@azure/identity 4.2.0-alpha.20240425.2 → 4.3.0-alpha.20240426.2

package/dist/index.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var logger$q = require('@azure/logger');
+var logger$r = require('@azure/logger');
 var coreClient = require('@azure/core-client');
 var coreUtil = require('@azure/core-util');
 var coreRestPipeline = require('@azure/core-rest-pipeline');
@@ -197,7 +197,7 @@ const msalPlugins = {
 /**
  * The AzureLogger used for all clients within the identity package
  */
-const logger$p = logger$q.createClientLogger("identity");
+const logger$q = logger$r.createClientLogger("identity");
 /**
  * Separates a list of environment variable names into a plain object with two arrays: an array of missing environment variables and another array with assigned environment variables.
  * @param supportedEnvVars - List of environment variable names
@@ -237,7 +237,7 @@ function formatError(scope, error) {
  *   `[title] => [message]`
  *
  */
-function credentialLoggerInstance(title, parent, log = logger$p) {
+function credentialLoggerInstance(title, parent, log = logger$q) {
     const fullTitle = parent ? `${parent.fullTitle} ${title}` : title;
     function info(message) {
         log.info(`${fullTitle} =>`, message);
@@ -248,12 +248,16 @@ function credentialLoggerInstance(title, parent, log = logger$p) {
     function verbose(message) {
         log.verbose(`${fullTitle} =>`, message);
     }
+    function error(message) {
+        log.error(`${fullTitle} =>`, message);
+    }
     return {
         title,
         fullTitle,
         info,
         warning,
         verbose,
+        error,
     };
 }
 /**
@@ -266,7 +270,7 @@ function credentialLoggerInstance(title, parent, log = logger$p) {
  *   `[title] => getToken() => [message]`
  *
  */
-function credentialLogger(title, log = logger$p) {
+function credentialLogger(title, log = logger$q) {
     const credLogger = credentialLoggerInstance(title, undefined, log);
     return Object.assign(Object.assign({}, credLogger), { parent: log, getToken: credentialLoggerInstance("=> getToken()", credLogger, log) });
 }
@@ -594,7 +598,7 @@ class IdentityClient extends coreClient.ServiceClient {
         this.tokenCredentialOptions = Object.assign({}, options);
     }
     async sendTokenRequest(request) {
-        logger$p.info(`IdentityClient: sending token request to [${request.url}]`);
+        logger$q.info(`IdentityClient: sending token request to [${request.url}]`);
         const response = await this.sendRequest(request);
         if (response.bodyAsText && (response.status === 200 || response.status === 201)) {
             const parsedBody = JSON.parse(response.bodyAsText);
@@ -609,12 +613,12 @@ class IdentityClient extends coreClient.ServiceClient {
                 },
                 refreshToken: parsedBody.refresh_token,
             };
-            logger$p.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
+            logger$q.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
             return token;
         }
         else {
             const error = new AuthenticationError(response.status, response.bodyAsText);
-            logger$p.warning(`IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`);
+            logger$q.warning(`IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`);
             throw error;
         }
     }
@@ -622,7 +626,7 @@ class IdentityClient extends coreClient.ServiceClient {
         if (refreshToken === undefined) {
             return null;
         }
-        logger$p.info(`IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`);
+        logger$q.info(`IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`);
         const refreshParams = {
             grant_type: "refresh_token",
             client_id: clientId,
@@ -648,7 +652,7 @@ class IdentityClient extends coreClient.ServiceClient {
                     tracingOptions: updatedOptions.tracingOptions,
                 });
                 const response = await this.sendTokenRequest(request);
-                logger$p.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
+                logger$q.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
                 return response;
             }
             catch (err) {
@@ -657,11 +661,11 @@ class IdentityClient extends coreClient.ServiceClient {
                     // It's likely that the refresh token has expired, so
                     // return null so that the credential implementation will
                     // initiate the authentication flow again.
-                    logger$p.info(`IdentityClient: interaction required for client ID: ${clientId}`);
+                    logger$q.info(`IdentityClient: interaction required for client ID: ${clientId}`);
                     return null;
                 }
                 else {
-                    logger$p.warning(`IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`);
+                    logger$q.warning(`IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`);
                     throw err;
                 }
             }
@@ -770,10 +774,10 @@ class IdentityClient extends coreClient.ServiceClient {
             }
             const base64Metadata = accessToken.split(".")[1];
             const { appid, upn, tid, oid } = JSON.parse(Buffer.from(base64Metadata, "base64").toString("utf8"));
-            logger$p.info(`[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`);
+            logger$q.info(`[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`);
         }
         catch (e) {
-            logger$p.warning("allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:", e.message);
+            logger$q.warning("allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:", e.message);
         }
     }
 }
@@ -782,7 +786,7 @@ class IdentityClient extends coreClient.ServiceClient {
 // Licensed under the MIT license.
 const CommonTenantId = "common";
 const AzureAccountClientId = "aebc6443-996d-45c2-90f0-388ff96faa56"; // VSC: 'aebc6443-996d-45c2-90f0-388ff96faa56'
-const logger$o = credentialLogger("VisualStudioCodeCredential");
+const logger$p = credentialLogger("VisualStudioCodeCredential");
 let findCredentials = undefined;
 const vsCodeCredentialControl = {
     setVsCodeCredentialFinder(finder) {
@@ -835,7 +839,7 @@ function getPropertyFromVSCode(property) {
         }
     }
     catch (e) {
-        logger$o.info(`Failed to load the Visual Studio Code configuration file. Error: ${e.message}`);
+        logger$p.info(`Failed to load the Visual Studio Code configuration file. Error: ${e.message}`);
         return;
     }
 }
@@ -868,7 +872,7 @@ class VisualStudioCodeCredential {
         const authorityHost = mapVSCodeAuthorityHosts[this.cloudName];
         this.identityClient = new IdentityClient(Object.assign({ authorityHost }, options));
         if (options && options.tenantId) {
-            checkTenantId(logger$o, options.tenantId);
+            checkTenantId(logger$p, options.tenantId);
             this.tenantId = options.tenantId;
         }
         else {
@@ -908,7 +912,7 @@ class VisualStudioCodeCredential {
     async getToken(scopes, options) {
         var _a, _b;
         await this.prepareOnce();
-        const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds, logger$o) || this.tenantId;
+        const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds, logger$p) || this.tenantId;
         if (findCredentials === undefined) {
             throw new CredentialUnavailableError([
                 "No implementation of `VisualStudioCodeCredential` is available.",
@@ -922,7 +926,7 @@ class VisualStudioCodeCredential {
         // Check to make sure the scope we get back is a valid scope
         if (!scopeString.match(/^[0-9a-zA-Z-.:/]+$/)) {
             const error = new Error("Invalid scope was specified by the user or calling client");
-            logger$o.getToken.info(formatError(scopes, error));
+            logger$p.getToken.info(formatError(scopes, error));
             throw error;
         }
         if (scopeString.indexOf("offline_access") < 0) {
@@ -942,18 +946,18 @@ class VisualStudioCodeCredential {
         if (refreshToken) {
             const tokenResponse = await this.identityClient.refreshAccessToken(tenantId, AzureAccountClientId, scopeString, refreshToken, undefined);
             if (tokenResponse) {
-                logger$o.getToken.info(formatSuccess(scopes));
+                logger$p.getToken.info(formatSuccess(scopes));
                 return tokenResponse.accessToken;
             }
             else {
                 const error = new CredentialUnavailableError("Could not retrieve the token associated with Visual Studio Code. Have you connected using the 'Azure Account' extension recently? To troubleshoot, visit https://aka.ms/azsdk/js/identity/vscodecredential/troubleshoot.");
-                logger$o.getToken.info(formatError(scopes, error));
+                logger$p.getToken.info(formatError(scopes, error));
                 throw error;
             }
         }
         else {
             const error = new CredentialUnavailableError("Could not retrieve the token associated with Visual Studio Code. Did you connect using the 'Azure Account' extension? To troubleshoot, visit https://aka.ms/azsdk/js/identity/vscodecredential/troubleshoot.");
-            logger$o.getToken.info(formatError(scopes, error));
+            logger$p.getToken.info(formatError(scopes, error));
             throw error;
         }
     }
@@ -1005,7 +1009,7 @@ function useIdentityPlugin(plugin) {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$6 = "ManagedIdentityCredential - AppServiceMSI 2017";
-const logger$n = credentialLogger(msiName$6);
+const logger$o = credentialLogger(msiName$6);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1046,22 +1050,22 @@ const appServiceMsi2017 = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$n.info(`${msiName$6}: Unavailable. Multiple scopes are not supported.`);
+            logger$o.info(`${msiName$6}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.MSI_ENDPOINT && env.MSI_SECRET);
         if (!result) {
-            logger$n.info(`${msiName$6}: Unavailable. The environment variables needed are: MSI_ENDPOINT and MSI_SECRET.`);
