@azure/identity 4.14.0-beta.2 → 4.14.0-beta.3

package/dist/commonjs/credentials/workloadIdentityCredential.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"workloadIdentityCredential.js","sourceRoot":"","sources":["../../../src/credentials/workloadIdentityCredential.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAwElC,4EAwCC;AA7GD,mDAAsE;AAEtE,iFAA2E;AAC3E,4CAA0D;AAE1D,+DAAyD;AACzD,+CAA4C;AAE5C,kEAAoE;AAEpE,uEAAyE;AACzE,qCAAuC;AAEvC,MAAM,cAAc,GAAG,4BAA4B,CAAC;AACpD;;;;;;GAMG;AACU,QAAA,qCAAqC,GAAG;IACnD,iBAAiB;IACjB,iBAAiB;IACjB,4BAA4B;CAC7B,CAAC;AAEF,MAAM,MAAM,GAAG,IAAA,6BAAgB,EAAC,cAAc,CAAC,CAAC;AAEhD;;GAEG;AACH,MAAM,aAAa,GAAG;IACpB,2BAA2B,EAAE,CAAC,QAAgB,EAAE,KAAc,EAAE,EAAE,CAChE,2CAA2C,QAAQ,MAAM,KAAK,EAAE;IAClE,oBAAoB,EAAE,CAAC,QAAgB,EAAE,EAAE,CACzC,qDAAqD,QAAQ,GAAG;IAClE,2BAA2B,EAAE,CAAC,GAAW,EAAE,EAAE,CAC3C,8BAA8B,GAAG,8BAA8B;IACjE,uBAAuB,EAAE,CAAC,GAAW,EAAE,EAAE,CACvC,8BAA8B,GAAG,4BAA4B;IAC/D,0BAA0B,EAAE,CAAC,GAAW,EAAE,EAAE,CAC1C,8BAA8B,GAAG,+BAA+B;IAClE,aAAa,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,iCAAiC,IAAI,EAAE;IACxE,sBAAsB,EAAE,CAAC,IAAY,EAAE,KAAc,EAAE,EAAE,CACvD,uCAAuC,IAAI,KAAK,KAAK,EAAE;IACzD,uBAAuB,EAAE,8DAA8D;IACvF,iBAAiB,EAAE,CAAC,IAAwB,EAAE,EAAE,CAAC,8BAA8B,IAAI,GAAG;IACtF,eAAe,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,0BAA0B,IAAI,GAAG;IACpE,YAAY,EAAE,qCAAqC;IACnD,kBAAkB,EAAE;qIAC+G;IACnI,kBAAkB,EAAE;qIAC+G;IACnI,wBAAwB,EAAE;qIACyG;IACnI,mBAAmB,EAAE,6GAA6G;IAClI,0BAA0B,EAAE,iGAAiG;IAC7H,gBAAgB,EAAE;;;;iKAI6I;CAChK,CAAC;AAEF;;;GAGG;AACH,SAAgB,gCAAgC,CAAC,QAAgB;IAC/D,IAAI,UAAe,CAAC;IACpB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CACnG,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,2BAA2B,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,uBAAuB,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,0BAA0B,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACvD,+EAA+E;QAC/E,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;IAC5B,CAAC;IAED,OAAO,UAAU,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,0BAA0B;IAC7B,MAAM,CAAwC;IAC9C,8BAA8B,GAAuB,SAAS,CAAC;IAC/D,SAAS,GAAuB,SAAS,CAAC;IAC1C,sBAAsB,CAAqB;IAEnD,wDAAwD;IAChD,iBAAiB,CAAsD;IACvE,YAAY,CAAqB;IACjC,MAAM,CAAqB;IAC3B,MAAM,CAAqB;IAC3B,OAAO,CAAqB;IAEpC;;;;OAIG;IACH,YAAY,OAA2C;QACrD,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAA,2BAAc,EAAC,6CAAqC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,8CAA8C,WAAW,EAAE,CAAC,CAAC;QAEzE,MAAM,iCAAiC,GAAG,OAAO,IAAI,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,iCAAiC,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3F,MAAM,QAAQ,GAAG,iCAAiC,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3F,IAAI,CAAC,sBAAsB;YACzB,iCAAiC,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAE5F,IAAI,QAAQ,EAAE,CAAC;YACb,IAAA,gCAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,kBAAkB,EAAE,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,kBAAkB,EAAE,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,wBAAwB,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,IAAI,iCAAiC,CAAC,gBAAgB,EAAE,CAAC;YACvD,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YACtE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;YAChE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAE9D,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,mGAAmG;gBACnG,iFAAiF;gBACjF,IAAI,iBAAiB,IAAI,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;oBAC9D,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,mBAAmB,EAAE,CAC1E,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,wGAAwG,CACzG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;gBAE1E,oEAAoE;gBACpE,gFAAgF;gBAChF,IAAI,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;oBACzC,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,0BAA0B,EAAE,CACjF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC;gBAC/B,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC;gBAC/B,IAAI,CAAC,OAAO,GAAG,iBAAiB,CAAC;gBAEjC,iDAAiD;gBACjD,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;gBAC1D,iCAAiC,CAAC,UAAU,GAAG,WAAW,CAAC;gBAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,yCAAyC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CACT,sDAAsD,QAAQ,eAAe,iCAAiC,CAAC,QAAQ,uCAAuC,CAC/J,CAAC;QAEF,IAAI,CAAC,MAAM,GAAG,IAAI,wDAAyB,CACzC,QAAQ,EACR,QAAQ,EACR,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAChC,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,oBAAoB,CAAC,aAAqB;QAChD,MAAM,aAAa,GAAG,IAAA,4CAAuB,GAAE,CAAC;QAChD,iFAAiF;QACjF,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAE/C,OAAO;YACL,WAAW,EAAE,KAAK,EAAE,OAAwB,EAA6B,EAAE;gBACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAExC,MAAM,CAAC,IAAI,CACT,GAAG,cAAc,iDAAiD,aAAa,EAAE,CAClF,CAAC;gBAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;gBAExC,kEAAkE;gBAClE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,GAAG,WAAW;oBACjC,CAAC,CAAC,QAAQ,CAAC,QAAQ,GAAG,GAAG,GAAG,WAAW,CAAC;gBAE1C,qEAAqE;gBACrE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC;gBAC/B,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;gBAClC,MAAM,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;gBAE9B,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAChC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBAE5C,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,wBAAwB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBACpE,wDAAwD;gBACxD,OAAO,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,cAAc;QACpB,yCAAyC;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAA,gDAAyB,EAAC,IAAI,CAAC,MAAO,CAAC,EAAE,CAAC;oBAC7C,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,uBAAuB,EAAE,CAC9E,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,iBAAiB,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1C,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QAED,qEAAqE;QACrE,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAO,EAAE,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;QACD,+CAA+C;QAC/C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,sFAAsF;gBACtF,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACjF,CAAC;YACJ,CAAC;YACD,2DAA2D;YAC3D,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAElD,IAAI,CAAC,IAAA,gDAAyB,EAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,uBAAuB,EAAE,CAC9E,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,IAAI,CAAC,iBAAiB,GAAG;gBACvB,EAAE,EAAE,YAAY;gBAChB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;aAClD,CAAC;YACF,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC,iBAAkB,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAyB,EACzB,OAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,GAAG,cAAc,qBAAqB,aAAa,CAAC,gBAAgB,EAAE,CAAC;YAC5F,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1B,MAAM,IAAI,sCAA0B,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,2CAA2C;QAC3C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC,8BAA8B,GAAG,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,sCAA0B,CAClC,GAAG,cAAc,qBAAqB,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,CACnG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,8BAA8B,GAAG,KAAK,CAAC;gBAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAjQD,gEAiQC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { credentialLogger, processEnvVars } from \"../util/logging.js\";\n\nimport { ClientAssertionCredential } from \"./clientAssertionCredential.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport type { WorkloadIdentityCredentialOptions } from \"./workloadIdentityCredentialOptions.js\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { readFile } from \"node:fs/promises\";\nimport type { PipelineRequest, PipelineResponse, HttpClient } from \"@azure/core-rest-pipeline\";\nimport { createDefaultHttpClient } from \"@azure/core-rest-pipeline\";\nimport type { TlsSettings } from \"@azure/core-rest-pipeline\";\nimport { canParseAsX509Certificate } from \"../util/certificatesUtils.js\";\nimport { readFileSync } from \"node:fs\";\n\nconst credentialName = \"WorkloadIdentityCredential\";\n/**\n * Contains the list of all supported environment variable names so that an\n * appropriate error message can be generated when no credentials can be\n * configured.\n *\n * @internal\n */\nexport const SupportedWorkloadEnvironmentVariables = [\n  \"AZURE_TENANT_ID\",\n  \"AZURE_CLIENT_ID\",\n  \"AZURE_FEDERATED_TOKEN_FILE\",\n];\n\nconst logger = credentialLogger(credentialName);\n\n/**\n * Error messages for WorkloadIdentityCredential\n */\nconst ErrorMessages = {\n  FAILED_TO_PARSE_TOKEN_PROXY: (endpoint: string, error: unknown) =>\n    `Failed to parse custom token proxy URL \"${endpoint}\": ${error}`,\n  INVALID_HTTPS_SCHEME: (protocol: string) =>\n    `Custom token endpoint must use https scheme, got \"${protocol}\"`,\n  TOKEN_ENDPOINT_NO_USER_INFO: (url: string) =>\n    `Custom token endpoint URL \"${url}\" must not contain user info`,\n  TOKEN_ENDPOINT_NO_QUERY: (url: string) =>\n    `Custom token endpoint URL \"${url}\" must not contain a query`,\n  TOKEN_ENDPOINT_NO_FRAGMENT: (url: string) =>\n    `Custom token endpoint URL \"${url}\" must not contain a fragment`,\n  CA_FILE_EMPTY: (file: string) => `CA certificate file is empty: ${file}`,\n  FAILED_TO_READ_CA_FILE: (file: string, error: unknown) =>\n    `Failed to read CA certificate file: ${file}. ${error}`,\n  INVALID_CA_CERTIFICATES: `Invalid CA certificate data: no valid PEM certificates found`,\n  INVALID_FILE_PATH: (path: string | undefined) => `Invalid file path provided ${path}.`,\n  NO_FILE_CONTENT: (path: string) => `No content on the file ${path}.`,\n  NO_CA_SOURCE: `No CA certificate source specified.`,\n  CLIENT_ID_REQUIRED: `clientId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_CLIENT_ID\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n  TENANT_ID_REQUIRED: `tenantId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_TENANT_ID\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n  TOKEN_FILE_PATH_REQUIRED: `federatedTokenFilePath is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_FEDERATED_TOKEN_FILE\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n  TOKEN_PROXY_NOT_SET: `AZURE_KUBERNETES_TOKEN_PROXY is not set but other custom endpoint-related environment variables are present`,\n  CA_FILE_AND_DATA_EXCLUSIVE: `AZURE_KUBERNETES_CA_FILE and AZURE_KUBERNETES_CA_DATA are mutually exclusive. Specify only one.`,\n  MISSING_ENV_VARS: `tenantId, clientId, and federatedTokenFilePath are required parameters. \n      In DefaultAzureCredential and ManagedIdentityCredential, these can be provided as environment variables - \n      \"AZURE_TENANT_ID\",\n      \"AZURE_CLIENT_ID\",\n      \"AZURE_FEDERATED_TOKEN_FILE\". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n};\n\n/**\n * @internal\n * Parses and validates the custom token proxy endpoint URL\n */\nexport function parseAndValidateCustomTokenProxy(endpoint: string): string {\n  let tokenProxy: URL;\n  try {\n    tokenProxy = new URL(endpoint);\n  } catch (error) {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.FAILED_TO_PARSE_TOKEN_PROXY(endpoint, error)}`,\n    );\n  }\n\n  if (tokenProxy.protocol !