@azure/identity 4.14.0-beta.2 → 4.14.0-beta.4

package/dist/commonjs/credentials/azureDeveloperCliCredential.js

@@ -1,233 +1,271 @@
-"use strict";
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AzureDeveloperCliCredential = exports.developerCliCredentialInternals = exports.azureDeveloperCliPublicErrorMessages = void 0;
-const tslib_1 = require("tslib");
-const logging_js_1 = require("../util/logging.js");
-const errors_js_1 = require("../errors.js");
-const child_process_1 = tslib_1.__importDefault(require("child_process"));
-const tenantIdUtils_js_1 = require("../util/tenantIdUtils.js");
-const tracing_js_1 = require("../util/tracing.js");
-const scopeUtils_js_1 = require("../util/scopeUtils.js");
-const logger = (0, logging_js_1.credentialLogger)("AzureDeveloperCliCredential");
-/**
- * Messages to use when throwing in this credential.
- * @internal
- */
-exports.azureDeveloperCliPublicErrorMessages = {
-    notInstalled: "Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.",
-    login: "Please run 'azd auth login' from a command prompt to authenticate before using this credential. For more information, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.",
-    unknown: "Unknown error while trying to retrieve the access token",
-    claim: "This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:",
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-/**
- * Mockable reference to the Developer CLI credential cliCredentialFunctions
- * @internal
- */
-exports.developerCliCredentialInternals = {
-    /**
-     * Parses azd stderr JSON output to extract the error message.
-     * azd outputs JSON like: \{"type":"consoleMessage","timestamp":"...","data":\{"message":"ERROR: ..."\}\}
-     * If parsing succeeds and .data.message exists, returns the trimmed message.
-     * Otherwise, returns the raw stderr.
-     * @param stderr - The stderr output from azd command
-     * @returns The parsed error message or raw stderr
-     * @internal
-     */
-    parseAzdStderr(stderr) {
-        try {
-            const parsed = JSON.parse(stderr);
-            const message = parsed?.data?.message;
-            if (typeof message === "string" && message.trim().length > 0) {
-                return message.trim();
-            }
-        }
-        catch {
-            // If JSON parsing fails, fall through to return raw stderr
-        }
-        return stderr;
-    },
-    /**
-     * @internal
-     */
-    getSafeWorkingDir() {
-        if (process.platform === "win32") {
-            let systemRoot = process.env.SystemRoot || process.env["SYSTEMROOT"];
-            if (!systemRoot) {
-                logger.getToken.warning("The SystemRoot environment variable is not set. This may cause issues when using the Azure Developer CLI credential.");
-                systemRoot = "C:\\Windows";
-            }
-            return systemRoot;
-        }
-        else {
-            return "/bin";
-        }
-    },
-    /**
-     * Gets the access token from Azure Developer CLI
-     * @param scopes - The scopes to use when getting the token
-     * @internal
-     */
-    async getAzdAccessToken(scopes, tenantId, timeout, claims) {
-        let tenantSection = [];
-        if (tenantId) {
-            tenantSection = ["--tenant-id", tenantId];
-        }
-        let claimsSections = [];
-        if (claims) {
-            const encodedClaims = btoa(claims);
-            claimsSections = ["--claims", encodedClaims];
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var azureDeveloperCliCredential_exports = {};
+__export(azureDeveloperCliCredential_exports, {
+  AzureDeveloperCliCredential: () => AzureDeveloperCliCredential,
+  azureDeveloperCliPublicErrorMessages: () => azureDeveloperCliPublicErrorMessages,
+  developerCliCredentialInternals: () => developerCliCredentialInternals
+});
+module.exports = __toCommonJS(azureDeveloperCliCredential_exports);
+var import_logging = require("../util/logging.js");
+var import_errors = require("../errors.js");
+var import_child_process = __toESM(require("child_process"));
+var import_tenantIdUtils = require("../util/tenantIdUtils.js");
+var import_tracing = require("../util/tracing.js");
+var import_scopeUtils = require("../util/scopeUtils.js");
+var import_core_util = require("@azure/core-util");
+const logger = (0, import_logging.credentialLogger)("AzureDeveloperCliCredential");
+const azureDeveloperCliPublicErrorMessages = {
+  notInstalled: "Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.",
+  login: "Please run 'azd auth login' from a command prompt to authenticate before using this credential. For more information, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.",
+  unknown: "Unknown error while trying to retrieve the access token",
+  claim: "This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:"
+};
+const developerCliCredentialInternals = {
+  /**
+   * Parses azd stderr JSON output to extract a human-readable error message.
+   *
+   * Three formats are supported across azd versions:
+   * - pre-v1.23.7: `{"type":"consoleMessage","data":{"message":"..."}}`
+   * - v1.23.7 - v1.23.15: an empty `consoleMessage` line followed by `{"error":"...","message":"...","suggestion":"..."}`
+   * - v1.24.0+: `{"error":"...","message":"...","suggestion":"..."}`
+   *
+   * The structured `error` field is preferred. If absent, falls back to the
+   * first non-empty `data.message` from a legacy `consoleMessage` line. If
+   * neither is found, the raw stderr is returned unchanged so plain-text and
+   * malformed output continue to surface to callers.
+   *
+   * @param stderr - The stderr output from azd command
+   * @returns The parsed error message or raw stderr
+   * @internal
+   */
+  parseAzdStderr(stderr) {
+    if (!stderr?.trim()) {
+      return stderr;
+    }
+    let fallback;
+    for (const rawLine of stderr.split("\n")) {
+      const line = rawLine.trim();
+      if (!line.startsWith("{")) {
+        continue;
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (typeof parsed?.error === "string" && parsed.error.trim()) {
+        return parsed.error.trim();
+      }
+      if (fallback === void 0) {
+        const message = parsed?.data?.message;
+        if (typeof message === "string" && message.trim()) {
+          fallback = message.trim();
         }
-        return new Promise((resolve, reject) => {
-            try {
-                const args = [
-                    "auth",
-                    "token",
-                    "--output",
-                    "json",
-                    "--no-prompt",
-                    ...scopes.reduce((previous, current) => previous.concat("--scope", current), []),
-                    ...tenantSection,
-                    ...claimsSections,
-                ];
-                const command = ["azd", ...args].join(" ");
-                child_process_1.default.exec(command, {
-                    cwd: exports.developerCliCredentialInternals.getSafeWorkingDir(),
-                    timeout,
-                }, (error, stdout, stderr) => {
-                    resolve({ stdout, stderr, error });
-                });
-            }
-            catch (err) {
-                reject(err);
-            }
-        });
-    },
+      }
+    }
+    return fallback ?? stderr;
+  },
+  /**
+   * @internal
+   */
+  getSafeWorkingDir() {
+    if (process.platform === "win32") {
+      let systemRoot = process.env.SystemRoot || process.env["SYSTEMROOT"];
+      if (!systemRoot) {
+        logger.getToken.warning(
+          "The SystemRoot environment variable is not set. This may cause issues when using the Azure Developer CLI credential."
