dsh-db-tool 1.9.0 → 1.9.2

package/vendor/sqlserver-driver.cjs

@@ -42,9 +42,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// node_modules/mssql/node_modules/ms/index.js
+// node_modules/ms/index.js
 var require_ms = __commonJS({
-  "node_modules/mssql/node_modules/ms/index.js"(exports2, module2) {
+  "node_modules/ms/index.js"(exports2, module2) {
     var s = 1e3;
     var m = s * 60;
     var h = m * 60;
@@ -2356,7 +2356,7 @@ var require_table = __commonJS({
       let cursor = -1;
       let buffer = "";
       let escaped = false;
-      const path2 = [];
+      const path3 = [];
       while (++cursor < length) {
         const char = name.charAt(cursor);
         if (char === "[") {
@@ -2375,7 +2375,7 @@ var require_table = __commonJS({
           if (escaped) {
             buffer += char;
           } else {
-            path2.push(buffer);
+            path3.push(buffer);
             buffer = "";
           }
         } else {
@@ -2383,26 +2383,26 @@ var require_table = __commonJS({
         }
       }
       if (buffer) {
-        path2.push(buffer);
+        path3.push(buffer);
       }
-      switch (path2.length) {
+      switch (path3.length) {
         case 1:
           return {
-            name: path2[0],
+            name: path3[0],
             schema: null,
             database: null
           };
         case 2:
           return {
-            name: path2[1],
-            schema: path2[0],
+            name: path3[1],
+            schema: path3[0],
             database: null
           };
         case 3:
           return {
-            name: path2[2],
-            schema: path2[1],
-            database: path2[0]
+            name: path3[2],
+            schema: path3[1],
+            database: path3[0]
           };
         default:
           throw new Error("Invalid table name.");
@@ -5783,7 +5783,7 @@ var require_constants = __commonJS({
       SDK_VERSION: () => SDK_VERSION
     });
     module2.exports = __toCommonJS2(constants_exports);
-    var SDK_VERSION = `4.13.3`;
+    var SDK_VERSION = `4.14.1`;
     var DeveloperSignOnClientId = "04b07795-8ddb-461a-bbee-02f9e1bf7b46";
     var DefaultTenantId = "common";
     var AzureAuthorityHosts2 = /* @__PURE__ */ ((AzureAuthorityHosts22) => {
@@ -5860,8 +5860,8 @@ var require_msalPlugins = __commonJS({
       }
     };
     var msalNodeFlowVSCodeCredentialControl = {
-      setVSCodeAuthRecordPath(path2) {
-        vsCodeAuthRecordPath = path2;
+      setVSCodeAuthRecordPath(path3) {
+        vsCodeAuthRecordPath = path3;
       },
       setVSCodeBroker(broker) {
         vsCodeBrokerInfo = {
@@ -6162,10 +6162,10 @@ var require_log = __commonJS({
     });
     module2.exports = __toCommonJS2(log_exports);
     var import_node_os2 = require("node:os");
-    var import_node_util6 = __toESM2(require("node:util"));
-    var import_node_process8 = __toESM2(require("node:process"));
+    var import_node_util7 = __toESM2(require("node:util"));
+    var import_node_process9 = __toESM2(require("node:process"));
     function log(message, ...args) {
-      import_node_process8.default.stderr.write(`${import_node_util6.default.format(message, ...args)}${import_node_os2.EOL}`);
+      import_node_process9.default.stderr.write(`${import_node_util7.default.format(message, ...args)}${import_node_os2.EOL}`);
     }
   }
 });
@@ -6213,17 +6213,17 @@ var require_env = __commonJS({
       isWebWorker: () => isWebWorker2
     });
     module2.exports = __toCommonJS2(env_exports);
-    var import_node_process8 = __toESM2(require("node:process"));
+    var import_node_process9 = __toESM2(require("node:process"));
     function getEnvironmentVariable(name) {
-      return import_node_process8.default.env[name];
+      return import_node_process9.default.env[name];
     }
     function emitNodeWarning(warning) {
-      import_node_process8.default.emitWarning(warning);
+      import_node_process9.default.emitWarning(warning);
     }
     var isBrowser2 = false;
     var isWebWorker2 = false;
-    var isDeno2 = typeof import_node_process8.default.versions.deno === "string" && import_node_process8.default.versions.deno.length > 0;
-    var isBun2 = typeof import_node_process8.default.versions.bun === "string" && import_node_process8.default.versions.bun.length > 0;
+    var isDeno2 = typeof import_node_process9.default.versions.deno === "string" && import_node_process9.default.versions.deno.length > 0;
+    var isBun2 = typeof import_node_process9.default.versions.bun === "string" && import_node_process9.default.versions.bun.length > 0;
     var isNodeLike2 = true;
     var isNodeRuntime2 = !isBun2 && !isDeno2;
     var isReactNative2 = false;
@@ -7922,126 +7922,10 @@ var require_TokenExpiredError = __commonJS({
   }
 });
 
-// node_modules/jsonwebtoken/node_modules/ms/index.js
-var require_ms2 = __commonJS({
-  "node_modules/jsonwebtoken/node_modules/ms/index.js"(exports2, module2) {
-    var s = 1e3;
-    var m = s * 60;
-    var h = m * 60;
-    var d = h * 24;
-    var w = d * 7;
-    var y = d * 365.25;
-    module2.exports = function(val, options) {
-      options = options || {};
-      var type = typeof val;
-      if (type === "string" && val.length > 0) {
-        return parse(val);
-      } else if (type === "number" && isFinite(val)) {
-        return options.long ? fmtLong(val) : fmtShort(val);
-      }
-      throw new Error(
-        "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
-      );
-    };
-    function parse(str) {
-      str = String(str);
-      if (str.length > 100) {
-        return;
-      }
-      var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
-        str
-      );
-      if (!match) {
-        return;
-      }
-      var n = parseFloat(match[1]);
-      var type = (match[2] || "ms").toLowerCase();
-      switch (type) {
-        case "years":
-        case "year":
-        case "yrs":
-        case "yr":
-        case "y":
-          return n * y;
-        case "weeks":
-        case "week":
-        case "w":
-          return n * w;
-        case "days":
-        case "day":
-        case "d":
-          return n * d;
-        case "hours":
-        case "hour":
-        case "hrs":
-        case "hr":
