@azure/identity 4.14.0-beta.3 → 4.14.0-beta.5

package/dist/commonjs/client/identityClient.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/client/identityClient.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { INetworkModule, NetworkRequestOptions, NetworkResponse } from \"@azure/msal-node\";\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport { ServiceClient } from \"@azure/core-client\";\nimport type { PipelineRequest, PipelineResponse } from \"@azure/core-rest-pipeline\";\nimport { createHttpHeaders, createPipelineRequest } from \"@azure/core-rest-pipeline\";\nimport type { AbortSignalLike } from \"@azure/abort-controller\";\nimport { AuthenticationError, AuthenticationErrorName } from \"../errors.js\";\nimport { getIdentityTokenEndpointSuffix } from \"../util/identityTokenEndpoint.js\";\nimport { SDK_VERSION } from \"../constants.js\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { logger } from \"../util/logging.js\";\nimport type { TokenCredentialOptions } from \"../tokenCredentialOptions.js\";\nimport type { TokenResponseParsedBody } from \"../credentials/managedIdentityCredential/utils.js\";\nimport {\n  parseExpirationTimestamp,\n  parseRefreshTimestamp,\n} from \"../credentials/managedIdentityCredential/utils.js\";\nimport { getAuthorityHost } from \"../util/authorityHost.js\";\n\nconst noCorrelationId = \"noCorrelationId\";\nconst HttpStatus = {\n  CLIENT_ERROR_RANGE_START: 400,\n  CLIENT_ERROR_RANGE_END: 499,\n  SERVER_ERROR_RANGE_START: 500,\n  SERVER_ERROR_RANGE_END: 599,\n};\n\n/**\n * An internal type used to communicate details of a token request's\n * response that should not be sent back as part of the access token.\n */\nexport interface TokenResponse {\n  /**\n   * The AccessToken to be returned from getToken.\n   */\n  accessToken: AccessToken;\n  /**\n   * The refresh token if the 'offline_access' scope was used.\n   */\n  refreshToken?: string;\n}\n\n/**\n * The network module used by the Identity credentials.\n *\n * It allows for credentials to abort any pending request independently of the MSAL flow,\n * by calling to the `abortRequests()` method.\n *\n */\nexport class IdentityClient extends ServiceClient implements INetworkModule {\n  public authorityHost: string;\n  private allowLoggingAccountIdentifiers?: boolean;\n  private abortControllers: Map<string, AbortController[] | undefined>;\n  private allowInsecureConnection: boolean = false;\n  // used for WorkloadIdentity\n  private tokenCredentialOptions: TokenCredentialOptions;\n\n  constructor(options?: TokenCredentialOptions) {\n    const packageDetails = `azsdk-js-identity/${SDK_VERSION}`;\n    const userAgentPrefix = options?.userAgentOptions?.userAgentPrefix\n      ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}`\n      : `${packageDetails}`;\n\n    const baseUri = getAuthorityHost(options);\n    if (!baseUri.startsWith(\"https:\")) {\n      throw new Error(\"The authorityHost address must use the 'https' protocol.\");\n    }\n\n    super({\n      requestContentType: \"application/json; charset=utf-8\",\n      retryOptions: {\n        maxRetries: 3,\n      },\n      ...options,\n      userAgentOptions: {\n        userAgentPrefix,\n      },\n      baseUri,\n    });\n\n    this.authorityHost = baseUri;\n    this.abortControllers = new Map();\n    this.allowLoggingAccountIdentifiers = options?.loggingOptions?.allowLoggingAccountIdentifiers;\n    // used for WorkloadIdentity\n    this.tokenCredentialOptions = { ...options };\n\n    // used for ManagedIdentity\n    if (options?.allowInsecureConnection) {\n      this.allowInsecureConnection = options.allowInsecureConnection;\n    }\n  }\n\n  async sendTokenRequest(request: PipelineRequest): Promise<TokenResponse | null> {\n    logger.info(`IdentityClient: sending token request to [${request.url}]`);\n    const response = await this.sendRequest(request);\n    if (response.bodyAsText && (response.status === 200 || response.status === 201)) {\n      const parsedBody: TokenResponseParsedBody = JSON.parse(response.bodyAsText);\n\n      if (!parsedBody.access_token) {\n        return null;\n      }\n\n      this.logIdentifiers(response);\n\n      const token = {\n        accessToken: {\n          token: parsedBody.access_token,\n          expiresOnTimestamp: parseExpirationTimestamp(parsedBody),\n          refreshAfterTimestamp: parseRefreshTimestamp(parsedBody),\n          tokenType: \"Bearer\",\n        } as AccessToken,\n        refreshToken: parsedBody.refresh_token,\n      };\n\n      logger.info(\n        `IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`,\n      );\n      return token;\n    } else {\n      const error = new AuthenticationError(response.status, response.bodyAsText);\n      logger.warning(\n        `IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`,\n      );\n      throw error;\n    }\n  }\n\n  async refreshAccessToken(\n    tenantId: string,\n    clientId: string,\n    scopes: string,\n    refreshToken: string | undefined,\n    clientSecret: string | undefined,\n    options: GetTokenOptions = {},\n  ): Promise<TokenResponse | null> {\n    if (refreshToken === undefined) {\n      return null;\n    }\n    logger.info(\n      `IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`,\n    );\n\n    const refreshParams = {\n      grant_type: \"refresh_token\",\n      client_id: clientId,\n      refresh_token: refreshToken,\n      scope: scopes,\n    };\n\n    if (clientSecret !== undefined) {\n      (refreshParams as any).client_secret = clientSecret;\n    }\n\n    const query = new URLSearchParams(refreshParams);\n\n    return tracingClient.withSpan(\n      \"IdentityClient.refreshAccessToken\",\n      options,\n      async (updatedOptions) => {\n        try {\n          const urlSuffix = getIdentityTokenEndpointSuffix(tenantId);\n          const request = createPipelineRequest({\n            url: `${this.authorityHost}/${tenantId}/${urlSuffix}`,\n            method: \"POST\",\n            body: query.toString(),\n            abortSignal: options.abortSignal,\n            headers: createHttpHeaders({\n              Accept: \"application/json\",\n              \"Content-Type\": \"application/x-www-form-urlencoded\",\n            }),\n            tracingOptions: updatedOptions.tracingOptions,\n          });\n\n          const response = await this.sendTokenRequest(request);\n          logger.info(`IdentityClient: refreshed token for client ID: ${clientId}`);\n          return response;\n        } catch (err: any) {\n          if (\n            err.name === AuthenticationErrorName &&\n            err.errorResponse.error === \"interaction_required\"\n          ) {\n            // It's likely that the refresh token has expired, so\n            // return null so that the credential implementation will\n            // initiate the authentication flow again.\n            logger.info(`IdentityClient: interaction required for client ID: ${clientId}`);\n            return null;\n          } else {\n            logger.warning(\n              `IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`,\n            );\n            throw err;\n          }\n        }\n      },\n    );\n  }\n\n  // Here is a custom layer that allows us to abort requests that go through MSAL,\n  // since MSAL doesn't allow us to pass options all the way through.\n\n  generateAbortSignal(correlationId: string): AbortSignalLike {\n    const controller = new AbortController();\n    const controllers = this.abortControllers.get(correlationId) || [];\n    controllers.push(controller);\n    this.abortControllers.set(correlationId, controllers);\n    const existingOnAbort = controller.signal.onabort;\n    controller.signal.onabort = (...params) => {\n      this.abortControllers.set(correlationId, undefined);\n      if (existingOnAbort) {\n        existingOnAbort.apply(controller.signal, params);\n      }\n    };\n    return controller.signal;\n  }\n\n  abortRequests(correlationId?: string): void {\n    const key = correlationId || noCorrelationId;\n    const controllers = [\n      ...(this.abortControllers.get(key) || []),\n      // MSAL passes no correlation ID to the get requests...\n      ...(this.abortControllers.get(noCorrelationId) || []),\n    ];\n    if (!controllers.length) {\n      return;\n    }\n    for (const controller of controllers) {\n      controller.abort();\n    }\n    this.abortControllers.set(key, undefined);\n  }\n\n  getCorrelationId(options?: NetworkRequestOptions): string {\n    const parameter = options?.body\n      ?.split(\"&\")\n      .map((part) => part.split(\"=\"))\n      .find(([key]) => key === \"client-request-id\");\n    return parameter && parameter.length ? parameter[1] || noCorrelationId : noCorrelationId;\n  }\n\n  // The MSAL network module methods follow\n\n  async sendGetRequestAsync<T>(\n    url: string,\n    options?: NetworkRequestOptions,\n  ): Promise<NetworkResponse<T>> {\n    const request = createPipelineRequest({\n      url,\n      method: \"GET\",\n      body: options?.body,\n      allowInsecureConnection: this.allowInsecureConnection,\n      headers: createHttpHeaders(options?.headers),\n      abortSignal: this.generateAbortSignal(noCorrelationId),\n    });\n\n    const response = await this.sendRequest(request);\n\n    this.logIdentifiers(response);\n\n    return {\n      body: this.parseResponseBody(response) as T,\n      headers: response.headers.toJSON(),\n      status: response.status,\n    };\n  }\n\n  async sendPostRequestAsync<T>(\n    url: string,\n    options?: NetworkRequestOptions,\n  ): Promise<NetworkResponse<T>> {\n    const request = createPipelineRequest({\n      url,\n      method: \"POST\",\n      body: options?.body,\n      headers: createHttpHeaders(options?.headers),\n      allowInsecureConnection: this.allowInsecureConnection,\n      // MSAL doesn't send the correlation ID on the get requests.\n      abortSignal: this.generateAbortSignal(this.getCorrelationId(options)),\n    });\n\n    const response = await this.sendRequest(request);\n\n    this.logIdentifiers(response);\n\n    return {\n      body: this.parseResponseBody(response) as T,\n      headers: response.headers.toJSON(),\n      status: response.status,\n    };\n  }\n\n  /**\n   *\n   * @internal\n   */\n  getTokenCredentialOptions(): TokenCredentialOptions {\n    return this.tokenCredentialOptions;\n  }\n  /**\n   * If allowLoggingAccountIdentifiers was set on the constructor options\n   * we try to log the account identifiers by parsing the received access token.\n   *\n   * The account identifiers we try to log are:\n   * - `appid`: The application or Client Identifier.\n   * - `upn`: User Principal Name.\n   *   - It might not be available in some authentication scenarios.\n   *   - If it's not available, we put a placeholder: \"No User Principal Name available\".\n   * - `tid`: Tenant Identifier.\n   * - `oid`: Object Identifier of the authenticated user.\n   */\n  private logIdentifiers(response: PipelineResponse): void {\n    if (!this.allowLoggingAccountIdentifiers || !response.bodyAsText) {\n      return;\n    }\n    const unavailableUpn = \"No User Principal Name available\";\n    try {\n      const parsed = (response as any).parsedBody || JSON.parse(response.bodyAsText);\n      const accessToken = parsed.access_token;\n      if (!accessToken) {\n        // Without an access token allowLoggingAccountIdentifiers isn't useful.\n        return;\n      }\n      const base64Metadata = accessToken.split(\".\")[1];\n      const { appid, upn, tid, oid } = JSON.parse(\n        Buffer.from(base64Metadata, \"base64\").toString(\"utf8\"),\n      );\n\n      logger.info(\n        `[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${\n          upn || unavailableUpn\n        }. Object ID (user): ${oid}`,\n      );\n    } catch (e: any) {\n      logger.warning(\n        \"allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:\",\n        e.message,\n      );\n    }\n  }\n\n  /**\n   * Parses the response body if possible. Add error properties if parsing fails.\n   * This follows MSAL INetworkModule behavior so the response is in expected format.\n   */\n  private parseResponseBody(response: PipelineResponse) {\n    let parsedBody: {};\n    try {\n      parsedBody = JSON.parse(response.bodyAsText || \"\");\n    } catch (error) {\n      logger.info(`IdentityClient: Could not parse response body: ${error}`);\n      let errorType;\n      let errorDescriptionHelper;\n      /**\n       * Determine error type based on status code ranges following MSAL patterns:\n       * Client error responses (400 \u2013 499)\n       * Server error responses (500 \u2013 599)\n       */\n      if (\n        response.status >= HttpStatus.CLIENT_ERROR_RANGE_START &&\n        response.status <= HttpStatus.CLIENT_ERROR_RANGE_END\n      ) {\n        errorType = \"client_error\";\n        errorDescriptionHelper = \"A client\";\n      } else if (\n        response.status >= HttpStatus.SERVER_ERROR_RANGE_START &&\n        response.status <= HttpStatus.SERVER_ERROR_RANGE_END\n      ) {\n        errorType = \"server_error\";\n        errorDescriptionHelper = \"A server\";\n      } else {\n        errorType = \"unknown_error\";\n        errorDescriptionHelper = \"An unknown\";\n      }\n\n      const errorDescriptionLines = [\n        `${errorDescriptionHelper} error occured.