== \"https:\") {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.INVALID_HTTPS_SCHEME(tokenProxy.protocol)}`,\n    );\n  }\n\n  if (tokenProxy.username || tokenProxy.password) {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_ENDPOINT_NO_USER_INFO(tokenProxy.toString())}`,\n    );\n  }\n\n  if (tokenProxy.search) {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_ENDPOINT_NO_QUERY(tokenProxy.toString())}`,\n    );\n  }\n\n  if (tokenProxy.hash) {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_ENDPOINT_NO_FRAGMENT(tokenProxy.toString())}`,\n    );\n  }\n\n  if (!tokenProxy.pathname || tokenProxy.pathname === \"\") {\n    // if the path is empty, set it to \"/\" to avoid stripping the path from req.URL\n    tokenProxy.pathname = \"/\";\n  }\n\n  return tokenProxy.toString();\n}\n\n/**\n * Workload Identity authentication is a feature in Azure that allows applications running on virtual machines (VMs)\n * to access other Azure resources without the need for a service principal or managed identity. With Workload Identity\n * authentication, applications authenticate themselves using their own identity, rather than using a shared service\n * principal or managed identity. Under the hood, Workload Identity authentication uses the concept of Service Account\n * Credentials (SACs), which are automatically created by Azure and stored securely in the VM. By using Workload\n * Identity authentication, you can avoid the need to manage and rotate service principals or managed identities for\n * each application on each VM. Additionally, because SACs are created automatically and managed by Azure, you don't\n * need to worry about storing and securing sensitive credentials themselves.\n * The WorkloadIdentityCredential supports Microsoft Entra Workload ID authentication on Azure Kubernetes and acquires\n * a token using the SACs available in the Azure Kubernetes environment.\n * Refer to <a href=\"https://learn.microsoft.com/azure/aks/workload-identity-overview\">Microsoft Entra\n * Workload ID</a> for more information.\n */\nexport class WorkloadIdentityCredential implements TokenCredential {\n  private client: ClientAssertionCredential | undefined;\n  private azureFederatedTokenFileContent: string | undefined = undefined;\n  private cacheDate: number | undefined = undefined;\n  private federatedTokenFilePath: string | undefined;\n\n  // AKS proxy CA caching - persists across token requests\n  private cachedTlsSettings: (TlsSettings & { servername?: string }) | undefined;\n  private cachedCaData: Buffer | undefined;\n  private caData: string | undefined;\n  private caFile: string | undefined;\n  private sniName: string | undefined;\n\n  /**\n   * WorkloadIdentityCredential supports Microsoft Entra Workload ID on Kubernetes.\n   *\n   * @param options - The identity client options to use for authentication.\n   */\n  constructor(options?: WorkloadIdentityCredentialOptions) {\n    // Logging environment variables for error details\n    const assignedEnv = processEnvVars(SupportedWorkloadEnvironmentVariables).assigned.join(\", \");\n    logger.info(`Found the following environment variables: ${assignedEnv}`);\n\n    const workloadIdentityCredentialOptions = options ?? {};\n    const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;\n    const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;\n    this.federatedTokenFilePath =\n      workloadIdentityCredentialOptions.tokenFilePath || process.env.AZURE_FEDERATED_TOKEN_FILE;\n\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    if (!clientId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.CLIENT_ID_REQUIRED}`,\n      );\n    }\n\n    if (!tenantId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.TENANT_ID_REQUIRED}`,\n      );\n    }\n\n    if (!this.federatedTokenFilePath) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_FILE_PATH_REQUIRED}`,\n      );\n    }\n\n    // Use identity binding mode only when enableAzureProxy is set\n    if (workloadIdentityCredentialOptions.enableAzureProxy) {\n      const kubernetesTokenProxy = process.env.AZURE_KUBERNETES_TOKEN_PROXY;\n      const kubernetesSNIName = process.env.AZURE_KUBERNETES_SNI_NAME;\n      const kubernetesCAFile = process.env.AZURE_KUBERNETES_CA_FILE;\n      const kubernetesCAData = process.env.AZURE_KUBERNETES_CA_DATA;\n\n      if (!kubernetesTokenProxy) {\n        // Custom token proxy is not set, while other Kubernetes-related environment variables are present,\n        // this is likely a configuration issue so erroring out to avoid misconfiguration\n        if (kubernetesSNIName || kubernetesCAFile || kubernetesCAData) {\n          throw new CredentialUnavailableError(\n            `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_PROXY_NOT_SET}`,\n          );\n        }\n        logger.info(\n          `enableAzureProxy is true but AZURE_KUBERNETES_TOKEN_PROXY is not set, using normal authentication flow`,\n        );\n      } else {\n        const tokenProxy = parseAndValidateCustomTokenProxy(kubernetesTokenProxy);\n\n        // CAFile and CAData are mutually exclusive, at most one can be set.\n        // If none of CAFile or CAData are set, the default system CA pool will be used.\n        if (kubernetesCAFile && kubernetesCAData) {\n          throw new CredentialUnavailableError(\n            `${credentialName}: is unavailable. ${ErrorMessages.CA_FILE_AND_DATA_EXCLUSIVE}`,\n          );\n        }\n\n        this.caData = kubernetesCAData;\n        this.caFile = kubernetesCAFile;\n        this.sniName = kubernetesSNIName;\n\n        // Configure client options with AKS proxy client\n        const proxyClient = this.createAksProxyClient(tokenProxy);\n        workloadIdentityCredentialOptions.httpClient = proxyClient;\n        logger.info(`${credentialName}: Using proxy client for token requests`);\n      }\n    }\n\n    logger.info(\n      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`,\n    );\n\n    this.client = new ClientAssertionCredential(\n      tenantId,\n      clientId,\n      this.readFileContents.bind(this),\n      workloadIdentityCredentialOptions,\n    );\n  }\n\n  /**\n   * Creates a proxy HttpClient that intercepts token requests and redirects them to the Kubernetes endpoint\n   * Caching is handled at the credential level to persist across token requests\n   */\n  private createAksProxyClient(tokenEndpoint: string): HttpClient {\n    const defaultClient = createDefaultHttpClient();\n    // Init cached TLS settings at construction time to fail fast on misconfiguration\n    this.cachedTlsSettings = this.getTlsSettings();\n\n    return {\n      sendRequest: async (request: PipelineRequest): Promise<PipelineResponse> => {\n        const requestUrl = new URL(request.url);\n\n        logger.info(\n          `${credentialName}: Redirecting request to Kubernetes endpoint: ${tokenEndpoint}`,\n        );\n\n        const proxyUrl = new URL(tokenEndpoint);\n\n        // Remove leading slash from request path and join with proxy path\n        const requestPath = requestUrl.pathname.replace(/^\\//, \"\");\n        const combinedPath = proxyUrl.pathname.endsWith(\"/\")\n          ? proxyUrl.pathname + requestPath\n          : proxyUrl.pathname + \"/\" + requestPath;\n\n        // Create new URL preserving query and fragment from original request\n        const newUrl = new URL(proxyUrl.origin);\n        newUrl.pathname = combinedPath;\n        newUrl.search = requestUrl.search;\n        newUrl.hash = requestUrl.hash;\n\n        request.url = newUrl.toString();\n        request.tlsSettings = this.getTlsSettings();\n\n        logger.info(`${credentialName}: Sending request to ${request.url}`);\n        // Forward the modified request with custom TLS settings\n        return defaultClient.sendRequest(request);\n      },\n    };\n  }\n\n  /**\n   * Gets TLS settings for the request.\n   * Handles a few scenarios with CA data or CA file provided.\n   */\n  private getTlsSettings(): TlsSettings & { servername?: string } {\n    // No CA overrides, use default transport\n    if (!this.caData && !this.caFile) {\n      if (!this.cachedTlsSettings) {\n        this.cachedTlsSettings = this.sniName ? { servername: this.sniName } : {};\n      }\n      return this.cachedTlsSettings;\n    }\n\n    // Host provided CA bytes in AZURE_KUBERNETES_CA_DATA and can't change now\n    if (!this.caFile) {\n      if (!this.cachedTlsSettings) {\n        if (!canParseAsX509Certificate(this.caData!)) {\n          throw new CredentialUnavailableError(\n            `${credentialName}: is unavailable. ${ErrorMessages.INVALID_CA_CERTIFICATES}`,\n          );\n        }\n        this.cachedTlsSettings = this.sniName ? { servername: this.sniName } : {};\n        this.cachedTlsSettings.ca = this.caData;\n      }\n      return this.cachedTlsSettings;\n    }\n\n    // Host provided the CA bytes in a file whose contents it can change,\n    let fileContent: Buffer;\n    try {\n      fileContent = readFileSync(this.caFile);\n    } catch (error) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.FAILED_TO_READ_CA_FILE(this.caFile!, error)}`,\n      );\n    }\n    // This can happen in the middle of CA rotation\n    if (fileContent.length === 0) {\n      if (!this.cachedTlsSettings) {\n        // If the transport was never created, error out here to force retrying the call later\n        throw new CredentialUnavailableError(\n          `${credentialName}: is unavailable. ${ErrorMessages.CA_FILE_EMPTY(this.caFile)}`,\n        );\n      }\n      // If the transport was already created, just keep using it\n      return this.cachedTlsSettings;\n    }\n\n    // Check if CA has changed\n    if (!this.cachedCaData || !fileContent.equals(this.cachedCaData)) {\n      const caDataString = fileContent.toString(\"utf8\");\n\n      if (!canParseAsX509Certificate(caDataString)) {\n        throw new CredentialUnavailableError(\n          `${credentialName}: is unavailable. ${ErrorMessages.INVALID_CA_CERTIFICATES}`,\n        );\n      }\n\n      // CA has changed, rebuild the TLS settings with new CA pool\n      this.cachedTlsSettings = {\n        ca: caDataString,\n        ...(this.sniName && { servername: this.sniName }),\n      };\n      this.cachedCaData = fileContent;\n    }\n\n    return this.cachedTlsSettings!;\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options?: GetTokenOptions,\n  ): Promise<AccessToken> {\n    if (!this.client) {\n      const errorMessage = `${credentialName}: is unavailable. ${ErrorMessages.MISSING_ENV_VARS}`;\n      logger.info(errorMessage);\n      throw new CredentialUnavailableError(errorMessage);\n    }\n    logger.info(\"Invoking getToken() of Client Assertion Credential\");\n    return this.client.getToken(scopes, options);\n  }\n\n  private async readFileContents(): Promise<string> {\n    // Cached assertions expire after 5 minutes\n    if (this.cacheDate !