-        case "h":
-          return n * h;
-        case "minutes":
-        case "minute":
-        case "mins":
-        case "min":
-        case "m":
-          return n * m;
-        case "seconds":
-        case "second":
-        case "secs":
-        case "sec":
-        case "s":
-          return n * s;
-        case "milliseconds":
-        case "millisecond":
-        case "msecs":
-        case "msec":
-        case "ms":
-          return n;
-        default:
-          return void 0;
-      }
-    }
-    function fmtShort(ms) {
-      var msAbs = Math.abs(ms);
-      if (msAbs >= d) {
-        return Math.round(ms / d) + "d";
-      }
-      if (msAbs >= h) {
-        return Math.round(ms / h) + "h";
-      }
-      if (msAbs >= m) {
-        return Math.round(ms / m) + "m";
-      }
-      if (msAbs >= s) {
-        return Math.round(ms / s) + "s";
-      }
-      return ms + "ms";
-    }
-    function fmtLong(ms) {
-      var msAbs = Math.abs(ms);
-      if (msAbs >= d) {
-        return plural(ms, msAbs, d, "day");
-      }
-      if (msAbs >= h) {
-        return plural(ms, msAbs, h, "hour");
-      }
-      if (msAbs >= m) {
-        return plural(ms, msAbs, m, "minute");
-      }
-      if (msAbs >= s) {
-        return plural(ms, msAbs, s, "second");
-      }
-      return ms + " ms";
-    }
-    function plural(ms, msAbs, n, name) {
-      var isPlural = msAbs >= n * 1.5;
-      return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
-    }
-  }
-});
-
 // node_modules/jsonwebtoken/lib/timespan.js
 var require_timespan = __commonJS({
   "node_modules/jsonwebtoken/lib/timespan.js"(exports2, module2) {
-    var ms = require_ms2();
+    var ms = require_ms();
     module2.exports = function(time, iat) {
       var timestamp = iat || Math.floor(Date.now() / 1e3);
       if (typeof time === "string") {
@@ -11015,7 +10899,7 @@ var require_msal_node = __commonJS({
     var jwt = require_jsonwebtoken();
     var http = require("http");
     var fs6 = require("fs");
-    var path2 = require("path");
+    var path3 = require("path");
     var Serializer = class {
       /**
        * serialize the JSON blob
@@ -11201,6 +11085,7 @@ var require_msal_node = __commonJS({
     var USER_ID = "user_id";
     var FMI_PATH = "fmi_path";
     var ATTRIBUTE_TOKENS = "attribute_tokens";
+    var POPUP_ORIGIN_CHECK_DONE = "pocd";
     var SKU = "msal.js.common";
     var DEFAULT_AUTHORITY = "https://login.microsoftonline.com/common/";
     var DEFAULT_AUTHORITY_HOST = "login.microsoftonline.com";
@@ -11232,7 +11117,6 @@ var require_msal_node = __commonJS({
     ];
     var INVALID_INSTANCE = "invalid_instance";
     var HTTP_SUCCESS = 200;
-    var HTTP_REDIRECT = 302;
     var HTTP_CLIENT_ERROR_RANGE_START = 400;
     var HTTP_BAD_REQUEST = 400;
     var HTTP_UNAUTHORIZED = 401;
@@ -11389,7 +11273,7 @@ var require_msal_node = __commonJS({
     function getDefaultErrorMessage(code) {
       return `See https://aka.ms/msal.js.errors#${code} for details`;
     }
-    var AuthError = class _AuthError extends Error {
+    var AuthError2 = class _AuthError extends Error {
       constructor(errorCode, correlationId, errorMessage, suberror) {
         const message = errorMessage || (errorCode ? getDefaultErrorMessage(errorCode) : "");
         const errorString = message ? `${errorCode}: ${message}` : errorCode;
@@ -11403,9 +11287,9 @@ var require_msal_node = __commonJS({
       }
     };
     function createAuthError(code, correlationId, additionalMessage) {
-      return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage(code));
+      return new AuthError2(code, correlationId, additionalMessage || getDefaultErrorMessage(code));
     }
-    var ClientAuthError = class _ClientAuthError extends AuthError {
+    var ClientAuthError = class _ClientAuthError extends AuthError2 {
       constructor(errorCode, correlationId, additionalMessage) {
         super(errorCode, correlationId, additionalMessage);
         this.name = "ClientAuthError";
@@ -11720,7 +11604,7 @@ var require_msal_node = __commonJS({
       postRequestFailed,
       unexpectedError
     });
-    var ClientConfigurationError = class _ClientConfigurationError extends AuthError {
+    var ClientConfigurationError = class _ClientConfigurationError extends AuthError2 {
       constructor(errorCode, correlationId) {
         super(errorCode, correlationId);
         this.name = "ClientConfigurationError";
@@ -11730,6 +11614,29 @@ var require_msal_node = __commonJS({
     function createClientConfigurationError(errorCode, correlationId) {
       return new ClientConfigurationError(errorCode, correlationId);
     }
+    var normalizedHeaderRecords = /* @__PURE__ */ new WeakSet();
+    function normalizeResponseHeaders(headers) {
+      if (normalizedHeaderRecords.has(headers)) {
+        return headers;
+      }
+      const normalized = Object.fromEntries(Object.entries(headers).map(([name2, value]) => [
+        name2.toLowerCase(),
+        value
+      ]));
+      normalizedHeaderRecords.add(normalized);
+      return normalized;
+    }
+    function getResponseHeader(headers, name2) {
+      const key = name2.toLowerCase();
+      if (Object.prototype.hasOwnProperty.call(headers, key)) {
+        return headers[key];
+      }
+      if (normalizedHeaderRecords.has(headers)) {
+        return void 0;
+      }
+      const headerName = Object.keys(headers).find((header) => header.toLowerCase() === key);
+      return headerName === void 0 ? void 0 : headers[headerName];
+    }
     var redirectUriEmpty = "redirect_uri_empty";
     var claimsRequestParsingError = "claims_request_parsing_error";
     var authorityUriInsecure = "authority_uri_insecure";
@@ -12996,7 +12903,7 @@ var require_msal_node = __commonJS({
           this.logger.verbose("Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request.", this.correlationId);
           match = getCloudDiscoveryMetadataFromNetworkResponse(metadata, this.hostnameAndPort);
         } catch (error) {
-          if (error instanceof AuthError) {
+          if (error instanceof AuthError2) {
             this.logger.error(`There was a network error while attempting to get the cloud discovery instance metadata.
