@azure/identity 4.14.0-beta.1 → 4.14.0-beta.3

package/dist/commonjs/credentials/managedIdentityCredential/index.js

@@ -1,257 +1,271 @@
-"use strict";
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ManagedIdentityCredential = void 0;
-const logger_1 = require("@azure/logger");
-const msal_node_1 = require("@azure/msal-node");
-const identityClient_js_1 = require("../../client/identityClient.js");
-const errors_js_1 = require("../../errors.js");
-const utils_js_1 = require("../../msal/utils.js");
-const imdsRetryPolicy_js_1 = require("./imdsRetryPolicy.js");
-const logging_js_1 = require("../../util/logging.js");
-const tracing_js_1 = require("../../util/tracing.js");
-const imdsMsi_js_1 = require("./imdsMsi.js");
-const tokenExchangeMsi_js_1 = require("./tokenExchangeMsi.js");
-const utils_js_2 = require("./utils.js");
-const logger = (0, logging_js_1.credentialLogger)("ManagedIdentityCredential");
-/**
- * Attempts authentication using a managed identity available at the deployment environment.
- * This authentication type works in Azure VMs, App Service instances, Azure Functions applications,
- * Azure Kubernetes Services, Azure Service Fabric instances and inside of the Azure Cloud Shell.
- *
- * More information about configuring managed identities can be found here:
- * https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview
- */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var managedIdentityCredential_exports = {};
+__export(managedIdentityCredential_exports, {
+  ManagedIdentityCredential: () => ManagedIdentityCredential
+});
+module.exports = __toCommonJS(managedIdentityCredential_exports);
+var import_logger = require("@azure/logger");
+var import_msal_node = require("@azure/msal-node");
+var import_identityClient = require("../../client/identityClient.js");
+var import_errors = require("../../errors.js");
+var import_utils = require("../../msal/utils.js");
+var import_imdsRetryPolicy = require("./imdsRetryPolicy.js");
+var import_logging = require("../../util/logging.js");
+var import_tracing = require("../../util/tracing.js");
+var import_imdsMsi = require("./imdsMsi.js");
+var import_tokenExchangeMsi = require("./tokenExchangeMsi.js");
+var import_utils2 = require("./utils.js");
+const logger = (0, import_logging.credentialLogger)("ManagedIdentityCredential");
 class ManagedIdentityCredential {
-    managedIdentityApp;
-    identityClient;
-    clientId;
-    resourceId;
-    objectId;
-    msiRetryConfig = {
-        maxRetries: 5,
-        startDelayInMs: 800,
-        intervalIncrement: 2,
-    };
-    isAvailableIdentityClient;
-    sendProbeRequest;
-    /**
-     * @internal
-     * @hidden
-     */
-    constructor(clientIdOrOptions, options) {
-        let _options;
-        if (typeof clientIdOrOptions === "string") {
-            this.clientId = clientIdOrOptions;
-            _options = options ?? {};
-        }
-        else {
-            this.clientId = clientIdOrOptions?.clientId;
-            _options = clientIdOrOptions ?? {};
-        }
-        this.resourceId = _options?.resourceId;
-        this.objectId = _options?.objectId;
-        this.sendProbeRequest =
-            _options?.sendProbeRequest ?? false;
-        // For JavaScript users.
-        const providedIds = [
-            { key: "clientId", value: this.clientId },
-            { key: "resourceId", value: this.resourceId },
-            { key: "objectId", value: this.objectId },
-        ].filter((id) => id.value);
-        if (providedIds.length > 1) {
-            throw new Error(`ManagedIdentityCredential: only one of 'clientId', 'resourceId', or 'objectId' can be provided. Received values: ${JSON.stringify({ clientId: this.clientId, resourceId: this.resourceId, objectId: this.objectId })}`);
-        }
-        // ManagedIdentity uses http for local requests
-        _options.allowInsecureConnection = true;
-        if (_options.retryOptions?.maxRetries !== undefined) {
-            this.msiRetryConfig.maxRetries = _options.retryOptions.maxRetries;
+  managedIdentityApp;
+  identityClient;
+  clientId;
+  resourceId;
+  objectId;
+  msiRetryConfig = {
+    maxRetries: 5,
+    startDelayInMs: 800,
+    intervalIncrement: 2
+  };
+  isAvailableIdentityClient;
+  sendProbeRequest;
+  /**
+   * @internal
+   * @hidden
+   */
+  constructor(clientIdOrOptions, options) {
+    let _options;
+    if (typeof clientIdOrOptions === "string") {
+      this.clientId = clientIdOrOptions;
+      _options = options ?? {};
+    } else {
+      this.clientId = clientIdOrOptions?.clientId;
+      _options = clientIdOrOptions ?? {};
+    }
+    this.resourceId = _options?.resourceId;
+    this.objectId = _options?.objectId;
+    this.sendProbeRequest = _options?.sendProbeRequest ?? false;
+    const providedIds = [
+      { key: "clientId", value: this.clientId },
+      { key: "resourceId", value: this.resourceId },
+      { key: "objectId", value: this.objectId }
+    ].filter((id) => id.value);
+    if (providedIds.length > 1) {
+      throw new Error(
+        `ManagedIdentityCredential: only one of 'clientId', 'resourceId', or 'objectId' can be provided. Received values: ${JSON.stringify(
+          { clientId: this.clientId, resourceId: this.resourceId, objectId: this.objectId }
+        )}`
+      );
+    }
+    _options.allowInsecureConnection = true;
+    if (_options.retryOptions?.maxRetries !== void 0) {
+      this.msiRetryConfig.maxRetries = _options.retryOptions.maxRetries;
+    }
+    this.identityClient = new import_identityClient.IdentityClient({
+      ..._options,
+      additionalPolicies: [{ policy: (0, import_imdsRetryPolicy.imdsRetryPolicy)(this.msiRetryConfig), position: "perCall" }]
+    });
+    this.managedIdentityApp = new import_msal_node.ManagedIdentityApplication({
+      managedIdentityIdParams: {
+        userAssignedClientId: this.clientId,
+        userAssignedResourceId: this.resourceId,
+        userAssignedObjectId: this.objectId
+      },
+      system: {
+        disableInternalRetries: true,
+        networkClient: this.identityClient,
+        loggerOptions: {
+          logLevel: (0, import_utils.getMSALLogLevel)((0, import_logger.getLogLevel)()),
+          piiLoggingEnabled: _options.loggingOptions?.enableUnsafeSupportLogging,
+          loggerCallback: (0, import_utils.defaultLoggerCallback)(logger)
         }
-        this.identityClient = new identityClient_js_1.IdentityClient({
-            ..._options,
-            additionalPolicies: [{ policy: (0, imdsRetryPolicy_js_1.imdsRetryPolicy)(this.msiRetryConfig), position: "perCall" }],
-        });
-        this.managedIdentityApp = new msal_node_1.ManagedIdentityApplication({
-            managedIdentityIdParams: {
-                userAssignedClientId: this.clientId,
-                userAssignedResourceId: this.resourceId,
-                userAssignedObjectId: this.objectId,
-            },
-            system: {
-                disableInternalRetries: true,
-                networkClient: this.identityClient,
-                loggerOptions: {
-                    logLevel: (0, utils_js_1.getMSALLogLevel)((0, logger_1.getLogLevel)()),
-                    piiLoggingEnabled: _options.loggingOptions?.enableUnsafeSupportLogging,
-                    loggerCallback: (0, utils_js_1.defaultLoggerCallback)(logger),
-                },
-            },
-        });
-        this.isAvailableIdentityClient = new identityClient_js_1.IdentityClient({
-            ..._options,
-            retryOptions: {
-                maxRetries: 0,
-            },
-        });
-        const managedIdentitySource = this.managedIdentityApp.getManagedIdentitySource();
-        // CloudShell MSI will ignore any user-assigned identity passed as parameters. To avoid confusion, we prevent this from happening as early as possible.