+            logger$o.info(`${msiName$6}: Unavailable. The environment variables needed are: MSI_ENDPOINT and MSI_SECRET.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (resourceId) {
-            logger$n.warning(`${msiName$6}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
+            logger$o.warning(`${msiName$6}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
-        logger$n.info(`${msiName$6}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
+        logger$o.info(`${msiName$6}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$5(scopes, clientId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -1073,7 +1077,7 @@ const appServiceMsi2017 = {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$5 = "ManagedIdentityCredential - AppServiceMSI 2019";
-const logger$m = credentialLogger(msiName$5);
+const logger$n = credentialLogger(msiName$5);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1117,19 +1121,19 @@ const appServiceMsi2019 = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$m.info(`${msiName$5}: Unavailable. Multiple scopes are not supported.`);
+            logger$n.info(`${msiName$5}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER);
         if (!result) {
-            logger$m.info(`${msiName$5}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT and IDENTITY_HEADER.`);
+            logger$n.info(`${msiName$5}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT and IDENTITY_HEADER.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
-        logger$m.info(`${msiName$5}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
+        logger$n.info(`${msiName$5}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$4(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -1141,7 +1145,7 @@ const appServiceMsi2019 = {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$4 = "ManagedIdentityCredential - Azure Arc MSI";
-const logger$l = credentialLogger(msiName$4);
+const logger$m = credentialLogger(msiName$4);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1215,12 +1219,12 @@ const arcMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$l.info(`${msiName$4}: Unavailable. Multiple scopes are not supported.`);
+            logger$m.info(`${msiName$4}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const result = Boolean(process.env.IMDS_ENDPOINT && process.env.IDENTITY_ENDPOINT);
         if (!result) {
-            logger$l.info(`${msiName$4}: The environment variables needed are: IMDS_ENDPOINT and IDENTITY_ENDPOINT`);
+            logger$m.info(`${msiName$4}: The environment variables needed are: IMDS_ENDPOINT and IDENTITY_ENDPOINT`);
         }
         return result;
     },
@@ -1228,12 +1232,12 @@ const arcMsi = {
         var _a;
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (clientId) {
-            logger$l.warning(`${msiName$4}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
+            logger$m.warning(`${msiName$4}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
         }
         if (resourceId) {
-            logger$l.warning(`${msiName$4}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
+            logger$m.warning(`${msiName$4}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
         }
-        logger$l.info(`${msiName$4}: Authenticating.`);
+        logger$m.info(`${msiName$4}: Authenticating.`);
         const requestOptions = Object.assign(Object.assign({ disableJsonStringifyOnBody: true, deserializationMapper: undefined, abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$3(scopes, clientId, resourceId)), { allowInsecureConnection: true });
         const filePath = await filePathRequest(identityClient, requestOptions);
         if (!filePath) {
@@ -1252,7 +1256,7 @@ const arcMsi = {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$3 = "ManagedIdentityCredential - CloudShellMSI";
-const logger$k = credentialLogger(msiName$3);
+const logger$l = credentialLogger(msiName$3);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1295,24 +1299,24 @@ const cloudShellMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$k.info(`${msiName$3}: Unavailable. Multiple scopes are not supported.`);
+            logger$l.info(`${msiName$3}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const result = Boolean(process.env.MSI_ENDPOINT);
         if (!result) {
-            logger$k.info(`${msiName$3}: Unavailable. The environment variable MSI_ENDPOINT is needed.`);
+            logger$l.info(`${msiName$3}: Unavailable. The environment variable MSI_ENDPOINT is needed.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (clientId) {
-            logger$k.warning(`${msiName$3}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
+            logger$l.warning(`${msiName$3}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
         }
         if (resourceId) {
-            logger$k.warning(`${msiName$3}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
+            logger$l.warning(`${msiName$3}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
         }
-        logger$k.info(`${msiName$3}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
+        logger$l.info(`${msiName$3}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$2(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -1334,7 +1338,7 @@ const cloudShellMsi = {
 //   curl --insecure $IDENTITY_ENDPOINT'?api-version=2019-07-01-preview&resource=https://vault.azure.net/' -H "Secret: $IDENTITY_HEADER"
 //
 const msiName$2 = "ManagedIdentityCredential - Fabric MSI";
-const logger$j = credentialLogger(msiName$2);
+const logger$k = credentialLogger(msiName$2);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1378,22 +1382,22 @@ const fabricMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$j.info(`${msiName$2}: Unavailable. Multiple scopes are not supported.`);
+            logger$k.info(`${msiName$2}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER && env.IDENTITY_SERVER_THUMBPRINT);
         if (!result) {
-            logger$j.info(`${msiName$2}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
+            logger$k.info(`${msiName$2}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { scopes, identityClient, clientId, resourceId } = configuration;
         if (resourceId) {
-            logger$j.warning(`${msiName$2}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
+            logger$k.warning(`${msiName$2}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
-        logger$j.info([
+        logger$k.info([
             `${msiName$2}:`,
             "Using the endpoint and the secret coming from the environment variables:",
             `IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT},`,
@@ -1416,7 +1420,7 @@ const fabricMsi = {
 /**
  * @internal
  */
-const logger$i = credentialLogger("IdentityUtils");
+const logger$j = credentialLogger("IdentityUtils");
 /**
  * Latest AuthenticationRecord version
  * @internal
@@ -1428,7 +1432,7 @@ const LatestAuthenticationRecordVersion = "1.0";
  */
 function ensureValidMsalToken(scopes, msalToken, getTokenOptions) {
     const error = (message) => {
-        logger$i.getToken.info(message);
+        logger$j.getToken.info(message);
         return new AuthenticationRequiredError({
             scopes: Array.isArray(scopes) ? scopes : [scopes],
             getTokenOptions,
@@ -1538,17 +1542,17 @@ function handleMsalError(scopes, error, getTokenOptions) {
         const msalError = error;
         switch (msalError.errorCode) {
             case "endpoints_resolution_error":
-                logger$i.info(formatError(scopes, error.message));
+                logger$j.info(formatError(scopes, error.message));
                 return new CredentialUnavailableError(error.message);
             case "device_code_polling_cancelled":
                 return new abortController.AbortError("The authentication has been aborted by the caller.");
             case "consent_required":
             case "interaction_required":
             case "login_required":
-                logger$i.info(formatError(scopes, `Authentication returned errorCode ${msalError.errorCode}`));
+                logger$j.info(formatError(scopes, `Authentication returned errorCode ${msalError.errorCode}`));
                 break;
             default:
-                logger$i.info(formatError(scopes, `Failed to acquire token: ${error.message}`));
+                logger$j.info(formatError(scopes, `Failed to acquire token: ${error.message}`));
                 break;
         }
     }
@@ -1558,7 +1562,7 @@ function handleMsalError(scopes, error, getTokenOptions) {
         return error;
     }
     if (error.name === "NativeAuthError") {
-        logger$i.info(formatError(scopes, `Error from the native broker: ${error.message} with status code: ${error.statusCode}`));
+        logger$j.info(formatError(scopes, `Error from the native broker: ${error.message} with status code: ${error.statusCode}`));
         return error;
     }
     return new AuthenticationRequiredError({ scopes, getTokenOptions, message: error.message });
@@ -1626,7 +1630,7 @@ function deserializeAuthenticationRecord(serializedRecord) {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName$1 = "ManagedIdentityCredential - IMDS";
-const logger$h = credentialLogger(msiName$1);
+const logger$i = credentialLogger(msiName$1);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -1678,7 +1682,7 @@ const imdsMsi = {
     async isAvailable({ scopes, identityClient, clientId, resourceId, getTokenOptions = {}, }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$h.info(`${msiName$1}: Unavailable. Multiple scopes are not supported.`);
+            logger$i.info(`${msiName$1}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         // if the PodIdentityEndpoint environment variable was set no need to probe the endpoint, it can be assumed to exist
@@ -1706,39 +1710,39 @@ const imdsMsi = {
             request.allowInsecureConnection = true;
             let response;
             try {
-                logger$h.info(`${msiName$1}: Pinging the Azure IMDS endpoint`);
+                logger$i.info(`${msiName$1}: Pinging the Azure IMDS endpoint`);
                 response = await identityClient.sendRequest(request);
             }
             catch (err) {
                 // If the request failed, or Node.js was unable to establish a connection,
                 // or the host was down, we'll assume the IMDS endpoint isn't available.