`,\n        `Http status code: ${response.status}`,\n        `Http status message: ${response.bodyAsText || \"Unknown\"}`,\n        `Headers: ${JSON.stringify(response.headers)}`,\n      ];\n      parsedBody = {\n        error: errorType,\n        error_description: errorDescriptionLines.join(\"\\n\"),\n      };\n    }\n    return parsedBody;\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,yBAA8B;AAE9B,gCAAyD;AAEzD,oBAA6D;AAC7D,mCAA+C;AAC/C,uBAA4B;AAC5B,qBAA8B;AAC9B,qBAAuB;AAGvB,mBAGO;AACP,2BAAiC;AAEjC,MAAM,kBAAkB;AACxB,MAAM,aAAa;AAAA,EACjB,0BAA0B;AAAA,EAC1B,wBAAwB;AAAA,EACxB,0BAA0B;AAAA,EAC1B,wBAAwB;AAC1B;AAwBO,MAAM,uBAAuB,iCAAwC;AAAA,EACnE;AAAA,EACC;AAAA,EACA;AAAA,EACA,0BAAmC;AAAA;AAAA,EAEnC;AAAA,EAER,YAAY,SAAkC;AAC5C,UAAM,iBAAiB,qBAAqB,4BAAW;AACvD,UAAM,kBAAkB,SAAS,kBAAkB,kBAC/C,GAAG,QAAQ,iBAAiB,eAAe,IAAI,cAAc,KAC7D,GAAG,cAAc;AAErB,UAAM,cAAU,uCAAiB,OAAO;AACxC,QAAI,CAAC,QAAQ,WAAW,QAAQ,GAAG;AACjC,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAEA,UAAM;AAAA,MACJ,oBAAoB;AAAA,MACpB,cAAc;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,MACA,GAAG;AAAA,MACH,kBAAkB;AAAA,QAChB;AAAA,MACF;AAAA,MACA;AAAA,IACF,CAAC;AAED,SAAK,gBAAgB;AACrB,SAAK,mBAAmB,oBAAI,IAAI;AAChC,SAAK,iCAAiC,SAAS,gBAAgB;AAE/D,SAAK,yBAAyB,EAAE,GAAG,QAAQ;AAG3C,QAAI,SAAS,yBAAyB;AACpC,WAAK,0BAA0B,QAAQ;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAyD;AAC9E,0BAAO,KAAK,6CAA6C,QAAQ,GAAG,GAAG;AACvE,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO;AAC/C,QAAI,SAAS,eAAe,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC/E,YAAM,aAAsC,KAAK,MAAM,SAAS,UAAU;AAE1E,UAAI,CAAC,WAAW,cAAc;AAC5B,eAAO;AAAA,MACT;AAEA,WAAK,eAAe,QAAQ;AAE5B,YAAM,QAAQ;AAAA,QACZ,aAAa;AAAA,UACX,OAAO,WAAW;AAAA,UAClB,wBAAoB,uCAAyB,UAAU;AAAA,UACvD,2BAAuB,oCAAsB,UAAU;AAAA,UACvD,WAAW;AAAA,QACb;AAAA,QACA,cAAc,WAAW;AAAA,MAC3B;AAEA,4BAAO;AAAA,QACL,oBAAoB,QAAQ,GAAG,gCAAgC,MAAM,YAAY,kBAAkB;AAAA,MACrG;AACA,aAAO;AAAA,IACT,OAAO;AACL,YAAM,QAAQ,IAAI,kCAAoB,SAAS,QAAQ,SAAS,UAAU;AAC1E,4BAAO;AAAA,QACL,sDAAsD,SAAS,MAAM,KAAK,MAAM,cAAc,gBAAgB;AAAA,MAChH;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,UACA,UACA,QACA,cACA,cACA,UAA2B,CAAC,GACG;AAC/B,QAAI,iBAAiB,QAAW;AAC9B,aAAO;AAAA,IACT;AACA,0BAAO;AAAA,MACL,2DAA2D,QAAQ,aAAa,MAAM;AAAA,IACxF;AAEA,UAAM,gBAAgB;AAAA,MACpB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,MACf,OAAO;AAAA,IACT;AAEA,QAAI,iBAAiB,QAAW;AAC9B,MAAC,cAAsB,gBAAgB;AAAA,IACzC;AAEA,UAAM,QAAQ,IAAI,gBAAgB,aAAa;AAE/C,WAAO,6BAAc;AAAA,MACnB;AAAA,MACA;AAAA,MACA,OAAO,mBAAmB;AACxB,YAAI;AACF,gBAAM,gBAAY,6DAA+B,QAAQ;AACzD,gBAAM,cAAU,iDAAsB;AAAA,YACpC,KAAK,GAAG,KAAK,aAAa,IAAI,QAAQ,IAAI,SAAS;AAAA,YACnD,QAAQ;AAAA,YACR,MAAM,MAAM,SAAS;AAAA,YACrB,aAAa,QAAQ;AAAA,YACrB,aAAS,6CAAkB;AAAA,cACzB,QAAQ;AAAA,cACR,gBAAgB;AAAA,YAClB,CAAC;AAAA,YACD,gBAAgB,eAAe;AAAA,UACjC,CAAC;AAED,gBAAM,WAAW,MAAM,KAAK,iBAAiB,OAAO;AACpD,gCAAO,KAAK,kDAAkD,QAAQ,EAAE;AACxE,iBAAO;AAAA,QACT,SAAS,KAAU;AACjB,cACE,IAAI,SAAS,yCACb,IAAI,cAAc,UAAU,wBAC5B;AAIA,kCAAO,KAAK,uDAAuD,QAAQ,EAAE;AAC7E,mBAAO;AAAA,UACT,OAAO;AACL,kCAAO;AAAA,cACL,0DAA0D,QAAQ,KAAK,GAAG;AAAA,YAC5E;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,oBAAoB,eAAwC;AAC1D,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,cAAc,KAAK,iBAAiB,IAAI,aAAa,KAAK,CAAC;AACjE,gBAAY,KAAK,UAAU;AAC3B,SAAK,iBAAiB,IAAI,eAAe,WAAW;AACpD,UAAM,kBAAkB,WAAW,OAAO;AAC1C,eAAW,OAAO,UAAU,IAAI,WAAW;AACzC,WAAK,iBAAiB,IAAI,eAAe,MAAS;AAClD,UAAI,iBAAiB;AACnB,wBAAgB,MAAM,WAAW,QAAQ,MAAM;AAAA,MACjD;AAAA,IACF;AACA,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,cAAc,eAA8B;AAC1C,UAAM,MAAM,iBAAiB;AAC7B,UAAM,cAAc;AAAA,MAClB,GAAI,KAAK,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAAA;AAAA,MAEvC,GAAI,KAAK,iBAAiB,IAAI,eAAe,KAAK,CAAC;AAAA,IACrD;AACA,QAAI,CAAC,YAAY,QAAQ;AACvB;AAAA,IACF;AACA,eAAW,cAAc,aAAa;AACpC,iBAAW,MAAM;AAAA,IACnB;AACA,SAAK,iBAAiB,IAAI,KAAK,MAAS;AAAA,EAC1C;AAAA,EAEA,iBAAiB,SAAyC;AACxD,UAAM,YAAY,SAAS,MACvB,MAAM,GAAG,EACV,IAAI,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC,EAC7B,KAAK,CAAC,CAAC,GAAG,MAAM,QAAQ,mBAAmB;AAC9C,WAAO,aAAa,UAAU,SAAS,UAAU,CAAC,KAAK,kBAAkB;AAAA,EAC3E;AAAA;AAAA,EAIA,MAAM,oBACJ,KACA,SAC6B;AAC7B,UAAM,cAAU,iDAAsB;AAAA,MACpC;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,SAAS;AAAA,MACf,yBAAyB,KAAK;AAAA,MAC9B,aAAS,6CAAkB,SAAS,OAAO;AAAA,MAC3C,aAAa,KAAK,oBAAoB,eAAe;AAAA,IACvD,CAAC;AAED,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO;AAE/C,SAAK,eAAe,QAAQ;AAE5B,WAAO;AAAA,MACL,MAAM,KAAK,kBAAkB,QAAQ;AAAA,MACrC,SAAS,SAAS,QAAQ,OAAO;AAAA,MACjC,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,KACA,SAC6B;AAC7B,UAAM,cAAU,iDAAsB;AAAA,MACpC;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,SAAS;AAAA,MACf,aAAS,6CAAkB,SAAS,OAAO;AAAA,MAC3C,yBAAyB,KAAK;AAAA;AAAA,MAE9B,aAAa,KAAK,oBAAoB,KAAK,iBAAiB,OAAO,CAAC;AAAA,IACtE,CAAC;AAED,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO;AAE/C,SAAK,eAAe,QAAQ;AAE5B,WAAO;AAAA,MACL,MAAM,KAAK,kBAAkB,QAAQ;AAAA,MACrC,SAAS,SAAS,QAAQ,OAAO;AAAA,MACjC,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,4BAAoD;AAClD,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,eAAe,UAAkC;AACvD,QAAI,CAAC,KAAK,kCAAkC,CAAC,SAAS,YAAY;AAChE;AAAA,IACF;AACA,UAAM,iBAAiB;AACvB,QAAI;AACF,YAAM,SAAU,SAAiB,cAAc,KAAK,MAAM,SAAS,UAAU;AAC7E,YAAM,cAAc,OAAO;AAC3B,UAAI,CAAC,aAAa;AAEhB;AAAA,MACF;AACA,YAAM,iBAAiB,YAAY,MAAM,GAAG,EAAE,CAAC;AAC/C,YAAM,EAAE,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK;AAAA,QACpC,OAAO,KAAK,gBAAgB,QAAQ,EAAE,SAAS,MAAM;AAAA,MACvD;AAEA,4BAAO;AAAA,QACL,sCAAsC,KAAK,gBAAgB,GAAG,0BAC5D,OAAO,cACT,uBAAuB,GAAG;AAAA,MAC5B;AAAA,IACF,SAAS,GAAQ;AACf,4BAAO;AAAA,QACL;AAAA,QACA,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,kBAAkB,UAA4B;AACpD,QAAI;AACJ,QAAI;AACF,mBAAa,KAAK,MAAM,SAAS,cAAc,EAAE;AAAA,IACnD,SAAS,OAAO;AACd,4BAAO,KAAK,kDAAkD,KAAK,EAAE;AACrE,UAAI;AACJ,UAAI;AAMJ,UACE,SAAS,UAAU,WAAW,4BAC9B,SAAS,UAAU,WAAW,wBAC9B;AACA,oBAAY;AACZ,iCAAyB;AAAA,MAC3B,WACE,SAAS,UAAU,WAAW,4BAC9B,SAAS,UAAU,WAAW,wBAC9B;AACA,oBAAY;AACZ,iCAAyB;AAAA,MAC3B,OAAO;AACL,oBAAY;AACZ,iCAAyB;AAAA,MAC3B;AAEA,YAAM,wBAAwB;AAAA,QAC5B,GAAG,sBAAsB;AAAA,QACzB,qBAAqB,SAAS,MAAM;AAAA,QACpC,wBAAwB,SAAS,cAAc,SAAS;AAAA,QACxD,YAAY,KAAK,UAAU,SAAS,OAAO,CAAC;AAAA,MAC9C;AACA,mBAAa;AAAA,QACX,OAAO;AAAA,QACP,mBAAmB,sBAAsB,KAAK,IAAI;AAAA,MACpD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { INetworkModule, NetworkRequestOptions, NetworkResponse } from \"@azure/msal-node\";\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport { ServiceClient } from \"@azure/core-client\";\nimport type { PipelineRequest, PipelineResponse } from \"@azure/core-rest-pipeline\";\nimport { createHttpHeaders, createPipelineRequest } from \"@azure/core-rest-pipeline\";\nimport type { AbortSignalLike } from \"@azure/abort-controller\";\nimport { uint8ArrayToString, stringToUint8Array } from \"@azure/core-util\";\nimport { AuthenticationError, AuthenticationErrorName } from \"../errors.js\";\nimport { getIdentityTokenEndpointSuffix } from \"../util/identityTokenEndpoint.js\";\nimport { SDK_VERSION } from \"../constants.js\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { logger } from \"../util/logging.js\";\nimport type { TokenCredentialOptions } from \"../tokenCredentialOptions.js\";\nimport type { TokenResponseParsedBody } from \"../credentials/managedIdentityCredential/utils.js\";\nimport {\n  parseExpirationTimestamp,\n  parseRefreshTimestamp,\n} from \"../credentials/managedIdentityCredential/utils.js\";\nimport { getAuthorityHost } from \"../util/authorityHost.js\";\n\nconst noCorrelationId = \"noCorrelationId\";\nconst HttpStatus = {\n  CLIENT_ERROR_RANGE_START: 400,\n  CLIENT_ERROR_RANGE_END: 499,\n  SERVER_ERROR_RANGE_START: 500,\n  SERVER_ERROR_RANGE_END: 599,\n};\n\n/**\n * An internal type used to communicate details of a token request's\n * response that should not be sent back as part of the access token.\n */\nexport interface TokenResponse {\n  /**\n   * The AccessToken to be returned from getToken.\n   */\n  accessToken: AccessToken;\n  /**\n   * The refresh token if the 'offline_access' scope was used.\n   */\n  refreshToken?: string;\n}\n\n/**\n * The network module used by the Identity credentials.\n *\n * It allows for credentials to abort any pending request independently of the MSAL flow,\n * by calling to the `abortRequests()` method.\n *\n */\nexport class IdentityClient extends ServiceClient implements INetworkModule {\n  public authorityHost: string;\n  private allowLoggingAccountIdentifiers?: boolean;\n  private abortControllers: Map<string, AbortController[] | undefined>;\n  private allowInsecureConnection: boolean = false;\n  // used for WorkloadIdentity\n  private tokenCredentialOptions: TokenCredentialOptions;\n\n  constructor(options?: TokenCredentialOptions) {\n    const packageDetails = `azsdk-js-identity/${SDK_VERSION}`;\n    const userAgentPrefix = options?.userAgentOptions?.userAgentPrefix\n      ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}`\n      : `${packageDetails}`;\n\n    const baseUri = getAuthorityHost(options);\n    if (!baseUri.startsWith(\"https:\")) {\n      throw new Error(\"The authorityHost address must use the 'https' protocol.\");\n    }\n\n    super({\n      requestContentType: \"application/json; charset=utf-8\",\n      retryOptions: {\n        maxRetries: 3,\n      },\n      ...options,\n      userAgentOptions: {\n        userAgentPrefix,\n      },\n      baseUri,\n    });\n\n    this.authorityHost = baseUri;\n    this.abortControllers = new Map();\n    this.allowLoggingAccountIdentifiers = options?.loggingOptions?.allowLoggingAccountIdentifiers;\n    // used for WorkloadIdentity\n    this.tokenCredentialOptions = { ...options };\n\n    // used for ManagedIdentity\n    if (options?.allowInsecureConnection) {\n      this.allowInsecureConnection = options.allowInsecureConnection;\n    }\n  }\n\n  async sendTokenRequest(request: PipelineRequest): Promise<TokenResponse | null> {\n    logger.info(`IdentityClient: sending token request to [${request.url}]`);\n    const response = await this.sendRequest(request);\n    if (response.bodyAsText && (response.status === 200 || response.status === 201)) {\n      const parsedBody: TokenResponseParsedBody = JSON.parse(response.bodyAsText);\n\n      if (!parsedBody.access_token) {\n        return null;\n      }\n\n      this.logIdentifiers(response);\n\n      const token = {\n        accessToken: {\n          token: parsedBody.access_token,\n          expiresOnTimestamp: parseExpirationTimestamp(parsedBody),\n          refreshAfterTimestamp: parseRefreshTimestamp(parsedBody),\n          tokenType: \"Bearer\",\n        } as AccessToken,\n        refreshToken: parsedBody.refresh_token,\n      };\n\n      logger.info(\n        `IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`,\n      );\n      return token;\n    } else {\n      const error = new AuthenticationError(response.status, response.bodyAsText);\n      logger.warning(\n        `IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`,\n      );\n      throw error;\n    }\n  }\n\n  async refreshAccessToken(\n    tenantId: string,\n    clientId: string,\n    scopes: string,\n    refreshToken: string | undefined,\n    clientSecret: string | undefined,\n    options: GetTokenOptions = {},\n  ): Promise<TokenResponse | null> {\n    if (refreshToken === undefined) {\n      return null;\n    }\n    logger.info(\n      `IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`,\n    );\n\n    const refreshParams = {\n      grant_type: \"refresh_token\",\n      client_id: clientId,\n      refresh_token: refreshToken,\n      scope: scopes,\n    };\n\n    if (clientSecret !== undefined) {\n      (refreshParams as any).client_secret = clientSecret;\n    }\n\n    const query = new URLSearchParams(refreshParams);\n\n    return tracingClient.withSpan(\n      \"IdentityClient.refreshAccessToken\",\n      options,\n      async (updatedOptions) => {\n        try {\n          const urlSuffix = getIdentityTokenEndpointSuffix(tenantId);\n          const request = createPipelineRequest({\n            url: `${this.authorityHost}/${tenantId}/${urlSuffix}`,\n            method: \"POST\",\n            body: query.toString(),\n            abortSignal: options.abortSignal,\n            headers: createHttpHeaders({\n              Accept: \"application/json\",\n              \"Content-Type\": \"application/x-www-form-urlencoded\",\n            }),\n            tracingOptions: updatedOptions.tracingOptions,\n          });\n\n          const response = await this.sendTokenRequest(request);\n          logger.info(`IdentityClient: refreshed token for client ID: ${clientId}`);\n          return response;\n        } catch (err: any) {\n          if (\n            err.name === AuthenticationErrorName &&\n            err.errorResponse.error === \"interaction_required\"\n          ) {\n            // It's likely that the refresh token has expired, so\n            // return null so that the credential implementation will\n            // initiate the authentication flow again.