-        if (managedIdentitySource === "CloudShell") {
-            if (this.clientId || this.resourceId || this.objectId) {
-                logger.warning(`CloudShell MSI detected with user-provided IDs - throwing. Received values: ${JSON.stringify({
-                    clientId: this.clientId,
-                    resourceId: this.resourceId,
-                    objectId: this.objectId,
-                })}.`);
-                throw new errors_js_1.CredentialUnavailableError("ManagedIdentityCredential: Specifying a user-assigned managed identity is not supported for CloudShell at runtime. When using Managed Identity in CloudShell, omit the clientId, resourceId, and objectId parameters.");
+      }
+    });
+    this.isAvailableIdentityClient = new import_identityClient.IdentityClient({
+      ..._options,
+      retryOptions: {
+        maxRetries: 0
+      }
+    });
+    const managedIdentitySource = this.managedIdentityApp.getManagedIdentitySource();
+    if (managedIdentitySource === "CloudShell") {
+      if (this.clientId || this.resourceId || this.objectId) {
+        logger.warning(
+          `CloudShell MSI detected with user-provided IDs - throwing. Received values: ${JSON.stringify(
+            {
+              clientId: this.clientId,
+              resourceId: this.resourceId,
+              objectId: this.objectId
             }
-        }
-        // ServiceFabric does not support specifying user-assigned managed identity by client ID or resource ID. The managed identity selected is based on the resource configuration.
-        if (managedIdentitySource === "ServiceFabric") {
-            if (this.clientId || this.resourceId || this.objectId) {
-                logger.warning(`Service Fabric detected with user-provided IDs - throwing. Received values: ${JSON.stringify({
-                    clientId: this.clientId,
-                    resourceId: this.resourceId,
-                    objectId: this.objectId,
-                })}.`);
-                throw new errors_js_1.CredentialUnavailableError(`ManagedIdentityCredential: ${utils_js_2.serviceFabricErrorMessage}`);
+          )}.`
+        );
+        throw new import_errors.CredentialUnavailableError(
+          "ManagedIdentityCredential: Specifying a user-assigned managed identity is not supported for CloudShell at runtime. When using Managed Identity in CloudShell, omit the clientId, resourceId, and objectId parameters."
+        );
+      }
+    }
+    if (managedIdentitySource === "ServiceFabric") {
+      if (this.clientId || this.resourceId || this.objectId) {
+        logger.warning(
+          `Service Fabric detected with user-provided IDs - throwing. Received values: ${JSON.stringify(
+            {
+              clientId: this.clientId,
+              resourceId: this.resourceId,
+              objectId: this.objectId
             }
-        }
-        logger.info(`Using ${managedIdentitySource} managed identity.`);
-        // Check if either clientId, resourceId or objectId was provided and log the value used
-        if (providedIds.length === 1) {
-            const { key, value } = providedIds[0];
-            logger.info(`${managedIdentitySource} with ${key}: ${value}`);
-        }
+          )}.`
+        );
+        throw new import_errors.CredentialUnavailableError(
+          `ManagedIdentityCredential: ${import_utils2.serviceFabricErrorMessage}`
+        );
+      }
+    }
+    logger.info(`Using ${managedIdentitySource} managed identity.`);
+    if (providedIds.length === 1) {
+      const { key, value } = providedIds[0];
+      logger.info(`${managedIdentitySource} with ${key}: ${value}`);
     }
-    /**
-     * Authenticates with Microsoft Entra ID and returns an access token if successful.
-     * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
-     * If an unexpected error occurs, an {@link AuthenticationError} will be thrown with the details of the failure.
-     *
-     * @param scopes - The list of scopes for which the token will have access.
-     * @param options - The options used to configure any requests this
-     *                TokenCredential implementation might make.
-     */
-    async getToken(scopes, options = {}) {
-        logger.getToken.info("Using the MSAL provider for Managed Identity.");
-        const resource = (0, utils_js_2.mapScopesToResource)(scopes);
-        if (!resource) {
-            throw new errors_js_1.CredentialUnavailableError(`ManagedIdentityCredential: Multiple scopes are not supported. Scopes: ${JSON.stringify(scopes)}`);
+  }
+  /**
+   * Authenticates with Microsoft Entra ID and returns an access token if successful.
+   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
+   * If an unexpected error occurs, an {@link AuthenticationError} will be thrown with the details of the failure.
+   *
+   * @param scopes - The list of scopes for which the token will have access.
+   * @param options - The options used to configure any requests this
+   *                TokenCredential implementation might make.
+   */
+  async getToken(scopes, options = {}) {
+    logger.getToken.info("Using the MSAL provider for Managed Identity.");
+    const resource = (0, import_utils2.mapScopesToResource)(scopes);
+    if (!resource) {
+      throw new import_errors.CredentialUnavailableError(
+        `ManagedIdentityCredential: Multiple scopes are not supported. Scopes: ${JSON.stringify(
+          scopes
+        )}`
+      );
+    }
+    return import_tracing.tracingClient.withSpan("ManagedIdentityCredential.getToken", options, async () => {
+      try {
+        const isTokenExchangeMsi = await import_tokenExchangeMsi.tokenExchangeMsi.isAvailable(this.clientId);
+        const identitySource = this.managedIdentityApp.getManagedIdentitySource();
+        const isImdsMsi = identitySource === "DefaultToImds" || identitySource === "Imds";
+        logger.getToken.info(`MSAL Identity source: ${identitySource}`);
+        if (isTokenExchangeMsi) {
+          logger.getToken.info("Using the token exchange managed identity.");
+          const result = await import_tokenExchangeMsi.tokenExchangeMsi.getToken({
+            scopes,
+            clientId: this.clientId,
+            identityClient: this.identityClient,
+            retryConfig: this.msiRetryConfig,
+            resourceId: this.resourceId
+          });
+          if (result === null) {
+            throw new import_errors.CredentialUnavailableError(
+              "Attempted to use the token exchange managed identity, but received a null response."
+            );
+          }
+          return result;
+        } else if (isImdsMsi && this.sendProbeRequest) {
+          logger.getToken.info("Using the IMDS endpoint to probe for availability.");
+          const isAvailable = await import_imdsMsi.imdsMsi.isAvailable({
+            scopes,
+            clientId: this.clientId,
+            getTokenOptions: options,
+            identityClient: this.isAvailableIdentityClient,
+            resourceId: this.resourceId
+          });
+          if (!isAvailable) {
+            throw new import_errors.CredentialUnavailableError(
+              `Attempted to use the IMDS endpoint, but it is not available.`
+            );
+          }
         }
-        return tracing_js_1.tracingClient.withSpan("ManagedIdentityCredential.getToken", options, async () => {
-            try {
-                const isTokenExchangeMsi = await tokenExchangeMsi_js_1.tokenExchangeMsi.isAvailable(this.clientId);
-                // Most scenarios are handled by MSAL except for two:
-                // AKS pod identity - MSAL does not implement the token exchange flow.
-                // IMDS Endpoint probing - MSAL does not do any probing before trying to get a token.
-                // As a DefaultAzureCredential optimization we probe the IMDS endpoint with a short timeout and no retries before actually trying to get a token
-                // We will continue to implement these features in the Identity library.
-                const identitySource = this.managedIdentityApp.getManagedIdentitySource();
-                const isImdsMsi = identitySource === "DefaultToImds" || identitySource === "Imds"; // Neither actually checks that IMDS endpoint is available, just that it's the source the MSAL _would_ try to use.
-                logger.getToken.info(`MSAL Identity source: ${identitySource}`);
-                if (isTokenExchangeMsi) {
-                    // In the AKS scenario we will use the existing tokenExchangeMsi indefinitely.
-                    logger.getToken.info("Using the token exchange managed identity.");
-                    const result = await tokenExchangeMsi_js_1.tokenExchangeMsi.getToken({
-                        scopes,
-                        clientId: this.clientId,
-                        identityClient: this.identityClient,
-                        retryConfig: this.msiRetryConfig,
-                        resourceId: this.resourceId,
-                    });
-                    if (result === null) {
-                        throw new errors_js_1.CredentialUnavailableError("Attempted to use the token exchange managed identity, but received a null response.");
-                    }
-                    return result;
-                }
-                else if (isImdsMsi && this.sendProbeRequest) {
-                    // In the IMDS scenario we will probe the IMDS endpoint to ensure it's available before trying to get a token.
-                    // If the IMDS endpoint is not available and this is the source that MSAL will use, we will fail-fast with an error that tells DAC to move to the next credential.
-                    logger.getToken.info("Using the IMDS endpoint to probe for availability.");
-                    const isAvailable = await imdsMsi_js_1.imdsMsi.isAvailable({
-                        scopes,
-                        clientId: this.clientId,
-                        getTokenOptions: options,
-                        identityClient: this.isAvailableIdentityClient,
-                        resourceId: this.resourceId,
-                    });
-                    if (!isAvailable) {
-                        throw new errors_js_1.CredentialUnavailableError(`Attempted to use the IMDS endpoint, but it is not available.`);
-                    }
-                }
-                // If we got this far, it means:
-                // - This is not a tokenExchangeMsi,
-                // - We already probed for IMDS endpoint availability and failed-fast if it's unreachable,
-                // or we skip probing because the credential is set in DAC.