                 if (coreUtil.isError(err)) {
-                    logger$h.verbose(`${msiName$1}: Caught error ${err.name}: ${err.message}`);
+                    logger$i.verbose(`${msiName$1}: Caught error ${err.name}: ${err.message}`);
                 }
                 // This is a special case for Docker Desktop which responds with a 403 with a message that contains "A socket operation was attempted to an unreachable network" or "A socket operation was attempted to an unreachable host"
                 // rather than just timing out, as expected.
-                logger$h.info(`${msiName$1}: The Azure IMDS endpoint is unavailable`);
+                logger$i.info(`${msiName$1}: The Azure IMDS endpoint is unavailable`);
                 return false;
             }
             if (response.status === 403) {
                 if ((_b = response.bodyAsText) === null || _b === void 0 ? void 0 : _b.includes("unreachable")) {
-                    logger$h.info(`${msiName$1}: The Azure IMDS endpoint is unavailable`);
-                    logger$h.info(`${msiName$1}: ${response.bodyAsText}`);
+                    logger$i.info(`${msiName$1}: The Azure IMDS endpoint is unavailable`);
+                    logger$i.info(`${msiName$1}: ${response.bodyAsText}`);
                     return false;
                 }
             }
             // If we received any response, the endpoint is available
-            logger$h.info(`${msiName$1}: The Azure IMDS endpoint is available`);
+            logger$i.info(`${msiName$1}: The Azure IMDS endpoint is available`);
             return true;
         });
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (process.env.AZURE_POD_IDENTITY_AUTHORITY_HOST) {
-            logger$h.info(`${msiName$1}: Using the Azure IMDS endpoint coming from the environment variable AZURE_POD_IDENTITY_AUTHORITY_HOST=${process.env.AZURE_POD_IDENTITY_AUTHORITY_HOST}.`);
+            logger$i.info(`${msiName$1}: Using the Azure IMDS endpoint coming from the environment variable AZURE_POD_IDENTITY_AUTHORITY_HOST=${process.env.AZURE_POD_IDENTITY_AUTHORITY_HOST}.`);
         }
         else {
-            logger$h.info(`${msiName$1}: Using the default Azure IMDS endpoint ${imdsHost}.`);
+            logger$i.info(`${msiName$1}: Using the default Azure IMDS endpoint ${imdsHost}.`);
         }
         let nextDelayInMs = configuration.retryConfig.startDelayInMs;
         for (let retries = 0; retries < configuration.retryConfig.maxRetries; retries++) {
@@ -1930,7 +1934,7 @@ function generateMsalConfiguration(clientId, tenantId, msalClientOptions = {}) {
             networkClient: httpClient,
             loggerOptions: {
                 loggerCallback: defaultLoggerCallback((_b = msalClientOptions.logger) !== null && _b !== void 0 ? _b : msalLogger),
-                logLevel: getMSALLogLevel(logger$q.getLogLevel()),
+                logLevel: getMSALLogLevel(logger$r.getLogLevel()),
                 piiLoggingEnabled: (_c = msalClientOptions.loggingOptions) === null || _c === void 0 ? void 0 : _c.enableUnsafeSupportLogging,
             },
         },
@@ -2098,7 +2102,7 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$g = credentialLogger("ClientAssertionCredential");
+const logger$h = credentialLogger("ClientAssertionCredential");
 /**
  * Authenticates a service principal with a JWT assertion.
  */
@@ -2121,7 +2125,7 @@ class ClientAssertionCredential {
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
         this.options = options;
         this.getAssertion = getAssertion;
-        this.msalClient = createMsalClient(clientId, tenantId, Object.assign(Object.assign({}, options), { logger: logger$g, tokenCredentialOptions: this.options }));
+        this.msalClient = createMsalClient(clientId, tenantId, Object.assign(Object.assign({}, options), { logger: logger$h, tokenCredentialOptions: this.options }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -2133,7 +2137,7 @@ class ClientAssertionCredential {
      */
     async getToken(scopes, options = {}) {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
-            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$g);
+            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$h);
             const clientAssertion = await this.getAssertion();
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             return this.msalClient.getTokenByClientAssertion(arrayScopes, clientAssertion, newOptions);
@@ -2143,7 +2147,7 @@ class ClientAssertionCredential {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const credentialName$3 = "WorkloadIdentityCredential";
+const credentialName$4 = "WorkloadIdentityCredential";
 /**
  * Contains the list of all supported environment variable names so that an
  * appropriate error message can be generated when no credentials can be
@@ -2156,7 +2160,7 @@ const SupportedWorkloadEnvironmentVariables = [
     "AZURE_CLIENT_ID",
     "AZURE_FEDERATED_TOKEN_FILE",
 ];
-const logger$f = credentialLogger(credentialName$3);
+const logger$g = credentialLogger(credentialName$4);
 /**
  * Workload Identity authentication is a feature in Azure that allows applications running on virtual machines (VMs)
  * to access other Azure resources without the need for a service principal or managed identity. With Workload Identity
@@ -2182,17 +2186,17 @@ class WorkloadIdentityCredential {
         this.cacheDate = undefined;
         // Logging environment variables for error details
         const assignedEnv = processEnvVars(SupportedWorkloadEnvironmentVariables).assigned.join(", ");
-        logger$f.info(`Found the following environment variables: ${assignedEnv}`);
+        logger$g.info(`Found the following environment variables: ${assignedEnv}`);
         const workloadIdentityCredentialOptions = options !== null && options !== void 0 ? options : {};
         const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;
         const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;
         this.federatedTokenFilePath =
             workloadIdentityCredentialOptions.tokenFilePath || process.env.AZURE_FEDERATED_TOKEN_FILE;
         if (tenantId) {
-            checkTenantId(logger$f, tenantId);
+            checkTenantId(logger$g, tenantId);
         }
         if (clientId && tenantId && this.federatedTokenFilePath) {
-            logger$f.info(`Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`);
+            logger$g.info(`Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`);
             this.client = new ClientAssertionCredential(tenantId, clientId, this.readFileContents.bind(this), options);
         }
     }
@@ -2206,15 +2210,15 @@ class WorkloadIdentityCredential {
      */
     async getToken(scopes, options) {
         if (!this.client) {
-            const errorMessage = `${credentialName$3}: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters. 
+            const errorMessage = `${credentialName$4}: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters. 