\n            logger.info(`IdentityClient: interaction required for client ID: ${clientId}`);\n            return null;\n          } else {\n            logger.warning(\n              `IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`,\n            );\n            throw err;\n          }\n        }\n      },\n    );\n  }\n\n  // Here is a custom layer that allows us to abort requests that go through MSAL,\n  // since MSAL doesn't allow us to pass options all the way through.\n\n  generateAbortSignal(correlationId: string): AbortSignalLike {\n    const controller = new AbortController();\n    const controllers = this.abortControllers.get(correlationId) || [];\n    controllers.push(controller);\n    this.abortControllers.set(correlationId, controllers);\n    const existingOnAbort = controller.signal.onabort;\n    controller.signal.onabort = (...params) => {\n      this.abortControllers.set(correlationId, undefined);\n      if (existingOnAbort) {\n        existingOnAbort.apply(controller.signal, params);\n      }\n    };\n    return controller.signal;\n  }\n\n  abortRequests(correlationId?: string): void {\n    const key = correlationId || noCorrelationId;\n    const controllers = [\n      ...(this.abortControllers.get(key) || []),\n      // MSAL passes no correlation ID to the get requests...\n      ...(this.abortControllers.get(noCorrelationId) || []),\n    ];\n    if (!controllers.length) {\n      return;\n    }\n    for (const controller of controllers) {\n      controller.abort();\n    }\n    this.abortControllers.set(key, undefined);\n  }\n\n  getCorrelationId(options?: NetworkRequestOptions): string {\n    const parameter = options?.body\n      ?.split(\"&\")\n      .map((part) => part.split(\"=\"))\n      .find(([key]) => key === \"client-request-id\");\n    return parameter && parameter.length ? parameter[1] || noCorrelationId : noCorrelationId;\n  }\n\n  // The MSAL network module methods follow\n\n  async sendGetRequestAsync<T>(\n    url: string,\n    options?: NetworkRequestOptions,\n  ): Promise<NetworkResponse<T>> {\n    const request = createPipelineRequest({\n      url,\n      method: \"GET\",\n      body: options?.body,\n      allowInsecureConnection: this.allowInsecureConnection,\n      headers: createHttpHeaders(options?.headers),\n      abortSignal: this.generateAbortSignal(noCorrelationId),\n    });\n\n    const response = await this.sendRequest(request);\n\n    this.logIdentifiers(response);\n\n    return {\n      body: this.parseResponseBody(response) as T,\n      headers: response.headers.toJSON(),\n      status: response.status,\n    };\n  }\n\n  async sendPostRequestAsync<T>(\n    url: string,\n    options?: NetworkRequestOptions,\n  ): Promise<NetworkResponse<T>> {\n    const request = createPipelineRequest({\n      url,\n      method: \"POST\",\n      body: options?.body,\n      headers: createHttpHeaders(options?.headers),\n      allowInsecureConnection: this.allowInsecureConnection,\n      // MSAL doesn't send the correlation ID on the get requests.\n      abortSignal: this.generateAbortSignal(this.getCorrelationId(options)),\n    });\n\n    const response = await this.sendRequest(request);\n\n    this.logIdentifiers(response);\n\n    return {\n      body: this.parseResponseBody(response) as T,\n      headers: response.headers.toJSON(),\n      status: response.status,\n    };\n  }\n\n  /**\n   *\n   * @internal\n   */\n  getTokenCredentialOptions(): TokenCredentialOptions {\n    return this.tokenCredentialOptions;\n  }\n  /**\n   * If allowLoggingAccountIdentifiers was set on the constructor options\n   * we try to log the account identifiers by parsing the received access token.\n   *\n   * The account identifiers we try to log are:\n   * - `appid`: The application or Client Identifier.\n   * - `upn`: User Principal Name.\n   *   - It might not be available in some authentication scenarios.\n   *   - If it's not available, we put a placeholder: \"No User Principal Name available\".\n   * - `tid`: Tenant Identifier.\n   * - `oid`: Object Identifier of the authenticated user.\n   */\n  private logIdentifiers(response: PipelineResponse): void {\n    if (!this.allowLoggingAccountIdentifiers || !response.bodyAsText) {\n      return;\n    }\n    const unavailableUpn = \"No User Principal Name available\";\n    try {\n      const parsed = (response as any).parsedBody || JSON.parse(response.bodyAsText);\n      const accessToken = parsed.access_token;\n      if (!accessToken) {\n        // Without an access token allowLoggingAccountIdentifiers isn't useful.\n        return;\n      }\n      const base64Metadata = accessToken.split(\".\")[1];\n      const { appid, upn, tid, oid } = JSON.parse(\n        uint8ArrayToString(stringToUint8Array(base64Metadata, \"base64url\"), \"utf-8\"),\n      );\n\n      logger.info(\n        `[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${\n          upn || unavailableUpn\n        }. Object ID (user): ${oid}`,\n      );\n    } catch (e: any) {\n      logger.warning(\n        \"allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:\",\n        e.message,\n      );\n    }\n  }\n\n  /**\n   * Parses the response body if possible. Add error properties if parsing fails.\n   * This follows MSAL INetworkModule behavior so the response is in expected format.\n   */\n  private parseResponseBody(response: PipelineResponse) {\n    let parsedBody: {};\n    try {\n      parsedBody = JSON.parse(response.bodyAsText || \"\");\n    } catch (error) {\n      logger.info(`IdentityClient: Could not parse response body: ${error}`);\n      let errorType;\n      let errorDescriptionHelper;\n      /**\n       * Determine error type based on status code ranges following MSAL patterns:\n       * Client error responses (400 \u2013 499)\n       * Server error responses (500 \u2013 599)\n       */\n      if (\n        response.status >= HttpStatus.CLIENT_ERROR_RANGE_START &&\n        response.status <= HttpStatus.CLIENT_ERROR_RANGE_END\n      ) {\n        errorType = \"client_error\";\n        errorDescriptionHelper = \"A client\";\n      } else if (\n        response.status >= HttpStatus.SERVER_ERROR_RANGE_START &&\n        response.status <= HttpStatus.SERVER_ERROR_RANGE_END\n      ) {\n        errorType = \"server_error\";\n        errorDescriptionHelper = \"A server\";\n      } else {\n        errorType = \"unknown_error\";\n        errorDescriptionHelper = \"An unknown\";\n      }\n\n      const errorDescriptionLines = [\n        `${errorDescriptionHelper} error occured.`,\n        `Http status code: ${response.status}`,\n        `Http status message: ${response.bodyAsText || \"Unknown\"}`,\n        `Headers: ${JSON.stringify(response.headers)}`,\n      ];\n      parsedBody = {\n        error: errorType,\n        error_description: errorDescriptionLines.join(\"\\n\"),\n      };\n    }\n    return parsedBody;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,yBAA8B;AAE9B,gCAAyD;AAEzD,uBAAuD;AACvD,oBAA6D;AAC7D,mCAA+C;AAC/C,uBAA4B;AAC5B,qBAA8B;AAC9B,qBAAuB;AAGvB,mBAGO;AACP,2BAAiC;AAEjC,MAAM,kBAAkB;AACxB,MAAM,aAAa;AAAA,EACjB,0BAA0B;AAAA,EAC1B,wBAAwB;AAAA,EACxB,0BAA0B;AAAA,EAC1B,wBAAwB;AAC1B;AAwBO,MAAM,uBAAuB,iCAAwC;AAAA,EACnE;AAAA,EACC;AAAA,EACA;AAAA,EACA,0BAAmC;AAAA;AAAA,EAEnC;AAAA,EAER,YAAY,SAAkC;AAC5C,UAAM,iBAAiB,qBAAqB,4BAAW;AACvD,UAAM,kBAAkB,SAAS,kBAAkB,kBAC/C,GAAG,QAAQ,iBAAiB,eAAe,IAAI,cAAc,KAC7D,GAAG,cAAc;AAErB,UAAM,cAAU,uCAAiB,OAAO;AACxC,QAAI,CAAC,QAAQ,WAAW,QAAQ,GAAG;AACjC,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAEA,UAAM;AAAA,MACJ,oBAAoB;AAAA,MACpB,cAAc;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,MACA,GAAG;AAAA,MACH,kBAAkB;AAAA,QAChB;AAAA,MACF;AAAA,MACA;AAAA,IACF,CAAC;AAED,SAAK,gBAAgB;AACrB,SAAK,mBAAmB,oBAAI,IAAI;AAChC,SAAK,iCAAiC,SAAS,gBAAgB;AAE/D,SAAK,yBAAyB,EAAE,GAAG,QAAQ;AAG3C,QAAI,SAAS,yBAAyB;AACpC,WAAK,0BAA0B,QAAQ;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAyD;AAC9E,0BAAO,KAAK,6CAA6C,QAAQ,GAAG,GAAG;AACvE,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO;AAC/C,QAAI,SAAS,eAAe,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC/E,YAAM,aAAsC,KAAK,MAAM,SAAS,UAAU;AAE1E,UAAI,CAAC,WAAW,cAAc;AAC5B,eAAO;AAAA,MACT;AAEA,WAAK,eAAe,QAAQ;AAE5B,YAAM,QAAQ;AAAA,QACZ,aAAa;AAAA,UACX,OAAO,WAAW;AAAA,UAClB,wBAAoB,uCAAyB,UAAU;AAAA,UACvD,2BAAuB,oCAAsB,UAAU;AAAA,UACvD,WAAW;AAAA,QACb;AAAA,QACA,cAAc,WAAW;AAAA,MAC3B;AAEA,4BAAO;AAAA,QACL,oBAAoB,QAAQ,GAAG,gCAAgC,MAAM,YAAY,kBAAkB;AAAA,MACrG;AACA,aAAO;AAAA,IACT,OAAO;AACL,YAAM,QAAQ,IAAI,kCAAoB,SAAS,QAAQ,SAAS,UAAU;AAC1E,4BAAO;AAAA,QACL,sDAAsD,SAAS,MAAM,KAAK,MAAM,cAAc,gBAAgB;AAAA,MAChH;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,UACA,UACA,QACA,cACA,cACA,UAA2B,CAAC,GACG;AAC/B,QAAI,iBAAiB,QAAW;AAC9B,aAAO;AAAA,IACT;AACA,0BAAO;AAAA,MACL,2DAA2D,QAAQ,aAAa,MAAM;AAAA,IACxF;AAEA,UAAM,gBAAgB;AAAA,MACpB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,MACf,OAAO;AAAA,IACT;AAEA,QAAI,iBAAiB,QAAW;AAC9B,MAAC,cAAsB,gBAAgB;AAAA,IACzC;AAEA,UAAM,QAAQ,IAAI,gBAAgB,aAAa;AAE/C,WAAO,6BAAc;AAAA,MACnB;AAAA,MACA;AAAA,MACA,OAAO,mBAAmB;AACxB,YAAI;AACF,gBAAM,gBAAY,6DAA+B,QAAQ;AACzD,gBAAM,cAAU,iDAAsB;AAAA,YACpC,KAAK,GAAG,KAAK,aAAa,IAAI,QAAQ,IAAI,SAAS;AAAA,YACnD,QAAQ;AAAA,YACR,MAAM,MAAM,SAAS;AAAA,YACrB,aAAa,QAAQ;AAAA,YACrB,aAAS,6CAAkB;AAAA,cACzB,QAAQ;AAAA,cACR,gBAAgB;AAAA,YAClB,CAAC;AAAA,YACD,gBAAgB,eAAe;AAAA,UACjC,CAAC;AAED,gBAAM,WAAW,MAAM,KAAK,iBAAiB,OAAO;AACpD,gCAAO,KAAK,kDAAkD,QAAQ,EAAE;AACxE,iBAAO;AAAA,QACT,SAAS,KAAU;AACjB,cACE,IAAI,SAAS,yCACb,IAAI,cAAc,UAAU,wBAC5B;AAIA,kCAAO,KAAK,uDAAuD,QAAQ,EAAE;AAC7E,mBAAO;AAAA,UACT,OAAO;AACL,kCAAO;AAAA,cACL,0DAA0D,QAAQ,KAAK,GAAG;AAAA,YAC5E;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,oBAAoB,eAAwC;AAC1D,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,cAAc,KAAK,iBAAiB,IAAI,aAAa,KAAK,CAAC;AACjE,gBAAY,KAAK,UAAU;AAC3B,SAAK,iBAAiB,IAAI,eAAe,WAAW;AACpD,UAAM,kBAAkB,WAAW,OAAO;AAC1C,eAAW,OAAO,UAAU,IAAI,WAAW;AACzC,WAAK,iBAAiB,IAAI,eAAe,MAAS;AAClD,UAAI,iBAAiB;AACnB,wBAAgB,MAAM,WAAW,QAAQ,MAAM;AAAA,MACjD;AAAA,IACF;AACA,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,cAAc,eAA8B;AAC1C,UAAM,MAAM,iBAAiB;AAC7B,UAAM,cAAc;AAAA,MAClB,GAAI,KAAK,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAAA;AAAA,MAEvC,GAAI,KAAK,iBAAiB,IAAI,eAAe,KAAK,CAAC;AAAA,IACrD;AACA,QAAI,CAAC,YAAY,QAAQ;AACvB;AAAA,IACF;AACA,eAAW,cAAc,aAAa;AACpC,iBAAW,MAAM;AAAA,IACnB;AACA,SAAK,iBAAiB,IAAI,KAAK,MAAS;AAAA,EAC1C;AAAA,EAEA,iBAAiB,SAAyC;AACxD,UAAM,YAAY,SAAS,MACvB,MAAM,GAAG,EACV,IAAI,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC,EAC7B,KAAK,CAAC,CAAC,GAAG,MAAM,QAAQ,mBAAmB;AAC9C,WAAO,aAAa,UAAU,SAAS,UAAU,CAAC,KAAK,kBAAkB;AAAA,EAC3E;AAAA;AAAA,EAIA,MAAM,oBACJ,KACA,SAC6B;AAC7B,UAAM,cAAU,iDAAsB;AAAA,MACpC;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,SAAS;AAAA,MACf,yBAAyB,KAAK;AAAA,MAC9B,aAAS,6CAAkB,SAAS,OAAO;AAAA,MAC3C,aAAa,KAAK,oBAAoB,eAAe;AAAA,IACvD,CAAC;AAED,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO;AAE/C,SAAK,eAAe,QAAQ;AAE5B,WAAO;AAAA,MACL,MAAM,KAAK,kBAAkB,QAAQ;AAAA,MACrC,SAAS,SAAS,QAAQ,OAAO;AAAA,MACjC,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,KACA,SAC6B;AAC7B,UAAM,cAAU,iDAAsB;AAAA,MACpC;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,SAAS;AAAA,MACf,aAAS,6CAAkB,SAAS,OAAO;AAAA,MAC3C,yBAAyB,KAAK;AAAA;AAAA,MAE9B,aAAa,KAAK,oBAAoB,KAAK,iBAAiB,OAAO,CAAC;AAAA,IACtE,CAAC;AAED,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO;AAE/C,SAAK,eAAe,QAAQ;AAE5B,WAAO;AAAA,MACL,MAAM,KAAK,kBAAkB,QAAQ;AAAA,MACrC,SAAS,SAAS,QAAQ,OAAO;AAAA,MACjC,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,4BAAoD;AAClD,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,eAAe,UAAkC;AACvD,QAAI,CAAC,KAAK,kCAAkC,CAAC,SAAS,YAAY;AAChE;AAAA,IACF;AACA,UAAM,iBAAiB;AACvB,QAAI;AACF,YAAM,SAAU,SAAiB,cAAc,KAAK,MAAM,SAAS,UAAU;AAC7E,YAAM,cAAc,OAAO;AAC3B,UAAI,CAAC,aAAa;AAEhB;AAAA,MACF;AACA,YAAM,iBAAiB,YAAY,MAAM,GAAG,EAAE,CAAC;AAC/C,YAAM,EAAE,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK;AAAA,YACpC,yCAAmB,qCAAmB,gBAAgB,WAAW,GAAG,OAAO;AAAA,MAC7E;AAEA,4BAAO;AAAA,QACL,sCAAsC,KAAK,gBAAgB,GAAG,0BAC5D,OAAO,cACT,uBAAuB,GAAG;AAAA,MAC5B;AAAA,IACF,SAAS,GAAQ;AACf,4BAAO;AAAA,QACL;AAAA,QACA,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,kBAAkB,UAA4B;AACpD,QAAI;AACJ,QAAI;AACF,mBAAa,KAAK,MAAM,SAAS,cAAc,EAAE;AAAA,IACnD,SAAS,OAAO;AACd,4BAAO,KAAK,kDAAkD,KAAK,EAAE;AACrE,UAAI;AACJ,UAAI;AAMJ,UACE,SAAS,UAAU,WAAW,4BAC9B,SAAS,UAAU,WAAW,wBAC9B;AACA,oBAAY;AACZ,iCAAyB;AAAA,MAC3B,WACE,SAAS,UAAU,WAAW,4BAC9B,SAAS,UAAU,WAAW,wBAC9B;AACA,oBAAY;AACZ,iCAAyB;AAAA,MAC3B,OAAO;AACL,oBAAY;AACZ,iCAAyB;AAAA,MAC3B;AAEA,YAAM,wBAAwB;AAAA,QAC5B,GAAG,sBAAsB;AAAA,QACzB,qBAAqB,SAAS,MAAM;AAAA,QACpC,wBAAwB,SAAS,cAAc,SAAS;AAAA,QACxD,YAAY,KAAK,UAAU,SAAS,OAAO,CAAC;AAAA,MAC9C;AACA,mBAAa;AAAA,QACX,OAAO;AAAA,QACP,mBAAmB,sBAAsB,KAAK,IAAI;AAAA,MACpD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/commonjs/constants.d.ts

