAC9D,aAAO,QAAQ,mBAAmB;AAAA,QAChC;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN,WAAW,0BAA0B,OAAO;AAAA,QAC5C,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,iBAAe,mBACb,QACA,oBACA,mBACA,UAA2B,CAAC,GACN;AACtB,eAAW,SAAS,KAAK,uDAAuD;AAEhF,QAAI,OAAO,sBAAsB,UAAU;AAEzC,iBAAW,SAAS,KAAK,2CAA2C;AACpE,YAAM,WAAW,KAAK,eAAe;AAAA,IACvC,WAAW,OAAO,sBAAsB,YAAY;AAElD,iBAAW,SAAS,KAAK,uDAAuD;AAChF,YAAM,WAAW,KAAK,kBAAkB;AAAA,IAC1C,OAAO;AAEL,iBAAW,SAAS,KAAK,gDAAgD;AACzE,YAAM,WAAW,KAAK,oBAAoB;AAAA,IAC5C;AAEA,UAAM,UAAU,MAAM,mBAAmB,OAAO;AAChD,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,uBAAuB;AAAA,QACpD;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,QAAQ,QAAQ;AAAA,QAChB,cAAc;AAAA,MAChB,CAAC;AACD,6CAAqB,QAAQ,UAAU,OAAO;AAE9C,iBAAW,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC9C,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,QAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,QACnD,WAAW,SAAS;AAAA,MACtB;AAAA,IACF,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAMA,WAAS,6BACP,QACA,SACyB;AACzB,WAAO;AAAA,MACL,aAAa,OAAO,QAAQ;AAC1B,cAAM,OAAO,MAAM,OAAO,MAAM;AAChC,cAAM,KAAK,QAAQ,KAAK,EAAE,aAAa,KAAK,CAAC;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,WAAW,0BAA0B,OAAO;AAAA,MAC5C,QAAQ,SAAS;AAAA,MACjB,WAAW,SAAS;AAAA,MACpB,eAAe,SAAS,6BAA6B;AAAA,MACrD,iBAAiB,SAAS,6BAA6B;AAAA,MACvD,QAAQ,SAAS,YAAY,UAAU;AAAA,IACzC;AAAA,EACF;AAKA,iBAAe,yBACb,QACA,yBACA,UAAsC,CAAC,GACH;AACpC,eAAW,QAAQ,+CAA+C;AAElE,UAAM,MAAM,MAAM,aAAa,OAAO;AAEtC,UAAM,qBAAqB,6BAA6B,QAAQ,OAAO;AACvE,QAAI,MAAM,oBAAoB,OAAO,oBAAoB;AACvD,yBAAmB,eAAe,OAAO;AAAA,QACvC,MAAM,oBAAoB,OAAO;AAAA,MACnC;AAAA,IACF,OAAO;AAEL,iBAAW;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,oBAAoB,OAAO,sBAAsB;AACzD,OAAC,mBAAmB,yBAAyB,CAAC,GAAG,mBAAmB,IAClE;AAAA,IACJ;AACA,QAAI,yBAAyB;AAC3B,yBAAmB,SAAS;AAC5B,iBAAW,QAAQ,mEAAmE;AAAA,IACxF,OAAO;AACL,iBAAW,QAAQ,qEAAqE;AAAA,IAC1F;AAEA,QAAI,QAAQ,0BAA0B;AACpC,yBAAmB,WAAW,QAAQ,yBAAyB;AAC/D,yBAAmB,uBAAuB;AAC1C,yBAAmB,wBACjB,QAAQ,yBAAyB;AACnC,yBAAmB,qBAAqB,QAAQ,yBAAyB;AAAA,IAC3E;AACA,QAAI;AACF,aAAO,MAAM,IAAI,wBAAwB,kBAAkB;AAAA,IAC7D,SAAS,GAAQ;AACf,iBAAW,QAAQ,8CAA8C,EAAE,OAAO,EAAE;AAC5E,UAAI,QAAQ,gCAAgC;AAC1C,cAAM,IAAI,0CAA4B;AAAA,UACpC;AAAA,UACA,iBAAiB;AAAA,UACjB,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAEA,UAAI,yBAAyB;AAC3B,eAAO,yBAAyB,QAAQ,OAAO,OAAO;AAAA,MACxD,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAQA,iBAAe,iBACb,QACA,yBACA,UAAsC,CAAC,GACjB;AACtB,eAAW,SAAS;AAAA,MAClB,2FAA2F,uBAAuB;AAAA,IACpH;AACA,UAAM,WAAW,MAAM,yBAAyB,QAAQ,yBAAyB,OAAO;AACxF,2CAAqB,QAAQ,UAAU,OAAO;AAC9C,UAAM,gBAAgB,UAAU,WAAW;AAE3C,UAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,WAAO;AAAA,MACL,OAAO,SAAS;AAAA,MAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,MAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,MACnD,WAAW,SAAS;AAAA,IACtB;AAAA,EACF;AAEA,iBAAe,6BACb,QACA,UAAsC,CAAC,GACjB;AACtB,eAAW,SAAS,KAAK,2CAA2C;AAEpE,UAAM,MAAM,MAAM,aAAa,OAAO;AAEtC,WAAO,yBAAyB,KAAK,QAAQ,SAAS,YAAY;AAChE,YAAM,qBAAqB,6BAA6B,QAAQ,OAAO;AAEvE,UAAI,MAAM,oBAAoB,OAAO,WAAW;AAC9C,eAAO;AAAA,UACL;AAAA,UACA,MAAM,oBAAoB,OAAO,2BAA2B;AAAA,UAC5D;AAAA,QACF;AAAA,MACF;AACA,UAAI,QAAQ,0BAA0B;AACpC,2BAAmB,WAAW,QAAQ,yBAAyB;AAC/D,2BAAmB,uBAAuB;AAC1C,2BAAmB,wBACjB,QAAQ,yBAAyB;AACnC,2BAAmB,qBAAqB,QAAQ,yBAAyB;AAAA,MAC3E;AACA,aAAO,IAAI,wBAAwB,kBAAkB;AAAA,IACvD,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport * as msal from \"@azure/msal-node\";\n\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport type { AuthenticationRecord, CertificateParts } from \"../types.js\";\nimport type { CredentialLogger } from \"../../util/logging.js\";\nimport { credentialLogger, formatSuccess } from \"../../util/logging.js\";\nimport type { PluginConfiguration } from \"./msalPlugins.js\";\nimport { msalPlugins } from \"./msalPlugins.js\";\nimport {\n  defaultLoggerCallback,\n  ensureValidMsalToken,\n  getAuthority,\n  getAuthorityHost,\n  getKnownAuthorities,\n  getMSALLogLevel,\n  handleMsalError,\n  msalToPublic,\n  publicToMsal,\n} from \"../utils.js\";\n\nimport { AuthenticationRequiredError } from \"../../errors.js\";\nimport type { BrokerOptions } from \"./brokerOptions.js\";\nimport type { DeviceCodePromptCallback } from \"../../credentials/deviceCodeCredentialOptions.js\";\nimport { IdentityClient } from \"../../client/identityClient.js\";\nimport type { InteractiveBrowserCredentialNodeOptions } from \"../../credentials/interactiveBrowserCredentialOptions.js\";\nimport type { TokenCachePersistenceOptions } from \"./tokenCachePersistenceOptions.js\";\nimport { calculateRegionalAuthority } from \"../../regionalAuthority.js\";\nimport { getLogLevel } from \"@azure/logger\";\nimport { resolveTenantId } from \"../../util/tenantIdUtils.js\";\n\n/**\n * The default logger used if no logger was passed in by the credential.\n */\nconst msalLogger = credentialLogger(\"MsalClient\");\n\n/**\n * Represents the options for acquiring a token using flows that support silent authentication.\n */\nexport interface GetTokenWithSilentAuthOptions extends GetTokenOptions {\n  /**\n   * Disables automatic authentication. If set to true, the method will throw an error if the user needs to authenticate.\n   *\n   * @remarks\n   *\n   * This option will be set to `false` when the user calls `authenticate` directly on a credential that supports it.\n   */\n  disableAutomaticAuthentication?: boolean;\n}\n\n/**\n * Represents the options for acquiring a token interactively.\n */\nexport interface GetTokenInteractiveOptions extends GetTokenWithSilentAuthOptions {\n  /**\n   * Window handle for parent window, required for WAM authentication.\n   */\n  parentWindowHandle?: Buffer;\n  /**\n   * Shared configuration options for browser customization\n   */\n  browserCustomizationOptions?: InteractiveBrowserCredentialNodeOptions[\"browserCustomizationOptions\"];\n  /**\n   * loginHint allows a user name to be pre-selected for interactive logins.\n   * Setting this option skips the account selection prompt and immediately attempts to login with the specified account.\n   */\n  loginHint?: string;\n}\n\n/**\n * Represents a client for interacting with the Microsoft Authentication Library (MSAL).\n */\nexport interface MsalClient {\n  /**\n   *\n   * Retrieves an access token by using the on-behalf-of flow and a client assertion callback of the calling service.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param userAssertionToken - The access token that was sent to the middle-tier API. This token must have an audience of the app making this OBO request.\n   * @param clientCredentials - The client secret OR client certificate OR client `getAssertion` callback.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenOnBehalfOf(\n    scopes: string[],\n    userAssertionToken: string,\n    clientCredentials: string | CertificateParts | (() => Promise<string>),\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves an access token by using an interactive prompt (InteractiveBrowserCredential).\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByInteractiveRequest(\n    scopes: string[],\n    options: GetTokenInteractiveOptions,\n  ): Promise<AccessToken>;\n  /**\n   * Retrieves an access token by using a user's username and password.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param username - The username provided by the developer.\n   * @param password - The user's password provided by the developer.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByUsernamePassword(\n    scopes: string[],\n    username: string,\n    password: string,\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n  /**\n   * Retrieves an access token by prompting the user to authenticate using a device code.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param userPromptCallback - The callback function that allows developers to customize the prompt message.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByDeviceCode(\n    scopes: string[],\n    userPromptCallback: DeviceCodePromptCallback,\n    options?: GetTokenWithSilentAuthOptions,\n  ): Promise<AccessToken>;\n  /**\n   * Retrieves an access token by using a client certificate.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param certificate - The client certificate used for authentication.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByClientCertificate(\n    scopes: string[],\n    certificate: CertificateParts,\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves an access token by using a client assertion.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param clientAssertion - The client `getAssertion` callback used for authentication.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByClientAssertion(\n    scopes: string[],\n    clientAssertion: () => Promise<string>,\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves an access token by using a client secret.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param clientSecret - The client secret of the application. This is a credential that the application can use to authenticate itself.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getTokenByClientSecret(\n    scopes: string[],\n    clientSecret: string,\n    options?: GetTokenOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves an access token by using an authorization code flow.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param authorizationCode - An authorization code that was received from following the\n                              authorization code flow.  This authorization code must not\n                              have already been used to obtain an access token.\n   * @param redirectUri - The redirect URI that was used to request the authorization code.\n                        Must be the same URI that is configured for the App Registration.\n   * @param clientSecret - An optional client secret that was generated for the App Registration.\n   * @param options - Additional options that may be provided to the method.\n   */\n  getTokenByAuthorizationCode(\n    scopes: string[],\n    redirectUri: string,\n    authorizationCode: string,\n    clientSecret?: string,\n    options?: GetTokenWithSilentAuthOptions,\n  ): Promise<AccessToken>;\n\n  /**\n   * Retrieves the last authenticated account. This method expects an authentication record to have been previously loaded.\n   *\n   * An authentication record could be loaded by calling the `getToken` method, or by providing an `authenticationRecord` when creating a credential.\n   */\n  getActiveAccount(): AuthenticationRecord | undefined;\n\n  /**\n   * Retrieves an access token using brokered authentication.\n   *\n   * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.\n   * @param useDefaultBrokerAccount - Whether to use the default broker account for authentication.\n   * @param options - Additional options that may be provided to the method.\n   * @returns An access token.\n   */\n  getBrokeredToken(\n    scopes: string[],\n    useDefaultBrokerAccount: boolean,\n    options?: GetTokenInteractiveOptions,\n  ): Promise<AccessToken>;\n}\n\n/**\n * Represents the options for configuring the MsalClient.\n */\nexport interface MsalClientOptions {\n  /**\n   * Parameters that enable WAM broker authentication in the InteractiveBrowserCredential.\n   */\n  brokerOptions?: BrokerOptions;\n\n  /**\n   * Parameters that enable token cache persistence in the Identity credentials.\n   */\n  tokenCachePersistenceOptions?: TokenCachePersistenceOptions;\n\n  /**\n   * Indicates if this is being used by VSCode credential.\n   */\n  isVSCodeCredential?: boolean;\n\n  /**\n   * A custom authority host.\n   */\n  authorityHost?: IdentityClient[\"tokenCredentialOptions\"][\"authorityHost\"];\n\n  /**\n   * Allows users to configure settings for logging policy options, allow logging account information and personally identifiable information for customer support.\n   */\n  loggingOptions?: IdentityClient[\"tokenCredentialOptions\"][\"loggingOptions\"];\n\n  /**\n   * The token credential options for the MsalClient.\n   */\n  tokenCredentialOptions?: IdentityClient[\"tokenCredentialOptions\"];\n\n  /**\n   * Determines whether instance discovery is disabled.\n   */\n  disableInstanceDiscovery?: boolean;\n\n  /**\n   * The logger for the MsalClient.\n   */\n  logger?: CredentialLogger;\n\n  /**\n   * The authentication record for the MsalClient.\n   */\n  authenticationRecord?: AuthenticationRecord;\n}\n\n/**\n * Generates the configuration for MSAL (Microsoft Authentication Library).\n *\n * @param clientId - The client ID of the application.\n * @param  tenantId - The tenant ID of the Azure Active Directory.\n * @param  msalClientOptions - Optional. Additional options for creating the MSAL client.\n * @returns  The MSAL configuration object.\n */\nexport function generateMsalConfiguration(\n  clientId: string,\n  tenantId: string,\n  msalClientOptions: MsalClientOptions = {},\n): msal.Configuration {\n  const resolvedTenant = resolveTenantId(\n    msalClientOptions.logger ?? msalLogger,\n    tenantId,\n    clientId,\n  );\n\n  // TODO: move and reuse getIdentityClientAuthorityHost\n  const authority = getAuthority(resolvedTenant, getAuthorityHost(msalClientOptions));\n\n  const httpClient = new IdentityClient({\n    ...msalClientOptions.tokenCredentialOptions,\n    authorityHost: authority,\n    loggingOptions: msalClientOptions.loggingOptions,\n  });\n\n  const msalConfig: msal.Configuration = {\n    auth: {\n      clientId,\n      authority,\n      knownAuthorities: getKnownAuthorities(\n        resolvedTenant,\n        authority,\n        msalClientOptions.disableInstanceDiscovery,\n      ),\n    },\n    system: {\n      networkClient: httpClient,\n      loggerOptions: {\n        loggerCallback: defaultLoggerCallback(msalClientOptions.logger ?? msalLogger),\n        logLevel: getMSALLogLevel(getLogLevel()),\n        piiLoggingEnabled: msalClientOptions.loggingOptions?.enableUnsafeSupportLogging,\n      },\n    },\n  };\n  return msalConfig;\n}\n\n/**\n * Represents the state necessary for the MSAL (Microsoft Authentication Library) client to operate.\n * This includes the MSAL configuration, cached account information, Azure region, and a flag to disable automatic authentication.\n */\ninterface MsalClientState {\n  /** The configuration for the MSAL client. */\n  msalConfig: msal.Configuration;\n\n  /** The cached account information, or null if no account information is cached. */\n  cachedAccount: msal.AccountInfo | null;\n\n  /** Configured plugins */\n  pluginConfiguration: PluginConfiguration;\n\n  /** Claims received from challenges, cached for the next request */\n  cachedClaims?: string;\n\n  /** The logger instance */\n  logger: CredentialLogger;\n}\n\n/**\n * Creates an instance of the MSAL (Microsoft Authentication Library) client.\n *\n * @param clientId - The client ID of the application.\n * @param tenantId - The tenant ID of the Azure Active Directory.\n * @param createMsalClientOptions - Optional. Additional options for creating the MSAL client.\n * @returns An instance of the MSAL client.