       In DefaultAzureCredential and ManagedIdentityCredential, these can be provided as environment variables - 
       "AZURE_TENANT_ID",
       "AZURE_CLIENT_ID",
       "AZURE_FEDERATED_TOKEN_FILE". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot  `;
-            logger$f.info(errorMessage);
+            logger$g.info(errorMessage);
             throw new CredentialUnavailableError(errorMessage);
         }
-        logger$f.info("Invoking getToken() of Client Assertion Credential");
+        logger$g.info("Invoking getToken() of Client Assertion Credential");
         return this.client.getToken(scopes, options);
     }
     async readFileContents() {
@@ -2223,13 +2227,13 @@ class WorkloadIdentityCredential {
             this.azureFederatedTokenFileContent = undefined;
         }
         if (!this.federatedTokenFilePath) {
-            throw new CredentialUnavailableError(`${credentialName$3}: is unavailable. Invalid file path provided ${this.federatedTokenFilePath}.`);
+            throw new CredentialUnavailableError(`${credentialName$4}: is unavailable. Invalid file path provided ${this.federatedTokenFilePath}.`);
         }
         if (!this.azureFederatedTokenFileContent) {
             const file = await promises.readFile(this.federatedTokenFilePath, "utf8");
             const value = file.trim();
             if (!value) {
-                throw new CredentialUnavailableError(`${credentialName$3}: is unavailable. No content on the file ${this.federatedTokenFilePath}.`);
+                throw new CredentialUnavailableError(`${credentialName$4}: is unavailable. No content on the file ${this.federatedTokenFilePath}.`);
             }
             else {
                 this.azureFederatedTokenFileContent = value;
@@ -2243,7 +2247,7 @@ class WorkloadIdentityCredential {
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const msiName = "ManagedIdentityCredential - Token Exchange";
-const logger$e = credentialLogger(msiName);
+const logger$f = credentialLogger(msiName);
 /**
  * Defines how to determine whether the token exchange MSI is available, and also how to retrieve a token from the token exchange MSI.
  */
@@ -2256,7 +2260,7 @@ function tokenExchangeMsi() {
                 env.AZURE_TENANT_ID &&
                 process.env.AZURE_FEDERATED_TOKEN_FILE);
             if (!result) {
-                logger$e.info(`${msiName}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
+                logger$f.info(`${msiName}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
             }
             return result;
         },
@@ -2272,7 +2276,7 @@ function tokenExchangeMsi() {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$d = credentialLogger("ManagedIdentityCredential");
+const logger$e = credentialLogger("ManagedIdentityCredential");
 /**
  * Attempts authentication using a managed identity available at the deployment environment.
  * This authentication type works in Azure VMs, App Service instances, Azure Functions applications,
@@ -2330,7 +2334,7 @@ class ManagedIdentityCredential {
             },
             system: {
                 loggerOptions: {
-                    logLevel: getMSALLogLevel(logger$q.getLogLevel()),
+                    logLevel: getMSALLogLevel(logger$r.getLogLevel()),
                 },
             },
         });
@@ -2427,7 +2431,7 @@ class ManagedIdentityCredential {
                     // It also means that the endpoint answered with either 200 or 201 (see the sendTokenRequest method),
                     // yet we had no access token. For this reason, we'll throw once with a specific message:
                     const error = new CredentialUnavailableError("The managed identity endpoint was reached, yet no tokens were received.");
-                    logger$d.getToken.info(formatError(scopes, error));
+                    logger$e.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 // Since `authenticateManagedIdentity` didn't throw, and the result was not null,
@@ -2439,10 +2443,10 @@ class ManagedIdentityCredential {
                 // We've previously determined that the endpoint was unavailable,
                 // either because it was unreachable or permanently unable to authenticate.
                 const error = new CredentialUnavailableError("The managed identity endpoint is not currently available");
-                logger$d.getToken.info(formatError(scopes, error));
+                logger$e.getToken.info(formatError(scopes, error));
                 throw error;
             }
-            logger$d.getToken.info(formatSuccess(scopes));
+            logger$e.getToken.info(formatSuccess(scopes));
             return result;
         }
         catch (err) {
@@ -2464,14 +2468,14 @@ class ManagedIdentityCredential {
             // we can safely assume the credential is unavailable.
             if (err.code === "ENETUNREACH") {
                 const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. Network unreachable. Message: ${err.message}`);
-                logger$d.getToken.info(formatError(scopes, error));
+                logger$e.getToken.info(formatError(scopes, error));
                 throw error;
             }
             // If either the host was unreachable,
             // we can safely assume the credential is unavailable.
             if (err.code === "EHOSTUNREACH") {
                 const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. No managed identity endpoint found. Message: ${err.message}`);
-                logger$d.getToken.info(formatError(scopes, error));
+                logger$e.getToken.info(formatError(scopes, error));
                 throw error;
             }
             // If err.statusCode has a value of 400, it comes from sendTokenRequest,
@@ -2484,7 +2488,7 @@ class ManagedIdentityCredential {
             if (err.statusCode === 403 || err.code === 403) {
                 if (err.message.includes("unreachable")) {
                     const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. Network unreachable. Message: ${err.message}`);
-                    logger$d.getToken.info(formatError(scopes, error));
+                    logger$e.getToken.info(formatError(scopes, error));
                     throw error;
                 }
             }
@@ -2511,7 +2515,7 @@ class ManagedIdentityCredential {
      */
     handleResult(scopes, result, getTokenOptions) {
         this.ensureValidMsalToken(scopes, result, getTokenOptions);
-        logger$d.getToken.info(formatSuccess(scopes));
+        logger$e.getToken.info(formatSuccess(scopes));
         return {
             token: result.accessToken,
             expiresOnTimestamp: result.expiresOn.getTime(),
@@ -2522,7 +2526,7 @@ class ManagedIdentityCredential {
      */
     ensureValidMsalToken(scopes, msalToken, getTokenOptions) {
         const error = (message) => {
-            logger$d.getToken.info(message);
+            logger$e.getToken.info(message);
             return new AuthenticationRequiredError({
                 scopes: Array.isArray(scopes) ? scopes : [scopes],
                 getTokenOptions,
@@ -2542,12 +2546,12 @@ class ManagedIdentityCredential {
     initializeSetAppTokenProvider() {
         if (!this.isAppTokenProviderInitialized) {
             this.confidentialApp.SetAppTokenProvider(async (appTokenProviderParameters) => {
-                logger$d.info(`SetAppTokenProvider invoked with parameters- ${JSON.stringify(appTokenProviderParameters)}`);
+                logger$e.info(`SetAppTokenProvider invoked with parameters- ${JSON.stringify(appTokenProviderParameters)}`);
                 const getTokenOptions = Object.assign({}, appTokenProviderParameters);
-                logger$d.info(`authenticateManagedIdentity invoked with scopes- ${JSON.stringify(appTokenProviderParameters.scopes)} and getTokenOptions - ${JSON.stringify(getTokenOptions)}`);
+                logger$e.info(`authenticateManagedIdentity invoked with scopes- ${JSON.stringify(appTokenProviderParameters.scopes)} and getTokenOptions - ${JSON.stringify(getTokenOptions)}`);
                 const resultToken = await this.authenticateManagedIdentity(appTokenProviderParameters.scopes, getTokenOptions);
                 if (resultToken) {
-                    logger$d.info(`SetAppTokenProvider will save the token in cache`);
+                    logger$e.info(`SetAppTokenProvider will save the token in cache`);
                     const expiresInSeconds = (resultToken === null || resultToken === void 0 ? void 0 : resultToken.expiresOnTimestamp)
                         ? Math.floor((resultToken.expiresOnTimestamp - Date.now()) / 1000)
                         : 0;
@@ -2557,7 +2561,7 @@ class ManagedIdentityCredential {
                     };
                 }
                 else {
-                    logger$d.info(`SetAppTokenProvider token has "no_access_token_returned" as the saved token`);
+                    logger$e.info(`SetAppTokenProvider token has "no_access_token_returned" as the saved token`);
                     return {
                         accessToken: "no_access_token_returned",
                         expiresInSeconds: 0,
@@ -2648,7 +2652,7 @@ const cliCredentialInternals = {
         });
     },
 };
-const logger$c = credentialLogger("AzureCliCredential");
+const logger$d = credentialLogger("AzureCliCredential");
 /**
  * This credential will use the currently logged-in user login information
  * via the Azure CLI ('az') commandline tool.
