@azure/identity 4.14.0-beta.3 → 4.14.0-beta.5

package/dist/commonjs/credentials/azurePipelinesCredential.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/credentials/azurePipelinesCredential.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { AuthenticationError, CredentialUnavailableError } from \"../errors.js\";\nimport { createHttpHeaders, createPipelineRequest } from \"@azure/core-rest-pipeline\";\n\nimport type { AzurePipelinesCredentialOptions } from \"./azurePipelinesCredentialOptions.js\";\nimport { ClientAssertionCredential } from \"./clientAssertionCredential.js\";\nimport { IdentityClient } from \"../client/identityClient.js\";\nimport type { PipelineResponse } from \"@azure/core-rest-pipeline\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { credentialLogger } from \"../util/logging.js\";\n\nconst credentialName = \"AzurePipelinesCredential\";\nconst logger = credentialLogger(credentialName);\nconst OIDC_API_VERSION = \"7.1\";\n\n/**\n * This credential is designed to be used in Azure Pipelines with service connections\n * as a setup for workload identity federation.\n */\nexport class AzurePipelinesCredential implements TokenCredential {\n  private clientAssertionCredential: ClientAssertionCredential | undefined;\n  private identityClient: IdentityClient;\n\n  /**\n   * AzurePipelinesCredential supports Federated Identity on Azure Pipelines through Service Connections.\n   * @param tenantId - tenantId associated with the service connection\n   * @param clientId - clientId associated with the service connection\n   * @param serviceConnectionId - Unique ID for the service connection, as found in the querystring's resourceId key\n   * @param systemAccessToken - The pipeline's <see href=\"https://learn.microsoft.com/azure/devops/pipelines/build/variables?view=azure-devops%26tabs=yaml#systemaccesstoken\">System.AccessToken</see> value.\n   * @param options - The identity client options to use for authentication.\n   */\n  constructor(\n    tenantId: string,\n    clientId: string,\n    serviceConnectionId: string,\n    systemAccessToken: string,\n    options: AzurePipelinesCredentialOptions = {},\n  ) {\n    if (!clientId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. clientId is a required parameter.`,\n      );\n    }\n    if (!tenantId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. tenantId is a required parameter.`,\n      );\n    }\n    if (!serviceConnectionId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. serviceConnectionId is a required parameter.`,\n      );\n    }\n    if (!systemAccessToken) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. systemAccessToken is a required parameter.`,\n      );\n    }\n\n    // Allow these headers to be logged for troubleshooting by AzurePipelines.\n    options.loggingOptions = {\n      ...options?.loggingOptions,\n      additionalAllowedHeaderNames: [\n        ...(options.loggingOptions?.additionalAllowedHeaderNames ?? []),\n        \"x-vss-e2eid\",\n        \"x-msedge-ref\",\n      ],\n    };\n\n    this.identityClient = new IdentityClient(options);\n    checkTenantId(logger, tenantId);\n    logger.info(\n      `Invoking AzurePipelinesCredential with tenant ID: ${tenantId}, client ID: ${clientId}, and service connection ID: ${serviceConnectionId}`,\n    );\n    if (!process.env.SYSTEM_OIDCREQUESTURI) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. Ensure that you're running this task in an Azure Pipeline, so that following missing system variable(s) can be defined- \"SYSTEM_OIDCREQUESTURI\"`,\n      );\n    }\n\n    const oidcRequestUrl = `${process.env.SYSTEM_OIDCREQUESTURI}?api-version=${OIDC_API_VERSION}&serviceConnectionId=${serviceConnectionId}`;\n    logger.info(\n      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, client ID: ${clientId} and service connection ID: ${serviceConnectionId}`,\n    );\n    this.clientAssertionCredential = new ClientAssertionCredential(\n      tenantId,\n      clientId,\n      this.requestOidcToken.bind(this, oidcRequestUrl, systemAccessToken),\n      options,\n    );\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} or {@link AuthenticationError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options?: GetTokenOptions,\n  ): Promise<AccessToken> {\n    if (!this.clientAssertionCredential) {\n      const errorMessage = `${credentialName}: is unavailable. To use Federation Identity in Azure Pipelines, the following parameters are required - \n      tenantId,\n      clientId,\n      serviceConnectionId,\n      systemAccessToken,\n      \"SYSTEM_OIDCREQUESTURI\".      \n      See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;\n      logger.error(errorMessage);\n      throw new CredentialUnavailableError(errorMessage);\n    }\n    logger.info(\"Invoking getToken() of Client Assertion Credential\");\n    return this.clientAssertionCredential.getToken(scopes, options);\n  }\n\n  /**\n   *\n   * @param oidcRequestUrl - oidc request url\n   * @param systemAccessToken - system access token\n   * @returns OIDC token from Azure Pipelines\n   */\n  private async requestOidcToken(\n    oidcRequestUrl: string,\n    systemAccessToken: string,\n  ): Promise<string> {\n    logger.info(\"Requesting OIDC token from Azure Pipelines...\");\n    logger.info(oidcRequestUrl);\n    const request = createPipelineRequest({\n      url: oidcRequestUrl,\n      method: \"POST\",\n      headers: createHttpHeaders({\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${systemAccessToken}`,\n        // Prevents the service from responding with a redirect HTTP status code (useful for automation).\n        \"X-TFS-FedAuthRedirect\": \"Suppress\",\n      }),\n    });\n    const response = await this.identityClient.sendRequest(request);\n    return handleOidcResponse(response);\n  }\n}\n\nexport function handleOidcResponse(response: PipelineResponse): string {\n  // OIDC token is present in `bodyAsText` field\n  const text = response.bodyAsText;\n  if (!text) {\n    logger.error(\n      `${credentialName}: Authentication Failed. Received null token from OIDC request. Response status- ${\n        response.status\n      }. Complete response - ${JSON.stringify(response)}`,\n    );\n    throw new AuthenticationError(response.status, {\n      error: `${credentialName}: Authentication Failed. Received null token from OIDC request.`,\n      error_description: `${JSON.stringify(\n        response,\n      )}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,\n    });\n  }\n  try {\n    const result = JSON.parse(text);\n    if (result?.oidcToken) {\n      return result.oidcToken;\n    } else {\n      const errorMessage = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;\n      let errorDescription = ``;\n      if (response.status !== 200) {\n        errorDescription = `Response body = ${text}. Response Headers [\"x-vss-e2eid\"] = ${response.headers.get(\"x-vss-e2eid\")} and [\"x-msedge-ref\"] = ${response.headers.get(\"x-msedge-ref\")}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;\n      }\n      logger.error(errorMessage);\n      logger.error(errorDescription);\n      throw new AuthenticationError(response.status, {\n        error: errorMessage,\n        error_description: errorDescription,\n      });\n    }\n  } catch (e: any) {\n    const errorDetails = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;\n    logger.error(\n      `Response from service = ${text}, Response Headers [\"x-vss-e2eid\"] = ${response.headers.get(\"x-vss-e2eid\")} \n      and [\"x-msedge-ref\"] = ${response.headers.get(\"x-msedge-ref\")}, error message = ${e.message}`,\n    );\n    logger.error(errorDetails);\n    throw new AuthenticationError(response.status, {\n      error: errorDetails,\n      error_description: `Response = ${text}. Response headers [\"x-vss-e2eid\"] = ${response.headers.get(\"x-vss-e2eid\")} and [\"x-msedge-ref\"] =  ${response.headers.get(\"x-msedge-ref\")}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,\n    });\n  }\n}\n"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { AuthenticationError, CredentialUnavailableError } from \"../errors.js\";\nimport { createHttpHeaders, createPipelineRequest } from \"@azure/core-rest-pipeline\";\n\nimport type { AzurePipelinesCredentialOptions } from \"./azurePipelinesCredentialOptions.js\";\nimport { ClientAssertionCredential } from \"#platform/credentials/clientAssertionCredential\";\nimport { IdentityClient } from \"../client/identityClient.js\";\nimport type { PipelineResponse } from \"@azure/core-rest-pipeline\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { credentialLogger } from \"../util/logging.js\";\n\nconst credentialName = \"AzurePipelinesCredential\";\nconst logger = credentialLogger(credentialName);\nconst OIDC_API_VERSION = \"7.1\";\n\n/**\n * This credential is designed to be used in Azure Pipelines with service connections\n * as a setup for workload identity federation.\n */\nexport class AzurePipelinesCredential implements TokenCredential {\n  private clientAssertionCredential: ClientAssertionCredential | undefined;\n  private identityClient: IdentityClient;\n\n  /**\n   * AzurePipelinesCredential supports Federated Identity on Azure Pipelines through Service Connections.\n   * @param tenantId - tenantId associated with the service connection\n   * @param clientId - clientId associated with the service connection\n   * @param serviceConnectionId - Unique ID for the service connection, as found in the querystring's resourceId key\n   * @param systemAccessToken - The pipeline's <see href=\"https://learn.microsoft.com/azure/devops/pipelines/build/variables?view=azure-devops%26tabs=yaml#systemaccesstoken\">System.AccessToken</see> value.\n   * @param options - The identity client options to use for authentication.\n   */\n  constructor(\n    tenantId: string,\n    clientId: string,\n    serviceConnectionId: string,\n    systemAccessToken: string,\n    options: AzurePipelinesCredentialOptions = {},\n  ) {\n    if (!clientId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. clientId is a required parameter.`,\n      );\n    }\n    if (!tenantId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. tenantId is a required parameter.`,\n      );\n    }\n    if (!serviceConnectionId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. serviceConnectionId is a required parameter.`,\n      );\n    }\n    if (!systemAccessToken) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. systemAccessToken is a required parameter.`,\n      );\n    }\n\n    // Allow these headers to be logged for troubleshooting by AzurePipelines.\n    options.loggingOptions = {\n      ...options?.loggingOptions,\n      additionalAllowedHeaderNames: [\n        ...(options.loggingOptions?.additionalAllowedHeaderNames ?? []),\n        \"x-vss-e2eid\",\n        \"x-msedge-ref\",\n      ],\n    };\n\n    this.identityClient = new IdentityClient(options);\n    checkTenantId(logger, tenantId);\n    logger.info(\n      `Invoking AzurePipelinesCredential with tenant ID: ${tenantId}, client ID: ${clientId}, and service connection ID: ${serviceConnectionId}`,\n    );\n    if (!process.env.SYSTEM_OIDCREQUESTURI) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. Ensure that you're running this task in an Azure Pipeline, so that following missing system variable(s) can be defined- \"SYSTEM_OIDCREQUESTURI\"`,\n      );\n    }\n\n    const oidcRequestUrl = `${process.env.SYSTEM_OIDCREQUESTURI}?api-version=${OIDC_API_VERSION}&serviceConnectionId=${serviceConnectionId}`;\n    logger.info(\n      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, client ID: ${clientId} and service connection ID: ${serviceConnectionId}`,\n    );\n    this.clientAssertionCredential = new ClientAssertionCredential(\n      tenantId,\n      clientId,\n      this.requestOidcToken.bind(this, oidcRequestUrl, systemAccessToken),\n      options,\n    );\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} or {@link AuthenticationError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options?: GetTokenOptions,\n  ): Promise<AccessToken> {\n    if (!this.clientAssertionCredential) {\n      const errorMessage = `${credentialName}: is unavailable. To use Federation Identity in Azure Pipelines, the following parameters are required - \n      tenantId,\n      clientId,\n      serviceConnectionId,\n      systemAccessToken,\n      \"SYSTEM_OIDCREQUESTURI\".      \n      See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;\n      logger.error(errorMessage);\n      throw new CredentialUnavailableError(errorMessage);\n    }\n    logger.info(\"Invoking getToken() of Client Assertion Credential\");\n    return this.clientAssertionCredential.getToken(scopes, options);\n  }\n\n  /**\n   *\n   * @param oidcRequestUrl - oidc request url\n   * @param systemAccessToken - system access token\n   * @returns OIDC token from Azure Pipelines\n   */\n  private async requestOidcToken(\n    oidcRequestUrl: string,\n    systemAccessToken: string,\n  ): Promise<string> {\n    logger.info(\"Requesting OIDC token from Azure Pipelines...\");\n    logger.info(oidcRequestUrl);\n    const request = createPipelineRequest({\n      url: oidcRequestUrl,\n      method: \"POST\",\n      headers: createHttpHeaders({\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${systemAccessToken}`,\n        // Prevents the service from responding with a redirect HTTP status code (useful for automation).\n        \"X-TFS-FedAuthRedirect\": \"Suppress\",\n      }),\n    });\n    const response = await this.identityClient.sendRequest(request);\n    return handleOidcResponse(response);\n  }\n}\n\nexport function handleOidcResponse(response: PipelineResponse): string {\n  // OIDC token is present in `bodyAsText` field\n  const text = response.bodyAsText;\n  if (!text) {\n    logger.error(\n      `${credentialName}: Authentication Failed. Received null token from OIDC request. Response status- ${\n        response.status\n      }. Complete response - ${JSON.stringify(response)}`,\n    );\n    throw new AuthenticationError(response.status, {\n      error: `${credentialName}: Authentication Failed. Received null token from OIDC request.`,\n      error_description: `${JSON.stringify(\n        response,\n      )}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,\n    });\n  }\n  try {\n    const result = JSON.parse(text);\n    if (result?.oidcToken) {\n      return result.oidcToken;\n    } else {\n      const errorMessage = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;\n      let errorDescription = ``;\n      if (response.status !== 200) {\n        errorDescription = `Response body = ${text}. Response Headers [\"x-vss-e2eid\"] = ${response.headers.get(\"x-vss-e2eid\")} and [\"x-msedge-ref\"] = ${response.headers.get(\"x-msedge-ref\")}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`;\n      }\n      logger.error(errorMessage);\n      logger.error(errorDescription);\n      throw new AuthenticationError(response.status, {\n        error: errorMessage,\n        error_description: errorDescription,\n      });\n    }\n  } catch (e: any) {\n    const errorDetails = `${credentialName}: Authentication Failed. oidcToken field not detected in the response.`;\n    logger.error(\n      `Response from service = ${text}, Response Headers [\"x-vss-e2eid\"] = ${response.headers.get(\"x-vss-e2eid\")} \n      and [\"x-msedge-ref\"] = ${response.headers.get(\"x-msedge-ref\")}, error message = ${e.message}`,\n    );\n    logger.error(errorDetails);\n    throw new AuthenticationError(response.status, {\n      error: errorDetails,\n      error_description: `Response = ${text}. Response headers [\"x-vss-e2eid\"] = ${response.headers.get(\"x-vss-e2eid\")} and [\"x-msedge-ref\"] =  ${response.headers.get(\"x-msedge-ref\")}. See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/azurepipelinescredential/troubleshoot`,\n    });\n  }\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAAgE;AAChE,gCAAyD;AAGzD,uCAA0C;AAC1C,4BAA+B;AAE/B,2BAA8B;AAC9B,qBAAiC;AAEjC,MAAM,iBAAiB;AACvB,MAAM,aAAS,iCAAiB,cAAc;AAC9C,MAAM,mBAAmB;AAMlB,MAAM,yBAAoD;AAAA,EACvD;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUR,YACE,UACA,UACA,qBACA,mBACA,UAA2C,CAAC,GAC5C;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA,MACnB;AAAA,IACF;AAGA,YAAQ,iBAAiB;AAAA,MACvB,GAAG,SAAS;AAAA,MACZ,8BAA8B;AAAA,QAC5B,GAAI,QAAQ,gBAAgB,gCAAgC,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,SAAK,iBAAiB,IAAI,qCAAe,OAAO;AAChD,4CAAc,QAAQ,QAAQ;AAC9B,WAAO;AAAA,MACL,qDAAqD,QAAQ,gBAAgB,QAAQ,gCAAgC,mBAAmB;AAAA,IAC1I;AACA,QAAI,CAAC,QAAQ,IAAI,uBAAuB;AACtC,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,iBAAiB,GAAG,QAAQ,IAAI,qBAAqB,gBAAgB,gBAAgB,wBAAwB,mBAAmB;AACtI,WAAO;AAAA,MACL,sDAAsD,QAAQ,gBAAgB,QAAQ,+BAA+B,mBAAmB;AAAA,IAC1I;AACA,SAAK,4BAA4B,IAAI;AAAA,MACnC;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,KAAK,MAAM,gBAAgB,iBAAiB;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAa,SACX,QACA,SACsB;AACtB,QAAI,CAAC,KAAK,2BAA2B;AACnC,YAAM,eAAe,GAAG,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOtC,aAAO,MAAM,YAAY;AACzB,YAAM,IAAI,yCAA2B,YAAY;AAAA,IACnD;AACA,WAAO,KAAK,oDAAoD;AAChE,WAAO,KAAK,0BAA0B,SAAS,QAAQ,OAAO;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,iBACZ,gBACA,mBACiB;AACjB,WAAO,KAAK,+CAA+C;AAC3D,WAAO,KAAK,cAAc;AAC1B,UAAM,cAAU,iDAAsB;AAAA,MACpC,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,aAAS,6CAAkB;AAAA,QACzB,gBAAgB;AAAA,QAChB,eAAe,UAAU,iBAAiB;AAAA;AAAA,QAE1C,yBAAyB;AAAA,MAC3B,CAAC;AAAA,IACH,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,eAAe,YAAY,OAAO;AAC9D,WAAO,mBAAmB,QAAQ;AAAA,EACpC;AACF;AAEO,SAAS,mBAAmB,UAAoC;AAErE,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL,GAAG,cAAc,oFACf,SAAS,MACX,yBAAyB,KAAK,UAAU,QAAQ,CAAC;AAAA,IACnD;AACA,UAAM,IAAI,kCAAoB,SAAS,QAAQ;AAAA,MAC7C,OAAO,GAAG,cAAc;AAAA,MACxB,mBAAmB,GAAG,KAAK;AAAA,QACzB;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,QAAQ,WAAW;AACrB,aAAO,OAAO;AAAA,IAChB,OAAO;AACL,YAAM,eAAe,GAAG,cAAc;AACtC,UAAI,mBAAmB;AACvB,UAAI,SAAS,WAAW,KAAK;AAC3B,2BAAmB,mBAAmB,IAAI,wCAAwC,SAAS,QAAQ,IAAI,aAAa,CAAC,2BAA2B,SAAS,QAAQ,IAAI,cAAc,CAAC;AAAA,MACtL;AACA,aAAO,MAAM,YAAY;AACzB,aAAO,MAAM,gBAAgB;AAC7B,YAAM,IAAI,kCAAoB,SAAS,QAAQ;AAAA,QAC7C,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF,SAAS,GAAQ;AACf,UAAM,eAAe,GAAG,cAAc;AACtC,WAAO;AAAA,MACL,2BAA2B,IAAI,wCAAwC,SAAS,QAAQ,IAAI,aAAa,CAAC;AAAA,+BACjF,SAAS,QAAQ,IAAI,cAAc,CAAC,qBAAqB,EAAE,OAAO;AAAA,IAC7F;AACA,WAAO,MAAM,YAAY;AACzB,UAAM,IAAI,kCAAoB,SAAS,QAAQ;AAAA,MAC7C,OAAO;AAAA,MACP,mBAAmB,cAAc,IAAI,wCAAwC,SAAS,QAAQ,IAAI,aAAa,CAAC,4BAA4B,SAAS,QAAQ,IAAI,cAAc,CAAC;AAAA,IAClL,CAAC;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/commonjs/credentials/azurePowerShellCredential.d.ts

@@ -1,5 +1,15 @@
 import type { AccessToken, GetTokenOptions, TokenCredential } from "@azure/core-auth";
 import type { AzurePowerShellCredentialOptions } from "./azurePowerShellCredentialOptions.js";
+/**
+ * Creates the child environment used to pass private values to PowerShell.