== undefined && Date.now() - this.cacheDate >= 1000 * 60 * 5) {\n      this.azureFederatedTokenFileContent = undefined;\n    }\n    if (!this.federatedTokenFilePath) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.INVALID_FILE_PATH(this.federatedTokenFilePath)}`,\n      );\n    }\n    if (!this.azureFederatedTokenFileContent) {\n      const file = await readFile(this.federatedTokenFilePath, \"utf8\");\n      const value = file.trim();\n      if (!value) {\n        throw new CredentialUnavailableError(\n          `${credentialName}: is unavailable. ${ErrorMessages.NO_FILE_CONTENT(this.federatedTokenFilePath)}`,\n        );\n      } else {\n        this.azureFederatedTokenFileContent = value;\n        this.cacheDate = Date.now();\n      }\n    }\n    return this.azureFederatedTokenFileContent;\n  }\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/workloadIdentityCredential.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { credentialLogger, processEnvVars } from \"../util/logging.js\";\n\nimport { ClientAssertionCredential } from \"./clientAssertionCredential.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport type { WorkloadIdentityCredentialOptions } from \"./workloadIdentityCredentialOptions.js\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { readFile } from \"node:fs/promises\";\nimport type { PipelineRequest, PipelineResponse, HttpClient } from \"@azure/core-rest-pipeline\";\nimport { createDefaultHttpClient } from \"@azure/core-rest-pipeline\";\nimport type { TlsSettings } from \"@azure/core-rest-pipeline\";\nimport { canParseAsX509Certificate } from \"../util/certificatesUtils.js\";\nimport { readFileSync } from \"node:fs\";\n\nconst credentialName = \"WorkloadIdentityCredential\";\n/**\n * Contains the list of all supported environment variable names so that an\n * appropriate error message can be generated when no credentials can be\n * configured.\n *\n * @internal\n */\nexport const SupportedWorkloadEnvironmentVariables = [\n  \"AZURE_TENANT_ID\",\n  \"AZURE_CLIENT_ID\",\n  \"AZURE_FEDERATED_TOKEN_FILE\",\n];\n\nconst logger = credentialLogger(credentialName);\n\n/**\n * Error messages for WorkloadIdentityCredential\n */\nconst ErrorMessages = {\n  FAILED_TO_PARSE_TOKEN_PROXY: (endpoint: string, error: unknown) =>\n    `Failed to parse custom token proxy URL \"${endpoint}\": ${error}`,\n  INVALID_HTTPS_SCHEME: (protocol: string) =>\n    `Custom token endpoint must use https scheme, got \"${protocol}\"`,\n  TOKEN_ENDPOINT_NO_USER_INFO: (url: string) =>\n    `Custom token endpoint URL \"${url}\" must not contain user info`,\n  TOKEN_ENDPOINT_NO_QUERY: (url: string) =>\n    `Custom token endpoint URL \"${url}\" must not contain a query`,\n  TOKEN_ENDPOINT_NO_FRAGMENT: (url: string) =>\n    `Custom token endpoint URL \"${url}\" must not contain a fragment`,\n  CA_FILE_EMPTY: (file: string) => `CA certificate file is empty: ${file}`,\n  FAILED_TO_READ_CA_FILE: (file: string, error: unknown) =>\n    `Failed to read CA certificate file: ${file}. ${error}`,\n  INVALID_CA_CERTIFICATES: `Invalid CA certificate data: no valid PEM certificates found`,\n  INVALID_FILE_PATH: (path: string | undefined) => `Invalid file path provided ${path}.`,\n  NO_FILE_CONTENT: (path: string) => `No content on the file ${path}.`,\n  NO_CA_SOURCE: `No CA certificate source specified.`,\n  CLIENT_ID_REQUIRED: `clientId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_CLIENT_ID\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n  TENANT_ID_REQUIRED: `tenantId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_TENANT_ID\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n  TOKEN_FILE_PATH_REQUIRED: `federatedTokenFilePath is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - \"AZURE_FEDERATED_TOKEN_FILE\".\n        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n  TOKEN_PROXY_NOT_SET: `AZURE_KUBERNETES_TOKEN_PROXY is not set but other custom endpoint-related environment variables are present`,\n  CA_FILE_AND_DATA_EXCLUSIVE: `AZURE_KUBERNETES_CA_FILE and AZURE_KUBERNETES_CA_DATA are mutually exclusive. Specify only one.`,\n  MISSING_ENV_VARS: `tenantId, clientId, and federatedTokenFilePath are required parameters. \n      In DefaultAzureCredential and ManagedIdentityCredential, these can be provided as environment variables - \n      \"AZURE_TENANT_ID\",\n      \"AZURE_CLIENT_ID\",\n      \"AZURE_FEDERATED_TOKEN_FILE\". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,\n};\n\n/**\n * @internal\n * Parses and validates the custom token proxy endpoint URL\n */\nexport function parseAndValidateCustomTokenProxy(endpoint: string): string {\n  let tokenProxy: URL;\n  try {\n    tokenProxy = new URL(endpoint);\n  } catch (error) {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.FAILED_TO_PARSE_TOKEN_PROXY(endpoint, error)}`,\n    );\n  }\n\n  if (tokenProxy.protocol !== \"https:\") {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.INVALID_HTTPS_SCHEME(tokenProxy.protocol)}`,\n    );\n  }\n\n  if (tokenProxy.username || tokenProxy.password) {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_ENDPOINT_NO_USER_INFO(tokenProxy.toString())}`,\n    );\n  }\n\n  if (tokenProxy.search) {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_ENDPOINT_NO_QUERY(tokenProxy.toString())}`,\n    );\n  }\n\n  if (tokenProxy.hash) {\n    throw new CredentialUnavailableError(\n      `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_ENDPOINT_NO_FRAGMENT(tokenProxy.toString())}`,\n    );\n  }\n\n  if (!tokenProxy.pathname || tokenProxy.pathname === \"\") {\n    // if the path is empty, set it to \"/\" to avoid stripping the path from req.URL\n    tokenProxy.pathname = \"/\";\n  }\n\n  return tokenProxy.toString();\n}\n\n/**\n * Workload Identity authentication is a feature in Azure that allows applications running on virtual machines (VMs)\n * to access other Azure resources without the need for a service principal or managed identity. With Workload Identity\n * authentication, applications authenticate themselves using their own identity, rather than using a shared service\n * principal or managed identity. Under the hood, Workload Identity authentication uses the concept of Service Account\n * Credentials (SACs), which are automatically created by Azure and stored securely in the VM. By using Workload\n * Identity authentication, you can avoid the need to manage and rotate service principals or managed identities for\n * each application on each VM. Additionally, because SACs are created automatically and managed by Azure, you don't\n * need to worry about storing and securing sensitive credentials themselves.\n * The WorkloadIdentityCredential supports Microsoft Entra Workload ID authentication on Azure Kubernetes and acquires\n * a token using the SACs available in the Azure Kubernetes environment.\n * Refer to <a href=\"https://learn.microsoft.com/azure/aks/workload-identity-overview\">Microsoft Entra\n * Workload ID</a> for more information.\n */\nexport class WorkloadIdentityCredential implements TokenCredential {\n  private client: ClientAssertionCredential | undefined;\n  private azureFederatedTokenFileContent: string | undefined = undefined;\n  private cacheDate: number | undefined = undefined;\n  private federatedTokenFilePath: string | undefined;\n\n  // AKS proxy CA caching - persists across token requests\n  private cachedTlsSettings: (TlsSettings & { servername?: string }) | undefined;\n  private cachedCaData: Buffer | undefined;\n  private caData: string | undefined;\n  private caFile: string | undefined;\n  private sniName: string | undefined;\n\n  /**\n   * WorkloadIdentityCredential supports Microsoft Entra Workload ID on Kubernetes.\n   *\n   * @param options - The identity client options to use for authentication.\n   */\n  constructor(options?: WorkloadIdentityCredentialOptions) {\n    // Logging environment variables for error details\n    const assignedEnv = processEnvVars(SupportedWorkloadEnvironmentVariables).assigned.join(\", \");\n    logger.info(`Found the following environment variables: ${assignedEnv}`);\n\n    const workloadIdentityCredentialOptions = options ?? {};\n    const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;\n    const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;\n    this.federatedTokenFilePath =\n      workloadIdentityCredentialOptions.tokenFilePath || process.env.AZURE_FEDERATED_TOKEN_FILE;\n\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    if (!clientId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.CLIENT_ID_REQUIRED}`,\n      );\n    }\n\n    if (!tenantId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.TENANT_ID_REQUIRED}`,\n      );\n    }\n\n    if (!this.federatedTokenFilePath) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_FILE_PATH_REQUIRED}`,\n      );\n    }\n\n    // Use identity binding mode only when enableAzureProxy is set\n    if (workloadIdentityCredentialOptions.enableAzureProxy) {\n      const kubernetesTokenProxy = process.env.AZURE_KUBERNETES_TOKEN_PROXY;\n      const kubernetesSNIName = process.env.AZURE_KUBERNETES_SNI_NAME;\n      const kubernetesCAFile = process.env.AZURE_KUBERNETES_CA_FILE;\n      const kubernetesCAData = process.env.AZURE_KUBERNETES_CA_DATA;\n\n      if (!kubernetesTokenProxy) {\n        // Custom token proxy is not set, while other Kubernetes-related environment variables are present,\n        // this is likely a configuration issue so erroring out to avoid misconfiguration\n        if (kubernetesSNIName || kubernetesCAFile || kubernetesCAData) {\n          throw new CredentialUnavailableError(\n            `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_PROXY_NOT_SET}`,\n          );\n        }\n        logger.info(\n          `enableAzureProxy is true but AZURE_KUBERNETES_TOKEN_PROXY is not set, using normal authentication flow`,\n        );\n      } else {\n        const tokenProxy = parseAndValidateCustomTokenProxy(kubernetesTokenProxy);\n\n        // CAFile and CAData are mutually exclusive, at most one can be set.\n        // If none of CAFile or CAData are set, the default system CA pool will be used.