@openclaw/msteams 2026.7.1-beta.1 → 2026.7.1-beta.4

package/node_modules/@azure/msal-node/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@azure/msal-node",
-  "version": "5.2.3",
+  "version": "5.3.1",
   "author": {
     "name": "Microsoft",
     "email": "nugetaad@microsoft.com",
@@ -66,7 +66,7 @@
     ]
   },
   "devDependencies": {
-    "@microsoft/api-extractor": "^7.43.4",
+    "@microsoft/api-extractor": "^7.58.7",
     "@rollup/plugin-node-resolve": "^15.0.1",
     "@rollup/plugin-typescript": "^11.0.0",
     "@types/jest": "^29.5.0",
@@ -78,13 +78,13 @@
     "prettier": "2.8.7",
     "rollup": "^4.22.4",
     "rollup-msal": "file:../../shared-configs/rollup-msal",
-    "ts-jest": "^29.1.0",
+    "ts-jest": "^29.4.11",
     "tslib": "^1.10.0",
     "typescript": "^4.9.5",
     "yargs": "^17.3.1"
   },
   "dependencies": {
-    "@azure/msal-common": "16.7.0",
+    "@azure/msal-common": "16.11.0",
     "jsonwebtoken": "^9.0.0"
   },
   "engines": {

package/node_modules/@azure/msal-node/src/cache/CacheHelpers.ts

@@ -8,8 +8,21 @@ import {
     Constants,
     CredentialEntity,
 } from "@azure/msal-common/node";
+import { createHash } from "crypto";
 import { CACHE } from "../utils/Constants.js";
 
+/**
+ * Computes a combined hash from additional cache key components.
+ * Matches the cross-SDK algorithm: sort keys → concatenate key+value → SHA-256 → Base64URL (no padding).
+ */
+function computeAdditionalCacheKeyHash(
+    components: Record<string, string>
+): string {
+    const sortedKeys = Object.keys(components).sort();
+    const input = sortedKeys.map((k) => k + components[k]).join("");
+    return createHash("sha256").update(input, "utf8").digest("base64url");
+}
+
 export function generateCredentialKey(credential: CredentialEntity): string {
     const familyId =
         (credential.credentialType === Constants.CredentialType.REFRESH_TOKEN &&
@@ -31,6 +44,18 @@ export function generateCredentialKey(credential: CredentialEntity): string {
         scheme,
     ];
 
+    // Compute and append a combined hash from additional cache key components (e.g., fmi_path)
+    if (
+        credential.additionalCacheKeyComponents &&
+        Object.keys(credential.additionalCacheKeyComponents).length > 0
+    ) {
+        credentialKey.push(
+            computeAdditionalCacheKeyHash(
+                credential.additionalCacheKeyComponents
+            )
+        );
+    }
+
     return credentialKey.join(CACHE.KEY_SEPARATOR).toLowerCase();
 }
 

package/node_modules/@azure/msal-node/src/cache/serializer/Deserializer.ts

@@ -134,6 +134,8 @@ export class Deserializer {
                         serializedAT.token_type as Constants.AuthenticationScheme,
                     userAssertionHash: serializedAT.userAssertionHash,
                     resource: serializedAT.resource,
+                    additionalCacheKeyComponents:
+                        serializedAT.additionalCacheKeyComponents,
                     lastUpdatedAt: Date.now().toString(),
                 };
                 atObjects[key] = accessToken;

package/node_modules/@azure/msal-node/src/cache/serializer/Serializer.ts

@@ -114,6 +114,8 @@ export class Serializer {
                 token_type: atEntity.tokenType,
                 userAssertionHash: atEntity.userAssertionHash,
                 resource: atEntity.resource,
+                additionalCacheKeyComponents:
+                    atEntity.additionalCacheKeyComponents,
             };
         });
 

package/node_modules/@azure/msal-node/src/cache/serializer/SerializerTypes.ts

@@ -93,6 +93,7 @@ export type SerializedAccessTokenEntity = {
     token_type?: string;
     userAssertionHash?: string;
     resource?: string;
+    additionalCacheKeyComponents?: Record<string, string>;
 };
 