@@ -2666,7 +2670,7 @@ class AzureCliCredential {
      */
     constructor(options) {
         if (options === null || options === void 0 ? void 0 : options.tenantId) {
-            checkTenantId(logger$c, options === null || options === void 0 ? void 0 : options.tenantId);
+            checkTenantId(logger$d, options === null || options === void 0 ? void 0 : options.tenantId);
             this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         }
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
@@ -2683,14 +2687,14 @@ class AzureCliCredential {
     async getToken(scopes, options = {}) {
         const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds);
         if (tenantId) {
-            checkTenantId(logger$c, tenantId);
+            checkTenantId(logger$d, tenantId);
         }
         const scope = typeof scopes === "string" ? scopes : scopes[0];
-        logger$c.getToken.info(`Using the scope ${scope}`);
+        logger$d.getToken.info(`Using the scope ${scope}`);
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
             var _a, _b, _c, _d;
             try {
-                ensureValidScopeForDevTimeCreds(scope, logger$c);
+                ensureValidScopeForDevTimeCreds(scope, logger$d);
                 const resource = getScopeResource(scope);
                 const obj = await cliCredentialInternals.getAzureCliAccessToken(resource, tenantId, this.timeout);
                 const specificScope = (_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("(.*)az login --scope(.*)");
@@ -2698,18 +2702,18 @@ class AzureCliCredential {
                 const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("az:(.*)not found")) || ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'az' is not recognized"));
                 if (isNotInstallError) {
                     const error = new CredentialUnavailableError("Azure CLI could not be found. Please visit https://aka.ms/azure-cli for installation instructions and then, once installed, authenticate to your Azure account using 'az login'.");
-                    logger$c.getToken.info(formatError(scopes, error));
+                    logger$d.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 if (isLoginError) {
                     const error = new CredentialUnavailableError("Please run 'az login' from a command prompt to authenticate before using this credential.");
-                    logger$c.getToken.info(formatError(scopes, error));
+                    logger$d.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 try {
                     const responseData = obj.stdout;
                     const response = this.parseRawResponse(responseData);
-                    logger$c.getToken.info(formatSuccess(scopes));
+                    logger$d.getToken.info(formatSuccess(scopes));
                     return response;
                 }
                 catch (e) {
@@ -2723,7 +2727,7 @@ class AzureCliCredential {
                 const error = err.name === "CredentialUnavailableError"
                     ? err
                     : new CredentialUnavailableError(err.message || "Unknown error while trying to retrieve the access token");
-                logger$c.getToken.info(formatError(scopes, error));
+                logger$d.getToken.info(formatError(scopes, error));
                 throw error;
             }
         });
@@ -2745,7 +2749,7 @@ class AzureCliCredential {
         // ensure it's a number or NaN
         let expiresOnTimestamp = Number.parseInt(response.expires_on, 10) * 1000;
         if (!isNaN(expiresOnTimestamp)) {
-            logger$c.getToken.info("expires_on is available and is valid, using it");
+            logger$d.getToken.info("expires_on is available and is valid, using it");
             return {
                 token,
                 expiresOnTimestamp,
@@ -2817,7 +2821,7 @@ const developerCliCredentialInternals = {
         });
     },
 };
-const logger$b = credentialLogger("AzureDeveloperCliCredential");
+const logger$c = credentialLogger("AzureDeveloperCliCredential");
 /**
  * Azure Developer CLI is a command-line interface tool that allows developers to create, manage, and deploy
  * resources in Azure. It's built on top of the Azure CLI and provides additional functionality specific
@@ -2854,7 +2858,7 @@ class AzureDeveloperCliCredential {
      */
     constructor(options) {
         if (options === null || options === void 0 ? void 0 : options.tenantId) {
-            checkTenantId(logger$b, options === null || options === void 0 ? void 0 : options.tenantId);
+            checkTenantId(logger$c, options === null || options === void 0 ? void 0 : options.tenantId);
             this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         }
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
@@ -2871,7 +2875,7 @@ class AzureDeveloperCliCredential {
     async getToken(scopes, options = {}) {
         const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds);
         if (tenantId) {
-            checkTenantId(logger$b, tenantId);
+            checkTenantId(logger$c, tenantId);
         }
         let scopeList;
         if (typeof scopes === "string") {
@@ -2880,12 +2884,12 @@ class AzureDeveloperCliCredential {
         else {
             scopeList = scopes;
         }
-        logger$b.getToken.info(`Using the scopes ${scopes}`);
+        logger$c.getToken.info(`Using the scopes ${scopes}`);
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
             var _a, _b, _c, _d;
             try {
                 scopeList.forEach((scope) => {
-                    ensureValidScopeForDevTimeCreds(scope, logger$b);
+                    ensureValidScopeForDevTimeCreds(scope, logger$c);
                 });
                 const obj = await developerCliCredentialInternals.getAzdAccessToken(scopeList, tenantId, this.timeout);
                 const isNotLoggedInError = ((_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("not logged in, run `azd login` to login")) ||
@@ -2894,17 +2898,17 @@ class AzureDeveloperCliCredential {
                     ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'azd' is not recognized"));
                 if (isNotInstallError || (obj.error && obj.error.code === "ENOENT")) {
                     const error = new CredentialUnavailableError("Azure Developer CLI couldn't be found. To mitigate this issue, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.");
-                    logger$b.getToken.info(formatError(scopes, error));
+                    logger$c.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 if (isNotLoggedInError) {
                     const error = new CredentialUnavailableError("Please run 'azd auth login' from a command prompt to authenticate before using this credential. For more information, see the troubleshooting guidelines at https://aka.ms/azsdk/js/identity/azdevclicredential/troubleshoot.");
-                    logger$b.getToken.info(formatError(scopes, error));
+                    logger$c.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 try {
                     const resp = JSON.parse(obj.stdout);
-                    logger$b.getToken.info(formatSuccess(scopes));
+                    logger$c.getToken.info(formatSuccess(scopes));
                     return {
                         token: resp.token,
                         expiresOnTimestamp: new Date(resp.expiresOn).getTime(),
@@ -2921,7 +2925,7 @@ class AzureDeveloperCliCredential {
                 const error = err.name === "CredentialUnavailableError"
                     ? err
                     : new CredentialUnavailableError(err.message || "Unknown error while trying to retrieve the access token");
-                logger$b.getToken.info(formatError(scopes, error));
+                logger$c.getToken.info(formatError(scopes, error));
                 throw error;
             }
         });
@@ -2961,7 +2965,7 @@ const processUtils = {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$a = credentialLogger("AzurePowerShellCredential");
+const logger$b = credentialLogger("AzurePowerShellCredential");
 const isWindows = process.platform === "win32";
 /**
  * Returns a platform-appropriate command name by appending ".exe" on Windows.
@@ -3042,7 +3046,7 @@ class AzurePowerShellCredential {
      */
     constructor(options) {
         if (options === null || options === void 0 ? void 0 : options.tenantId) {
-            checkTenantId(logger$a, options === null || options === void 0 ? void 0 : options.tenantId);
+            checkTenantId(logger$b, options === null || options === void 0 ? void 0 : options.tenantId);
             this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         }
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
@@ -3105,14 +3109,14 @@ class AzurePowerShellCredential {
             const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds);
             const scope = typeof scopes === "string" ? scopes : scopes[0];
             if (tenantId) {
-                checkTenantId(logger$a, tenantId);
+                checkTenantId(logger$b, tenantId);
             }
             try {
-                ensureValidScopeForDevTimeCreds(scope, logger$a);
-                logger$a.getToken.info(`Using the scope ${scope}`);
+                ensureValidScopeForDevTimeCreds(scope, logger$b);
+                logger$b.getToken.info(`Using the scope ${scope}`);
                 const resource = getScopeResource(scope);
                 const response = await this.getAzurePowerShellAccessToken(resource, tenantId, this.timeout);
-                logger$a.getToken.info(formatSuccess(scopes));
+                logger$b.getToken.info(formatSuccess(scopes));
                 return {
                     token: response.Token,
                     expiresOnTimestamp: new Date(response.ExpiresOn).getTime(),
@@ -3121,16 +3125,16 @@ class AzurePowerShellCredential {
             catch (err) {
                 if (isNotInstalledError(err)) {
                     const error = new CredentialUnavailableError(powerShellPublicErrorMessages.installed);
-                    logger$a.getToken.info(formatError(scope, error));
+                    logger$b.getToken.info(formatError(scope, error));
                     throw error;
                 }
                 else if (isLoginError(err)) {
                     const error = new CredentialUnavailableError(powerShellPublicErrorMessages.login);
-                    logger$a.getToken.info(formatError(scope, error));
+                    logger$b.getToken.info(formatError(scope, error));
                     throw error;
                 }
                 const error = new CredentialUnavailableError(`${err}. ${powerShellPublicErrorMessages.troubleshoot}`);
-                logger$a.getToken.info(formatError(scope, error));
+                logger$b.getToken.info(formatError(scope, error));
                 throw error;
             }
         });
@@ -3142,7 +3146,7 @@ class AzurePowerShellCredential {
 /**
  * @internal
  */
-const logger$9 = credentialLogger("ChainedTokenCredential");
+const logger$a = credentialLogger("ChainedTokenCredential");
 /**
  * Enables multiple `TokenCredential` implementations to be tried in order
  * until one of the getToken methods returns an access token.