\n        if (kubernetesCAFile && kubernetesCAData) {\n          throw new CredentialUnavailableError(\n            `${credentialName}: is unavailable. ${ErrorMessages.CA_FILE_AND_DATA_EXCLUSIVE}`,\n          );\n        }\n\n        this.caData = kubernetesCAData;\n        this.caFile = kubernetesCAFile;\n        this.sniName = kubernetesSNIName;\n\n        // Configure client options with AKS proxy client\n        const proxyClient = this.createAksProxyClient(tokenProxy);\n        workloadIdentityCredentialOptions.httpClient = proxyClient;\n        logger.info(`${credentialName}: Using proxy client for token requests`);\n      }\n    }\n\n    logger.info(\n      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`,\n    );\n\n    this.client = new ClientAssertionCredential(\n      tenantId,\n      clientId,\n      this.readFileContents.bind(this),\n      workloadIdentityCredentialOptions,\n    );\n  }\n\n  /**\n   * Creates a proxy HttpClient that intercepts token requests and redirects them to the Kubernetes endpoint\n   * Caching is handled at the credential level to persist across token requests\n   */\n  private createAksProxyClient(tokenEndpoint: string): HttpClient {\n    const defaultClient = createDefaultHttpClient();\n    // Init cached TLS settings at construction time to fail fast on misconfiguration\n    this.cachedTlsSettings = this.getTlsSettings();\n\n    return {\n      sendRequest: async (request: PipelineRequest): Promise<PipelineResponse> => {\n        const requestUrl = new URL(request.url);\n\n        logger.info(\n          `${credentialName}: Redirecting request to Kubernetes endpoint: ${tokenEndpoint}`,\n        );\n\n        const proxyUrl = new URL(tokenEndpoint);\n\n        // Remove leading slash from request path and join with proxy path\n        const requestPath = requestUrl.pathname.replace(/^\\//, \"\");\n        const combinedPath = proxyUrl.pathname.endsWith(\"/\")\n          ? proxyUrl.pathname + requestPath\n          : proxyUrl.pathname + \"/\" + requestPath;\n\n        // Create new URL preserving query and fragment from original request\n        const newUrl = new URL(proxyUrl.origin);\n        newUrl.pathname = combinedPath;\n        newUrl.search = requestUrl.search;\n        newUrl.hash = requestUrl.hash;\n\n        request.url = newUrl.toString();\n        request.tlsSettings = this.getTlsSettings();\n\n        logger.info(`${credentialName}: Sending request to ${request.url}`);\n        // Forward the modified request with custom TLS settings\n        return defaultClient.sendRequest(request);\n      },\n    };\n  }\n\n  /**\n   * Gets TLS settings for the request.\n   * Handles a few scenarios with CA data or CA file provided.\n   */\n  private getTlsSettings(): TlsSettings & { servername?: string } {\n    // No CA overrides, use default transport\n    if (!this.caData && !this.caFile) {\n      if (!this.cachedTlsSettings) {\n        this.cachedTlsSettings = this.sniName ? { servername: this.sniName } : {};\n      }\n      return this.cachedTlsSettings;\n    }\n\n    // Host provided CA bytes in AZURE_KUBERNETES_CA_DATA and can't change now\n    if (!this.caFile) {\n      if (!this.cachedTlsSettings) {\n        if (!canParseAsX509Certificate(this.caData!)) {\n          throw new CredentialUnavailableError(\n            `${credentialName}: is unavailable. ${ErrorMessages.INVALID_CA_CERTIFICATES}`,\n          );\n        }\n        this.cachedTlsSettings = this.sniName ? { servername: this.sniName } : {};\n        this.cachedTlsSettings.ca = this.caData;\n      }\n      return this.cachedTlsSettings;\n    }\n\n    // Host provided the CA bytes in a file whose contents it can change,\n    let fileContent: Buffer;\n    try {\n      fileContent = readFileSync(this.caFile);\n    } catch (error) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.FAILED_TO_READ_CA_FILE(this.caFile!, error)}`,\n      );\n    }\n    // This can happen in the middle of CA rotation\n    if (fileContent.length === 0) {\n      if (!this.cachedTlsSettings) {\n        // If the transport was never created, error out here to force retrying the call later\n        throw new CredentialUnavailableError(\n          `${credentialName}: is unavailable. ${ErrorMessages.CA_FILE_EMPTY(this.caFile)}`,\n        );\n      }\n      // If the transport was already created, just keep using it\n      return this.cachedTlsSettings;\n    }\n\n    // Check if CA has changed\n    if (!this.cachedCaData || !fileContent.equals(this.cachedCaData)) {\n      const caDataString = fileContent.toString(\"utf8\");\n\n      if (!canParseAsX509Certificate(caDataString)) {\n        throw new CredentialUnavailableError(\n          `${credentialName}: is unavailable. ${ErrorMessages.INVALID_CA_CERTIFICATES}`,\n        );\n      }\n\n      // CA has changed, rebuild the TLS settings with new CA pool\n      this.cachedTlsSettings = {\n        ca: caDataString,\n        ...(this.sniName && { servername: this.sniName }),\n      };\n      this.cachedCaData = fileContent;\n    }\n\n    return this.cachedTlsSettings!;\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options?: GetTokenOptions,\n  ): Promise<AccessToken> {\n    if (!this.client) {\n      const errorMessage = `${credentialName}: is unavailable. ${ErrorMessages.MISSING_ENV_VARS}`;\n      logger.info(errorMessage);\n      throw new CredentialUnavailableError(errorMessage);\n    }\n    logger.info(\"Invoking getToken() of Client Assertion Credential\");\n    return this.client.getToken(scopes, options);\n  }\n\n  private async readFileContents(): Promise<string> {\n    // Cached assertions expire after 5 minutes\n    if (this.cacheDate !== undefined && Date.now() - this.cacheDate >= 1000 * 60 * 5) {\n      this.azureFederatedTokenFileContent = undefined;\n    }\n    if (!this.federatedTokenFilePath) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. ${ErrorMessages.INVALID_FILE_PATH(this.federatedTokenFilePath)}`,\n      );\n    }\n    if (!this.azureFederatedTokenFileContent) {\n      const file = await readFile(this.federatedTokenFilePath, \"utf8\");\n      const value = file.trim();\n      if (!value) {\n        throw new CredentialUnavailableError(\n          `${credentialName}: is unavailable. ${ErrorMessages.NO_FILE_CONTENT(this.federatedTokenFilePath)}`,\n        );\n      } else {\n        this.azureFederatedTokenFileContent = value;\n        this.cacheDate = Date.now();\n      }\n    }\n    return this.azureFederatedTokenFileContent;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,qBAAiD;AAEjD,uCAA0C;AAC1C,oBAA2C;AAE3C,2BAA8B;AAC9B,sBAAyB;AAEzB,gCAAwC;AAExC,+BAA0C;AAC1C,qBAA6B;AAE7B,MAAM,iBAAiB;AAQhB,MAAM,wCAAwC;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,aAAS,iCAAiB,cAAc;AAK9C,MAAM,gBAAgB;AAAA,EACpB,6BAA6B,CAAC,UAAkB,UAC9C,2CAA2C,QAAQ,MAAM,KAAK;AAAA,EAChE,sBAAsB,CAAC,aACrB,qDAAqD,QAAQ;AAAA,EAC/D,6BAA6B,CAAC,QAC5B,8BAA8B,GAAG;AAAA,EACnC,yBAAyB,CAAC,QACxB,8BAA8B,GAAG;AAAA,EACnC,4BAA4B,CAAC,QAC3B,8BAA8B,GAAG;AAAA,EACnC,eAAe,CAAC,SAAiB,iCAAiC,IAAI;AAAA,EACtE,wBAAwB,CAAC,MAAc,UACrC,uCAAuC,IAAI,KAAK,KAAK;AAAA,EACvD,yBAAyB;AAAA,EACzB,mBAAmB,CAAC,SAA6B,8BAA8B,IAAI;AAAA,EACnF,iBAAiB,CAAC,SAAiB,0BAA0B,IAAI;AAAA,EACjE,cAAc;AAAA,EACd,oBAAoB;AAAA;AAAA,EAEpB,oBAAoB;AAAA;AAAA,EAEpB,0BAA0B;AAAA;AAAA,EAE1B,qBAAqB;AAAA,EACrB,4BAA4B;AAAA,EAC5B,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAKpB;AAMO,SAAS,iCAAiC,UAA0B;AACzE,MAAI;AACJ,MAAI;AACF,iBAAa,IAAI,IAAI,QAAQ;AAAA,EAC/B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,GAAG,cAAc,qBAAqB,cAAc,4BAA4B,UAAU,KAAK,CAAC;AAAA,IAClG;AAAA,EACF;AAEA,MAAI,WAAW,aAAa,UAAU;AACpC,UAAM,IAAI;AAAA,MACR,GAAG,cAAc,qBAAqB,cAAc,qBAAqB,WAAW,QAAQ,CAAC;AAAA,IAC/F;AAAA,EACF;AAEA,MAAI,WAAW,YAAY,WAAW,UAAU;AAC9C,UAAM,IAAI;AAAA,MACR,GAAG,cAAc,qBAAqB,cAAc,4BAA4B,WAAW,SAAS,CAAC,CAAC;AAAA,IACxG;AAAA,EACF;AAEA,MAAI,WAAW,QAAQ;AACrB,UAAM,IAAI;AAAA,MACR,GAAG,cAAc,qBAAqB,cAAc,wBAAwB,WAAW,SAAS,CAAC,CAAC;AAAA,IACpG;AAAA,EACF;AAEA,MAAI,WAAW,MAAM;AACnB,UAAM,IAAI;AAAA,MACR,GAAG,cAAc,qBAAqB,cAAc,2BAA2B,WAAW,SAAS,CAAC,CAAC;AAAA,IACvG;AAAA,EACF;AAEA,MAAI,CAAC,WAAW,YAAY,WAAW,aAAa,IAAI;AAEtD,eAAW,WAAW;AAAA,EACxB;AAEA,SAAO,WAAW,SAAS;AAC7B;AAgBO,MAAM,2BAAsD;AAAA,EACzD;AAAA,EACA,iCAAqD;AAAA,EACrD,YAAgC;AAAA,EAChC;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,YAAY,SAA6C;AAEvD,UAAM,kBAAc,+BAAe,qCAAqC,EAAE,SAAS,KAAK,IAAI;AAC5F,WAAO,KAAK,8CAA8C,WAAW,EAAE;AAEvE,UAAM,oCAAoC,WAAW,CAAC;AACtD,UAAM,WAAW,kCAAkC,YAAY,QAAQ,IAAI;AAC3E,UAAM,WAAW,kCAAkC,YAAY,QAAQ,IAAI;AAC3E,SAAK,yBACH,kCAAkC,iBAAiB,QAAQ,IAAI;AAEjE,QAAI,UAAU;AACZ,8CAAc,QAAQ,QAAQ;AAAA,IAChC;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,GAAG,cAAc,qBAAqB,cAAc,kBAAkB;AAAA,MACxE;AAAA,IACF;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,GAAG,cAAc,qBAAqB,cAAc,kBAAkB;AAAA,MACxE;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,wBAAwB;AAChC,YAAM,IAAI;AAAA,QACR,GAAG,cAAc,qBAAqB,cAAc,wBAAwB;AAAA,MAC9E;AAAA,IACF;AAGA,QAAI,kCAAkC,kBAAkB;AACtD,YAAM,uBAAuB,QAAQ,IAAI;AACzC,YAAM,oBAAoB,QAAQ,IAAI;AACtC,YAAM,mBAAmB,QAAQ,IAAI;AACrC,YAAM,mBAAmB,QAAQ,IAAI;AAErC,UAAI,CAAC,sBAAsB;AAGzB,YAAI,qBAAqB,oBAAoB,kBAAkB;AAC7D,gBAAM,IAAI;AAAA,YACR,GAAG,cAAc,qBAAqB,cAAc,mBAAmB;AAAA,UACzE;AAAA,QACF;AACA,eAAO;AAAA,UACL;AAAA,QACF;AAAA,MACF,OAAO;AACL,cAAM,aAAa,iCAAiC,oBAAoB;AAIxE,YAAI,oBAAoB,kBAAkB;AACxC,gBAAM,IAAI;AAAA,YACR,GAAG,cAAc,qBAAqB,cAAc,0BAA0B;AAAA,UAChF;AAAA,QACF;AAEA,aAAK,SAAS;AACd,aAAK,SAAS;AACd,aAAK,UAAU;AAGf,cAAM,cAAc,KAAK,qBAAqB,UAAU;AACxD,0CAAkC,aAAa;AAC/C,eAAO,KAAK,GAAG,cAAc,yCAAyC;AAAA,MACxE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,sDAAsD,QAAQ,eAAe,kCAAkC,QAAQ;AAAA,IACzH;AAEA,SAAK,SAAS,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,KAAK,IAAI;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,qBAAqB,eAAmC;AAC9D,UAAM,oBAAgB,mDAAwB;AAE9C,SAAK,oBAAoB,KAAK,eAAe;AAE7C,WAAO;AAAA,MACL,aAAa,OAAO,YAAwD;AAC1E,cAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AAEtC,eAAO;AAAA,UACL,GAAG,cAAc,iDAAiD,aAAa;AAAA,QACjF;AAEA,cAAM,WAAW,IAAI,IAAI,aAAa;AAGtC,cAAM,cAAc,WAAW,SAAS,QAAQ,OAAO,EAAE;AACzD,cAAM,eAAe,SAAS,SAAS,SAAS,GAAG,IAC/C,SAAS,WAAW,cACpB,SAAS,WAAW,MAAM;AAG9B,cAAM,SAAS,IAAI,IAAI,SAAS,MAAM;AACtC,eAAO,WAAW;AAClB,eAAO,SAAS,WAAW;AAC3B,eAAO,OAAO,WAAW;AAEzB,gBAAQ,MAAM,OAAO,SAAS;AAC9B,gBAAQ,cAAc,KAAK,eAAe;AAE1C,eAAO,KAAK,GAAG,cAAc,wBAAwB,QAAQ,GAAG,EAAE;AAElE,eAAO,cAAc,YAAY,OAAO;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAwD;AAE9D,QAAI,CAAC,KAAK,UAAU,CAAC,KAAK,QAAQ;AAChC,UAAI,CAAC,KAAK,mBAAmB;AAC3B,aAAK,oBAAoB,KAAK,UAAU,EAAE,YAAY,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC1E;AACA,aAAO,KAAK;AAAA,IACd;AAGA,QAAI,CAAC,KAAK,QAAQ;AAChB,UAAI,CAAC,KAAK,mBAAmB;AAC3B,YAAI,KAAC,oDAA0B,KAAK,MAAO,GAAG;AAC5C,gBAAM,IAAI;AAAA,YACR,GAAG,cAAc,qBAAqB,cAAc,uBAAuB;AAAA,UAC7E;AAAA,QACF;AACA,aAAK,oBAAoB,KAAK,UAAU,EAAE,YAAY,KAAK,QAAQ,IAAI,CAAC;AACxE,aAAK,kBAAkB,KAAK,KAAK;AAAA,MACnC;AACA,aAAO,KAAK;AAAA,IACd;AAGA,QAAI;AACJ,QAAI;AACF,wBAAc,6BAAa,KAAK,MAAM;AAAA,IACxC,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,GAAG,cAAc,qBAAqB,cAAc,uBAAuB,KAAK,QAAS,KAAK,CAAC;AAAA,MACjG;AAAA,IACF;AAEA,QAAI,YAAY,WAAW,GAAG;AAC5B,UAAI,CAAC,KAAK,mBAAmB;AAE3B,cAAM,IAAI;AAAA,UACR,GAAG,cAAc,qBAAqB,cAAc,cAAc,KAAK,MAAM,CAAC;AAAA,QAChF;AAAA,MACF;AAEA,aAAO,KAAK;AAAA,IACd;AAGA,QAAI,CAAC,KAAK,gBAAgB,CAAC,YAAY,OAAO,KAAK,YAAY,GAAG;AAChE,YAAM,eAAe,YAAY,SAAS,MAAM;AAEhD,UAAI,KAAC,oDAA0B,YAAY,GAAG;AAC5C,cAAM,IAAI;AAAA,UACR,GAAG,cAAc,qBAAqB,cAAc,uBAAuB;AAAA,QAC7E;AAAA,MACF;AAGA,WAAK,oBAAoB;AAAA,QACvB,IAAI;AAAA,QACJ,GAAI,KAAK,WAAW,EAAE,YAAY,KAAK,QAAQ;AAAA,MACjD;AACA,WAAK,eAAe;AAAA,IACtB;AAEA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,SACX,QACA,SACsB;AACtB,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,eAAe,GAAG,cAAc,qBAAqB,cAAc,gBAAgB;AACzF,aAAO,KAAK,YAAY;AACxB,YAAM,IAAI,yCAA2B,YAAY;AAAA,IACnD;AACA,WAAO,KAAK,oDAAoD;AAChE,WAAO,KAAK,OAAO,SAAS,QAAQ,OAAO;AAAA,EAC7C;AAAA,EAEA,MAAc,mBAAoC;AAEhD,QAAI,KAAK,cAAc,UAAa,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,KAAK,GAAG;AAChF,WAAK,iCAAiC;AAAA,IACxC;AACA,QAAI,CAAC,KAAK,wBAAwB;AAChC,YAAM,IAAI;AAAA,QACR,GAAG,cAAc,qBAAqB,cAAc,kBAAkB,KAAK,sBAAsB,CAAC;AAAA,MACpG;AAAA,IACF;AACA,QAAI,CAAC,KAAK,gCAAgC;AACxC,YAAM,OAAO,UAAM,0BAAS,KAAK,wBAAwB,MAAM;AAC/D,YAAM,QAAQ,KAAK,KAAK;AACxB,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,GAAG,cAAc,qBAAqB,cAAc,gBAAgB,KAAK,sBAAsB,CAAC;AAAA,QAClG;AAAA,MACF,OAAO;AACL,aAAK,iCAAiC;AACtC,aAAK,YAAY,KAAK,IAAI;AAAA,MAC5B;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AACF;",