+        );
+        systemRoot = "C:\\Windows";
+      }
+      return systemRoot;
+    } else {
+      return "/bin";
+    }
+  },
+  /**
+   * Gets the access token from Azure Developer CLI
+   * @param scopes - The scopes to use when getting the token
+   * @internal
+   */
+  async getAzdAccessToken(scopes, tenantId, timeout, claims) {
+    let tenantSection = [];
+    if (tenantId) {
+      tenantSection = ["--tenant-id", tenantId];
+    }
+    let claimsSections = [];
+    if (claims) {
+      const encodedClaims = (0, import_core_util.uint8ArrayToString)((0, import_core_util.stringToUint8Array)(claims, "utf-8"), "base64");
+      claimsSections = ["--claims", encodedClaims];
+    }
+    return new Promise((resolve, reject) => {
+      try {
+        const args = [
+          "auth",
+          "token",
+          "--output",
+          "json",
+          "--no-prompt",
+          ...scopes.reduce(
+            (previous, current) => previous.concat("--scope", current),
+            []
+          ),
+          ...tenantSection,
+          ...claimsSections
+        ];
+        const command = ["azd", ...args].join(" ");
+        import_child_process.default.exec(
+          command,
+          {
+            cwd: developerCliCredentialInternals.getSafeWorkingDir(),
+            timeout
+          },
+          (error, stdout, stderr) => {
+            resolve({ stdout, stderr, error });
+          }
+        );
+      } catch (err) {
+        reject(err);
+      }
+    });
+  }
 };
-/**
- * Azure Developer CLI is a command-line interface tool that allows developers to create, manage, and deploy
- * resources in Azure. It's built on top of the Azure CLI and provides additional functionality specific
- * to Azure developers. It allows users to authenticate as a user and/or a service principal against
- * <a href="https://learn.microsoft.com/entra/fundamentals/">Microsoft Entra ID</a>. The
- * AzureDeveloperCliCredential authenticates in a development environment and acquires a token on behalf of
- * the logged-in user or service principal in the Azure Developer CLI. It acts as the Azure Developer CLI logged in user or
- * service principal and executes an Azure CLI command underneath to authenticate the application against
- * Microsoft Entra ID.
- *
- * <h2> Configure AzureDeveloperCliCredential </h2>
- *
- * To use this credential, the developer needs to authenticate locally in Azure Developer CLI using one of the
- * commands below:
- *
- * <ol>
- *     <li>Run "azd auth login" in Azure Developer CLI to authenticate interactively as a user.</li>
- *     <li>Run "azd auth login --client-id clientID --client-secret clientSecret
- *     --tenant-id tenantID" to authenticate as a service principal.</li>
- * </ol>
- *
- * You may need to repeat this process after a certain time period, depending on the refresh token validity in your
- * organization. Generally, the refresh token validity period is a few weeks to a few months.
- * AzureDeveloperCliCredential will prompt you to sign in again.
- */
 class AzureDeveloperCliCredential {
-    tenantId;
-    additionallyAllowedTenantIds;
-    timeout;
-    /**
-     * Creates an instance of the {@link AzureDeveloperCliCredential}.
-     *
-     * To use this credential, ensure that you have already logged
-     * in via the 'azd' tool using the command "azd auth login" from the commandline.
-     *
-     * @param options - Options, to optionally allow multi-tenant requests.
-     */
-    constructor(options) {
-        if (options?.tenantId) {
-            (0, tenantIdUtils_js_1.checkTenantId)(logger, options?.tenantId);
-            this.tenantId = options?.tenantId;
-        }
-        this.additionallyAllowedTenantIds = (0, tenantIdUtils_js_1.resolveAdditionallyAllowedTenantIds)(options?.additionallyAllowedTenants);
-        this.timeout = options?.processTimeoutInMs;
+  tenantId;
+  additionallyAllowedTenantIds;
+  timeout;
+  /**
+   * Creates an instance of the {@link AzureDeveloperCliCredential}.
+   *
+   * To use this credential, ensure that you have already logged
+   * in via the 'azd' tool using the command "azd auth login" from the commandline.
+   *
+   * @param options - Options, to optionally allow multi-tenant requests.
+   */
+  constructor(options) {
+    if (options?.tenantId) {
+      (0, import_tenantIdUtils.checkTenantId)(logger, options?.tenantId);
+      this.tenantId = options?.tenantId;
+    }
+    this.additionallyAllowedTenantIds = (0, import_tenantIdUtils.resolveAdditionallyAllowedTenantIds)(
+      options?.additionallyAllowedTenants
+    );
+    this.timeout = options?.processTimeoutInMs;
+  }
+  /**
+   * Authenticates with Microsoft Entra ID and returns an access token if successful.
+   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
+   *
+   * @param scopes - The list of scopes for which the token will have access.
+   * @param options - The options used to configure any requests this
+   *                TokenCredential implementation might make.
+   */
+  async getToken(scopes, options = {}) {
+    const tenantId = (0, import_tenantIdUtils.processMultiTenantRequest)(
+      this.tenantId,
+      options,
+      this.additionallyAllowedTenantIds
+    );
+    if (tenantId) {
+      (0, import_tenantIdUtils.checkTenantId)(logger, tenantId);
+    }
+    let scopeList;
+    if (typeof scopes === "string") {
+      scopeList = [scopes];
+    } else {
+      scopeList = scopes;
     }
-    /**
-     * Authenticates with Microsoft Entra ID and returns an access token if successful.
-     * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
-     *
-     * @param scopes - The list of scopes for which the token will have access.
-     * @param options - The options used to configure any requests this
-     *                TokenCredential implementation might make.