 /**

package/node_modules/@azure/msal-node/src/client/ClientApplication.ts

@@ -166,7 +166,11 @@ export abstract class ClientApplication {
                 "acquireTokenByCode - validating state",
                 request.correlationId || ""
             );
-            this.validateState(request.state, authCodePayLoad.state || "");
+            this.validateState(
+                request.state,
+                authCodePayLoad.state || "",
+                request.correlationId || ""
+            );
             // eslint-disable-next-line no-param-reassign
             authCodePayLoad = { ...authCodePayLoad, state: "" };
         }
@@ -208,7 +212,7 @@ export abstract class ClientApplication {
             );
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -267,7 +271,7 @@ export abstract class ClientApplication {
             );
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -346,7 +350,7 @@ export abstract class ClientApplication {
             }
         } catch (error) {
             if (error instanceof AuthError) {
-                error.setCorrelationId(validRequest.correlationId);
+                error.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(error);
             throw error;
@@ -441,7 +445,7 @@ export abstract class ClientApplication {
             return await usernamePasswordClient.acquireToken(validRequest);
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -465,13 +469,20 @@ export abstract class ClientApplication {
      * @param state - Unique GUID generated by the user that is cached by the user and sent to the server during the first leg of the flow
      * @param cachedState - This string is sent back by the server with the authorization code
      */
-    protected validateState(state: string, cachedState: string): void {
+    protected validateState(
+        state: string,
+        cachedState: string,
+        correlationId: string
+    ): void {
         if (!state) {
-            throw NodeAuthError.createStateNotFoundError();
+            throw NodeAuthError.createStateNotFoundError(correlationId);
         }
 
         if (state !== cachedState) {
-            throw createClientAuthError(ClientAuthErrorCodes.stateMismatch);
+            throw createClientAuthError(
+                ClientAuthErrorCodes.stateMismatch,
+                correlationId
+            );
         }
     }
 

package/node_modules/@azure/msal-node/src/client/ClientAssertion.ts

@@ -116,7 +116,10 @@ export class ClientAssertion {
             return this.jwt;
         }
 
-        throw createClientAuthError(NodeClientAuthErrorCodes.invalidAssertion);
+        throw createClientAuthError(
+            NodeClientAuthErrorCodes.invalidAssertion,
+            ""
+        );
     }
 
     /**

package/node_modules/@azure/msal-node/src/client/ClientCredentialClient.ts

@@ -4,6 +4,7 @@
  */
 
 import {
+    AADServerParamKeys,
     AccessTokenEntity,
     AuthenticationResult,
     Authority,
@@ -59,8 +60,21 @@ export class ClientCredentialClient extends BaseClient {
     public async acquireToken(
         request: CommonClientCredentialRequest
     ): Promise<AuthenticationResult | null> {
+        // Build additional cache key components for FMI cache isolation
+        let additionalCacheKeyComponents: Record<string, string> | undefined;
+        if (request.fmiPath) {
+            additionalCacheKeyComponents = {
+                fmi_path: request.fmiPath,
+            };
+        }
+
         if (request.skipCache || request.claims) {
-            return this.executeTokenRequest(request, this.authority);
+            return this.executeTokenRequest(
+                request,
+                this.authority,
+                /* refreshAccessToken */ undefined,
+                additionalCacheKeyComponents
+            );
         }
 
         const [cachedAuthenticationResult, lastCacheOutcome] =
@@ -70,7 +84,8 @@ export class ClientCredentialClient extends BaseClient {
                 this.cryptoUtils,
                 this.authority,
                 this.cacheManager,
-                this.serverTelemetryManager
+                this.serverTelemetryManager,
+                additionalCacheKeyComponents
             );
 
         if (cachedAuthenticationResult) {
@@ -89,14 +104,20 @@ export class ClientCredentialClient extends BaseClient {
                 await this.executeTokenRequest(
                     request,
                     this.authority,
-                    refreshAccessToken
+                    refreshAccessToken,
+                    additionalCacheKeyComponents
                 );
             }
 