+  "names": []
+}

package/dist/commonjs/credentials/workloadIdentityCredentialOptions.js

@@ -1,5 +1,16 @@
-"use strict";
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=workloadIdentityCredentialOptions.js.map
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var workloadIdentityCredentialOptions_exports = {};
+module.exports = __toCommonJS(workloadIdentityCredentialOptions_exports);
+//# sourceMappingURL=workloadIdentityCredentialOptions.js.map

package/dist/commonjs/credentials/workloadIdentityCredentialOptions.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"workloadIdentityCredentialOptions.js","sourceRoot":"","sources":["../../../src/credentials/workloadIdentityCredentialOptions.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AuthorityValidationOptions } from \"./authorityValidationOptions.js\";\nimport type { MultiTenantTokenCredentialOptions } from \"./multiTenantTokenCredentialOptions.js\";\n\n/**\n * Options for the {@link WorkloadIdentityCredential}\n */\nexport interface WorkloadIdentityCredentialOptions\n  extends MultiTenantTokenCredentialOptions, AuthorityValidationOptions {\n  /**\n   * ID of the application's Microsoft Entra tenant. Also called its directory ID.\n   */\n  tenantId?: string;\n  /**\n   * The client ID of a Microsoft Entra app registration.\n   */\n  clientId?: string;\n  /**\n   * The path to a file containing a Kubernetes service account token that authenticates the identity.\n   */\n  tokenFilePath?: string;\n  /**\n   * Enables the {@link https://learn.microsoft.com/azure/aks/identity-bindings-concepts | identity binding feature}.\n   */\n  enableAzureProxy?: boolean;\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/workloadIdentityCredentialOptions.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AuthorityValidationOptions } from \"./authorityValidationOptions.js\";\nimport type { MultiTenantTokenCredentialOptions } from \"./multiTenantTokenCredentialOptions.js\";\n\n/**\n * Options for the {@link WorkloadIdentityCredential}\n */\nexport interface WorkloadIdentityCredentialOptions\n  extends MultiTenantTokenCredentialOptions, AuthorityValidationOptions {\n  /**\n   * ID of the application's Microsoft Entra tenant. Also called its directory ID.\n   */\n  tenantId?: string;\n  /**\n   * The client ID of a Microsoft Entra app registration.\n   */\n  clientId?: string;\n  /**\n   * The path to a file containing a Kubernetes service account token that authenticates the identity.\n   */\n  tokenFilePath?: string;\n  /**\n   * Enables the {@link https://learn.microsoft.com/azure/aks/identity-bindings-concepts | identity binding feature}.\n   */\n  enableAzureProxy?: boolean;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;AAAA;AAAA;",
+  "names": []
+}

package/dist/commonjs/errors.js

@@ -1,146 +1,145 @@
-"use strict";
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthenticationRequiredError = exports.AggregateAuthenticationError = exports.AggregateAuthenticationErrorName = exports.AuthenticationError = exports.AuthenticationErrorName = exports.CredentialUnavailableError = exports.CredentialUnavailableErrorName = void 0;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var errors_exports = {};
+__export(errors_exports, {
+  AggregateAuthenticationError: () => AggregateAuthenticationError,
+  AggregateAuthenticationErrorName: () => AggregateAuthenticationErrorName,
+  AuthenticationError: () => AuthenticationError,
+  AuthenticationErrorName: () => AuthenticationErrorName,
+  AuthenticationRequiredError: () => AuthenticationRequiredError,
+  CredentialUnavailableError: () => CredentialUnavailableError,
+  CredentialUnavailableErrorName: () => CredentialUnavailableErrorName
+});
+module.exports = __toCommonJS(errors_exports);
 function isErrorResponse(errorResponse) {
-    return (errorResponse &&
-        typeof errorResponse.error === "string" &&
-        typeof errorResponse.error_description === "string");
+  return errorResponse && typeof errorResponse.error === "string" && typeof errorResponse.error_description === "string";
 }
-/**
- * The Error.name value of an CredentialUnavailable
- */
-exports.CredentialUnavailableErrorName = "CredentialUnavailableError";
-/**
- * This signifies that the credential that was tried in a chained credential
- * was not available to be used as the credential. Rather than treating this as
- * an error that should halt the chain, it's caught and the chain continues
- */
+const CredentialUnavailableErrorName = "CredentialUnavailableError";
 class CredentialUnavailableError extends Error {
-    constructor(message, options) {
-        super(message, options);
-        this.name = exports.CredentialUnavailableErrorName;
-    }
+  constructor(message, options) {
+    super(message, options);
+    this.name = CredentialUnavailableErrorName;
+  }
 }
-exports.CredentialUnavailableError = CredentialUnavailableError;
-/**
- * The Error.name value of an AuthenticationError
- */
-exports.AuthenticationErrorName = "AuthenticationError";
-/**
- * Provides details about a failure to authenticate with Azure Active
- * Directory.  The `errorResponse` field contains more details about
- * the specific failure.
- */
+const AuthenticationErrorName = "AuthenticationError";
 class AuthenticationError extends Error {
-    /**
-     * The HTTP status code returned from the authentication request.
-     */
-    statusCode;
-    /**
-     * The error response details.
-     */
-    errorResponse;
-    constructor(statusCode, errorBody, options) {
-        let errorResponse = {
-            error: "unknown",
-            errorDescription: "An unknown error occurred and no additional details are available.",
-        };
-        if (isErrorResponse(errorBody)) {
-            errorResponse = convertOAuthErrorResponseToErrorResponse(errorBody);
-        }
-        else if (typeof errorBody === "string") {
-            try {
-                // Most error responses will contain JSON-formatted error details
-                // in the response body
-                const oauthErrorResponse = JSON.parse(errorBody);
-                errorResponse = convertOAuthErrorResponseToErrorResponse(oauthErrorResponse);
-            }
-            catch (e) {
-                if (statusCode === 400) {
-                    errorResponse = {
-                        error: "invalid_request",
-                        errorDescription: `The service indicated that the request was invalid.\n\n${errorBody}`,
-                    };
-                }
-                else {
-                    errorResponse = {
-                        error: "unknown_error",
-                        errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}`,
-                    };
-                }
-            }
-        }
-        else {
-            errorResponse = {
-                error: "unknown_error",
-                errorDescription: "An unknown error occurred and no additional details are available.",
-            };
+  /**
+   * The HTTP status code returned from the authentication request.
+   */
+  statusCode;
+  /**
+   * The error response details.
+   */
+  errorResponse;
+  constructor(statusCode, errorBody, options) {
+    let errorResponse = {
+      error: "unknown",
+      errorDescription: "An unknown error occurred and no additional details are available."
+    };
+    if (isErrorResponse(errorBody)) {
+      errorResponse = convertOAuthErrorResponseToErrorResponse(errorBody);
+    } else if (typeof errorBody === "string") {
+      try {
+        const oauthErrorResponse = JSON.parse(errorBody);
+        errorResponse = convertOAuthErrorResponseToErrorResponse(oauthErrorResponse);
+      } catch (e) {
+        if (statusCode === 400) {
+          errorResponse = {
+            error: "invalid_request",
+            errorDescription: `The service indicated that the request was invalid.
+
+${errorBody}`
+          };
+        } else {
+          errorResponse = {
+            error: "unknown_error",
+            errorDescription: `An unknown error has occurred. Response body:
+
+${errorBody}`
+          };
         }
-        super(`${errorResponse.error} Status code: ${statusCode}\nMore details:\n${errorResponse.errorDescription},`, options);
-        this.statusCode = statusCode;
-        this.errorResponse = errorResponse;
-        // Ensure that this type reports the correct name
-        this.name = exports.AuthenticationErrorName;
+      }
+    } else {
+      errorResponse = {
+        error: "unknown_error",
+        errorDescription: "An unknown error occurred and no additional details are available."
+      };
     }
+    super(
+      `${errorResponse.error} Status code: ${statusCode}
+More details:
+${errorResponse.errorDescription},`,
+      options
+    );
+    this.statusCode = statusCode;
+    this.errorResponse = errorResponse;
+    this.name = AuthenticationErrorName;
+  }
 }
-exports.AuthenticationError = AuthenticationError;
-/**
- * The Error.name value of an AggregateAuthenticationError
- */
-exports.AggregateAuthenticationErrorName = "AggregateAuthenticationError";
-/**
- * Provides an `errors` array containing {@link AuthenticationError} instance
- * for authentication failures from credentials in a {@link ChainedTokenCredential}.
- */
+const AggregateAuthenticationErrorName = "AggregateAuthenticationError";
 class AggregateAuthenticationError extends Error {
-    /**
-     * The array of error objects that were thrown while trying to authenticate
-     * with the credentials in a {@link ChainedTokenCredential}.
-     */
-    errors;
-    constructor(errors, errorMessage) {
-        const errorDetail = errors.join("\n");
-        super(`${errorMessage}\n${errorDetail}`);
-        this.errors = errors;
-        // Ensure that this type reports the correct name
-        this.name = exports.AggregateAuthenticationErrorName;
-    }
+  /**
+   * The array of error objects that were thrown while trying to authenticate
+   * with the credentials in a {@link ChainedTokenCredential}.
+   */
+  errors;
+  constructor(errors, errorMessage) {
+    const errorDetail = errors.join("\n");
+    super(`${errorMessage}
+${errorDetail}`);
+    this.errors = errors;
+    this.name = AggregateAuthenticationErrorName;
+  }
 }
-exports.AggregateAuthenticationError = AggregateAuthenticationError;
 function convertOAuthErrorResponseToErrorResponse(errorBody) {
-    return {
-        error: errorBody.error,
-        errorDescription: errorBody.error_description,
-        correlationId: errorBody.correlation_id,
-        errorCodes: errorBody.error_codes,
-        timestamp: errorBody.timestamp,
-        traceId: errorBody.trace_id,
-    };
+  return {
+    error: errorBody.error,
+    errorDescription: errorBody.error_description,
+    correlationId: errorBody.correlation_id,
+    errorCodes: errorBody.error_codes,
+    timestamp: errorBody.timestamp,
+    traceId: errorBody.trace_id
+  };
 }
-/**
- * Error used to enforce authentication after trying to retrieve a token silently.