 Error: '${error.errorCode}'
 Error Description: '${error.errorMessage}'`, this.correlationId);
@@ -13601,6 +13508,11 @@ Error Description: '${typedError.message}'`, this.correlationId);
         parameters.set(INSTANCE_AWARE, "true");
       }
     }
+    function addPopupOriginCheckDone(parameters) {
+      if (!parameters.has(POPUP_ORIGIN_CHECK_DONE)) {
+        parameters.set(POPUP_ORIGIN_CHECK_DONE, "1");
+      }
+    }
     function addExtraParameters(parameters, extraParams) {
       Object.entries(extraParams).forEach(([key, value]) => {
         if (!parameters.has(key) && value) {
@@ -13729,6 +13641,9 @@ Error Description: '${typedError.message}'`, this.correlationId);
       }
       try {
         const normalizedResponse = stripLeadingHashOrQuery(responseString);
+        if (!/^[^=&?#/]+(?:=|&|$)/.test(normalizedResponse)) {
+          return null;
+        }
         const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
         if (deserializedHash.code || deserializedHash.ear_jwe || deserializedHash.error || deserializedHash.error_description || deserializedHash.state) {
           return deserializedHash;
@@ -13790,12 +13705,12 @@ Error Description: '${typedError.message}'`, this.correlationId);
       }
     };
     exports2.LogLevel = void 0;
-    (function(LogLevel) {
-      LogLevel[LogLevel["Error"] = 0] = "Error";
-      LogLevel[LogLevel["Warning"] = 1] = "Warning";
-      LogLevel[LogLevel["Info"] = 2] = "Info";
-      LogLevel[LogLevel["Verbose"] = 3] = "Verbose";
-      LogLevel[LogLevel["Trace"] = 4] = "Trace";
+    (function(LogLevel2) {
+      LogLevel2[LogLevel2["Error"] = 0] = "Error";
+      LogLevel2[LogLevel2["Warning"] = 1] = "Warning";
+      LogLevel2[LogLevel2["Info"] = 2] = "Info";
+      LogLevel2[LogLevel2["Verbose"] = 3] = "Verbose";
+      LogLevel2[LogLevel2["Trace"] = 4] = "Trace";
     })(exports2.LogLevel || (exports2.LogLevel = {}));
     var CACHE_CAPACITY = 50;
     var MAX_LOGS_PER_CORRELATION = 500;
@@ -14014,7 +13929,7 @@ Error Description: '${typedError.message}'`, this.correlationId);
       }
     };
     var name$1 = "@azure/msal-common";
-    var version$1 = "16.14.1";
+    var version$1 = "16.15.0";
     var cacheQuotaExceeded = "cache_quota_exceeded";
     var cacheErrorUnknown = "cache_error_unknown";
     var CacheError = class _CacheError extends Error {
@@ -14214,7 +14129,7 @@ Error Description: '${typedError.message}'`, this.correlationId);
           }
         } catch (e) {
           this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`, correlationId);
-          if (e instanceof AuthError) {
+          if (e instanceof AuthError2) {
             throw e;
           } else {
             throw createCacheError(e);
@@ -15224,7 +15139,7 @@ Error Description: '${typedError.message}'`, this.correlationId);
         return this.cache;
       }
     };
-    var JoseHeaderError = class _JoseHeaderError extends AuthError {
+    var JoseHeaderError = class _JoseHeaderError extends AuthError2 {
       constructor(errorCode, correlationId, errorMessage) {
         super(errorCode, correlationId, errorMessage);
         this.name = "JoseHeaderError";
@@ -15550,7 +15465,7 @@ Error Description: '${typedError.message}'`, this.correlationId);
       "ui_not_allowed",
       "interrupted_user"
     ];
-    var InteractionRequiredAuthError = class _InteractionRequiredAuthError extends AuthError {
+    var InteractionRequiredAuthError = class _InteractionRequiredAuthError extends AuthError2 {
       constructor(errorCode, correlationId, errorMessage, subError, timestamp, traceId, claims, errorNo) {
         super(errorCode, correlationId, errorMessage, subError);
         Object.setPrototypeOf(this, _InteractionRequiredAuthError.prototype);
@@ -15572,7 +15487,7 @@ Error Description: '${typedError.message}'`, this.correlationId);
     function createInteractionRequiredAuthError(errorCode, correlationId, errorMessage) {
       return new InteractionRequiredAuthError(errorCode, correlationId, errorMessage);
     }
-    var ServerError = class _ServerError extends AuthError {
+    var ServerError = class _ServerError extends AuthError2 {
       constructor(errorCode, correlationId, errorMessage, subError, errorNo, status) {
         super(errorCode, correlationId, errorMessage, subError);
         this.name = "ServerError";
@@ -15985,12 +15900,13 @@ ${serverError}`, correlationId);
        * Performs necessary throttling checks after a network request.
        * @param cacheManager
        * @param thumbprint
-       * @param response
+       * @param response - Token response with case-insensitive header names.
        */
       static postProcess(cacheManager, thumbprint, response, correlationId) {
-        if (_ThrottlingUtils.checkResponseStatus(response) || _ThrottlingUtils.checkResponseForRetryAfter(response)) {
+        const retryAfter = getRetryAfterHeader(response);
+        if (_ThrottlingUtils.checkResponseStatus(response) || retryAfter !== void 0) {
           const thumbprintValue = {
-            throttleTime: _ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
+            throttleTime: _ThrottlingUtils.calculateThrottleTime(parseInt(retryAfter || "")),
             error: response.body.error,
             errorCodes: response.body.error_codes,
             errorMessage: response.body.error_description,
@@ -16008,13 +15924,10 @@ ${serverError}`, correlationId);
       }
       /**
        * Checks a NetworkResponse object's RetryAfter header
-       * @param response
+       * @param response - Token response with case-insensitive header names.
        */
       static checkResponseForRetryAfter(response) {
-        if (response.headers) {
-          return response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) && (response.status < 200 || response.status >= 300);
-        }
-        return false;
+        return getRetryAfterHeader(response) !== void 0;
       }
       /**
        * Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
@@ -16031,7 +15944,13 @@ ${serverError}`, correlationId);
         cacheManager.removeItem(key, request.correlationId);
       }
     };
-    var NetworkError = class _NetworkError extends AuthError {
+    function getRetryAfterHeader(response) {
+      if ((response.status < 200 || response.status >= 300) && response.headers) {
+        return getResponseHeader(response.headers, HeaderNames.RETRY_AFTER);
+      }
+      return void 0;
+    }
+    var NetworkError = class _NetworkError extends AuthError2 {
       constructor(error, httpStatus, responseHeaders) {
         super(error.errorCode, error.correlationId, error.errorMessage, error.subError);
         Object.setPrototypeOf(this, _NetworkError.prototype);
@@ -16102,7 +16021,8 @@ ${serverError}`, correlationId);
       let response;
       try {
         response = await invokeAsync(networkClient.sendPostRequestAsync.bind(networkClient), NetworkClientSendPostRequestAsync, logger2, performanceClient, correlationId)(tokenEndpoint, { ...options, correlationId, performanceClient });
-        const responseHeaders = response.headers || {};
+        const responseHeaders = normalizeResponseHeaders(response.headers || {});
+        response = { ...response, headers: responseHeaders };
         performanceClient?.addFields({
           refreshTokenSize: response.body.refresh_token?.length || 0,
           httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
@@ -16110,19 +16030,19 @@ ${serverError}`, correlationId);
         }, correlationId);
       } catch (e) {
         if (e instanceof NetworkError) {
-          const responseHeaders = e.responseHeaders;
+          const responseHeaders = e.responseHeaders ? normalizeResponseHeaders(e.responseHeaders) : void 0;
           if (responseHeaders) {
             performanceClient?.addFields({
               httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
               requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
-              contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] || void 0,
-              contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] || void 0,
+              contentTypeHeader: getResponseHeader(responseHeaders, HeaderNames.CONTENT_TYPE) || void 0,
+              contentLengthHeader: getResponseHeader(responseHeaders, HeaderNames.CONTENT_LENGTH) || void 0,
               httpStatus: e.httpStatus
             }, correlationId);
           }
           throw e.error;
         }
-        if (e instanceof AuthError) {
+        if (e instanceof AuthError2) {
           throw e;
         } else {
           throw createClientAuthError(networkError, correlationId);
@@ -16325,6 +16245,9 @@ ${serverError}`, correlationId);
         if (request.logoutHint) {
           addLogoutHint(parameters, request.logoutHint);
         }
+        if (request.popupOriginCheckDone) {
+          addPopupOriginCheckDone(parameters);
+        }
         if (request.extraQueryParameters) {
           addExtraParameters(parameters, request.extraQueryParameters);
         }
@@ -16429,6 +16352,9 @@ ${serverError}`, correlationId);
       if (authOptions.instanceAware && (!request.extraQueryParameters || !Object.keys(request.extraQueryParameters).includes(INSTANCE_AWARE))) {
         addInstanceAware(parameters);
       }
+      if (request.popupOriginCheckDone) {
+        addPopupOriginCheckDone(parameters);
+      }
       return parameters;
     }
     function getAuthorizeUrl(authority, requestParameters) {
@@ -16558,6 +16484,7 @@ ${serverError}`, correlationId);
           addRedirectUri(parameters, request.redirectUri);
         }
         addScopes(parameters, request.scopes, request.correlationId, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addResource(parameters, request.resource);
         addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
         addClientInfo(parameters);
         addLibraryInfo(parameters, this.config.libraryInfo);
@@ -16727,7 +16654,7 @@ ${serverError}`, correlationId);
           }
           lastRequests.failedRequests.push(this.apiId, this.correlationId);
           if (error instanceof Error && !!error && error.toString()) {
-            if (error instanceof AuthError) {
+            if (error instanceof AuthError2) {
               if (error.subError) {
                 lastRequests.errors.push(error.subError);
               } else if (error.errorCode) {
@@ -17382,7 +17309,7 @@ ${serverError}`, correlationId);
       [wwwAuthenticateHeaderMissing]: "A 401 response was received from the Azure Arc Managed Identity, but the www-authenticate header is missing.",
       [wwwAuthenticateHeaderUnsupportedFormat]: "A 401 response was received from the Azure Arc Managed Identity, but the www-authenticate header is in an unsupported format."