\n *\n * @public\n */\nexport function createMsalClient(\n  clientId: string,\n  tenantId: string,\n  createMsalClientOptions: MsalClientOptions = {},\n): MsalClient {\n  const state: MsalClientState = {\n    msalConfig: generateMsalConfiguration(clientId, tenantId, createMsalClientOptions),\n    cachedAccount: createMsalClientOptions.authenticationRecord\n      ? publicToMsal(createMsalClientOptions.authenticationRecord)\n      : null,\n    pluginConfiguration: msalPlugins.generatePluginConfiguration(createMsalClientOptions),\n    logger: createMsalClientOptions.logger ?? msalLogger,\n  };\n\n  const publicApps: Map<string, msal.PublicClientApplication> = new Map();\n  async function getPublicApp(\n    options: GetTokenOptions = {},\n  ): Promise<msal.PublicClientApplication> {\n    const appKey = options.enableCae ? \"CAE\" : \"default\";\n\n    let publicClientApp = publicApps.get(appKey);\n    if (publicClientApp) {\n      state.logger.getToken.info(\"Existing PublicClientApplication found in cache, returning it.\");\n      return publicClientApp;\n    }\n\n    // Initialize a new app and cache it\n    state.logger.getToken.info(\n      `Creating new PublicClientApplication with CAE ${options.enableCae ? \"enabled\" : \"disabled\"}.`,\n    );\n\n    const cachePlugin = options.enableCae\n      ? state.pluginConfiguration.cache.cachePluginCae\n      : state.pluginConfiguration.cache.cachePlugin;\n\n    state.msalConfig.auth.clientCapabilities = options.enableCae ? [\"cp1\"] : undefined;\n\n    publicClientApp = new msal.PublicClientApplication({\n      ...state.msalConfig,\n      broker: { nativeBrokerPlugin: state.pluginConfiguration.broker.nativeBrokerPlugin },\n      cache: { cachePlugin: await cachePlugin },\n    });\n\n    publicApps.set(appKey, publicClientApp);\n\n    return publicClientApp;\n  }\n\n  const confidentialApps: Map<string, msal.ConfidentialClientApplication> = new Map();\n  async function getConfidentialApp(\n    options: GetTokenOptions = {},\n  ): Promise<msal.ConfidentialClientApplication> {\n    const appKey = options.enableCae ? \"CAE\" : \"default\";\n\n    let confidentialClientApp = confidentialApps.get(appKey);\n    if (confidentialClientApp) {\n      state.logger.getToken.info(\n        \"Existing ConfidentialClientApplication found in cache, returning it.\",\n      );\n      return confidentialClientApp;\n    }\n\n    // Initialize a new app and cache it\n    state.logger.getToken.info(\n      `Creating new ConfidentialClientApplication with CAE ${\n        options.enableCae ? \"enabled\" : \"disabled\"\n      }.`,\n    );\n\n    const cachePlugin = options.enableCae\n      ? state.pluginConfiguration.cache.cachePluginCae\n      : state.pluginConfiguration.cache.cachePlugin;\n\n    state.msalConfig.auth.clientCapabilities = options.enableCae ? [\"cp1\"] : undefined;\n\n    confidentialClientApp = new msal.ConfidentialClientApplication({\n      ...state.msalConfig,\n      broker: { nativeBrokerPlugin: state.pluginConfiguration.broker.nativeBrokerPlugin },\n      cache: { cachePlugin: await cachePlugin },\n    });\n\n    confidentialApps.set(appKey, confidentialClientApp);\n\n    return confidentialClientApp;\n  }\n\n  async function getTokenSilent(\n    app: msal.ConfidentialClientApplication | msal.PublicClientApplication,\n    scopes: string[],\n    options: GetTokenOptions = {},\n  ): Promise<msal.AuthenticationResult> {\n    if (state.cachedAccount === null) {\n      state.logger.getToken.info(\"No cached account found in local state.\");\n      throw new AuthenticationRequiredError({ scopes });\n    }\n\n    // Keep track and reuse the claims we received across challenges\n    if (options.claims) {\n      state.cachedClaims = options.claims;\n    }\n\n    const silentRequest: msal.SilentFlowRequest = {\n      account: state.cachedAccount,\n      scopes,\n      claims: state.cachedClaims,\n    };\n\n    if (state.pluginConfiguration.broker.isEnabled) {\n      silentRequest.extraQueryParameters ||= {};\n      if (state.pluginConfiguration.broker.enableMsaPassthrough) {\n        silentRequest.extraQueryParameters[\"msal_request_type\"] = \"consumer_passthrough\";\n      }\n    }\n\n    if (options.proofOfPossessionOptions) {\n      silentRequest.shrNonce = options.proofOfPossessionOptions.nonce;\n      silentRequest.authenticationScheme = \"pop\";\n      silentRequest.resourceRequestMethod = options.proofOfPossessionOptions.resourceRequestMethod;\n      silentRequest.resourceRequestUri = options.proofOfPossessionOptions.resourceRequestUrl;\n    }\n    state.logger.getToken.info(\"Attempting to acquire token silently\");\n    try {\n      return await app.acquireTokenSilent(silentRequest);\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  /**\n   * Builds an authority URL for the given request. The authority may be different than the one used when creating the MSAL client\n   * if the user is creating cross-tenant requests\n   */\n  function calculateRequestAuthority(options?: GetTokenOptions): string | undefined {\n    if (options?.tenantId) {\n      return getAuthority(options.tenantId, getAuthorityHost(createMsalClientOptions));\n    }\n    return state.msalConfig.auth.authority;\n  }\n\n  /**\n   * Performs silent authentication using MSAL to acquire an access token.\n   * If silent authentication fails, falls back to interactive authentication.\n   *\n   * @param msalApp - The MSAL application instance.\n   * @param scopes - The scopes for which to acquire the access token.\n   * @param options - The options for acquiring the access token.\n   * @param onAuthenticationRequired - A callback function to handle interactive authentication when silent authentication fails.\n   * @returns A promise that resolves to an AccessToken object containing the access token and its expiration timestamp.\n   */\n  async function withSilentAuthentication(\n    msalApp: msal.ConfidentialClientApplication | msal.PublicClientApplication,\n    scopes: Array<string>,\n    options: GetTokenWithSilentAuthOptions,\n    onAuthenticationRequired: () => Promise<msal.AuthenticationResult | null>,\n  ): Promise<AccessToken> {\n    let response: msal.AuthenticationResult | null = null;\n    try {\n      response = await getTokenSilent(msalApp, scopes, options);\n    } catch (e: any) {\n      if (e.name !== \"AuthenticationRequiredError\") {\n        throw e;\n      }\n      if (options.disableAutomaticAuthentication) {\n        throw new AuthenticationRequiredError({\n          scopes,\n          getTokenOptions: options,\n          message:\n            \"Automatic authentication has been disabled. You may call the authentication() method.\",\n        });\n      }\n    }\n\n    // Silent authentication failed\n    if (response === null) {\n      try {\n        response = await onAuthenticationRequired();\n      } catch (err: any) {\n        throw handleMsalError(scopes, err, options);\n      }\n    }\n\n    // At this point we should have a token, process it\n    ensureValidMsalToken(scopes, response, options);\n    state.cachedAccount = response?.account ?? null;\n\n    state.logger.getToken.info(formatSuccess(scopes));\n    return {\n      token: response.accessToken,\n      expiresOnTimestamp: response.expiresOn.getTime(),\n      refreshAfterTimestamp: response.refreshOn?.getTime(),\n      tokenType: response.tokenType,\n    } as AccessToken;\n  }\n\n  async function getTokenByClientSecret(\n    scopes: string[],\n    clientSecret: string,\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using client secret`);\n\n    state.msalConfig.auth.clientSecret = clientSecret;\n\n    const msalApp = await getConfidentialApp(options);\n\n    try {\n      const response = await msalApp.acquireTokenByClientCredential({\n        scopes,\n        authority: calculateRequestAuthority(options),\n        azureRegion: calculateRegionalAuthority(),\n        claims: options?.claims,\n      });\n      ensureValidMsalToken(scopes, response, options);\n      state.logger.getToken.info(formatSuccess(scopes));\n      return {\n        token: response.accessToken,\n        expiresOnTimestamp: response.expiresOn.getTime(),\n        refreshAfterTimestamp: response.refreshOn?.getTime(),\n        tokenType: response.tokenType,\n      } as AccessToken;\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  async function getTokenByClientAssertion(\n    scopes: string[],\n    clientAssertion: () => Promise<string>,\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using client assertion`);\n\n    state.msalConfig.auth.clientAssertion = clientAssertion;\n\n    const msalApp = await getConfidentialApp(options);\n\n    try {\n      const response = await msalApp.acquireTokenByClientCredential({\n        scopes,\n        authority: calculateRequestAuthority(options),\n        azureRegion: calculateRegionalAuthority(),\n        claims: options?.claims,\n        clientAssertion,\n      });\n      ensureValidMsalToken(scopes, response, options);\n\n      state.logger.getToken.info(formatSuccess(scopes));\n      return {\n        token: response.accessToken,\n        expiresOnTimestamp: response.expiresOn.getTime(),\n        refreshAfterTimestamp: response.refreshOn?.getTime(),\n        tokenType: response.tokenType,\n      } as AccessToken;\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  async function getTokenByClientCertificate(\n    scopes: string[],\n    certificate: CertificateParts,\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using client certificate`);\n\n    state.msalConfig.auth.clientCertificate = certificate;\n\n    const msalApp = await getConfidentialApp(options);\n    try {\n      const response = await msalApp.acquireTokenByClientCredential({\n        scopes,\n        authority: calculateRequestAuthority(options),\n        azureRegion: calculateRegionalAuthority(),\n        claims: options?.claims,\n      });\n      ensureValidMsalToken(scopes, response, options);\n\n      state.logger.getToken.info(formatSuccess(scopes));\n      return {\n        token: response.accessToken,\n        expiresOnTimestamp: response.expiresOn.getTime(),\n        refreshAfterTimestamp: response.refreshOn?.getTime(),\n        tokenType: response.tokenType,\n      } as AccessToken;\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  async function getTokenByDeviceCode(\n    scopes: string[],\n    deviceCodeCallback: DeviceCodePromptCallback,\n    options: GetTokenWithSilentAuthOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using device code`);\n\n    const msalApp = await getPublicApp(options);\n\n    return withSilentAuthentication(msalApp, scopes, options, () => {\n      const requestOptions: msal.DeviceCodeRequest = {\n        scopes,\n        cancel: options?.abortSignal?.aborted ?? false,\n        deviceCodeCallback,\n        authority: calculateRequestAuthority(options),\n        claims: options?.claims,\n      };\n      const deviceCodeRequest = msalApp.acquireTokenByDeviceCode(requestOptions);\n      if (options.abortSignal) {\n        options.abortSignal.addEventListener(\"abort\", () => {\n          requestOptions.cancel = true;\n        });\n      }\n\n      return deviceCodeRequest;\n    });\n  }\n\n  async function getTokenByUsernamePassword(\n    scopes: string[],\n    username: string,\n    password: string,\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using username and password`);\n\n    const msalApp = await getPublicApp(options);\n\n    return withSilentAuthentication(msalApp, scopes, options, () => {\n      const requestOptions: msal.UsernamePasswordRequest = {\n        scopes,\n        username,\n        password,\n        authority: calculateRequestAuthority(options),\n        claims: options?.claims,\n      };\n\n      return msalApp.acquireTokenByUsernamePassword(requestOptions);\n    });\n  }\n\n  function getActiveAccount(): AuthenticationRecord | undefined {\n    if (!state.cachedAccount) {\n      return undefined;\n    }\n    return msalToPublic(clientId, state.cachedAccount);\n  }\n\n  async function getTokenByAuthorizationCode(\n    scopes: string[],\n    redirectUri: string,\n    authorizationCode: string,\n    clientSecret?: string,\n    options: GetTokenWithSilentAuthOptions = {},\n  ): Promise<AccessToken> {\n    state.logger.getToken.info(`Attempting to acquire token using authorization code`);\n\n    let msalApp: msal.ConfidentialClientApplication | msal.PublicClientApplication;\n    if (clientSecret) {\n      // If a client secret is provided, we need to use a confidential client application\n      // See https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-access-token-with-a-client_secret\n      state.msalConfig.auth.clientSecret = clientSecret;\n      msalApp = await getConfidentialApp(options);\n    } else {\n      msalApp = await getPublicApp(options);\n    }\n\n    return withSilentAuthentication(msalApp, scopes, options, () => {\n      return msalApp.acquireTokenByCode({\n        scopes,\n        redirectUri,\n        code: authorizationCode,\n        authority: calculateRequestAuthority(options),\n        claims: options?.claims,\n      });\n    });\n  }\n\n  async function getTokenOnBehalfOf(\n    scopes: string[],\n    userAssertionToken: string,\n    clientCredentials: string | CertificateParts | (() => Promise<string>),\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    msalLogger.getToken.info(`Attempting to acquire token on behalf of another user`);\n\n    if (typeof clientCredentials === \"string\") {\n      // Client secret\n      msalLogger.getToken.info(`Using client secret for on behalf of flow`);\n      state.msalConfig.auth.clientSecret = clientCredentials;\n    } else if (typeof clientCredentials === \"function\") {\n      // Client Assertion\n      msalLogger.getToken.info(`Using client assertion callback for on behalf of flow`);\n      state.msalConfig.auth.clientAssertion = clientCredentials;\n    } else {\n      // Client certificate\n      msalLogger.getToken.info(`Using client certificate for on behalf of flow`);\n      state.msalConfig.auth.clientCertificate = clientCredentials;\n    }\n\n    const msalApp = await getConfidentialApp(options);\n    try {\n      const response = await msalApp.acquireTokenOnBehalfOf({\n        scopes,\n        authority: calculateRequestAuthority(options),\n        claims: options.claims,\n        oboAssertion: userAssertionToken,\n      });\n      ensureValidMsalToken(scopes, response, options);\n\n      msalLogger.getToken.info(formatSuccess(scopes));\n      return {\n        token: response.accessToken,\n        expiresOnTimestamp: response.expiresOn.getTime(),\n        refreshAfterTimestamp: response.refreshOn?.getTime(),\n        tokenType: response.tokenType,\n      } as AccessToken;\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  /**\n   * Creates a base interactive request configuration for MSAL interactive authentication.\n   * This is shared between interactive and brokered authentication flows.