+ *
+ * @param resource - The resource passed to PowerShell.
+ * @param tenantId - The optional tenant ID passed to PowerShell.
+ * @param environment - The environment to copy.
+ * @returns A child environment containing canonical private variable names.
+ * @internal
+ */
+export declare function createPowerShellEnvironment(resource: string, tenantId: string | undefined, environment?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /**
  * Returns a platform-appropriate command name by appending ".exe" on Windows.
  *

package/dist/commonjs/credentials/azurePowerShellCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"azurePowerShellCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azurePowerShellCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAStF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAS9F;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAMzD;AAuBD;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;CAI5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;CAOzC,CAAC;AAUF;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAA0B,CAAC;AAMpD;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,eAAe;IAC/D,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,OAAO,CAAC,CAAS;IAEzB;;;;;;;;;;OAUG;gBACS,OAAO,CAAC,EAAE,gCAAgC;IAWtD;;;OAGG;YACW,6BAA6B;IAwE3C;;;;;;OAMG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,CAAC;CA0DxB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB/C"}
+{"version":3,"file":"azurePowerShellCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/azurePowerShellCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAStF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAiB9F;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,MAAM,CAAC,UAAU,CASnB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAMzD;AA4BD;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;CAI5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;CAOzC,CAAC;AAUF;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAA0B,CAAC;AAMpD;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,eAAe;IAC/D,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,OAAO,CAAC,CAAS;IAEzB;;;;;;;;;;OAUG;gBACS,OAAO,CAAC,EAAE,gCAAgC;IAWtD;;;OAGG;YACW,6BAA6B;IA6E3C;;;;;;OAMG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,CAAC;CA6DxB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB/C"}

package/dist/commonjs/credentials/azurePowerShellCredential.js

@@ -19,6 +19,7 @@ var azurePowerShellCredential_exports = {};
 __export(azurePowerShellCredential_exports, {
   AzurePowerShellCredential: () => AzurePowerShellCredential,
   commandStack: () => commandStack,
+  createPowerShellEnvironment: () => createPowerShellEnvironment,
   formatCommand: () => formatCommand,
   parseJsonToken: () => parseJsonToken,
   powerShellErrors: () => powerShellErrors,
@@ -31,8 +32,26 @@ var import_scopeUtils = require("../util/scopeUtils.js");
 var import_errors = require("../errors.js");
 var import_processUtils = require("../util/processUtils.js");
 var import_tracing = require("../util/tracing.js");
+var import_core_util = require("@azure/core-util");
 const logger = (0, import_logging.credentialLogger)("AzurePowerShellCredential");
 const isWindows = process.platform === "win32";
+const powerShellResourceEnvironmentVariable = "AZURE_IDENTITY_POWERSHELL_RESOURCE";
+const powerShellTenantEnvironmentVariable = "AZURE_IDENTITY_POWERSHELL_TENANT_ID";
+const powerShellPrivateEnvironmentVariables = new Set(
+  [powerShellResourceEnvironmentVariable, powerShellTenantEnvironmentVariable].map(
+    (name) => name.toLowerCase()
+  )
+);
+function createPowerShellEnvironment(resource, tenantId, environment = process.env) {
+  const childEnvironment = Object.fromEntries(
+    Object.entries(environment).filter(
+      ([name]) => !powerShellPrivateEnvironmentVariables.has(name.toLowerCase())
+    )
+  );
+  childEnvironment[powerShellResourceEnvironmentVariable] = resource;
+  childEnvironment[powerShellTenantEnvironmentVariable] = tenantId ?? "";
+  return childEnvironment;
+}
 function formatCommand(commandName) {
   if (isWindows) {
     return `${commandName}.exe`;
@@ -40,12 +59,13 @@ function formatCommand(commandName) {
     return commandName;
   }
 }
-async function runCommands(commands, timeout) {
+async function runCommands(commands, timeout, env) {
   const results = [];
   for (const command of commands) {
     const [file, ...parameters] = command;
     const result = await import_processUtils.processUtils.execFile(file, parameters, {
       encoding: "utf8",
+      env,
       timeout
     });
     results.push(result);
@@ -105,19 +125,21 @@ class AzurePowerShellCredential {
         commandStack.shift();
         continue;
       }
-      const results = await runCommands([
+      const results = await runCommands(
         [
-          powerShellCommand,
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `
-          $tenantId = "${tenantId ?? ""}"
+          [
+            powerShellCommand,
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            `
+          $tenantId = $env:${powerShellTenantEnvironmentVariable}
+          $resource = $env:${powerShellResourceEnvironmentVariable}
           $m = Import-Module Az.Accounts -MinimumVersion 2.2.0 -PassThru
           $useSecureString = $m.Version -ge [version]'2.17.0' -and $m.Version -lt [version]'5.0.0'
 
           $params = @{
-            ResourceUrl = "${resource}"
+            ResourceUrl = $resource
           }
 
           if ($tenantId.Length -gt 0) {
@@ -153,8 +175,11 @@ class AzurePowerShellCredential {
 
           Write-Output (ConvertTo-Json $result)
           `
-        ]
-      ]);
+          ]
+        ],
+        timeout,
+        createPowerShellEnvironment(resource, tenantId)
+      );
       const result = results[0];
       return parseJsonToken(result);
     }
@@ -172,7 +197,10 @@ class AzurePowerShellCredential {
       const scope = typeof scopes === "string" ? scopes : scopes[0];
       const claimsValue = options.claims;
       if (claimsValue && claimsValue.trim()) {
-        const encodedClaims = btoa(claimsValue);
+        const encodedClaims = (0, import_core_util.uint8ArrayToString)(
+          (0, import_core_util.stringToUint8Array)(claimsValue, "utf-8"),
+          "base64"
+        );
         let loginCmd = `Connect-AzAccount -ClaimsChallenge ${encodedClaims}`;
         const tenantIdFromOptions = options.tenantId;
         if (tenantIdFromOptions) {
@@ -252,6 +280,7 @@ async function parseJsonToken(result) {
 0 && (module.exports = {
   AzurePowerShellCredential,
   commandStack,
+  createPowerShellEnvironment,
   formatCommand,
   parseJsonToken,
   powerShellErrors,

package/dist/commonjs/credentials/azurePowerShellCredential.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/credentials/azurePowerShellCredential.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport { ensureValidScopeForDevTimeCreds, getScopeResource } from \"../util/scopeUtils.js\";\n\nimport type { AzurePowerShellCredentialOptions } from \"./azurePowerShellCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport { processUtils } from \"../util/processUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\n\nconst logger = credentialLogger(\"AzurePowerShellCredential\");\n\nconst isWindows = process.platform === \"win32\";\n\n/**\n * Returns a platform-appropriate command name by appending \".exe\" on Windows.\n *\n * @internal\n */\nexport function formatCommand(commandName: string): string {\n  if (isWindows) {\n    return `${commandName}.exe`;\n  } else {\n    return commandName;\n  }\n}\n\n/**\n * Receives a list of commands to run, executes them, then returns the outputs.\n * If anything fails, an error is thrown.\n * @internal\n */\nasync function runCommands(commands: string[][], timeout?: number): Promise<string[]> {\n  const results: string[] = [];\n\n  for (const command of commands) {\n    const [file, ...parameters] = command;\n    const result = (await processUtils.execFile(file, parameters, {\n      encoding: \"utf8\",\n      timeout,\n    })) as string;\n\n    results.push(result);\n  }\n\n  return results;\n}\n\n/**\n * Known PowerShell errors\n * @internal\n */\nexport const powerShellErrors = {\n  login: \"Run Connect-AzAccount to login\",\n  installed:\n    \"The specified module 'Az.Accounts' with version '2.2.0' was not loaded because no valid module file was found in any module directory\",\n};\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const powerShellPublicErrorMessages = {\n  login:\n    \"Please run 'Connect-AzAccount' from PowerShell to authenticate before using this credential.\",\n  installed: `The 'Az.Account' module >= 2.2.0 is not installed. Install the Azure Az PowerShell module with: \"Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force\".`,\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n  troubleshoot: `To troubleshoot, visit https://aka.ms/azsdk/js/identity/powershellcredential/troubleshoot.`,\n};\n\n// PowerShell Azure User not logged in error check.\nconst isLoginError: (err: Error) => RegExpMatchArray | null = (err: Error) =>\n  err.message.match(`(.*)${powerShellErrors.login}(.*)`);\n\n// Az Module not Installed in Azure PowerShell check.\nconst isNotInstalledError: (err: Error) => RegExpMatchArray | null = (err: Error) =>\n  err.message.match(powerShellErrors.installed);\n\n/**\n * The PowerShell commands to be tried, in order.\n *\n * @internal\n */\nexport const commandStack = [formatCommand(\"pwsh\")];\n\nif (isWindows) {\n  commandStack.push(formatCommand(\"powershell\"));\n}\n\n/**\n * This credential will use the currently logged-in user information from the\n * Azure PowerShell module. To do so, it will read the user access token and\n * expire time with Azure PowerShell command `Get-AzAccessToken -ResourceUrl {ResourceScope}`\n */\nexport class AzurePowerShellCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n\n  /**\n   * Creates an instance of the {@link AzurePowerShellCredential}.\n   *\n   * To use this credential:\n   * - Install the Azure Az PowerShell module with:\n   *   `Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force`.\n   * - You have already logged in to Azure PowerShell using the command\n   * `Connect-AzAccount` from the command line.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzurePowerShellCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Gets the access token from Azure PowerShell\n   * @param resource - The resource to use when getting the token\n   */\n  private async getAzurePowerShellAccessToken(\n    resource: string,\n    tenantId?: string,\n    timeout?: number,\n  ): Promise<{ Token: string; ExpiresOn: string }> {\n    // Clone the stack to avoid mutating it while iterating\n    for (const powerShellCommand of [...commandStack]) {\n      try {\n        await runCommands([[powerShellCommand, \"/?\"]], timeout);\n      } catch (e: any) {\n        // Remove this credential from the original stack so that we don't try it again.\n        commandStack.shift();\n        continue;\n      }\n\n      const results = await runCommands([\n        [\n          powerShellCommand,\n          \"-NoProfile\",\n          \"-NonInteractive\",\n          \"-Command\",\n          `\n          $tenantId = \"${tenantId ?? \"\"}\"\n          $m = Import-Module Az.Accounts -MinimumVersion 2.2.0 -PassThru\n          $useSecureString = $m.Version -ge [version]'2.17.0' -and $m.Version -lt [version]'5.0.0'\n\n          $params = @{\n            ResourceUrl = \"${resource}\"\n          }\n\n          if ($tenantId.Length -gt 0) {\n            $params[\"TenantId\"] = $tenantId\n          }\n\n          if ($useSecureString) {\n            $params[\"AsSecureString\"] = $true\n          }\n\n          $token = Get-AzAccessToken @params\n\n          $result = New-Object -TypeName PSObject\n          $result | Add-Member -MemberType NoteProperty -Name ExpiresOn -Value $token.ExpiresOn\n\n          if ($token.Token -is [System.Security.SecureString]) {\n            if ($PSVersionTable.PSVersion.Major -lt 7) {\n              $ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($token.Token)\n              try {\n                $result | Add-Member -MemberType NoteProperty -Name Token -Value ([System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr))\n              }\n              finally {\n                [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)\n              }\n            }\n            else {\n              $result | Add-Member -MemberType NoteProperty -Name Token -Value ($token.Token | ConvertFrom-SecureString -AsPlainText)\n            }\n          }\n          else {\n            $result | Add-Member -MemberType NoteProperty -Name Token -Value $token.Token\n          }\n\n          Write-Output (ConvertTo-Json $result)\n          `,\n        ],\n      ]);\n\n      const result = results[0];\n      return parseJsonToken(result);\n    }\n    throw new Error(`Unable to execute PowerShell. Ensure that it is installed in your system`);\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If the authentication cannot be performed through PowerShell, a {@link CredentialUnavailableError} will be thrown.