-                // We can proceed normally by calling MSAL for a token.
-                logger.getToken.info("Calling into MSAL for managed identity token.");
-                const token = await this.managedIdentityApp.acquireToken({
-                    resource,
-                });
-                this.ensureValidMsalToken(scopes, token, options);
-                logger.getToken.info((0, logging_js_1.formatSuccess)(scopes));
-                return {
-                    expiresOnTimestamp: token.expiresOn.getTime(),
-                    token: token.accessToken,
-                    refreshAfterTimestamp: token.refreshOn?.getTime(),
-                    tokenType: "Bearer",
-                };
-            }
-            catch (err) {
-                logger.getToken.error((0, logging_js_1.formatError)(scopes, err));
-                // AuthenticationRequiredError described as Error to enforce authentication after trying to retrieve a token silently.
-                // TODO: why would this _ever_ happen considering we're not trying the silent request in this flow?
-                if (err.name === "AuthenticationRequiredError") {
-                    throw err;
-                }
-                if (isNetworkError(err)) {
-                    throw new errors_js_1.CredentialUnavailableError(`ManagedIdentityCredential: Network unreachable. Message: ${err.message}`, { cause: err });
-                }
-                throw new errors_js_1.CredentialUnavailableError(`ManagedIdentityCredential: Authentication failed. Message ${err.message}`, { cause: err });
-            }
+        logger.getToken.info("Calling into MSAL for managed identity token.");
+        const token = await this.managedIdentityApp.acquireToken({
+          resource
         });
-    }
-    /**
-     * Ensures the validity of the MSAL token
-     */
-    ensureValidMsalToken(scopes, msalToken, getTokenOptions) {
-        const createError = (message) => {
-            logger.getToken.info(message);
-            return new errors_js_1.AuthenticationRequiredError({
-                scopes: Array.isArray(scopes) ? scopes : [scopes],
-                getTokenOptions,
-                message,
-            });
+        this.ensureValidMsalToken(scopes, token, options);
+        logger.getToken.info((0, import_logging.formatSuccess)(scopes));
+        return {
+          expiresOnTimestamp: token.expiresOn.getTime(),
+          token: token.accessToken,
+          refreshAfterTimestamp: token.refreshOn?.getTime(),
+          tokenType: "Bearer"
         };
-        if (!msalToken) {
-            throw createError("No response.");
-        }
-        if (!msalToken.expiresOn) {
-            throw createError(`Response had no "expiresOn" property.`);
+      } catch (err) {
+        logger.getToken.error((0, import_logging.formatError)(scopes, err));
+        if (err.name === "AuthenticationRequiredError") {
+          throw err;
         }
-        if (!msalToken.accessToken) {
-            throw createError(`Response had no "accessToken" property.`);
+        if (isNetworkError(err)) {
+          throw new import_errors.CredentialUnavailableError(
+            `ManagedIdentityCredential: Network unreachable. Message: ${err.message}`,
+            { cause: err }
+          );
         }
+        throw new import_errors.CredentialUnavailableError(
+          `ManagedIdentityCredential: Authentication failed. Message ${err.message}`,
+          { cause: err }
+        );
+      }
+    });
+  }
+  /**
+   * Ensures the validity of the MSAL token
+   */
+  ensureValidMsalToken(scopes, msalToken, getTokenOptions) {
+    const createError = (message) => {
+      logger.getToken.info(message);
+      return new import_errors.AuthenticationRequiredError({
+        scopes: Array.isArray(scopes) ? scopes : [scopes],
+        getTokenOptions,
+        message
+      });
+    };
+    if (!msalToken) {
+      throw createError("No response.");
     }
-}
-exports.ManagedIdentityCredential = ManagedIdentityCredential;
-function isNetworkError(err) {
-    // MSAL error
-    if (err.errorCode === "network_error") {
-        return true;
+    if (!msalToken.expiresOn) {
+      throw createError(`Response had no "expiresOn" property.`);
     }
-    // Probe errors
-    if (err.code === "ENETUNREACH" || err.code === "EHOSTUNREACH") {
-        return true;
+    if (!msalToken.accessToken) {
+      throw createError(`Response had no "accessToken" property.`);
     }
-    // This is a special case for Docker Desktop which responds with a 403 with a message that contains "A socket operation was attempted to an unreachable network" or "A socket operation was attempted to an unreachable host"
-    // rather than just timing out, as expected.
-    if (err.statusCode === 403 || err.code === 403) {
-        if (err.message.includes("unreachable")) {
-            return true;
-        }
+  }
+}
+function isNetworkError(err) {
+  if (err.errorCode === "network_error") {
+    return true;
+  }
+  if (err.code === "ENETUNREACH" || err.code === "EHOSTUNREACH") {
+    return true;
+  }
+  if (err.statusCode === 403 || err.code === 403) {
+    if (err.message.includes("unreachable")) {
+      return true;
     }
-    return false;
+  }
+  return false;
 }
-//# sourceMappingURL=index.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ManagedIdentityCredential
+});
+//# sourceMappingURL=index.js.map

package/dist/commonjs/credentials/managedIdentityCredential/index.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/credentials/managedIdentityCredential/index.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAKlC,0CAA4C;AAC5C,gDAA8D;AAC9D,sEAAgE;AAChE,+CAA0F;AAC1F,kDAA6E;AAC7E,6DAAuD;AAEvD,sDAAqF;AACrF,sDAAsD;AACtD,6CAAuC;AACvC,+DAAyD;AACzD,yCAA4E;AAS5E,MAAM,MAAM,GAAG,IAAA,6BAAgB,EAAC,2BAA2B,CAAC,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAa,yBAAyB;IAC5B,kBAAkB,CAA6B;IAC/C,cAAc,CAAiB;IAC/B,QAAQ,CAAU;IAClB,UAAU,CAAU;IACpB,QAAQ,CAAU;IAClB,cAAc,GAAoC;QACxD,UAAU,EAAE,CAAC;QACb,cAAc,EAAE,GAAG;QACnB,iBAAiB,EAAE,CAAC;KACrB,CAAC;IACM,yBAAyB,CAAiB;IAC1C,gBAAgB,CAAU;IA4BlC;;;OAGG;IACH,YACE,iBAI4C,EAC5C,OAAgC;QAEhC,IAAI,QAAgC,CAAC;QACrC,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC;YAClC,QAAQ,GAAG,OAAO,IAAI,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,GAAI,iBAA8D,EAAE,QAAQ,CAAC;YAC1F,QAAQ,GAAG,iBAAiB,IAAI,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,UAAU,GAAI,QAAuD,EAAE,UAAU,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAI,QAAqD,EAAE,QAAQ,CAAC;QACjF,IAAI,CAAC,gBAAgB;YAClB,QAAqD,EAAE,gBAAgB,IAAI,KAAK,CAAC;QACpF,wBAAwB;QACxB,MAAM,WAAW,GAAG;YAClB,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;YACzC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7C,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;SAC1C,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,oHAAoH,IAAI,CAAC,SAAS,CAChI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAClF,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,QAAQ,CAAC,uBAAuB,GAAG,IAAI,CAAC;QAExC,IAAI,QAAQ,CAAC,YAAY,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,IAAI,kCAAc,CAAC;YACvC,GAAG,QAAQ;YACX,kBAAkB,EAAE,CAAC,EAAE,MAAM,EAAE,IAAA,oCAAe,EAAC,IAAI,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;SAC5F,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,GAAG,IAAI,sCAA0B,CAAC;YACvD,uBAAuB,EAAE;gBACvB,oBAAoB,EAAE,IAAI,CAAC,QAAQ;gBACnC,sBAAsB,EAAE,IAAI,CAAC,UAAU;gBACvC,oBAAoB,EAAE,IAAI,CAAC,QAAQ;aACpC;YACD,MAAM,EAAE;gBACN,sBAAsB,EAAE,IAAI;gBAC5B,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,aAAa,EAAE;oBACb,QAAQ,EAAE,IAAA,0BAAe,EAAC,IAAA,oBAAW,GAAE,CAAC;oBACxC,iBAAiB,EAAE,QAAQ,CAAC,cAAc,EAAE,0BAA0B;oBACtE,cAAc,EAAE,IAAA,gCAAqB,EAAC,MAAM,CAAC;iBAC9C;