\n   */\n  function createBaseInteractiveRequest(\n    scopes: string[],\n    options: GetTokenInteractiveOptions,\n  ): msal.InteractiveRequest {\n    return {\n      openBrowser: async (url) => {\n        const open = await import(\"open\");\n        await open.default(url);\n      },\n      scopes,\n      authority: calculateRequestAuthority(options),\n      claims: options?.claims,\n      loginHint: options?.loginHint,\n      errorTemplate: options?.browserCustomizationOptions?.errorMessage,\n      successTemplate: options?.browserCustomizationOptions?.successMessage,\n      prompt: options?.loginHint ? \"login\" : \"select_account\",\n    };\n  }\n\n  /**\n   * @internal\n   */\n  async function getBrokeredTokenInternal(\n    scopes: string[],\n    useDefaultBrokerAccount: boolean,\n    options: GetTokenInteractiveOptions = {},\n  ): Promise<msal.AuthenticationResult> {\n    msalLogger.verbose(\"Authentication will resume through the broker\");\n\n    const app = await getPublicApp(options);\n\n    const interactiveRequest = createBaseInteractiveRequest(scopes, options);\n    if (state.pluginConfiguration.broker.parentWindowHandle) {\n      interactiveRequest.windowHandle = Buffer.from(\n        state.pluginConfiguration.broker.parentWindowHandle,\n      );\n    } else {\n      // this is a bug, as the pluginConfiguration handler should validate this case.\n      msalLogger.warning(\n        \"Parent window handle is not specified for the broker. This may cause unexpected behavior. Please provide the parentWindowHandle.\",\n      );\n    }\n\n    if (state.pluginConfiguration.broker.enableMsaPassthrough) {\n      (interactiveRequest.extraQueryParameters ??= {})[\"msal_request_type\"] =\n        \"consumer_passthrough\";\n    }\n    if (useDefaultBrokerAccount) {\n      interactiveRequest.prompt = \"none\";\n      msalLogger.verbose(\"Attempting broker authentication using the default broker account\");\n    } else {\n      msalLogger.verbose(\"Attempting broker authentication without the default broker account\");\n    }\n\n    if (options.proofOfPossessionOptions) {\n      interactiveRequest.shrNonce = options.proofOfPossessionOptions.nonce;\n      interactiveRequest.authenticationScheme = \"pop\";\n      interactiveRequest.resourceRequestMethod =\n        options.proofOfPossessionOptions.resourceRequestMethod;\n      interactiveRequest.resourceRequestUri = options.proofOfPossessionOptions.resourceRequestUrl;\n    }\n    try {\n      return await app.acquireTokenInteractive(interactiveRequest);\n    } catch (e: any) {\n      msalLogger.verbose(`Failed to authenticate through the broker: ${e.message}`);\n      if (options.disableAutomaticAuthentication) {\n        throw new AuthenticationRequiredError({\n          scopes,\n          getTokenOptions: options,\n          message: \"Cannot silently authenticate with default broker account.\",\n        });\n      }\n      // If we tried to use the default broker account and failed, fall back to interactive authentication\n      if (useDefaultBrokerAccount) {\n        return getBrokeredTokenInternal(scopes, false, options);\n      } else {\n        throw e;\n      }\n    }\n  }\n\n  /**\n   * A helper function that supports brokered authentication through the MSAL's public application.\n   *\n   * When useDefaultBrokerAccount is true, the method will attempt to authenticate using the default broker account.\n   * If the default broker account is not available, the method will fall back to interactive authentication.\n   */\n  async function getBrokeredToken(\n    scopes: string[],\n    useDefaultBrokerAccount: boolean,\n    options: GetTokenInteractiveOptions = {},\n  ): Promise<AccessToken> {\n    msalLogger.getToken.info(\n      `Attempting to acquire token using brokered authentication with useDefaultBrokerAccount: ${useDefaultBrokerAccount}`,\n    );\n    const response = await getBrokeredTokenInternal(scopes, useDefaultBrokerAccount, options);\n    ensureValidMsalToken(scopes, response, options);\n    state.cachedAccount = response?.account ?? null;\n\n    state.logger.getToken.info(formatSuccess(scopes));\n    return {\n      token: response.accessToken,\n      expiresOnTimestamp: response.expiresOn.getTime(),\n      refreshAfterTimestamp: response.refreshOn?.getTime(),\n      tokenType: response.tokenType,\n    } as AccessToken;\n  }\n\n  async function getTokenByInteractiveRequest(\n    scopes: string[],\n    options: GetTokenInteractiveOptions = {},\n  ): Promise<AccessToken> {\n    msalLogger.getToken.info(`Attempting to acquire token interactively`);\n\n    const app = await getPublicApp(options);\n\n    return withSilentAuthentication(app, scopes, options, async () => {\n      const interactiveRequest = createBaseInteractiveRequest(scopes, options);\n\n      if (state.pluginConfiguration.broker.isEnabled) {\n        return getBrokeredTokenInternal(\n          scopes,\n          state.pluginConfiguration.broker.useDefaultBrokerAccount ?? false,\n          options,\n        );\n      }\n      if (options.proofOfPossessionOptions) {\n        interactiveRequest.shrNonce = options.proofOfPossessionOptions.nonce;\n        interactiveRequest.authenticationScheme = \"pop\";\n        interactiveRequest.resourceRequestMethod =\n          options.proofOfPossessionOptions.resourceRequestMethod;\n        interactiveRequest.resourceRequestUri = options.proofOfPossessionOptions.resourceRequestUrl;\n      }\n      return app.acquireTokenInteractive(interactiveRequest);\n    });\n  }\n\n  return {\n    getActiveAccount,\n    getBrokeredToken,\n    getTokenByClientSecret,\n    getTokenByClientAssertion,\n    getTokenByClientCertificate,\n    getTokenByDeviceCode,\n    getTokenByUsernamePassword,\n    getTokenByAuthorizationCode,\n    getTokenOnBehalfOf,\n    getTokenByInteractiveRequest,\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,WAAsB;AAKtB,qBAAgD;AAEhD,yBAA4B;AAC5B,mBAUO;AAEP,oBAA4C;AAG5C,4BAA+B;AAG/B,+BAA2C;AAC3C,oBAA4B;AAC5B,2BAAgC;AAKhC,MAAM,iBAAa,iCAAiB,YAAY;AA4OzC,SAAS,0BACd,UACA,UACA,oBAAuC,CAAC,GACpB;AACpB,QAAM,qBAAiB;AAAA,IACrB,kBAAkB,UAAU;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AAGA,QAAM,gBAAY,2BAAa,oBAAgB,+BAAiB,iBAAiB,CAAC;AAElF,QAAM,aAAa,IAAI,qCAAe;AAAA,IACpC,GAAG,kBAAkB;AAAA,IACrB,eAAe;AAAA,IACf,gBAAgB,kBAAkB;AAAA,EACpC,CAAC;AAED,QAAM,aAAiC;AAAA,IACrC,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,sBAAkB;AAAA,QAChB;AAAA,QACA;AAAA,QACA,kBAAkB;AAAA,MACpB;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,eAAe;AAAA,MACf,eAAe;AAAA,QACb,oBAAgB,oCAAsB,kBAAkB,UAAU,UAAU;AAAA,QAC5E,cAAU,kCAAgB,2BAAY,CAAC;AAAA,QACvC,mBAAmB,kBAAkB,gBAAgB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAiCO,SAAS,iBACd,UACA,UACA,0BAA6C,CAAC,GAClC;AACZ,QAAM,QAAyB;AAAA,IAC7B,YAAY,0BAA0B,UAAU,UAAU,uBAAuB;AAAA,IACjF,eAAe,wBAAwB,2BACnC,2BAAa,wBAAwB,oBAAoB,IACzD;AAAA,IACJ,qBAAqB,+BAAY,4BAA4B,uBAAuB;AAAA,IACpF,QAAQ,wBAAwB,UAAU;AAAA,EAC5C;AAEA,QAAM,aAAwD,oBAAI,IAAI;AACtE,iBAAe,aACb,UAA2B,CAAC,GACW;AACvC,UAAM,SAAS,QAAQ,YAAY,QAAQ;AAE3C,QAAI,kBAAkB,WAAW,IAAI,MAAM;AAC3C,QAAI,iBAAiB;AACnB,YAAM,OAAO,SAAS,KAAK,gEAAgE;AAC3F,aAAO;AAAA,IACT;AAGA,UAAM,OAAO,SAAS;AAAA,MACpB,iDAAiD,QAAQ,YAAY,YAAY,UAAU;AAAA,IAC7F;AAEA,UAAM,cAAc,QAAQ,YACxB,MAAM,oBAAoB,MAAM,iBAChC,MAAM,oBAAoB,MAAM;AAEpC,UAAM,WAAW,KAAK,qBAAqB,QAAQ,YAAY,CAAC,KAAK,IAAI;AAEzE,sBAAkB,IAAI,KAAK,wBAAwB;AAAA,MACjD,GAAG,MAAM;AAAA,MACT,QAAQ,EAAE,oBAAoB,MAAM,oBAAoB,OAAO,mBAAmB;AAAA,MAClF,OAAO,EAAE,aAAa,MAAM,YAAY;AAAA,IAC1C,CAAC;AAED,eAAW,IAAI,QAAQ,eAAe;AAEtC,WAAO;AAAA,EACT;AAEA,QAAM,mBAAoE,oBAAI,IAAI;AAClF,iBAAe,mBACb,UAA2B,CAAC,GACiB;AAC7C,UAAM,SAAS,QAAQ,YAAY,QAAQ;AAE3C,QAAI,wBAAwB,iBAAiB,IAAI,MAAM;AACvD,QAAI,uBAAuB;AACzB,YAAM,OAAO,SAAS;AAAA,QACpB;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAGA,UAAM,OAAO,SAAS;AAAA,MACpB,uDACE,QAAQ,YAAY,YAAY,UAClC;AAAA,IACF;AAEA,UAAM,cAAc,QAAQ,YACxB,MAAM,oBAAoB,MAAM,iBAChC,MAAM,oBAAoB,MAAM;AAEpC,UAAM,WAAW,KAAK,qBAAqB,QAAQ,YAAY,CAAC,KAAK,IAAI;AAEzE,4BAAwB,IAAI,KAAK,8BAA8B;AAAA,MAC7D,GAAG,MAAM;AAAA,MACT,QAAQ,EAAE,oBAAoB,MAAM,oBAAoB,OAAO,mBAAmB;AAAA,MAClF,OAAO,EAAE,aAAa,MAAM,YAAY;AAAA,IAC1C,CAAC;AAED,qBAAiB,IAAI,QAAQ,qBAAqB;AAElD,WAAO;AAAA,EACT;AAEA,iBAAe,eACb,KACA,QACA,UAA2B,CAAC,GACQ;AACpC,QAAI,MAAM,kBAAkB,MAAM;AAChC,YAAM,OAAO,SAAS,KAAK,yCAAyC;AACpE,YAAM,IAAI,0CAA4B,EAAE,OAAO,CAAC;AAAA,IAClD;AAGA,QAAI,QAAQ,QAAQ;AAClB,YAAM,eAAe,QAAQ;AAAA,IAC/B;AAEA,UAAM,gBAAwC;AAAA,MAC5C,SAAS,MAAM;AAAA,MACf;AAAA,MACA,QAAQ,MAAM;AAAA,IAChB;AAEA,QAAI,MAAM,oBAAoB,OAAO,WAAW;AAC9C,oBAAc,yBAAyB,CAAC;AACxC,UAAI,MAAM,oBAAoB,OAAO,sBAAsB;AACzD,sBAAc,qBAAqB,mBAAmB,IAAI;AAAA,MAC5D;AAAA,IACF;AAEA,QAAI,QAAQ,0BAA0B;AACpC,oBAAc,WAAW,QAAQ,yBAAyB;AAC1D,oBAAc,uBAAuB;AACrC,oBAAc,wBAAwB,QAAQ,yBAAyB;AACvE,oBAAc,qBAAqB,QAAQ,yBAAyB;AAAA,IACtE;AACA,UAAM,OAAO,SAAS,KAAK,sCAAsC;AACjE,QAAI;AACF,aAAO,MAAM,IAAI,mBAAmB,aAAa;AAAA,IACnD,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAMA,WAAS,0BAA0B,SAA+C;AAChF,QAAI,SAAS,UAAU;AACrB,iBAAO,2BAAa,QAAQ,cAAU,+BAAiB,uBAAuB,CAAC;AAAA,IACjF;AACA,WAAO,MAAM,WAAW,KAAK;AAAA,EAC/B;AAYA,iBAAe,yBACb,SACA,QACA,SACA,0BACsB;AACtB,QAAI,WAA6C;AACjD,QAAI;AACF,iBAAW,MAAM,eAAe,SAAS,QAAQ,OAAO;AAAA,IAC1D,SAAS,GAAQ;AACf,UAAI,EAAE,SAAS,+BAA+B;AAC5C,cAAM;AAAA,MACR;AACA,UAAI,QAAQ,gCAAgC;AAC1C,cAAM,IAAI,0CAA4B;AAAA,UACpC;AAAA,UACA,iBAAiB;AAAA,UACjB,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AAGA,QAAI,aAAa,MAAM;AACrB,UAAI;AACF,mBAAW,MAAM,yBAAyB;AAAA,MAC5C,SAAS,KAAU;AACjB,kBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,MAC5C;AAAA,IACF;AAGA,2CAAqB,QAAQ,UAAU,OAAO;AAC9C,UAAM,gBAAgB,UAAU,WAAW;AAE3C,UAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,WAAO;AAAA,MACL,OAAO,SAAS;AAAA,MAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,MAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,MACnD,WAAW,SAAS;AAAA,IACtB;AAAA,EACF;AAEA,iBAAe,uBACb,QACA,cACA,UAA2B,CAAC,GACN;AACtB,UAAM,OAAO,SAAS,KAAK,iDAAiD;AAE5E,UAAM,WAAW,KAAK,eAAe;AAErC,UAAM,UAAU,MAAM,mBAAmB,OAAO;AAEhD,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,+BAA+B;AAAA,QAC5D;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,iBAAa,qDAA2B;AAAA,QACxC,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,6CAAqB,QAAQ,UAAU,OAAO;AAC9C,YAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,QAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,QACnD,WAAW,SAAS;AAAA,MACtB;AAAA,IACF,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,iBAAe,0BACb,QACA,iBACA,UAA2B,CAAC,GACN;AACtB,UAAM,OAAO,SAAS,KAAK,oDAAoD;AAE/E,UAAM,WAAW,KAAK,kBAAkB;AAExC,UAAM,UAAU,MAAM,mBAAmB,OAAO;AAEhD,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,+BAA+B;AAAA,QAC5D;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,iBAAa,qDAA2B;AAAA,QACxC,QAAQ,SAAS;AAAA,QACjB;AAAA,MACF,CAAC;AACD,6CAAqB,QAAQ,UAAU,OAAO;AAE9C,YAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,QAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,QACnD,WAAW,SAAS;AAAA,MACtB;AAAA,IACF,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,iBAAe,4BACb,QACA,aACA,UAA2B,CAAC,GACN;AACtB,UAAM,OAAO,SAAS,KAAK,sDAAsD;AAEjF,UAAM,WAAW,KAAK,oBAAoB;AAE1C,UAAM,UAAU,MAAM,mBAAmB,OAAO;AAChD,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,+BAA+B;AAAA,QAC5D;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,iBAAa,qDAA2B;AAAA,QACxC,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,6CAAqB,QAAQ,UAAU,OAAO;AAE9C,YAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,QAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,QACnD,WAAW,SAAS;AAAA,MACtB;AAAA,IACF,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,iBAAe,qBACb,QACA,oBACA,UAAyC,CAAC,GACpB;AACtB,UAAM,OAAO,SAAS,KAAK,+CAA+C;AAE1E,UAAM,UAAU,MAAM,aAAa,OAAO;AAE1C,WAAO,yBAAyB,SAAS,QAAQ,SAAS,MAAM;AAC9D,YAAM,iBAAyC;AAAA,QAC7C;AAAA,QACA,QAAQ,SAAS,aAAa,WAAW;AAAA,QACzC;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,QAAQ,SAAS;AAAA,MACnB;AACA,YAAM,oBAAoB,QAAQ,yBAAyB,cAAc;AACzE,UAAI,QAAQ,aAAa;AACvB,gBAAQ,YAAY,iBAAiB,SAAS,MAAM;AAClD,yBAAe,SAAS;AAAA,QAC1B,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,iBAAe,2BACb,QACA,UACA,UACA,UAA2B,CAAC,GACN;AACtB,UAAM,OAAO,SAAS,KAAK,yDAAyD;AAEpF,UAAM,UAAU,MAAM,aAAa,OAAO;AAE1C,WAAO,yBAAyB,SAAS,QAAQ,SAAS,MAAM;AAC9D,YAAM,iBAA+C;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,QAAQ,SAAS;AAAA,MACnB;AAEA,aAAO,QAAQ,+BAA+B,cAAc;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,WAAS,mBAAqD;AAC5D,QAAI,CAAC,MAAM,eAAe;AACxB,aAAO;AAAA,IACT;AACA,eAAO,2BAAa,UAAU,MAAM,aAAa;AAAA,EACnD;AAEA,iBAAe,4BACb,QACA,aACA,mBACA,cACA,UAAyC,CAAC,GACpB;AACtB,UAAM,OAAO,SAAS,KAAK,sDAAsD;AAEjF,QAAI;AACJ,QAAI,cAAc;AAGhB,YAAM,WAAW,KAAK,eAAe;AACrC,gBAAU,MAAM,mBAAmB,OAAO;AAAA,IAC5C,OAAO;AACL,gBAAU,MAAM,aAAa,OAAO;AAAA,IACtC;AAEA,WAAO,yBAAyB,SAAS,QAAQ,SAAS,MAAM;AAC9D,aAAO,QAAQ,mBAAmB;AAAA,QAChC;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN,WAAW,0BAA0B,OAAO;AAAA,QAC5C,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,iBAAe,mBACb,QACA,oBACA,mBACA,UAA2B,CAAC,GACN;AACtB,eAAW,SAAS,KAAK,uDAAuD;AAEhF,QAAI,OAAO,sBAAsB,UAAU;AAEzC,iBAAW,SAAS,KAAK,2CAA2C;AACpE,YAAM,WAAW,KAAK,eAAe;AAAA,IACvC,WAAW,OAAO,sBAAsB,YAAY;AAElD,iBAAW,SAAS,KAAK,uDAAuD;AAChF,YAAM,WAAW,KAAK,kBAAkB;AAAA,IAC1C,OAAO;AAEL,iBAAW,SAAS,KAAK,gDAAgD;AACzE,YAAM,WAAW,KAAK,oBAAoB;AAAA,IAC5C;AAEA,UAAM,UAAU,MAAM,mBAAmB,OAAO;AAChD,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,uBAAuB;AAAA,QACpD;AAAA,QACA,WAAW,0BAA0B,OAAO;AAAA,QAC5C,QAAQ,QAAQ;AAAA,QAChB,cAAc;AAAA,MAChB,CAAC;AACD,6CAAqB,QAAQ,UAAU,OAAO;AAE9C,iBAAW,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC9C,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,QAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,QACnD,WAAW,SAAS;AAAA,MACtB;AAAA,IACF,SAAS,KAAU;AACjB,gBAAM,8BAAgB,QAAQ,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAMA,WAAS,6BACP,QACA,SACyB;AACzB,WAAO;AAAA,MACL,aAAa,OAAO,QAAQ;AAC1B,cAAM,OAAO,MAAM,OAAO,MAAM;AAChC,cAAM,KAAK,QAAQ,GAAG;AAAA,MACxB;AAAA,MACA;AAAA,MACA,WAAW,0BAA0B,OAAO;AAAA,MAC5C,QAAQ,SAAS;AAAA,MACjB,WAAW,SAAS;AAAA,MACpB,eAAe,SAAS,6BAA6B;AAAA,MACrD,iBAAiB,SAAS,6BAA6B;AAAA,MACvD,QAAQ,SAAS,YAAY,UAAU;AAAA,IACzC;AAAA,EACF;AAKA,iBAAe,yBACb,QACA,yBACA,UAAsC,CAAC,GACH;AACpC,eAAW,QAAQ,+CAA+C;AAElE,UAAM,MAAM,MAAM,aAAa,OAAO;AAEtC,UAAM,qBAAqB,6BAA6B,QAAQ,OAAO;AACvE,QAAI,MAAM,oBAAoB,OAAO,oBAAoB;AACvD,yBAAmB,eAAe,OAAO;AAAA,QACvC,MAAM,oBAAoB,OAAO;AAAA,MACnC;AAAA,IACF,OAAO;AAEL,iBAAW;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,oBAAoB,OAAO,sBAAsB;AACzD,OAAC,mBAAmB,yBAAyB,CAAC,GAAG,mBAAmB,IAClE;AAAA,IACJ;AACA,QAAI,yBAAyB;AAC3B,yBAAmB,SAAS;AAC5B,iBAAW,QAAQ,mEAAmE;AAAA,IACxF,OAAO;AACL,iBAAW,QAAQ,qEAAqE;AAAA,IAC1F;AAEA,QAAI,QAAQ,0BAA0B;AACpC,yBAAmB,WAAW,QAAQ,yBAAyB;AAC/D,yBAAmB,uBAAuB;AAC1C,yBAAmB,wBACjB,QAAQ,yBAAyB;AACnC,yBAAmB,qBAAqB,QAAQ,yBAAyB;AAAA,IAC3E;AACA,QAAI;AACF,aAAO,MAAM,IAAI,wBAAwB,kBAAkB;AAAA,IAC7D,SAAS,GAAQ;AACf,iBAAW,QAAQ,8CAA8C,EAAE,OAAO,EAAE;AAC5E,UAAI,QAAQ,gCAAgC;AAC1C,cAAM,IAAI,0CAA4B;AAAA,UACpC;AAAA,UACA,iBAAiB;AAAA,UACjB,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAEA,UAAI,yBAAyB;AAC3B,eAAO,yBAAyB,QAAQ,OAAO,OAAO;AAAA,MACxD,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAQA,iBAAe,iBACb,QACA,yBACA,UAAsC,CAAC,GACjB;AACtB,eAAW,SAAS;AAAA,MAClB,2FAA2F,uBAAuB;AAAA,IACpH;AACA,UAAM,WAAW,MAAM,yBAAyB,QAAQ,yBAAyB,OAAO;AACxF,2CAAqB,QAAQ,UAAU,OAAO;AAC9C,UAAM,gBAAgB,UAAU,WAAW;AAE3C,UAAM,OAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAChD,WAAO;AAAA,MACL,OAAO,SAAS;AAAA,MAChB,oBAAoB,SAAS,UAAU,QAAQ;AAAA,MAC/C,uBAAuB,SAAS,WAAW,QAAQ;AAAA,MACnD,WAAW,SAAS;AAAA,IACtB;AAAA,EACF;AAEA,iBAAe,6BACb,QACA,UAAsC,CAAC,GACjB;AACtB,eAAW,SAAS,KAAK,2CAA2C;AAEpE,UAAM,MAAM,MAAM,aAAa,OAAO;AAEtC,WAAO,yBAAyB,KAAK,QAAQ,SAAS,YAAY;AAChE,YAAM,qBAAqB,6BAA6B,QAAQ,OAAO;AAEvE,UAAI,MAAM,oBAAoB,OAAO,WAAW;AAC9C,eAAO;AAAA,UACL;AAAA,UACA,MAAM,oBAAoB,OAAO,2BAA2B;AAAA,UAC5D;AAAA,QACF;AAAA,MACF;AACA,UAAI,QAAQ,0BAA0B;AACpC,2BAAmB,WAAW,QAAQ,yBAAyB;AAC/D,2BAAmB,uBAAuB;AAC1C,2BAAmB,wBACjB,QAAQ,yBAAyB;AACnC,2BAAmB,qBAAqB,QAAQ,yBAAyB;AAAA,MAC3E;AACA,aAAO,IAAI,wBAAwB,kBAAkB;AAAA,IACvD,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/commonjs/package.json