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      const scope = typeof scopes === \"string\" ? scopes : scopes[0];\n\n      const claimsValue = options.claims;\n      if (claimsValue && claimsValue.trim()) {\n        const encodedClaims = btoa(claimsValue);\n        let loginCmd = `Connect-AzAccount -ClaimsChallenge ${encodedClaims}`;\n\n        const tenantIdFromOptions = options.tenantId;\n        if (tenantIdFromOptions) {\n          loginCmd += ` -Tenant ${tenantIdFromOptions}`;\n        }\n        const error = new CredentialUnavailableError(\n          `${powerShellPublicErrorMessages.claim} ${loginCmd}`,\n        );\n\n        logger.getToken.info(formatError(scope, error));\n        throw error;\n      }\n\n      const tenantId = processMultiTenantRequest(\n        this.tenantId,\n        options,\n        this.additionallyAllowedTenantIds,\n      );\n      if (tenantId) {\n        checkTenantId(logger, tenantId);\n      }\n      try {\n        ensureValidScopeForDevTimeCreds(scope, logger);\n        logger.getToken.info(`Using the scope ${scope}`);\n        const resource = getScopeResource(scope);\n        const response = await this.getAzurePowerShellAccessToken(resource, tenantId, this.timeout);\n        logger.getToken.info(formatSuccess(scopes));\n        return {\n          token: response.Token,\n          expiresOnTimestamp: new Date(response.ExpiresOn).getTime(),\n          tokenType: \"Bearer\",\n        } as AccessToken;\n      } catch (err: any) {\n        if (isNotInstalledError(err)) {\n          const error = new CredentialUnavailableError(powerShellPublicErrorMessages.installed);\n          logger.getToken.info(formatError(scope, error));\n          throw error;\n        } else if (isLoginError(err)) {\n          const error = new CredentialUnavailableError(powerShellPublicErrorMessages.login);\n          logger.getToken.info(formatError(scope, error));\n          throw error;\n        }\n        const error = new CredentialUnavailableError(\n          `${err}. ${powerShellPublicErrorMessages.troubleshoot}`,\n        );\n        logger.getToken.info(formatError(scope, error));\n        throw error;\n      }\n    });\n  }\n}\n\n/**\n *\n * @internal\n */\nexport async function parseJsonToken(\n  result: string,\n): Promise<{ Token: string; ExpiresOn: string }> {\n  const jsonRegex = /{[^{}]*}/g;\n  const matches = result.match(jsonRegex);\n  let resultWithoutToken = result;\n  if (matches) {\n    try {\n      for (const item of matches) {\n        try {\n          const jsonContent = JSON.parse(item);\n          if (jsonContent?.Token) {\n            resultWithoutToken = resultWithoutToken.replace(item, \"\");\n            if (resultWithoutToken) {\n              logger.getToken.warning(resultWithoutToken);\n            }\n            return jsonContent;\n          }\n        } catch (e) {\n          continue;\n        }\n      }\n    } catch (e: any) {\n      throw new Error(`Unable to parse the output of PowerShell. Received output: ${result}`);\n    }\n  }\n  throw new Error(`No access token found in the output. Received output: ${result}`);\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,2BAIO;AACP,qBAA6D;AAC7D,wBAAkE;AAGlE,oBAA2C;AAC3C,0BAA6B;AAC7B,qBAA8B;AAE9B,MAAM,aAAS,iCAAiB,2BAA2B;AAE3D,MAAM,YAAY,QAAQ,aAAa;AAOhC,SAAS,cAAc,aAA6B;AACzD,MAAI,WAAW;AACb,WAAO,GAAG,WAAW;AAAA,EACvB,OAAO;AACL,WAAO;AAAA,EACT;AACF;AAOA,eAAe,YAAY,UAAsB,SAAqC;AACpF,QAAM,UAAoB,CAAC;AAE3B,aAAW,WAAW,UAAU;AAC9B,UAAM,CAAC,MAAM,GAAG,UAAU,IAAI;AAC9B,UAAM,SAAU,MAAM,iCAAa,SAAS,MAAM,YAAY;AAAA,MAC5D,UAAU;AAAA,MACV;AAAA,IACF,CAAC;AAED,YAAQ,KAAK,MAAM;AAAA,EACrB;AAEA,SAAO;AACT;AAMO,MAAM,mBAAmB;AAAA,EAC9B,OAAO;AAAA,EACP,WACE;AACJ;AAMO,MAAM,gCAAgC;AAAA,EAC3C,OACE;AAAA,EACF,WAAW;AAAA,EACX,OACE;AAAA,EACF,cAAc;AAChB;AAGA,MAAM,eAAwD,CAAC,QAC7D,IAAI,QAAQ,MAAM,OAAO,iBAAiB,KAAK,MAAM;AAGvD,MAAM,sBAA+D,CAAC,QACpE,IAAI,QAAQ,MAAM,iBAAiB,SAAS;AAOvC,MAAM,eAAe,CAAC,cAAc,MAAM,CAAC;AAElD,IAAI,WAAW;AACb,eAAa,KAAK,cAAc,YAAY,CAAC;AAC/C;AAOO,MAAM,0BAAqD;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaR,YAAY,SAA4C;AACtD,QAAI,SAAS,UAAU;AACrB,8CAAc,QAAQ,SAAS,QAAQ;AACvC,WAAK,WAAW,SAAS;AAAA,IAC3B;AACA,SAAK,mCAA+B;AAAA,MAClC,SAAS;AAAA,IACX;AACA,SAAK,UAAU,SAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,8BACZ,UACA,UACA,SAC+C;AAE/C,eAAW,qBAAqB,CAAC,GAAG,YAAY,GAAG;AACjD,UAAI;AACF,cAAM,YAAY,CAAC,CAAC,mBAAmB,IAAI,CAAC,GAAG,OAAO;AAAA,MACxD,SAAS,GAAQ;AAEf,qBAAa,MAAM;AACnB;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,YAAY;AAAA,QAChC;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,yBACe,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,6BAKV,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAoC7B;AAAA,MACF,CAAC;AAED,YAAM,SAAS,QAAQ,CAAC;AACxB,aAAO,eAAe,MAAM;AAAA,IAC9B;AACA,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,SACX,QACA,UAA2B,CAAC,GACN;AACtB,WAAO,6BAAc,SAAS,GAAG,KAAK,YAAY,IAAI,aAAa,SAAS,YAAY;AACtF,YAAM,QAAQ,OAAO,WAAW,WAAW,SAAS,OAAO,CAAC;AAE5D,YAAM,cAAc,QAAQ;AAC5B,UAAI,eAAe,YAAY,KAAK,GAAG;AACrC,cAAM,gBAAgB,KAAK,WAAW;AACtC,YAAI,WAAW,sCAAsC,aAAa;AAElE,cAAM,sBAAsB,QAAQ;AACpC,YAAI,qBAAqB;AACvB,sBAAY,YAAY,mBAAmB;AAAA,QAC7C;AACA,cAAM,QAAQ,IAAI;AAAA,UAChB,GAAG,8BAA8B,KAAK,IAAI,QAAQ;AAAA,QACpD;AAEA,eAAO,SAAS,SAAK,4BAAY,OAAO,KAAK,CAAC;AAC9C,cAAM;AAAA,MACR;AAEA,YAAM,eAAW;AAAA,QACf,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AACA,UAAI,UAAU;AACZ,gDAAc,QAAQ,QAAQ;AAAA,MAChC;AACA,UAAI;AACF,+DAAgC,OAAO,MAAM;AAC7C,eAAO,SAAS,KAAK,mBAAmB,KAAK,EAAE;AAC/C,cAAM,eAAW,oCAAiB,KAAK;AACvC,cAAM,WAAW,MAAM,KAAK,8BAA8B,UAAU,UAAU,KAAK,OAAO;AAC1F,eAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC1C,eAAO;AAAA,UACL,OAAO,SAAS;AAAA,UAChB,oBAAoB,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AAAA,UACzD,WAAW;AAAA,QACb;AAAA,MACF,SAAS,KAAU;AACjB,YAAI,oBAAoB,GAAG,GAAG;AAC5B,gBAAMA,SAAQ,IAAI,yCAA2B,8BAA8B,SAAS;AACpF,iBAAO,SAAS,SAAK,4BAAY,OAAOA,MAAK,CAAC;AAC9C,gBAAMA;AAAA,QACR,WAAW,aAAa,GAAG,GAAG;AAC5B,gBAAMA,SAAQ,IAAI,yCAA2B,8BAA8B,KAAK;AAChF,iBAAO,SAAS,SAAK,4BAAY,OAAOA,MAAK,CAAC;AAC9C,gBAAMA;AAAA,QACR;AACA,cAAM,QAAQ,IAAI;AAAA,UAChB,GAAG,GAAG,KAAK,8BAA8B,YAAY;AAAA,QACvD;AACA,eAAO,SAAS,SAAK,4BAAY,OAAO,KAAK,CAAC;AAC9C,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAMA,eAAsB,eACpB,QAC+C;AAC/C,QAAM,YAAY;AAClB,QAAM,UAAU,OAAO,MAAM,SAAS;AACtC,MAAI,qBAAqB;AACzB,MAAI,SAAS;AACX,QAAI;AACF,iBAAW,QAAQ,SAAS;AAC1B,YAAI;AACF,gBAAM,cAAc,KAAK,MAAM,IAAI;AACnC,cAAI,aAAa,OAAO;AACtB,iCAAqB,mBAAmB,QAAQ,MAAM,EAAE;AACxD,gBAAI,oBAAoB;AACtB,qBAAO,SAAS,QAAQ,kBAAkB;AAAA,YAC5C;AACA,mBAAO;AAAA,UACT;AAAA,QACF,SAAS,GAAG;AACV;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,GAAQ;AACf,YAAM,IAAI,MAAM,8DAA8D,MAAM,EAAE;AAAA,IACxF;AAAA,EACF;AACA,QAAM,IAAI,MAAM,yDAAyD,MAAM,EAAE;AACnF;",
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport {\n  checkTenantId,\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n} from \"../util/tenantIdUtils.js\";\nimport { credentialLogger, formatError, formatSuccess } from \"../util/logging.js\";\nimport { ensureValidScopeForDevTimeCreds, getScopeResource } from \"../util/scopeUtils.js\";\n\nimport type { AzurePowerShellCredentialOptions } from \"./azurePowerShellCredentialOptions.js\";\nimport { CredentialUnavailableError } from \"../errors.js\";\nimport { processUtils } from \"../util/processUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { uint8ArrayToString, stringToUint8Array } from \"@azure/core-util\";\n\nconst logger = credentialLogger(\"AzurePowerShellCredential\");\n\nconst isWindows = process.platform === \"win32\";\nconst powerShellResourceEnvironmentVariable = \"AZURE_IDENTITY_POWERSHELL_RESOURCE\";\nconst powerShellTenantEnvironmentVariable = \"AZURE_IDENTITY_POWERSHELL_TENANT_ID\";\nconst powerShellPrivateEnvironmentVariables = new Set(\n  [powerShellResourceEnvironmentVariable, powerShellTenantEnvironmentVariable].map((name) =>\n    name.toLowerCase(),\n  ),\n);\n\n/**\n * Creates the child environment used to pass private values to PowerShell.\n *\n * @param resource - The resource passed to PowerShell.\n * @param tenantId - The optional tenant ID passed to PowerShell.\n * @param environment - The environment to copy.\n * @returns A child environment containing canonical private variable names.\n * @internal\n */\nexport function createPowerShellEnvironment(\n  resource: string,\n  tenantId: string | undefined,\n  environment: NodeJS.ProcessEnv = process.env,\n): NodeJS.ProcessEnv {\n  const childEnvironment = Object.fromEntries(\n    Object.entries(environment).filter(\n      ([name]) => !powerShellPrivateEnvironmentVariables.has(name.toLowerCase()),\n    ),\n  );\n  childEnvironment[powerShellResourceEnvironmentVariable] = resource;\n  childEnvironment[powerShellTenantEnvironmentVariable] = tenantId ?? \"\";\n  return childEnvironment;\n}\n\n/**\n * Returns a platform-appropriate command name by appending \".exe\" on Windows.\n *\n * @internal\n */\nexport function formatCommand(commandName: string): string {\n  if (isWindows) {\n    return `${commandName}.exe`;\n  } else {\n    return commandName;\n  }\n}\n\n/**\n * Receives a list of commands to run, executes them, then returns the outputs.\n * If anything fails, an error is thrown.\n * @internal\n */\nasync function runCommands(\n  commands: string[][],\n  timeout?: number,\n  env?: NodeJS.ProcessEnv,\n): Promise<string[]> {\n  const results: string[] = [];\n\n  for (const command of commands) {\n    const [file, ...parameters] = command;\n    const result = await processUtils.execFile(file, parameters, {\n      encoding: \"utf8\",\n      env,\n      timeout,\n    });\n\n    results.push(result);\n  }\n\n  return results;\n}\n\n/**\n * Known PowerShell errors\n * @internal\n */\nexport const powerShellErrors = {\n  login: \"Run Connect-AzAccount to login\",\n  installed:\n    \"The specified module 'Az.Accounts' with version '2.2.0' was not loaded because no valid module file was found in any module directory\",\n};\n\n/**\n * Messages to use when throwing in this credential.\n * @internal\n */\nexport const powerShellPublicErrorMessages = {\n  login:\n    \"Please run 'Connect-AzAccount' from PowerShell to authenticate before using this credential.\",\n  installed: `The 'Az.Account' module >= 2.2.0 is not installed. Install the Azure Az PowerShell module with: \"Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force\".`,\n  claim:\n    \"This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:\",\n  troubleshoot: `To troubleshoot, visit https://aka.ms/azsdk/js/identity/powershellcredential/troubleshoot.`,\n};\n\n// PowerShell Azure User not logged in error check.\nconst isLoginError: (err: Error) => RegExpMatchArray | null = (err: Error) =>\n  err.message.match(`(.*)${powerShellErrors.login}(.*)`);\n\n// Az Module not Installed in Azure PowerShell check.\nconst isNotInstalledError: (err: Error) => RegExpMatchArray | null = (err: Error) =>\n  err.message.match(powerShellErrors.installed);\n\n/**\n * The PowerShell commands to be tried, in order.\n *\n * @internal\n */\nexport const commandStack = [formatCommand(\"pwsh\")];\n\nif (isWindows) {\n  commandStack.push(formatCommand(\"powershell\"));\n}\n\n/**\n * This credential will use the currently logged-in user information from the\n * Azure PowerShell module. To do so, it will read the user access token and\n * expire time with Azure PowerShell command `Get-AzAccessToken -ResourceUrl {ResourceScope}`\n */\nexport class AzurePowerShellCredential implements TokenCredential {\n  private tenantId?: string;\n  private additionallyAllowedTenantIds: string[];\n  private timeout?: number;\n\n  /**\n   * Creates an instance of the {@link AzurePowerShellCredential}.\n   *\n   * To use this credential:\n   * - Install the Azure Az PowerShell module with:\n   *   `Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force`.\n   * - You have already logged in to Azure PowerShell using the command\n   * `Connect-AzAccount` from the command line.\n   *\n   * @param options - Options, to optionally allow multi-tenant requests.\n   */\n  constructor(options?: AzurePowerShellCredentialOptions) {\n    if (options?.tenantId) {\n      checkTenantId(logger, options?.tenantId);\n      this.tenantId = options?.tenantId;\n    }\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.additionallyAllowedTenants,\n    );\n    this.timeout = options?.processTimeoutInMs;\n  }\n\n  /**\n   * Gets the access token from Azure PowerShell\n   * @param resource - The resource to use when getting the token\n   */\n  private async getAzurePowerShellAccessToken(\n    resource: string,\n    tenantId?: string,\n    timeout?: number,\n  ): Promise<{ Token: string; ExpiresOn: string }> {\n    // Clone the stack to avoid mutating it while iterating\n    for (const powerShellCommand of [...commandStack]) {\n      try {\n        await runCommands([[powerShellCommand, \"/?\"]], timeout);\n      } catch (e: any) {\n        // Remove this credential from the original stack so that we don't try it again.\n        commandStack.shift();\n        continue;\n      }\n\n      const results = await runCommands(\n        [\n          [\n            powerShellCommand,\n            \"-NoProfile\",\n            \"-NonInteractive\",\n            \"-Command\",\n            `\n          $tenantId = $env:${powerShellTenantEnvironmentVariable}\n          $resource = $env:${powerShellResourceEnvironmentVariable}\n          $m = Import-Module Az.Accounts -MinimumVersion 2.2.0 -PassThru\n          $useSecureString = $m.Version -ge [version]'2.17.0' -and $m.Version -lt [version]'5.0.0'\n\n          $params = @{\n            ResourceUrl = $resource\n          }\n\n          if ($tenantId.Length -gt 0) {\n            $params[\"TenantId\"] = $tenantId\n          }\n\n          if ($useSecureString) {\n            $params[\"AsSecureString\"] = $true\n          }\n\n          $token = Get-AzAccessToken @params\n\n          $result = New-Object -TypeName PSObject\n          $result | Add-Member -MemberType NoteProperty -Name ExpiresOn -Value $token.ExpiresOn\n\n          if ($token.Token -is [System.Security.SecureString]) {\n            if ($PSVersionTable.PSVersion.Major -lt 7) {\n              $ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($token.Token)\n              try {\n                $result | Add-Member -MemberType NoteProperty -Name Token -Value ([System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr))\n              }\n              finally {\n                [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)\n              }\n            }\n            else {\n              $result | Add-Member -MemberType NoteProperty -Name Token -Value ($token.Token | ConvertFrom-SecureString -AsPlainText)\n            }\n          }\n          else {\n            $result | Add-Member -MemberType NoteProperty -Name Token -Value $token.Token\n          }\n\n          Write-Output (ConvertTo-Json $result)\n          `,\n          ],\n        ],\n        timeout,\n        createPowerShellEnvironment(resource, tenantId),\n      );\n\n      const result = results[0];\n      return parseJsonToken(result);\n    }\n    throw new Error(`Unable to execute PowerShell. Ensure that it is installed in your system`);\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If the authentication cannot be performed through PowerShell, a {@link CredentialUnavailableError} will be thrown.