-     */
-    async getToken(scopes, options = {}) {
-        const tenantId = (0, tenantIdUtils_js_1.processMultiTenantRequest)(this.tenantId, options, this.additionallyAllowedTenantIds);
-        if (tenantId) {
-            (0, tenantIdUtils_js_1.checkTenantId)(logger, tenantId);
+    logger.getToken.info(`Using the scopes ${scopes}`);
+    return import_tracing.tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
+      try {
+        scopeList.forEach((scope) => {
+          (0, import_scopeUtils.ensureValidScopeForDevTimeCreds)(scope, logger);
+        });
+        const obj = await developerCliCredentialInternals.getAzdAccessToken(
+          scopeList,
+          tenantId,
+          this.timeout,
+          options.claims
+        );
+        const isMFARequiredError = obj.stderr?.match("must use multi-factor authentication") || obj.stderr?.match("reauthentication required");
+        const isNotLoggedInError = obj.stderr?.match("not logged in, run `azd login` to login") || obj.stderr?.match("not logged in, run `azd auth login` to login");
+        const isNotInstallError = obj.stderr?.match("azd:(.*)not found") || obj.stderr?.startsWith("'azd' is not recognized");
+        if (isNotInstallError || obj.error && obj.error.code === "ENOENT") {
+          const error = new import_errors.CredentialUnavailableError(
+            azureDeveloperCliPublicErrorMessages.notInstalled
+          );
+          logger.getToken.info((0, import_logging.formatError)(scopes, error));
+          throw error;
         }
-        let scopeList;
-        if (typeof scopes === "string") {
-            scopeList = [scopes];
+        if (isNotLoggedInError) {
+          const error = new import_errors.CredentialUnavailableError(azureDeveloperCliPublicErrorMessages.login);
+          logger.getToken.info((0, import_logging.formatError)(scopes, error));
+          throw error;
         }
-        else {
-            scopeList = scopes;
+        if (isMFARequiredError) {
+          const scope = scopeList.reduce((previous, current) => previous.concat("--scope", current), []).join(" ");
+          const loginCmd = `azd auth login ${scope}`;
+          const error = new import_errors.CredentialUnavailableError(
+            `${azureDeveloperCliPublicErrorMessages.claim} ${loginCmd}`
+          );
+          logger.getToken.info((0, import_logging.formatError)(scopes, error));
+          throw error;
         }
-        logger.getToken.info(`Using the scopes ${scopes}`);
-        return tracing_js_1.tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
-            try {
-                scopeList.forEach((scope) => {
-                    (0, scopeUtils_js_1.ensureValidScopeForDevTimeCreds)(scope, logger);
-                });
-                const obj = await exports.developerCliCredentialInternals.getAzdAccessToken(scopeList, tenantId, this.timeout, options.claims);
-                const isMFARequiredError = obj.stderr?.match("must use multi-factor authentication") ||
-                    obj.stderr?.match("reauthentication required");
-                const isNotLoggedInError = obj.stderr?.match("not logged in, run `azd login` to login") ||
-                    obj.stderr?.match("not logged in, run `azd auth login` to login");
-                const isNotInstallError = obj.stderr?.match("azd:(.*)not found") ||
-                    obj.stderr?.startsWith("'azd' is not recognized");
-                if (isNotInstallError || (obj.error && obj.error.code === "ENOENT")) {
-                    const error = new errors_js_1.CredentialUnavailableError(exports.azureDeveloperCliPublicErrorMessages.notInstalled);
-                    logger.getToken.info((0, logging_js_1.formatError)(scopes, error));
-                    throw error;
-                }
-                if (isNotLoggedInError) {
-                    const error = new errors_js_1.CredentialUnavailableError(exports.azureDeveloperCliPublicErrorMessages.login);
-                    logger.getToken.info((0, logging_js_1.formatError)(scopes, error));
-                    throw error;
-                }
-                if (isMFARequiredError) {
-                    const scope = scopeList
-                        .reduce((previous, current) => previous.concat("--scope", current), [])
-                        .join(" ");
-                    const loginCmd = `azd auth login ${scope}`;
-                    const error = new errors_js_1.CredentialUnavailableError(`${exports.azureDeveloperCliPublicErrorMessages.claim} ${loginCmd}`);
-                    logger.getToken.info((0, logging_js_1.formatError)(scopes, error));
-                    throw error;
-                }
-                try {
-                    const resp = JSON.parse(obj.stdout);
-                    logger.getToken.info((0, logging_js_1.formatSuccess)(scopes));
-                    return {
-                        token: resp.token,
-                        expiresOnTimestamp: new Date(resp.expiresOn).getTime(),
-                        tokenType: "Bearer",
-                    };
-                }
-                catch (e) {
-                    if (obj.stderr) {
-                        const errorMessage = exports.developerCliCredentialInternals.parseAzdStderr(obj.stderr);
-                        throw new errors_js_1.CredentialUnavailableError(errorMessage);
-                    }
-                    throw e;
-                }
-            }
-            catch (err) {
-                const error = err.name === "CredentialUnavailableError"
-                    ? err
-                    : new errors_js_1.CredentialUnavailableError(err.message || exports.azureDeveloperCliPublicErrorMessages.unknown);
-                logger.getToken.info((0, logging_js_1.formatError)(scopes, error));
-                throw error;
-            }
-        });
-    }
+        try {
+          const resp = JSON.parse(obj.stdout);
+          logger.getToken.info((0, import_logging.formatSuccess)(scopes));
+          return {
+            token: resp.token,
+            expiresOnTimestamp: new Date(resp.expiresOn).getTime(),
+            tokenType: "Bearer"
+          };
+        } catch (e) {
+          if (obj.stderr) {