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,yBAAyB,GAAG,IAAI,kCAAc,CAAC;YAClD,GAAG,QAAQ;YACX,YAAY,EAAE;gBACZ,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CAAC;QAEH,MAAM,qBAAqB,GAAG,IAAI,CAAC,kBAAkB,CAAC,wBAAwB,EAAE,CAAC;QACjF,uJAAuJ;QACvJ,IAAI,qBAAqB,KAAK,YAAY,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtD,MAAM,CAAC,OAAO,CACZ,+EAA+E,IAAI,CAAC,SAAS,CAC3F;oBACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CACF,GAAG,CACL,CAAC;gBACF,MAAM,IAAI,sCAA0B,CAClC,uNAAuN,CACxN,CAAC;YACJ,CAAC;QACH,CAAC;QAED,8KAA8K;QAC9K,IAAI,qBAAqB,KAAK,eAAe,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtD,MAAM,CAAC,OAAO,CACZ,+EAA+E,IAAI,CAAC,SAAS,CAC3F;oBACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CACF,GAAG,CACL,CAAC;gBACF,MAAM,IAAI,sCAA0B,CAClC,8BAA8B,oCAAyB,EAAE,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,SAAS,qBAAqB,oBAAoB,CAAC,CAAC;QAEhE,uFAAuF;QACvF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAyB,EACzB,UAA2B,EAAE;QAE7B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAA,8BAAmB,EAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,sCAA0B,CAClC,yEAAyE,IAAI,CAAC,SAAS,CACrF,MAAM,CACP,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,OAAO,0BAAa,CAAC,QAAQ,CAAC,oCAAoC,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;YACtF,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,sCAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAE7E,qDAAqD;gBACrD,sEAAsE;gBACtE,qFAAqF;gBACrF,gJAAgJ;gBAChJ,wEAAwE;gBAExE,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,wBAAwB,EAAE,CAAC;gBAC1E,MAAM,SAAS,GAAG,cAAc,KAAK,eAAe,IAAI,cAAc,KAAK,MAAM,CAAC,CAAC,kHAAkH;gBAErM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,cAAc,EAAE,CAAC,CAAC;gBAEhE,IAAI,kBAAkB,EAAE,CAAC;oBACvB,8EAA8E;oBAC9E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;oBACnE,MAAM,MAAM,GAAG,MAAM,sCAAgB,CAAC,QAAQ,CAAC;wBAC7C,MAAM;wBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;wBACnC,WAAW,EAAE,IAAI,CAAC,cAAc;wBAChC,UAAU,EAAE,IAAI,CAAC,UAAU;qBAC5B,CAAC,CAAC;oBAEH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,MAAM,IAAI,sCAA0B,CAClC,qFAAqF,CACtF,CAAC;oBACJ,CAAC;oBAED,OAAO,MAAM,CAAC;gBAChB,CAAC;qBAAM,IAAI,SAAS,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBAC9C,8GAA8G;oBAC9G,kKAAkK;oBAClK,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;oBAC3E,MAAM,WAAW,GAAG,MAAM,oBAAO,CAAC,WAAW,CAAC;wBAC5C,MAAM;wBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,eAAe,EAAE,OAAO;wBACxB,cAAc,EAAE,IAAI,CAAC,yBAAyB;wBAC9C,UAAU,EAAE,IAAI,CAAC,UAAU;qBAC5B,CAAC,CAAC;oBAEH,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,MAAM,IAAI,sCAA0B,CAClC,8DAA8D,CAC/D,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,gCAAgC;gBAChC,oCAAoC;gBACpC,0FAA0F;gBAC1F,2DAA2D;gBAC3D,uDAAuD;gBACvD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;gBACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC;oBACvD,QAAQ;iBACT,CAAC,CAAC;gBAEH,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,0BAAa,EAAC,MAAM,CAAC,CAAC,CAAC;gBAE5C,OAAO;oBACL,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE;oBAC7C,KAAK,EAAE,KAAK,CAAC,WAAW;oBACxB,qBAAqB,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE;oBACjD,SAAS,EAAE,QAAQ;iBACL,CAAC;YACnB,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAA,wBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;gBAEhD,sHAAsH;gBACtH,mGAAmG;gBACnG,IAAI,GAAG,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;oBAC/C,MAAM,GAAG,CAAC;gBACZ,CAAC;gBAED,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,IAAI,sCAA0B,CAClC,4DAA4D,GAAG,CAAC,OAAO,EAAE,EACzE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,sCAA0B,CAClC,6DAA6D,GAAG,CAAC,OAAO,EAAE,EAC1E,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,oBAAoB,CAC1B,MAAyB,EACzB,SAAqB,EACrB,eAAiC;QAEjC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAS,EAAE;YAC7C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,IAAI,uCAA2B,CAAC;gBACrC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACjD,eAAe;gBACf,OAAO;aACR,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,WAAW,CAAC,uCAAuC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC3B,MAAM,WAAW,CAAC,yCAAyC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF;AAhTD,8DAgTC;AAED,SAAS,cAAc,CAAC,GAAQ;IAC9B,aAAa;IACb,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe;IACf,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6NAA6N;IAC7N,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;QAC/C,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\n\nimport type { TokenCredentialOptions } from \"../../tokenCredentialOptions.js\";\nimport { getLogLevel } from \"@azure/logger\";\nimport { ManagedIdentityApplication } from \"@azure/msal-node\";\nimport { IdentityClient } from \"../../client/identityClient.js\";\nimport { AuthenticationRequiredError, CredentialUnavailableError } from \"../../errors.js\";\nimport { getMSALLogLevel, defaultLoggerCallback } from \"../../msal/utils.js\";\nimport { imdsRetryPolicy } from \"./imdsRetryPolicy.js\";\nimport type { MSIConfiguration } from \"./models.js\";\nimport { formatSuccess, formatError, credentialLogger } from \"../../util/logging.js\";\nimport { tracingClient } from \"../../util/tracing.js\";\nimport { imdsMsi } from \"./imdsMsi.js\";\nimport { tokenExchangeMsi } from \"./tokenExchangeMsi.js\";\nimport { mapScopesToResource, serviceFabricErrorMessage } from \"./utils.js\";\nimport type { MsalToken, ValidMsalToken } from \"../../msal/types.js\";\nimport type {\n  InternalManagedIdentityCredentialOptions,\n  ManagedIdentityCredentialClientIdOptions,\n  ManagedIdentityCredentialObjectIdOptions,\n  ManagedIdentityCredentialResourceIdOptions,\n} from \"./options.js\";\n\nconst logger = credentialLogger(\"ManagedIdentityCredential\");\n\n/**\n * Attempts authentication using a managed identity available at the deployment environment.\n * This authentication type works in Azure VMs, App Service instances, Azure Functions applications,\n * Azure Kubernetes Services, Azure Service Fabric instances and inside of the Azure Cloud Shell.\n *\n * More information about configuring managed identities can be found here:\n * https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview\n */\nexport class ManagedIdentityCredential implements TokenCredential {\n  private managedIdentityApp: ManagedIdentityApplication;\n  private identityClient: IdentityClient;\n  private clientId?: string;\n  private resourceId?: string;\n  private objectId?: string;\n  private msiRetryConfig: MSIConfiguration[\"retryConfig\"] = {\n    maxRetries: 5,\n    startDelayInMs: 800,\n    intervalIncrement: 2,\n  };\n  private isAvailableIdentityClient: IdentityClient;\n  private sendProbeRequest: boolean;\n\n  /**\n   * Creates an instance of ManagedIdentityCredential with the client ID of a\n   * user-assigned identity, or app registration (when working with AKS pod-identity).\n   *\n   * @param clientId - The client ID of the user-assigned identity, or app registration (when working with AKS pod-identity).\n   * @param options - Options for configuring the client which makes the access token request.\n   */\n  constructor(clientId: string, options?: TokenCredentialOptions);\n  /**\n   * Creates an instance of ManagedIdentityCredential with a client ID\n   *\n   * @param options - Options for configuring the client which makes the access token request.\n   */\n  constructor(options?: ManagedIdentityCredentialClientIdOptions);\n  /**\n   * Creates an instance of ManagedIdentityCredential with a resource ID\n   *\n   * @param options - Options for configuring the resource which makes the access token request.\n   */\n  constructor(options?: ManagedIdentityCredentialResourceIdOptions);\n  /**\n   * Creates an instance of ManagedIdentityCredential with an object ID\n   *\n   * @param options - Options for configuring the resource which makes the access token request.