@@ -1,3 +1,8 @@
 {
-  "type": "commonjs"
+  "name": "@azure/identity",
+  "version": "4.13.3",
+  "type": "commonjs",
+  "exports": {
+    "./package.json": "./package.json"
+  }
 }

package/dist/esm/constants.d.ts

@@ -1,7 +1,7 @@
 /**
  * Current version of the `@azure/identity` package.
  */
-export declare const SDK_VERSION = "4.13.2";
+export declare const SDK_VERSION = "4.13.3";
 /**
  * The default client ID for authentication
  * @internal

package/dist/esm/constants.js

@@ -3,7 +3,7 @@
 /**
  * Current version of the `@azure/identity` package.
  */
-export const SDK_VERSION = `4.13.2`;
+export const SDK_VERSION = `4.13.3`;
 /**
  * The default client ID for authentication
  * @internal

package/dist/esm/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAEpC;;;GAGG;AACH,2EAA2E;AAC3E,6CAA6C;AAC7C,uGAAuG;AACvG,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;GAEG;AACH,MAAM,CAAN,IAAY,mBAoBX;AApBD,WAAY,mBAAmB;IAC7B;;OAEG;IACH,oEAA6C,CAAA;IAC7C;;;;;SAKK;IACL,wEAAiD,CAAA;IACjD;;OAEG;IACH,2EAAoD,CAAA;IACpD;;OAEG;IACH,6EAAsD,CAAA;AACxD,CAAC,EApBW,mBAAmB,KAAnB,mBAAmB,QAoB9B;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,gBAAgB,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAa,CAAC,GAAG,CAAC,CAAC;AAE3C;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\n/**\n * Current version of the `@azure/identity` package.\n */\nexport const SDK_VERSION = `4.13.2`;\n\n/**\n * The default client ID for authentication\n * @internal\n */\n// TODO: temporary - this is the Azure CLI clientID - we'll replace it when\n// Developer Sign On application is available\n// https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/Constants.cs#L9\nexport const DeveloperSignOnClientId = \"04b07795-8ddb-461a-bbee-02f9e1bf7b46\";\n\n/**\n * The default tenant for authentication\n * @internal\n */\nexport const DefaultTenantId = \"common\";\n\n/**\n * A list of known Azure authority hosts\n */\nexport enum AzureAuthorityHosts {\n  /**\n   * China-based Azure Authority Host\n   */\n  AzureChina = \"https://login.chinacloudapi.cn\",\n  /**\n   * Germany-based Azure Authority Host\n   *\n   * @deprecated Microsoft Cloud Germany was closed on October 29th, 2021.\n   *\n   * */\n  AzureGermany = \"https://login.microsoftonline.de\",\n  /**\n   * US Government Azure Authority Host\n   */\n  AzureGovernment = \"https://login.microsoftonline.us\",\n  /**\n   * Public Cloud Azure Authority Host\n   */\n  AzurePublicCloud = \"https://login.microsoftonline.com\",\n}\n\n/**\n * @internal\n * The default authority host.\n */\nexport const DefaultAuthorityHost = AzureAuthorityHosts.AzurePublicCloud;\n\n/**\n * @internal\n * The default environment host for Azure Public Cloud\n */\nexport const DefaultAuthority = \"login.microsoftonline.com\";\n\n/**\n * @internal\n * Allow acquiring tokens for any tenant for multi-tentant auth.\n */\nexport const ALL_TENANTS: string[] = [\"*\"];\n\n/**\n * @internal\n */\nexport const CACHE_CAE_SUFFIX = \"cae\";\n\n/**\n * @internal\n */\nexport const CACHE_NON_CAE_SUFFIX = \"nocae\";\n\n/**\n * @internal\n *\n * The default name for the cache persistence plugin.\n * Matches the constant defined in the cache persistence package.\n */\nexport const DEFAULT_TOKEN_CACHE_NAME = \"msal.cache\";\n"]}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAEpC;;;GAGG;AACH,2EAA2E;AAC3E,6CAA6C;AAC7C,uGAAuG;AACvG,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;GAEG;AACH,MAAM,CAAN,IAAY,mBAoBX;AApBD,WAAY,mBAAmB;IAC7B;;OAEG;IACH,oEAA6C,CAAA;IAC7C;;;;;SAKK;IACL,wEAAiD,CAAA;IACjD;;OAEG;IACH,2EAAoD,CAAA;IACpD;;OAEG;IACH,6EAAsD,CAAA;AACxD,CAAC,EApBW,mBAAmB,KAAnB,mBAAmB,QAoB9B;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,gBAAgB,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAa,CAAC,GAAG,CAAC,CAAC;AAE3C;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\n/**\n * Current version of the `@azure/identity` package.\n */\nexport const SDK_VERSION = `4.13.3`;\n\n/**\n * The default client ID for authentication\n * @internal\n */\n// TODO: temporary - this is the Azure CLI clientID - we'll replace it when\n// Developer Sign On application is available\n// https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/Constants.cs#L9\nexport const DeveloperSignOnClientId = \"04b07795-8ddb-461a-bbee-02f9e1bf7b46\";\n\n/**\n * The default tenant for authentication\n * @internal\n */\nexport const DefaultTenantId = \"common\";\n\n/**\n * A list of known Azure authority hosts\n */\nexport enum AzureAuthorityHosts {\n  /**\n   * China-based Azure Authority Host\n   */\n  AzureChina = \"https://login.chinacloudapi.cn\",\n  /**\n   * Germany-based Azure Authority Host\n   *\n   * @deprecated Microsoft Cloud Germany was closed on October 29th, 2021.\n   *\n   * */\n  AzureGermany = \"https://login.microsoftonline.de\",\n  /**\n   * US Government Azure Authority Host\n   */\n  AzureGovernment = \"https://login.microsoftonline.us\",\n  /**\n   * Public Cloud Azure Authority Host\n   */\n  AzurePublicCloud = \"https://login.microsoftonline.com\",\n}\n\n/**\n * @internal\n * The default authority host.\n */\nexport const DefaultAuthorityHost = AzureAuthorityHosts.AzurePublicCloud;\n\n/**\n * @internal\n * The default environment host for Azure Public Cloud\n */\nexport const DefaultAuthority = \"login.microsoftonline.com\";\n\n/**\n * @internal\n * Allow acquiring tokens for any tenant for multi-tentant auth.\n */\nexport const ALL_TENANTS: string[] = [\"*\"];\n\n/**\n * @internal\n */\nexport const CACHE_CAE_SUFFIX = \"cae\";\n\n/**\n * @internal\n */\nexport const CACHE_NON_CAE_SUFFIX = \"nocae\";\n\n/**\n * @internal\n *\n * The default name for the cache persistence plugin.\n * Matches the constant defined in the cache persistence package.\n */\nexport const DEFAULT_TOKEN_CACHE_NAME = \"msal.cache\";\n"]}