+            const errorMessage = developerCliCredentialInternals.parseAzdStderr(obj.stderr);
+            throw new import_errors.CredentialUnavailableError(errorMessage);
+          }
+          throw e;
+        }
+      } catch (err) {
+        const error = err.name === "CredentialUnavailableError" ? err : new import_errors.CredentialUnavailableError(
+          err.message || azureDeveloperCliPublicErrorMessages.unknown
+        );
+        logger.getToken.info((0, import_logging.formatError)(scopes, error));
+        throw error;
+      }
+    });
+  }
 }
-exports.AzureDeveloperCliCredential = AzureDeveloperCliCredential;
-//# sourceMappingURL=azureDeveloperCliCredential.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AzureDeveloperCliCredential,
+  azureDeveloperCliPublicErrorMessages,
+  developerCliCredentialInternals
+});
+//# sourceMappingURL=azureDeveloperCliCredential.js.map

package/dist/commonjs/credentials/azureDeveloperCliCredential.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"azureDeveloperCliCredential.js","sourceRoot":"","sources":["../../../src/credentials/azureDeveloperCliCredential.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;;AAGlC,mDAAkF;AAElF,4CAA0D;AAC1D,0EAA0C;AAC1C,+DAIkC;AAClC,mDAAmD;AACnD,yDAAwE;AAExE,MAAM,MAAM,GAAG,IAAA,6BAAgB,EAAC,6BAA6B,CAAC,CAAC;AAE/D;;;GAGG;AACU,QAAA,oCAAoC,GAAG;IAClD,YAAY,EACV,wKAAwK;IAC1K,KAAK,EACH,+NAA+N;IACjO,OAAO,EAAE,yDAAyD;IAClE,KAAK,EACH,gIAAgI;CACnI,CAAC;AAEF;;;GAGG;AACU,QAAA,+BAA+B,GAAG;IAC7C;;;;;;;;OAQG;IACH,cAAc,CAAC,MAAc;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC;YACtC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7D,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,QAAQ,CAAC,OAAO,CACrB,sHAAsH,CACvH,CAAC;gBAEF,UAAU,GAAG,aAAa,CAAC;YAC7B,CAAC;YAED,OAAO,UAAU,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,MAAgB,EAChB,QAAiB,EACjB,OAAgB,EAChB,MAAe;QAEf,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,aAAa,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,cAAc,GAAa,EAAE,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,cAAc,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG;oBACX,MAAM;oBACN,OAAO;oBACP,UAAU;oBACV,MAAM;oBACN,aAAa;oBACb,GAAG,MAAM,CAAC,MAAM,CACd,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAC1D,EAAE,CACH;oBACD,GAAG,aAAa;oBAChB,GAAG,cAAc;iBAClB,CAAC;gBACF,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC3C,uBAAa,CAAC,IAAI,CAChB,OAAO,EACP;oBACE,GAAG,EAAE,uCAA+B,CAAC,iBAAiB,EAAE;oBACxD,OAAO;iBACR,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;oBACxB,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrC,CAAC,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAa,2BAA2B;IAC9B,QAAQ,CAAU;IAClB,4BAA4B,CAAW;IACvC,OAAO,CAAU;IAEzB;;;;;;;OAOG;IACH,YAAY,OAA4C;QACtD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,IAAA,gCAAa,EAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,4BAA4B,GAAG,IAAA,sDAAmC,EACrE,OAAO,EAAE,0BAA0B,CACpC,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,kBAAkB,CAAC;IAC7C,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAyB,EACzB,UAA2B,EAAE;QAE7B,MAAM,QAAQ,GAAG,IAAA,4CAAyB,EACxC,IAAI,CAAC,QAAQ,EACb,OAAO,EACP,IAAI,CAAC,4BAA4B,CAClC,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,IAAA,gCAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,SAAmB,CAAC;QACxB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,SAAS,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;QAEnD,OAAO,0BAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;YACrF,IAAI,CAAC;gBACH,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC1B,IAAA,+CAA+B,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjD,CAAC,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,uCAA+B,CAAC,iBAAiB,CACjE,SAAS,EACT,QAAQ,EACR,IAAI,CAAC,OAAO,EACZ,OAAO,CAAC,MAAM,CACf,CAAC;gBACF,MAAM,kBAAkB,GACtB,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,sCAAsC,CAAC;oBACzD,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACjD,MAAM,kBAAkB,GACtB,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,yCAAyC,CAAC;oBAC5D,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBACpE,MAAM,iBAAiB,GACrB,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,mBAAmB,CAAC;oBACtC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,yBAAyB,CAAC,CAAC;gBACpD,IAAI,iBAAiB,IAAI,CAAC,GAAG,CAAC,KAAK,IAAK,GAAG,CAAC,KAAa,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;oBAC7E,MAAM,KAAK,GAAG,IAAI,sCAA0B,CAC1C,4CAAoC,CAAC,YAAY,CAClD,CAAC;oBACF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,wBAAW,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;oBACjD,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,KAAK,GAAG,IAAI,sCAA0B,CAAC,4CAAoC,CAAC,KAAK,CAAC,CAAC;oBACzF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,wBAAW,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;oBACjD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,KAAK,GAAG,SAAS;yBACpB,MAAM,CAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;yBAChF,IAAI,CAAC,GAAG,CAAC,CAAC;oBACb,MAAM,QAAQ,GAAG,kBAAkB,KAAK,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,IAAI,sCAA0B,CAC1C,GAAG,4CAAoC,CAAC,KAAK,IAAI,QAAQ,EAAE,CAC5D,CAAC;oBACF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,wBAAW,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;oBACjD,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,IAAI,GAAyC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,0BAAa,EAAC,MAAM,CAAC,CAAC,CAAC;oBAC5C,OAAO;wBACL,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,kBAAkB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;wBACtD,SAAS,EAAE,QAAQ;qBACL,CAAC;gBACnB,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;wBACf,MAAM,YAAY,GAAG,uCAA+B,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBAChF,MAAM,IAAI,sCAA0B,CAAC,YAAY,CAAC,CAAC;oBACrD,CAAC;oBACD,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,KAAK,4BAA4B;oBACvC,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,IAAI,sCAA0B,CAC3B,GAAa,CAAC,OAAO,IAAI,4CAAoC,CAAC,OAAO,CACvE,CAAC;gBACR,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,wBAAW,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;gBACjD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA5HD,kEA4HC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport type { AzureDeveloperCliCredentialOptions } from \"./azureDeveloperCliCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport child_process from \"child_process\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { ensureValidScopeForDevTimeCreds } from \"../util/scopeUtils.js\";\n\nconst logger = credentialLogger(\"AzureDeveloperCliCredential\");\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const azureDeveloperCliPublicErrorMessages = {\n  notInstalled:\n    \"Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.