\n   */\n  constructor(options?: ManagedIdentityCredentialObjectIdOptions);\n  /**\n   * @internal\n   * @hidden\n   */\n  constructor(\n    clientIdOrOptions?:\n      | string\n      | ManagedIdentityCredentialClientIdOptions\n      | ManagedIdentityCredentialResourceIdOptions\n      | ManagedIdentityCredentialObjectIdOptions,\n    options?: TokenCredentialOptions,\n  ) {\n    let _options: TokenCredentialOptions;\n    if (typeof clientIdOrOptions === \"string\") {\n      this.clientId = clientIdOrOptions;\n      _options = options ?? {};\n    } else {\n      this.clientId = (clientIdOrOptions as ManagedIdentityCredentialClientIdOptions)?.clientId;\n      _options = clientIdOrOptions ?? {};\n    }\n    this.resourceId = (_options as ManagedIdentityCredentialResourceIdOptions)?.resourceId;\n    this.objectId = (_options as ManagedIdentityCredentialObjectIdOptions)?.objectId;\n    this.sendProbeRequest =\n      (_options as InternalManagedIdentityCredentialOptions)?.sendProbeRequest ?? false;\n    // For JavaScript users.\n    const providedIds = [\n      { key: \"clientId\", value: this.clientId },\n      { key: \"resourceId\", value: this.resourceId },\n      { key: \"objectId\", value: this.objectId },\n    ].filter((id) => id.value);\n    if (providedIds.length > 1) {\n      throw new Error(\n        `ManagedIdentityCredential: only one of 'clientId', 'resourceId', or 'objectId' can be provided. Received values: ${JSON.stringify(\n          { clientId: this.clientId, resourceId: this.resourceId, objectId: this.objectId },\n        )}`,\n      );\n    }\n\n    // ManagedIdentity uses http for local requests\n    _options.allowInsecureConnection = true;\n\n    if (_options.retryOptions?.maxRetries !== undefined) {\n      this.msiRetryConfig.maxRetries = _options.retryOptions.maxRetries;\n    }\n\n    this.identityClient = new IdentityClient({\n      ..._options,\n      additionalPolicies: [{ policy: imdsRetryPolicy(this.msiRetryConfig), position: \"perCall\" }],\n    });\n\n    this.managedIdentityApp = new ManagedIdentityApplication({\n      managedIdentityIdParams: {\n        userAssignedClientId: this.clientId,\n        userAssignedResourceId: this.resourceId,\n        userAssignedObjectId: this.objectId,\n      },\n      system: {\n        disableInternalRetries: true,\n        networkClient: this.identityClient,\n        loggerOptions: {\n          logLevel: getMSALLogLevel(getLogLevel()),\n          piiLoggingEnabled: _options.loggingOptions?.enableUnsafeSupportLogging,\n          loggerCallback: defaultLoggerCallback(logger),\n        },\n      },\n    });\n\n    this.isAvailableIdentityClient = new IdentityClient({\n      ..._options,\n      retryOptions: {\n        maxRetries: 0,\n      },\n    });\n\n    const managedIdentitySource = this.managedIdentityApp.getManagedIdentitySource();\n    // CloudShell MSI will ignore any user-assigned identity passed as parameters. To avoid confusion, we prevent this from happening as early as possible.\n    if (managedIdentitySource === \"CloudShell\") {\n      if (this.clientId || this.resourceId || this.objectId) {\n        logger.warning(\n          `CloudShell MSI detected with user-provided IDs - throwing. Received values: ${JSON.stringify(\n            {\n              clientId: this.clientId,\n              resourceId: this.resourceId,\n              objectId: this.objectId,\n            },\n          )}.`,\n        );\n        throw new CredentialUnavailableError(\n          \"ManagedIdentityCredential: Specifying a user-assigned managed identity is not supported for CloudShell at runtime. When using Managed Identity in CloudShell, omit the clientId, resourceId, and objectId parameters.\",\n        );\n      }\n    }\n\n    // ServiceFabric does not support specifying user-assigned managed identity by client ID or resource ID. The managed identity selected is based on the resource configuration.\n    if (managedIdentitySource === \"ServiceFabric\") {\n      if (this.clientId || this.resourceId || this.objectId) {\n        logger.warning(\n          `Service Fabric detected with user-provided IDs - throwing. Received values: ${JSON.stringify(\n            {\n              clientId: this.clientId,\n              resourceId: this.resourceId,\n              objectId: this.objectId,\n            },\n          )}.`,\n        );\n        throw new CredentialUnavailableError(\n          `ManagedIdentityCredential: ${serviceFabricErrorMessage}`,\n        );\n      }\n    }\n\n    logger.info(`Using ${managedIdentitySource} managed identity.`);\n\n    // Check if either clientId, resourceId or objectId was provided and log the value used\n    if (providedIds.length === 1) {\n      const { key, value } = providedIds[0];\n      logger.info(`${managedIdentitySource} with ${key}: ${value}`);\n    }\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   * If an unexpected error occurs, an {@link AuthenticationError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    logger.getToken.info(\"Using the MSAL provider for Managed Identity.\");\n    const resource = mapScopesToResource(scopes);\n    if (!resource) {\n      throw new CredentialUnavailableError(\n        `ManagedIdentityCredential: Multiple scopes are not supported. Scopes: ${JSON.stringify(\n          scopes,\n        )}`,\n      );\n    }\n\n    return tracingClient.withSpan(\"ManagedIdentityCredential.getToken\", options, async () => {\n      try {\n        const isTokenExchangeMsi = await tokenExchangeMsi.isAvailable(this.clientId);\n\n        // Most scenarios are handled by MSAL except for two:\n        // AKS pod identity - MSAL does not implement the token exchange flow.\n        // IMDS Endpoint probing - MSAL does not do any probing before trying to get a token.\n        // As a DefaultAzureCredential optimization we probe the IMDS endpoint with a short timeout and no retries before actually trying to get a token\n        // We will continue to implement these features in the Identity library.\n\n        const identitySource = this.managedIdentityApp.getManagedIdentitySource();\n        const isImdsMsi = identitySource === \"DefaultToImds\" || identitySource === \"Imds\"; // Neither actually checks that IMDS endpoint is available, just that it's the source the MSAL _would_ try to use.\n\n        logger.getToken.info(`MSAL Identity source: ${identitySource}`);\n\n        if (isTokenExchangeMsi) {\n          // In the AKS scenario we will use the existing tokenExchangeMsi indefinitely.\n          logger.getToken.info(\"Using the token exchange managed identity.\");\n          const result = await tokenExchangeMsi.getToken({\n            scopes,\n            clientId: this.clientId,\n            identityClient: this.identityClient,\n            retryConfig: this.msiRetryConfig,\n            resourceId: this.resourceId,\n          });\n\n          if (result === null) {\n            throw new CredentialUnavailableError(\n              \"Attempted to use the token exchange managed identity, but received a null response.\",\n            );\n          }\n\n          return result;\n        } else if (isImdsMsi && this.sendProbeRequest) {\n          // In the IMDS scenario we will probe the IMDS endpoint to ensure it's available before trying to get a token.\n          // If the IMDS endpoint is not available and this is the source that MSAL will use, we will fail-fast with an error that tells DAC to move to the next credential.\n          logger.getToken.info(\"Using the IMDS endpoint to probe for availability.