@@ -3197,17 +3201,17 @@ class ChainedTokenCredential {
                         errors.push(err);
                     }
                     else {
-                        logger$9.getToken.info(formatError(scopes, err));
+                        logger$a.getToken.info(formatError(scopes, err));
                         throw err;
                     }
                 }
             }
             if (!token && errors.length > 0) {
                 const err = new AggregateAuthenticationError(errors, "ChainedTokenCredential authentication failed.");
-                logger$9.getToken.info(formatError(scopes, err));
+                logger$a.getToken.info(formatError(scopes, err));
                 throw err;
             }
-            logger$9.getToken.info(`Result for ${successfulCredential.constructor.name}: ${formatSuccess(scopes)}`);
+            logger$a.getToken.info(`Result for ${successfulCredential.constructor.name}: ${formatSuccess(scopes)}`);
             if (token === null) {
                 throw new CredentialUnavailableError("Failed to retrieve a valid token");
             }
@@ -3218,8 +3222,8 @@ class ChainedTokenCredential {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const credentialName$2 = "ClientCertificateCredential";
-const logger$8 = credentialLogger(credentialName$2);
+const credentialName$3 = "ClientCertificateCredential";
+const logger$9 = credentialLogger(credentialName$3);
 /**
  * Enables authentication to Microsoft Entra ID using a PEM-encoded
  * certificate that is assigned to an App Registration. More information
@@ -3231,7 +3235,7 @@ const logger$8 = credentialLogger(credentialName$2);
 class ClientCertificateCredential {
     constructor(tenantId, clientId, certificatePathOrConfiguration, options = {}) {
         if (!tenantId || !clientId) {
-            throw new Error(`${credentialName$2}: tenantId and clientId are required parameters.`);
+            throw new Error(`${credentialName$3}: tenantId and clientId are required parameters.`);
         }
         this.tenantId = tenantId;
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
@@ -3244,12 +3248,12 @@ class ClientCertificateCredential {
         const certificate = this.certificateConfiguration.certificate;
         const certificatePath = this.certificateConfiguration.certificatePath;
         if (!this.certificateConfiguration || !(certificate || certificatePath)) {
-            throw new Error(`${credentialName$2}: Provide either a PEM certificate in string form, or the path to that certificate in the filesystem. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.`);
+            throw new Error(`${credentialName$3}: Provide either a PEM certificate in string form, or the path to that certificate in the filesystem. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.`);
         }
         if (certificate && certificatePath) {
-            throw new Error(`${credentialName$2}: To avoid unexpected behaviors, providing both the contents of a PEM certificate and the path to a PEM certificate is forbidden. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.`);
+            throw new Error(`${credentialName$3}: To avoid unexpected behaviors, providing both the contents of a PEM certificate and the path to a PEM certificate is forbidden. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.`);
         }
-        this.msalClient = createMsalClient(clientId, tenantId, Object.assign(Object.assign({}, options), { logger: logger$8, tokenCredentialOptions: options }));
+        this.msalClient = createMsalClient(clientId, tenantId, Object.assign(Object.assign({}, options), { logger: logger$9, tokenCredentialOptions: options }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -3260,8 +3264,8 @@ class ClientCertificateCredential {
      *                TokenCredential implementation might make.
      */
     async getToken(scopes, options = {}) {
-        return tracingClient.withSpan(`${credentialName$2}.getToken`, options, async (newOptions) => {
-            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$8);
+        return tracingClient.withSpan(`${credentialName$3}.getToken`, options, async (newOptions) => {
+            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$9);
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             const certificate = await this.buildClientCertificate();
             return this.msalClient.getTokenByClientCertificate(arrayScopes, certificate, newOptions);
@@ -3323,7 +3327,7 @@ class ClientCertificateCredential {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$7 = credentialLogger("ClientSecretCredential");
+const logger$8 = credentialLogger("ClientSecretCredential");
 /**
  * Enables authentication to Microsoft Entra ID using a client secret
  * that was generated for an App Registration. More information on how
@@ -3350,7 +3354,7 @@ class ClientSecretCredential {
         this.clientSecret = clientSecret;
         this.tenantId = tenantId;
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
-        this.msalClient = createMsalClient(clientId, tenantId, Object.assign(Object.assign({}, options), { logger: logger$7, tokenCredentialOptions: options }));
+        this.msalClient = createMsalClient(clientId, tenantId, Object.assign(Object.assign({}, options), { logger: logger$8, tokenCredentialOptions: options }));
     }
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
@@ -3362,7 +3366,7 @@ class ClientSecretCredential {
      */
     async getToken(scopes, options = {}) {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
-            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$7);
+            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$8);
             const arrayScopes = ensureScopes(scopes);
             return this.msalClient.getTokenByClientSecret(arrayScopes, this.clientSecret, newOptions);
         });
@@ -3447,7 +3451,7 @@ class MsalNode {
                 networkClient: this.identityClient,
                 loggerOptions: {
                     loggerCallback: defaultLoggerCallback(options.logger),
-                    logLevel: getMSALLogLevel(logger$q.getLogLevel()),
+                    logLevel: getMSALLogLevel(logger$r.getLogLevel()),
                     piiLoggingEnabled: (_a = options.loggingOptions) === null || _a === void 0 ? void 0 : _a.enableUnsafeSupportLogging,
                 },
             },
@@ -3713,7 +3717,7 @@ class MsalUsernamePassword extends MsalNode {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$6 = credentialLogger("UsernamePasswordCredential");
+const logger$7 = credentialLogger("UsernamePasswordCredential");
 /**
  * Enables authentication to Microsoft Entra ID with a user's
  * username and password. This credential requires a high degree of
@@ -3738,7 +3742,7 @@ class UsernamePasswordCredential {
         }
         this.tenantId = tenantId;
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
-        this.msalFlow = new MsalUsernamePassword(Object.assign(Object.assign({}, options), { logger: logger$6,
+        this.msalFlow = new MsalUsernamePassword(Object.assign(Object.assign({}, options), { logger: logger$7,
             clientId,
             tenantId,
             username,
@@ -3758,7 +3762,7 @@ class UsernamePasswordCredential {
      */
     async getToken(scopes, options = {}) {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
-            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$6);
+            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$7);
             const arrayScopes = ensureScopes(scopes);
             return this.msalFlow.getToken(arrayScopes, newOptions);
         });
@@ -3789,8 +3793,8 @@ function getAdditionallyAllowedTenants() {
     const additionallyAllowedValues = (_a = process.env.AZURE_ADDITIONALLY_ALLOWED_TENANTS) !== null && _a !== void 0 ? _a : "";
     return additionallyAllowedValues.split(";");
 }
-const credentialName$1 = "EnvironmentCredential";
-const logger$5 = credentialLogger(credentialName$1);
+const credentialName$2 = "EnvironmentCredential";
+const logger$6 = credentialLogger(credentialName$2);
 /**
  * Enables authentication to Microsoft Entra ID using a client secret or certificate, or as a user
  * with a username and password.