package/dist/esm/credentials/azurePipelinesCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"azurePipelinesCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azurePipelinesCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAItF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAG5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAQlE;;;GAGG;AACH,qBAAa,wBAAyB,YAAW,eAAe;IAC9D,OAAO,CAAC,yBAAyB,CAAwC;IACzE,OAAO,CAAC,cAAc,CAAiB;IAEvC;;;;;;;OAOG;gBAED,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,mBAAmB,EAAE,MAAM,EAC3B,iBAAiB,EAAE,MAAM,EACzB,OAAO,GAAE,+BAAoC;IAwD/C;;;;;;;OAOG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC;IAgBvB;;;;;OAKG;YACW,gBAAgB;CAmB/B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CA6CrE"}
+{"version":3,"file":"azurePipelinesCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azurePipelinesCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAItF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAG5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAQlE;;;GAGG;AACH,qBAAa,wBAAyB,YAAW,eAAe;IAC9D,OAAO,CAAC,yBAAyB,CAAwC;IACzE,OAAO,CAAC,cAAc,CAAiB;IAEvC;;;;;;;OAOG;gBAED,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,mBAAmB,EAAE,MAAM,EAC3B,iBAAiB,EAAE,MAAM,EACzB,OAAO,GAAE,+BAAoC;IAwD/C;;;;;;;OAOG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC;IAgBvB;;;;;OAKG;YACW,gBAAgB;CAmB/B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAyCrE"}

package/dist/esm/credentials/azurePipelinesCredential.js

@@ -105,11 +105,12 @@ export class AzurePipelinesCredential {
 export function handleOidcResponse(response) {
     // OIDC token is present in `bodyAsText` field
     const text = response.bodyAsText;
+    const responseDetails = stringifyOidcResponse(response);
     if (!text) {
-        logger.error(`${credentialName}: Authentication Failed. Received null token from OIDC request. Response status- ${response.status}. Complete response - ${JSON.stringify(response)}`);
+        logger.error(`${credentialName}: Authentication Failed. Received null token from OIDC request. Response status- ${response.status}. Complete response - ${responseDetails}`);
         throw new AuthenticationError(response.status, {
             error: `${credentialName}: Authentication Failed. Received null token from OIDC request.`,
-            error_description: `${JSON.stringify(response)}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,
+            error_description: `Complete response - ${responseDetails}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,
         });
     }
     try {
@@ -121,7 +122,7 @@ export function handleOidcResponse(response) {
             const errorMessage = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;
             let errorDescription = ``;
             if (response.status !== 200) {
-                errorDescription = `Response body = ${text}. Response Headers ["x-vss-e2eid"] = ${response.headers.get("x-vss-e2eid")} and ["x-msedge-ref"] = ${response.headers.get("x-msedge-ref")}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;
+                errorDescription = `${responseDetails}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;
             }
             logger.error(errorMessage);
             logger.error(errorDescription);
@@ -133,13 +134,22 @@ export function handleOidcResponse(response) {
     }
     catch (e) {
         const errorDetails = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;
-        logger.error(`Response from service = ${text}, Response Headers ["x-vss-e2eid"] = ${response.headers.get("x-vss-e2eid")} 
-      and ["x-msedge-ref"] = ${response.headers.get("x-msedge-ref")}, error message = ${e.message}`);
+        logger.error(`Response from service = ${responseDetails}, error message = ${e.message}`);
         logger.error(errorDetails);
         throw new AuthenticationError(response.status, {
             error: errorDetails,
-            error_description: `Response = ${text}. Response headers ["x-vss-e2eid"] = ${response.headers.get("x-vss-e2eid")} and ["x-msedge-ref"] =  ${response.headers.get("x-msedge-ref")}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,
+            error_description: `Response from service = ${responseDetails}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,
         });
     }
 }
+function stringifyOidcResponse(response) {
+    return JSON.stringify({
+        status: response.status,
+        bodyAsText: response.bodyAsText,
+        headers: {
+            "x-vss-e2eid": response.headers.get("x-vss-e2eid"),
+            "x-msedge-ref": response.headers.get("x-msedge-ref"),
+        },
+    });
+}
 //# sourceMappingURL=azurePipelinesCredential.js.map