\");\n          const isAvailable = await imdsMsi.isAvailable({\n            scopes,\n            clientId: this.clientId,\n            getTokenOptions: options,\n            identityClient: this.isAvailableIdentityClient,\n            resourceId: this.resourceId,\n          });\n\n          if (!isAvailable) {\n            throw new CredentialUnavailableError(\n              `Attempted to use the IMDS endpoint, but it is not available.`,\n            );\n          }\n        }\n\n        // If we got this far, it means:\n        // - This is not a tokenExchangeMsi,\n        // - We already probed for IMDS endpoint availability and failed-fast if it's unreachable,\n        // or we skip probing because the credential is set in DAC.\n        // We can proceed normally by calling MSAL for a token.\n        logger.getToken.info(\"Calling into MSAL for managed identity token.\");\n        const token = await this.managedIdentityApp.acquireToken({\n          resource,\n        });\n\n        this.ensureValidMsalToken(scopes, token, options);\n        logger.getToken.info(formatSuccess(scopes));\n\n        return {\n          expiresOnTimestamp: token.expiresOn.getTime(),\n          token: token.accessToken,\n          refreshAfterTimestamp: token.refreshOn?.getTime(),\n          tokenType: \"Bearer\",\n        } as AccessToken;\n      } catch (err: any) {\n        logger.getToken.error(formatError(scopes, err));\n\n        // AuthenticationRequiredError described as Error to enforce authentication after trying to retrieve a token silently.\n        // TODO: why would this _ever_ happen considering we're not trying the silent request in this flow?\n        if (err.name === \"AuthenticationRequiredError\") {\n          throw err;\n        }\n\n        if (isNetworkError(err)) {\n          throw new CredentialUnavailableError(\n            `ManagedIdentityCredential: Network unreachable. Message: ${err.message}`,\n            { cause: err },\n          );\n        }\n\n        throw new CredentialUnavailableError(\n          `ManagedIdentityCredential: Authentication failed. Message ${err.message}`,\n          { cause: err },\n        );\n      }\n    });\n  }\n\n  /**\n   * Ensures the validity of the MSAL token\n   */\n  private ensureValidMsalToken(\n    scopes: string | string[],\n    msalToken?: MsalToken,\n    getTokenOptions?: GetTokenOptions,\n  ): asserts msalToken is ValidMsalToken {\n    const createError = (message: string): Error => {\n      logger.getToken.info(message);\n      return new AuthenticationRequiredError({\n        scopes: Array.isArray(scopes) ? scopes : [scopes],\n        getTokenOptions,\n        message,\n      });\n    };\n    if (!msalToken) {\n      throw createError(\"No response.\");\n    }\n    if (!msalToken.expiresOn) {\n      throw createError(`Response had no \"expiresOn\" property.`);\n    }\n    if (!msalToken.accessToken) {\n      throw createError(`Response had no \"accessToken\" property.`);\n    }\n  }\n}\n\nfunction isNetworkError(err: any): boolean {\n  // MSAL error\n  if (err.errorCode === \"network_error\") {\n    return true;\n  }\n\n  // Probe errors\n  if (err.code === \"ENETUNREACH\" || err.code === \"EHOSTUNREACH\") {\n    return true;\n  }\n\n  // This is a special case for Docker Desktop which responds with a 403 with a message that contains \"A socket operation was attempted to an unreachable network\" or \"A socket operation was attempted to an unreachable host\"\n  // rather than just timing out, as expected.\n  if (err.statusCode === 403 || err.code === 403) {\n    if (err.message.includes(\"unreachable\")) {\n      return true;\n    }\n  }\n\n  return false;\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../../../src/credentials/managedIdentityCredential/index.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\n\nimport type { TokenCredentialOptions } from \"../../tokenCredentialOptions.js\";\nimport { getLogLevel } from \"@azure/logger\";\nimport { ManagedIdentityApplication } from \"@azure/msal-node\";\nimport { IdentityClient } from \"../../client/identityClient.js\";\nimport { AuthenticationRequiredError, CredentialUnavailableError } from \"../../errors.js\";\nimport { getMSALLogLevel, defaultLoggerCallback } from \"../../msal/utils.js\";\nimport { imdsRetryPolicy } from \"./imdsRetryPolicy.js\";\nimport type { MSIConfiguration } from \"./models.js\";\nimport { formatSuccess, formatError, credentialLogger } from \"../../util/logging.js\";\nimport { tracingClient } from \"../../util/tracing.js\";\nimport { imdsMsi } from \"./imdsMsi.js\";\nimport { tokenExchangeMsi } from \"./tokenExchangeMsi.js\";\nimport { mapScopesToResource, serviceFabricErrorMessage } from \"./utils.js\";\nimport type { MsalToken, ValidMsalToken } from \"../../msal/types.js\";\nimport type {\n  InternalManagedIdentityCredentialOptions,\n  ManagedIdentityCredentialClientIdOptions,\n  ManagedIdentityCredentialObjectIdOptions,\n  ManagedIdentityCredentialResourceIdOptions,\n} from \"./options.js\";\n\nconst logger = credentialLogger(\"ManagedIdentityCredential\");\n\n/**\n * Attempts authentication using a managed identity available at the deployment environment.\n * This authentication type works in Azure VMs, App Service instances, Azure Functions applications,\n * Azure Kubernetes Services, Azure Service Fabric instances and inside of the Azure Cloud Shell.\n *\n * More information about configuring managed identities can be found here:\n * https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview\n */\nexport class ManagedIdentityCredential implements TokenCredential {\n  private managedIdentityApp: ManagedIdentityApplication;\n  private identityClient: IdentityClient;\n  private clientId?: string;\n  private resourceId?: string;\n  private objectId?: string;\n  private msiRetryConfig: MSIConfiguration[\"retryConfig\"] = {\n    maxRetries: 5,\n    startDelayInMs: 800,\n    intervalIncrement: 2,\n  };\n  private isAvailableIdentityClient: IdentityClient;\n  private sendProbeRequest: boolean;\n\n  /**\n   * Creates an instance of ManagedIdentityCredential with the client ID of a\n   * user-assigned identity, or app registration (when working with AKS pod-identity).\n   *\n   * @param clientId - The client ID of the user-assigned identity, or app registration (when working with AKS pod-identity).\n   * @param options - Options for configuring the client which makes the access token request.\n   */\n  constructor(clientId: string, options?: TokenCredentialOptions);\n  /**\n   * Creates an instance of ManagedIdentityCredential with a client ID\n   *\n   * @param options - Options for configuring the client which makes the access token request.\n   */\n  constructor(options?: ManagedIdentityCredentialClientIdOptions);\n  /**\n   * Creates an instance of ManagedIdentityCredential with a resource ID\n   *\n   * @param options - Options for configuring the resource which makes the access token request.\n   */\n  constructor(options?: ManagedIdentityCredentialResourceIdOptions);\n  /**\n   * Creates an instance of ManagedIdentityCredential with an object ID\n   *\n   * @param options - Options for configuring the resource which makes the access token request.\n   */\n  constructor(options?: ManagedIdentityCredentialObjectIdOptions);\n  /**\n   * @internal\n   * @hidden\n   */\n  constructor(\n    clientIdOrOptions?:\n      | string\n      | ManagedIdentityCredentialClientIdOptions\n      | ManagedIdentityCredentialResourceIdOptions\n      | ManagedIdentityCredentialObjectIdOptions,\n    options?: TokenCredentialOptions,\n  ) {\n    let _options: TokenCredentialOptions;\n    if (typeof clientIdOrOptions === \"string\") {\n      this.clientId = clientIdOrOptions;\n      _options = options ?? {};\n    } else {\n      this.clientId = (clientIdOrOptions as ManagedIdentityCredentialClientIdOptions)?.clientId;\n      _options = clientIdOrOptions ?? {};\n    }\n    this.resourceId = (_options as ManagedIdentityCredentialResourceIdOptions)?.resourceId;\n    this.objectId = (_options as ManagedIdentityCredentialObjectIdOptions)?.objectId;\n    this.sendProbeRequest =\n      (_options as InternalManagedIdentityCredentialOptions)?.sendProbeRequest ?? false;\n    // For JavaScript users.