@@ -1,7 +1,7 @@
 /**
  * Current version of the `@azure/identity` package.
  */
-export declare const SDK_VERSION = "4.14.0-beta.3";
+export declare const SDK_VERSION = "4.14.0-beta.5";
 /**
  * The default client ID for authentication
  * @internal

package/dist/commonjs/constants.js

@@ -29,7 +29,7 @@ __export(constants_exports, {
   SDK_VERSION: () => SDK_VERSION
 });
 module.exports = __toCommonJS(constants_exports);
-const SDK_VERSION = `4.14.0-beta.3`;
+const SDK_VERSION = `4.14.0-beta.5`;
 const DeveloperSignOnClientId = "04b07795-8ddb-461a-bbee-02f9e1bf7b46";
 const DefaultTenantId = "common";
 var AzureAuthorityHosts = /* @__PURE__ */ ((AzureAuthorityHosts2) => {

package/dist/commonjs/constants.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\n/**\n * Current version of the `@azure/identity` package.\n */\nexport const SDK_VERSION = `4.14.0-beta.3`;\n\n/**\n * The default client ID for authentication\n * @internal\n */\n// TODO: temporary - this is the Azure CLI clientID - we'll replace it when\n// Developer Sign On application is available\n// https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/Constants.cs#L9\nexport const DeveloperSignOnClientId = \"04b07795-8ddb-461a-bbee-02f9e1bf7b46\";\n\n/**\n * The default tenant for authentication\n * @internal\n */\nexport const DefaultTenantId = \"common\";\n\n/**\n * A list of known Azure authority hosts\n */\nexport enum AzureAuthorityHosts {\n  /**\n   * China-based Azure Authority Host\n   */\n  AzureChina = \"https://login.chinacloudapi.cn\",\n  /**\n   * Germany-based Azure Authority Host\n   *\n   * @deprecated Microsoft Cloud Germany was closed on October 29th, 2021.\n   *\n   * */\n  AzureGermany = \"https://login.microsoftonline.de\",\n  /**\n   * US Government Azure Authority Host\n   */\n  AzureGovernment = \"https://login.microsoftonline.us\",\n  /**\n   * Public Cloud Azure Authority Host\n   */\n  AzurePublicCloud = \"https://login.microsoftonline.com\",\n}\n\n/**\n * @internal\n * The default authority host.\n */\nexport const DefaultAuthorityHost = AzureAuthorityHosts.AzurePublicCloud;\n\n/**\n * @internal\n * The default environment host for Azure Public Cloud\n */\nexport const DefaultAuthority = \"login.microsoftonline.com\";\n\n/**\n * @internal\n * Allow acquiring tokens for any tenant for multi-tentant auth.\n */\nexport const ALL_TENANTS: string[] = [\"*\"];\n\n/**\n * @internal\n */\nexport const CACHE_CAE_SUFFIX = \"cae\";\n\n/**\n * @internal\n */\nexport const CACHE_NON_CAE_SUFFIX = \"nocae\";\n\n/**\n * @internal\n *\n * The default name for the cache persistence plugin.\n * Matches the constant defined in the cache persistence package.\n */\nexport const DEFAULT_TOKEN_CACHE_NAME = \"msal.cache\";\n"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\n/**\n * Current version of the `@azure/identity` package.\n */\nexport const SDK_VERSION = `4.14.0-beta.5`;\n\n/**\n * The default client ID for authentication\n * @internal\n */\n// TODO: temporary - this is the Azure CLI clientID - we'll replace it when\n// Developer Sign On application is available\n// https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/Constants.cs#L9\nexport const DeveloperSignOnClientId = \"04b07795-8ddb-461a-bbee-02f9e1bf7b46\";\n\n/**\n * The default tenant for authentication\n * @internal\n */\nexport const DefaultTenantId = \"common\";\n\n/**\n * A list of known Azure authority hosts\n */\nexport enum AzureAuthorityHosts {\n  /**\n   * China-based Azure Authority Host\n   */\n  AzureChina = \"https://login.chinacloudapi.cn\",\n  /**\n   * Germany-based Azure Authority Host\n   *\n   * @deprecated Microsoft Cloud Germany was closed on October 29th, 2021.\n   *\n   * */\n  AzureGermany = \"https://login.microsoftonline.de\",\n  /**\n   * US Government Azure Authority Host\n   */\n  AzureGovernment = \"https://login.microsoftonline.us\",\n  /**\n   * Public Cloud Azure Authority Host\n   */\n  AzurePublicCloud = \"https://login.microsoftonline.com\",\n}\n\n/**\n * @internal\n * The default authority host.\n */\nexport const DefaultAuthorityHost = AzureAuthorityHosts.AzurePublicCloud;\n\n/**\n * @internal\n * The default environment host for Azure Public Cloud\n */\nexport const DefaultAuthority = \"login.microsoftonline.com\";\n\n/**\n * @internal\n * Allow acquiring tokens for any tenant for multi-tentant auth.\n */\nexport const ALL_TENANTS: string[] = [\"*\"];\n\n/**\n * @internal\n */\nexport const CACHE_CAE_SUFFIX = \"cae\";\n\n/**\n * @internal\n */\nexport const CACHE_NON_CAE_SUFFIX = \"nocae\";\n\n/**\n * @internal\n *\n * The default name for the cache persistence plugin.\n * Matches the constant defined in the cache persistence package.\n */\nexport const DEFAULT_TOKEN_CACHE_NAME = \"msal.cache\";\n"],
   "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMO,MAAM,cAAc;AASpB,MAAM,0BAA0B;AAMhC,MAAM,kBAAkB;AAKxB,IAAK,sBAAL,kBAAKA,yBAAL;AAIL,EAAAA,qBAAA,gBAAa;AAOb,EAAAA,qBAAA,kBAAe;AAIf,EAAAA,qBAAA,qBAAkB;AAIlB,EAAAA,qBAAA,sBAAmB;AAnBT,SAAAA;AAAA,GAAA;AA0BL,MAAM,uBAAuB;AAM7B,MAAM,mBAAmB;AAMzB,MAAM,cAAwB,CAAC,GAAG;AAKlC,MAAM,mBAAmB;AAKzB,MAAM,uBAAuB;AAQ7B,MAAM,2BAA2B;",
   "names": ["AzureAuthorityHosts"]
 }

package/dist/commonjs/credentials/azureCliCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"azureCliCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azureCliCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAStF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAQhF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;CAUvC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB;IACjC;;OAEG;yBACkB,MAAM;IAgB3B;;;;OAIG;qCAES,MAAM,aACL,MAAM,iBACF,MAAM,YACX,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,CAAC;CAmCpE,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,eAAe;IACxD,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,YAAY,CAAC,CAAS;IAE9B;;;;;;;OAOG;gBACS,OAAO,CAAC,EAAE,yBAAyB;IAe/C;;;;;;;OAOG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,CAAC;IAiFvB;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;CA+BzB"}
+{"version":3,"file":"azureCliCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azureCliCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAStF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAUhF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;CAUvC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB;IACjC;;OAEG;yBACkB,MAAM;IAgB3B;;;;OAIG;qCAES,MAAM,aACL,MAAM,iBACF,MAAM,YACX,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,CAAC;CA0BpE,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,eAAe;IACxD,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,YAAY,CAAC,CAAS;IAE9B;;;;;;;OAOG;gBACS,OAAO,CAAC,EAAE,yBAAyB;IAe/C;;;;;;;OAOG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,CAAC;IAmFvB;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;CA+BzB"}

package/dist/commonjs/credentials/azureCliCredential.js

@@ -1,8 +1,6 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -16,14 +14,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var azureCliCredential_exports = {};
 __export(azureCliCredential_exports, {
@@ -36,9 +26,11 @@ var import_tenantIdUtils = require("../util/tenantIdUtils.js");
 var import_logging = require("../util/logging.js");
 var import_scopeUtils = require("../util/scopeUtils.js");
 var import_errors = require("../errors.js");
-var import_child_process = __toESM(require("child_process"));
+var import_core_util = require("@azure/core-util");
 var import_tracing = require("../util/tracing.js");
 var import_subscriptionUtils = require("../util/subscriptionUtils.js");
+var import_processUtils = require("../util/processUtils.js");
+var import_core_process = require("@azure/core-process");
 const logger = (0, import_logging.credentialLogger)("AzureCliCredential");
 const azureCliPublicErrorMessages = {
   claim: "This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:",
@@ -77,31 +69,23 @@ const cliCredentialInternals = {
       tenantSection = ["--tenant", tenantId];
     }
     if (subscription) {
-      subscriptionSection = ["--subscription", `"${subscription}"`];
+      subscriptionSection = ["--subscription", subscription];
     }
-    return new Promise((resolve, reject) => {
-      try {
-        const args = [
-          "account",
-          "get-access-token",
-          "--output",
-          "json",
-          "--resource",
-          resource,
-          ...tenantSection,
-          ...subscriptionSection
-        ];
-        const command = ["az", ...args].join(" ");
-        import_child_process.default.exec(
-          command,
-          { cwd: cliCredentialInternals.getSafeWorkingDir(), timeout },
-          (error, stdout, stderr) => {
-            resolve({ stdout, stderr, error });
-          }
-        );
-      } catch (err) {
-        reject(err);
-      }
+    const args = [
+      "account",
+      "get-access-token",
+      "--output",
+      "json",
+      "--resource",
+      resource,
+      ...tenantSection,
+      ...subscriptionSection
+    ];
+    return import_processUtils.processUtils.execFileWithResult("az", args, {
+      allowWindowsBatchFiles: true,
+      cwd: cliCredentialInternals.getSafeWorkingDir(),
+      encoding: "utf8",
+      timeout
     });
   }
 };
@@ -144,7 +128,7 @@ class AzureCliCredential {
     const scope = typeof scopes === "string" ? scopes : scopes[0];
     const claimsValue = options.claims;
     if (claimsValue && claimsValue.trim()) {
-      const encodedClaims = btoa(claimsValue);
+      const encodedClaims = (0, import_core_util.uint8ArrayToString)((0, import_core_util.stringToUint8Array)(claimsValue, "utf-8"), "base64");
       let loginCmd = `az login --claims-challenge ${encodedClaims} --scope ${scope}`;
       const tenantIdFromOptions = options.tenantId;
       if (tenantIdFromOptions) {
@@ -180,7 +164,7 @@ class AzureCliCredential {
         );
         const specificScope = obj.stderr?.match("(.*)az login --scope(.*)");
         const isLoginError = obj.stderr?.match("(.*)az login(.*)") && !specificScope;
-        const isNotInstallError = obj.stderr?.match("az:(.*)not found") || obj.stderr?.startsWith("'az' is not recognized");
+        const isNotInstallError = obj.stderr?.match("az:(.*)not found") || obj.stderr?.startsWith("'az' is not recognized") || obj.error && (0, import_core_process.isProcessError)(obj.error) && obj.error.code === "ENOENT";
         if (isNotInstallError) {
           const error = new import_errors.CredentialUnavailableError(azureCliPublicErrorMessages.notInstalled);
           logger.getToken.info((0, import_logging.formatError)(scopes, error));