package/dist/esm/credentials/azurePipelinesCredential.js.map

@@ -1 +1 @@
-{"version":3,"file":"azurePipelinesCredential.js","sourceRoot":"","sources":["../../../src/credentials/azurePipelinesCredential.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;AAChD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IAC3B,yBAAyB,CAAwC;IACjE,cAAc,CAAiB;IAEvC;;;;;;;OAOG;IACH,YACE,QAAgB,EAChB,QAAgB,EAChB,mBAA2B,EAC3B,iBAAyB,EACzB,UAA2C,EAAE;QAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,qDAAqD,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,qDAAqD,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,gEAAgE,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,8DAA8D,CAChF,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,OAAO,CAAC,cAAc,GAAG;YACvB,GAAG,OAAO,EAAE,cAAc;YAC1B,4BAA4B,EAAE;gBAC5B,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;gBAC/D,aAAa;gBACb,cAAc;aACf;SACF,CAAC;QAEF,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,qDAAqD,QAAQ,gBAAgB,QAAQ,gCAAgC,mBAAmB,EAAE,CAC3I,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;YACvC,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,mKAAmK,CACrL,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,gBAAgB,gBAAgB,wBAAwB,mBAAmB,EAAE,CAAC;QACzI,MAAM,CAAC,IAAI,CACT,sDAAsD,QAAQ,gBAAgB,QAAQ,+BAA+B,mBAAmB,EAAE,CAC3I,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,yBAAyB,CAC5D,QAAQ,EACR,QAAQ,EACR,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,iBAAiB,CAAC,EACnE,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAyB,EACzB,OAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,GAAG,cAAc;;;;;;iIAMqF,CAAC;YAC5H,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3B,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAC5B,cAAsB,EACtB,iBAAyB;QAEzB,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,qBAAqB,CAAC;YACpC,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iBAAiB,CAAC;gBACzB,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,iBAAiB,EAAE;gBAC5C,iGAAiG;gBACjG,uBAAuB,EAAE,UAAU;aACpC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,QAA0B;IAC3D,8CAA8C;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,CACV,GAAG,cAAc,oFACf,QAAQ,CAAC,MACX,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CACpD,CAAC;QACF,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7C,KAAK,EAAE,GAAG,cAAc,iEAAiE;YACzF,iBAAiB,EAAE,GAAG,IAAI,CAAC,SAAS,CAClC,QAAQ,CACT,8HAA8H;SAChI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,GAAG,cAAc,wEAAwE,CAAC;YAC/G,IAAI,gBAAgB,GAAG,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,mBAAmB,IAAI,wCAAwC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,2BAA2B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,8HAA8H,CAAC;YACrT,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC/B,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAC7C,KAAK,EAAE,YAAY;gBACnB,iBAAiB,EAAE,gBAAgB;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,GAAG,cAAc,wEAAwE,CAAC;QAC/G,MAAM,CAAC,KAAK,CACV,2BAA2B,IAAI,wCAAwC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;+BACjF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAC9F,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7C,KAAK,EAAE,YAAY;YACnB,iBAAiB,EAAE,cAAc,IAAI,wCAAwC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,4BAA4B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,8HAA8H;SAC/S,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { AuthenticationError, CredentialUnavailableError } from \"../errors.js\";\nimport { createHttpHeaders, createPipelineRequest } from \"@azure/core-rest-pipeline\";\n\nimport type { AzurePipelinesCredentialOptions } from \"./azurePipelinesCredentialOptions.js\";\nimport { ClientAssertionCredential } from \"#platform/credentials/clientAssertionCredential\";\nimport { IdentityClient } from \"../client/identityClient.js\";\nimport type { PipelineResponse } from \"@azure/core-rest-pipeline\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { credentialLogger } from \"../util/logging.js\";\n\nconst credentialName = \"AzurePipelinesCredential\";\nconst logger = credentialLogger(credentialName);\nconst OIDC_API_VERSION = \"7.1\";\n\n/**\n * This credential is designed to be used in Azure Pipelines with service connections\n * as a setup for workload identity federation.\n */\nexport class AzurePipelinesCredential implements TokenCredential {\n  private clientAssertionCredential: ClientAssertionCredential | undefined;\n  private identityClient: IdentityClient;\n\n  /**\n   * AzurePipelinesCredential supports Federated Identity on Azure Pipelines through Service Connections.\n   * @param tenantId - tenantId associated with the service connection\n   * @param clientId - clientId associated with the service connection\n   * @param serviceConnectionId - Unique ID for the service connection, as found in the querystring's resourceId key\n   * @param systemAccessToken - The pipeline's <see href=\"https://learn.microsoft.com/azure/devops/pipelines/build/variables?view=azure-devops%26tabs=yaml#systemaccesstoken\">System.AccessToken</see> value.\n   * @param options - The identity client options to use for authentication.\n   */\n  constructor(\n    tenantId: string,\n    clientId: string,\n    serviceConnectionId: string,\n    systemAccessToken: string,\n    options: AzurePipelinesCredentialOptions = {},\n  ) {\n    if (!clientId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. clientId is a required parameter.`,\n      );\n    }\n    if (!tenantId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. tenantId is a required parameter.`,\n      );\n    }\n    if (!serviceConnectionId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. serviceConnectionId is a required parameter.`,\n      );\n    }\n    if (!systemAccessToken) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. systemAccessToken is a required parameter.`,\n      );\n    }\n\n    // Allow these headers to be logged for troubleshooting by AzurePipelines.\n    options.loggingOptions = {\n      ...options?.loggingOptions,\n      additionalAllowedHeaderNames: [\n        ...(options.loggingOptions?.additionalAllowedHeaderNames ?? []),\n        \"x-vss-e2eid\",\n        \"x-msedge-ref\",\n      ],\n    };\n\n    this.identityClient = new IdentityClient(options);\n    checkTenantId(logger, tenantId);\n    logger.info(\n      `Invoking AzurePipelinesCredential with tenant ID: ${tenantId}, client ID: ${clientId}, and service connection ID: ${serviceConnectionId}`,\n    );\n    if (!process.env.SYSTEM_OIDCREQUESTURI) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. Ensure that you're running this task in an Azure Pipeline, so that following missing system variable(s) can be defined- \"SYSTEM_OIDCREQUESTURI\"`,\n      );\n    }\n\n    const oidcRequestUrl = `${process.env.SYSTEM_OIDCREQUESTURI}?api-version=${OIDC_API_VERSION}&serviceConnectionId=${serviceConnectionId}`;\n    logger.info(\n      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, client ID: ${clientId} and service connection ID: ${serviceConnectionId}`,\n    );\n    this.clientAssertionCredential = new ClientAssertionCredential(\n      tenantId,\n      clientId,\n      this.requestOidcToken.bind(this, oidcRequestUrl, systemAccessToken),\n      options,\n    );\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} or {@link AuthenticationError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options?: GetTokenOptions,\n  ): Promise<AccessToken> {\n    if (!this.clientAssertionCredential) {\n      const errorMessage = `${credentialName}: is unavailable. To use Federation Identity in Azure Pipelines, the following parameters are required - \n      tenantId,\n      clientId,\n      serviceConnectionId,\n      systemAccessToken,\n      \"SYSTEM_OIDCREQUESTURI\".      \n      See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;\n      logger.error(errorMessage);\n      throw new CredentialUnavailableError(errorMessage);\n    }\n    logger.info(\"Invoking getToken() of Client Assertion Credential\");\n    return this.clientAssertionCredential.getToken(scopes, options);\n  }\n\n  /**\n   *\n   * @param oidcRequestUrl - oidc request url\n   * @param systemAccessToken - system access token\n   * @returns OIDC token from Azure Pipelines\n   */\n  private async requestOidcToken(\n    oidcRequestUrl: string,\n    systemAccessToken: string,\n  ): Promise<string> {\n    logger.info(\"Requesting OIDC token from Azure Pipelines...\");\n    logger.info(oidcRequestUrl);\n    const request = createPipelineRequest({\n      url: oidcRequestUrl,\n      method: \"POST\",\n      headers: createHttpHeaders({\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${systemAccessToken}`,\n        // Prevents the service from responding with a redirect HTTP status code (useful for automation).\n        \"X-TFS-FedAuthRedirect\": \"Suppress\",\n      }),\n    });\n    const response = await this.identityClient.sendRequest(request);\n    return handleOidcResponse(response);\n  }\n}\n\nexport function handleOidcResponse(response: PipelineResponse): string {\n  // OIDC token is present in `bodyAsText` field\n  const text = response.bodyAsText;\n  if (!text) {\n    logger.error(\n      `${credentialName}: Authentication Failed. Received null token from OIDC request. Response status- ${\n        response.status\n      }. Complete response - ${JSON.stringify(response)}`,\n    );\n    throw new AuthenticationError(response.status, {\n      error: `${credentialName}: Authentication Failed. Received null token from OIDC request.`,\n      error_description: `${JSON.stringify(\n        response,\n      )}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,\n    });\n  }\n  try {\n    const result = JSON.parse(text);\n    if (result?.oidcToken) {\n      return result.oidcToken;\n    } else {\n      const errorMessage = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;\n      let errorDescription = ``;\n      if (response.status !== 200) {\n        errorDescription = `Response body = ${text}. Response Headers [\"x-vss-e2eid\"] = ${response.headers.get(\"x-vss-e2eid\")} and [\"x-msedge-ref\"] = ${response.headers.get(\"x-msedge-ref\")}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;\n      }\n      logger.error(errorMessage);\n      logger.error(errorDescription);\n      throw new AuthenticationError(response.status, {\n        error: errorMessage,\n        error_description: errorDescription,\n      });\n    }\n  } catch (e: any) {\n    const errorDetails = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;\n    logger.error(\n      `Response from service = ${text}, Response Headers [\"x-vss-e2eid\"] = ${response.headers.get(\"x-vss-e2eid\")} \n      and [\"x-msedge-ref\"] = ${response.headers.get(\"x-msedge-ref\")}, error message = ${e.message}`,\n    );\n    logger.error(errorDetails);\n    throw new AuthenticationError(response.status, {\n      error: errorDetails,\n      error_description: `Response = ${text}. Response headers [\"x-vss-e2eid\"] = ${response.headers.get(\"x-vss-e2eid\")} and [\"x-msedge-ref\"] =  ${response.headers.get(\"x-msedge-ref\")}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,\n    });\n  }\n}\n"]}
+{"version":3,"file":"azurePipelinesCredential.js","sourceRoot":"","sources":["../../../src/credentials/azurePipelinesCredential.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;AAChD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IAC3B,yBAAyB,CAAwC;IACjE,cAAc,CAAiB;IAEvC;;;;;;;OAOG;IACH,YACE,QAAgB,EAChB,QAAgB,EAChB,mBAA2B,EAC3B,iBAAyB,EACzB,UAA2C,EAAE;QAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,qDAAqD,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,qDAAqD,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,gEAAgE,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,8DAA8D,CAChF,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,OAAO,CAAC,cAAc,GAAG;YACvB,GAAG,OAAO,EAAE,cAAc;YAC1B,4BAA4B,EAAE;gBAC5B,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;gBAC/D,aAAa;gBACb,cAAc;aACf;SACF,CAAC;QAEF,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,qDAAqD,QAAQ,gBAAgB,QAAQ,gCAAgC,mBAAmB,EAAE,CAC3I,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;YACvC,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,mKAAmK,CACrL,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,gBAAgB,gBAAgB,wBAAwB,mBAAmB,EAAE,CAAC;QACzI,MAAM,CAAC,IAAI,CACT,sDAAsD,QAAQ,gBAAgB,QAAQ,+BAA+B,mBAAmB,EAAE,CAC3I,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,yBAAyB,CAC5D,QAAQ,EACR,QAAQ,EACR,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,iBAAiB,CAAC,EACnE,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAyB,EACzB,OAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,GAAG,cAAc;;;;;;iIAMqF,CAAC;YAC5H,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3B,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAC5B,cAAsB,EACtB,iBAAyB;QAEzB,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,qBAAqB,CAAC;YACpC,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iBAAiB,CAAC;gBACzB,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,iBAAiB,EAAE;gBAC5C,iGAAiG;gBACjG,uBAAuB,EAAE,UAAU;aACpC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,QAA0B;IAC3D,8CAA8C;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC;IACjC,MAAM,eAAe,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,CACV,GAAG,cAAc,oFACf,QAAQ,CAAC,MACX,yBAAyB,eAAe,EAAE,CAC3C,CAAC;QACF,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7C,KAAK,EAAE,GAAG,cAAc,iEAAiE;YACzF,iBAAiB,EAAE,uBAAuB,eAAe,8HAA8H;SACxL,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,GAAG,cAAc,wEAAwE,CAAC;YAC/G,IAAI,gBAAgB,GAAG,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,GAAG,eAAe,8HAA8H,CAAC;YACtK,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC/B,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAC7C,KAAK,EAAE,YAAY;gBACnB,iBAAiB,EAAE,gBAAgB;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,GAAG,cAAc,wEAAwE,CAAC;QAC/G,MAAM,CAAC,KAAK,CAAC,2BAA2B,eAAe,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7C,KAAK,EAAE,YAAY;YACnB,iBAAiB,EAAE,2BAA2B,eAAe,8HAA8H;SAC5L,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA0B;IACvD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE;YACP,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAClD,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;SACrD;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { AuthenticationError, CredentialUnavailableError } from \"../errors.js\";\nimport { createHttpHeaders, createPipelineRequest } from \"@azure/core-rest-pipeline\";\n\nimport type { AzurePipelinesCredentialOptions } from \"./azurePipelinesCredentialOptions.js\";\nimport { ClientAssertionCredential } from \"#platform/credentials/clientAssertionCredential\";\nimport { IdentityClient } from \"../client/identityClient.js\";\nimport type { PipelineResponse } from \"@azure/core-rest-pipeline\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { credentialLogger } from \"../util/logging.js\";\n\nconst credentialName = \"AzurePipelinesCredential\";\nconst logger = credentialLogger(credentialName);\nconst OIDC_API_VERSION = \"7.1\";\n\n/**\n * This credential is designed to be used in Azure Pipelines with service connections\n * as a setup for workload identity federation.\n */\nexport class AzurePipelinesCredential implements TokenCredential {\n  private clientAssertionCredential: ClientAssertionCredential | undefined;\n  private identityClient: IdentityClient;\n\n  /**\n   * AzurePipelinesCredential supports Federated Identity on Azure Pipelines through Service Connections.\n   * @param tenantId - tenantId associated with the service connection\n   * @param clientId - clientId associated with the service connection\n   * @param serviceConnectionId - Unique ID for the service connection, as found in the querystring's resourceId key\n   * @param systemAccessToken - The pipeline's <see href=\"https://learn.microsoft.com/azure/devops/pipelines/build/variables?view=azure-devops%26tabs=yaml#systemaccesstoken\">System.AccessToken</see> value.\n   * @param options - The identity client options to use for authentication.\n   */\n  constructor(\n    tenantId: string,\n    clientId: string,\n    serviceConnectionId: string,\n    systemAccessToken: string,\n    options: AzurePipelinesCredentialOptions = {},\n  ) {\n    if (!clientId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. clientId is a required parameter.`,\n      );\n    }\n    if (!tenantId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. tenantId is a required parameter.`,\n      );\n    }\n    if (!serviceConnectionId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. serviceConnectionId is a required parameter.`,\n      );\n    }\n    if (!systemAccessToken) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. systemAccessToken is a required parameter.`,\n      );\n    }\n\n    // Allow these headers to be logged for troubleshooting by AzurePipelines.\n    options.loggingOptions = {\n      ...options?.loggingOptions,\n      additionalAllowedHeaderNames: [\n        ...(options.loggingOptions?.additionalAllowedHeaderNames ?? []),\n        \"x-vss-e2eid\",\n        \"x-msedge-ref\",\n      ],\n    };\n\n    this.identityClient = new IdentityClient(options);\n    checkTenantId(logger, tenantId);\n    logger.info(\n      `Invoking AzurePipelinesCredential with tenant ID: ${tenantId}, client ID: ${clientId}, and service connection ID: ${serviceConnectionId}`,\n    );\n    if (!process.env.SYSTEM_OIDCREQUESTURI) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. Ensure that you're running this task in an Azure Pipeline, so that following missing system variable(s) can be defined- \"SYSTEM_OIDCREQUESTURI\"`,\n      );\n    }\n\n    const oidcRequestUrl = `${process.env.SYSTEM_OIDCREQUESTURI}?api-version=${OIDC_API_VERSION}&serviceConnectionId=${serviceConnectionId}`;\n    logger.info(\n      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, client ID: ${clientId} and service connection ID: ${serviceConnectionId}`,\n    );\n    this.clientAssertionCredential = new ClientAssertionCredential(\n      tenantId,\n      clientId,\n      this.requestOidcToken.bind(this, oidcRequestUrl, systemAccessToken),\n      options,\n    );\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} or {@link AuthenticationError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options?: GetTokenOptions,\n  ): Promise<AccessToken> {\n    if (!this.clientAssertionCredential) {\n      const errorMessage = `${credentialName}: is unavailable. To use Federation Identity in Azure Pipelines, the following parameters are required - \n      tenantId,\n      clientId,\n      serviceConnectionId,\n      systemAccessToken,\n      \"SYSTEM_OIDCREQUESTURI\".      \n      See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;\n      logger.error(errorMessage);\n      throw new CredentialUnavailableError(errorMessage);\n    }\n    logger.info(\"Invoking getToken() of Client Assertion Credential\");\n    return this.clientAssertionCredential.getToken(scopes, options);\n  }\n\n  /**\n   *\n   * @param oidcRequestUrl - oidc request url\n   * @param systemAccessToken - system access token\n   * @returns OIDC token from Azure Pipelines\n   */\n  private async requestOidcToken(\n    oidcRequestUrl: string,\n    systemAccessToken: string,\n  ): Promise<string> {\n    logger.info(\"Requesting OIDC token from Azure Pipelines...\");\n    logger.info(oidcRequestUrl);\n    const request = createPipelineRequest({\n      url: oidcRequestUrl,\n      method: \"POST\",\n      headers: createHttpHeaders({\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${systemAccessToken}`,\n        // Prevents the service from responding with a redirect HTTP status code (useful for automation).\n        \"X-TFS-FedAuthRedirect\": \"Suppress\",\n      }),\n    });\n    const response = await this.identityClient.sendRequest(request);\n    return handleOidcResponse(response);\n  }\n}\n\nexport function handleOidcResponse(response: PipelineResponse): string {\n  // OIDC token is present in `bodyAsText` field\n  const text = response.bodyAsText;\n  const responseDetails = stringifyOidcResponse(response);\n  if (!text) {\n    logger.error(\n      `${credentialName}: Authentication Failed. Received null token from OIDC request. Response status- ${\n        response.status\n      }. Complete response - ${responseDetails}`,\n    );\n    throw new AuthenticationError(response.status, {\n      error: `${credentialName}: Authentication Failed. Received null token from OIDC request.`,\n      error_description: `Complete response - ${responseDetails}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,\n    });\n  }\n  try {\n    const result = JSON.parse(text);\n    if (result?.oidcToken) {\n      return result.oidcToken;\n    } else {\n      const errorMessage = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;\n      let errorDescription = ``;\n      if (response.status !== 200) {\n        errorDescription = `${responseDetails}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;\n      }\n      logger.error(errorMessage);\n      logger.error(errorDescription);\n      throw new AuthenticationError(response.status, {\n        error: errorMessage,\n        error_description: errorDescription,\n      });\n    }\n  } catch (e: any) {\n    const errorDetails = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;\n    logger.error(`Response from service = ${responseDetails}, error message = ${e.message}`);\n    logger.error(errorDetails);\n    throw new AuthenticationError(response.status, {\n      error: errorDetails,\n      error_description: `Response from service = ${responseDetails}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,\n    });\n  }\n}\n\nfunction stringifyOidcResponse(response: PipelineResponse): string {\n  return JSON.stringify({\n    status: response.status,\n    bodyAsText: response.bodyAsText,\n    headers: {\n      \"x-vss-e2eid\": response.headers.get(\"x-vss-e2eid\"),\n      \"x-msedge-ref\": response.headers.get(\"x-msedge-ref\"),\n    },\n  });\n}\n"]}

package/dist/esm/credentials/azurePowerShellCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"azurePowerShellCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azurePowerShellCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAStF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAgB9F;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,MAAM,CAAC,UAAU,CASnB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAMzD;AA4BD;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;CAI5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;CAOzC,CAAC;AAUF;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAA0B,CAAC;AAMpD;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,eAAe;IAC/D,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,OAAO,CAAC,CAAS;IAEzB;;;;;;;;;;OAUG;gBACS,OAAO,CAAC,EAAE,gCAAgC;IAWtD;;;OAGG;YACW,6BAA6B;IA6E3C;;;;;;OAMG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,CAAC;CA0DxB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB/C"}
+{"version":3,"file":"azurePowerShellCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azurePowerShellCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAStF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAgB9F;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,MAAM,CAAC,UAAU,CASnB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAMzD;AA4BD;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;CAI5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;CAOzC,CAAC;AAUF;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAA0B,CAAC;AAMpD;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,eAAe;IAC/D,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,OAAO,CAAC,CAAS;IAEzB;;;;;;;;;;OAUG;gBACS,OAAO,CAAC,EAAE,gCAAgC;IAWtD;;;OAGG;YACW,6BAA6B;IA6E3C;;;;;;OAMG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,CAAC;CA0DxB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B/C"}

package/dist/esm/credentials/azurePowerShellCredential.js

@@ -270,7 +270,9 @@ export async function parseJsonToken(result) {
             }
         }
         catch (e) {
-            throw new Error(`Unable to parse the output of PowerShell. Received output: ${result}`);
+            throw new Error(`Unable to parse the output of PowerShell. Received output: ${result}`, {
+                cause: e,
+            });
         }
     }
     throw new Error(`No access token found in the output. Received output: ${result}`);