\n    const providedIds = [\n      { key: \"clientId\", value: this.clientId },\n      { key: \"resourceId\", value: this.resourceId },\n      { key: \"objectId\", value: this.objectId },\n    ].filter((id) => id.value);\n    if (providedIds.length > 1) {\n      throw new Error(\n        `ManagedIdentityCredential: only one of 'clientId', 'resourceId', or 'objectId' can be provided. Received values: ${JSON.stringify(\n          { clientId: this.clientId, resourceId: this.resourceId, objectId: this.objectId },\n        )}`,\n      );\n    }\n\n    // ManagedIdentity uses http for local requests\n    _options.allowInsecureConnection = true;\n\n    if (_options.retryOptions?.maxRetries !== undefined) {\n      this.msiRetryConfig.maxRetries = _options.retryOptions.maxRetries;\n    }\n\n    this.identityClient = new IdentityClient({\n      ..._options,\n      additionalPolicies: [{ policy: imdsRetryPolicy(this.msiRetryConfig), position: \"perCall\" }],\n    });\n\n    this.managedIdentityApp = new ManagedIdentityApplication({\n      managedIdentityIdParams: {\n        userAssignedClientId: this.clientId,\n        userAssignedResourceId: this.resourceId,\n        userAssignedObjectId: this.objectId,\n      },\n      system: {\n        disableInternalRetries: true,\n        networkClient: this.identityClient,\n        loggerOptions: {\n          logLevel: getMSALLogLevel(getLogLevel()),\n          piiLoggingEnabled: _options.loggingOptions?.enableUnsafeSupportLogging,\n          loggerCallback: defaultLoggerCallback(logger),\n        },\n      },\n    });\n\n    this.isAvailableIdentityClient = new IdentityClient({\n      ..._options,\n      retryOptions: {\n        maxRetries: 0,\n      },\n    });\n\n    const managedIdentitySource = this.managedIdentityApp.getManagedIdentitySource();\n    // CloudShell MSI will ignore any user-assigned identity passed as parameters. To avoid confusion, we prevent this from happening as early as possible.\n    if (managedIdentitySource === \"CloudShell\") {\n      if (this.clientId || this.resourceId || this.objectId) {\n        logger.warning(\n          `CloudShell MSI detected with user-provided IDs - throwing. Received values: ${JSON.stringify(\n            {\n              clientId: this.clientId,\n              resourceId: this.resourceId,\n              objectId: this.objectId,\n            },\n          )}.`,\n        );\n        throw new CredentialUnavailableError(\n          \"ManagedIdentityCredential: Specifying a user-assigned managed identity is not supported for CloudShell at runtime. When using Managed Identity in CloudShell, omit the clientId, resourceId, and objectId parameters.\",\n        );\n      }\n    }\n\n    // ServiceFabric does not support specifying user-assigned managed identity by client ID or resource ID. The managed identity selected is based on the resource configuration.\n    if (managedIdentitySource === \"ServiceFabric\") {\n      if (this.clientId || this.resourceId || this.objectId) {\n        logger.warning(\n          `Service Fabric detected with user-provided IDs - throwing. Received values: ${JSON.stringify(\n            {\n              clientId: this.clientId,\n              resourceId: this.resourceId,\n              objectId: this.objectId,\n            },\n          )}.`,\n        );\n        throw new CredentialUnavailableError(\n          `ManagedIdentityCredential: ${serviceFabricErrorMessage}`,\n        );\n      }\n    }\n\n    logger.info(`Using ${managedIdentitySource} managed identity.`);\n\n    // Check if either clientId, resourceId or objectId was provided and log the value used\n    if (providedIds.length === 1) {\n      const { key, value } = providedIds[0];\n      logger.info(`${managedIdentitySource} with ${key}: ${value}`);\n    }\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   * If an unexpected error occurs, an {@link AuthenticationError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    logger.getToken.info(\"Using the MSAL provider for Managed Identity.\");\n    const resource = mapScopesToResource(scopes);\n    if (!resource) {\n      throw new CredentialUnavailableError(\n        `ManagedIdentityCredential: Multiple scopes are not supported. Scopes: ${JSON.stringify(\n          scopes,\n        )}`,\n      );\n    }\n\n    return tracingClient.withSpan(\"ManagedIdentityCredential.getToken\", options, async () => {\n      try {\n        const isTokenExchangeMsi = await tokenExchangeMsi.isAvailable(this.clientId);\n\n        // Most scenarios are handled by MSAL except for two:\n        // AKS pod identity - MSAL does not implement the token exchange flow.\n        // IMDS Endpoint probing - MSAL does not do any probing before trying to get a token.\n        // As a DefaultAzureCredential optimization we probe the IMDS endpoint with a short timeout and no retries before actually trying to get a token\n        // We will continue to implement these features in the Identity library.\n\n        const identitySource = this.managedIdentityApp.getManagedIdentitySource();\n        const isImdsMsi = identitySource === \"DefaultToImds\" || identitySource === \"Imds\"; // Neither actually checks that IMDS endpoint is available, just that it's the source the MSAL _would_ try to use.\n\n        logger.getToken.info(`MSAL Identity source: ${identitySource}`);\n\n        if (isTokenExchangeMsi) {\n          // In the AKS scenario we will use the existing tokenExchangeMsi indefinitely.\n          logger.getToken.info(\"Using the token exchange managed identity.\");\n          const result = await tokenExchangeMsi.getToken({\n            scopes,\n            clientId: this.clientId,\n            identityClient: this.identityClient,\n            retryConfig: this.msiRetryConfig,\n            resourceId: this.resourceId,\n          });\n\n          if (result === null) {\n            throw new CredentialUnavailableError(\n              \"Attempted to use the token exchange managed identity, but received a null response.\",\n            );\n          }\n\n          return result;\n        } else if (isImdsMsi && this.sendProbeRequest) {\n          // In the IMDS scenario we will probe the IMDS endpoint to ensure it's available before trying to get a token.\n          // If the IMDS endpoint is not available and this is the source that MSAL will use, we will fail-fast with an error that tells DAC to move to the next credential.\n          logger.getToken.info(\"Using the IMDS endpoint to probe for availability.\");\n          const isAvailable = await imdsMsi.isAvailable({\n            scopes,\n            clientId: this.clientId,\n            getTokenOptions: options,\n            identityClient: this.isAvailableIdentityClient,\n            resourceId: this.resourceId,\n          });\n\n          if (!isAvailable) {\n            throw new CredentialUnavailableError(\n              `Attempted to use the IMDS endpoint, but it is not available.`,\n            );\n          }\n        }\n\n        // If we got this far, it means:\n        // - This is not a tokenExchangeMsi,\n        // - We already probed for IMDS endpoint availability and failed-fast if it's unreachable,\n        // or we skip probing because the credential is set in DAC.\n        // We can proceed normally by calling MSAL for a token.