package/dist/commonjs/credentials/azureCliCredential.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/credentials/azureCliCredential.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport { ensureValidScopeForDevTimeCreds, getScopeResource } from \"../util/scopeUtils.js\";\n\nimport type { AzureCliCredentialOptions } from \"./azureCliCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport child_process from \"child_process\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { checkSubscription } from \"../util/subscriptionUtils.js\";\n\nconst logger = credentialLogger(\"AzureCliCredential\");\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const azureCliPublicErrorMessages = {\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n  notInstalled:\n    \"Azure CLI could not be found. Please visit https://aka.ms/azure-cli for installation instructions and then, once installed, authenticate to your Azure account using 'az login'.\",\n  login:\n    \"Please run 'az login' from a command prompt to authenticate before using this credential.\",\n  unknown: \"Unknown error while trying to retrieve the access token\",\n  unexpectedResponse:\n    'Unexpected response from Azure CLI when getting token. Expected \"expiresOn\" to be a RFC3339 date string. Got:',\n};\n\n/**\n * Mockable reference to the CLI credential cliCredentialFunctions\n * @internal\n */\nexport const cliCredentialInternals = {\n  /**\n   * @internal\n   */\n  getSafeWorkingDir(): string {\n    if (process.platform === \"win32\") {\n      let systemRoot = process.env.SystemRoot || process.env[\"SYSTEMROOT\"];\n      if (!systemRoot) {\n        logger.getToken.warning(\n          \"The SystemRoot environment variable is not set. This may cause issues when using the Azure CLI credential.\",\n        );\n\n        systemRoot = \"C:\\\\Windows\";\n      }\n      return systemRoot;\n    } else {\n      return \"/bin\";\n    }\n  },\n\n  /**\n   * Gets the access token from Azure CLI\n   * @param resource - The resource to use when getting the token\n   * @internal\n   */\n  async getAzureCliAccessToken(\n    resource: string,\n    tenantId?: string,\n    subscription?: string,\n    timeout?: number,\n  ): Promise<{ stdout: string; stderr: string; error: Error | null }> {\n    let tenantSection: string[] = [];\n    let subscriptionSection: string[] = [];\n    if (tenantId) {\n      tenantSection = [\"--tenant\", tenantId];\n    }\n    if (subscription) {\n      // Add quotes around the subscription to handle subscriptions with spaces\n      subscriptionSection = [\"--subscription\", `\"${subscription}\"`];\n    }\n    return new Promise((resolve, reject) => {\n      try {\n        const args = [\n          \"account\",\n          \"get-access-token\",\n          \"--output\",\n          \"json\",\n          \"--resource\",\n          resource,\n          ...tenantSection,\n          ...subscriptionSection,\n        ];\n        const command = [\"az\", ...args].join(\" \");\n        child_process.exec(\n          command,\n          { cwd: cliCredentialInternals.getSafeWorkingDir(), timeout },\n          (error, stdout, stderr) => {\n            resolve({ stdout: stdout, stderr: stderr, error });\n          },\n        );\n      } catch (err: any) {\n        reject(err);\n      }\n    });\n  },\n};\n\n/**\n * This credential will use the currently logged-in user login information\n * via the Azure CLI ('az') commandline tool.\n * To do so, it will read the user access token and expire time\n * with Azure CLI command \"az account get-access-token\".\n */\nexport class AzureCliCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n  private subscription?: string;\n\n  /**\n   * Creates an instance of the {@link AzureCliCredential}.\n   *\n   * To use this credential, ensure that you have already logged\n   * in via the 'az' tool using the command \"az login\" from the commandline.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzureCliCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    if (options?.subscription) {\n      checkSubscription(logger, options?.subscription);\n      this.subscription = options?.subscription;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    const scope = typeof scopes === \"string\" ? scopes : scopes[0];\n    const claimsValue = options.claims;\n    if (claimsValue && claimsValue.trim()) {\n      const encodedClaims = btoa(claimsValue);\n      let loginCmd = `az login --claims-challenge ${encodedClaims} --scope ${scope}`;\n\n      const tenantIdFromOptions = options.tenantId;\n      if (tenantIdFromOptions) {\n        loginCmd += ` --tenant ${tenantIdFromOptions}`;\n      }\n\n      const error = new CredentialUnavailableError(\n        `${azureCliPublicErrorMessages.claim} ${loginCmd}`,\n      );\n      logger.getToken.info(formatError(scope, error));\n      throw error;\n    }\n\n    const tenantId = processMultiTenantRequest(\n      this.tenantId,\n      options,\n      this.additionallyAllowedTenantIds,\n    );\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    if (this.subscription) {\n      checkSubscription(logger, this.subscription);\n    }\n    logger.getToken.info(`Using the scope ${scope}`);\n\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      try {\n        ensureValidScopeForDevTimeCreds(scope, logger);\n        const resource = getScopeResource(scope);\n        const obj = await cliCredentialInternals.getAzureCliAccessToken(\n          resource,\n          tenantId,\n          this.subscription,\n          this.timeout,\n        );\n        const specificScope = obj.stderr?.match(\"(.*)az login --scope(.*)\");\n        const isLoginError = obj.stderr?.match(\"(.*)az login(.*)\") && !specificScope;\n        const isNotInstallError =\n          obj.stderr?.match(\"az:(.*)not found\") || obj.stderr?.startsWith(\"'az' is not recognized\");\n\n        if (isNotInstallError) {\n          const error = new CredentialUnavailableError(azureCliPublicErrorMessages.notInstalled);\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n        if (isLoginError) {\n          const error = new CredentialUnavailableError(azureCliPublicErrorMessages.login);\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n        try {\n          const responseData = obj.stdout;\n          const response: AccessToken = this.parseRawResponse(responseData);\n          logger.getToken.info(formatSuccess(scopes));\n          return response;\n        } catch (e: any) {\n          if (obj.stderr) {\n            throw new CredentialUnavailableError(obj.stderr);\n          }\n          throw e;\n        }\n      } catch (err: any) {\n        const error =\n          err.name === \"CredentialUnavailableError\"\n            ? err\n            : new CredentialUnavailableError(\n                (err as Error).message || azureCliPublicErrorMessages.unknown,\n              );\n        logger.getToken.info(formatError(scopes, error));\n        throw error;\n      }\n    });\n  }\n\n  /**\n   * Parses the raw JSON response from the Azure CLI into a usable AccessToken object\n   *\n   * @param rawResponse - The raw JSON response from the Azure CLI\n   * @returns An access token with the expiry time parsed from the raw response\n   *\n   * The expiryTime of the credential's access token, in milliseconds, is calculated as follows:\n   *\n   * When available, expires_on (introduced in Azure CLI v2.54.0) will be preferred. Otherwise falls back to expiresOn.\n   */\n  private parseRawResponse(rawResponse: string): AccessToken {\n    const response: any = JSON.parse(rawResponse);\n    const token = response.accessToken;\n    // if available, expires_on will be a number representing seconds since epoch.\n    // ensure it's a number or NaN\n    let expiresOnTimestamp = Number.parseInt(response.expires_on, 10) * 1000;\n    if (!isNaN(expiresOnTimestamp)) {\n      logger.getToken.info(\"expires_on is available and is valid, using it\");\n      return {\n        token,\n        expiresOnTimestamp,\n        tokenType: \"Bearer\",\n      };\n    }\n\n    // fallback to the older expiresOn - an RFC3339 date string\n    expiresOnTimestamp = new Date(response.expiresOn).getTime();\n\n    // ensure expiresOn is well-formatted\n    if (isNaN(expiresOnTimestamp)) {\n      throw new CredentialUnavailableError(\n        `${azureCliPublicErrorMessages.unexpectedResponse} \"${response.expiresOn}\"`,\n      );\n    }\n\n    return {\n      token,\n      expiresOnTimestamp,\n      tokenType: \"Bearer\",\n    };\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,2BAIO;AACP,qBAA6D;AAC7D,wBAAkE;AAGlE,oBAA2C;AAC3C,2BAA0B;AAC1B,qBAA8B;AAC9B,+BAAkC;AAElC,MAAM,aAAS,iCAAiB,oBAAoB;AAM7C,MAAM,8BAA8B;AAAA,EACzC,OACE;AAAA,EACF,cACE;AAAA,EACF,OACE;AAAA,EACF,SAAS;AAAA,EACT,oBACE;AACJ;AAMO,MAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA,EAIpC,oBAA4B;AAC1B,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI,aAAa,QAAQ,IAAI,cAAc,QAAQ,IAAI,YAAY;AACnE,UAAI,CAAC,YAAY;AACf,eAAO,SAAS;AAAA,UACd;AAAA,QACF;AAEA,qBAAa;AAAA,MACf;AACA,aAAO;AAAA,IACT,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,uBACJ,UACA,UACA,cACA,SACkE;AAClE,QAAI,gBAA0B,CAAC;AAC/B,QAAI,sBAAgC,CAAC;AACrC,QAAI,UAAU;AACZ,sBAAgB,CAAC,YAAY,QAAQ;AAAA,IACvC;AACA,QAAI,cAAc;AAEhB,4BAAsB,CAAC,kBAAkB,IAAI,YAAY,GAAG;AAAA,IAC9D;AACA,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI;AACF,cAAM,OAAO;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AACA,cAAM,UAAU,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,GAAG;AACxC,6BAAAA,QAAc;AAAA,UACZ;AAAA,UACA,EAAE,KAAK,uBAAuB,kBAAkB,GAAG,QAAQ;AAAA,UAC3D,CAAC,OAAO,QAAQ,WAAW;AACzB,oBAAQ,EAAE,QAAgB,QAAgB,MAAM,CAAC;AAAA,UACnD;AAAA,QACF;AAAA,MACF,SAAS,KAAU;AACjB,eAAO,GAAG;AAAA,MACZ;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAQO,MAAM,mBAA8C;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUR,YAAY,SAAqC;AAC/C,QAAI,SAAS,UAAU;AACrB,8CAAc,QAAQ,SAAS,QAAQ;AACvC,WAAK,WAAW,SAAS;AAAA,IAC3B;AACA,QAAI,SAAS,cAAc;AACzB,sDAAkB,QAAQ,SAAS,YAAY;AAC/C,WAAK,eAAe,SAAS;AAAA,IAC/B;AACA,SAAK,mCAA+B;AAAA,MAClC,SAAS;AAAA,IACX;AACA,SAAK,UAAU,SAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,SACX,QACA,UAA2B,CAAC,GACN;AACtB,UAAM,QAAQ,OAAO,WAAW,WAAW,SAAS,OAAO,CAAC;AAC5D,UAAM,cAAc,QAAQ;AAC5B,QAAI,eAAe,YAAY,KAAK,GAAG;AACrC,YAAM,gBAAgB,KAAK,WAAW;AACtC,UAAI,WAAW,+BAA+B,aAAa,YAAY,KAAK;AAE5E,YAAM,sBAAsB,QAAQ;AACpC,UAAI,qBAAqB;AACvB,oBAAY,aAAa,mBAAmB;AAAA,MAC9C;AAEA,YAAM,QAAQ,IAAI;AAAA,QAChB,GAAG,4BAA4B,KAAK,IAAI,QAAQ;AAAA,MAClD;AACA,aAAO,SAAS,SAAK,4BAAY,OAAO,KAAK,CAAC;AAC9C,YAAM;AAAA,IACR;AAEA,UAAM,eAAW;AAAA,MACf,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,IACP;AACA,QAAI,UAAU;AACZ,8CAAc,QAAQ,QAAQ;AAAA,IAChC;AACA,QAAI,KAAK,cAAc;AACrB,sDAAkB,QAAQ,KAAK,YAAY;AAAA,IAC7C;AACA,WAAO,SAAS,KAAK,mBAAmB,KAAK,EAAE;AAE/C,WAAO,6BAAc,SAAS,GAAG,KAAK,YAAY,IAAI,aAAa,SAAS,YAAY;AACtF,UAAI;AACF,+DAAgC,OAAO,MAAM;AAC7C,cAAM,eAAW,oCAAiB,KAAK;AACvC,cAAM,MAAM,MAAM,uBAAuB;AAAA,UACvC;AAAA,UACA;AAAA,UACA,KAAK;AAAA,UACL,KAAK;AAAA,QACP;AACA,cAAM,gBAAgB,IAAI,QAAQ,MAAM,0BAA0B;AAClE,cAAM,eAAe,IAAI,QAAQ,MAAM,kBAAkB,KAAK,CAAC;AAC/D,cAAM,oBACJ,IAAI,QAAQ,MAAM,kBAAkB,KAAK,IAAI,QAAQ,WAAW,wBAAwB;AAE1F,YAAI,mBAAmB;AACrB,gBAAM,QAAQ,IAAI,yCAA2B,4BAA4B,YAAY;AACrF,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AACA,YAAI,cAAc;AAChB,gBAAM,QAAQ,IAAI,yCAA2B,4BAA4B,KAAK;AAC9E,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AACA,YAAI;AACF,gBAAM,eAAe,IAAI;AACzB,gBAAM,WAAwB,KAAK,iBAAiB,YAAY;AAChE,iBAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC1C,iBAAO;AAAA,QACT,SAAS,GAAQ;AACf,cAAI,IAAI,QAAQ;AACd,kBAAM,IAAI,yCAA2B,IAAI,MAAM;AAAA,UACjD;AACA,gBAAM;AAAA,QACR;AAAA,MACF,SAAS,KAAU;AACjB,cAAM,QACJ,IAAI,SAAS,+BACT,MACA,IAAI;AAAA,UACD,IAAc,WAAW,4BAA4B;AAAA,QACxD;AACN,eAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,iBAAiB,aAAkC;AACzD,UAAM,WAAgB,KAAK,MAAM,WAAW;AAC5C,UAAM,QAAQ,SAAS;AAGvB,QAAI,qBAAqB,OAAO,SAAS,SAAS,YAAY,EAAE,IAAI;AACpE,QAAI,CAAC,MAAM,kBAAkB,GAAG;AAC9B,aAAO,SAAS,KAAK,gDAAgD;AACrE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,WAAW;AAAA,MACb;AAAA,IACF;AAGA,yBAAqB,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AAG1D,QAAI,MAAM,kBAAkB,GAAG;AAC7B,YAAM,IAAI;AAAA,QACR,GAAG,4BAA4B,kBAAkB,KAAK,SAAS,SAAS;AAAA,MAC1E;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAAA,EACF;AACF;",
-  "names": ["child_process"]
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport { ensureValidScopeForDevTimeCreds, getScopeResource } from \"../util/scopeUtils.js\";\n\nimport type { AzureCliCredentialOptions } from \"./azureCliCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport { uint8ArrayToString, stringToUint8Array } from \"@azure/core-util\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { checkSubscription } from \"../util/subscriptionUtils.js\";\nimport { processUtils } from \"../util/processUtils.js\";\nimport { isProcessError } from \"@azure/core-process\";\n\nconst logger = credentialLogger(\"AzureCliCredential\");\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const azureCliPublicErrorMessages = {\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n  notInstalled:\n    \"Azure CLI could not be found. Please visit https://aka.ms/azure-cli for installation instructions and then, once installed, authenticate to your Azure account using 'az login'.\",\n  login:\n    \"Please run 'az login' from a command prompt to authenticate before using this credential.\",\n  unknown: \"Unknown error while trying to retrieve the access token\",\n  unexpectedResponse:\n    'Unexpected response from Azure CLI when getting token. Expected \"expiresOn\" to be a RFC3339 date string. Got:',\n};\n\n/**\n * Mockable reference to the CLI credential cliCredentialFunctions\n * @internal\n */\nexport const cliCredentialInternals = {\n  /**\n   * @internal\n   */\n  getSafeWorkingDir(): string {\n    if (process.platform === \"win32\") {\n      let systemRoot = process.env.SystemRoot || process.env[\"SYSTEMROOT\"];\n      if (!systemRoot) {\n        logger.getToken.warning(\n          \"The SystemRoot environment variable is not set. This may cause issues when using the Azure CLI credential.\",\n        );\n\n        systemRoot = \"C:\\\\Windows\";\n      }\n      return systemRoot;\n    } else {\n      return \"/bin\";\n    }\n  },\n\n  /**\n   * Gets the access token from Azure CLI\n   * @param resource - The resource to use when getting the token\n   * @internal\n   */\n  async getAzureCliAccessToken(\n    resource: string,\n    tenantId?: string,\n    subscription?: string,\n    timeout?: number,\n  ): Promise<{ stdout: string; stderr: string; error: Error | null }> {\n    let tenantSection: string[] = [];\n    let subscriptionSection: string[] = [];\n    if (tenantId) {\n      tenantSection = [\"--tenant\", tenantId];\n    }\n    if (subscription) {\n      subscriptionSection = [\"--subscription\", subscription];\n    }\n    const args = [\n      \"account\",\n      \"get-access-token\",\n      \"--output\",\n      \"json\",\n      \"--resource\",\n      resource,\n      ...tenantSection,\n      ...subscriptionSection,\n    ];\n    return processUtils.execFileWithResult(\"az\", args, {\n      allowWindowsBatchFiles: true,\n      cwd: cliCredentialInternals.getSafeWorkingDir(),\n      encoding: \"utf8\",\n      timeout,\n    });\n  },\n};\n\n/**\n * This credential will use the currently logged-in user login information\n * via the Azure CLI ('az') commandline tool.\n * To do so, it will read the user access token and expire time\n * with Azure CLI command \"az account get-access-token\".\n */\nexport class AzureCliCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n  private subscription?: string;\n\n  /**\n   * Creates an instance of the {@link AzureCliCredential}.\n   *\n   * To use this credential, ensure that you have already logged\n   * in via the 'az' tool using the command \"az login\" from the commandline.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzureCliCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    if (options?.subscription) {\n      checkSubscription(logger, options?.subscription);\n      this.subscription = options?.subscription;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    const scope = typeof scopes === \"string\" ? scopes : scopes[0];\n    const claimsValue = options.claims;\n    if (claimsValue && claimsValue.trim()) {\n      const encodedClaims = uint8ArrayToString(stringToUint8Array(claimsValue, \"utf-8\"), \"base64\");\n      let loginCmd = `az login --claims-challenge ${encodedClaims} --scope ${scope}`;\n\n      const tenantIdFromOptions = options.tenantId;\n      if (tenantIdFromOptions) {\n        loginCmd += ` --tenant ${tenantIdFromOptions}`;\n      }\n\n      const error = new CredentialUnavailableError(\n        `${azureCliPublicErrorMessages.claim} ${loginCmd}`,\n      );\n      logger.getToken.info(formatError(scope, error));\n      throw error;\n    }\n\n    const tenantId = processMultiTenantRequest(\n      this.tenantId,\n      options,\n      this.additionallyAllowedTenantIds,\n    );\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    if (this.subscription) {\n      checkSubscription(logger, this.subscription);\n    }\n    logger.getToken.info(`Using the scope ${scope}`);\n\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      try {\n        ensureValidScopeForDevTimeCreds(scope, logger);\n        const resource = getScopeResource(scope);\n        const obj = await cliCredentialInternals.getAzureCliAccessToken(\n          resource,\n          tenantId,\n          this.subscription,\n          this.timeout,\n        );\n        const specificScope = obj.stderr?.match(\"(.*)az login --scope(.*)\");\n        const isLoginError = obj.stderr?.match(\"(.*)az login(.*)\") && !specificScope;\n        const isNotInstallError =\n          obj.stderr?.match(\"az:(.*)not found\") ||\n          obj.stderr?.startsWith(\"'az' is not recognized\") ||\n          (obj.error && isProcessError(obj.error) && obj.error.code === \"ENOENT\");\n\n        if (isNotInstallError) {\n          const error = new CredentialUnavailableError(azureCliPublicErrorMessages.notInstalled);\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n        if (isLoginError) {\n          const error = new CredentialUnavailableError(azureCliPublicErrorMessages.login);\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n        try {\n          const responseData = obj.stdout;\n          const response: AccessToken = this.parseRawResponse(responseData);\n          logger.getToken.info(formatSuccess(scopes));\n          return response;\n        } catch (e: any) {\n          if (obj.stderr) {\n            throw new CredentialUnavailableError(obj.stderr);\n          }\n          throw e;\n        }\n      } catch (err: any) {\n        const error =\n          err.name === \"CredentialUnavailableError\"\n            ? err\n            : new CredentialUnavailableError(\n                (err as Error).message || azureCliPublicErrorMessages.unknown,\n              );\n        logger.getToken.info(formatError(scopes, error));\n        throw error;\n      }\n    });\n  }\n\n  /**\n   * Parses the raw JSON response from the Azure CLI into a usable AccessToken object\n   *\n   * @param rawResponse - The raw JSON response from the Azure CLI\n   * @returns An access token with the expiry time parsed from the raw response\n   *\n   * The expiryTime of the credential's access token, in milliseconds, is calculated as follows:\n   *\n   * When available, expires_on (introduced in Azure CLI v2.54.0) will be preferred. Otherwise falls back to expiresOn.\n   */\n  private parseRawResponse(rawResponse: string): AccessToken {\n    const response: any = JSON.parse(rawResponse);\n    const token = response.accessToken;\n    // if available, expires_on will be a number representing seconds since epoch.\n    // ensure it's a number or NaN\n    let expiresOnTimestamp = Number.parseInt(response.expires_on, 10) * 1000;\n    if (!isNaN(expiresOnTimestamp)) {\n      logger.getToken.info(\"expires_on is available and is valid, using it\");\n      return {\n        token,\n        expiresOnTimestamp,\n        tokenType: \"Bearer\",\n      };\n    }\n\n    // fallback to the older expiresOn - an RFC3339 date string\n    expiresOnTimestamp = new Date(response.expiresOn).getTime();\n\n    // ensure expiresOn is well-formatted\n    if (isNaN(expiresOnTimestamp)) {\n      throw new CredentialUnavailableError(\n        `${azureCliPublicErrorMessages.unexpectedResponse} \"${response.expiresOn}\"`,\n      );\n    }\n\n    return {\n      token,\n      expiresOnTimestamp,\n      tokenType: \"Bearer\",\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,2BAIO;AACP,qBAA6D;AAC7D,wBAAkE;AAGlE,oBAA2C;AAC3C,uBAAuD;AACvD,qBAA8B;AAC9B,+BAAkC;AAClC,0BAA6B;AAC7B,0BAA+B;AAE/B,MAAM,aAAS,iCAAiB,oBAAoB;AAM7C,MAAM,8BAA8B;AAAA,EACzC,OACE;AAAA,EACF,cACE;AAAA,EACF,OACE;AAAA,EACF,SAAS;AAAA,EACT,oBACE;AACJ;AAMO,MAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA,EAIpC,oBAA4B;AAC1B,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI,aAAa,QAAQ,IAAI,cAAc,QAAQ,IAAI,YAAY;AACnE,UAAI,CAAC,YAAY;AACf,eAAO,SAAS;AAAA,UACd;AAAA,QACF;AAEA,qBAAa;AAAA,MACf;AACA,aAAO;AAAA,IACT,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,uBACJ,UACA,UACA,cACA,SACkE;AAClE,QAAI,gBAA0B,CAAC;AAC/B,QAAI,sBAAgC,CAAC;AACrC,QAAI,UAAU;AACZ,sBAAgB,CAAC,YAAY,QAAQ;AAAA,IACvC;AACA,QAAI,cAAc;AAChB,4BAAsB,CAAC,kBAAkB,YAAY;AAAA,IACvD;AACA,UAAM,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG;AAAA,MACH,GAAG;AAAA,IACL;AACA,WAAO,iCAAa,mBAAmB,MAAM,MAAM;AAAA,MACjD,wBAAwB;AAAA,MACxB,KAAK,uBAAuB,kBAAkB;AAAA,MAC9C,UAAU;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAQO,MAAM,mBAA8C;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUR,YAAY,SAAqC;AAC/C,QAAI,SAAS,UAAU;AACrB,8CAAc,QAAQ,SAAS,QAAQ;AACvC,WAAK,WAAW,SAAS;AAAA,IAC3B;AACA,QAAI,SAAS,cAAc;AACzB,sDAAkB,QAAQ,SAAS,YAAY;AAC/C,WAAK,eAAe,SAAS;AAAA,IAC/B;AACA,SAAK,mCAA+B;AAAA,MAClC,SAAS;AAAA,IACX;AACA,SAAK,UAAU,SAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,SACX,QACA,UAA2B,CAAC,GACN;AACtB,UAAM,QAAQ,OAAO,WAAW,WAAW,SAAS,OAAO,CAAC;AAC5D,UAAM,cAAc,QAAQ;AAC5B,QAAI,eAAe,YAAY,KAAK,GAAG;AACrC,YAAM,oBAAgB,yCAAmB,qCAAmB,aAAa,OAAO,GAAG,QAAQ;AAC3F,UAAI,WAAW,+BAA+B,aAAa,YAAY,KAAK;AAE5E,YAAM,sBAAsB,QAAQ;AACpC,UAAI,qBAAqB;AACvB,oBAAY,aAAa,mBAAmB;AAAA,MAC9C;AAEA,YAAM,QAAQ,IAAI;AAAA,QAChB,GAAG,4BAA4B,KAAK,IAAI,QAAQ;AAAA,MAClD;AACA,aAAO,SAAS,SAAK,4BAAY,OAAO,KAAK,CAAC;AAC9C,YAAM;AAAA,IACR;AAEA,UAAM,eAAW;AAAA,MACf,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,IACP;AACA,QAAI,UAAU;AACZ,8CAAc,QAAQ,QAAQ;AAAA,IAChC;AACA,QAAI,KAAK,cAAc;AACrB,sDAAkB,QAAQ,KAAK,YAAY;AAAA,IAC7C;AACA,WAAO,SAAS,KAAK,mBAAmB,KAAK,EAAE;AAE/C,WAAO,6BAAc,SAAS,GAAG,KAAK,YAAY,IAAI,aAAa,SAAS,YAAY;AACtF,UAAI;AACF,+DAAgC,OAAO,MAAM;AAC7C,cAAM,eAAW,oCAAiB,KAAK;AACvC,cAAM,MAAM,MAAM,uBAAuB;AAAA,UACvC;AAAA,UACA;AAAA,UACA,KAAK;AAAA,UACL,KAAK;AAAA,QACP;AACA,cAAM,gBAAgB,IAAI,QAAQ,MAAM,0BAA0B;AAClE,cAAM,eAAe,IAAI,QAAQ,MAAM,kBAAkB,KAAK,CAAC;AAC/D,cAAM,oBACJ,IAAI,QAAQ,MAAM,kBAAkB,KACpC,IAAI,QAAQ,WAAW,wBAAwB,KAC9C,IAAI,aAAS,oCAAe,IAAI,KAAK,KAAK,IAAI,MAAM,SAAS;AAEhE,YAAI,mBAAmB;AACrB,gBAAM,QAAQ,IAAI,yCAA2B,4BAA4B,YAAY;AACrF,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AACA,YAAI,cAAc;AAChB,gBAAM,QAAQ,IAAI,yCAA2B,4BAA4B,KAAK;AAC9E,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AACA,YAAI;AACF,gBAAM,eAAe,IAAI;AACzB,gBAAM,WAAwB,KAAK,iBAAiB,YAAY;AAChE,iBAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC1C,iBAAO;AAAA,QACT,SAAS,GAAQ;AACf,cAAI,IAAI,QAAQ;AACd,kBAAM,IAAI,yCAA2B,IAAI,MAAM;AAAA,UACjD;AACA,gBAAM;AAAA,QACR;AAAA,MACF,SAAS,KAAU;AACjB,cAAM,QACJ,IAAI,SAAS,+BACT,MACA,IAAI;AAAA,UACD,IAAc,WAAW,4BAA4B;AAAA,QACxD;AACN,eAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,iBAAiB,aAAkC;AACzD,UAAM,WAAgB,KAAK,MAAM,WAAW;AAC5C,UAAM,QAAQ,SAAS;AAGvB,QAAI,qBAAqB,OAAO,SAAS,SAAS,YAAY,EAAE,IAAI;AACpE,QAAI,CAAC,MAAM,kBAAkB,GAAG;AAC9B,aAAO,SAAS,KAAK,gDAAgD;AACrE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,WAAW;AAAA,MACb;AAAA,IACF;AAGA,yBAAqB,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AAG1D,QAAI,MAAM,kBAAkB,GAAG;AAC7B,YAAM,IAAI;AAAA,QACR,GAAG,4BAA4B,kBAAkB,KAAK,SAAS,SAAS;AAAA,MAC1E;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAAA,EACF;AACF;",
+  "names": []
 }