\",\n  login:\n    \"Please run 'azd auth login' from a command prompt to authenticate before using this credential. For more information, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.\",\n  unknown: \"Unknown error while trying to retrieve the access token\",\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n};\n\n/**\n * Mockable reference to the Developer CLI credential cliCredentialFunctions\n * @internal\n */\nexport const developerCliCredentialInternals = {\n  /**\n   * Parses azd stderr JSON output to extract the error message.\n   * azd outputs JSON like: \\{\"type\":\"consoleMessage\",\"timestamp\":\"...\",\"data\":\\{\"message\":\"ERROR: ...\"\\}\\}\n   * If parsing succeeds and .data.message exists, returns the trimmed message.\n   * Otherwise, returns the raw stderr.\n   * @param stderr - The stderr output from azd command\n   * @returns The parsed error message or raw stderr\n   * @internal\n   */\n  parseAzdStderr(stderr: string): string {\n    try {\n      const parsed = JSON.parse(stderr);\n      const message = parsed?.data?.message;\n      if (typeof message === \"string\" && message.trim().length > 0) {\n        return message.trim();\n      }\n    } catch {\n      // If JSON parsing fails, fall through to return raw stderr\n    }\n    return stderr;\n  },\n\n  /**\n   * @internal\n   */\n  getSafeWorkingDir(): string {\n    if (process.platform === \"win32\") {\n      let systemRoot = process.env.SystemRoot || process.env[\"SYSTEMROOT\"];\n      if (!systemRoot) {\n        logger.getToken.warning(\n          \"The SystemRoot environment variable is not set. This may cause issues when using the Azure Developer CLI credential.\",\n        );\n\n        systemRoot = \"C:\\\\Windows\";\n      }\n\n      return systemRoot;\n    } else {\n      return \"/bin\";\n    }\n  },\n\n  /**\n   * Gets the access token from Azure Developer CLI\n   * @param scopes - The scopes to use when getting the token\n   * @internal\n   */\n  async getAzdAccessToken(\n    scopes: string[],\n    tenantId?: string,\n    timeout?: number,\n    claims?: string,\n  ): Promise<{ stdout: string; stderr: string; error: Error | null }> {\n    let tenantSection: string[] = [];\n    if (tenantId) {\n      tenantSection = [\"--tenant-id\", tenantId];\n    }\n\n    let claimsSections: string[] = [];\n    if (claims) {\n      const encodedClaims = btoa(claims);\n      claimsSections = [\"--claims\", encodedClaims];\n    }\n    return new Promise((resolve, reject) => {\n      try {\n        const args = [\n          \"auth\",\n          \"token\",\n          \"--output\",\n          \"json\",\n          \"--no-prompt\",\n          ...scopes.reduce<string[]>(\n            (previous, current) => previous.concat(\"--scope\", current),\n            [],\n          ),\n          ...tenantSection,\n          ...claimsSections,\n        ];\n        const command = [\"azd\", ...args].join(\" \");\n        child_process.exec(\n          command,\n          {\n            cwd: developerCliCredentialInternals.getSafeWorkingDir(),\n            timeout,\n          },\n          (error, stdout, stderr) => {\n            resolve({ stdout, stderr, error });\n          },\n        );\n      } catch (err: any) {\n        reject(err);\n      }\n    });\n  },\n};\n\n/**\n * Azure Developer CLI is a command-line interface tool that allows developers to create, manage, and deploy\n * resources in Azure. It's built on top of the Azure CLI and provides additional functionality specific\n * to Azure developers. It allows users to authenticate as a user and/or a service principal against\n * <a href=\"https://learn.microsoft.com/entra/fundamentals/\">Microsoft Entra ID</a>. The\n * AzureDeveloperCliCredential authenticates in a development environment and acquires a token on behalf of\n * the logged-in user or service principal in the Azure Developer CLI. It acts as the Azure Developer CLI logged in user or\n * service principal and executes an Azure CLI command underneath to authenticate the application against\n * Microsoft Entra ID.\n *\n * <h2> Configure AzureDeveloperCliCredential </h2>\n *\n * To use this credential, the developer needs to authenticate locally in Azure Developer CLI using one of the\n * commands below:\n *\n * <ol>\n *     <li>Run \"azd auth login\" in Azure Developer CLI to authenticate interactively as a user.</li>\n *     <li>Run \"azd auth login --client-id clientID --client-secret clientSecret\n *     --tenant-id tenantID\" to authenticate as a service principal.</li>\n * </ol>\n *\n * You may need to repeat this process after a certain time period, depending on the refresh token validity in your\n * organization. Generally, the refresh token validity period is a few weeks to a few months.\n * AzureDeveloperCliCredential will prompt you to sign in again.\n */\nexport class AzureDeveloperCliCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n\n  /**\n   * Creates an instance of the {@link AzureDeveloperCliCredential}.\n   *\n   * To use this credential, ensure that you have already logged\n   * in via the 'azd' tool using the command \"azd auth login\" from the commandline.