     };
-    var ManagedIdentityError = class _ManagedIdentityError extends AuthError {
+    var ManagedIdentityError = class _ManagedIdentityError extends AuthError2 {
       constructor(errorCode, correlationId) {
         super(errorCode, correlationId, ManagedIdentityErrorMessages[errorCode]);
         this.name = "ManagedIdentityError";
@@ -17458,6 +17385,10 @@ ${serverError}`, correlationId);
         code: "loopback_server_timeout",
         desc: "Timed out waiting for auth code listener to be registered."
       },
+      loopbackServerQueryResponseNotSupported: {
+        code: "loopback_server_query_response_not_supported",
+        desc: "The loopback server received an OAuth response in the URL. Interactive authentication requires form_post."
+      },
       stateNotFoundError: {
         code: "state_not_found",
         desc: "State not found. Please verify that the request originated from msal."
@@ -17469,9 +17400,13 @@ ${serverError}`, correlationId);
       redirectUriNotSupported: {
         code: "redirect_uri_not_supported",
         desc: "RedirectUri is not supported in this scenario. Please remove redirectUri from the request."
+      },
+      unsupportedCcaInstanceAware: {
+        code: "unsupported_cca_instance_aware",
+        desc: "Instance-aware configuration is not supported by ConfidentialClientApplication."
       }
     };
-    var NodeAuthError = class _NodeAuthError extends AuthError {
+    var NodeAuthError = class _NodeAuthError extends AuthError2 {
       constructor(errorCode, correlationId, errorMessage) {
         super(errorCode, correlationId, errorMessage);
         this.name = "NodeAuthError";
@@ -17512,6 +17447,12 @@ ${serverError}`, correlationId);
       static createLoopbackServerTimeoutError(correlationId = "") {
         return new _NodeAuthError(NodeAuthErrorMessage.loopbackServerTimeout.code, correlationId, `${NodeAuthErrorMessage.loopbackServerTimeout.desc}`);
       }
+      /**
+       * Creates an error thrown if the loopback server receives an OAuth response in a query string.
+       */
+      static createLoopbackServerQueryResponseNotSupportedError() {
+        return new _NodeAuthError(NodeAuthErrorMessage.loopbackServerQueryResponseNotSupported.code, "", NodeAuthErrorMessage.loopbackServerQueryResponseNotSupported.desc);
+      }
       /**
        * Creates an error thrown when the state is not present.
        */
@@ -17530,6 +17471,12 @@ ${serverError}`, correlationId);
       static createRedirectUriNotSupportedError(correlationId = "") {
         return new _NodeAuthError(NodeAuthErrorMessage.redirectUriNotSupported.code, correlationId, NodeAuthErrorMessage.redirectUriNotSupported.desc);
       }
+      /**
+       * Creates an error thrown when instance-aware behavior is requested for a confidential client.
+       */
+      static createUnsupportedCcaInstanceAwareError(correlationId = "") {
+        return new _NodeAuthError(NodeAuthErrorMessage.unsupportedCcaInstanceAware.code, correlationId, NodeAuthErrorMessage.unsupportedCcaInstanceAware.desc);
+      }
     };
     var DEFAULT_AUTH_OPTIONS = {
       clientId: "",
@@ -18593,7 +18540,7 @@ ${serverError}`, correlationId);
       }
     };
     var name = "@azure/msal-node";
-    var version = "6.0.1";
+    var version = "7.1.2";
     var BaseClient = class {
       constructor(configuration) {
         this.config = buildClientConfiguration(configuration);
@@ -18743,6 +18690,87 @@ ${serverError}`, correlationId);
       addExtraParameters(parameters, request.extraQueryParameters || {});
       return getAuthorizeUrl(authority, parameters);
     }
+    var activeSilentTokenRequests = /* @__PURE__ */ new WeakMap();
+    function acquireTokenSilentDeduped(owner, logger2, silentRequestKey, correlationId, acquireToken) {
+      const existingRequests = activeSilentTokenRequests.get(owner);
+      const activeRequests = existingRequests || /* @__PURE__ */ new Map();
+      if (!existingRequests) {
+        activeSilentTokenRequests.set(owner, activeRequests);
+      }
+      const inProgressRequest = activeRequests.get(silentRequestKey);
+      if (inProgressRequest) {
+        logger2.verbose("acquireTokenSilent has been called previously, returning the result from the first call", correlationId);
+        return applyCallerCorrelationIdToResult(inProgressRequest, correlationId);
+      }
+      logger2.verbose("acquireTokenSilent called for the first time, storing active request", correlationId);
+      const activeRequest = Promise.resolve().then(acquireToken).finally(() => {
+        activeRequests.delete(silentRequestKey);
+        if (activeRequests.size === 0) {
+          activeSilentTokenRequests.delete(owner);
+        }
+      });
+      activeRequests.set(silentRequestKey, activeRequest);
+      return applyCallerCorrelationIdToResult(activeRequest, correlationId);
+    }
+    function getSilentRequestKey(input) {
+      const { request } = input;
+      const authority = input.requestType === "native" ? request.authority : input.authority;
+      const commonKeyFields = {
+        requestType: input.requestType,
+        clientId: input.requestType === "native" ? input.request.clientId : input.clientId,
+        authority,
+        scopes: canonicalizeRequestValues(request.scopes),
+        claims: request.claims,
+        authenticationScheme: request.authenticationScheme,
+        resourceRequestMethod: request.resourceRequestMethod,
+        resourceRequestUri: request.resourceRequestUri,
+        forceRefresh: request.forceRefresh,
+        redirectUri: request.redirectUri || "",
+        resource: request.resource,
+        extraParameters: canonicalizeRequestValues(request.extraParameters)
+      };
+      if (input.requestType === "native") {
+        return JSON.stringify({
+          ...commonKeyFields,
+          accountId: input.request.accountId,
+          shrNonce: input.request.shrNonce,
+          extraScopesToConsent: canonicalizeRequestValues(input.request.extraScopesToConsent),
+          loginHint: input.request.loginHint,
+          prompt: input.request.prompt
+        });
+      }
+      const nonNativeRequest = input.request;
+      const thumbprint = getRequestThumbprint(input.clientId, { ...nonNativeRequest, authority }, nonNativeRequest.account.homeAccountId);
+      return JSON.stringify({
+        ...thumbprint,
+        ...commonKeyFields,
+        accountTenantId: nonNativeRequest.account.tenantId,
+        accountEnvironment: nonNativeRequest.account.environment,
+        refreshTokenExpirationOffsetSeconds: nonNativeRequest.refreshTokenExpirationOffsetSeconds,
+        extraQueryParameters: canonicalizeRequestValues(nonNativeRequest.extraQueryParameters),
+        skipBrokerClaims: thumbprint.embeddedClientId || nonNativeRequest.extraParameters?.[BROKER_CLIENT_ID] ? nonNativeRequest.skipBrokerClaims : void 0
+      });
+    }
+    function snapshotNativeRequest(request) {
+      return {
+        ...request,
+        scopes: [...request.scopes],
+        extraParameters: request.extraParameters ? { ...request.extraParameters } : void 0,
+        extraScopesToConsent: request.extraScopesToConsent ? [...request.extraScopesToConsent] : void 0
+      };
+    }
+    function canonicalizeRequestValues(values) {