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options: GetTokenOptions = {},\n  ): Promise<AccessToken> {\n    return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {\n      const scope = typeof scopes === \"string\" ? scopes : scopes[0];\n\n      const claimsValue = options.claims;\n      if (claimsValue && claimsValue.trim()) {\n        const encodedClaims = uint8ArrayToString(\n          stringToUint8Array(claimsValue, \"utf-8\"),\n          \"base64\",\n        );\n        let loginCmd = `Connect-AzAccount -ClaimsChallenge ${encodedClaims}`;\n\n        const tenantIdFromOptions = options.tenantId;\n        if (tenantIdFromOptions) {\n          loginCmd += ` -Tenant ${tenantIdFromOptions}`;\n        }\n        const error = new CredentialUnavailableError(\n          `${powerShellPublicErrorMessages.claim} ${loginCmd}`,\n        );\n\n        logger.getToken.info(formatError(scope, error));\n        throw error;\n      }\n\n      const tenantId = processMultiTenantRequest(\n        this.tenantId,\n        options,\n        this.additionallyAllowedTenantIds,\n      );\n      if (tenantId) {\n        checkTenantId(logger, tenantId);\n      }\n      try {\n        ensureValidScopeForDevTimeCreds(scope, logger);\n        logger.getToken.info(`Using the scope ${scope}`);\n        const resource = getScopeResource(scope);\n        const response = await this.getAzurePowerShellAccessToken(resource, tenantId, this.timeout);\n        logger.getToken.info(formatSuccess(scopes));\n        return {\n          token: response.Token,\n          expiresOnTimestamp: new Date(response.ExpiresOn).getTime(),\n          tokenType: \"Bearer\",\n        } as AccessToken;\n      } catch (err: any) {\n        if (isNotInstalledError(err)) {\n          const error = new CredentialUnavailableError(powerShellPublicErrorMessages.installed);\n          logger.getToken.info(formatError(scope, error));\n          throw error;\n        } else if (isLoginError(err)) {\n          const error = new CredentialUnavailableError(powerShellPublicErrorMessages.login);\n          logger.getToken.info(formatError(scope, error));\n          throw error;\n        }\n        const error = new CredentialUnavailableError(\n          `${err}. ${powerShellPublicErrorMessages.troubleshoot}`,\n        );\n        logger.getToken.info(formatError(scope, error));\n        throw error;\n      }\n    });\n  }\n}\n\n/**\n *\n * @internal\n */\nexport async function parseJsonToken(\n  result: string,\n): Promise<{ Token: string; ExpiresOn: string }> {\n  const jsonRegex = /{[^{}]*}/g;\n  const matches = result.match(jsonRegex);\n  let resultWithoutToken = result;\n  if (matches) {\n    try {\n      for (const item of matches) {\n        try {\n          const jsonContent = JSON.parse(item);\n          if (jsonContent?.Token) {\n            resultWithoutToken = resultWithoutToken.replace(item, \"\");\n            if (resultWithoutToken) {\n              logger.getToken.warning(resultWithoutToken);\n            }\n            return jsonContent;\n          }\n        } catch (e) {\n          continue;\n        }\n      }\n    } catch (e: any) {\n      throw new Error(`Unable to parse the output of PowerShell. Received output: ${result}`);\n    }\n  }\n  throw new Error(`No access token found in the output. Received output: ${result}`);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,2BAIO;AACP,qBAA6D;AAC7D,wBAAkE;AAGlE,oBAA2C;AAC3C,0BAA6B;AAC7B,qBAA8B;AAC9B,uBAAuD;AAEvD,MAAM,aAAS,iCAAiB,2BAA2B;AAE3D,MAAM,YAAY,QAAQ,aAAa;AACvC,MAAM,wCAAwC;AAC9C,MAAM,sCAAsC;AAC5C,MAAM,wCAAwC,IAAI;AAAA,EAChD,CAAC,uCAAuC,mCAAmC,EAAE;AAAA,IAAI,CAAC,SAChF,KAAK,YAAY;AAAA,EACnB;AACF;AAWO,SAAS,4BACd,UACA,UACA,cAAiC,QAAQ,KACtB;AACnB,QAAM,mBAAmB,OAAO;AAAA,IAC9B,OAAO,QAAQ,WAAW,EAAE;AAAA,MAC1B,CAAC,CAAC,IAAI,MAAM,CAAC,sCAAsC,IAAI,KAAK,YAAY,CAAC;AAAA,IAC3E;AAAA,EACF;AACA,mBAAiB,qCAAqC,IAAI;AAC1D,mBAAiB,mCAAmC,IAAI,YAAY;AACpE,SAAO;AACT;AAOO,SAAS,cAAc,aAA6B;AACzD,MAAI,WAAW;AACb,WAAO,GAAG,WAAW;AAAA,EACvB,OAAO;AACL,WAAO;AAAA,EACT;AACF;AAOA,eAAe,YACb,UACA,SACA,KACmB;AACnB,QAAM,UAAoB,CAAC;AAE3B,aAAW,WAAW,UAAU;AAC9B,UAAM,CAAC,MAAM,GAAG,UAAU,IAAI;AAC9B,UAAM,SAAS,MAAM,iCAAa,SAAS,MAAM,YAAY;AAAA,MAC3D,UAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAED,YAAQ,KAAK,MAAM;AAAA,EACrB;AAEA,SAAO;AACT;AAMO,MAAM,mBAAmB;AAAA,EAC9B,OAAO;AAAA,EACP,WACE;AACJ;AAMO,MAAM,gCAAgC;AAAA,EAC3C,OACE;AAAA,EACF,WAAW;AAAA,EACX,OACE;AAAA,EACF,cAAc;AAChB;AAGA,MAAM,eAAwD,CAAC,QAC7D,IAAI,QAAQ,MAAM,OAAO,iBAAiB,KAAK,MAAM;AAGvD,MAAM,sBAA+D,CAAC,QACpE,IAAI,QAAQ,MAAM,iBAAiB,SAAS;AAOvC,MAAM,eAAe,CAAC,cAAc,MAAM,CAAC;AAElD,IAAI,WAAW;AACb,eAAa,KAAK,cAAc,YAAY,CAAC;AAC/C;AAOO,MAAM,0BAAqD;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaR,YAAY,SAA4C;AACtD,QAAI,SAAS,UAAU;AACrB,8CAAc,QAAQ,SAAS,QAAQ;AACvC,WAAK,WAAW,SAAS;AAAA,IAC3B;AACA,SAAK,mCAA+B;AAAA,MAClC,SAAS;AAAA,IACX;AACA,SAAK,UAAU,SAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,8BACZ,UACA,UACA,SAC+C;AAE/C,eAAW,qBAAqB,CAAC,GAAG,YAAY,GAAG;AACjD,UAAI;AACF,cAAM,YAAY,CAAC,CAAC,mBAAmB,IAAI,CAAC,GAAG,OAAO;AAAA,MACxD,SAAS,GAAQ;AAEf,qBAAa,MAAM;AACnB;AAAA,MACF;AAEA,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,UACE;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,6BACiB,mCAAmC;AAAA,6BACnC,qCAAqC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAyCxD;AAAA,QACF;AAAA,QACA;AAAA,QACA,4BAA4B,UAAU,QAAQ;AAAA,MAChD;AAEA,YAAM,SAAS,QAAQ,CAAC;AACxB,aAAO,eAAe,MAAM;AAAA,IAC9B;AACA,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,SACX,QACA,UAA2B,CAAC,GACN;AACtB,WAAO,6BAAc,SAAS,GAAG,KAAK,YAAY,IAAI,aAAa,SAAS,YAAY;AACtF,YAAM,QAAQ,OAAO,WAAW,WAAW,SAAS,OAAO,CAAC;AAE5D,YAAM,cAAc,QAAQ;AAC5B,UAAI,eAAe,YAAY,KAAK,GAAG;AACrC,cAAM,oBAAgB;AAAA,cACpB,qCAAmB,aAAa,OAAO;AAAA,UACvC;AAAA,QACF;AACA,YAAI,WAAW,sCAAsC,aAAa;AAElE,cAAM,sBAAsB,QAAQ;AACpC,YAAI,qBAAqB;AACvB,sBAAY,YAAY,mBAAmB;AAAA,QAC7C;AACA,cAAM,QAAQ,IAAI;AAAA,UAChB,GAAG,8BAA8B,KAAK,IAAI,QAAQ;AAAA,QACpD;AAEA,eAAO,SAAS,SAAK,4BAAY,OAAO,KAAK,CAAC;AAC9C,cAAM;AAAA,MACR;AAEA,YAAM,eAAW;AAAA,QACf,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AACA,UAAI,UAAU;AACZ,gDAAc,QAAQ,QAAQ;AAAA,MAChC;AACA,UAAI;AACF,+DAAgC,OAAO,MAAM;AAC7C,eAAO,SAAS,KAAK,mBAAmB,KAAK,EAAE;AAC/C,cAAM,eAAW,oCAAiB,KAAK;AACvC,cAAM,WAAW,MAAM,KAAK,8BAA8B,UAAU,UAAU,KAAK,OAAO;AAC1F,eAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC1C,eAAO;AAAA,UACL,OAAO,SAAS;AAAA,UAChB,oBAAoB,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AAAA,UACzD,WAAW;AAAA,QACb;AAAA,MACF,SAAS,KAAU;AACjB,YAAI,oBAAoB,GAAG,GAAG;AAC5B,gBAAMA,SAAQ,IAAI,yCAA2B,8BAA8B,SAAS;AACpF,iBAAO,SAAS,SAAK,4BAAY,OAAOA,MAAK,CAAC;AAC9C,gBAAMA;AAAA,QACR,WAAW,aAAa,GAAG,GAAG;AAC5B,gBAAMA,SAAQ,IAAI,yCAA2B,8BAA8B,KAAK;AAChF,iBAAO,SAAS,SAAK,4BAAY,OAAOA,MAAK,CAAC;AAC9C,gBAAMA;AAAA,QACR;AACA,cAAM,QAAQ,IAAI;AAAA,UAChB,GAAG,GAAG,KAAK,8BAA8B,YAAY;AAAA,QACvD;AACA,eAAO,SAAS,SAAK,4BAAY,OAAO,KAAK,CAAC;AAC9C,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAMA,eAAsB,eACpB,QAC+C;AAC/C,QAAM,YAAY;AAClB,QAAM,UAAU,OAAO,MAAM,SAAS;AACtC,MAAI,qBAAqB;AACzB,MAAI,SAAS;AACX,QAAI;AACF,iBAAW,QAAQ,SAAS;AAC1B,YAAI;AACF,gBAAM,cAAc,KAAK,MAAM,IAAI;AACnC,cAAI,aAAa,OAAO;AACtB,iCAAqB,mBAAmB,QAAQ,MAAM,EAAE;AACxD,gBAAI,oBAAoB;AACtB,qBAAO,SAAS,QAAQ,kBAAkB;AAAA,YAC5C;AACA,mBAAO;AAAA,UACT;AAAA,QACF,SAAS,GAAG;AACV;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,GAAQ;AACf,YAAM,IAAI,MAAM,8DAA8D,MAAM,EAAE;AAAA,IACxF;AAAA,EACF;AACA,QAAM,IAAI,MAAM,yDAAyD,MAAM,EAAE;AACnF;",
   "names": ["error"]
 }

package/dist/commonjs/credentials/clientCertificateCredentialModels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientCertificateCredentialModels.d.ts","sourceRoot":"","sources":["../../../src/credentials/clientCertificateCredentialModels.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD;;GAEG;AACH,MAAM,MAAM,2CAA2C,GACnD,+BAA+B,GAC/B,mCAAmC,CAAC"}
+{"version":3,"file":"clientCertificateCredentialModels.d.ts","sourceRoot":"","sources":["../../../src/credentials/clientCertificateCredentialModels.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD;;GAEG;AACH,MAAM,MAAM,2CAA2C,GACrD,+BAA+B,GAAG,mCAAmC,CAAC"}

package/dist/commonjs/credentials/clientCertificateCredentialModels.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/credentials/clientCertificateCredentialModels.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\n/**\n * Required configuration options for the {@link ClientCertificateCredential}, with the string contents of a PEM certificate\n */\nexport interface ClientCertificatePEMCertificate {\n  /**\n   * The PEM-encoded public/private key certificate on the filesystem.\n   * Ensure that certificate is in PEM format and contains both the public and private keys.\n   */\n  certificate: string;\n\n  /**\n   * The password for the certificate file.\n   */\n  certificatePassword?: string;\n}\n/**\n * Required configuration options for the {@link ClientCertificateCredential}, with the path to a PEM certificate.\n */\nexport interface ClientCertificatePEMCertificatePath {\n  /**\n   * The path to the PEM-encoded public/private key certificate on the filesystem.\n   */\n  certificatePath: string;\n\n  /**\n   * The password for the certificate file.\n   */\n  certificatePassword?: string;\n}\n/**\n * Required configuration options for the {@link ClientCertificateCredential}, with either the string contents of a PEM certificate, or the path to a PEM certificate.\n */\nexport type ClientCertificateCredentialPEMConfiguration =\n  | ClientCertificatePEMCertificate\n  | ClientCertificatePEMCertificatePath;\n"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\n/**\n * Required configuration options for the {@link ClientCertificateCredential}, with the string contents of a PEM certificate\n */\nexport interface ClientCertificatePEMCertificate {\n  /**\n   * The PEM-encoded public/private key certificate on the filesystem.\n   * Ensure that certificate is in PEM format and contains both the public and private keys.\n   */\n  certificate: string;\n\n  /**\n   * The password for the certificate file.\n   */\n  certificatePassword?: string;\n}\n/**\n * Required configuration options for the {@link ClientCertificateCredential}, with the path to a PEM certificate.\n */\nexport interface ClientCertificatePEMCertificatePath {\n  /**\n   * The path to the PEM-encoded public/private key certificate on the filesystem.\n   */\n  certificatePath: string;\n\n  /**\n   * The password for the certificate file.\n   */\n  certificatePassword?: string;\n}\n/**\n * Required configuration options for the {@link ClientCertificateCredential}, with either the string contents of a PEM certificate, or the path to a PEM certificate.\n */\nexport type ClientCertificateCredentialPEMConfiguration =\n  ClientCertificatePEMCertificate | ClientCertificatePEMCertificatePath;\n"],
   "mappings": ";;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/commonjs/credentials/defaultAzureCredential.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/credentials/defaultAzureCredential.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type {\n  DefaultAzureCredentialClientIdOptions,\n  DefaultAzureCredentialOptions,\n  DefaultAzureCredentialResourceIdOptions,\n} from \"./defaultAzureCredentialOptions.js\";\n\nimport { ManagedIdentityCredential } from \"./managedIdentityCredential/index.js\";\nimport { VisualStudioCodeCredential } from \"./visualStudioCodeCredential.js\";\nimport { AzureCliCredential } from \"./azureCliCredential.js\";\nimport { AzureDeveloperCliCredential } from \"./azureDeveloperCliCredential.js\";\nimport { AzurePowerShellCredential } from \"./azurePowerShellCredential.js\";\nimport { ChainedTokenCredential } from \"./chainedTokenCredential.js\";\nimport { EnvironmentCredential } from \"./environmentCredential.js\";\nimport type { TokenCredential } from \"@azure/core-auth\";\nimport { WorkloadIdentityCredential } from \"./workloadIdentityCredential.js\";\nimport { credentialLogger } from \"../util/logging.js\";\nimport {\n  createDefaultAzureCliCredential,\n  createDefaultAzureDeveloperCliCredential,\n  createDefaultAzurePowershellCredential,\n  createDefaultBrokerCredential,\n  createDefaultManagedIdentityCredential,\n  createDefaultVisualStudioCodeCredential,\n  createDefaultWorkloadIdentityCredential,\n  createDefaultEnvironmentCredential,\n} from \"./defaultAzureCredentialFunctions.js\";\n\nconst logger = credentialLogger(\"DefaultAzureCredential\");\n\n/**\n * A no-op credential that logs the reason it was skipped if getToken is called.\n * @internal\n */\nexport class UnavailableDefaultCredential implements TokenCredential {\n  credentialUnavailableErrorMessage: string;\n  credentialName: string;\n\n  constructor(credentialName: string, message: string) {\n    this.credentialName = credentialName;\n    this.credentialUnavailableErrorMessage = message;\n  }\n\n  getToken(): Promise<null> {\n    logger.getToken.info(\n      `Skipping ${this.credentialName}, reason: ${this.credentialUnavailableErrorMessage}`,\n    );\n    return Promise.resolve(null);\n  }\n}\n\n/**\n * Provides a default {@link ChainedTokenCredential} configuration that works for most\n * applications that use Azure SDK client libraries. For more information, see\n * [DefaultAzureCredential overview](https://aka.ms/azsdk/js/identity/credential-chains#defaultazurecredential-overview).\n *\n * The following credential types will be tried, in order:\n *\n * - {@link EnvironmentCredential}\n * - {@link WorkloadIdentityCredential}\n * - {@link ManagedIdentityCredential}\n * - {@link VisualStudioCodeCredential}\n * - {@link AzureCliCredential}\n * - {@link AzurePowerShellCredential}\n * - {@link AzureDeveloperCliCredential}\n * - BrokerCredential (a broker-enabled credential that requires \\@azure/identity-broker is installed)\n *\n * Consult the documentation of these credential types for more information\n * on how they attempt authentication.\n *\n * The following example demonstrates how to use the `requiredEnvVars` option to ensure that certain environment variables are set before the `DefaultAzureCredential` is instantiated.\n * If any of the specified environment variables are missing or empty, an error will be thrown, preventing the application from continuing execution without the necessary configuration.\n * It also demonstrates how to set the `AZURE_TOKEN_CREDENTIALS` environment variable to control which credentials are included in the chain.\n \n * ```ts snippet:defaultazurecredential_requiredEnvVars\n * import { DefaultAzureCredential } from \"@azure/identity\";\n *\n * const credential = new DefaultAzureCredential({\n *   requiredEnvVars: [\n *     \"AZURE_CLIENT_ID\",\n *     \"AZURE_TENANT_ID\",\n *     \"AZURE_CLIENT_SECRET\",\n *     \"AZURE_TOKEN_CREDENTIALS\",\n *   ],\n * });\n * ```\n */\nexport class DefaultAzureCredential extends ChainedTokenCredential {\n  /**\n   * Creates an instance of the DefaultAzureCredential class with {@link DefaultAzureCredentialClientIdOptions}.\n   *\n   * @param options - Optional parameters. See {@link DefaultAzureCredentialClientIdOptions}.