package/dist/commonjs/credentials/azureDeveloperCliCredential.d.ts

@@ -16,10 +16,18 @@ export declare const azureDeveloperCliPublicErrorMessages: {
  */
 export declare const developerCliCredentialInternals: {
     /**
-     * Parses azd stderr JSON output to extract the error message.
-     * azd outputs JSON like: \{"type":"consoleMessage","timestamp":"...","data":\{"message":"ERROR: ..."\}\}
-     * If parsing succeeds and .data.message exists, returns the trimmed message.
-     * Otherwise, returns the raw stderr.
+     * Parses azd stderr JSON output to extract a human-readable error message.
+     *
+     * Three formats are supported across azd versions:
+     * - pre-v1.23.7: `{"type":"consoleMessage","data":{"message":"..."}}`
+     * - v1.23.7 - v1.23.15: an empty `consoleMessage` line followed by `{"error":"...","message":"...","suggestion":"..."}`
+     * - v1.24.0+: `{"error":"...","message":"...","suggestion":"..."}`
+     *
+     * The structured `error` field is preferred. If absent, falls back to the
+     * first non-empty `data.message` from a legacy `consoleMessage` line. If
+     * neither is found, the raw stderr is returned unchanged so plain-text and
+     * malformed output continue to surface to callers.
+     *
      * @param stderr - The stderr output from azd command
      * @returns The parsed error message or raw stderr
      * @internal

package/dist/commonjs/credentials/azureDeveloperCliCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"azureDeveloperCliCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azureDeveloperCliCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEtF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAalG;;;GAGG;AACH,eAAO,MAAM,oCAAoC;;;;;CAQhD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;;;OAQG;2BACoB,MAAM,GAAG,MAAM;IAatC;;OAEG;yBACkB,MAAM;IAiB3B;;;;OAIG;8BAEO,MAAM,EAAE,aACL,MAAM,YACP,MAAM,WACP,MAAM,GACd,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,CAAC;CA0CpE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,2BAA4B,YAAW,eAAe;IACjE,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,OAAO,CAAC,CAAS;IAEzB;;;;;;;OAOG;gBACS,OAAO,CAAC,EAAE,kCAAkC;IAWxD;;;;;;;OAOG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,CAAC;CAyFxB"}
+{"version":3,"file":"azureDeveloperCliCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azureDeveloperCliCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEtF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAclG;;;GAGG;AACH,eAAO,MAAM,oCAAoC;;;;;CAQhD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;;;;;;;;;;;OAgBG;2BACoB,MAAM,GAAG,MAAM;IAoCtC;;OAEG;yBACkB,MAAM;IAiB3B;;;;OAIG;8BAEO,MAAM,EAAE,aACL,MAAM,YACP,MAAM,WACP,MAAM,GACd,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,CAAC;CA4BpE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,2BAA4B,YAAW,eAAe;IACjE,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,OAAO,CAAC,CAAS;IAEzB;;;;;;;OAOG;gBACS,OAAO,CAAC,EAAE,kCAAkC;IAWxD;;;;;;;OAOG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,CAAC;CAyFxB"}

package/dist/commonjs/credentials/azureDeveloperCliCredential.js

@@ -1,8 +1,6 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -16,14 +14,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var azureDeveloperCliCredential_exports = {};
 __export(azureDeveloperCliCredential_exports, {
@@ -34,10 +24,11 @@ __export(azureDeveloperCliCredential_exports, {
 module.exports = __toCommonJS(azureDeveloperCliCredential_exports);
 var import_logging = require("../util/logging.js");
 var import_errors = require("../errors.js");
-var import_child_process = __toESM(require("child_process"));
 var import_tenantIdUtils = require("../util/tenantIdUtils.js");
 var import_tracing = require("../util/tracing.js");
 var import_scopeUtils = require("../util/scopeUtils.js");
+var import_core_util = require("@azure/core-util");
+var import_processUtils = require("../util/processUtils.js");
 const logger = (0, import_logging.credentialLogger)("AzureDeveloperCliCredential");
 const azureDeveloperCliPublicErrorMessages = {
   notInstalled: "Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.",
@@ -47,24 +38,49 @@ const azureDeveloperCliPublicErrorMessages = {
 };
 const developerCliCredentialInternals = {
   /**
-   * Parses azd stderr JSON output to extract the error message.
-   * azd outputs JSON like: \{"type":"consoleMessage","timestamp":"...","data":\{"message":"ERROR: ..."\}\}
-   * If parsing succeeds and .data.message exists, returns the trimmed message.
-   * Otherwise, returns the raw stderr.
+   * Parses azd stderr JSON output to extract a human-readable error message.
+   *
+   * Three formats are supported across azd versions:
+   * - pre-v1.23.7: `{"type":"consoleMessage","data":{"message":"..."}}`
+   * - v1.23.7 - v1.23.15: an empty `consoleMessage` line followed by `{"error":"...","message":"...","suggestion":"..."}`
+   * - v1.24.0+: `{"error":"...","message":"...","suggestion":"..."}`
+   *
+   * The structured `error` field is preferred. If absent, falls back to the
+   * first non-empty `data.message` from a legacy `consoleMessage` line. If
+   * neither is found, the raw stderr is returned unchanged so plain-text and
+   * malformed output continue to surface to callers.
+   *
    * @param stderr - The stderr output from azd command
    * @returns The parsed error message or raw stderr
    * @internal
    */
   parseAzdStderr(stderr) {
-    try {
-      const parsed = JSON.parse(stderr);
-      const message = parsed?.data?.message;
-      if (typeof message === "string" && message.trim().length > 0) {
-        return message.trim();
+    if (!stderr?.trim()) {
+      return stderr;
+    }
+    let fallback;
+    for (const rawLine of stderr.split("\n")) {
+      const line = rawLine.trim();
+      if (!line.startsWith("{")) {
+        continue;
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (typeof parsed?.error === "string" && parsed.error.trim()) {
+        return parsed.error.trim();
+      }
+      if (fallback === void 0) {
+        const message = parsed?.data?.message;
+        if (typeof message === "string" && message.trim()) {
+          fallback = message.trim();
+        }
       }
-    } catch {
     }
-    return stderr;
+    return fallback ?? stderr;
   },
   /**
    * @internal
@@ -95,38 +111,24 @@ const developerCliCredentialInternals = {
     }
     let claimsSections = [];
     if (claims) {
-      const encodedClaims = btoa(claims);
+      const encodedClaims = (0, import_core_util.uint8ArrayToString)((0, import_core_util.stringToUint8Array)(claims, "utf-8"), "base64");
       claimsSections = ["--claims", encodedClaims];
     }
-    return new Promise((resolve, reject) => {
-      try {
-        const args = [
-          "auth",
-          "token",
-          "--output",
-          "json",
-          "--no-prompt",
-          ...scopes.reduce(
-            (previous, current) => previous.concat("--scope", current),
-            []
-          ),
-          ...tenantSection,
-          ...claimsSections
-        ];
-        const command = ["azd", ...args].join(" ");
-        import_child_process.default.exec(
-          command,
-          {
-            cwd: developerCliCredentialInternals.getSafeWorkingDir(),
-            timeout
-          },
-          (error, stdout, stderr) => {
-            resolve({ stdout, stderr, error });
-          }
-        );
-      } catch (err) {
-        reject(err);
-      }
+    const args = [
+      "auth",
+      "token",
+      "--output",
+      "json",
+      "--no-prompt",
+      ...scopes.reduce((previous, current) => previous.concat("--scope", current), []),
+      ...tenantSection,
+      ...claimsSections
+    ];
+    return import_processUtils.processUtils.execFileWithResult("azd", args, {
+      allowWindowsBatchFiles: true,
+      cwd: developerCliCredentialInternals.getSafeWorkingDir(),
+      encoding: "utf8",
+      timeout
     });
   }
 };