package/dist/esm/credentials/azurePowerShellCredential.js.map

@@ -1 +1 @@
-{"version":3,"file":"azurePowerShellCredential.js","sourceRoot":"","sources":["../../../src/credentials/azurePowerShellCredential.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAGlC,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;AAE7D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAC/C,MAAM,qCAAqC,GAAG,oCAAoC,CAAC;AACnF,MAAM,mCAAmC,GAAG,qCAAqC,CAAC;AAClF,MAAM,qCAAqC,GAAG,IAAI,GAAG,CACnD,CAAC,qCAAqC,EAAE,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxF,IAAI,CAAC,WAAW,EAAE,CACnB,CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,QAA4B,EAC5B,cAAiC,OAAO,CAAC,GAAG;IAE5C,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACzC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAChC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,qCAAqC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC3E,CACF,CAAC;IACF,gBAAgB,CAAC,qCAAqC,CAAC,GAAG,QAAQ,CAAC;IACnE,gBAAgB,CAAC,mCAAmC,CAAC,GAAG,QAAQ,IAAI,EAAE,CAAC;IACvE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,GAAG,WAAW,MAAM,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,QAAoB,EACpB,OAAgB,EAChB,GAAuB;IAEvB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;YAC3D,QAAQ,EAAE,MAAM;YAChB,GAAG;YACH,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK,EAAE,gCAAgC;IACvC,SAAS,EACP,uIAAuI;CAC1I,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,KAAK,EACH,8FAA8F;IAChG,SAAS,EAAE,4KAA4K;IACvL,KAAK,EACH,gIAAgI;IAClI,YAAY,EAAE,4FAA4F;CAC3G,CAAC;AAEF,mDAAmD;AACnD,MAAM,YAAY,GAA4C,CAAC,GAAU,EAAE,EAAE,CAC3E,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,KAAK,MAAM,CAAC,CAAC;AAEzD,qDAAqD;AACrD,MAAM,mBAAmB,GAA4C,CAAC,GAAU,EAAE,EAAE,CAClF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpD,IAAI,SAAS,EAAE,CAAC;IACd,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAC5B,QAAQ,CAAU;IAClB,4BAA4B,CAAW;IACvC,OAAO,CAAU;IAEzB;;;;;;;;;;OAUG;IACH,YAAY,OAA0C;QACpD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,4BAA4B,GAAG,mCAAmC,CACrE,OAAO,EAAE,0BAA0B,CACpC,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,kBAAkB,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,6BAA6B,CACzC,QAAgB,EAChB,QAAiB,EACjB,OAAgB;QAEhB,uDAAuD;QACvD,KAAK,MAAM,iBAAiB,IAAI,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,gFAAgF;gBAChF,YAAY,CAAC,KAAK,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B;gBACE;oBACE,iBAAiB;oBACjB,YAAY;oBACZ,iBAAiB;oBACjB,UAAU;oBACV;6BACiB,mCAAmC;6BACnC,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAwCvD;iBACA;aACF,EACD,OAAO,EACP,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAChD,CAAC;YAEF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAyB,EACzB,UAA2B,EAAE;QAE7B,OAAO,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAE9D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YACnC,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxC,IAAI,QAAQ,GAAG,sCAAsC,aAAa,EAAE,CAAC;gBAErE,MAAM,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;gBAC7C,IAAI,mBAAmB,EAAE,CAAC;oBACxB,QAAQ,IAAI,YAAY,mBAAmB,EAAE,CAAC;gBAChD,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAC1C,GAAG,6BAA6B,CAAC,KAAK,IAAI,QAAQ,EAAE,CACrD,CAAC;gBAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,yBAAyB,CACxC,IAAI,CAAC,QAAQ,EACb,OAAO,EACP,IAAI,CAAC,4BAA4B,CAClC,CAAC;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,CAAC;gBACH,+BAA+B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5C,OAAO;oBACL,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,kBAAkB,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;oBAC1D,SAAS,EAAE,QAAQ;iBACL,CAAC;YACnB,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACtF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBAChD,MAAM,KAAK,CAAC;gBACd,CAAC;qBAAM,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC;oBAClF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBAChD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAC1C,GAAG,GAAG,KAAK,6BAA6B,CAAC,YAAY,EAAE,CACxD,CAAC;gBACF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc;IAEd,MAAM,SAAS,GAAG,WAAW,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,kBAAkB,GAAG,MAAM,CAAC;IAChC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrC,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC;wBACvB,kBAAkB,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC1D,IAAI,kBAAkB,EAAE,CAAC;4BACvB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;wBAC9C,CAAC;wBACD,OAAO,WAAW,CAAC;oBACrB,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,8DAA8D,MAAM,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport { ensureValidScopeForDevTimeCreds, getScopeResource } from \"../util/scopeUtils.js\";\n\nimport type { AzurePowerShellCredentialOptions } from \"./azurePowerShellCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport { processUtils } from \"../util/processUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\n\nconst logger = credentialLogger(\"AzurePowerShellCredential\");\n\nconst isWindows = process.platform === \"win32\";\nconst powerShellResourceEnvironmentVariable = \"AZURE_IDENTITY_POWERSHELL_RESOURCE\";\nconst powerShellTenantEnvironmentVariable = \"AZURE_IDENTITY_POWERSHELL_TENANT_ID\";\nconst powerShellPrivateEnvironmentVariables = new Set(\n  [powerShellResourceEnvironmentVariable, powerShellTenantEnvironmentVariable].map((name) =>\n    name.toLowerCase(),\n  ),\n);\n\n/**\n * Creates the child environment used to pass private values to PowerShell.\n *\n * @param resource - The resource passed to PowerShell.\n * @param tenantId - The optional tenant ID passed to PowerShell.\n * @param environment - The environment to copy.\n * @returns A child environment containing canonical private variable names.\n * @internal\n */\nexport function createPowerShellEnvironment(\n  resource: string,\n  tenantId: string | undefined,\n  environment: NodeJS.ProcessEnv = process.env,\n): NodeJS.ProcessEnv {\n  const childEnvironment = Object.fromEntries(\n    Object.entries(environment).filter(\n      ([name]) => !powerShellPrivateEnvironmentVariables.has(name.toLowerCase()),\n    ),\n  );\n  childEnvironment[powerShellResourceEnvironmentVariable] = resource;\n  childEnvironment[powerShellTenantEnvironmentVariable] = tenantId ?? \"\";\n  return childEnvironment;\n}\n\n/**\n * Returns a platform-appropriate command name by appending \".exe\" on Windows.\n *\n * @internal\n */\nexport function formatCommand(commandName: string): string {\n  if (isWindows) {\n    return `${commandName}.exe`;\n  } else {\n    return commandName;\n  }\n}\n\n/**\n * Receives a list of commands to run, executes them, then returns the outputs.\n * If anything fails, an error is thrown.\n * @internal\n */\nasync function runCommands(\n  commands: string[][],\n  timeout?: number,\n  env?: NodeJS.ProcessEnv,\n): Promise<string[]> {\n  const results: string[] = [];\n\n  for (const command of commands) {\n    const [file, ...parameters] = command;\n    const result = await processUtils.execFile(file, parameters, {\n      encoding: \"utf8\",\n      env,\n      timeout,\n    });\n\n    results.push(result);\n  }\n\n  return results;\n}\n\n/**\n * Known PowerShell errors\n * @internal\n */\nexport const powerShellErrors = {\n  login: \"Run Connect-AzAccount to login\",\n  installed:\n    \"The specified module 'Az.Accounts' with version '2.2.0' was not loaded because no valid module file was found in any module directory\",\n};\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const powerShellPublicErrorMessages = {\n  login:\n    \"Please run 'Connect-AzAccount' from PowerShell to authenticate before using this credential.\",\n  installed: `The 'Az.Account' module >= 2.2.0 is not installed. Install the Azure Az PowerShell module with: \"Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force\".`,\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n  troubleshoot: `To troubleshoot, visit https://aka.ms/azsdk/js/identity/powershellcredential/troubleshoot.`,\n};\n\n// PowerShell Azure User not logged in error check.\nconst isLoginError: (err: Error) => RegExpMatchArray | null = (err: Error) =>\n  err.message.match(`(.*)${powerShellErrors.login}(.*)`);\n\n// Az Module not Installed in Azure PowerShell check.\nconst isNotInstalledError: (err: Error) => RegExpMatchArray | null = (err: Error) =>\n  err.message.match(powerShellErrors.installed);\n\n/**\n * The PowerShell commands to be tried, in order.\n *\n * @internal\n */\nexport const commandStack = [formatCommand(\"pwsh\")];\n\nif (isWindows) {\n  commandStack.push(formatCommand(\"powershell\"));\n}\n\n/**\n * This credential will use the currently logged-in user information from the\n * Azure PowerShell module. To do so, it will read the user access token and\n * expire time with Azure PowerShell command `Get-AzAccessToken -ResourceUrl {ResourceScope}`\n */\nexport class AzurePowerShellCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n\n  /**\n   * Creates an instance of the {@link AzurePowerShellCredential}.\n   *\n   * To use this credential:\n   * - Install the Azure Az PowerShell module with:\n   *   `Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force`.\n   * - You have already logged in to Azure PowerShell using the command\n   * `Connect-AzAccount` from the command line.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzurePowerShellCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Gets the access token from Azure PowerShell\n   * @param resource - The resource to use when getting the token\n   */\n  private async getAzurePowerShellAccessToken(\n    resource: string,\n    tenantId?: string,\n    timeout?: number,\n  ): Promise<{ Token: string; ExpiresOn: string }> {\n    // Clone the stack to avoid mutating it while iterating\n    for (const powerShellCommand of [...commandStack]) {\n      try {\n        await runCommands([[powerShellCommand, \"/?\"]], timeout);\n      } catch (e: any) {\n        // Remove this credential from the original stack so that we don't try it again.\n        commandStack.shift();\n        continue;\n      }\n\n      const results = await runCommands(\n        [\n          [\n            powerShellCommand,\n            \"-NoProfile\",\n            \"-NonInteractive\",\n            \"-Command\",\n            `\n          $tenantId = $env:${powerShellTenantEnvironmentVariable}\n          $resource = $env:${powerShellResourceEnvironmentVariable}\n          $m = Import-Module Az.Accounts -MinimumVersion 2.2.0 -PassThru\n          $useSecureString = $m.Version -ge [version]'2.17.0' -and $m.Version -lt [version]'5.0.0'\n\n          $params = @{\n            ResourceUrl = $resource\n          }\n\n          if ($tenantId.Length -gt 0) {\n            $params[\"TenantId\"] = $tenantId\n          }\n\n          if ($useSecureString) {\n            $params[\"AsSecureString\"] = $true\n          }\n\n          $token = Get-AzAccessToken @params\n\n          $result = New-Object -TypeName PSObject\n          $result | Add-Member -MemberType NoteProperty -Name ExpiresOn -Value $token.ExpiresOn\n\n          if ($token.Token -is [System.Security.SecureString]) {\n            if ($PSVersionTable.PSVersion.Major -lt 7) {\n              $ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($token.Token)\n              try {\n                $result | Add-Member -MemberType NoteProperty -Name Token -Value ([System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr))\n              }\n              finally {\n                [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)\n              }\n            }\n            else {\n              $result | Add-Member -MemberType NoteProperty -Name Token -Value ($token.Token | ConvertFrom-SecureString -AsPlainText)\n            }\n          }\n          else {\n            $result | Add-Member -MemberType NoteProperty -Name Token -Value $token.Token\n          }\n\n          Write-Output (ConvertTo-Json $result)\n          `,\n          ],\n        ],\n        timeout,\n        createPowerShellEnvironment(resource, tenantId),\n      );\n\n      const result = results[0];\n      return parseJsonToken(result);\n    }\n    throw new Error(`Unable to execute PowerShell. Ensure that it is installed in your system`);\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If the authentication cannot be performed through PowerShell, a {@link CredentialUnavailableError} will be thrown.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      const scope = typeof scopes === \"string\" ? scopes : scopes[0];\n\n      const claimsValue = options.claims;\n      if (claimsValue && claimsValue.trim()) {\n        const encodedClaims = btoa(claimsValue);\n        let loginCmd = `Connect-AzAccount -ClaimsChallenge ${encodedClaims}`;\n\n        const tenantIdFromOptions = options.tenantId;\n        if (tenantIdFromOptions) {\n          loginCmd += ` -Tenant ${tenantIdFromOptions}`;\n        }\n        const error = new CredentialUnavailableError(\n          `${powerShellPublicErrorMessages.claim} ${loginCmd}`,\n        );\n\n        logger.getToken.info(formatError(scope, error));\n        throw error;\n      }\n\n      const tenantId = processMultiTenantRequest(\n        this.tenantId,\n        options,\n        this.additionallyAllowedTenantIds,\n      );\n      if (tenantId) {\n        checkTenantId(logger, tenantId);\n      }\n      try {\n        ensureValidScopeForDevTimeCreds(scope, logger);\n        logger.getToken.info(`Using the scope ${scope}`);\n        const resource = getScopeResource(scope);\n        const response = await this.getAzurePowerShellAccessToken(resource, tenantId, this.timeout);\n        logger.getToken.info(formatSuccess(scopes));\n        return {\n          token: response.Token,\n          expiresOnTimestamp: new Date(response.ExpiresOn).getTime(),\n          tokenType: \"Bearer\",\n        } as AccessToken;\n      } catch (err: any) {\n        if (isNotInstalledError(err)) {\n          const error = new CredentialUnavailableError(powerShellPublicErrorMessages.installed);\n          logger.getToken.info(formatError(scope, error));\n          throw error;\n        } else if (isLoginError(err)) {\n          const error = new CredentialUnavailableError(powerShellPublicErrorMessages.login);\n          logger.getToken.info(formatError(scope, error));\n          throw error;\n        }\n        const error = new CredentialUnavailableError(\n          `${err}. ${powerShellPublicErrorMessages.troubleshoot}`,\n        );\n        logger.getToken.info(formatError(scope, error));\n        throw error;\n      }\n    });\n  }\n}\n\n/**\n *\n * @internal\n */\nexport async function parseJsonToken(\n  result: string,\n): Promise<{ Token: string; ExpiresOn: string }> {\n  const jsonRegex = /{[^{}]*}/g;\n  const matches = result.match(jsonRegex);\n  let resultWithoutToken = result;\n  if (matches) {\n    try {\n      for (const item of matches) {\n        try {\n          const jsonContent = JSON.parse(item);\n          if (jsonContent?.Token) {\n            resultWithoutToken = resultWithoutToken.replace(item, \"\");\n            if (resultWithoutToken) {\n              logger.getToken.warning(resultWithoutToken);\n            }\n            return jsonContent;\n          }\n        } catch (e) {\n          continue;\n        }\n      }\n    } catch (e: any) {\n      throw new Error(`Unable to parse the output of PowerShell. Received output: ${result}`);\n    }\n  }\n  throw new Error(`No access token found in the output. Received output: ${result}`);\n}\n"]}
+{"version":3,"file":"azurePowerShellCredential.js","sourceRoot":"","sources":["../../../src/credentials/azurePowerShellCredential.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAGlC,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;AAE7D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAC/C,MAAM,qCAAqC,GAAG,oCAAoC,CAAC;AACnF,MAAM,mCAAmC,GAAG,qCAAqC,CAAC;AAClF,MAAM,qCAAqC,GAAG,IAAI,GAAG,CACnD,CAAC,qCAAqC,EAAE,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxF,IAAI,CAAC,WAAW,EAAE,CACnB,CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,QAA4B,EAC5B,cAAiC,OAAO,CAAC,GAAG;IAE5C,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACzC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAChC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,qCAAqC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC3E,CACF,CAAC;IACF,gBAAgB,CAAC,qCAAqC,CAAC,GAAG,QAAQ,CAAC;IACnE,gBAAgB,CAAC,mCAAmC,CAAC,GAAG,QAAQ,IAAI,EAAE,CAAC;IACvE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,GAAG,WAAW,MAAM,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,QAAoB,EACpB,OAAgB,EAChB,GAAuB;IAEvB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;YAC3D,QAAQ,EAAE,MAAM;YAChB,GAAG;YACH,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK,EAAE,gCAAgC;IACvC,SAAS,EACP,uIAAuI;CAC1I,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,KAAK,EACH,8FAA8F;IAChG,SAAS,EAAE,4KAA4K;IACvL,KAAK,EACH,gIAAgI;IAClI,YAAY,EAAE,4FAA4F;CAC3G,CAAC;AAEF,mDAAmD;AACnD,MAAM,YAAY,GAA4C,CAAC,GAAU,EAAE,EAAE,CAC3E,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,KAAK,MAAM,CAAC,CAAC;AAEzD,qDAAqD;AACrD,MAAM,mBAAmB,GAA4C,CAAC,GAAU,EAAE,EAAE,CAClF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpD,IAAI,SAAS,EAAE,CAAC;IACd,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAC5B,QAAQ,CAAU;IAClB,4BAA4B,CAAW;IACvC,OAAO,CAAU;IAEzB;;;;;;;;;;OAUG;IACH,YAAY,OAA0C;QACpD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,4BAA4B,GAAG,mCAAmC,CACrE,OAAO,EAAE,0BAA0B,CACpC,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,kBAAkB,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,6BAA6B,CACzC,QAAgB,EAChB,QAAiB,EACjB,OAAgB;QAEhB,uDAAuD;QACvD,KAAK,MAAM,iBAAiB,IAAI,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,gFAAgF;gBAChF,YAAY,CAAC,KAAK,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B;gBACE;oBACE,iBAAiB;oBACjB,YAAY;oBACZ,iBAAiB;oBACjB,UAAU;oBACV;6BACiB,mCAAmC;6BACnC,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAwCvD;iBACA;aACF,EACD,OAAO,EACP,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAChD,CAAC;YAEF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAyB,EACzB,UAA2B,EAAE;QAE7B,OAAO,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAE9D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YACnC,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxC,IAAI,QAAQ,GAAG,sCAAsC,aAAa,EAAE,CAAC;gBAErE,MAAM,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;gBAC7C,IAAI,mBAAmB,EAAE,CAAC;oBACxB,QAAQ,IAAI,YAAY,mBAAmB,EAAE,CAAC;gBAChD,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAC1C,GAAG,6BAA6B,CAAC,KAAK,IAAI,QAAQ,EAAE,CACrD,CAAC;gBAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,yBAAyB,CACxC,IAAI,CAAC,QAAQ,EACb,OAAO,EACP,IAAI,CAAC,4BAA4B,CAClC,CAAC;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,CAAC;gBACH,+BAA+B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5C,OAAO;oBACL,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,kBAAkB,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;oBAC1D,SAAS,EAAE,QAAQ;iBACL,CAAC;YACnB,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACtF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBAChD,MAAM,KAAK,CAAC;gBACd,CAAC;qBAAM,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC;oBAClF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBAChD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAC1C,GAAG,GAAG,KAAK,6BAA6B,CAAC,YAAY,EAAE,CACxD,CAAC;gBACF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc;IAEd,MAAM,SAAS,GAAG,WAAW,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,kBAAkB,GAAG,MAAM,CAAC;IAChC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrC,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC;wBACvB,kBAAkB,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC1D,IAAI,kBAAkB,EAAE,CAAC;4BACvB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;wBAC9C,CAAC;wBACD,OAAO,WAAW,CAAC;oBACrB,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,8DAA8D,MAAM,EAAE,EAAE;gBACtF,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport { ensureValidScopeForDevTimeCreds, getScopeResource } from \"../util/scopeUtils.js\";\n\nimport type { AzurePowerShellCredentialOptions } from \"./azurePowerShellCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport { processUtils } from \"../util/processUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\n\nconst logger = credentialLogger(\"AzurePowerShellCredential\");\n\nconst isWindows = process.platform === \"win32\";\nconst powerShellResourceEnvironmentVariable = \"AZURE_IDENTITY_POWERSHELL_RESOURCE\";\nconst powerShellTenantEnvironmentVariable = \"AZURE_IDENTITY_POWERSHELL_TENANT_ID\";\nconst powerShellPrivateEnvironmentVariables = new Set(\n  [powerShellResourceEnvironmentVariable, powerShellTenantEnvironmentVariable].map((name) =>\n    name.toLowerCase(),\n  ),\n);\n\n/**\n * Creates the child environment used to pass private values to PowerShell.\n *\n * @param resource - The resource passed to PowerShell.\n * @param tenantId - The optional tenant ID passed to PowerShell.\n * @param environment - The environment to copy.\n * @returns A child environment containing canonical private variable names.\n * @internal\n */\nexport function createPowerShellEnvironment(\n  resource: string,\n  tenantId: string | undefined,\n  environment: NodeJS.ProcessEnv = process.env,\n): NodeJS.ProcessEnv {\n  const childEnvironment = Object.fromEntries(\n    Object.entries(environment).filter(\n      ([name]) => !powerShellPrivateEnvironmentVariables.has(name.toLowerCase()),\n    ),\n  );\n  childEnvironment[powerShellResourceEnvironmentVariable] = resource;\n  childEnvironment[powerShellTenantEnvironmentVariable] = tenantId ?? \"\";\n  return childEnvironment;\n}\n\n/**\n * Returns a platform-appropriate command name by appending \".exe\" on Windows.\n *\n * @internal\n */\nexport function formatCommand(commandName: string): string {\n  if (isWindows) {\n    return `${commandName}.exe`;\n  } else {\n    return commandName;\n  }\n}\n\n/**\n * Receives a list of commands to run, executes them, then returns the outputs.\n * If anything fails, an error is thrown.\n * @internal\n */\nasync function runCommands(\n  commands: string[][],\n  timeout?: number,\n  env?: NodeJS.ProcessEnv,\n): Promise<string[]> {\n  const results: string[] = [];\n\n  for (const command of commands) {\n    const [file, ...parameters] = command;\n    const result = await processUtils.execFile(file, parameters, {\n      encoding: \"utf8\",\n      env,\n      timeout,\n    });\n\n    results.push(result);\n  }\n\n  return results;\n}\n\n/**\n * Known PowerShell errors\n * @internal\n */\nexport const powerShellErrors = {\n  login: \"Run Connect-AzAccount to login\",\n  installed:\n    \"The specified module 'Az.Accounts' with version '2.2.0' was not loaded because no valid module file was found in any module directory\",\n};\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const powerShellPublicErrorMessages = {\n  login:\n    \"Please run 'Connect-AzAccount' from PowerShell to authenticate before using this credential.\",\n  installed: `The 'Az.Account' module >= 2.2.0 is not installed. Install the Azure Az PowerShell module with: \"Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force\".`,\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n  troubleshoot: `To troubleshoot, visit https://aka.ms/azsdk/js/identity/powershellcredential/troubleshoot.`,\n};\n\n// PowerShell Azure User not logged in error check.\nconst isLoginError: (err: Error) => RegExpMatchArray | null = (err: Error) =>\n  err.message.match(`(.*)${powerShellErrors.login}(.*)`);\n\n// Az Module not Installed in Azure PowerShell check.\nconst isNotInstalledError: (err: Error) => RegExpMatchArray | null = (err: Error) =>\n  err.message.match(powerShellErrors.installed);\n\n/**\n * The PowerShell commands to be tried, in order.\n *\n * @internal\n */\nexport const commandStack = [formatCommand(\"pwsh\")];\n\nif (isWindows) {\n  commandStack.push(formatCommand(\"powershell\"));\n}\n\n/**\n * This credential will use the currently logged-in user information from the\n * Azure PowerShell module. To do so, it will read the user access token and\n * expire time with Azure PowerShell command `Get-AzAccessToken -ResourceUrl {ResourceScope}`\n */\nexport class AzurePowerShellCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n\n  /**\n   * Creates an instance of the {@link AzurePowerShellCredential}.\n   *\n   * To use this credential:\n   * - Install the Azure Az PowerShell module with:\n   *   `Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force`.\n   * - You have already logged in to Azure PowerShell using the command\n   * `Connect-AzAccount` from the command line.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzurePowerShellCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Gets the access token from Azure PowerShell\n   * @param resource - The resource to use when getting the token\n   */\n  private async getAzurePowerShellAccessToken(\n    resource: string,\n    tenantId?: string,\n    timeout?: number,\n  ): Promise<{ Token: string; ExpiresOn: string }> {\n    // Clone the stack to avoid mutating it while iterating\n    for (const powerShellCommand of [...commandStack]) {\n      try {\n        await runCommands([[powerShellCommand, \"/?\"]], timeout);\n      } catch (e: any) {\n        // Remove this credential from the original stack so that we don't try it again.\n        commandStack.shift();\n        continue;\n      }\n\n      const results = await runCommands(\n        [\n          [\n            powerShellCommand,\n            \"-NoProfile\",\n            \"-NonInteractive\",\n            \"-Command\",\n            `\n          $tenantId = $env:${powerShellTenantEnvironmentVariable}\n          $resource = $env:${powerShellResourceEnvironmentVariable}\n          $m = Import-Module Az.Accounts -MinimumVersion 2.2.0 -PassThru\n          $useSecureString = $m.Version -ge [version]'2.17.0' -and $m.Version -lt [version]'5.0.0'\n\n          $params = @{\n            ResourceUrl = $resource\n          }\n\n          if ($tenantId.Length -gt 0) {\n            $params[\"TenantId\"] = $tenantId\n          }\n\n          if ($useSecureString) {\n            $params[\"AsSecureString\"] = $true\n          }\n\n          $token = Get-AzAccessToken @params\n\n          $result = New-Object -TypeName PSObject\n          $result | Add-Member -MemberType NoteProperty -Name ExpiresOn -Value $token.ExpiresOn\n\n          if ($token.Token -is [System.Security.SecureString]) {\n            if ($PSVersionTable.PSVersion.Major -lt 7) {\n              $ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($token.Token)\n              try {\n                $result | Add-Member -MemberType NoteProperty -Name Token -Value ([System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr))\n              }\n              finally {\n                [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)\n              }\n            }\n            else {\n              $result | Add-Member -MemberType NoteProperty -Name Token -Value ($token.Token | ConvertFrom-SecureString -AsPlainText)\n            }\n          }\n          else {\n            $result | Add-Member -MemberType NoteProperty -Name Token -Value $token.Token\n          }\n\n          Write-Output (ConvertTo-Json $result)\n          `,\n          ],\n        ],\n        timeout,\n        createPowerShellEnvironment(resource, tenantId),\n      );\n\n      const result = results[0];\n      return parseJsonToken(result);\n    }\n    throw new Error(`Unable to execute PowerShell. Ensure that it is installed in your system`);\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If the authentication cannot be performed through PowerShell, a {@link CredentialUnavailableError} will be thrown.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      const scope = typeof scopes === \"string\" ? scopes : scopes[0];\n\n      const claimsValue = options.claims;\n      if (claimsValue && claimsValue.trim()) {\n        const encodedClaims = btoa(claimsValue);\n        let loginCmd = `Connect-AzAccount -ClaimsChallenge ${encodedClaims}`;\n\n        const tenantIdFromOptions = options.tenantId;\n        if (tenantIdFromOptions) {\n          loginCmd += ` -Tenant ${tenantIdFromOptions}`;\n        }\n        const error = new CredentialUnavailableError(\n          `${powerShellPublicErrorMessages.claim} ${loginCmd}`,\n        );\n\n        logger.getToken.info(formatError(scope, error));\n        throw error;\n      }\n\n      const tenantId = processMultiTenantRequest(\n        this.tenantId,\n        options,\n        this.additionallyAllowedTenantIds,\n      );\n      if (tenantId) {\n        checkTenantId(logger, tenantId);\n      }\n      try {\n        ensureValidScopeForDevTimeCreds(scope, logger);\n        logger.getToken.info(`Using the scope ${scope}`);\n        const resource = getScopeResource(scope);\n        const response = await this.getAzurePowerShellAccessToken(resource, tenantId, this.timeout);\n        logger.getToken.info(formatSuccess(scopes));\n        return {\n          token: response.Token,\n          expiresOnTimestamp: new Date(response.ExpiresOn).getTime(),\n          tokenType: \"Bearer\",\n        } as AccessToken;\n      } catch (err: any) {\n        if (isNotInstalledError(err)) {\n          const error = new CredentialUnavailableError(powerShellPublicErrorMessages.installed);\n          logger.getToken.info(formatError(scope, error));\n          throw error;\n        } else if (isLoginError(err)) {\n          const error = new CredentialUnavailableError(powerShellPublicErrorMessages.login);\n          logger.getToken.info(formatError(scope, error));\n          throw error;\n        }\n        const error = new CredentialUnavailableError(\n          `${err}. ${powerShellPublicErrorMessages.troubleshoot}`,\n        );\n        logger.getToken.info(formatError(scope, error));\n        throw error;\n      }\n    });\n  }\n}\n\n/**\n *\n * @internal\n */\nexport async function parseJsonToken(\n  result: string,\n): Promise<{ Token: string; ExpiresOn: string }> {\n  const jsonRegex = /{[^{}]*}/g;\n  const matches = result.match(jsonRegex);\n  let resultWithoutToken = result;\n  if (matches) {\n    try {\n      for (const item of matches) {\n        try {\n          const jsonContent = JSON.parse(item);\n          if (jsonContent?.Token) {\n            resultWithoutToken = resultWithoutToken.replace(item, \"\");\n            if (resultWithoutToken) {\n              logger.getToken.warning(resultWithoutToken);\n            }\n            return jsonContent;\n          }\n        } catch (e) {\n          continue;\n        }\n      }\n    } catch (e: any) {\n      throw new Error(`Unable to parse the output of PowerShell. Received output: ${result}`, {\n        cause: e,\n      });\n    }\n  }\n  throw new Error(`No access token found in the output. Received output: ${result}`);\n}\n"]}