             // return the cached token
             return cachedAuthenticationResult;
         } else {
-            return this.executeTokenRequest(request, this.authority);
+            return this.executeTokenRequest(
+                request,
+                this.authority,
+                /* refreshAccessToken */ undefined,
+                additionalCacheKeyComponents
+            );
         }
     }
 
@@ -109,7 +130,8 @@ export class ClientCredentialClient extends BaseClient {
         cryptoUtils: ICrypto,
         authority: Authority,
         cacheManager: CacheManager,
-        serverTelemetryManager?: ServerTelemetryManager | null
+        serverTelemetryManager?: ServerTelemetryManager | null,
+        additionalCacheKeyComponents?: Record<string, string>
     ): Promise<[AuthenticationResult | null, Constants.CacheOutcome]> {
         const clientConfiguration = config as ClientConfiguration;
         const managedIdentityConfiguration =
@@ -137,9 +159,10 @@ export class ClientCredentialClient extends BaseClient {
             authority,
             managedIdentityConfiguration.managedIdentityId?.id ||
                 clientConfiguration.authOptions.clientId,
-            new ScopeSet(request.scopes || []),
+            new ScopeSet(request.scopes || [], request.correlationId),
             cacheManager,
-            request.correlationId
+            request.correlationId,
+            additionalCacheKeyComponents
         );
 
         if (
@@ -212,7 +235,8 @@ export class ClientCredentialClient extends BaseClient {
         id: string,
         scopeSet: ScopeSet,
         cacheManager: CacheManager,
-        correlationId: string
+        correlationId: string,
+        additionalCacheKeyComponents?: Record<string, string>
     ): AccessTokenEntity | null {
         const accessTokenFilter: CredentialFilter = {
             homeAccountId: "",
@@ -221,7 +245,11 @@ export class ClientCredentialClient extends BaseClient {
             credentialType: Constants.CredentialType.ACCESS_TOKEN,
             clientId: id,
             realm: authority.tenant,
-            target: ScopeSet.createSearchScopes(scopeSet.asArray()),
+            target: ScopeSet.createSearchScopes(
+                scopeSet.asArray(),
+                correlationId
+            ),
+            additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
 
         const accessTokens = cacheManager.getAccessTokensByFilter(
@@ -232,7 +260,8 @@ export class ClientCredentialClient extends BaseClient {
             return null;
         } else if (accessTokens.length > 1) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.multipleMatchingTokens
+                ClientAuthErrorCodes.multipleMatchingTokens,
+                correlationId
             );
         }
         return accessTokens[0] as AccessTokenEntity;
@@ -246,7 +275,8 @@ export class ClientCredentialClient extends BaseClient {
     private async executeTokenRequest(
         request: CommonClientCredentialRequest,
         authority: Authority,
-        refreshAccessToken?: boolean
+        refreshAccessToken?: boolean,
+        additionalCacheKeyComponents?: Record<string, string>
     ): Promise<AuthenticationResult | null> {
         let serverTokenResponse: ServerAuthorizationTokenResponse;
         let reqTimestamp: number;
@@ -337,7 +367,13 @@ export class ClientCredentialClient extends BaseClient {
             this.authority,
             reqTimestamp,
             request,
-            ApiId.acquireTokenByClientCredential
+            ApiId.acquireTokenByClientCredential,
+            undefined, // authCodePayload
+            undefined, // userAssertionHash
+            undefined, // handlingRefreshTokenResponse
+            undefined, // forceCacheRefreshTokenResponse
+            undefined, // serverRequestId
+            additionalCacheKeyComponents
         );
 
         return tokenResponse;
@@ -357,7 +393,12 @@ export class ClientCredentialClient extends BaseClient {
             this.config.authOptions.clientId
         );
 
-        RequestParameterBuilder.addScopes(parameters, request.scopes, false);
+        RequestParameterBuilder.addScopes(
+            parameters,
+            request.scopes,
+            request.correlationId,
+            false
+        );
 