package/dist/commonjs/credentials/azureDeveloperCliCredential.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/credentials/azureDeveloperCliCredential.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport type { AzureDeveloperCliCredentialOptions } from \"./azureDeveloperCliCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport child_process from \"child_process\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { ensureValidScopeForDevTimeCreds } from \"../util/scopeUtils.js\";\n\nconst logger = credentialLogger(\"AzureDeveloperCliCredential\");\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const azureDeveloperCliPublicErrorMessages = {\n  notInstalled:\n    \"Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.\",\n  login:\n    \"Please run 'azd auth login' from a command prompt to authenticate before using this credential. For more information, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.\",\n  unknown: \"Unknown error while trying to retrieve the access token\",\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n};\n\n/**\n * Mockable reference to the Developer CLI credential cliCredentialFunctions\n * @internal\n */\nexport const developerCliCredentialInternals = {\n  /**\n   * Parses azd stderr JSON output to extract the error message.\n   * azd outputs JSON like: \\{\"type\":\"consoleMessage\",\"timestamp\":\"...\",\"data\":\\{\"message\":\"ERROR: ...\"\\}\\}\n   * If parsing succeeds and .data.message exists, returns the trimmed message.\n   * Otherwise, returns the raw stderr.\n   * @param stderr - The stderr output from azd command\n   * @returns The parsed error message or raw stderr\n   * @internal\n   */\n  parseAzdStderr(stderr: string): string {\n    try {\n      const parsed = JSON.parse(stderr);\n      const message = parsed?.data?.message;\n      if (typeof message === \"string\" && message.trim().length > 0) {\n        return message.trim();\n      }\n    } catch {\n      // If JSON parsing fails, fall through to return raw stderr\n    }\n    return stderr;\n  },\n\n  /**\n   * @internal\n   */\n  getSafeWorkingDir(): string {\n    if (process.platform === \"win32\") {\n      let systemRoot = process.env.SystemRoot || process.env[\"SYSTEMROOT\"];\n      if (!systemRoot) {\n        logger.getToken.warning(\n          \"The SystemRoot environment variable is not set. This may cause issues when using the Azure Developer CLI credential.\",\n        );\n\n        systemRoot = \"C:\\\\Windows\";\n      }\n\n      return systemRoot;\n    } else {\n      return \"/bin\";\n    }\n  },\n\n  /**\n   * Gets the access token from Azure Developer CLI\n   * @param scopes - The scopes to use when getting the token\n   * @internal\n   */\n  async getAzdAccessToken(\n    scopes: string[],\n    tenantId?: string,\n    timeout?: number,\n    claims?: string,\n  ): Promise<{ stdout: string; stderr: string; error: Error | null }> {\n    let tenantSection: string[] = [];\n    if (tenantId) {\n      tenantSection = [\"--tenant-id\", tenantId];\n    }\n\n    let claimsSections: string[] = [];\n    if (claims) {\n      const encodedClaims = btoa(claims);\n      claimsSections = [\"--claims\", encodedClaims];\n    }\n    return new Promise((resolve, reject) => {\n      try {\n        const args = [\n          \"auth\",\n          \"token\",\n          \"--output\",\n          \"json\",\n          \"--no-prompt\",\n          ...scopes.reduce<string[]>(\n            (previous, current) => previous.concat(\"--scope\", current),\n            [],\n          ),\n          ...tenantSection,\n          ...claimsSections,\n        ];\n        const command = [\"azd\", ...args].join(\" \");\n        child_process.exec(\n          command,\n          {\n            cwd: developerCliCredentialInternals.getSafeWorkingDir(),\n            timeout,\n          },\n          (error, stdout, stderr) => {\n            resolve({ stdout, stderr, error });\n          },\n        );\n      } catch (err: any) {\n        reject(err);\n      }\n    });\n  },\n};\n\n/**\n * Azure Developer CLI is a command-line interface tool that allows developers to create, manage, and deploy\n * resources in Azure. It's built on top of the Azure CLI and provides additional functionality specific\n * to Azure developers. It allows users to authenticate as a user and/or a service principal against\n * <a href=\"https://learn.microsoft.com/entra/fundamentals/\">Microsoft Entra ID</a>. The\n * AzureDeveloperCliCredential authenticates in a development environment and acquires a token on behalf of\n * the logged-in user or service principal in the Azure Developer CLI. It acts as the Azure Developer CLI logged in user or\n * service principal and executes an Azure CLI command underneath to authenticate the application against\n * Microsoft Entra ID.\n *\n * <h2> Configure AzureDeveloperCliCredential </h2>\n *\n * To use this credential, the developer needs to authenticate locally in Azure Developer CLI using one of the\n * commands below:\n *\n * <ol>\n *     <li>Run \"azd auth login\" in Azure Developer CLI to authenticate interactively as a user.</li>\n *     <li>Run \"azd auth login --client-id clientID --client-secret clientSecret\n *     --tenant-id tenantID\" to authenticate as a service principal.</li>\n * </ol>\n *\n * You may need to repeat this process after a certain time period, depending on the refresh token validity in your\n * organization. Generally, the refresh token validity period is a few weeks to a few months.\n * AzureDeveloperCliCredential will prompt you to sign in again.\n */\nexport class AzureDeveloperCliCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n\n  /**\n   * Creates an instance of the {@link AzureDeveloperCliCredential}.\n   *\n   * To use this credential, ensure that you have already logged\n   * in via the 'azd' tool using the command \"azd auth login\" from the commandline.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzureDeveloperCliCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    const tenantId = processMultiTenantRequest(\n      this.tenantId,\n      options,\n      this.additionallyAllowedTenantIds,\n    );\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    let scopeList: string[];\n    if (typeof scopes === \"string\") {\n      scopeList = [scopes];\n    } else {\n      scopeList = scopes;\n    }\n    logger.getToken.info(`Using the scopes ${scopes}`);\n\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      try {\n        scopeList.forEach((scope) => {\n          ensureValidScopeForDevTimeCreds(scope, logger);\n        });\n        const obj = await developerCliCredentialInternals.getAzdAccessToken(\n          scopeList,\n          tenantId,\n          this.timeout,\n          options.claims,\n        );\n        const isMFARequiredError =\n          obj.stderr?.match(\"must use multi-factor authentication\") ||\n          obj.stderr?.match(\"reauthentication required\");\n        const isNotLoggedInError =\n          obj.stderr?.match(\"not logged in, run `azd login` to login\") ||\n          obj.stderr?.match(\"not logged in, run `azd auth login` to login\");\n        const isNotInstallError =\n          obj.stderr?.match(\"azd:(.*)not found\") ||\n          obj.stderr?.startsWith(\"'azd' is not recognized\");\n        if (isNotInstallError || (obj.error && (obj.error as any).code === \"ENOENT\")) {\n          const error = new CredentialUnavailableError(\n            azureDeveloperCliPublicErrorMessages.notInstalled,\n          );\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n\n        if (isNotLoggedInError) {\n          const error = new CredentialUnavailableError(azureDeveloperCliPublicErrorMessages.login);\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n        if (isMFARequiredError) {\n          const scope = scopeList\n            .reduce<string[]>((previous, current) => previous.concat(\"--scope\", current), [])\n            .join(\" \");\n          const loginCmd = `azd auth login ${scope}`;\n          const error = new CredentialUnavailableError(\n            `${azureDeveloperCliPublicErrorMessages.claim} ${loginCmd}`,\n          );\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n\n        try {\n          const resp: { token: string; expiresOn: string } = JSON.parse(obj.stdout);\n          logger.getToken.info(formatSuccess(scopes));\n          return {\n            token: resp.token,\n            expiresOnTimestamp: new Date(resp.expiresOn).getTime(),\n            tokenType: \"Bearer\",\n          } as AccessToken;\n        } catch (e: any) {\n          if (obj.stderr) {\n            const errorMessage = developerCliCredentialInternals.parseAzdStderr(obj.stderr);\n            throw new CredentialUnavailableError(errorMessage);\n          }\n          throw e;\n        }\n      } catch (err: any) {\n        const error =\n          err.name === \"CredentialUnavailableError\"\n            ? err\n            : new CredentialUnavailableError(\n                (err as Error).message || azureDeveloperCliPublicErrorMessages.unknown,\n              );\n        logger.getToken.info(formatError(scopes, error));\n        throw error;\n      }\n    });\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,qBAA6D;AAE7D,oBAA2C;AAC3C,2BAA0B;AAC1B,2BAIO;AACP,qBAA8B;AAC9B,wBAAgD;AAEhD,MAAM,aAAS,iCAAiB,6BAA6B;AAMtD,MAAM,uCAAuC;AAAA,EAClD,cACE;AAAA,EACF,OACE;AAAA,EACF,SAAS;AAAA,EACT,OACE;AACJ;AAMO,MAAM,kCAAkC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU7C,eAAe,QAAwB;AACrC,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,MAAM;AAChC,YAAM,UAAU,QAAQ,MAAM;AAC9B,UAAI,OAAO,YAAY,YAAY,QAAQ,KAAK,EAAE,SAAS,GAAG;AAC5D,eAAO,QAAQ,KAAK;AAAA,MACtB;AAAA,IACF,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,oBAA4B;AAC1B,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI,aAAa,QAAQ,IAAI,cAAc,QAAQ,IAAI,YAAY;AACnE,UAAI,CAAC,YAAY;AACf,eAAO,SAAS;AAAA,UACd;AAAA,QACF;AAEA,qBAAa;AAAA,MACf;AAEA,aAAO;AAAA,IACT,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBACJ,QACA,UACA,SACA,QACkE;AAClE,QAAI,gBAA0B,CAAC;AAC/B,QAAI,UAAU;AACZ,sBAAgB,CAAC,eAAe,QAAQ;AAAA,IAC1C;AAEA,QAAI,iBAA2B,CAAC;AAChC,QAAI,QAAQ;AACV,YAAM,gBAAgB,KAAK,MAAM;AACjC,uBAAiB,CAAC,YAAY,aAAa;AAAA,IAC7C;AACA,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI;AACF,cAAM,OAAO;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,GAAG,OAAO;AAAA,YACR,CAAC,UAAU,YAAY,SAAS,OAAO,WAAW,OAAO;AAAA,YACzD,CAAC;AAAA,UACH;AAAA,UACA,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AACA,cAAM,UAAU,CAAC,OAAO,GAAG,IAAI,EAAE,KAAK,GAAG;AACzC,6BAAAA,QAAc;AAAA,UACZ;AAAA,UACA;AAAA,YACE,KAAK,gCAAgC,kBAAkB;AAAA,YACvD;AAAA,UACF;AAAA,UACA,CAAC,OAAO,QAAQ,WAAW;AACzB,oBAAQ,EAAE,QAAQ,QAAQ,MAAM,CAAC;AAAA,UACnC;AAAA,QACF;AAAA,MACF,SAAS,KAAU;AACjB,eAAO,GAAG;AAAA,MACZ;AAAA,IACF,CAAC;AAAA,EACH;AACF;AA2BO,MAAM,4BAAuD;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUR,YAAY,SAA8C;AACxD,QAAI,SAAS,UAAU;AACrB,8CAAc,QAAQ,SAAS,QAAQ;AACvC,WAAK,WAAW,SAAS;AAAA,IAC3B;AACA,SAAK,mCAA+B;AAAA,MAClC,SAAS;AAAA,IACX;AACA,SAAK,UAAU,SAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,SACX,QACA,UAA2B,CAAC,GACN;AACtB,UAAM,eAAW;AAAA,MACf,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,IACP;AACA,QAAI,UAAU;AACZ,8CAAc,QAAQ,QAAQ;AAAA,IAChC;AACA,QAAI;AACJ,QAAI,OAAO,WAAW,UAAU;AAC9B,kBAAY,CAAC,MAAM;AAAA,IACrB,OAAO;AACL,kBAAY;AAAA,IACd;AACA,WAAO,SAAS,KAAK,oBAAoB,MAAM,EAAE;AAEjD,WAAO,6BAAc,SAAS,GAAG,KAAK,YAAY,IAAI,aAAa,SAAS,YAAY;AACtF,UAAI;AACF,kBAAU,QAAQ,CAAC,UAAU;AAC3B,iEAAgC,OAAO,MAAM;AAAA,QAC/C,CAAC;AACD,cAAM,MAAM,MAAM,gCAAgC;AAAA,UAChD;AAAA,UACA;AAAA,UACA,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AACA,cAAM,qBACJ,IAAI,QAAQ,MAAM,sCAAsC,KACxD,IAAI,QAAQ,MAAM,2BAA2B;AAC/C,cAAM,qBACJ,IAAI,QAAQ,MAAM,yCAAyC,KAC3D,IAAI,QAAQ,MAAM,8CAA8C;AAClE,cAAM,oBACJ,IAAI,QAAQ,MAAM,mBAAmB,KACrC,IAAI,QAAQ,WAAW,yBAAyB;AAClD,YAAI,qBAAsB,IAAI,SAAU,IAAI,MAAc,SAAS,UAAW;AAC5E,gBAAM,QAAQ,IAAI;AAAA,YAChB,qCAAqC;AAAA,UACvC;AACA,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AAEA,YAAI,oBAAoB;AACtB,gBAAM,QAAQ,IAAI,yCAA2B,qCAAqC,KAAK;AACvF,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AACA,YAAI,oBAAoB;AACtB,gBAAM,QAAQ,UACX,OAAiB,CAAC,UAAU,YAAY,SAAS,OAAO,WAAW,OAAO,GAAG,CAAC,CAAC,EAC/E,KAAK,GAAG;AACX,gBAAM,WAAW,kBAAkB,KAAK;AACxC,gBAAM,QAAQ,IAAI;AAAA,YAChB,GAAG,qCAAqC,KAAK,IAAI,QAAQ;AAAA,UAC3D;AACA,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AAEA,YAAI;AACF,gBAAM,OAA6C,KAAK,MAAM,IAAI,MAAM;AACxE,iBAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC1C,iBAAO;AAAA,YACL,OAAO,KAAK;AAAA,YACZ,oBAAoB,IAAI,KAAK,KAAK,SAAS,EAAE,QAAQ;AAAA,YACrD,WAAW;AAAA,UACb;AAAA,QACF,SAAS,GAAQ;AACf,cAAI,IAAI,QAAQ;AACd,kBAAM,eAAe,gCAAgC,eAAe,IAAI,MAAM;AAC9E,kBAAM,IAAI,yCAA2B,YAAY;AAAA,UACnD;AACA,gBAAM;AAAA,QACR;AAAA,MACF,SAAS,KAAU;AACjB,cAAM,QACJ,IAAI,SAAS,+BACT,MACA,IAAI;AAAA,UACD,IAAc,WAAW,qCAAqC;AAAA,QACjE;AACN,eAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AACF;",
-  "names": ["child_process"]