\n   */\n  constructor(options?: DefaultAzureCredentialClientIdOptions);\n\n  /**\n   * Creates an instance of the DefaultAzureCredential class with {@link DefaultAzureCredentialResourceIdOptions}.\n   *\n   * @param options - Optional parameters. See {@link DefaultAzureCredentialResourceIdOptions}.\n   */\n  constructor(options?: DefaultAzureCredentialResourceIdOptions);\n\n  /**\n   * Creates an instance of the DefaultAzureCredential class with {@link DefaultAzureCredentialOptions}.\n   *\n   * @param options - Optional parameters. See {@link DefaultAzureCredentialOptions}.\n   */\n  constructor(options?: DefaultAzureCredentialOptions);\n\n  constructor(options?: DefaultAzureCredentialOptions) {\n    validateRequiredEnvVars(options);\n    // If AZURE_TOKEN_CREDENTIALS is not set, use the default credential chain.\n    const azureTokenCredentials = process.env.AZURE_TOKEN_CREDENTIALS\n      ? process.env.AZURE_TOKEN_CREDENTIALS.trim().toLowerCase()\n      : undefined;\n    const devCredentialFunctions = [\n      createDefaultVisualStudioCodeCredential,\n      createDefaultAzureCliCredential,\n      createDefaultAzurePowershellCredential,\n      createDefaultAzureDeveloperCliCredential,\n      createDefaultBrokerCredential,\n    ];\n    const prodCredentialFunctions = [\n      createDefaultEnvironmentCredential,\n      createDefaultWorkloadIdentityCredential,\n      createDefaultManagedIdentityCredential,\n    ];\n    let credentialFunctions = [];\n    const validCredentialNames =\n      \"EnvironmentCredential, WorkloadIdentityCredential, ManagedIdentityCredential, VisualStudioCodeCredential, AzureCliCredential, AzurePowerShellCredential, AzureDeveloperCliCredential\";\n    // If AZURE_TOKEN_CREDENTIALS is set, use it to determine which credentials to use.\n    // The value of AZURE_TOKEN_CREDENTIALS should be either \"dev\" or \"prod\" or any one of these credentials - {validCredentialNames}.\n    if (azureTokenCredentials) {\n      switch (azureTokenCredentials) {\n        case \"dev\":\n          credentialFunctions = devCredentialFunctions;\n          break;\n        case \"prod\":\n          credentialFunctions = prodCredentialFunctions;\n          break;\n        case \"environmentcredential\":\n          credentialFunctions = [createDefaultEnvironmentCredential];\n          break;\n        case \"workloadidentitycredential\":\n          credentialFunctions = [createDefaultWorkloadIdentityCredential];\n          break;\n        case \"managedidentitycredential\":\n          // Setting `sendProbeRequest` to false to ensure ManagedIdentityCredential behavior\n          // is consistent when used standalone in DAC chain or used directly.\n          credentialFunctions = [\n            () => createDefaultManagedIdentityCredential({ sendProbeRequest: false }),\n          ];\n          break;\n        case \"visualstudiocodecredential\":\n          credentialFunctions = [createDefaultVisualStudioCodeCredential];\n          break;\n        case \"azureclicredential\":\n          credentialFunctions = [createDefaultAzureCliCredential];\n          break;\n        case \"azurepowershellcredential\":\n          credentialFunctions = [createDefaultAzurePowershellCredential];\n          break;\n        case \"azuredeveloperclicredential\":\n          credentialFunctions = [createDefaultAzureDeveloperCliCredential];\n          break;\n        default: {\n          // If AZURE_TOKEN_CREDENTIALS is set to an unsupported value, throw an error.\n          // This will prevent the creation of the DefaultAzureCredential.\n          const errorMessage = `Invalid value for AZURE_TOKEN_CREDENTIALS = ${process.env.AZURE_TOKEN_CREDENTIALS}. Valid values are 'prod' or 'dev' or any of these credentials - ${validCredentialNames}.`;\n          logger.warning(errorMessage);\n          throw new Error(errorMessage);\n        }\n      }\n    } else {\n      // If AZURE_TOKEN_CREDENTIALS is not set, use the default credential chain.\n      credentialFunctions = [...prodCredentialFunctions, ...devCredentialFunctions];\n    }\n\n    // Errors from individual credentials should not be thrown in the DefaultAzureCredential constructor, instead throwing on getToken() which is handled by ChainedTokenCredential.\n    // When adding new credentials to the default chain, consider:\n    // 1. Making the constructor parameters required and explicit\n    // 2. Validating any required parameters in the factory function\n    // 3. Returning a UnavailableDefaultCredential from the factory function if a credential is unavailable for any reason\n    const credentials: TokenCredential[] = credentialFunctions.map((createCredentialFn) => {\n      try {\n        return createCredentialFn(options ?? {});\n      } catch (err: any) {\n        logger.warning(\n          `Skipped ${createCredentialFn.name} because of an error creating the credential: ${err}`,\n        );\n        return new UnavailableDefaultCredential(createCredentialFn.name, err.message);\n      }\n    });\n\n    super(...credentials);\n  }\n}\n\n/**\n * This function checks that all environment variables in `options.requiredEnvVars` are set and non-empty.\n * If any are missing or empty, it throws an error.\n */\nfunction validateRequiredEnvVars(options?: DefaultAzureCredentialOptions) {\n  if (options?.requiredEnvVars) {\n    const requiredVars = Array.isArray(options.requiredEnvVars)\n      ? options.requiredEnvVars\n      : [options.requiredEnvVars];\n    const missing = requiredVars.filter((envVar) => !process.env[envVar]);\n    if (missing.length > 0) {\n      const errorMessage = `Required environment ${missing.length === 1 ? \"variable\" : \"variables\"} '${missing.join(\", \")}' for DefaultAzureCredential ${missing.length === 1 ? \"is\" : \"are\"} not set or empty.`;\n      logger.warning(errorMessage);\n      throw new Error(errorMessage);\n    }\n  }\n}\n"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type {\n  DefaultAzureCredentialClientIdOptions,\n  DefaultAzureCredentialOptions,\n  DefaultAzureCredentialResourceIdOptions,\n} from \"./defaultAzureCredentialOptions.js\";\n\nimport { ManagedIdentityCredential } from \"#platform/credentials/managedIdentityCredential/index\";\nimport { VisualStudioCodeCredential } from \"#platform/credentials/visualStudioCodeCredential\";\nimport { AzureCliCredential } from \"#platform/credentials/azureCliCredential\";\nimport { AzureDeveloperCliCredential } from \"#platform/credentials/azureDeveloperCliCredential\";\nimport { AzurePowerShellCredential } from \"#platform/credentials/azurePowerShellCredential\";\nimport { ChainedTokenCredential } from \"./chainedTokenCredential.js\";\nimport { EnvironmentCredential } from \"#platform/credentials/environmentCredential\";\nimport type { TokenCredential } from \"@azure/core-auth\";\nimport { WorkloadIdentityCredential } from \"#platform/credentials/workloadIdentityCredential\";\nimport { credentialLogger } from \"../util/logging.js\";\nimport {\n  createDefaultAzureCliCredential,\n  createDefaultAzureDeveloperCliCredential,\n  createDefaultAzurePowershellCredential,\n  createDefaultBrokerCredential,\n  createDefaultManagedIdentityCredential,\n  createDefaultVisualStudioCodeCredential,\n  createDefaultWorkloadIdentityCredential,\n  createDefaultEnvironmentCredential,\n} from \"./defaultAzureCredentialFunctions.js\";\n\nconst logger = credentialLogger(\"DefaultAzureCredential\");\n\n/**\n * A no-op credential that logs the reason it was skipped if getToken is called.\n * @internal\n */\nexport class UnavailableDefaultCredential implements TokenCredential {\n  credentialUnavailableErrorMessage: string;\n  credentialName: string;\n\n  constructor(credentialName: string, message: string) {\n    this.credentialName = credentialName;\n    this.credentialUnavailableErrorMessage = message;\n  }\n\n  getToken(): Promise<null> {\n    logger.getToken.info(\n      `Skipping ${this.credentialName}, reason: ${this.credentialUnavailableErrorMessage}`,\n    );\n    return Promise.resolve(null);\n  }\n}\n\n/**\n * Provides a default {@link ChainedTokenCredential} configuration that works for most\n * applications that use Azure SDK client libraries. For more information, see\n * [DefaultAzureCredential overview](https://aka.ms/azsdk/js/identity/credential-chains#defaultazurecredential-overview).\n *\n * The following credential types will be tried, in order:\n *\n * - {@link EnvironmentCredential}\n * - {@link WorkloadIdentityCredential}\n * - {@link ManagedIdentityCredential}\n * - {@link VisualStudioCodeCredential}\n * - {@link AzureCliCredential}\n * - {@link AzurePowerShellCredential}\n * - {@link AzureDeveloperCliCredential}\n * - BrokerCredential (a broker-enabled credential that requires \\@azure/identity-broker is installed)\n *\n * Consult the documentation of these credential types for more information\n * on how they attempt authentication.\n *\n * The following example demonstrates how to use the `requiredEnvVars` option to ensure that certain environment variables are set before the `DefaultAzureCredential` is instantiated.\n * If any of the specified environment variables are missing or empty, an error will be thrown, preventing the application from continuing execution without the necessary configuration.\n * It also demonstrates how to set the `AZURE_TOKEN_CREDENTIALS` environment variable to control which credentials are included in the chain.\n \n * ```ts snippet:defaultazurecredential_requiredEnvVars\n * import { DefaultAzureCredential } from \"@azure/identity\";\n *\n * const credential = new DefaultAzureCredential({\n *   requiredEnvVars: [\n *     \"AZURE_CLIENT_ID\",\n *     \"AZURE_TENANT_ID\",\n *     \"AZURE_CLIENT_SECRET\",\n *     \"AZURE_TOKEN_CREDENTIALS\",\n *   ],\n * });\n * ```\n */\nexport class DefaultAzureCredential extends ChainedTokenCredential {\n  /**\n   * Creates an instance of the DefaultAzureCredential class with {@link DefaultAzureCredentialClientIdOptions}.\n   *\n   * @param options - Optional parameters. See {@link DefaultAzureCredentialClientIdOptions}.\n   */\n  constructor(options?: DefaultAzureCredentialClientIdOptions);\n\n  /**\n   * Creates an instance of the DefaultAzureCredential class with {@link DefaultAzureCredentialResourceIdOptions}.\n   *\n   * @param options - Optional parameters. See {@link DefaultAzureCredentialResourceIdOptions}.\n   */\n  constructor(options?: DefaultAzureCredentialResourceIdOptions);\n\n  /**\n   * Creates an instance of the DefaultAzureCredential class with {@link DefaultAzureCredentialOptions}.\n   *\n   * @param options - Optional parameters. See {@link DefaultAzureCredentialOptions}.\n   */\n  constructor(options?: DefaultAzureCredentialOptions);\n\n  constructor(options?: DefaultAzureCredentialOptions) {\n    validateRequiredEnvVars(options);\n    // If AZURE_TOKEN_CREDENTIALS is not set, use the default credential chain.\n    const azureTokenCredentials = process.env.AZURE_TOKEN_CREDENTIALS\n      ? process.env.AZURE_TOKEN_CREDENTIALS.trim().toLowerCase()\n      : undefined;\n    const devCredentialFunctions = [\n      createDefaultVisualStudioCodeCredential,\n      createDefaultAzureCliCredential,\n      createDefaultAzurePowershellCredential,\n      createDefaultAzureDeveloperCliCredential,\n      createDefaultBrokerCredential,\n    ];\n    const prodCredentialFunctions = [\n      createDefaultEnvironmentCredential,\n      createDefaultWorkloadIdentityCredential,\n      createDefaultManagedIdentityCredential,\n    ];\n    let credentialFunctions = [];\n    const validCredentialNames =\n      \"EnvironmentCredential, WorkloadIdentityCredential, ManagedIdentityCredential, VisualStudioCodeCredential, AzureCliCredential, AzurePowerShellCredential, AzureDeveloperCliCredential\";\n    // If AZURE_TOKEN_CREDENTIALS is set, use it to determine which credentials to use.\n    // The value of AZURE_TOKEN_CREDENTIALS should be either \"dev\" or \"prod\" or any one of these credentials - {validCredentialNames}.\n    if (azureTokenCredentials) {\n      switch (azureTokenCredentials) {\n        case \"dev\":\n          credentialFunctions = devCredentialFunctions;\n          break;\n        case \"prod\":\n          credentialFunctions = prodCredentialFunctions;\n          break;\n        case \"environmentcredential\":\n          credentialFunctions = [createDefaultEnvironmentCredential];\n          break;\n        case \"workloadidentitycredential\":\n          credentialFunctions = [createDefaultWorkloadIdentityCredential];\n          break;\n        case \"managedidentitycredential\":\n          // Setting `sendProbeRequest` to false to ensure ManagedIdentityCredential behavior\n          // is consistent when used standalone in DAC chain or used directly.\n          credentialFunctions = [\n            () => createDefaultManagedIdentityCredential({ sendProbeRequest: false }),\n          ];\n          break;\n        case \"visualstudiocodecredential\":\n          credentialFunctions = [createDefaultVisualStudioCodeCredential];\n          break;\n        case \"azureclicredential\":\n          credentialFunctions = [createDefaultAzureCliCredential];\n          break;\n        case \"azurepowershellcredential\":\n          credentialFunctions = [createDefaultAzurePowershellCredential];\n          break;\n        case \"azuredeveloperclicredential\":\n          credentialFunctions = [createDefaultAzureDeveloperCliCredential];\n          break;\n        default: {\n          // If AZURE_TOKEN_CREDENTIALS is set to an unsupported value, throw an error.\n          // This will prevent the creation of the DefaultAzureCredential.\n          const errorMessage = `Invalid value for AZURE_TOKEN_CREDENTIALS = ${process.env.AZURE_TOKEN_CREDENTIALS}. Valid values are 'prod' or 'dev' or any of these credentials - ${validCredentialNames}.`;\n          logger.warning(errorMessage);\n          throw new Error(errorMessage);\n        }\n      }\n    } else {\n      // If AZURE_TOKEN_CREDENTIALS is not set, use the default credential chain.\n      credentialFunctions = [...prodCredentialFunctions, ...devCredentialFunctions];\n    }\n\n    // Errors from individual credentials should not be thrown in the DefaultAzureCredential constructor, instead throwing on getToken() which is handled by ChainedTokenCredential.