- */
 class AuthenticationRequiredError extends Error {
-    /**
-     * The list of scopes for which the token will have access.
-     */
-    scopes;
-    /**
-     * The options passed to the getToken request.
-     */
-    getTokenOptions;
-    constructor(
-    /**
-     * Optional parameters. A message can be specified. The {@link GetTokenOptions} of the request can also be specified to more easily associate the error with the received parameters.
-     */
-    options) {
-        super(options.message, options.cause ? { cause: options.cause } : undefined);
-        this.scopes = options.scopes;
-        this.getTokenOptions = options.getTokenOptions;
-        this.name = "AuthenticationRequiredError";
-    }
+  /**
+   * The list of scopes for which the token will have access.
+   */
+  scopes;
+  /**
+   * The options passed to the getToken request.
+   */
+  getTokenOptions;
+  constructor(options) {
+    super(options.message, options.cause ? { cause: options.cause } : void 0);
+    this.scopes = options.scopes;
+    this.getTokenOptions = options.getTokenOptions;
+    this.name = "AuthenticationRequiredError";
+  }
 }
-exports.AuthenticationRequiredError = AuthenticationRequiredError;
-//# sourceMappingURL=errors.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AggregateAuthenticationError,
+  AggregateAuthenticationErrorName,
+  AuthenticationError,
+  AuthenticationErrorName,
+  AuthenticationRequiredError,
+  CredentialUnavailableError,
+  CredentialUnavailableErrorName
+});
+//# sourceMappingURL=errors.js.map

package/dist/commonjs/errors.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAyDlC,SAAS,eAAe,CAAC,aAAkB;IACzC,OAAO,CACL,aAAa;QACb,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ;QACvC,OAAO,aAAa,CAAC,iBAAiB,KAAK,QAAQ,CACpD,CAAC;AACJ,CAAC;AAED;;GAEG;AACU,QAAA,8BAA8B,GAAG,4BAA4B,CAAC;AAE3E;;;;GAIG;AACH,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAgB,EAAE,OAA6B;QACzD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,sCAA8B,CAAC;IAC7C,CAAC;CACF;AALD,gEAKC;AAED;;GAEG;AACU,QAAA,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;GAIG;AACH,MAAa,mBAAoB,SAAQ,KAAK;IAC5C;;OAEG;IACa,UAAU,CAAS;IAEnC;;OAEG;IACa,aAAa,CAAgB;IAE7C,YACE,UAAkB,EAClB,SAA6C,EAC7C,OAA6B;QAE7B,IAAI,aAAa,GAAkB;YACjC,KAAK,EAAE,SAAS;YAChB,gBAAgB,EAAE,oEAAoE;SACvF,CAAC;QAEF,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,aAAa,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,iEAAiE;gBACjE,uBAAuB;gBACvB,MAAM,kBAAkB,GAAuB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACrE,aAAa,GAAG,wCAAwC,CAAC,kBAAkB,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;oBACvB,aAAa,GAAG;wBACd,KAAK,EAAE,iBAAiB;wBACxB,gBAAgB,EAAE,0DAA0D,SAAS,EAAE;qBACxF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,aAAa,GAAG;wBACd,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,oDAAoD,SAAS,EAAE;qBAClF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,GAAG;gBACd,KAAK,EAAE,eAAe;gBACtB,gBAAgB,EAAE,oEAAoE;aACvF,CAAC;QACJ,CAAC;QAED,KAAK,CACH,GAAG,aAAa,CAAC,KAAK,iBAAiB,UAAU,oBAAoB,aAAa,CAAC,gBAAgB,GAAG,EACtG,OAAO,CACR,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QAEnC,iDAAiD;QACjD,IAAI,CAAC,IAAI,GAAG,+BAAuB,CAAC;IACtC,CAAC;CACF;AA3DD,kDA2DC;AAED;;GAEG;AACU,QAAA,gCAAgC,GAAG,8BAA8B,CAAC;AAE/E;;;GAGG;AACH,MAAa,4BAA6B,SAAQ,KAAK;IACrD;;;OAGG;IACI,MAAM,CAAQ;IAErB,YAAY,MAAa,EAAE,YAAqB;QAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,CAAC,GAAG,YAAY,KAAK,WAAW,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,iDAAiD;QACjD,IAAI,CAAC,IAAI,GAAG,wCAAgC,CAAC;IAC/C,CAAC;CACF;AAfD,oEAeC;AAED,SAAS,wCAAwC,CAAC,SAA6B;IAC7E,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,gBAAgB,EAAE,SAAS,CAAC,iBAAiB;QAC7C,aAAa,EAAE,SAAS,CAAC,cAAc;QACvC,UAAU,EAAE,SAAS,CAAC,WAAW;QACjC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,OAAO,EAAE,SAAS,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAwBD;;GAEG;AACH,MAAa,2BAA4B,SAAQ,KAAK;IACpD;;OAEG;IACI,MAAM,CAAW;IACxB;;OAEG;IACI,eAAe,CAAmB;IAEzC;IACE;;OAEG;IACH,OAA2C;QAE3C,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AArBD,kEAqBC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { GetTokenOptions } from \"@azure/core-auth\";\n\n/**\n * See the official documentation for more details:\n *\n * https://learn.microsoft.com/azure/active-directory/develop/v1-protocols-oauth-code#error-response-1\n *\n * NOTE: This documentation is for v1 OAuth support but the same error\n * response details still apply to v2.\n */\nexport interface ErrorResponse {\n  /**\n   * The string identifier for the error.\n   */\n  error: string;\n\n  /**\n   * The error's description.\n   */\n  errorDescription: string;\n\n  /**\n   * An array of codes pertaining to the error(s) that occurred.\n   */\n  errorCodes?: number[];\n\n  /**\n   * The timestamp at which the error occurred.\n   */\n  timestamp?: string;\n\n  /**\n   * The trace identifier for this error occurrence.\n   */\n  traceId?: string;\n\n  /**\n   * The correlation ID to be used for tracking the source of the error.\n   */\n  correlationId?: string;\n}\n\n/**\n * Used for internal deserialization of OAuth responses. Public model is ErrorResponse\n * @internal\n */\nexport interface OAuthErrorResponse {\n  error: string;\n  error_description: string;\n  error_codes?: number[];\n  timestamp?: string;\n  trace_id?: string;\n  correlation_id?: string;\n}\n\nfunction isErrorResponse(errorResponse: any): errorResponse is OAuthErrorResponse {\n  return (\n    errorResponse &&\n    typeof errorResponse.error === \"string\" &&\n    typeof errorResponse.error_description === \"string\"\n  );\n}\n\n/**\n * The Error.name value of an CredentialUnavailable\n */\nexport const CredentialUnavailableErrorName = \"CredentialUnavailableError\";\n\n/**\n * This signifies that the credential that was tried in a chained credential\n * was not available to be used as the credential. Rather than treating this as\n * an error that should halt the chain, it's caught and the chain continues\n */\nexport class CredentialUnavailableError extends Error {\n  constructor(message?: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = CredentialUnavailableErrorName;\n  }\n}\n\n/**\n * The Error.name value of an AuthenticationError\n */\nexport const AuthenticationErrorName = \"AuthenticationError\";\n\n/**\n * Provides details about a failure to authenticate with Azure Active\n * Directory.  The `errorResponse` field contains more details about\n * the specific failure.\n */\nexport class AuthenticationError extends Error {\n  /**\n   * The HTTP status code returned from the authentication request.\n   */\n  public readonly statusCode: number;\n\n  /**\n   * The error response details.\n   */\n  public readonly errorResponse: ErrorResponse;\n\n  constructor(\n    statusCode: number,\n    errorBody: object | string | undefined | null,\n    options?: { cause?: unknown },\n  ) {\n    let errorResponse: ErrorResponse = {\n      error: \"unknown\",\n      errorDescription: \"An unknown error occurred and no additional details are available.\",\n    };\n\n    if (isErrorResponse(errorBody)) {\n      errorResponse = convertOAuthErrorResponseToErrorResponse(errorBody);\n    } else if (typeof errorBody === \"string\") {\n      try {\n        // Most error responses will contain JSON-formatted error details\n        // in the response body\n        const oauthErrorResponse: OAuthErrorResponse = JSON.parse(errorBody);\n        errorResponse = convertOAuthErrorResponseToErrorResponse(oauthErrorResponse);\n      } catch (e: any) {\n        if (statusCode === 400) {\n          errorResponse = {\n            error: \"invalid_request\",\n            errorDescription: `The service indicated that the request was invalid.\\n\\n${errorBody}`,\n          };\n        } else {\n          errorResponse = {\n            error: \"unknown_error\",\n            errorDescription: `An unknown error has occurred. Response body:\\n\\n${errorBody}`,\n          };\n        }\n      }\n    } else {\n      errorResponse = {\n        error: \"unknown_error\",\n        errorDescription: \"An unknown error occurred and no additional details are available.\",\n      };\n    }\n\n    super(\n      `${errorResponse.error} Status code: ${statusCode}\\nMore details:\\n${errorResponse.errorDescription},`,\n      options,\n    );\n    this.statusCode = statusCode;\n    this.errorResponse = errorResponse;\n\n    // Ensure that this type reports the correct name\n    this.name = AuthenticationErrorName;\n  }\n}\n\n/**\n * The Error.name value of an AggregateAuthenticationError\n */\nexport const AggregateAuthenticationErrorName = \"AggregateAuthenticationError\";\n\n/**\n * Provides an `errors` array containing {@link AuthenticationError} instance\n * for authentication failures from credentials in a {@link ChainedTokenCredential}.\n */\nexport class AggregateAuthenticationError extends Error {\n  /**\n   * The array of error objects that were thrown while trying to authenticate\n   * with the credentials in a {@link ChainedTokenCredential}.\n   */\n  public errors: any[];\n\n  constructor(errors: any[], errorMessage?: string) {\n    const errorDetail = errors.join(\"\\n\");\n    super(`${errorMessage}\\n${errorDetail}`);\n    this.errors = errors;\n\n    // Ensure that this type reports the correct name\n    this.name = AggregateAuthenticationErrorName;\n  }\n}\n\nfunction convertOAuthErrorResponseToErrorResponse(errorBody: OAuthErrorResponse): ErrorResponse {\n  return {\n    error: errorBody.error,\n    errorDescription: errorBody.error_description,\n    correlationId: errorBody.correlation_id,\n    errorCodes: errorBody.error_codes,\n    timestamp: errorBody.timestamp,\n    traceId: errorBody.trace_id,\n  };\n}\n\n/**\n * Optional parameters to the {@link AuthenticationRequiredError}\n */\nexport interface AuthenticationRequiredErrorOptions {\n  /**\n   * The list of scopes for which the token will have access.\n   */\n  scopes: string[];\n  /**\n   * The options passed to the getToken request.\n   */\n  getTokenOptions?: GetTokenOptions;\n  /**\n   * The message of the error.\n   */\n  message?: string;\n  /**\n   * The underlying cause, if any, that caused the authentication to fail.\n   */\n  cause?: unknown;\n}\n\n/**\n * Error used to enforce authentication after trying to retrieve a token silently.\n */\nexport class AuthenticationRequiredError extends Error {\n  /**\n   * The list of scopes for which the token will have access.\n   */\n  public scopes: string[];\n  /**\n   * The options passed to the getToken request.\n   */\n  public getTokenOptions?: GetTokenOptions;\n\n  constructor(\n    /**\n     * Optional parameters. A message can be specified. The {@link GetTokenOptions} of the request can also be specified to more easily associate the error with the received parameters.\n     */\n    options: AuthenticationRequiredErrorOptions,\n  ) {\n    super(options.message, options.cause ? { cause: options.cause } : undefined);\n    this.scopes = options.scopes;\n    this.getTokenOptions = options.getTokenOptions;\n    this.name = \"AuthenticationRequiredError\";\n  }\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../src/errors.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { GetTokenOptions } from \"@azure/core-auth\";\n\n/**\n * See the official documentation for more details:\n *\n * https://learn.microsoft.com/azure/active-directory/develop/v1-protocols-oauth-code#error-response-1\n *\n * NOTE: This documentation is for v1 OAuth support but the same error\n * response details still apply to v2.