@@ -3824,29 +3828,29 @@ class EnvironmentCredential {
         // Keep track of any missing environment variables for error details
         this._credential = undefined;
         const assigned = processEnvVars(AllSupportedEnvironmentVariables).assigned.join(", ");
-        logger$5.info(`Found the following environment variables: ${assigned}`);
+        logger$6.info(`Found the following environment variables: ${assigned}`);
         const tenantId = process.env.AZURE_TENANT_ID, clientId = process.env.AZURE_CLIENT_ID, clientSecret = process.env.AZURE_CLIENT_SECRET;
         const additionallyAllowedTenantIds = getAdditionallyAllowedTenants();
         const newOptions = Object.assign(Object.assign({}, options), { additionallyAllowedTenantIds });
         if (tenantId) {
-            checkTenantId(logger$5, tenantId);
+            checkTenantId(logger$6, tenantId);
         }
         if (tenantId && clientId && clientSecret) {
-            logger$5.info(`Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`);
+            logger$6.info(`Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`);
             this._credential = new ClientSecretCredential(tenantId, clientId, clientSecret, newOptions);
             return;
         }
         const certificatePath = process.env.AZURE_CLIENT_CERTIFICATE_PATH;
         const certificatePassword = process.env.AZURE_CLIENT_CERTIFICATE_PASSWORD;
         if (tenantId && clientId && certificatePath) {
-            logger$5.info(`Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`);
+            logger$6.info(`Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`);
             this._credential = new ClientCertificateCredential(tenantId, clientId, { certificatePath, certificatePassword }, newOptions);
             return;
         }
         const username = process.env.AZURE_USERNAME;
         const password = process.env.AZURE_PASSWORD;
         if (tenantId && clientId && username && password) {
-            logger$5.info(`Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`);
+            logger$6.info(`Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`);
             this._credential = new UsernamePasswordCredential(tenantId, clientId, username, password, newOptions);
         }
     }
@@ -3857,30 +3861,30 @@ class EnvironmentCredential {
      * @param options - Optional parameters. See {@link GetTokenOptions}.
      */
     async getToken(scopes, options = {}) {
-        return tracingClient.withSpan(`${credentialName$1}.getToken`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${credentialName$2}.getToken`, options, async (newOptions) => {
             if (this._credential) {
                 try {
                     const result = await this._credential.getToken(scopes, newOptions);
-                    logger$5.getToken.info(formatSuccess(scopes));
+                    logger$6.getToken.info(formatSuccess(scopes));
                     return result;
                 }
                 catch (err) {
                     const authenticationError = new AuthenticationError(400, {
-                        error: `${credentialName$1} authentication failed. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`,
+                        error: `${credentialName$2} authentication failed. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`,
                         error_description: err.message.toString().split("More details:").join(""),
                     });
-                    logger$5.getToken.info(formatError(scopes, authenticationError));
+                    logger$6.getToken.info(formatError(scopes, authenticationError));
                     throw authenticationError;
                 }
             }
-            throw new CredentialUnavailableError(`${credentialName$1} is unavailable. No underlying credential could be used. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`);
+            throw new CredentialUnavailableError(`${credentialName$2} is unavailable. No underlying credential could be used. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`);
         });
     }
 }
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$4 = credentialLogger("DefaultAzureCredential");
+const logger$5 = credentialLogger("DefaultAzureCredential");
 /**
  * Creates a {@link ManagedIdentityCredential} from the provided options.
  * @param options - Options to configure the credential.
@@ -3985,7 +3989,7 @@ class UnavailableDefaultCredential {
         this.credentialUnavailableErrorMessage = message;
     }
     getToken() {
-        logger$4.getToken.info(`Skipping ${this.credentialName}, reason: ${this.credentialUnavailableErrorMessage}`);
+        logger$5.getToken.info(`Skipping ${this.credentialName}, reason: ${this.credentialUnavailableErrorMessage}`);
         return Promise.resolve(null);
     }
 }
@@ -4013,7 +4017,7 @@ class DefaultAzureCredential extends ChainedTokenCredential {
                 return createCredentialFn(options);
             }
             catch (err) {
-                logger$4.warning(`Skipped ${createCredentialFn.name} because of an error creating the credential: ${err}`);
+                logger$5.warning(`Skipped ${createCredentialFn.name} because of an error creating the credential: ${err}`);
                 return new UnavailableDefaultCredential(createCredentialFn.name, err.message);
             }
         });
@@ -4131,7 +4135,7 @@ class MsalOpenBrowser extends MsalNode {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$3 = credentialLogger("InteractiveBrowserCredential");
+const logger$4 = credentialLogger("InteractiveBrowserCredential");
 /**
  * Enables authentication to Microsoft Entra ID inside of the web browser
  * using the interactive login flow.
@@ -4162,7 +4166,7 @@ class InteractiveBrowserCredential {
                 throw new Error("In order to do WAM authentication, `parentWindowHandle` under `brokerOptions` is a required parameter");
             }
             else {
-                this.msalFlow = new MsalOpenBrowser(Object.assign(Object.assign({}, options), { tokenCredentialOptions: options, logger: logger$3,
+                this.msalFlow = new MsalOpenBrowser(Object.assign(Object.assign({}, options), { tokenCredentialOptions: options, logger: logger$4,
                     redirectUri, browserCustomizationOptions: ibcNodeOptions === null || ibcNodeOptions === void 0 ? void 0 : ibcNodeOptions.browserCustomizationOptions, brokerOptions: {
                         enabled: true,
                         parentWindowHandle: ibcNodeOptions.brokerOptions.parentWindowHandle,
@@ -4172,7 +4176,7 @@ class InteractiveBrowserCredential {
             }
         }
         else {
-            this.msalFlow = new MsalOpenBrowser(Object.assign(Object.assign({}, options), { tokenCredentialOptions: options, logger: logger$3,
+            this.msalFlow = new MsalOpenBrowser(Object.assign(Object.assign({}, options), { tokenCredentialOptions: options, logger: logger$4,
                 redirectUri, browserCustomizationOptions: ibcNodeOptions === null || ibcNodeOptions === void 0 ? void 0 : ibcNodeOptions.browserCustomizationOptions }));
         }
         this.disableAutomaticAuthentication = options === null || options === void 0 ? void 0 : options.disableAutomaticAuthentication;
@@ -4191,7 +4195,7 @@ class InteractiveBrowserCredential {
      */
     async getToken(scopes, options = {}) {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
-            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$3);
+            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$4);
             const arrayScopes = ensureScopes(scopes);
             return this.msalFlow.getToken(arrayScopes, Object.assign(Object.assign({}, newOptions), { disableAutomaticAuthentication: this.disableAutomaticAuthentication }));
         });
@@ -4253,7 +4257,7 @@ class MsalDeviceCode extends MsalNode {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const logger$2 = credentialLogger("DeviceCodeCredential");
+const logger$3 = credentialLogger("DeviceCodeCredential");
 /**
  * Method that logs the user code from the DeviceCodeCredential.
  * @param deviceCodeInfo - The device code.
@@ -4289,7 +4293,7 @@ class DeviceCodeCredential {
     constructor(options) {
         this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
-        this.msalFlow = new MsalDeviceCode(Object.assign(Object.assign({}, options), { logger: logger$2, userPromptCallback: (options === null || options === void 0 ? void 0 : options.userPromptCallback) || defaultDeviceCodePromptCallback, tokenCredentialOptions: options || {} }));
+        this.msalFlow = new MsalDeviceCode(Object.assign(Object.assign({}, options), { logger: logger$3, userPromptCallback: (options === null || options === void 0 ? void 0 : options.userPromptCallback) || defaultDeviceCodePromptCallback, tokenCredentialOptions: options || {} }));
         this.disableAutomaticAuthentication = options === null || options === void 0 ? void 0 : options.disableAutomaticAuthentication;
     }
     /**
@@ -4306,7 +4310,7 @@ class DeviceCodeCredential {
      */
     async getToken(scopes, options = {}) {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
-            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$2);
+            newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$3);
             const arrayScopes = ensureScopes(scopes);
             return this.msalFlow.getToken(arrayScopes, Object.assign(Object.assign({}, newOptions), { disableAutomaticAuthentication: this.disableAutomaticAuthentication }));
         });
@@ -4330,6 +4334,130 @@ class DeviceCodeCredential {
     }
 }
 
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+const credentialName$1 = "AzurePipelinesServiceConnectionCredential";
+const OIDC_API_VERSION = "7.1";
+const logger$2 = credentialLogger(credentialName$1);
+/**
+ * This credential is designed to be used in ADO Pipelines with service connections
+ * as a setup for workload identity federation.