+      if (Array.isArray(values)) {
+        return Array.from(new Set(values.map((scope) => scope.trim()).filter((scope) => scope.length > 0))).sort();
+      }
+      return values ? Object.keys(values).sort().map((key) => [key, values[key]]) : void 0;
+    }
+    function applyCallerCorrelationIdToResult(activeRequest, correlationId) {
+      return activeRequest.then((result) => ({
+        ...result,
+        correlationId
+      }));
+    }
     var ClientApplication = class {
       /**
        * Constructor for the ClientApplication
@@ -18814,7 +18842,7 @@ ${serverError}`, correlationId);
           this.logger.verbose("Auth code client created", validRequest.correlationId);
           return await authorizationCodeClient.acquireToken(validRequest, ApiId.acquireTokenByCode, validatedAuthCodePayload);
         } catch (e) {
-          if (e instanceof AuthError) {
+          if (e instanceof AuthError2) {
             e.correlationId = validRequest.correlationId;
           }
           serverTelemetryManager.cacheFailedRequest(e);
@@ -18843,7 +18871,7 @@ ${serverError}`, correlationId);
           this.logger.verbose("Refresh token client created", validRequest.correlationId);
           return await refreshTokenClient.acquireToken(validRequest, ApiId.acquireTokenByRefreshToken);
         } catch (e) {
-          if (e instanceof AuthError) {
+          if (e instanceof AuthError2) {
             e.correlationId = validRequest.correlationId;
           }
           serverTelemetryManager.cacheFailedRequest(e);
@@ -18855,6 +18883,7 @@ ${serverError}`, correlationId);
        *
        * This API expects the user to provide an account object and looks into the cache to retrieve the token if present.
        * There is also an optional "forceRefresh" boolean the user can send to bypass the cache for access_token and id_token.
+       * Concurrent requests with the same request thumbprint return the same in-progress result.
        * In case the refresh_token is expired or not found, an error is thrown
        * and the guidance is for the user to call any interactive token acquisition API (eg: `acquireTokenByCode()`).
        */
@@ -18864,9 +18893,22 @@ ${serverError}`, correlationId);
           ...await this.initializeBaseRequest(request),
           forceRefresh: request.forceRefresh || false
         };
+        if (!validRequest.account) {
+          return this.acquireTokenSilentAsync(validRequest, request.azureCloudOptions);
+        }
+        const authorityForThumbprint = Authority.generateAuthority(validRequest.authority, request.azureCloudOptions || this.config.auth.azureCloudOptions);
+        const silentRequestKey = getSilentRequestKey({
+          requestType: "non-native",
+          request: validRequest,
+          authority: authorityForThumbprint,
+          clientId: this.config.auth.clientId
+        });
+        return acquireTokenSilentDeduped(this, this.logger, silentRequestKey, validRequest.correlationId, () => this.acquireTokenSilentAsync(validRequest, request.azureCloudOptions));
+      }
+      async acquireTokenSilentAsync(validRequest, azureCloudOptions) {
         const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenSilent, validRequest.correlationId, validRequest.forceRefresh);
         try {
-          const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, void 0, request.azureCloudOptions);
+          const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, void 0, azureCloudOptions);
           const clientConfiguration = await this.buildOauthClientConfiguration(discoveredAuthority, validRequest.correlationId, validRequest.redirectUri || "", serverTelemetryManager);
           const silentFlowClient = new SilentFlowClient(clientConfiguration, new StubPerformanceClient());
           this.logger.verbose("Silent flow client created", validRequest.correlationId);
@@ -18881,7 +18923,7 @@ ${serverError}`, correlationId);
             throw error;
           }
         } catch (error) {
-          if (error instanceof AuthError) {
+          if (error instanceof AuthError2) {
             error.correlationId = validRequest.correlationId;
           }
           serverTelemetryManager.cacheFailedRequest(error);
@@ -18928,7 +18970,7 @@ ${serverError}`, correlationId);
           this.logger.verbose("Username password client created", validRequest.correlationId);
           return await usernamePasswordClient.acquireToken(validRequest);
         } catch (e) {
-          if (e instanceof AuthError) {
+          if (e instanceof AuthError2) {
             e.correlationId = validRequest.correlationId;
           }
           serverTelemetryManager.cacheFailedRequest(e);
@@ -19130,16 +19172,9 @@ ${serverError}`, correlationId);
                 res.end();
                 return;
               }
-              if (authCodeResponse.code) {
-                res.writeHead(HTTP_REDIRECT, {
-                  location: redirectUri
-                });
-                res.end();
-              }
-              if (authCodeResponse.error) {
-                res.end(errorTemplate || `Error occurred: ${authCodeResponse.error}`);
-              }
-              resolve(authCodeResponse);
+              res.writeHead(400);
+              res.end("OAuth responses must use form_post and cannot be returned in the URL.");
+              reject(NodeAuthError.createLoopbackServerQueryResponseNotSupportedError());
             } else {
               res.writeHead(200);
               res.end();
@@ -19457,7 +19492,7 @@ ${serverError}`, correlationId);
           this.logger.verbose("Device code client created", validRequest.correlationId);
           return await deviceCodeClient.acquireToken(validRequest);
         } catch (e) {
-          if (e instanceof AuthError) {
+          if (e instanceof AuthError2) {
             e.correlationId = validRequest.correlationId;
           }
           serverTelemetryManager.cacheFailedRequest(e);
@@ -19497,8 +19532,8 @@ ${serverError}`, correlationId);
         }
         const { verifier, challenge } = await this.cryptoProvider.generatePkceCodes();
         const loopbackClient = new LoopbackClient(preferredPort);
-        const responseMode = remainingProperties.responseMode ?? ResponseMode$1.FORM_POST;
-        if (responseMode !== ResponseMode$1.QUERY && responseMode !== ResponseMode$1.FORM_POST) {
+        const responseMode = remainingProperties.responseMode;
+        if (responseMode !== void 0 && responseMode !== ResponseMode$1.FORM_POST) {
           throw createClientConfigurationError(invalidResponseMode, correlationId);
         }
         let authCodeResponse = {};
@@ -19515,7 +19550,7 @@ ${serverError}`, correlationId);
             correlationId,
             scopes: request.scopes || OIDC_DEFAULT_SCOPES,
             redirectUri,
-            responseMode,
+            responseMode: ResponseMode$1.FORM_POST,
             codeChallenge: challenge,
             codeChallengeMethod: CodeChallengeMethodValues.S256
           };
@@ -19552,7 +19587,8 @@ ${serverError}`, correlationId);
         this.logger.trace("acquireTokenSilent called", correlationId);
         enforceResourceParameter(this.config.auth.isMcp, request);
         if (this.nativeBrokerPlugin) {
-          const brokerRequest = {