\n */\nexport interface ErrorResponse {\n  /**\n   * The string identifier for the error.\n   */\n  error: string;\n\n  /**\n   * The error's description.\n   */\n  errorDescription: string;\n\n  /**\n   * An array of codes pertaining to the error(s) that occurred.\n   */\n  errorCodes?: number[];\n\n  /**\n   * The timestamp at which the error occurred.\n   */\n  timestamp?: string;\n\n  /**\n   * The trace identifier for this error occurrence.\n   */\n  traceId?: string;\n\n  /**\n   * The correlation ID to be used for tracking the source of the error.\n   */\n  correlationId?: string;\n}\n\n/**\n * Used for internal deserialization of OAuth responses. Public model is ErrorResponse\n * @internal\n */\nexport interface OAuthErrorResponse {\n  error: string;\n  error_description: string;\n  error_codes?: number[];\n  timestamp?: string;\n  trace_id?: string;\n  correlation_id?: string;\n}\n\nfunction isErrorResponse(errorResponse: any): errorResponse is OAuthErrorResponse {\n  return (\n    errorResponse &&\n    typeof errorResponse.error === \"string\" &&\n    typeof errorResponse.error_description === \"string\"\n  );\n}\n\n/**\n * The Error.name value of an CredentialUnavailable\n */\nexport const CredentialUnavailableErrorName = \"CredentialUnavailableError\";\n\n/**\n * This signifies that the credential that was tried in a chained credential\n * was not available to be used as the credential. Rather than treating this as\n * an error that should halt the chain, it's caught and the chain continues\n */\nexport class CredentialUnavailableError extends Error {\n  constructor(message?: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = CredentialUnavailableErrorName;\n  }\n}\n\n/**\n * The Error.name value of an AuthenticationError\n */\nexport const AuthenticationErrorName = \"AuthenticationError\";\n\n/**\n * Provides details about a failure to authenticate with Azure Active\n * Directory.  The `errorResponse` field contains more details about\n * the specific failure.\n */\nexport class AuthenticationError extends Error {\n  /**\n   * The HTTP status code returned from the authentication request.\n   */\n  public readonly statusCode: number;\n\n  /**\n   * The error response details.\n   */\n  public readonly errorResponse: ErrorResponse;\n\n  constructor(\n    statusCode: number,\n    errorBody: object | string | undefined | null,\n    options?: { cause?: unknown },\n  ) {\n    let errorResponse: ErrorResponse = {\n      error: \"unknown\",\n      errorDescription: \"An unknown error occurred and no additional details are available.\",\n    };\n\n    if (isErrorResponse(errorBody)) {\n      errorResponse = convertOAuthErrorResponseToErrorResponse(errorBody);\n    } else if (typeof errorBody === \"string\") {\n      try {\n        // Most error responses will contain JSON-formatted error details\n        // in the response body\n        const oauthErrorResponse: OAuthErrorResponse = JSON.parse(errorBody);\n        errorResponse = convertOAuthErrorResponseToErrorResponse(oauthErrorResponse);\n      } catch (e: any) {\n        if (statusCode === 400) {\n          errorResponse = {\n            error: \"invalid_request\",\n            errorDescription: `The service indicated that the request was invalid.\\n\\n${errorBody}`,\n          };\n        } else {\n          errorResponse = {\n            error: \"unknown_error\",\n            errorDescription: `An unknown error has occurred. Response body:\\n\\n${errorBody}`,\n          };\n        }\n      }\n    } else {\n      errorResponse = {\n        error: \"unknown_error\",\n        errorDescription: \"An unknown error occurred and no additional details are available.\",\n      };\n    }\n\n    super(\n      `${errorResponse.error} Status code: ${statusCode}\\nMore details:\\n${errorResponse.errorDescription},`,\n      options,\n    );\n    this.statusCode = statusCode;\n    this.errorResponse = errorResponse;\n\n    // Ensure that this type reports the correct name\n    this.name = AuthenticationErrorName;\n  }\n}\n\n/**\n * The Error.name value of an AggregateAuthenticationError\n */\nexport const AggregateAuthenticationErrorName = \"AggregateAuthenticationError\";\n\n/**\n * Provides an `errors` array containing {@link AuthenticationError} instance\n * for authentication failures from credentials in a {@link ChainedTokenCredential}.\n */\nexport class AggregateAuthenticationError extends Error {\n  /**\n   * The array of error objects that were thrown while trying to authenticate\n   * with the credentials in a {@link ChainedTokenCredential}.\n   */\n  public errors: any[];\n\n  constructor(errors: any[], errorMessage?: string) {\n    const errorDetail = errors.join(\"\\n\");\n    super(`${errorMessage}\\n${errorDetail}`);\n    this.errors = errors;\n\n    // Ensure that this type reports the correct name\n    this.name = AggregateAuthenticationErrorName;\n  }\n}\n\nfunction convertOAuthErrorResponseToErrorResponse(errorBody: OAuthErrorResponse): ErrorResponse {\n  return {\n    error: errorBody.error,\n    errorDescription: errorBody.error_description,\n    correlationId: errorBody.correlation_id,\n    errorCodes: errorBody.error_codes,\n    timestamp: errorBody.timestamp,\n    traceId: errorBody.trace_id,\n  };\n}\n\n/**\n * Optional parameters to the {@link AuthenticationRequiredError}\n */\nexport interface AuthenticationRequiredErrorOptions {\n  /**\n   * The list of scopes for which the token will have access.\n   */\n  scopes: string[];\n  /**\n   * The options passed to the getToken request.\n   */\n  getTokenOptions?: GetTokenOptions;\n  /**\n   * The message of the error.\n   */\n  message?: string;\n  /**\n   * The underlying cause, if any, that caused the authentication to fail.\n   */\n  cause?: unknown;\n}\n\n/**\n * Error used to enforce authentication after trying to retrieve a token silently.\n */\nexport class AuthenticationRequiredError extends Error {\n  /**\n   * The list of scopes for which the token will have access.\n   */\n  public scopes: string[];\n  /**\n   * The options passed to the getToken request.\n   */\n  public getTokenOptions?: GetTokenOptions;\n\n  constructor(\n    /**\n     * Optional parameters. A message can be specified. The {@link GetTokenOptions} of the request can also be specified to more easily associate the error with the received parameters.\n     */\n    options: AuthenticationRequiredErrorOptions,\n  ) {\n    super(options.message, options.cause ? { cause: options.cause } : undefined);\n    this.scopes = options.scopes;\n    this.getTokenOptions = options.getTokenOptions;\n    this.name = \"AuthenticationRequiredError\";\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0DA,SAAS,gBAAgB,eAAyD;AAChF,SACE,iBACA,OAAO,cAAc,UAAU,YAC/B,OAAO,cAAc,sBAAsB;AAE/C;AAKO,MAAM,iCAAiC;AAOvC,MAAM,mCAAmC,MAAM;AAAA,EACpD,YAAY,SAAkB,SAA+B;AAC3D,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AAAA,EACd;AACF;AAKO,MAAM,0BAA0B;AAOhC,MAAM,4BAA4B,MAAM;AAAA;AAAA;AAAA;AAAA,EAI7B;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EAEhB,YACE,YACA,WACA,SACA;AACA,QAAI,gBAA+B;AAAA,MACjC,OAAO;AAAA,MACP,kBAAkB;AAAA,IACpB;AAEA,QAAI,gBAAgB,SAAS,GAAG;AAC9B,sBAAgB,yCAAyC,SAAS;AAAA,IACpE,WAAW,OAAO,cAAc,UAAU;AACxC,UAAI;AAGF,cAAM,qBAAyC,KAAK,MAAM,SAAS;AACnE,wBAAgB,yCAAyC,kBAAkB;AAAA,MAC7E,SAAS,GAAQ;AACf,YAAI,eAAe,KAAK;AACtB,0BAAgB;AAAA,YACd,OAAO;AAAA,YACP,kBAAkB;AAAA;AAAA,EAA0D,SAAS;AAAA,UACvF;AAAA,QACF,OAAO;AACL,0BAAgB;AAAA,YACd,OAAO;AAAA,YACP,kBAAkB;AAAA;AAAA,EAAoD,SAAS;AAAA,UACjF;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,sBAAgB;AAAA,QACd,OAAO;AAAA,QACP,kBAAkB;AAAA,MACpB;AAAA,IACF;AAEA;AAAA,MACE,GAAG,cAAc,KAAK,iBAAiB,UAAU;AAAA;AAAA,EAAoB,cAAc,gBAAgB;AAAA,MACnG;AAAA,IACF;AACA,SAAK,aAAa;AAClB,SAAK,gBAAgB;AAGrB,SAAK,OAAO;AAAA,EACd;AACF;AAKO,MAAM,mCAAmC;AAMzC,MAAM,qCAAqC,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C;AAAA,EAEP,YAAY,QAAe,cAAuB;AAChD,UAAM,cAAc,OAAO,KAAK,IAAI;AACpC,UAAM,GAAG,YAAY;AAAA,EAAK,WAAW,EAAE;AACvC,SAAK,SAAS;AAGd,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,yCAAyC,WAA8C;AAC9F,SAAO;AAAA,IACL,OAAO,UAAU;AAAA,IACjB,kBAAkB,UAAU;AAAA,IAC5B,eAAe,UAAU;AAAA,IACzB,YAAY,UAAU;AAAA,IACtB,WAAW,UAAU;AAAA,IACrB,SAAS,UAAU;AAAA,EACrB;AACF;AA2BO,MAAM,oCAAoC,MAAM;AAAA;AAAA;AAAA;AAAA,EAI9C;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAEP,YAIE,SACA;AACA,UAAM,QAAQ,SAAS,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAS;AAC3E,SAAK,SAAS,QAAQ;AACtB,SAAK,kBAAkB,QAAQ;AAC/B,SAAK,OAAO;AAAA,EACd;AACF;",
+  "names": []
+}

package/dist/commonjs/index.d.ts

@@ -1,61 +1,61 @@
 export * from "./plugins/consumer.js";
-export { IdentityPlugin } from "./plugins/provider.js";
+export type { IdentityPlugin } from "./plugins/provider.js";
 import type { TokenCredential } from "@azure/core-auth";
-export { AuthenticationError, ErrorResponse, AggregateAuthenticationError, AuthenticationErrorName, AggregateAuthenticationErrorName, CredentialUnavailableError, CredentialUnavailableErrorName, AuthenticationRequiredError, AuthenticationRequiredErrorOptions, } from "./errors.js";
-export { AuthenticationRecord } from "./msal/types.js";
+export { AuthenticationError, type ErrorResponse, AggregateAuthenticationError, AuthenticationErrorName, AggregateAuthenticationErrorName, CredentialUnavailableError, CredentialUnavailableErrorName, AuthenticationRequiredError, type AuthenticationRequiredErrorOptions, } from "./errors.js";
+export type { AuthenticationRecord } from "./msal/types.js";
 export { serializeAuthenticationRecord, deserializeAuthenticationRecord } from "./msal/utils.js";
-export { TokenCredentialOptions } from "./tokenCredentialOptions.js";
-export { MultiTenantTokenCredentialOptions } from "./credentials/multiTenantTokenCredentialOptions.js";
-export { AuthorityValidationOptions } from "./credentials/authorityValidationOptions.js";
-export { BrokerAuthOptions } from "./credentials/brokerAuthOptions.js";
-export { BrokerOptions, BrokerEnabledOptions, BrokerDisabledOptions, } from "./msal/nodeFlows/brokerOptions.js";
-export { InteractiveCredentialOptions } from "./credentials/interactiveCredentialOptions.js";
+export type { TokenCredentialOptions } from "./tokenCredentialOptions.js";
+export type { MultiTenantTokenCredentialOptions } from "./credentials/multiTenantTokenCredentialOptions.js";
+export type { AuthorityValidationOptions } from "./credentials/authorityValidationOptions.js";
+export type { BrokerAuthOptions } from "./credentials/brokerAuthOptions.js";
+export type { BrokerOptions, BrokerEnabledOptions, BrokerDisabledOptions, } from "./msal/nodeFlows/brokerOptions.js";
+export type { InteractiveCredentialOptions } from "./credentials/interactiveCredentialOptions.js";
 export { ChainedTokenCredential } from "./credentials/chainedTokenCredential.js";
 export { ClientSecretCredential } from "./credentials/clientSecretCredential.js";
-export { ClientSecretCredentialOptions } from "./credentials/clientSecretCredentialOptions.js";
+export type { ClientSecretCredentialOptions } from "./credentials/clientSecretCredentialOptions.js";
 export { DefaultAzureCredential } from "./credentials/defaultAzureCredential.js";
-export { DefaultAzureCredentialOptions, DefaultAzureCredentialClientIdOptions, DefaultAzureCredentialResourceIdOptions, DefaultAzureCredentialEnvVars, } from "./credentials/defaultAzureCredentialOptions.js";