         RequestParameterBuilder.addGrantType(
             parameters,
@@ -405,7 +446,8 @@ export class ClientCredentialClient extends BaseClient {
                 await getClientAssertion(
                     clientAssertion.assertion,
                     this.config.authOptions.clientId,
-                    request.resourceRequestUri
+                    this.authority.tokenEndpoint,
+                    request.fmiPath
                 )
             );
             RequestParameterBuilder.addClientAssertionType(
@@ -414,6 +456,10 @@ export class ClientCredentialClient extends BaseClient {
             );
         }
 
+        if (request.fmiPath) {
+            parameters.set(AADServerParamKeys.FMI_PATH, request.fmiPath);
+        }
+
         if (
             !StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
@@ -421,6 +467,7 @@ export class ClientCredentialClient extends BaseClient {
         ) {
             RequestParameterBuilder.addClaims(
                 parameters,
+                request.correlationId,
                 request.claims,
                 this.config.authOptions.clientCapabilities
             );

package/node_modules/@azure/msal-node/src/client/ConfidentialClientApplication.ts

@@ -33,6 +33,9 @@ import { CommonClientCredentialRequest } from "../request/CommonClientCredential
 import { ClientCredentialRequest } from "../request/ClientCredentialRequest.js";
 import { ClientCredentialClient } from "./ClientCredentialClient.js";
 import { OnBehalfOfClient } from "./OnBehalfOfClient.js";
+import { UserFederatedIdentityCredentialClient } from "./UserFederatedIdentityCredentialClient.js";
+import { UserFederatedIdentityCredentialRequest } from "../request/UserFederatedIdentityCredentialRequest.js";
+import { CommonUserFederatedIdentityCredentialRequest } from "../request/CommonUserFederatedIdentityCredentialRequest.js";
 import * as NodeClientAuthErrorCodes from "../error/ClientAuthErrorCodes.js";
 
 /**
@@ -90,7 +93,8 @@ export class ConfidentialClientApplication
             (clientSecretNotEmpty && certificateNotEmpty)
         ) {
             throw createClientAuthError(
-                NodeClientAuthErrorCodes.invalidClientCredential
+                NodeClientAuthErrorCodes.invalidClientCredential,
+                ""
             );
         }
 
@@ -107,7 +111,8 @@ export class ConfidentialClientApplication
 
         if (!certificateNotEmpty) {
             throw createClientAuthError(
-                NodeClientAuthErrorCodes.invalidClientCredential
+                NodeClientAuthErrorCodes.invalidClientCredential,
+                ""
             );
         } else {
             this.clientAssertion = !!this.config.auth.clientCertificate
@@ -182,7 +187,10 @@ export class ConfidentialClientApplication
          * valid request should not have "common" or "organizations" in lieu of the tenant_id in the authority in the auth configuration
          * example authority: "https://login.microsoftonline.com/TenantId",
          */
-        const authority = new UrlString(validRequest.authority);
+        const authority = new UrlString(
+            validRequest.authority,
+            validRequest.correlationId
+        );
         const tenantId = authority.getUrlComponents().PathSegments[0];
         if (
             Object.values(Constants.AADAuthority).includes(
@@ -190,7 +198,8 @@ export class ConfidentialClientApplication
             )
         ) {
             throw createClientAuthError(
-                NodeClientAuthErrorCodes.missingTenantIdError
+                NodeClientAuthErrorCodes.missingTenantIdError,
+                validRequest.correlationId
             );
         }
 