\n    // When adding new credentials to the default chain, consider:\n    // 1. Making the constructor parameters required and explicit\n    // 2. Validating any required parameters in the factory function\n    // 3. Returning a UnavailableDefaultCredential from the factory function if a credential is unavailable for any reason\n    const credentials: TokenCredential[] = credentialFunctions.map((createCredentialFn) => {\n      try {\n        return createCredentialFn(options ?? {});\n      } catch (err: any) {\n        logger.warning(\n          `Skipped ${createCredentialFn.name} because of an error creating the credential: ${err}`,\n        );\n        return new UnavailableDefaultCredential(createCredentialFn.name, err.message);\n      }\n    });\n\n    super(...credentials);\n  }\n}\n\n/**\n * This function checks that all environment variables in `options.requiredEnvVars` are set and non-empty.\n * If any are missing or empty, it throws an error.\n */\nfunction validateRequiredEnvVars(options?: DefaultAzureCredentialOptions) {\n  if (options?.requiredEnvVars) {\n    const requiredVars = Array.isArray(options.requiredEnvVars)\n      ? options.requiredEnvVars\n      : [options.requiredEnvVars];\n    const missing = requiredVars.filter((envVar) => !process.env[envVar]);\n    if (missing.length > 0) {\n      const errorMessage = `Required environment ${missing.length === 1 ? \"variable\" : \"variables\"} '${missing.join(\", \")}' for DefaultAzureCredential ${missing.length === 1 ? \"is\" : \"are\"} not set or empty.`;\n      logger.warning(errorMessage);\n      throw new Error(errorMessage);\n    }\n  }\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,oCAAuC;AAIvC,qBAAiC;AACjC,6CASO;AAEP,MAAM,aAAS,iCAAiB,wBAAwB;AAMjD,MAAM,6BAAwD;AAAA,EACnE;AAAA,EACA;AAAA,EAEA,YAAY,gBAAwB,SAAiB;AACnD,SAAK,iBAAiB;AACtB,SAAK,oCAAoC;AAAA,EAC3C;AAAA,EAEA,WAA0B;AACxB,WAAO,SAAS;AAAA,MACd,YAAY,KAAK,cAAc,aAAa,KAAK,iCAAiC;AAAA,IACpF;AACA,WAAO,QAAQ,QAAQ,IAAI;AAAA,EAC7B;AACF;AAsCO,MAAM,+BAA+B,qDAAuB;AAAA,EAsBjE,YAAY,SAAyC;AACnD,4BAAwB,OAAO;AAE/B,UAAM,wBAAwB,QAAQ,IAAI,0BACtC,QAAQ,IAAI,wBAAwB,KAAK,EAAE,YAAY,IACvD;AACJ,UAAM,yBAAyB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,0BAA0B;AAAA,MAC9B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,sBAAsB,CAAC;AAC3B,UAAM,uBACJ;AAGF,QAAI,uBAAuB;AACzB,cAAQ,uBAAuB;AAAA,QAC7B,KAAK;AACH,gCAAsB;AACtB;AAAA,QACF,KAAK;AACH,gCAAsB;AACtB;AAAA,QACF,KAAK;AACH,gCAAsB,CAAC,yEAAkC;AACzD;AAAA,QACF,KAAK;AACH,gCAAsB,CAAC,8EAAuC;AAC9D;AAAA,QACF,KAAK;AAGH,gCAAsB;AAAA,YACpB,UAAM,+EAAuC,EAAE,kBAAkB,MAAM,CAAC;AAAA,UAC1E;AACA;AAAA,QACF,KAAK;AACH,gCAAsB,CAAC,8EAAuC;AAC9D;AAAA,QACF,KAAK;AACH,gCAAsB,CAAC,sEAA+B;AACtD;AAAA,QACF,KAAK;AACH,gCAAsB,CAAC,6EAAsC;AAC7D;AAAA,QACF,KAAK;AACH,gCAAsB,CAAC,+EAAwC;AAC/D;AAAA,QACF,SAAS;AAGP,gBAAM,eAAe,+CAA+C,QAAQ,IAAI,uBAAuB,oEAAoE,oBAAoB;AAC/L,iBAAO,QAAQ,YAAY;AAC3B,gBAAM,IAAI,MAAM,YAAY;AAAA,QAC9B;AAAA,MACF;AAAA,IACF,OAAO;AAEL,4BAAsB,CAAC,GAAG,yBAAyB,GAAG,sBAAsB;AAAA,IAC9E;AAOA,UAAM,cAAiC,oBAAoB,IAAI,CAAC,uBAAuB;AACrF,UAAI;AACF,eAAO,mBAAmB,WAAW,CAAC,CAAC;AAAA,MACzC,SAAS,KAAU;AACjB,eAAO;AAAA,UACL,WAAW,mBAAmB,IAAI,iDAAiD,GAAG;AAAA,QACxF;AACA,eAAO,IAAI,6BAA6B,mBAAmB,MAAM,IAAI,OAAO;AAAA,MAC9E;AAAA,IACF,CAAC;AAED,UAAM,GAAG,WAAW;AAAA,EACtB;AACF;AAMA,SAAS,wBAAwB,SAAyC;AACxE,MAAI,SAAS,iBAAiB;AAC5B,UAAM,eAAe,MAAM,QAAQ,QAAQ,eAAe,IACtD,QAAQ,kBACR,CAAC,QAAQ,eAAe;AAC5B,UAAM,UAAU,aAAa,OAAO,CAAC,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC;AACpE,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,eAAe,wBAAwB,QAAQ,WAAW,IAAI,aAAa,WAAW,KAAK,QAAQ,KAAK,IAAI,CAAC,gCAAgC,QAAQ,WAAW,IAAI,OAAO,KAAK;AACtL,aAAO,QAAQ,YAAY;AAC3B,YAAM,IAAI,MAAM,YAAY;AAAA,IAC9B;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/commonjs/credentials/defaultAzureCredentialFunctions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/credentials/defaultAzureCredentialFunctions.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { TokenCredential } from \"@azure/core-auth\";\nimport type {\n  DefaultAzureCredentialClientIdOptions,\n  DefaultAzureCredentialOptions,\n  DefaultAzureCredentialResourceIdOptions,\n} from \"./defaultAzureCredentialOptions.js\";\nimport { EnvironmentCredential } from \"./environmentCredential.js\";\nimport type {\n  ManagedIdentityCredentialClientIdOptions,\n  ManagedIdentityCredentialResourceIdOptions,\n} from \"./managedIdentityCredential/options.js\";\nimport { ManagedIdentityCredential } from \"./managedIdentityCredential/index.js\";\nimport { WorkloadIdentityCredential } from \"./workloadIdentityCredential.js\";\nimport { AzureDeveloperCliCredential } from \"./azureDeveloperCliCredential.js\";\nimport { AzureCliCredential } from \"./azureCliCredential.js\";\nimport { AzurePowerShellCredential } from \"./azurePowerShellCredential.js\";\nimport type { WorkloadIdentityCredentialOptions } from \"./workloadIdentityCredentialOptions.js\";\nimport { VisualStudioCodeCredential } from \"./visualStudioCodeCredential.js\";\nimport { BrokerCredential } from \"./brokerCredential.js\";\n\n/**\n * Creates a {@link BrokerCredential} instance with the provided options.\n * This credential uses the Windows Authentication Manager (WAM) broker for authentication.\n * It will only attempt to authenticate silently using the default broker account\n *\n * @param options - Options for configuring the credential.\n *\n * @internal\n */\nexport function createDefaultBrokerCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new BrokerCredential(options);\n}\n\n/**\n * Creates a {@link VisualStudioCodeCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultVisualStudioCodeCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new VisualStudioCodeCredential(options);\n}\n\n/**\n * Creates a {@link ManagedIdentityCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultManagedIdentityCredential(\n  options: (\n    | DefaultAzureCredentialOptions\n    | DefaultAzureCredentialResourceIdOptions\n    | DefaultAzureCredentialClientIdOptions\n  ) & { sendProbeRequest?: boolean } = {},\n): TokenCredential {\n  options.retryOptions ??= {\n    maxRetries: 5,\n    retryDelayInMs: 800,\n  };\n  // ManagedIdentityCredential inside DAC chain should send a probe request by default.\n  // This is different from standalone ManagedIdentityCredential behavior\n  // or when AZURE_TOKEN_CREDENTIALS is set to only ManagedIdentityCredential.\n  options.sendProbeRequest ??= true;\n  const managedIdentityClientId =\n    (options as DefaultAzureCredentialClientIdOptions)?.managedIdentityClientId ??\n    process.env.AZURE_CLIENT_ID;\n  const workloadIdentityClientId =\n    (options as DefaultAzureCredentialClientIdOptions)?.workloadIdentityClientId ??\n    managedIdentityClientId;\n  const managedResourceId = (options as DefaultAzureCredentialResourceIdOptions)\n    ?.managedIdentityResourceId;\n  const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;\n  const tenantId = options?.tenantId ?? process.env.AZURE_TENANT_ID;\n  if (managedResourceId) {\n    const managedIdentityResourceIdOptions: ManagedIdentityCredentialResourceIdOptions = {\n      ...options,\n      resourceId: managedResourceId,\n    };\n    return new ManagedIdentityCredential(managedIdentityResourceIdOptions);\n  }\n\n  if (workloadFile && workloadIdentityClientId) {\n    const workloadIdentityCredentialOptions: DefaultAzureCredentialOptions = {\n      ...options,\n      tenantId: tenantId,\n    };\n\n    return new ManagedIdentityCredential(\n      workloadIdentityClientId,\n      workloadIdentityCredentialOptions,\n    );\n  }\n\n  if (managedIdentityClientId) {\n    const managedIdentityClientOptions: ManagedIdentityCredentialClientIdOptions = {\n      ...options,\n      clientId: managedIdentityClientId,\n    };\n\n    return new ManagedIdentityCredential(managedIdentityClientOptions);\n  }\n\n  // We may be able to return a UnavailableCredential here, but that may be a breaking change\n  return new ManagedIdentityCredential(options);\n}\n\n/**\n * Creates a {@link WorkloadIdentityCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultWorkloadIdentityCredential(\n  options?: DefaultAzureCredentialOptions | DefaultAzureCredentialClientIdOptions,\n): TokenCredential {\n  const managedIdentityClientId =\n    (options as DefaultAzureCredentialClientIdOptions)?.managedIdentityClientId ??\n    process.env.AZURE_CLIENT_ID;\n  const workloadIdentityClientId =\n    (options as DefaultAzureCredentialClientIdOptions)?.workloadIdentityClientId ??\n    managedIdentityClientId;\n  const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;\n  const tenantId = options?.tenantId ?? process.env.AZURE_TENANT_ID;\n  if (workloadFile && workloadIdentityClientId) {\n    const workloadIdentityCredentialOptions: WorkloadIdentityCredentialOptions = {\n      ...options,\n      tenantId,\n      clientId: workloadIdentityClientId,\n      tokenFilePath: workloadFile,\n    };\n    return new WorkloadIdentityCredential(workloadIdentityCredentialOptions);\n  }\n  if (tenantId) {\n    const workloadIdentityClientTenantOptions: WorkloadIdentityCredentialOptions = {\n      ...options,\n      tenantId,\n    };\n    return new WorkloadIdentityCredential(workloadIdentityClientTenantOptions);\n  }\n\n  // We may be able to return a UnavailableCredential here, but that may be a breaking change\n  return new WorkloadIdentityCredential(options);\n}\n\n/**\n * Creates a {@link AzureDeveloperCliCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultAzureDeveloperCliCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new AzureDeveloperCliCredential(options);\n}\n\n/**\n * Creates a {@link AzureCliCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultAzureCliCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new AzureCliCredential(options);\n}\n\n/**\n * Creates a {@link AzurePowerShellCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultAzurePowershellCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new AzurePowerShellCredential(options);\n}\n\n/**\n * Creates an {@link EnvironmentCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultEnvironmentCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new EnvironmentCredential(options);\n}\n"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { TokenCredential } from \"@azure/core-auth\";\nimport type {\n  DefaultAzureCredentialClientIdOptions,\n  DefaultAzureCredentialOptions,\n  DefaultAzureCredentialResourceIdOptions,\n} from \"./defaultAzureCredentialOptions.js\";\nimport { EnvironmentCredential } from \"#platform/credentials/environmentCredential\";\nimport type {\n  ManagedIdentityCredentialClientIdOptions,\n  ManagedIdentityCredentialResourceIdOptions,\n} from \"./managedIdentityCredential/options.js\";\nimport { ManagedIdentityCredential } from \"#platform/credentials/managedIdentityCredential/index\";\nimport { WorkloadIdentityCredential } from \"#platform/credentials/workloadIdentityCredential\";\nimport { AzureDeveloperCliCredential } from \"#platform/credentials/azureDeveloperCliCredential\";\nimport { AzureCliCredential } from \"#platform/credentials/azureCliCredential\";\nimport { AzurePowerShellCredential } from \"#platform/credentials/azurePowerShellCredential\";\nimport type { WorkloadIdentityCredentialOptions } from \"./workloadIdentityCredentialOptions.js\";\nimport { VisualStudioCodeCredential } from \"#platform/credentials/visualStudioCodeCredential\";\nimport { BrokerCredential } from \"./brokerCredential.js\";\n\n/**\n * Creates a {@link BrokerCredential} instance with the provided options.\n * This credential uses the Windows Authentication Manager (WAM) broker for authentication.\n * It will only attempt to authenticate silently using the default broker account\n *\n * @param options - Options for configuring the credential.\n *\n * @internal\n */\nexport function createDefaultBrokerCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new BrokerCredential(options);\n}\n\n/**\n * Creates a {@link VisualStudioCodeCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultVisualStudioCodeCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new VisualStudioCodeCredential(options);\n}\n\n/**\n * Creates a {@link ManagedIdentityCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultManagedIdentityCredential(\n  options: (\n    | DefaultAzureCredentialOptions\n    | DefaultAzureCredentialResourceIdOptions\n    | DefaultAzureCredentialClientIdOptions\n  ) & { sendProbeRequest?: boolean } = {},\n): TokenCredential {\n  options.retryOptions ??= {\n    maxRetries: 5,\n    retryDelayInMs: 800,\n  };\n  // ManagedIdentityCredential inside DAC chain should send a probe request by default.\n  // This is different from standalone ManagedIdentityCredential behavior\n  // or when AZURE_TOKEN_CREDENTIALS is set to only ManagedIdentityCredential.\n  options.sendProbeRequest ??= true;\n  const managedIdentityClientId =\n    (options as DefaultAzureCredentialClientIdOptions)?.managedIdentityClientId ??\n    process.env.AZURE_CLIENT_ID;\n  const workloadIdentityClientId =\n    (options as DefaultAzureCredentialClientIdOptions)?.workloadIdentityClientId ??\n    managedIdentityClientId;\n  const managedResourceId = (options as DefaultAzureCredentialResourceIdOptions)\n    ?.managedIdentityResourceId;\n  const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;\n  const tenantId = options?.tenantId ?? process.env.AZURE_TENANT_ID;\n  if (managedResourceId) {\n    const managedIdentityResourceIdOptions: ManagedIdentityCredentialResourceIdOptions = {\n      ...options,\n      resourceId: managedResourceId,\n    };\n    return new ManagedIdentityCredential(managedIdentityResourceIdOptions);\n  }\n\n  if (workloadFile && workloadIdentityClientId) {\n    const workloadIdentityCredentialOptions: DefaultAzureCredentialOptions = {\n      ...options,\n      tenantId: tenantId,\n    };\n\n    return new ManagedIdentityCredential(\n      workloadIdentityClientId,\n      workloadIdentityCredentialOptions,\n    );\n  }\n\n  if (managedIdentityClientId) {\n    const managedIdentityClientOptions: ManagedIdentityCredentialClientIdOptions = {\n      ...options,\n      clientId: managedIdentityClientId,\n    };\n\n    return new ManagedIdentityCredential(managedIdentityClientOptions);\n  }\n\n  // We may be able to return a UnavailableCredential here, but that may be a breaking change\n  return new ManagedIdentityCredential(options);\n}\n\n/**\n * Creates a {@link WorkloadIdentityCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultWorkloadIdentityCredential(\n  options?: DefaultAzureCredentialOptions | DefaultAzureCredentialClientIdOptions,\n): TokenCredential {\n  const managedIdentityClientId =\n    (options as DefaultAzureCredentialClientIdOptions)?.managedIdentityClientId ??\n    process.env.AZURE_CLIENT_ID;\n  const workloadIdentityClientId =\n    (options as DefaultAzureCredentialClientIdOptions)?.workloadIdentityClientId ??