+export type { DefaultAzureCredentialOptions, DefaultAzureCredentialClientIdOptions, DefaultAzureCredentialResourceIdOptions, DefaultAzureCredentialEnvVars, } from "./credentials/defaultAzureCredentialOptions.js";
 export { EnvironmentCredential } from "./credentials/environmentCredential.js";
-export { EnvironmentCredentialOptions } from "./credentials/environmentCredentialOptions.js";
+export type { EnvironmentCredentialOptions } from "./credentials/environmentCredentialOptions.js";
 export { ClientCertificateCredential } from "./credentials/clientCertificateCredential.js";
-export { ClientCertificateCredentialPEMConfiguration, ClientCertificatePEMCertificatePath, ClientCertificatePEMCertificate, } from "./credentials/clientCertificateCredentialModels.js";
-export { ClientCertificateCredentialOptions } from "./credentials/clientCertificateCredentialOptions.js";
+export type { ClientCertificateCredentialPEMConfiguration, ClientCertificatePEMCertificatePath, ClientCertificatePEMCertificate, } from "./credentials/clientCertificateCredentialModels.js";
+export type { ClientCertificateCredentialOptions } from "./credentials/clientCertificateCredentialOptions.js";
 export { ClientAssertionCredential } from "./credentials/clientAssertionCredential.js";
-export { ClientAssertionCredentialOptions } from "./credentials/clientAssertionCredentialOptions.js";
-export { CredentialPersistenceOptions } from "./credentials/credentialPersistenceOptions.js";
+export type { ClientAssertionCredentialOptions } from "./credentials/clientAssertionCredentialOptions.js";
+export type { CredentialPersistenceOptions } from "./credentials/credentialPersistenceOptions.js";
 export { AzureCliCredential } from "./credentials/azureCliCredential.js";
-export { AzureCliCredentialOptions } from "./credentials/azureCliCredentialOptions.js";
+export type { AzureCliCredentialOptions } from "./credentials/azureCliCredentialOptions.js";
 export { AzureDeveloperCliCredential } from "./credentials/azureDeveloperCliCredential.js";
-export { AzureDeveloperCliCredentialOptions } from "./credentials/azureDeveloperCliCredentialOptions.js";
+export type { AzureDeveloperCliCredentialOptions } from "./credentials/azureDeveloperCliCredentialOptions.js";
 export { InteractiveBrowserCredential } from "./credentials/interactiveBrowserCredential.js";
-export { InteractiveBrowserCredentialNodeOptions, InteractiveBrowserCredentialInBrowserOptions, BrowserLoginStyle, } from "./credentials/interactiveBrowserCredentialOptions.js";
+export type { InteractiveBrowserCredentialNodeOptions, InteractiveBrowserCredentialInBrowserOptions, BrowserLoginStyle, } from "./credentials/interactiveBrowserCredentialOptions.js";
 export { ManagedIdentityCredential } from "./credentials/managedIdentityCredential/index.js";
-export { ManagedIdentityCredentialClientIdOptions, ManagedIdentityCredentialResourceIdOptions, ManagedIdentityCredentialObjectIdOptions, } from "./credentials/managedIdentityCredential/options.js";
+export type { ManagedIdentityCredentialClientIdOptions, ManagedIdentityCredentialResourceIdOptions, ManagedIdentityCredentialObjectIdOptions, } from "./credentials/managedIdentityCredential/options.js";
 export { DeviceCodeCredential } from "./credentials/deviceCodeCredential.js";
-export { DeviceCodePromptCallback, DeviceCodeInfo, } from "./credentials/deviceCodeCredentialOptions.js";
-export { DeviceCodeCredentialOptions } from "./credentials/deviceCodeCredentialOptions.js";
+export type { DeviceCodePromptCallback, DeviceCodeInfo, } from "./credentials/deviceCodeCredentialOptions.js";
+export type { DeviceCodeCredentialOptions } from "./credentials/deviceCodeCredentialOptions.js";
 export { AzurePipelinesCredential as AzurePipelinesCredential } from "./credentials/azurePipelinesCredential.js";
-export { AzurePipelinesCredentialOptions as AzurePipelinesCredentialOptions } from "./credentials/azurePipelinesCredentialOptions.js";
+export type { AzurePipelinesCredentialOptions as AzurePipelinesCredentialOptions } from "./credentials/azurePipelinesCredentialOptions.js";
 export { AuthorizationCodeCredential } from "./credentials/authorizationCodeCredential.js";
-export { AuthorizationCodeCredentialOptions } from "./credentials/authorizationCodeCredentialOptions.js";
+export type { AuthorizationCodeCredentialOptions } from "./credentials/authorizationCodeCredentialOptions.js";
 export { AzurePowerShellCredential } from "./credentials/azurePowerShellCredential.js";
-export { AzurePowerShellCredentialOptions } from "./credentials/azurePowerShellCredentialOptions.js";
-export { OnBehalfOfCredentialOptions, OnBehalfOfCredentialSecretOptions, OnBehalfOfCredentialCertificateOptions, OnBehalfOfCredentialAssertionOptions, } from "./credentials/onBehalfOfCredentialOptions.js";
+export type { AzurePowerShellCredentialOptions } from "./credentials/azurePowerShellCredentialOptions.js";
+export type { OnBehalfOfCredentialOptions, OnBehalfOfCredentialSecretOptions, OnBehalfOfCredentialCertificateOptions, OnBehalfOfCredentialAssertionOptions, } from "./credentials/onBehalfOfCredentialOptions.js";
 export { UsernamePasswordCredential } from "./credentials/usernamePasswordCredential.js";
-export { UsernamePasswordCredentialOptions } from "./credentials/usernamePasswordCredentialOptions.js";
+export type { UsernamePasswordCredentialOptions } from "./credentials/usernamePasswordCredentialOptions.js";
 export { VisualStudioCodeCredential } from "./credentials/visualStudioCodeCredential.js";
-export { VisualStudioCodeCredentialOptions } from "./credentials/visualStudioCodeCredentialOptions.js";
+export type { VisualStudioCodeCredentialOptions } from "./credentials/visualStudioCodeCredentialOptions.js";
 export { OnBehalfOfCredential } from "./credentials/onBehalfOfCredential.js";
 export { WorkloadIdentityCredential } from "./credentials/workloadIdentityCredential.js";
-export { WorkloadIdentityCredentialOptions } from "./credentials/workloadIdentityCredentialOptions.js";
-export { BrowserCustomizationOptions } from "./credentials/browserCustomizationOptions.js";
-export { TokenCachePersistenceOptions } from "./msal/nodeFlows/tokenCachePersistenceOptions.js";
-export { TokenCredential, GetTokenOptions, AccessToken } from "@azure/core-auth";
+export type { WorkloadIdentityCredentialOptions } from "./credentials/workloadIdentityCredentialOptions.js";
+export type { BrowserCustomizationOptions } from "./credentials/browserCustomizationOptions.js";
+export type { TokenCachePersistenceOptions } from "./msal/nodeFlows/tokenCachePersistenceOptions.js";
+export type { TokenCredential, GetTokenOptions, AccessToken } from "@azure/core-auth";
 export { logger } from "./util/logging.js";
 export { AzureAuthorityHosts } from "./constants.js";
 /**
  * Returns a new instance of the {@link DefaultAzureCredential}.
  */
 export declare function getDefaultAzureCredential(): TokenCredential;
-export { getBearerTokenProvider, GetBearerTokenProviderOptions } from "./tokenProvider.js";
+export { getBearerTokenProvider, type GetBearerTokenProviderOptions } from "./tokenProvider.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,uBAAuB,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,4BAA4B,EAC5B,uBAAuB,EACvB,gCAAgC,EAChC,0BAA0B,EAC1B,8BAA8B,EAC9B,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,iCAAiC,EAAE,MAAM,oDAAoD,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAIzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAE7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAE/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EACL,6BAA6B,EAC7B,qCAAqC,EACrC,uCAAuC,EACvC,6BAA6B,GAC9B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAE7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,qDAAqD,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,mDAAmD,CAAC;AACrG,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,kCAAkC,EAAE,MAAM,qDAAqD,CAAC;AACzG,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EACL,uCAAuC,EACvC,4CAA4C,EAC5C,iBAAiB,GAClB,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,EACL,wCAAwC,EACxC,0CAA0C,EAC1C,wCAAwC,GACzC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,wBAAwB,EACxB,cAAc,GACf,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,IAAI,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACjH,OAAO,EAAE,+BAA+B,IAAI,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AACtI,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,kCAAkC,EAAE,MAAM,qDAAqD,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,mDAAmD,CAAC;AACrG,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,sCAAsC,EACtC,oCAAoC,GACrC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,oDAAoD,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,oDAAoD,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,oDAAoD,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAEhG,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,eAAe,CAE3D;AAED,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,uBAAuB,CAAC;AAEtC,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,gCAAgC,EAChC,0BAA0B,EAC1B,8BAA8B,EAC9B,2BAA2B,EAC3B,KAAK,kCAAkC,GACxC,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AACjG,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,YAAY,EAAE,iCAAiC,EAAE,MAAM,oDAAoD,CAAC;AAC5G,YAAY,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAI9F,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAElG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,YAAY,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAEpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,YAAY,EACV,6BAA6B,EAC7B,qCAAqC,EACrC,uCAAuC,EACvC,6BAA6B,GAC9B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,YAAY,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAElG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,YAAY,EACV,2CAA2C,EAC3C,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,oDAAoD,CAAC;AAC5D,YAAY,EAAE,kCAAkC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,YAAY,EAAE,gCAAgC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,YAAY,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,YAAY,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,YAAY,EAAE,kCAAkC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,YAAY,EACV,uCAAuC,EACvC,4CAA4C,EAC5C,iBAAiB,GAClB,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,YAAY,EACV,wCAAwC,EACxC,0CAA0C,EAC1C,wCAAwC,GACzC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,YAAY,EACV,wBAAwB,EACxB,cAAc,GACf,MAAM,8CAA8C,CAAC;AACtD,YAAY,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,EAAE,wBAAwB,IAAI,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACjH,YAAY,EAAE,+BAA+B,IAAI,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AAC3I,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,YAAY,EAAE,kCAAkC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,YAAY,EAAE,gCAAgC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,YAAY,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,sCAAsC,EACtC,oCAAoC,GACrC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,YAAY,EAAE,iCAAiC,EAAE,MAAM,oDAAoD,CAAC;AAC5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,YAAY,EAAE,iCAAiC,EAAE,MAAM,oDAAoD,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,YAAY,EAAE,iCAAiC,EAAE,MAAM,oDAAoD,CAAC;AAC5G,YAAY,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,YAAY,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAErG,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,eAAe,CAE3D;AAED,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,oBAAoB,CAAC"}