@@ -245,7 +254,7 @@ export class ConfidentialClientApplication
             return await clientCredentialClient.acquireToken(validRequest);
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
             }
             serverTelemetryManager.cacheFailedRequest(e);
             throw e;
@@ -295,8 +304,101 @@ export class ConfidentialClientApplication
             return await oboClient.acquireToken(validRequest);
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(validRequest.correlationId);
+                e.correlationId = validRequest.correlationId;
+            }
+            throw e;
+        }
+    }
+
+    /**
+     * Acquires a user-scoped token using the user_fic grant type (Leg 3 of Agent Identity).
+     *
+     * Exchanges a federated identity credential (instance token from Leg 2) for a user-scoped token.
+     * Exactly one of `userObjectId` or `username` must be provided to identify the target user.
+     *
+     * This method always makes a network call. Use `acquireTokenSilent` to retrieve cached FIC tokens.
+     */
+    public async acquireTokenByUserFederatedIdentityCredential(
+        request: UserFederatedIdentityCredentialRequest
+    ): Promise<AuthenticationResult | null> {
+        this.logger.info(
+            "acquireTokenByUserFederatedIdentityCredential called",
+            request.correlationId || ""
+        );
+
+        // Validate that exactly one user identifier is provided
+        if (request.userObjectId && request.username) {
+            throw createClientAuthError(
+                NodeClientAuthErrorCodes.conflictingUserIdentifiers,
+                request.correlationId || ""
+            );
+        }
+        if (!request.userObjectId && !request.username) {
+            throw createClientAuthError(
+                NodeClientAuthErrorCodes.missingUserIdentifier,
+                request.correlationId || ""
+            );
+        }
+
+        // Validate that the assertion is not empty
+        if (!request.assertion) {
+            throw createClientAuthError(
+                NodeClientAuthErrorCodes.emptyFicAssertion,
+                request.correlationId || ""
+            );
+        }
+
+        // If there is a client assertion present in the request, resolve it
+        let clientAssertion: ClientAssertionType | undefined;
+        if (request.clientAssertion) {
+            clientAssertion = {
+                assertion: await getClientAssertion(
+                    request.clientAssertion,
+                    this.config.auth.clientId
+                ),
+                assertionType: NodeConstants.JWT_BEARER_ASSERTION_TYPE,
+            };
+        }
+
+        const baseRequest = await this.initializeBaseRequest(request);
+        const validRequest: CommonUserFederatedIdentityCredentialRequest = {
+            ...request,
+            ...baseRequest,
+            assertion: request.assertion,
+            clientAssertion,
+        } as CommonUserFederatedIdentityCredentialRequest;
+
+        const serverTelemetryManager = this.initializeServerTelemetryManager(
+            ApiId.acquireTokenByUserFederatedIdentityCredential,
+            validRequest.correlationId
+        );
+
+        try {
+            const discoveredAuthority = await this.createAuthority(
+                validRequest.authority,
+                validRequest.correlationId,
+                undefined,
+                request.azureCloudOptions
+            );
+            const clientConfig = await this.buildOauthClientConfiguration(
+                discoveredAuthority,
+                validRequest.correlationId,
+                "",
+                serverTelemetryManager
+            );
+            const ficClient = new UserFederatedIdentityCredentialClient(
+                clientConfig
+            );
+            this.logger.verbose(
+                "UserFederatedIdentityCredential client created",
+                validRequest.correlationId
+            );
+            return await ficClient.acquireToken(validRequest);
+        } catch (e) {
+            if (e instanceof AuthError) {
+                e.correlationId = validRequest.correlationId;
             }
+            serverTelemetryManager.cacheFailedRequest(e);
             throw e;
         }
     }

package/node_modules/@azure/msal-node/src/client/DeviceCodeClient.ts

@@ -177,7 +177,11 @@ export class DeviceCodeClient extends BaseClient {
     private createQueryString(request: CommonDeviceCodeRequest): string {
         const parameters = new Map<string, string>();
 