package/dist/esm/credentials/defaultAzureCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaultAzureCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/defaultAzureCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,qCAAqC,EACrC,6BAA6B,EAC7B,uCAAuC,EACxC,MAAM,oCAAoC,CAAC;AAO5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAgBxD;;;GAGG;AACH,qBAAa,4BAA6B,YAAW,eAAe;IAClE,iCAAiC,EAAE,MAAM,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC;gBAEX,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAKnD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAM1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,sBAAuB,SAAQ,sBAAsB;IAChE;;;;OAIG;gBACS,OAAO,CAAC,EAAE,qCAAqC;IAE3D;;;;OAIG;gBACS,OAAO,CAAC,EAAE,uCAAuC;IAE7D;;;;OAIG;gBACS,OAAO,CAAC,EAAE,6BAA6B;CAyFpD"}
+{"version":3,"file":"defaultAzureCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/defaultAzureCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,qCAAqC,EACrC,6BAA6B,EAC7B,uCAAuC,EACxC,MAAM,oCAAoC,CAAC;AAO5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAgBxD;;;GAGG;AACH,qBAAa,4BAA6B,YAAW,eAAe;IAClE,iCAAiC,EAAE,MAAM,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC;gBAEX,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAKnD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAM1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,sBAAuB,SAAQ,sBAAsB;IAChE;;;;OAIG;gBACS,OAAO,CAAC,EAAE,qCAAqC;IAE3D;;;;OAIG;gBACS,OAAO,CAAC,EAAE,uCAAuC;IAE7D;;;;OAIG;gBACS,OAAO,CAAC,EAAE,6BAA6B;CA6FpD"}

package/dist/esm/credentials/defaultAzureCredential.js

@@ -75,7 +75,7 @@ export class DefaultAzureCredential extends ChainedTokenCredential {
             createDefaultWorkloadIdentityCredential,
             createDefaultManagedIdentityCredential,
         ];
-        let credentialFunctions = [];
+        let credentialFunctions;
         const validCredentialNames = "EnvironmentCredential, WorkloadIdentityCredential, ManagedIdentityCredential, VisualStudioCodeCredential, AzureCliCredential, AzurePowerShellCredential, AzureDeveloperCliCredential";
         // If AZURE_TOKEN_CREDENTIALS is set, use it to determine which credentials to use.
         // The value of AZURE_TOKEN_CREDENTIALS should be either "dev" or "prod" or any one of these credentials - {validCredentialNames}.
@@ -97,7 +97,10 @@ export class DefaultAzureCredential extends ChainedTokenCredential {
                     // Setting `sendProbeRequest` to false to ensure ManagedIdentityCredential behavior
                     // is consistent when used standalone in DAC chain or used directly.
                     credentialFunctions = [
-                        () => createDefaultManagedIdentityCredential({ sendProbeRequest: false }),
+                        () => createDefaultManagedIdentityCredential({
+                            ...options,
+                            sendProbeRequest: false,
+                        }),
                     ];
                     break;
                 case "visualstudiocodecredential":