+          const nativeBrokerPlugin = this.nativeBrokerPlugin;
+          const brokerRequest = snapshotNativeRequest({
             ...request,
             clientId: this.config.auth.clientId,
             scopes: request.scopes || OIDC_DEFAULT_SCOPES,
@@ -19566,8 +19602,12 @@ ${serverError}`, correlationId);
             },
             accountId: request.account.nativeAccountId,
             forceRefresh: request.forceRefresh || false
-          };
-          return this.nativeBrokerPlugin.acquireTokenSilent(brokerRequest);
+          });
+          const silentRequestKey = getSilentRequestKey({
+            requestType: "native",
+            request: brokerRequest
+          });
+          return acquireTokenSilentDeduped(this, this.logger, silentRequestKey, correlationId, () => nativeBrokerPlugin.acquireTokenSilent(brokerRequest));
         }
         if (request.redirectUri) {
           if (!this.config.broker.nativeBrokerPlugin) {
@@ -19641,7 +19681,7 @@ ${serverError}`, correlationId);
               resolve(r);
               return;
             } catch (e) {
-              if (e instanceof AuthError && e.errorCode === NodeAuthErrorMessage.noLoopbackServerExists.code) {
+              if (e instanceof AuthError2 && e.errorCode === NodeAuthErrorMessage.noLoopbackServerExists.code) {
                 ticks++;
                 return;
               }
@@ -20164,6 +20204,9 @@ ${serverError}`, correlationId);
        * @param Configuration - configuration object for the MSAL ConfidentialClientApplication instance
        */
       constructor(configuration) {
+        if ("instanceAware" in configuration.auth && configuration.auth.instanceAware === true) {
+          throw NodeAuthError.createUnsupportedCcaInstanceAwareError();
+        }
         super(configuration);
         const clientSecretNotEmpty = !!this.config.auth.clientSecret;
         const clientAssertionNotEmpty = !!this.config.auth.clientAssertion;
@@ -20194,6 +20237,26 @@ ${serverError}`, correlationId);
         }
         this.appTokenProvider = void 0;
       }
+      /**
+       * Creates the URL of the authorization request.
+       */
+      async getAuthCodeUrl(request) {
+        if (request.extraQueryParameters && Object.prototype.hasOwnProperty.call(request.extraQueryParameters, "instance_aware")) {
+          throw NodeAuthError.createUnsupportedCcaInstanceAwareError(request.correlationId);
+        }
+        return super.getAuthCodeUrl(request);
+      }
+      /**
+       * Acquires a token by exchanging an authorization code.
+       */
+      async acquireTokenByCode(request, authCodePayload) {
+        const sanitizedAuthCodePayload = authCodePayload ? {
+          code: request.code,
+          state: authCodePayload.state,
+          nonce: request.nonce
+        } : void 0;
+        return super.acquireTokenByCode(request, sanitizedAuthCodePayload);
+      }
       /**
        * This extensibility point only works for the client_credential flow, i.e. acquireTokenByClientCredential and
        * is meant for Azure SDK to enhance Managed Identity support.
@@ -20255,7 +20318,7 @@ ${serverError}`, correlationId);
           this.logger.verbose("Client credential client created", validRequest.correlationId);
           return await clientCredentialClient.acquireToken(validRequest);
         } catch (e) {
-          if (e instanceof AuthError) {
+          if (e instanceof AuthError2) {
             e.correlationId = validRequest.correlationId;
           }
           serverTelemetryManager.cacheFailedRequest(e);
@@ -20286,7 +20349,7 @@ ${serverError}`, correlationId);
           this.logger.verbose("On behalf of client created", validRequest.correlationId);
           return await oboClient.acquireToken(validRequest);
         } catch (e) {
-          if (e instanceof AuthError) {
+          if (e instanceof AuthError2) {
             e.correlationId = validRequest.correlationId;
           }
           throw e;
@@ -20333,7 +20396,7 @@ ${serverError}`, correlationId);
           this.logger.verbose("UserFederatedIdentityCredential client created", validRequest.correlationId);
           return await ficClient.acquireToken(validRequest);
         } catch (e) {
-          if (e instanceof AuthError) {
+          if (e instanceof AuthError2) {
             e.correlationId = validRequest.correlationId;
           }
           serverTelemetryManager.cacheFailedRequest(e);
@@ -20507,7 +20570,7 @@ ${serverError}`, correlationId);
             response = await networkClientHelper.sendGetRequestAsync(networkRequest.computeUri(), networkRequestOptions);
           }
         } catch (error) {
-          if (error instanceof AuthError) {
+          if (error instanceof AuthError2) {
             throw error;
           } else {
             throw createClientAuthError(networkError, managedIdentityRequest.correlationId);
@@ -20898,7 +20961,7 @@ ${serverError}`, correlationId);
             throw createManagedIdentityError(platformNotSupported, "");
           }
           const expectedSecretFilePath = SUPPORTED_AZURE_ARC_PLATFORMS[process.platform];
-          const fileName = path2.basename(secretFilePath);
+          const fileName = path3.basename(secretFilePath);
           if (!fileName.endsWith(".key")) {
             throw createManagedIdentityError(invalidFileExtension, "");
           }
@@ -20926,7 +20989,7 @@ ${serverError}`, correlationId);
           try {
             retryResponse = await networkClient.sendGetRequestAsync(networkRequest.computeUri(), networkRequestOptions);
           } catch (error) {
-            if (error instanceof AuthError) {
+            if (error instanceof AuthError2) {
               throw error;
             } else {
               throw createClientAuthError(networkError, "");
@@ -21568,7 +21631,7 @@ ${serverError}`, correlationId);
     };
     var PromptValue = PromptValue$1;
     var ResponseMode = ResponseMode$1;
-    exports2.AuthError = AuthError;
+    exports2.AuthError = AuthError2;
     exports2.AuthErrorCodes = AuthErrorCodes;
     exports2.AzureCloudInstance = AzureCloudInstance;
     exports2.ClientAssertion = ClientAssertion;
@@ -22470,11 +22533,9 @@ var require_commonjs4 = __commonJS({
 // node_modules/@azure/identity/dist/commonjs/msal/msal.js
 var require_msal = __commonJS({
   "node_modules/@azure/identity/dist/commonjs/msal/msal.js"(exports2, module2) {
-    var __create2 = Object.create;
     var __defProp2 = Object.defineProperty;
     var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
     var __getOwnPropNames2 = Object.getOwnPropertyNames;
-    var __getProtoOf2 = Object.getPrototypeOf;
     var __hasOwnProp2 = Object.prototype.hasOwnProperty;
     var __export2 = (target, all) => {
       for (var name in all)
@@ -22488,21 +22549,14 @@ var require_msal = __commonJS({
       }
       return to;
     };
-    var __toESM2 = (mod, isNodeMode, target) => (target = mod != null ? __create2(__getProtoOf2(mod)) : {}, __copyProps2(
-      // If the importer is in node compatibility mode or this is not an ESM
-      // file that has been converted to a CommonJS file using a Babel-
-      // compatible transform (i.e. "__esModule" has not been set), then set
-      // "default" to the CommonJS "module.exports" for node compatibility.