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport type { AzureDeveloperCliCredentialOptions } from \"./azureDeveloperCliCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { ensureValidScopeForDevTimeCreds } from \"../util/scopeUtils.js\";\nimport { uint8ArrayToString, stringToUint8Array } from \"@azure/core-util\";\nimport { processUtils } from \"../util/processUtils.js\";\n\nconst logger = credentialLogger(\"AzureDeveloperCliCredential\");\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const azureDeveloperCliPublicErrorMessages = {\n  notInstalled:\n    \"Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.\",\n  login:\n    \"Please run 'azd auth login' from a command prompt to authenticate before using this credential. For more information, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.\",\n  unknown: \"Unknown error while trying to retrieve the access token\",\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n};\n\n/**\n * Mockable reference to the Developer CLI credential cliCredentialFunctions\n * @internal\n */\nexport const developerCliCredentialInternals = {\n  /**\n   * Parses azd stderr JSON output to extract a human-readable error message.\n   *\n   * Three formats are supported across azd versions:\n   * - pre-v1.23.7: `{\"type\":\"consoleMessage\",\"data\":{\"message\":\"...\"}}`\n   * - v1.23.7 - v1.23.15: an empty `consoleMessage` line followed by `{\"error\":\"...\",\"message\":\"...\",\"suggestion\":\"...\"}`\n   * - v1.24.0+: `{\"error\":\"...\",\"message\":\"...\",\"suggestion\":\"...\"}`\n   *\n   * The structured `error` field is preferred. If absent, falls back to the\n   * first non-empty `data.message` from a legacy `consoleMessage` line. If\n   * neither is found, the raw stderr is returned unchanged so plain-text and\n   * malformed output continue to surface to callers.\n   *\n   * @param stderr - The stderr output from azd command\n   * @returns The parsed error message or raw stderr\n   * @internal\n   */\n  parseAzdStderr(stderr: string): string {\n    if (!stderr?.trim()) {\n      return stderr;\n    }\n\n    let fallback: string | undefined;\n\n    for (const rawLine of stderr.split(\"\\n\")) {\n      const line = rawLine.trim();\n      if (!line.startsWith(\"{\")) {\n        continue;\n      }\n\n      let parsed: any;\n      try {\n        parsed = JSON.parse(line);\n      } catch {\n        // Not valid JSON on this line; continue.\n        continue;\n      }\n\n      if (typeof parsed?.error === \"string\" && parsed.error.trim()) {\n        return parsed.error.trim();\n      }\n\n      if (fallback === undefined) {\n        const message = parsed?.data?.message;\n        if (typeof message === \"string\" && message.trim()) {\n          fallback = message.trim();\n        }\n      }\n    }\n\n    return fallback ?? stderr;\n  },\n\n  /**\n   * @internal\n   */\n  getSafeWorkingDir(): string {\n    if (process.platform === \"win32\") {\n      let systemRoot = process.env.SystemRoot || process.env[\"SYSTEMROOT\"];\n      if (!systemRoot) {\n        logger.getToken.warning(\n          \"The SystemRoot environment variable is not set. This may cause issues when using the Azure Developer CLI credential.\",\n        );\n\n        systemRoot = \"C:\\\\Windows\";\n      }\n\n      return systemRoot;\n    } else {\n      return \"/bin\";\n    }\n  },\n\n  /**\n   * Gets the access token from Azure Developer CLI\n   * @param scopes - The scopes to use when getting the token\n   * @internal\n   */\n  async getAzdAccessToken(\n    scopes: string[],\n    tenantId?: string,\n    timeout?: number,\n    claims?: string,\n  ): Promise<{ stdout: string; stderr: string; error: Error | null }> {\n    let tenantSection: string[] = [];\n    if (tenantId) {\n      tenantSection = [\"--tenant-id\", tenantId];\n    }\n\n    let claimsSections: string[] = [];\n    if (claims) {\n      const encodedClaims = uint8ArrayToString(stringToUint8Array(claims, \"utf-8\"), \"base64\");\n      claimsSections = [\"--claims\", encodedClaims];\n    }\n    const args = [\n      \"auth\",\n      \"token\",\n      \"--output\",\n      \"json\",\n      \"--no-prompt\",\n      ...scopes.reduce<string[]>((previous, current) => previous.concat(\"--scope\", current), []),\n      ...tenantSection,\n      ...claimsSections,\n    ];\n    return processUtils.execFileWithResult(\"azd\", args, {\n      allowWindowsBatchFiles: true,\n      cwd: developerCliCredentialInternals.getSafeWorkingDir(),\n      encoding: \"utf8\",\n      timeout,\n    });\n  },\n};\n\n/**\n * Azure Developer CLI is a command-line interface tool that allows developers to create, manage, and deploy\n * resources in Azure. It's built on top of the Azure CLI and provides additional functionality specific\n * to Azure developers. It allows users to authenticate as a user and/or a service principal against\n * <a href=\"https://learn.microsoft.com/entra/fundamentals/\">Microsoft Entra ID</a>. The\n * AzureDeveloperCliCredential authenticates in a development environment and acquires a token on behalf of\n * the logged-in user or service principal in the Azure Developer CLI. It acts as the Azure Developer CLI logged in user or\n * service principal and executes an Azure CLI command underneath to authenticate the application against\n * Microsoft Entra ID.\n *\n * <h2> Configure AzureDeveloperCliCredential </h2>\n *\n * To use this credential, the developer needs to authenticate locally in Azure Developer CLI using one of the\n * commands below:\n *\n * <ol>\n *     <li>Run \"azd auth login\" in Azure Developer CLI to authenticate interactively as a user.</li>\n *     <li>Run \"azd auth login --client-id clientID --client-secret clientSecret\n *     --tenant-id tenantID\" to authenticate as a service principal.</li>\n * </ol>\n *\n * You may need to repeat this process after a certain time period, depending on the refresh token validity in your\n * organization. Generally, the refresh token validity period is a few weeks to a few months.\n * AzureDeveloperCliCredential will prompt you to sign in again.\n */\nexport class AzureDeveloperCliCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n\n  /**\n   * Creates an instance of the {@link AzureDeveloperCliCredential}.\n   *\n   * To use this credential, ensure that you have already logged\n   * in via the 'azd' tool using the command \"azd auth login\" from the commandline.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzureDeveloperCliCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    const tenantId = processMultiTenantRequest(\n      this.tenantId,\n      options,\n      this.additionallyAllowedTenantIds,\n    );\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n    let scopeList: string[];\n    if (typeof scopes === \"string\") {\n      scopeList = [scopes];\n    } else {\n      scopeList = scopes;\n    }\n    logger.getToken.info(`Using the scopes ${scopes}`);\n\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      try {\n        scopeList.forEach((scope) => {\n          ensureValidScopeForDevTimeCreds(scope, logger);\n        });\n        const obj = await developerCliCredentialInternals.getAzdAccessToken(\n          scopeList,\n          tenantId,\n          this.timeout,\n          options.claims,\n        );\n        const isMFARequiredError =\n          obj.stderr?.match(\"must use multi-factor authentication\") ||\n          obj.stderr?.match(\"reauthentication required\");\n        const isNotLoggedInError =\n          obj.stderr?.match(\"not logged in, run `azd login` to login\") ||\n          obj.stderr?.match(\"not logged in, run `azd auth login` to login\");\n        const isNotInstallError =\n          obj.stderr?.match(\"azd:(.*)not found\") ||\n          obj.stderr?.startsWith(\"'azd' is not recognized\");\n        if (isNotInstallError || (obj.error && (obj.error as any).code === \"ENOENT\")) {\n          const error = new CredentialUnavailableError(\n            azureDeveloperCliPublicErrorMessages.notInstalled,\n          );\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n\n        if (isNotLoggedInError) {\n          const error = new CredentialUnavailableError(azureDeveloperCliPublicErrorMessages.login);\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n        if (isMFARequiredError) {\n          const scope = scopeList\n            .reduce<string[]>((previous, current) => previous.concat(\"--scope\", current), [])\n            .join(\" \");\n          const loginCmd = `azd auth login ${scope}`;\n          const error = new CredentialUnavailableError(\n            `${azureDeveloperCliPublicErrorMessages.claim} ${loginCmd}`,\n          );\n          logger.getToken.info(formatError(scopes, error));\n          throw error;\n        }\n\n        try {\n          const resp: { token: string; expiresOn: string } = JSON.parse(obj.stdout);\n          logger.getToken.info(formatSuccess(scopes));\n          return {\n            token: resp.token,\n            expiresOnTimestamp: new Date(resp.expiresOn).getTime(),\n            tokenType: \"Bearer\",\n          } as AccessToken;\n        } catch (e: any) {\n          if (obj.stderr) {\n            const errorMessage = developerCliCredentialInternals.parseAzdStderr(obj.stderr);\n            throw new CredentialUnavailableError(errorMessage);\n          }\n          throw e;\n        }\n      } catch (err: any) {\n        const error =\n          err.name === \"CredentialUnavailableError\"\n            ? err\n            : new CredentialUnavailableError(\n                (err as Error).message || azureDeveloperCliPublicErrorMessages.unknown,\n              );\n        logger.getToken.info(formatError(scopes, error));\n        throw error;\n      }\n    });\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,qBAA6D;AAE7D,oBAA2C;AAC3C,2BAIO;AACP,qBAA8B;AAC9B,wBAAgD;AAChD,uBAAuD;AACvD,0BAA6B;AAE7B,MAAM,aAAS,iCAAiB,6BAA6B;AAMtD,MAAM,uCAAuC;AAAA,EAClD,cACE;AAAA,EACF,OACE;AAAA,EACF,SAAS;AAAA,EACT,OACE;AACJ;AAMO,MAAM,kCAAkC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB7C,eAAe,QAAwB;AACrC,QAAI,CAAC,QAAQ,KAAK,GAAG;AACnB,aAAO;AAAA,IACT;AAEA,QAAI;AAEJ,eAAW,WAAW,OAAO,MAAM,IAAI,GAAG;AACxC,YAAM,OAAO,QAAQ,KAAK;AAC1B,UAAI,CAAC,KAAK,WAAW,GAAG,GAAG;AACzB;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,IAAI;AAAA,MAC1B,QAAQ;AAEN;AAAA,MACF;AAEA,UAAI,OAAO,QAAQ,UAAU,YAAY,OAAO,MAAM,KAAK,GAAG;AAC5D,eAAO,OAAO,MAAM,KAAK;AAAA,MAC3B;AAEA,UAAI,aAAa,QAAW;AAC1B,cAAM,UAAU,QAAQ,MAAM;AAC9B,YAAI,OAAO,YAAY,YAAY,QAAQ,KAAK,GAAG;AACjD,qBAAW,QAAQ,KAAK;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAEA,WAAO,YAAY;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,oBAA4B;AAC1B,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI,aAAa,QAAQ,IAAI,cAAc,QAAQ,IAAI,YAAY;AACnE,UAAI,CAAC,YAAY;AACf,eAAO,SAAS;AAAA,UACd;AAAA,QACF;AAEA,qBAAa;AAAA,MACf;AAEA,aAAO;AAAA,IACT,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBACJ,QACA,UACA,SACA,QACkE;AAClE,QAAI,gBAA0B,CAAC;AAC/B,QAAI,UAAU;AACZ,sBAAgB,CAAC,eAAe,QAAQ;AAAA,IAC1C;AAEA,QAAI,iBAA2B,CAAC;AAChC,QAAI,QAAQ;AACV,YAAM,oBAAgB,yCAAmB,qCAAmB,QAAQ,OAAO,GAAG,QAAQ;AACtF,uBAAiB,CAAC,YAAY,aAAa;AAAA,IAC7C;AACA,UAAM,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO,OAAiB,CAAC,UAAU,YAAY,SAAS,OAAO,WAAW,OAAO,GAAG,CAAC,CAAC;AAAA,MACzF,GAAG;AAAA,MACH,GAAG;AAAA,IACL;AACA,WAAO,iCAAa,mBAAmB,OAAO,MAAM;AAAA,MAClD,wBAAwB;AAAA,MACxB,KAAK,gCAAgC,kBAAkB;AAAA,MACvD,UAAU;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AACF;AA2BO,MAAM,4BAAuD;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUR,YAAY,SAA8C;AACxD,QAAI,SAAS,UAAU;AACrB,8CAAc,QAAQ,SAAS,QAAQ;AACvC,WAAK,WAAW,SAAS;AAAA,IAC3B;AACA,SAAK,mCAA+B;AAAA,MAClC,SAAS;AAAA,IACX;AACA,SAAK,UAAU,SAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,SACX,QACA,UAA2B,CAAC,GACN;AACtB,UAAM,eAAW;AAAA,MACf,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,IACP;AACA,QAAI,UAAU;AACZ,8CAAc,QAAQ,QAAQ;AAAA,IAChC;AACA,QAAI;AACJ,QAAI,OAAO,WAAW,UAAU;AAC9B,kBAAY,CAAC,MAAM;AAAA,IACrB,OAAO;AACL,kBAAY;AAAA,IACd;AACA,WAAO,SAAS,KAAK,oBAAoB,MAAM,EAAE;AAEjD,WAAO,6BAAc,SAAS,GAAG,KAAK,YAAY,IAAI,aAAa,SAAS,YAAY;AACtF,UAAI;AACF,kBAAU,QAAQ,CAAC,UAAU;AAC3B,iEAAgC,OAAO,MAAM;AAAA,QAC/C,CAAC;AACD,cAAM,MAAM,MAAM,gCAAgC;AAAA,UAChD;AAAA,UACA;AAAA,UACA,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AACA,cAAM,qBACJ,IAAI,QAAQ,MAAM,sCAAsC,KACxD,IAAI,QAAQ,MAAM,2BAA2B;AAC/C,cAAM,qBACJ,IAAI,QAAQ,MAAM,yCAAyC,KAC3D,IAAI,QAAQ,MAAM,8CAA8C;AAClE,cAAM,oBACJ,IAAI,QAAQ,MAAM,mBAAmB,KACrC,IAAI,QAAQ,WAAW,yBAAyB;AAClD,YAAI,qBAAsB,IAAI,SAAU,IAAI,MAAc,SAAS,UAAW;AAC5E,gBAAM,QAAQ,IAAI;AAAA,YAChB,qCAAqC;AAAA,UACvC;AACA,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AAEA,YAAI,oBAAoB;AACtB,gBAAM,QAAQ,IAAI,yCAA2B,qCAAqC,KAAK;AACvF,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AACA,YAAI,oBAAoB;AACtB,gBAAM,QAAQ,UACX,OAAiB,CAAC,UAAU,YAAY,SAAS,OAAO,WAAW,OAAO,GAAG,CAAC,CAAC,EAC/E,KAAK,GAAG;AACX,gBAAM,WAAW,kBAAkB,KAAK;AACxC,gBAAM,QAAQ,IAAI;AAAA,YAChB,GAAG,qCAAqC,KAAK,IAAI,QAAQ;AAAA,UAC3D;AACA,iBAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,gBAAM;AAAA,QACR;AAEA,YAAI;AACF,gBAAM,OAA6C,KAAK,MAAM,IAAI,MAAM;AACxE,iBAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC1C,iBAAO;AAAA,YACL,OAAO,KAAK;AAAA,YACZ,oBAAoB,IAAI,KAAK,KAAK,SAAS,EAAE,QAAQ;AAAA,YACrD,WAAW;AAAA,UACb;AAAA,QACF,SAAS,GAAQ;AACf,cAAI,IAAI,QAAQ;AACd,kBAAM,eAAe,gCAAgC,eAAe,IAAI,MAAM;AAC9E,kBAAM,IAAI,yCAA2B,YAAY;AAAA,UACnD;AACA,gBAAM;AAAA,QACR;AAAA,MACF,SAAS,KAAU;AACjB,cAAM,QACJ,IAAI,SAAS,+BACT,MACA,IAAI;AAAA,UACD,IAAc,WAAW,qCAAqC;AAAA,QACjE;AACN,eAAO,SAAS,SAAK,4BAAY,QAAQ,KAAK,CAAC;AAC/C,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AACF;",
+  "names": []
 }