-        RequestParameterBuilder.addScopes(parameters, request.scopes);
+        RequestParameterBuilder.addScopes(
+            parameters,
+            request.scopes,
+            request.correlationId
+        );
         RequestParameterBuilder.addClientId(
             parameters,
             this.config.authOptions.clientId
@@ -197,6 +201,7 @@ export class DeviceCodeClient extends BaseClient {
         ) {
             RequestParameterBuilder.addClaims(
                 parameters,
+                request.correlationId,
                 request.claims,
                 this.config.authOptions.clientCapabilities
             );
@@ -208,21 +213,24 @@ export class DeviceCodeClient extends BaseClient {
     /**
      * Breaks the polling with specific conditions
      * @param deviceCodeExpirationTime - expiration time for the device code request
+     * @param correlationId - correlation id of the request
      * @param userSpecifiedTimeout - developer provided timeout, to be compared against deviceCodeExpirationTime
      * @param userSpecifiedCancelFlag - boolean indicating the developer would like to cancel the request
      */
     private continuePolling(
         deviceCodeExpirationTime: number,
+        correlationId: string,
         userSpecifiedTimeout?: number,
         userSpecifiedCancelFlag?: boolean
     ): boolean {
         if (userSpecifiedCancelFlag) {
             this.logger.error(
                 "Token request cancelled by setting DeviceCodeRequest.cancel = true",
-                ""
+                correlationId
             );
             throw createClientAuthError(
-                NodeClientAuthErrorCodes.deviceCodePollingCancelled
+                NodeClientAuthErrorCodes.deviceCodePollingCancelled,
+                correlationId
             );
         } else if (
             userSpecifiedTimeout &&
@@ -231,24 +239,26 @@ export class DeviceCodeClient extends BaseClient {
         ) {
             this.logger.error(
                 `User defined timeout for device code polling reached. The timeout was set for ${userSpecifiedTimeout}`,
-                ""
+                correlationId
             );
             throw createClientAuthError(
-                NodeClientAuthErrorCodes.userTimeoutReached
+                NodeClientAuthErrorCodes.userTimeoutReached,
+                correlationId
             );
         } else if (TimeUtils.nowSeconds() > deviceCodeExpirationTime) {
             if (userSpecifiedTimeout) {
                 this.logger.verbose(
                     `User specified timeout ignored as the device code has expired before the timeout elapsed. The user specified timeout was set for ${userSpecifiedTimeout}`,
-                    ""
+                    correlationId
                 );
             }
             this.logger.error(
                 `Device code expired. Expiration time of device code was ${deviceCodeExpirationTime}`,
-                ""
+                correlationId
             );
             throw createClientAuthError(
-                NodeClientAuthErrorCodes.deviceCodeExpired
+                NodeClientAuthErrorCodes.deviceCodeExpired,
+                correlationId
             );
         }
         return true;
@@ -289,6 +299,7 @@ export class DeviceCodeClient extends BaseClient {
         while (
             this.continuePolling(
                 deviceCodeExpirationTime,
+                request.correlationId,
                 userSpecifiedTimeout,
                 request.cancel
             )
@@ -328,6 +339,7 @@ export class DeviceCodeClient extends BaseClient {
                     );
                     throw createAuthError(
                         AuthErrorCodes.postRequestFailed,
+                        request.correlationId,
                         response.body.error
                     );
                 }
@@ -349,7 +361,8 @@ export class DeviceCodeClient extends BaseClient {
             request.correlationId
         );
         throw createClientAuthError(
-            NodeClientAuthErrorCodes.deviceCodeUnknownError
+            NodeClientAuthErrorCodes.deviceCodeUnknownError,
+            request.correlationId
         );
     }
 
@@ -364,7 +377,11 @@ export class DeviceCodeClient extends BaseClient {
     ): string {
         const parameters = new Map<string, string>();
 
-        RequestParameterBuilder.addScopes(parameters, request.scopes);
+        RequestParameterBuilder.addScopes(
+            parameters,
+            request.scopes,
+            request.correlationId
+        );
         RequestParameterBuilder.addClientId(
             parameters,
             this.config.authOptions.clientId
@@ -405,6 +422,7 @@ export class DeviceCodeClient extends BaseClient {
         ) {
             RequestParameterBuilder.addClaims(
                 parameters,
+                request.correlationId,
                 request.claims,
                 this.config.authOptions.clientCapabilities
             );

package/node_modules/@azure/msal-node/src/client/ManagedIdentityApplication.ts

@@ -135,7 +135,8 @@ export class ManagedIdentityApplication {
     ): Promise<AuthenticationResult> {
         if (!managedIdentityRequestParams.resource) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.urlEmptyError
+                ClientConfigurationErrorCodes.urlEmptyError,
+                ""
             );
         }
 

package/node_modules/@azure/msal-node/src/client/ManagedIdentityClient.ts

@@ -181,7 +181,8 @@ export class ManagedIdentityClient {
             );
         if (!source) {
             throw createManagedIdentityError(
-                ManagedIdentityErrorCodes.unableToCreateSource
+                ManagedIdentityErrorCodes.unableToCreateSource,
+                ""
             );
         }
         return source;