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzureDeveloperCliCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    const tenantId = processMultiTenantRequest(\n      this.tenantId,\n      options,\n      this.additionallyAllowedTenantIds,\n    );\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    let scopeList: string[];\n    if (typeof scopes === \"string\") {\n      scopeList = [scopes];\n    } else {\n      scopeList = scopes;\n    }\n    logger.getToken.info(`Using the scopes ${scopes}`);\n\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      try {\n        scopeList.forEach((scope) => {\n          ensureValidScopeForDevTimeCreds(scope, logger);\n        });\n        const obj = await developerCliCredentialInternals.getAzdAccessToken(\n          scopeList,\n          tenantId,\n          this.timeout,\n          options.claims,\n        );\n        const isMFARequiredError =\n          obj.stderr?.match(\"must use multi-factor authentication\") ||\n          obj.stderr?.match(\"reauthentication required\");\n        const isNotLoggedInError =\n          obj.stderr?.match(\"not logged in, run `azd login` to login\") ||\n          obj.stderr?.match(\"not logged in, run `azd auth login` to login\");\n        const isNotInstallError =\n          obj.stderr?.match(\"azd:(.*)not found\") ||\n          obj.stderr?.startsWith(\"'azd' is not recognized\");\n        if (isNotInstallError || (obj.error && (obj.error as any).code === \"ENOENT\")) {\n          const error = new CredentialUnavailableError(\n            azureDeveloperCliPublicErrorMessages.notInstalled,\n          );\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n\n        if (isNotLoggedInError) {\n          const error = new CredentialUnavailableError(azureDeveloperCliPublicErrorMessages.login);\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n        if (isMFARequiredError) {\n          const scope = scopeList\n            .reduce<string[]>((previous, current) => previous.concat(\"--scope\", current), [])\n            .join(\" \");\n          const loginCmd = `azd auth login ${scope}`;\n          const error = new CredentialUnavailableError(\n            `${azureDeveloperCliPublicErrorMessages.claim} ${loginCmd}`,\n          );\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n\n        try {\n          const resp: { token: string; expiresOn: string } = JSON.parse(obj.stdout);\n          logger.getToken.info(formatSuccess(scopes));\n          return {\n            token: resp.token,\n            expiresOnTimestamp: new Date(resp.expiresOn).getTime(),\n            tokenType: \"Bearer\",\n          } as AccessToken;\n        } catch (e: any) {\n          if (obj.stderr) {\n            const errorMessage = developerCliCredentialInternals.parseAzdStderr(obj.stderr);\n            throw new CredentialUnavailableError(errorMessage);\n          }\n          throw e;\n        }\n      } catch (err: any) {\n        const error =\n          err.name === \"CredentialUnavailableError\"\n            ? err\n            : new CredentialUnavailableError(\n                (err as Error).message || azureDeveloperCliPublicErrorMessages.unknown,\n              );\n        logger.getToken.info(formatError(scopes, error));\n        throw error;\n      }\n    });\n  }\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/azureDeveloperCliCredential.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport type { AzureDeveloperCliCredentialOptions } from \"./azureDeveloperCliCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport child_process from \"child_process\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { ensureValidScopeForDevTimeCreds } from \"../util/scopeUtils.js\";\nimport { uint8ArrayToString, stringToUint8Array } from \"@azure/core-util\";\n\nconst logger = credentialLogger(\"AzureDeveloperCliCredential\");\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const azureDeveloperCliPublicErrorMessages = {\n  notInstalled:\n    \"Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.\",\n  login:\n    \"Please run 'azd auth login' from a command prompt to authenticate before using this credential. For more information, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.\",\n  unknown: \"Unknown error while trying to retrieve the access token\",\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n};\n\n/**\n * Mockable reference to the Developer CLI credential cliCredentialFunctions\n * @internal\n */\nexport const developerCliCredentialInternals = {\n  /**\n   * Parses azd stderr JSON output to extract a human-readable error message.\n   *\n   * Three formats are supported across azd versions:\n   * - pre-v1.23.7: `{\"type\":\"consoleMessage\",\"data\":{\"message\":\"...\"}}`\n   * - v1.23.7 - v1.23.15: an empty `consoleMessage` line followed by `{\"error\":\"...\",\"message\":\"...\",\"suggestion\":\"...\"}`\n   * - v1.24.0+: `{\"error\":\"...\",\"message\":\"...\",\"suggestion\":\"...\"}`\n   *\n   * The structured `error` field is preferred. If absent, falls back to the\n   * first non-empty `data.message` from a legacy `consoleMessage` line. If\n   * neither is found, the raw stderr is returned unchanged so plain-text and\n   * malformed output continue to surface to callers.\n   *\n   * @param stderr - The stderr output from azd command\n   * @returns The parsed error message or raw stderr\n   * @internal\n   */\n  parseAzdStderr(stderr: string): string {\n    if (!stderr?.trim()) {\n      return stderr;\n    }\n\n    let fallback: string | undefined;\n\n    for (const rawLine of stderr.split(\"\\n\")) {\n      const line = rawLine.trim();\n      if (!line.startsWith(\"{\")) {\n        continue;\n      }\n\n      let parsed: any;\n      try {\n        parsed = JSON.parse(line);\n      } catch {\n        // Not valid JSON on this line; continue.\n        continue;\n      }\n\n      if (typeof parsed?.error === \"string\" && parsed.error.trim()) {\n        return parsed.error.trim();\n      }\n\n      if (fallback === undefined) {\n        const message = parsed?.data?.message;\n        if (typeof message === \"string\" && message.trim()) {\n          fallback = message.trim();\n        }\n      }\n    }\n\n    return fallback ?? stderr;\n  },\n\n  /**\n   * @internal\n   */\n  getSafeWorkingDir(): string {\n    if (process.platform === \"win32\") {\n      let systemRoot = process.env.SystemRoot || process.env[\"SYSTEMROOT\"];\n      if (!systemRoot) {\n        logger.getToken.warning(\n          \"The SystemRoot environment variable is not set. This may cause issues when using the Azure Developer CLI credential.