-      isNodeMode || !mod || !mod.__esModule ? __defProp2(target, "default", { value: mod, enumerable: true }) : target,
-      mod
-    ));
     var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
     var msal_exports = {};
     __export2(msal_exports, {
-      msalCommon: () => msalCommon
+      AuthError: () => import_msal_node.AuthError,
+      LogLevel: () => import_msal_node.LogLevel
     });
     module2.exports = __toCommonJS2(msal_exports);
-    var msalCommon = __toESM2(require_msal_node());
+    var import_msal_node = require_msal_node();
   }
 });
 
@@ -22532,7 +22586,6 @@ var require_utils3 = __commonJS({
       deserializeAuthenticationRecord: () => deserializeAuthenticationRecord2,
       ensureValidMsalToken: () => ensureValidMsalToken,
       getAuthority: () => getAuthority,
-      getAuthorityHost: () => getAuthorityHost,
       getKnownAuthorities: () => getKnownAuthorities,
       getMSALLogLevel: () => getMSALLogLevel,
       handleMsalError: () => handleMsalError,
@@ -22569,13 +22622,6 @@ var require_utils3 = __commonJS({
         throw error(`Response had no "accessToken" property.`);
       }
     }
-    function getAuthorityHost(options) {
-      let authorityHost = options?.authorityHost;
-      if (!authorityHost && import_core_util.isNodeLike) {
-        authorityHost = process.env.AZURE_AUTHORITY_HOST;
-      }
-      return authorityHost ?? import_constants.DefaultAuthorityHost;
-    }
     function getAuthority(tenantId, host) {
       if (!host) {
         host = import_constants.DefaultAuthorityHost;
@@ -22595,21 +22641,21 @@ var require_utils3 = __commonJS({
       }
       return [];
     }
-    var defaultLoggerCallback = (credLogger, platform2 = import_core_util.isNode ? "Node" : "Browser") => (level, message, containsPii) => {
+    var defaultLoggerCallback = (credLogger, platform2 = import_core_util.isNodeLike ? "Node" : "Browser") => (level, message, containsPii) => {
       if (containsPii) {
         return;
       }
       switch (level) {
-        case import_msal.msalCommon.LogLevel.Error:
+        case import_msal.LogLevel.Error:
           credLogger.info(`MSAL ${platform2} V2 error: ${message}`);
           return;
-        case import_msal.msalCommon.LogLevel.Info:
+        case import_msal.LogLevel.Info:
           credLogger.info(`MSAL ${platform2} V2 info message: ${message}`);
           return;
-        case import_msal.msalCommon.LogLevel.Verbose:
+        case import_msal.LogLevel.Verbose:
           credLogger.info(`MSAL ${platform2} V2 verbose message: ${message}`);
           return;
-        case import_msal.msalCommon.LogLevel.Warning:
+        case import_msal.LogLevel.Warning:
           credLogger.info(`MSAL ${platform2} V2 warning: ${message}`);
           return;
       }
@@ -22617,15 +22663,15 @@ var require_utils3 = __commonJS({
     function getMSALLogLevel(logLevel) {
       switch (logLevel) {
         case "error":
-          return import_msal.msalCommon.LogLevel.Error;
+          return import_msal.LogLevel.Error;
         case "info":
-          return import_msal.msalCommon.LogLevel.Info;
+          return import_msal.LogLevel.Info;
         case "verbose":
-          return import_msal.msalCommon.LogLevel.Verbose;
+          return import_msal.LogLevel.Verbose;
         case "warning":
-          return import_msal.msalCommon.LogLevel.Warning;
+          return import_msal.LogLevel.Warning;
         default:
-          return import_msal.msalCommon.LogLevel.Info;
+          return import_msal.LogLevel.Info;
       }
     }
     function randomUUID2() {
@@ -22664,7 +22710,12 @@ var require_utils3 = __commonJS({
         );
         return error;
       }
-      return new import_errors.AuthenticationRequiredError({ scopes, getTokenOptions, message: error.message });
+      return new import_errors.AuthenticationRequiredError({
+        scopes,
+        getTokenOptions,
+        message: error.message,
+        cause: error
+      });
     }
     function publicToMsal(account) {
       return {
@@ -23128,13 +23179,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path2, preserveJsx) {
-  if (typeof path2 === "string" && /^\.\.?\//.test(path2)) {
-    return path2.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path3, preserveJsx) {
+  if (typeof path3 === "string" && /^\.\.?\//.test(path3)) {
+    return path3.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path2;
+  return path3;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -24565,8 +24616,8 @@ var require_inspect = __commonJS({
       custom: () => custom
     });
     module2.exports = __toCommonJS2(inspect_exports);
-    var import_node_util6 = require("node:util");
-    var custom = import_node_util6.inspect.custom;
+    var import_node_util7 = require("node:util");
+    var custom = import_node_util7.inspect.custom;
   }
 });
 
@@ -25166,19 +25217,19 @@ var require_userAgentPlatform = __commonJS({
     });
     module2.exports = __toCommonJS2(userAgentPlatform_exports);
     var import_node_os2 = __toESM2(require("node:os"));
-    var import_node_process8 = __toESM2(require("node:process"));
+    var import_node_process9 = __toESM2(require("node:process"));
     function getHeaderName() {
       return "User-Agent";
     }
     async function setPlatformSpecificData2(map) {
-      if (import_node_process8.default && import_node_process8.default.versions) {
+      if (import_node_process9.default && import_node_process9.default.versions) {
         const osInfo = `${import_node_os2.default.type()} ${import_node_os2.default.release()}; ${import_node_os2.default.arch()}`;
-        if (import_node_process8.default.versions.bun) {
-          map.set("Bun", `${import_node_process8.default.versions.bun} (${osInfo})`);
-        } else if (import_node_process8.default.versions.deno) {
-          map.set("Deno", `${import_node_process8.default.versions.deno} (${osInfo})`);
-        } else if (import_node_process8.default.versions.node) {
-          map.set("Node", `${import_node_process8.default.versions.node} (${osInfo})`);
+        if (import_node_process9.default.versions.bun) {
+          map.set("Bun", `${import_node_process9.default.versions.bun} (${osInfo})`);
+        } else if (import_node_process9.default.versions.deno) {
+          map.set("Deno", `${import_node_process9.default.versions.deno} (${osInfo})`);
+        } else if (import_node_process9.default.versions.node) {
+          map.set("Node", `${import_node_process9.default.versions.node} (${osInfo})`);
         }