\n    managedIdentityClientId;\n  const workloadFile = process.env.AZURE_FEDERATED_TOKEN_FILE;\n  const tenantId = options?.tenantId ?? process.env.AZURE_TENANT_ID;\n  if (workloadFile && workloadIdentityClientId) {\n    const workloadIdentityCredentialOptions: WorkloadIdentityCredentialOptions = {\n      ...options,\n      tenantId,\n      clientId: workloadIdentityClientId,\n      tokenFilePath: workloadFile,\n    };\n    return new WorkloadIdentityCredential(workloadIdentityCredentialOptions);\n  }\n  if (tenantId) {\n    const workloadIdentityClientTenantOptions: WorkloadIdentityCredentialOptions = {\n      ...options,\n      tenantId,\n    };\n    return new WorkloadIdentityCredential(workloadIdentityClientTenantOptions);\n  }\n\n  // We may be able to return a UnavailableCredential here, but that may be a breaking change\n  return new WorkloadIdentityCredential(options);\n}\n\n/**\n * Creates a {@link AzureDeveloperCliCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultAzureDeveloperCliCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new AzureDeveloperCliCredential(options);\n}\n\n/**\n * Creates a {@link AzureCliCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultAzureCliCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new AzureCliCredential(options);\n}\n\n/**\n * Creates a {@link AzurePowerShellCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultAzurePowershellCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new AzurePowerShellCredential(options);\n}\n\n/**\n * Creates an {@link EnvironmentCredential} from the provided options.\n * @param options - Options to configure the credential.\n *\n * @internal\n */\nexport function createDefaultEnvironmentCredential(\n  options: DefaultAzureCredentialOptions = {},\n): TokenCredential {\n  return new EnvironmentCredential(options);\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,mCAAsC;AAKtC,uCAA0C;AAC1C,wCAA2C;AAC3C,yCAA4C;AAC5C,gCAAmC;AACnC,uCAA0C;AAE1C,wCAA2C;AAC3C,8BAAiC;AAW1B,SAAS,8BACd,UAAyC,CAAC,GACzB;AACjB,SAAO,IAAI,yCAAiB,OAAO;AACrC;AAQO,SAAS,wCACd,UAAyC,CAAC,GACzB;AACjB,SAAO,IAAI,6DAA2B,OAAO;AAC/C;AAQO,SAAS,uCACd,UAIqC,CAAC,GACrB;AACjB,UAAQ,iBAAiB;AAAA,IACvB,YAAY;AAAA,IACZ,gBAAgB;AAAA,EAClB;AAIA,UAAQ,qBAAqB;AAC7B,QAAM,0BACH,SAAmD,2BACpD,QAAQ,IAAI;AACd,QAAM,2BACH,SAAmD,4BACpD;AACF,QAAM,oBAAqB,SACvB;AACJ,QAAM,eAAe,QAAQ,IAAI;AACjC,QAAM,WAAW,SAAS,YAAY,QAAQ,IAAI;AAClD,MAAI,mBAAmB;AACrB,UAAM,mCAA+E;AAAA,MACnF,GAAG;AAAA,MACH,YAAY;AAAA,IACd;AACA,WAAO,IAAI,2DAA0B,gCAAgC;AAAA,EACvE;AAEA,MAAI,gBAAgB,0BAA0B;AAC5C,UAAM,oCAAmE;AAAA,MACvE,GAAG;AAAA,MACH;AAAA,IACF;AAEA,WAAO,IAAI;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,yBAAyB;AAC3B,UAAM,+BAAyE;AAAA,MAC7E,GAAG;AAAA,MACH,UAAU;AAAA,IACZ;AAEA,WAAO,IAAI,2DAA0B,4BAA4B;AAAA,EACnE;AAGA,SAAO,IAAI,2DAA0B,OAAO;AAC9C;AAQO,SAAS,wCACd,SACiB;AACjB,QAAM,0BACH,SAAmD,2BACpD,QAAQ,IAAI;AACd,QAAM,2BACH,SAAmD,4BACpD;AACF,QAAM,eAAe,QAAQ,IAAI;AACjC,QAAM,WAAW,SAAS,YAAY,QAAQ,IAAI;AAClD,MAAI,gBAAgB,0BAA0B;AAC5C,UAAM,oCAAuE;AAAA,MAC3E,GAAG;AAAA,MACH;AAAA,MACA,UAAU;AAAA,MACV,eAAe;AAAA,IACjB;AACA,WAAO,IAAI,6DAA2B,iCAAiC;AAAA,EACzE;AACA,MAAI,UAAU;AACZ,UAAM,sCAAyE;AAAA,MAC7E,GAAG;AAAA,MACH;AAAA,IACF;AACA,WAAO,IAAI,6DAA2B,mCAAmC;AAAA,EAC3E;AAGA,SAAO,IAAI,6DAA2B,OAAO;AAC/C;AAQO,SAAS,yCACd,UAAyC,CAAC,GACzB;AACjB,SAAO,IAAI,+DAA4B,OAAO;AAChD;AAQO,SAAS,gCACd,UAAyC,CAAC,GACzB;AACjB,SAAO,IAAI,6CAAmB,OAAO;AACvC;AAQO,SAAS,uCACd,UAAyC,CAAC,GACzB;AACjB,SAAO,IAAI,2DAA0B,OAAO;AAC9C;AAQO,SAAS,mCACd,UAAyC,CAAC,GACzB;AACjB,SAAO,IAAI,mDAAsB,OAAO;AAC1C;",
   "names": []
 }

package/dist/commonjs/credentials/environmentCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environmentCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/environmentCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAKtF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAU5C,CAAC;AAUF,wBAAgB,uBAAuB,IAAI,OAAO,CASjD;AAED;;GAEG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,WAAW,CAAC,CAGuB;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;gBACS,OAAO,CAAC,EAAE,4BAA4B;IA6DlD;;;;;OAKG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;CAqB/F"}
+{"version":3,"file":"environmentCredential.d.ts","sourceRoot":"","sources":["../../../src/credentials/environmentCredential.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAKtF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAU5C,CAAC;AAUF,wBAAgB,uBAAuB,IAAI,OAAO,CASjD;AAED;;GAEG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,WAAW,CAAC,CAC4E;IAChG;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;gBACS,OAAO,CAAC,EAAE,4BAA4B;IA6DlD;;;;;OAKG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;CAqB/F"}

package/dist/commonjs/credentials/environmentCredential.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/credentials/environmentCredential.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { AuthenticationError, CredentialUnavailableError } from \"../errors.js\";\nimport { credentialLogger, formatError, formatSuccess, processEnvVars } from \"../util/logging.js\";\n\nimport { ClientCertificateCredential } from \"./clientCertificateCredential.js\";\nimport { ClientSecretCredential } from \"./clientSecretCredential.js\";\nimport type { EnvironmentCredentialOptions } from \"./environmentCredentialOptions.js\";\nimport { UsernamePasswordCredential } from \"./usernamePasswordCredential.js\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\n\n/**\n * Contains the list of all supported environment variable names so that an\n * appropriate error message can be generated when no credentials can be\n * configured.\n *\n * @internal\n */\nexport const AllSupportedEnvironmentVariables = [\n  \"AZURE_TENANT_ID\",\n  \"AZURE_CLIENT_ID\",\n  \"AZURE_CLIENT_SECRET\",\n  \"AZURE_CLIENT_CERTIFICATE_PATH\",\n  \"AZURE_CLIENT_CERTIFICATE_PASSWORD\",\n  \"AZURE_USERNAME\",\n  \"AZURE_PASSWORD\",\n  \"AZURE_ADDITIONALLY_ALLOWED_TENANTS\",\n  \"AZURE_CLIENT_SEND_CERTIFICATE_CHAIN\",\n];\n\nfunction getAdditionallyAllowedTenants(): string[] {\n  const additionallyAllowedValues = process.env.AZURE_ADDITIONALLY_ALLOWED_TENANTS ?? \"\";\n  return additionallyAllowedValues.split(\";\");\n}\n\nconst credentialName = \"EnvironmentCredential\";\nconst logger = credentialLogger(credentialName);\n\nexport function getSendCertificateChain(): boolean {\n  const sendCertificateChain = (\n    process.env.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN ?? \"\"\n  ).toLowerCase();\n  const result = sendCertificateChain === \"true\" || sendCertificateChain === \"1\";\n  logger.verbose(\n    `AZURE_CLIENT_SEND_CERTIFICATE_CHAIN: ${process.env.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN}; sendCertificateChain: ${result}`,\n  );\n  return result;\n}\n\n/**\n * Enables authentication to Microsoft Entra ID using a client secret or certificate.\n */\nexport class EnvironmentCredential implements TokenCredential {\n  private _credential?:\n    | ClientSecretCredential\n    | ClientCertificateCredential\n    | UsernamePasswordCredential = undefined;\n  /**\n   * Creates an instance of the EnvironmentCredential class and decides what credential to use depending on the available environment variables.\n   *\n   * Required environment variables:\n   * - `AZURE_TENANT_ID`: The Microsoft Entra tenant (directory) ID.\n   * - `AZURE_CLIENT_ID`: The client (application) ID of an App Registration in the tenant.\n   *\n   * If setting the AZURE_TENANT_ID, then you can also set the additionally allowed tenants\n   * - `AZURE_ADDITIONALLY_ALLOWED_TENANTS`: For multi-tenant applications, specifies additional tenants for which the credential may acquire tokens with a single semicolon delimited string. Use * to allow all tenants.\n   *\n   * Environment variables used for client credential authentication:\n   * - `AZURE_CLIENT_SECRET`: A client secret that was generated for the App Registration.\n   * - `AZURE_CLIENT_CERTIFICATE_PATH`: The path to a PEM certificate to use during the authentication, instead of the client secret.\n   * - `AZURE_CLIENT_CERTIFICATE_PASSWORD`: (optional) password for the certificate file.\n   * - `AZURE_CLIENT_SEND_CERTIFICATE_CHAIN`: (optional) indicates that the certificate chain should be set in x5c header to support subject name / issuer based authentication.\n   *\n   * Username and password authentication is deprecated, since it doesn't support multifactor authentication (MFA). See https://aka.ms/azsdk/identity/mfa for more details. Users can still provide environment variables for this authentication method:\n   * - `AZURE_USERNAME`: Username to authenticate with.\n   * - `AZURE_PASSWORD`: Password to authenticate with.\n   *\n   * If the environment variables required to perform the authentication are missing, a {@link CredentialUnavailableError} will be thrown.\n   * If the authentication fails, or if there's an unknown error, an {@link AuthenticationError} will be thrown.\n   *\n   * @param options - Options for configuring the client which makes the authentication request.\n   */\n  constructor(options?: EnvironmentCredentialOptions) {\n    // Keep track of any missing environment variables for error details\n\n    const assigned = processEnvVars(AllSupportedEnvironmentVariables).assigned.join(\", \");\n    logger.info(`Found the following environment variables: ${assigned}`);\n\n    const tenantId = process.env.AZURE_TENANT_ID,\n      clientId = process.env.AZURE_CLIENT_ID,\n      clientSecret = process.env.AZURE_CLIENT_SECRET;\n\n    const additionallyAllowedTenantIds = getAdditionallyAllowedTenants();\n    const sendCertificateChain = getSendCertificateChain();\n    const newOptions = { ...options, additionallyAllowedTenantIds, sendCertificateChain };\n\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n\n    if (tenantId && clientId && clientSecret) {\n      logger.info(\n        `Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`,\n      );\n      this._credential = new ClientSecretCredential(tenantId, clientId, clientSecret, newOptions);\n      return;\n    }\n\n    const certificatePath = process.env.AZURE_CLIENT_CERTIFICATE_PATH;\n    const certificatePassword = process.env.AZURE_CLIENT_CERTIFICATE_PASSWORD;\n    if (tenantId && clientId && certificatePath) {\n      logger.info(\n        `Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`,\n      );\n      this._credential = new ClientCertificateCredential(\n        tenantId,\n        clientId,\n        { certificatePath, certificatePassword },\n        newOptions,\n      );\n      return;\n    }\n\n    const username = process.env.AZURE_USERNAME;\n    const password = process.env.AZURE_PASSWORD;\n    if (tenantId && clientId && username && password) {\n      logger.info(\n        `Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`,\n      );\n\n      logger.warning(\n        \"Environment is configured to use username and password authentication. This authentication method is deprecated, as it doesn't support multifactor authentication (MFA). Use a more secure credential. For more details, see https://aka.ms/azsdk/identity/mfa.\",\n      );\n      this._credential = new UsernamePasswordCredential(\n        tenantId,\n        clientId,\n        username,\n        password,\n        newOptions,\n      );\n    }\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - Optional parameters. See {@link GetTokenOptions}.\n   */\n  async getToken(scopes: string | string[], options: GetTokenOptions = {}): Promise<AccessToken> {\n    return tracingClient.withSpan(`${credentialName}.getToken`, options, async (newOptions) => {\n      if (this._credential) {\n        try {\n          const result = await this._credential.getToken(scopes, newOptions);\n          logger.getToken.info(formatSuccess(scopes));\n          return result;\n        } catch (err: any) {\n          const authenticationError = new AuthenticationError(400, {\n            error: `${credentialName} authentication failed. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`,\n            error_description: err.message.toString().split(\"More details:\").join(\"\"),\n          });\n          logger.getToken.info(formatError(scopes, authenticationError));\n          throw authenticationError;\n        }\n      }\n      throw new CredentialUnavailableError(\n        `${credentialName} is unavailable. No underlying credential could be used. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`,\n      );\n    });\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAAgE;AAChE,qBAA6E;AAE7E,yCAA4C;AAC5C,oCAAuC;AAEvC,wCAA2C;AAC3C,2BAA8B;AAC9B,qBAA8B;AASvB,MAAM,mCAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,gCAA0C;AACjD,QAAM,4BAA4B,QAAQ,IAAI,sCAAsC;AACpF,SAAO,0BAA0B,MAAM,GAAG;AAC5C;AAEA,MAAM,iBAAiB;AACvB,MAAM,aAAS,iCAAiB,cAAc;AAEvC,SAAS,0BAAmC;AACjD,QAAM,wBACJ,QAAQ,IAAI,uCAAuC,IACnD,YAAY;AACd,QAAM,SAAS,yBAAyB,UAAU,yBAAyB;AAC3E,SAAO;AAAA,IACL,wCAAwC,QAAQ,IAAI,mCAAmC,2BAA2B,MAAM;AAAA,EAC1H;AACA,SAAO;AACT;AAKO,MAAM,sBAAiD;AAAA,EACpD,cAGyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BjC,YAAY,SAAwC;AAGlD,UAAM,eAAW,+BAAe,gCAAgC,EAAE,SAAS,KAAK,IAAI;AACpF,WAAO,KAAK,8CAA8C,QAAQ,EAAE;AAEpE,UAAM,WAAW,QAAQ,IAAI,iBAC3B,WAAW,QAAQ,IAAI,iBACvB,eAAe,QAAQ,IAAI;AAE7B,UAAM,+BAA+B,8BAA8B;AACnE,UAAM,uBAAuB,wBAAwB;AACrD,UAAM,aAAa,EAAE,GAAG,SAAS,8BAA8B,qBAAqB;AAEpF,QAAI,UAAU;AACZ,8CAAc,QAAQ,QAAQ;AAAA,IAChC;AAEA,QAAI,YAAY,YAAY,cAAc;AACxC,aAAO;AAAA,QACL,mDAAmD,QAAQ,eAAe,QAAQ;AAAA,MACpF;AACA,WAAK,cAAc,IAAI,qDAAuB,UAAU,UAAU,cAAc,UAAU;AAC1F;AAAA,IACF;AAEA,UAAM,kBAAkB,QAAQ,IAAI;AACpC,UAAM,sBAAsB,QAAQ,IAAI;AACxC,QAAI,YAAY,YAAY,iBAAiB;AAC3C,aAAO;AAAA,QACL,wDAAwD,QAAQ,eAAe,QAAQ,yBAAyB,eAAe;AAAA,MACjI;AACA,WAAK,cAAc,IAAI;AAAA,QACrB;AAAA,QACA;AAAA,QACA,EAAE,iBAAiB,oBAAoB;AAAA,QACvC;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,WAAW,QAAQ,IAAI;AAC7B,UAAM,WAAW,QAAQ,IAAI;AAC7B,QAAI,YAAY,YAAY,YAAY,UAAU;AAChD,aAAO;AAAA,QACL,uDAAuD,QAAQ,eAAe,QAAQ,kBAAkB,QAAQ;AAAA,MAClH;AAEA,aAAO;AAAA,QACL;AAAA,MACF;AACA,WAAK,cAAc,IAAI;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,QAA2B,UAA2B,CAAC,GAAyB;AAC7F,WAAO,6BAAc,SAAS,GAAG,cAAc,aAAa,SAAS,OAAO,eAAe;AACzF,UAAI,KAAK,aAAa;AACpB,YAAI;AACF,gBAAM,SAAS,MAAM,KAAK,YAAY,SAAS,QAAQ,UAAU;AACjE,iBAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC1C,iBAAO;AAAA,QACT,SAAS,KAAU;AACjB,gBAAM,sBAAsB,IAAI,kCAAoB,KAAK;AAAA,YACvD,OAAO,GAAG,cAAc;AAAA,YACxB,mBAAmB,IAAI,QAAQ,SAAS,EAAE,MAAM,eAAe,EAAE,KAAK,EAAE;AAAA,UAC1E,CAAC;AACD,iBAAO,SAAS,SAAK,4BAAY,QAAQ,mBAAmB,CAAC;AAC7D,gBAAM;AAAA,QACR;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH;AACF;",