\n        logger.getToken.info(\"Calling into MSAL for managed identity token.\");\n        const token = await this.managedIdentityApp.acquireToken({\n          resource,\n        });\n\n        this.ensureValidMsalToken(scopes, token, options);\n        logger.getToken.info(formatSuccess(scopes));\n\n        return {\n          expiresOnTimestamp: token.expiresOn.getTime(),\n          token: token.accessToken,\n          refreshAfterTimestamp: token.refreshOn?.getTime(),\n          tokenType: \"Bearer\",\n        } as AccessToken;\n      } catch (err: any) {\n        logger.getToken.error(formatError(scopes, err));\n\n        // AuthenticationRequiredError described as Error to enforce authentication after trying to retrieve a token silently.\n        // TODO: why would this _ever_ happen considering we're not trying the silent request in this flow?\n        if (err.name === \"AuthenticationRequiredError\") {\n          throw err;\n        }\n\n        if (isNetworkError(err)) {\n          throw new CredentialUnavailableError(\n            `ManagedIdentityCredential: Network unreachable. Message: ${err.message}`,\n            { cause: err },\n          );\n        }\n\n        throw new CredentialUnavailableError(\n          `ManagedIdentityCredential: Authentication failed. Message ${err.message}`,\n          { cause: err },\n        );\n      }\n    });\n  }\n\n  /**\n   * Ensures the validity of the MSAL token\n   */\n  private ensureValidMsalToken(\n    scopes: string | string[],\n    msalToken?: MsalToken,\n    getTokenOptions?: GetTokenOptions,\n  ): asserts msalToken is ValidMsalToken {\n    const createError = (message: string): Error => {\n      logger.getToken.info(message);\n      return new AuthenticationRequiredError({\n        scopes: Array.isArray(scopes) ? scopes : [scopes],\n        getTokenOptions,\n        message,\n      });\n    };\n    if (!msalToken) {\n      throw createError(\"No response.\");\n    }\n    if (!msalToken.expiresOn) {\n      throw createError(`Response had no \"expiresOn\" property.`);\n    }\n    if (!msalToken.accessToken) {\n      throw createError(`Response had no \"accessToken\" property.`);\n    }\n  }\n}\n\nfunction isNetworkError(err: any): boolean {\n  // MSAL error\n  if (err.errorCode === \"network_error\") {\n    return true;\n  }\n\n  // Probe errors\n  if (err.code === \"ENETUNREACH\" || err.code === \"EHOSTUNREACH\") {\n    return true;\n  }\n\n  // This is a special case for Docker Desktop which responds with a 403 with a message that contains \"A socket operation was attempted to an unreachable network\" or \"A socket operation was attempted to an unreachable host\"\n  // rather than just timing out, as expected.\n  if (err.statusCode === 403 || err.code === 403) {\n    if (err.message.includes(\"unreachable\")) {\n      return true;\n    }\n  }\n\n  return false;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,oBAA4B;AAC5B,uBAA2C;AAC3C,4BAA+B;AAC/B,oBAAwE;AACxE,mBAAuD;AACvD,6BAAgC;AAEhC,qBAA6D;AAC7D,qBAA8B;AAC9B,qBAAwB;AACxB,8BAAiC;AACjC,IAAAA,gBAA+D;AAS/D,MAAM,aAAS,iCAAiB,2BAA2B;AAUpD,MAAM,0BAAqD;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAkD;AAAA,IACxD,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,mBAAmB;AAAA,EACrB;AAAA,EACQ;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgCR,YACE,mBAKA,SACA;AACA,QAAI;AACJ,QAAI,OAAO,sBAAsB,UAAU;AACzC,WAAK,WAAW;AAChB,iBAAW,WAAW,CAAC;AAAA,IACzB,OAAO;AACL,WAAK,WAAY,mBAAgE;AACjF,iBAAW,qBAAqB,CAAC;AAAA,IACnC;AACA,SAAK,aAAc,UAAyD;AAC5E,SAAK,WAAY,UAAuD;AACxE,SAAK,mBACF,UAAuD,oBAAoB;AAE9E,UAAM,cAAc;AAAA,MAClB,EAAE,KAAK,YAAY,OAAO,KAAK,SAAS;AAAA,MACxC,EAAE,KAAK,cAAc,OAAO,KAAK,WAAW;AAAA,MAC5C,EAAE,KAAK,YAAY,OAAO,KAAK,SAAS;AAAA,IAC1C,EAAE,OAAO,CAAC,OAAO,GAAG,KAAK;AACzB,QAAI,YAAY,SAAS,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,oHAAoH,KAAK;AAAA,UACvH,EAAE,UAAU,KAAK,UAAU,YAAY,KAAK,YAAY,UAAU,KAAK,SAAS;AAAA,QAClF,CAAC;AAAA,MACH;AAAA,IACF;AAGA,aAAS,0BAA0B;AAEnC,QAAI,SAAS,cAAc,eAAe,QAAW;AACnD,WAAK,eAAe,aAAa,SAAS,aAAa;AAAA,IACzD;AAEA,SAAK,iBAAiB,IAAI,qCAAe;AAAA,MACvC,GAAG;AAAA,MACH,oBAAoB,CAAC,EAAE,YAAQ,wCAAgB,KAAK,cAAc,GAAG,UAAU,UAAU,CAAC;AAAA,IAC5F,CAAC;AAED,SAAK,qBAAqB,IAAI,4CAA2B;AAAA,MACvD,yBAAyB;AAAA,QACvB,sBAAsB,KAAK;AAAA,QAC3B,wBAAwB,KAAK;AAAA,QAC7B,sBAAsB,KAAK;AAAA,MAC7B;AAAA,MACA,QAAQ;AAAA,QACN,wBAAwB;AAAA,QACxB,eAAe,KAAK;AAAA,QACpB,eAAe;AAAA,UACb,cAAU,kCAAgB,2BAAY,CAAC;AAAA,UACvC,mBAAmB,SAAS,gBAAgB;AAAA,UAC5C,oBAAgB,oCAAsB,MAAM;AAAA,QAC9C;AAAA,MACF;AAAA,IACF,CAAC;AAED,SAAK,4BAA4B,IAAI,qCAAe;AAAA,MAClD,GAAG;AAAA,MACH,cAAc;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF,CAAC;AAED,UAAM,wBAAwB,KAAK,mBAAmB,yBAAyB;AAE/E,QAAI,0BAA0B,cAAc;AAC1C,UAAI,KAAK,YAAY,KAAK,cAAc,KAAK,UAAU;AACrD,eAAO;AAAA,UACL,+EAA+E,KAAK;AAAA,YAClF;AAAA,cACE,UAAU,KAAK;AAAA,cACf,YAAY,KAAK;AAAA,cACjB,UAAU,KAAK;AAAA,YACjB;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,0BAA0B,iBAAiB;AAC7C,UAAI,KAAK,YAAY,KAAK,cAAc,KAAK,UAAU;AACrD,eAAO;AAAA,UACL,+EAA+E,KAAK;AAAA,YAClF;AAAA,cACE,UAAU,KAAK;AAAA,cACf,YAAY,KAAK;AAAA,cACjB,UAAU,KAAK;AAAA,YACjB;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,IAAI;AAAA,UACR,8BAA8B,uCAAyB;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,WAAO,KAAK,SAAS,qBAAqB,oBAAoB;AAG9D,QAAI,YAAY,WAAW,GAAG;AAC5B,YAAM,EAAE,KAAK,MAAM,IAAI,YAAY,CAAC;AACpC,aAAO,KAAK,GAAG,qBAAqB,SAAS,GAAG,KAAK,KAAK,EAAE;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAa,SACX,QACA,UAA2B,CAAC,GACN;AACtB,WAAO,SAAS,KAAK,+CAA+C;AACpE,UAAM,eAAW,mCAAoB,MAAM;AAC3C,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,yEAAyE,KAAK;AAAA,UAC5E;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO,6BAAc,SAAS,sCAAsC,SAAS,YAAY;AACvF,UAAI;AACF,cAAM,qBAAqB,MAAM,yCAAiB,YAAY,KAAK,QAAQ;AAQ3E,cAAM,iBAAiB,KAAK,mBAAmB,yBAAyB;AACxE,cAAM,YAAY,mBAAmB,mBAAmB,mBAAmB;AAE3E,eAAO,SAAS,KAAK,yBAAyB,cAAc,EAAE;AAE9D,YAAI,oBAAoB;AAEtB,iBAAO,SAAS,KAAK,4CAA4C;AACjE,gBAAM,SAAS,MAAM,yCAAiB,SAAS;AAAA,YAC7C;AAAA,YACA,UAAU,KAAK;AAAA,YACf,gBAAgB,KAAK;AAAA,YACrB,aAAa,KAAK;AAAA,YAClB,YAAY,KAAK;AAAA,UACnB,CAAC;AAED,cAAI,WAAW,MAAM;AACnB,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAEA,iBAAO;AAAA,QACT,WAAW,aAAa,KAAK,kBAAkB;AAG7C,iBAAO,SAAS,KAAK,oDAAoD;AACzE,gBAAM,cAAc,MAAM,uBAAQ,YAAY;AAAA,YAC5C;AAAA,YACA,UAAU,KAAK;AAAA,YACf,iBAAiB;AAAA,YACjB,gBAAgB,KAAK;AAAA,YACrB,YAAY,KAAK;AAAA,UACnB,CAAC;AAED,cAAI,CAAC,aAAa;AAChB,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAOA,eAAO,SAAS,KAAK,+CAA+C;AACpE,cAAM,QAAQ,MAAM,KAAK,mBAAmB,aAAa;AAAA,UACvD;AAAA,QACF,CAAC;AAED,aAAK,qBAAqB,QAAQ,OAAO,OAAO;AAChD,eAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAE1C,eAAO;AAAA,UACL,oBAAoB,MAAM,UAAU,QAAQ;AAAA,UAC5C,OAAO,MAAM;AAAA,UACb,uBAAuB,MAAM,WAAW,QAAQ;AAAA,UAChD,WAAW;AAAA,QACb;AAAA,MACF,SAAS,KAAU;AACjB,eAAO,SAAS,UAAM,4BAAY,QAAQ,GAAG,CAAC;AAI9C,YAAI,IAAI,SAAS,+BAA+B;AAC9C,gBAAM;AAAA,QACR;AAEA,YAAI,eAAe,GAAG,GAAG;AACvB,gBAAM,IAAI;AAAA,YACR,4DAA4D,IAAI,OAAO;AAAA,YACvE,EAAE,OAAO,IAAI;AAAA,UACf;AAAA,QACF;AAEA,cAAM,IAAI;AAAA,UACR,6DAA6D,IAAI,OAAO;AAAA,UACxE,EAAE,OAAO,IAAI;AAAA,QACf;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,qBACN,QACA,WACA,iBACqC;AACrC,UAAM,cAAc,CAAC,YAA2B;AAC9C,aAAO,SAAS,KAAK,OAAO;AAC5B,aAAO,IAAI,0CAA4B;AAAA,QACrC,QAAQ,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;AAAA,QAChD;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,CAAC,WAAW;AACd,YAAM,YAAY,cAAc;AAAA,IAClC;AACA,QAAI,CAAC,UAAU,WAAW;AACxB,YAAM,YAAY,uCAAuC;AAAA,IAC3D;AACA,QAAI,CAAC,UAAU,aAAa;AAC1B,YAAM,YAAY,yCAAyC;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,SAAS,eAAe,KAAmB;AAEzC,MAAI,IAAI,cAAc,iBAAiB;AACrC,WAAO;AAAA,EACT;AAGA,MAAI,IAAI,SAAS,iBAAiB,IAAI,SAAS,gBAAgB;AAC7D,WAAO;AAAA,EACT;AAIA,MAAI,IAAI,eAAe,OAAO,IAAI,SAAS,KAAK;AAC9C,QAAI,IAAI,QAAQ,SAAS,aAAa,GAAG;AACvC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;",
+  "names": ["import_utils"]
+}