+ */
+class AzurePipelinesServiceConnectionCredential {
+    /**
+     * AzurePipelinesServiceConnectionCredential supports Federated Identity on Azure Pipelines through Service Connections.
+     * @param tenantId - tenantId associated with the service connection
+     * @param clientId - clientId associated with the service connection
+     * @param serviceConnectionId - id for the service connection
+     * @param options - The identity client options to use for authentication.
+     */
+    constructor(tenantId, clientId, serviceConnectionId, options) {
+        if (!clientId || !tenantId || !serviceConnectionId) {
+            throw new CredentialUnavailableError(`${credentialName$1}: is unavailable. tenantId, clientId, and serviceConnectionId are required parameters.`);
+        }
+        checkTenantId(logger$2, tenantId);
+        logger$2.info(`Invoking AzurePipelinesServiceConnectionCredential with tenant ID: ${tenantId}, clientId: ${clientId} and service connection id: ${serviceConnectionId}`);
+        if (clientId && tenantId && serviceConnectionId) {
+            this.ensurePipelinesSystemVars();
+            const oidcRequestUrl = `${process.env.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI}${process.env.SYSTEM_TEAMPROJECTID}/_apis/distributedtask/hubs/build/plans/${process.env.SYSTEM_PLANID}/jobs/${process.env.SYSTEM_JOBID}/oidctoken?api-version=${OIDC_API_VERSION}&serviceConnectionId=${this.serviceConnectionId}`;
+            const systemAccessToken = `${process.env.SYSTEM_ACCESSTOKEN}`;
+            logger$2.info(`Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${clientId} and service connection id: ${serviceConnectionId}`);
+            this.clientAssertionCredential = new ClientAssertionCredential(tenantId, clientId, this.requestOidcToken.bind(this, oidcRequestUrl, systemAccessToken), options);
+        }
+    }
+    /**
+     * Authenticates with Microsoft Entra ID and returns an access token if successful.
+     * If authentication fails, a {@link CredentialUnavailableError} or {@link AuthenticationError} will be thrown with the details of the failure.
+     *
+     * @param scopes - The list of scopes for which the token will have access.
+     * @param options - The options used to configure any requests this
+     *                TokenCredential implementation might make.
+     */
+    async getToken(scopes, options) {
+        if (!this.clientAssertionCredential) {
+            const errorMessage = `${credentialName$1}: is unavailable. tenantId, clientId, and serviceConnectionId are required parameters. 
+      To use Federation Identity in Azure Pipelines, these are required as inputs / env variables - 
+      tenantId,
+      clientId,
+      serviceConnectionId,
+      "SYSTEM_TEAMFOUNDATIONCOLLECTIONURI" &&
+      "SYSTEM_TEAMPROJECTID" &&
+      "SYSTEM_PLANID" &&
+      "SYSTEM_JOBID" &&
+      "SYSTEM_ACCESSTOKEN"
+      See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/troubleshoot`;
+            logger$2.error(errorMessage);
+            throw new CredentialUnavailableError(errorMessage);
+        }
+        logger$2.info("Invoking getToken() of Client Assertion Credential");
+        return this.clientAssertionCredential.getToken(scopes, options);
+    }
+    /**
+     *
+     * @param oidcRequestUrl - oidc request url
+     * @param systemAccessToken - system access token
+     * @returns OIDC token from Azure Pipelines
+     */
+    async requestOidcToken(oidcRequestUrl, systemAccessToken) {
+        logger$2.info("Requesting OIDC token from Azure Pipelines...");
+        logger$2.info(oidcRequestUrl);
+        const httpClient = coreRestPipeline.createDefaultHttpClient();
+        const request = coreRestPipeline.createPipelineRequest({
+            url: oidcRequestUrl,
+            method: "POST",
+            headers: coreRestPipeline.createHttpHeaders({
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${systemAccessToken}`,
+            }),
+        });
+        const response = await httpClient.sendRequest(request);
+        const text = response.bodyAsText;
+        if (!text) {
+            throw new AuthenticationError(response.status, `${credentialName$1}: Authenticated Failed. Received null token from OIDC request.`);
+        }
+        const result = JSON.parse(text);
+        if (result === null || result === void 0 ? void 0 : result.oidcToken) {
+            return result.oidcToken;
+        }
+        else {
+            throw new AuthenticationError(response.status, `${credentialName$1}: Authentication Failed. oidcToken field not detected in the response. Response = ${JSON.stringify(result)}`);
+        }
+    }
+    /**
+     * Ensures all system env vars are there to form the request uri for OIDC token
+     * @returns void
+     * @throws CredentialUnavailableError
+     */
+    ensurePipelinesSystemVars() {
+        if (process.env.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI &&
+            process.env.SYSTEM_TEAMPROJECTID &&
+            process.env.SYSTEM_PLANID &&
+            process.env.SYSTEM_JOBID &&
+            process.env.SYSTEM_ACCESSTOKEN) {
+            return;
+        }
+        const missingEnvVars = [];
+        let errorMessage = "";
+        if (!process.env.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI) {
+            missingEnvVars.push("SYSTEM_TEAMFOUNDATIONCOLLECTIONURI");
+        }
+        if (!process.env.SYSTEM_TEAMPROJECTID)
+            missingEnvVars.push("SYSTEM_TEAMPROJECTID");
+        if (!process.env.SYSTEM_PLANID)
+            missingEnvVars.push("SYSTEM_PLANID");
+        if (!process.env.SYSTEM_JOBID)
+            missingEnvVars.push("SYSTEM_JOBID");
+        if (!process.env.SYSTEM_ACCESSTOKEN) {
+            errorMessage +=
+                "\nPlease ensure that the system access token is available in the SYSTEM_ACCESSTOKEN value; this is often most easily achieved by adding a block to the end of your pipeline yaml for the task with:\n env: \n- SYSTEM_ACCESSTOKEN: $(System.AccessToken)";
+            missingEnvVars.push("SYSTEM_ACCESSTOKEN");
+        }
+        if (missingEnvVars.length > 0) {
+            throw new CredentialUnavailableError(`${credentialName$1}: is unavailable. Ensure that you're running this task in an Azure Pipeline, so that following missing system variable(s) can be defined- ${missingEnvVars.join(", ")}.${errorMessage}`);
+        }
+    }
+}
+
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 /**
@@ -4630,6 +4758,7 @@ exports.AuthenticationRequiredError = AuthenticationRequiredError;
 exports.AuthorizationCodeCredential = AuthorizationCodeCredential;
 exports.AzureCliCredential = AzureCliCredential;
 exports.AzureDeveloperCliCredential = AzureDeveloperCliCredential;
+exports.AzurePipelinesServiceConnectionCredential = AzurePipelinesServiceConnectionCredential;
 exports.AzurePowerShellCredential = AzurePowerShellCredential;
 exports.ChainedTokenCredential = ChainedTokenCredential;
 exports.ClientAssertionCredential = ClientAssertionCredential;
@@ -4649,7 +4778,7 @@ exports.WorkloadIdentityCredential = WorkloadIdentityCredential;
 exports.deserializeAuthenticationRecord = deserializeAuthenticationRecord;
 exports.getBearerTokenProvider = getBearerTokenProvider;
 exports.getDefaultAzureCredential = getDefaultAzureCredential;
-exports.logger = logger$p;
+exports.logger = logger$q;
 exports.serializeAuthenticationRecord = serializeAuthenticationRecord;
 exports.useIdentityPlugin = useIdentityPlugin;
 //# sourceMappingURL=index.js.map