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { AuthenticationError, CredentialUnavailableError } from \"../errors.js\";\nimport { credentialLogger, formatError, formatSuccess, processEnvVars } from \"../util/logging.js\";\n\nimport { ClientCertificateCredential } from \"#platform/credentials/clientCertificateCredential\";\nimport { ClientSecretCredential } from \"#platform/credentials/clientSecretCredential\";\nimport type { EnvironmentCredentialOptions } from \"./environmentCredentialOptions.js\";\nimport { UsernamePasswordCredential } from \"#platform/credentials/usernamePasswordCredential\";\nimport { checkTenantId } from \"../util/tenantIdUtils.js\";\nimport { tracingClient } from \"../util/tracing.js\";\n\n/**\n * Contains the list of all supported environment variable names so that an\n * appropriate error message can be generated when no credentials can be\n * configured.\n *\n * @internal\n */\nexport const AllSupportedEnvironmentVariables = [\n  \"AZURE_TENANT_ID\",\n  \"AZURE_CLIENT_ID\",\n  \"AZURE_CLIENT_SECRET\",\n  \"AZURE_CLIENT_CERTIFICATE_PATH\",\n  \"AZURE_CLIENT_CERTIFICATE_PASSWORD\",\n  \"AZURE_USERNAME\",\n  \"AZURE_PASSWORD\",\n  \"AZURE_ADDITIONALLY_ALLOWED_TENANTS\",\n  \"AZURE_CLIENT_SEND_CERTIFICATE_CHAIN\",\n];\n\nfunction getAdditionallyAllowedTenants(): string[] {\n  const additionallyAllowedValues = process.env.AZURE_ADDITIONALLY_ALLOWED_TENANTS ?? \"\";\n  return additionallyAllowedValues.split(\";\");\n}\n\nconst credentialName = \"EnvironmentCredential\";\nconst logger = credentialLogger(credentialName);\n\nexport function getSendCertificateChain(): boolean {\n  const sendCertificateChain = (\n    process.env.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN ?? \"\"\n  ).toLowerCase();\n  const result = sendCertificateChain === \"true\" || sendCertificateChain === \"1\";\n  logger.verbose(\n    `AZURE_CLIENT_SEND_CERTIFICATE_CHAIN: ${process.env.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN}; sendCertificateChain: ${result}`,\n  );\n  return result;\n}\n\n/**\n * Enables authentication to Microsoft Entra ID using a client secret or certificate.\n */\nexport class EnvironmentCredential implements TokenCredential {\n  private _credential?:\n    ClientSecretCredential | ClientCertificateCredential | UsernamePasswordCredential = undefined;\n  /**\n   * Creates an instance of the EnvironmentCredential class and decides what credential to use depending on the available environment variables.\n   *\n   * Required environment variables:\n   * - `AZURE_TENANT_ID`: The Microsoft Entra tenant (directory) ID.\n   * - `AZURE_CLIENT_ID`: The client (application) ID of an App Registration in the tenant.\n   *\n   * If setting the AZURE_TENANT_ID, then you can also set the additionally allowed tenants\n   * - `AZURE_ADDITIONALLY_ALLOWED_TENANTS`: For multi-tenant applications, specifies additional tenants for which the credential may acquire tokens with a single semicolon delimited string. Use * to allow all tenants.\n   *\n   * Environment variables used for client credential authentication:\n   * - `AZURE_CLIENT_SECRET`: A client secret that was generated for the App Registration.\n   * - `AZURE_CLIENT_CERTIFICATE_PATH`: The path to a PEM certificate to use during the authentication, instead of the client secret.\n   * - `AZURE_CLIENT_CERTIFICATE_PASSWORD`: (optional) password for the certificate file.\n   * - `AZURE_CLIENT_SEND_CERTIFICATE_CHAIN`: (optional) indicates that the certificate chain should be set in x5c header to support subject name / issuer based authentication.\n   *\n   * Username and password authentication is deprecated, since it doesn't support multifactor authentication (MFA). See https://aka.ms/azsdk/identity/mfa for more details. Users can still provide environment variables for this authentication method:\n   * - `AZURE_USERNAME`: Username to authenticate with.\n   * - `AZURE_PASSWORD`: Password to authenticate with.\n   *\n   * If the environment variables required to perform the authentication are missing, a {@link CredentialUnavailableError} will be thrown.\n   * If the authentication fails, or if there's an unknown error, an {@link AuthenticationError} will be thrown.\n   *\n   * @param options - Options for configuring the client which makes the authentication request.\n   */\n  constructor(options?: EnvironmentCredentialOptions) {\n    // Keep track of any missing environment variables for error details\n\n    const assigned = processEnvVars(AllSupportedEnvironmentVariables).assigned.join(\", \");\n    logger.info(`Found the following environment variables: ${assigned}`);\n\n    const tenantId = process.env.AZURE_TENANT_ID,\n      clientId = process.env.AZURE_CLIENT_ID,\n      clientSecret = process.env.AZURE_CLIENT_SECRET;\n\n    const additionallyAllowedTenantIds = getAdditionallyAllowedTenants();\n    const sendCertificateChain = getSendCertificateChain();\n    const newOptions = { ...options, additionallyAllowedTenantIds, sendCertificateChain };\n\n    if (tenantId) {\n      checkTenantId(logger, tenantId);\n    }\n\n    if (tenantId && clientId && clientSecret) {\n      logger.info(\n        `Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`,\n      );\n      this._credential = new ClientSecretCredential(tenantId, clientId, clientSecret, newOptions);\n      return;\n    }\n\n    const certificatePath = process.env.AZURE_CLIENT_CERTIFICATE_PATH;\n    const certificatePassword = process.env.AZURE_CLIENT_CERTIFICATE_PASSWORD;\n    if (tenantId && clientId && certificatePath) {\n      logger.info(\n        `Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`,\n      );\n      this._credential = new ClientCertificateCredential(\n        tenantId,\n        clientId,\n        { certificatePath, certificatePassword },\n        newOptions,\n      );\n      return;\n    }\n\n    const username = process.env.AZURE_USERNAME;\n    const password = process.env.AZURE_PASSWORD;\n    if (tenantId && clientId && username && password) {\n      logger.info(\n        `Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`,\n      );\n\n      logger.warning(\n        \"Environment is configured to use username and password authentication. This authentication method is deprecated, as it doesn't support multifactor authentication (MFA). Use a more secure credential. For more details, see https://aka.ms/azsdk/identity/mfa.\",\n      );\n      this._credential = new UsernamePasswordCredential(\n        tenantId,\n        clientId,\n        username,\n        password,\n        newOptions,\n      );\n    }\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - Optional parameters. See {@link GetTokenOptions}.\n   */\n  async getToken(scopes: string | string[], options: GetTokenOptions = {}): Promise<AccessToken> {\n    return tracingClient.withSpan(`${credentialName}.getToken`, options, async (newOptions) => {\n      if (this._credential) {\n        try {\n          const result = await this._credential.getToken(scopes, newOptions);\n          logger.getToken.info(formatSuccess(scopes));\n          return result;\n        } catch (err: any) {\n          const authenticationError = new AuthenticationError(400, {\n            error: `${credentialName} authentication failed. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`,\n            error_description: err.message.toString().split(\"More details:\").join(\"\"),\n          });\n          logger.getToken.info(formatError(scopes, authenticationError));\n          throw authenticationError;\n        }\n      }\n      throw new CredentialUnavailableError(\n        `${credentialName} is unavailable. No underlying credential could be used. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`,\n      );\n    });\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAAgE;AAChE,qBAA6E;AAE7E,yCAA4C;AAC5C,oCAAuC;AAEvC,wCAA2C;AAC3C,2BAA8B;AAC9B,qBAA8B;AASvB,MAAM,mCAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,gCAA0C;AACjD,QAAM,4BAA4B,QAAQ,IAAI,sCAAsC;AACpF,SAAO,0BAA0B,MAAM,GAAG;AAC5C;AAEA,MAAM,iBAAiB;AACvB,MAAM,aAAS,iCAAiB,cAAc;AAEvC,SAAS,0BAAmC;AACjD,QAAM,wBACJ,QAAQ,IAAI,uCAAuC,IACnD,YAAY;AACd,QAAM,SAAS,yBAAyB,UAAU,yBAAyB;AAC3E,SAAO;AAAA,IACL,wCAAwC,QAAQ,IAAI,mCAAmC,2BAA2B,MAAM;AAAA,EAC1H;AACA,SAAO;AACT;AAKO,MAAM,sBAAiD;AAAA,EACpD,cAC8E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BtF,YAAY,SAAwC;AAGlD,UAAM,eAAW,+BAAe,gCAAgC,EAAE,SAAS,KAAK,IAAI;AACpF,WAAO,KAAK,8CAA8C,QAAQ,EAAE;AAEpE,UAAM,WAAW,QAAQ,IAAI,iBAC3B,WAAW,QAAQ,IAAI,iBACvB,eAAe,QAAQ,IAAI;AAE7B,UAAM,+BAA+B,8BAA8B;AACnE,UAAM,uBAAuB,wBAAwB;AACrD,UAAM,aAAa,EAAE,GAAG,SAAS,8BAA8B,qBAAqB;AAEpF,QAAI,UAAU;AACZ,8CAAc,QAAQ,QAAQ;AAAA,IAChC;AAEA,QAAI,YAAY,YAAY,cAAc;AACxC,aAAO;AAAA,QACL,mDAAmD,QAAQ,eAAe,QAAQ;AAAA,MACpF;AACA,WAAK,cAAc,IAAI,qDAAuB,UAAU,UAAU,cAAc,UAAU;AAC1F;AAAA,IACF;AAEA,UAAM,kBAAkB,QAAQ,IAAI;AACpC,UAAM,sBAAsB,QAAQ,IAAI;AACxC,QAAI,YAAY,YAAY,iBAAiB;AAC3C,aAAO;AAAA,QACL,wDAAwD,QAAQ,eAAe,QAAQ,yBAAyB,eAAe;AAAA,MACjI;AACA,WAAK,cAAc,IAAI;AAAA,QACrB;AAAA,QACA;AAAA,QACA,EAAE,iBAAiB,oBAAoB;AAAA,QACvC;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,WAAW,QAAQ,IAAI;AAC7B,UAAM,WAAW,QAAQ,IAAI;AAC7B,QAAI,YAAY,YAAY,YAAY,UAAU;AAChD,aAAO;AAAA,QACL,uDAAuD,QAAQ,eAAe,QAAQ,kBAAkB,QAAQ;AAAA,MAClH;AAEA,aAAO;AAAA,QACL;AAAA,MACF;AACA,WAAK,cAAc,IAAI;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,QAA2B,UAA2B,CAAC,GAAyB;AAC7F,WAAO,6BAAc,SAAS,GAAG,cAAc,aAAa,SAAS,OAAO,eAAe;AACzF,UAAI,KAAK,aAAa;AACpB,YAAI;AACF,gBAAM,SAAS,MAAM,KAAK,YAAY,SAAS,QAAQ,UAAU;AACjE,iBAAO,SAAS,SAAK,8BAAc,MAAM,CAAC;AAC1C,iBAAO;AAAA,QACT,SAAS,KAAU;AACjB,gBAAM,sBAAsB,IAAI,kCAAoB,KAAK;AAAA,YACvD,OAAO,GAAG,cAAc;AAAA,YACxB,mBAAmB,IAAI,QAAQ,SAAS,EAAE,MAAM,eAAe,EAAE,KAAK,EAAE;AAAA,UAC1E,CAAC;AACD,iBAAO,SAAS,SAAK,4BAAY,QAAQ,mBAAmB,CAAC;AAC7D,gBAAM;AAAA,QACR;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR,GAAG,cAAc;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/commonjs/credentials/managedIdentityCredential/tokenExchangeMsi.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/credentials/managedIdentityCredential/tokenExchangeMsi.ts"],
-  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport type { MSIConfiguration } from \"./models.js\";\nimport { WorkloadIdentityCredential } from \"../workloadIdentityCredential.js\";\nimport { credentialLogger } from \"../../util/logging.js\";\nimport type { WorkloadIdentityCredentialOptions } from \"../workloadIdentityCredentialOptions.js\";\n\nconst msiName = \"ManagedIdentityCredential - Token Exchange\";\nconst logger = credentialLogger(msiName);\n\n/**\n * Defines how to determine whether the token exchange MSI is available, and also how to retrieve a token from the token exchange MSI.\n *\n * Token exchange MSI (used by AKS) is the only MSI implementation handled entirely by Azure Identity.\n * The rest have been migrated to MSAL.\n */\nexport const tokenExchangeMsi = {\n  name: \"tokenExchangeMsi\",\n  async isAvailable(clientId?: string): Promise<boolean> {\n    const env = process.env;\n    const result = Boolean(\n      (clientId || env.AZURE_CLIENT_ID) &&\n      env.AZURE_TENANT_ID &&\n      process.env.AZURE_FEDERATED_TOKEN_FILE,\n    );\n    if (!result) {\n      logger.info(\n        `${msiName}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`,\n      );\n    }\n    return result;\n  },\n  async getToken(\n    configuration: MSIConfiguration,\n    getTokenOptions: GetTokenOptions = {},\n  ): Promise<AccessToken | null> {\n    const { scopes, clientId } = configuration;\n    const identityClientTokenCredentialOptions = {};\n    const workloadIdentityCredential = new WorkloadIdentityCredential({\n      clientId,\n      tenantId: process.env.AZURE_TENANT_ID,\n      tokenFilePath: process.env.AZURE_FEDERATED_TOKEN_FILE,\n      ...identityClientTokenCredentialOptions,\n      disableInstanceDiscovery: true,\n    } as WorkloadIdentityCredentialOptions);\n    return workloadIdentityCredential.getToken(scopes, getTokenOptions);\n  },\n};\n"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport type { MSIConfiguration } from \"./models.js\";\nimport { WorkloadIdentityCredential } from \"#platform/credentials/workloadIdentityCredential\";\nimport { credentialLogger } from \"../../util/logging.js\";\nimport type { WorkloadIdentityCredentialOptions } from \"../workloadIdentityCredentialOptions.js\";\n\nconst msiName = \"ManagedIdentityCredential - Token Exchange\";\nconst logger = credentialLogger(msiName);\n\n/**\n * Defines how to determine whether the token exchange MSI is available, and also how to retrieve a token from the token exchange MSI.\n *\n * Token exchange MSI (used by AKS) is the only MSI implementation handled entirely by Azure Identity.\n * The rest have been migrated to MSAL.\n */\nexport const tokenExchangeMsi = {\n  name: \"tokenExchangeMsi\",\n  async isAvailable(clientId?: string): Promise<boolean> {\n    const env = process.env;\n    const result = Boolean(\n      (clientId || env.AZURE_CLIENT_ID) &&\n      env.AZURE_TENANT_ID &&\n      process.env.AZURE_FEDERATED_TOKEN_FILE,\n    );\n    if (!result) {\n      logger.info(\n        `${msiName}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`,\n      );\n    }\n    return result;\n  },\n  async getToken(\n    configuration: MSIConfiguration,\n    getTokenOptions: GetTokenOptions = {},\n  ): Promise<AccessToken | null> {\n    const { scopes, clientId } = configuration;\n    const identityClientTokenCredentialOptions = {};\n    const workloadIdentityCredential = new WorkloadIdentityCredential({\n      clientId,\n      tenantId: process.env.AZURE_TENANT_ID,\n      tokenFilePath: process.env.AZURE_FEDERATED_TOKEN_FILE,\n      ...identityClientTokenCredentialOptions,\n      disableInstanceDiscovery: true,\n    } as WorkloadIdentityCredentialOptions);\n    return workloadIdentityCredential.getToken(scopes, getTokenOptions);\n  },\n};\n"],
   "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,wCAA2C;AAC3C,qBAAiC;AAGjC,MAAM,UAAU;AAChB,MAAM,aAAS,iCAAiB,OAAO;AAQhC,MAAM,mBAAmB;AAAA,EAC9B,MAAM;AAAA,EACN,MAAM,YAAY,UAAqC;AACrD,UAAM,MAAM,QAAQ;AACpB,UAAM,SAAS;AAAA,OACZ,YAAY,IAAI,oBACjB,IAAI,mBACJ,QAAQ,IAAI;AAAA,IACd;AACA,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL,GAAG,OAAO;AAAA,MACZ;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,MAAM,SACJ,eACA,kBAAmC,CAAC,GACP;AAC7B,UAAM,EAAE,QAAQ,SAAS,IAAI;AAC7B,UAAM,uCAAuC,CAAC;AAC9C,UAAM,6BAA6B,IAAI,6DAA2B;AAAA,MAChE;AAAA,MACA,UAAU,QAAQ,IAAI;AAAA,MACtB,eAAe,QAAQ,IAAI;AAAA,MAC3B,GAAG;AAAA,MACH,0BAA0B;AAAA,IAC5B,CAAsC;AACtC,WAAO,2BAA2B,SAAS,QAAQ,eAAe;AAAA,EACpE;AACF;",
   "names": []
 }