\",\n        );\n\n        systemRoot = \"C:\\\\Windows\";\n      }\n\n      return systemRoot;\n    } else {\n      return \"/bin\";\n    }\n  },\n\n  /**\n   * Gets the access token from Azure Developer CLI\n   * @param scopes - The scopes to use when getting the token\n   * @internal\n   */\n  async getAzdAccessToken(\n    scopes: string[],\n    tenantId?: string,\n    timeout?: number,\n    claims?: string,\n  ): Promise<{ stdout: string; stderr: string; error: Error | null }> {\n    let tenantSection: string[] = [];\n    if (tenantId) {\n      tenantSection = [\"--tenant-id\", tenantId];\n    }\n\n    let claimsSections: string[] = [];\n    if (claims) {\n      const encodedClaims = uint8ArrayToString(stringToUint8Array(claims, \"utf-8\"), \"base64\");\n      claimsSections = [\"--claims\", encodedClaims];\n    }\n    return new Promise((resolve, reject) => {\n      try {\n        const args = [\n          \"auth\",\n          \"token\",\n          \"--output\",\n          \"json\",\n          \"--no-prompt\",\n          ...scopes.reduce<string[]>(\n            (previous, current) => previous.concat(\"--scope\", current),\n            [],\n          ),\n          ...tenantSection,\n          ...claimsSections,\n        ];\n        const command = [\"azd\", ...args].join(\" \");\n        child_process.exec(\n          command,\n          {\n            cwd: developerCliCredentialInternals.getSafeWorkingDir(),\n            timeout,\n          },\n          (error, stdout, stderr) => {\n            resolve({ stdout, stderr, error });\n          },\n        );\n      } catch (err: any) {\n        reject(err);\n      }\n    });\n  },\n};\n\n/**\n * Azure Developer CLI is a command-line interface tool that allows developers to create, manage, and deploy\n * resources in Azure. It's built on top of the Azure CLI and provides additional functionality specific\n * to Azure developers. It allows users to authenticate as a user and/or a service principal against\n * <a href=\"https://learn.microsoft.com/entra/fundamentals/\">Microsoft Entra ID</a>. The\n * AzureDeveloperCliCredential authenticates in a development environment and acquires a token on behalf of\n * the logged-in user or service principal in the Azure Developer CLI. It acts as the Azure Developer CLI logged in user or\n * service principal and executes an Azure CLI command underneath to authenticate the application against\n * Microsoft Entra ID.\n *\n * <h2> Configure AzureDeveloperCliCredential </h2>\n *\n * To use this credential, the developer needs to authenticate locally in Azure Developer CLI using one of the\n * commands below:\n *\n * <ol>\n *     <li>Run \"azd auth login\" in Azure Developer CLI to authenticate interactively as a user.</li>\n *     <li>Run \"azd auth login --client-id clientID --client-secret clientSecret\n *     --tenant-id tenantID\" to authenticate as a service principal.</li>\n * </ol>\n *\n * You may need to repeat this process after a certain time period, depending on the refresh token validity in your\n * organization. Generally, the refresh token validity period is a few weeks to a few months.\n * AzureDeveloperCliCredential will prompt you to sign in again.\n */\nexport class AzureDeveloperCliCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n\n  /**\n   * Creates an instance of the {@link AzureDeveloperCliCredential}.\n   *\n   * To use this credential, ensure that you have already logged\n   * in via the 'azd' tool using the command \"azd auth login\" from the commandline.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzureDeveloperCliCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    const tenantId = processMultiTenantRequest(\n      this.tenantId,\n      options,\n      this.additionallyAllowedTenantIds,\n    );\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    let scopeList: string[];\n    if (typeof scopes === \"string\") {\n      scopeList = [scopes];\n    } else {\n      scopeList = scopes;\n    }\n    logger.getToken.info(`Using the scopes ${scopes}`);\n\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      try {\n        scopeList.forEach((scope) => {\n          ensureValidScopeForDevTimeCreds(scope, logger);\n        });\n        const obj = await developerCliCredentialInternals.getAzdAccessToken(\n          scopeList,\n          tenantId,\n          this.timeout,\n          options.claims,\n        );\n        const isMFARequiredError =\n          obj.stderr?.match(\"must use multi-factor authentication\") ||\n          obj.stderr?.match(\"reauthentication required\");\n        const isNotLoggedInError =\n          obj.stderr?.match(\"not logged in, run `azd login` to login\") ||\n          obj.stderr?.match(\"not logged in, run `azd auth login` to login\");\n        const isNotInstallError =\n          obj.stderr?.match(\"azd:(.*)not found\") ||\n          obj.stderr?.startsWith(\"'azd' is not recognized\");\n        if (isNotInstallError || (obj.error && (obj.error as any).code === \"ENOENT\")) {\n          const error = new CredentialUnavailableError(\n            azureDeveloperCliPublicErrorMessages.notInstalled,\n          );\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n\n        if (isNotLoggedInError) {\n          const error = new CredentialUnavailableError(azureDeveloperCliPublicErrorMessages.login);\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n        if (isMFARequiredError) {\n          const scope = scopeList\n            .reduce<string[]>((previous, current) => previous.concat(\"--scope\", current), [])\n            .join(\" \");\n          const loginCmd = `azd auth login ${scope}`;\n          const error = new CredentialUnavailableError(\n            `${azureDeveloperCliPublicErrorMessages.claim} ${loginCmd}`,\n          );\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n\n        try {\n          const resp: { token: string; expiresOn: string } = JSON.parse(obj.stdout);\n          logger.getToken.info(formatSuccess(scopes));\n          return {\n            token: resp.token,\n            expiresOnTimestamp: new Date(resp.expiresOn).getTime(),\n            tokenType: \"Bearer\",\n          } as AccessToken;\n        } catch (e: any) {\n          if (obj.stderr) {\n            const errorMessage = developerCliCredentialInternals.parseAzdStderr(obj.stderr);\n            throw new CredentialUnavailableError(errorMessage);\n          }\n          throw e;\n        }\n      } catch (err: any) {\n        const error =\n          err.name === \"CredentialUnavailableError\"\n            ? err\n            : new CredentialUnavailableError(\n                (err as Error).message || azureDeveloperCliPublicErrorMessages.unknown,\n              );\n        logger.getToken.info(formatError(scopes, error));\n        throw error;\n      }\n    });\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,qBAA6D;AAE7D,oBAA2C;AAC3C,2BAA0B;AAC1B,2BAIO;AACP,qBAA8B;AAC9B,wBAAgD;AAChD,uBAAuD;AAEvD,MAAM,aAAS,iCAAiB,6BAA6B;AAMtD,MAAM,uCAAuC;AAAA,EAClD,cACE;AAAA,EACF,OACE;AAAA,EACF,SAAS;AAAA,EACT,OACE;AACJ;AAMO,MAAM,kCAAkC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB7C,eAAe,QAAwB;AACrC,QAAI,CAAC,QAAQ,KAAK,GAAG;AACnB,aAAO;AAAA,IACT;AAEA,QAAI;AAEJ,eAAW,WAAW,OAAO,MAAM,IAAI,GAAG;AACxC,YAAM,OAAO,QAAQ,KAAK;AAC1B,UAAI,CAAC,KAAK,WAAW,GAAG,GAAG;AACzB;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,IAAI;AAAA,MAC1B,QAAQ;AAEN;AAAA,MACF;AAEA,UAAI,OAAO,QAAQ,UAAU,YAAY,OAAO,MAAM,KAAK,GAAG;AAC5D,eAAO,OAAO,MAAM,KAAK;AAAA,MAC3B;AAEA,UAAI,aAAa,QAAW;AAC1B,cAAM,UAAU,QAAQ,MAAM;AAC9B,YAAI,OAAO,YAAY,YAAY,QAAQ,KAAK,GAAG;AACjD,qBAAW,QAAQ,KAAK;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAEA,WAAO,YAAY;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,oBAA4B;AAC1B,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI,aAAa,QAAQ,IAAI,cAAc,QAAQ,IAAI,YAAY;AACnE,UAAI,CAAC,YAAY;AACf,eAAO,SAAS;AAAA,UACd;AAAA,QACF;AAEA,qBAAa;AAAA,MACf;AAEA,aAAO;AAAA,IACT,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBACJ,QACA,UACA,SACA,QACkE;AAClE,QAAI,gBAA0B,CAAC;AAC/B,QAAI,UAAU;AACZ,sBAAgB,CAAC,eAAe,QAAQ;AAAA,IAC1C;AAEA,QAAI,iBAA2B,CAAC;AAChC,QAAI,QAAQ;AACV,YAAM,oBAAgB,yCAAmB,qCAAmB,QAAQ,OAAO,GAAG,QAAQ;AACtF,uBAAiB,CAAC,YAAY,aAAa;AAAA,IAC7C;AACA,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI;AACF,cAAM,OAAO;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,GAAG,OAAO;AAAA,YACR,CAAC,UAAU,YAAY,SAAS,OAAO,WAAW,OAAO;AAAA,YACzD,CAAC;AAAA,UACH;AAAA,UACA,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AACA,cAAM,UAAU,CAAC,OAAO,GAAG,IAAI,EAAE,KAAK,GAAG;AACzC,6BAAAA,QAAc;AAAA,UACZ;AAAA,UACA;AAAA,YACE,KAAK,gCAAgC,kBAAkB;AAAA,YACvD;AAAA,UACF;AAAA,UACA,CAAC,OAAO,QAAQ,WAAW;AACzB,oBAAQ,EAAE,QAAQ,QAAQ,MAAM,CAAC;AAAA,UACnC;AAAA,QACF;AAAA,MACF,SAAS,KAAU;AACjB,eAAO,GAAG;AAAA,MACZ;AAAA,IACF,CAAC;AAAA,EACH;AACF;AA2BO,MAAM,4BAAuD;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUR,YAAY,SAA8C;AACxD,QAAI,SAAS,UAAU;AACrB,8CAAc,QAAQ,SAAS,QAAQ;AACvC,WAAK,WAAW,SAAS;AAAA,IAC3B;AACA,SAAK,mCAA+B;AAAA,MAClC,SAAS;AAAA,IACX;AACA,SAAK,UAAU,SAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,SACX,QACA,UAA2B,CAAC,GACN;AACtB,UAAM,eAAW;AAAA,MACf,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,IACP;AACA,QAAI,UAAU;AACZ,8CAAc,QAAQ,QAAQ;AAAA,IAChC;AACA,QAAI;AACJ,QAAI,OAAO,WAAW,UAAU;AAC9B,kBAAY,CAAC,MAAM;AAAA,IACrB,OAAO;AACL,kBAAY;AAAA,IACd;AACA,WAAO,SAAS,KAAK,oBAAoB,MAAM,EAAE;AAEjD,WAAO,6BAAc,SAAS,GAAG,KAAK,YAAY,IAAI,aAAa,SAAS,YAAY;AACtF,UAAI;AACF,kBAAU,QAAQ,CAAC,UAAU;AAC3B,iEAAgC,OAAO,MAAM;AAAA,QAC/C,CAAC;AACD,cAAM,MAAM,MAAM,gCAAgC;AAAA,UAChD;AAAA,UACA;AAAA,UACA,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AACA,cAAM,qBACJ,IAAI,QAAQ,MAAM,sCAAsC,KACxD,IAAI,QAAQ,MAAM,2BAA2B;AAC/C,cAAM,qBACJ,IAAI,QAAQ,MAAM,yCAAyC,KAC3D,IAAI,QAAQ,MAAM,8CAA8C;AAClE,cAAM,oBACJ,IAAI,QAAQ,MAAM,mBAAmB,KACrC,IAAI,QAAQ,WAAW,yBAAyB;AAClD,YAAI,qBAAsB,IAAI,SAAU,IAAI,MAAc,SAAS,UAAW;AAC5E,gBAAM,QAAQ,IAAI;AAAA,YAChB,qCAAqC;AAAA,UACvC;AACA,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AAEA,YAAI,oBAAoB;AACtB,gBAAM,QAAQ,IAAI,yCAA2B,qCAAqC,KAAK;AACvF,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AACA,YAAI,oBAAoB;AACtB,gBAAM,QAAQ,UACX,OAAiB,CAAC,UAAU,YAAY,SAAS,OAAO,WAAW,OAAO,GAAG,CAAC,CAAC,EAC/E,KAAK,GAAG;AACX,gBAAM,WAAW,kBAAkB,KAAK;AACxC,gBAAM,QAAQ,IAAI;AAAA,YAChB,GAAG,qCAAqC,KAAK,IAAI,QAAQ;AAAA,UAC3D;AACA,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AAEA,YAAI;AACF,gBAAM,OAA6C,KAAK,MAAM,IAAI,MAAM;AACxE,iBAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC1C,iBAAO;AAAA,YACL,OAAO,KAAK;AAAA,YACZ,oBAAoB,IAAI,KAAK,KAAK,SAAS,EAAE,QAAQ;AAAA,YACrD,WAAW;AAAA,UACb;AAAA,QACF,SAAS,GAAQ;AACf,cAAI,IAAI,QAAQ;AACd,kBAAM,eAAe,gCAAgC,eAAe,IAAI,MAAM;AAC9E,kBAAM,IAAI,yCAA2B,YAAY;AAAA,UACnD;AACA,gBAAM;AAAA,QACR;AAAA,MACF,SAAS,KAAU;AACjB,cAAM,QACJ,IAAI,SAAS,+BACT,MACA,IAAI;AAAA,UACD,IAAc,WAAW,qCAAqC;AAAA,QACjE;AACN,eAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AACF;",
+  "names": ["child_process"]
+}

package/dist/commonjs/credentials/azureDeveloperCliCredentialOptions.js

@@ -1,5 +1,16 @@
-"use strict";
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=azureDeveloperCliCredentialOptions.js.map
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var azureDeveloperCliCredentialOptions_exports = {};
+module.exports = __toCommonJS(azureDeveloperCliCredentialOptions_exports);
+//# sourceMappingURL=azureDeveloperCliCredentialOptions.js.map

package/dist/commonjs/credentials/azureDeveloperCliCredentialOptions.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"azureDeveloperCliCredentialOptions.js","sourceRoot":"","sources":["../../../src/credentials/azureDeveloperCliCredentialOptions.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { MultiTenantTokenCredentialOptions } from \"./multiTenantTokenCredentialOptions.js\";\n\n/**\n * Options for the {@link AzureDeveloperCliCredential}\n */\nexport interface AzureDeveloperCliCredentialOptions extends MultiTenantTokenCredentialOptions {\n  /**\n   * Allows specifying a tenant ID\n   */\n  tenantId?: string;\n  /**\n   * Process timeout configurable for making token requests, provided in milliseconds\n   */\n  processTimeoutInMs?: number;\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/azureDeveloperCliCredentialOptions.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { MultiTenantTokenCredentialOptions } from \"./multiTenantTokenCredentialOptions.js\";\n\n/**\n * Options for the {@link AzureDeveloperCliCredential}\n */\nexport interface AzureDeveloperCliCredentialOptions extends MultiTenantTokenCredentialOptions {\n  /**\n   * Allows specifying a tenant ID\n   */\n  tenantId?: string;\n  /**\n   * Process timeout configurable for making token requests, provided in milliseconds\n   */\n  processTimeoutInMs?: number;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;AAAA;AAAA;",
+  "names": []
+}