       }
     }
@@ -25918,122 +25969,6 @@ var require_tlsPolicy = __commonJS({
   }
 });
 
-// node_modules/https-proxy-agent/node_modules/ms/index.js
-var require_ms3 = __commonJS({
-  "node_modules/https-proxy-agent/node_modules/ms/index.js"(exports2, module2) {
-    var s = 1e3;
-    var m = s * 60;
-    var h = m * 60;
-    var d = h * 24;
-    var w = d * 7;
-    var y = d * 365.25;
-    module2.exports = function(val, options) {
-      options = options || {};
-      var type = typeof val;
-      if (type === "string" && val.length > 0) {
-        return parse(val);
-      } else if (type === "number" && isFinite(val)) {
-        return options.long ? fmtLong(val) : fmtShort(val);
-      }
-      throw new Error(
-        "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
-      );
-    };
-    function parse(str) {
-      str = String(str);
-      if (str.length > 100) {
-        return;
-      }
-      var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
-        str
-      );
-      if (!match) {
-        return;
-      }
-      var n = parseFloat(match[1]);
-      var type = (match[2] || "ms").toLowerCase();
-      switch (type) {
-        case "years":
-        case "year":
-        case "yrs":
-        case "yr":
-        case "y":
-          return n * y;
-        case "weeks":
-        case "week":
-        case "w":
-          return n * w;
-        case "days":
-        case "day":
-        case "d":
-          return n * d;
-        case "hours":
-        case "hour":
-        case "hrs":
-        case "hr":
-        case "h":
-          return n * h;
-        case "minutes":
-        case "minute":
-        case "mins":
-        case "min":
-        case "m":
-          return n * m;
-        case "seconds":
-        case "second":
-        case "secs":
-        case "sec":
-        case "s":
-          return n * s;
-        case "milliseconds":
-        case "millisecond":
-        case "msecs":
-        case "msec":
-        case "ms":
-          return n;
-        default:
-          return void 0;
-      }
-    }
-    function fmtShort(ms) {
-      var msAbs = Math.abs(ms);
-      if (msAbs >= d) {
-        return Math.round(ms / d) + "d";
-      }
-      if (msAbs >= h) {
-        return Math.round(ms / h) + "h";
-      }
-      if (msAbs >= m) {
-        return Math.round(ms / m) + "m";
-      }
-      if (msAbs >= s) {
-        return Math.round(ms / s) + "s";
-      }
-      return ms + "ms";
-    }
-    function fmtLong(ms) {
-      var msAbs = Math.abs(ms);
-      if (msAbs >= d) {
-        return plural(ms, msAbs, d, "day");
-      }
-      if (msAbs >= h) {
-        return plural(ms, msAbs, h, "hour");
-      }
-      if (msAbs >= m) {
-        return plural(ms, msAbs, m, "minute");
-      }
-      if (msAbs >= s) {
-        return plural(ms, msAbs, s, "second");
-      }
-      return ms + " ms";
-    }
-    function plural(ms, msAbs, n, name) {
-      var isPlural = msAbs >= n * 1.5;
-      return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
-    }
-  }
-});
-
 // node_modules/https-proxy-agent/node_modules/debug/src/common.js
 var require_common2 = __commonJS({
   "node_modules/https-proxy-agent/node_modules/debug/src/common.js"(exports2, module2) {
@@ -26044,7 +25979,7 @@ var require_common2 = __commonJS({
       createDebug.disable = disable;
       createDebug.enable = enable;
       createDebug.enabled = enabled;
-      createDebug.humanize = require_ms3();
+      createDebug.humanize = require_ms();
       createDebug.destroy = destroy;
       Object.keys(env).forEach((key) => {
         createDebug[key] = env[key];
@@ -27038,122 +26973,6 @@ var require_dist2 = __commonJS({
   }
 });
 
-// node_modules/http-proxy-agent/node_modules/ms/index.js
-var require_ms4 = __commonJS({
-  "node_modules/http-proxy-agent/node_modules/ms/index.js"(exports2, module2) {
-    var s = 1e3;
-    var m = s * 60;
-    var h = m * 60;
-    var d = h * 24;
-    var w = d * 7;
-    var y = d * 365.25;
-    module2.exports = function(val, options) {
-      options = options || {};
-      var type = typeof val;
-      if (type === "string" && val.length > 0) {
-        return parse(val);
-      } else if (type === "number" && isFinite(val)) {
-        return options.long ? fmtLong(val) : fmtShort(val);
-      }
-      throw new Error(
-        "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
-      );
-    };
-    function parse(str) {
-      str = String(str);
-      if (str.length > 100) {
-        return;
-      }
-      var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
-        str
-      );
-      if (!match) {
-        return;
-      }
-      var n = parseFloat(match[1]);
-      var type = (match[2] || "ms").toLowerCase();
-      switch (type) {
-        case "years":
-        case "year":
-        case "yrs":
-        case "yr":
-        case "y":
-          return n * y;
-        case "weeks":
-        case "week":
-        case "w":
-          return n * w;
-        case "days":
-        case "day":
-        case "d":
-          return n * d;
-        case "hours":
-        case "hour":
-        case "hrs":
-        case "hr":
-        case "h":
-          return n * h;
-        case "minutes":
-        case "minute":
-        case "mins":
-        case "min":
-        case "m":
-          return n * m;
-        case "seconds":
-        case "second":
-        case "secs":
-        case "sec":
-        case "s":
-          return n * s;
-        case "milliseconds":
-        case "millisecond":
-        case "msecs":
-        case "msec":
-        case "ms":
-          return n;
-        default:
-          return void 0;
-      }
-    }
-    function fmtShort(ms) {
-      var msAbs = Math.abs(ms);
-      if (msAbs >= d) {
-        return Math.round(ms / d) + "d";
-      }
-      if (msAbs >= h) {
-        return Math.round(ms / h) + "h";
-      }
-      if (msAbs >= m) {
-        return Math.round(ms / m) + "m";
-      }
-      if (msAbs >= s) {
-        return Math.round(ms / s) + "s";
-      }
-      return ms + "ms";
-    }
-    function fmtLong(ms) {
-      var msAbs = Math.abs(ms);
-      if (msAbs >= d) {
-        return plural(ms, msAbs, d, "day");
-      }
-      if (msAbs >= h) {
-        return plural(ms, msAbs, h, "hour");
-      }
-      if (msAbs >= m) {
-        return plural(ms, msAbs, m, "minute");
-      }
-      if (msAbs >= s) {
-        return plural(ms, msAbs, s, "second");
-      }
-      return ms + " ms";
-    }
-    function plural(ms, msAbs, n, name) {
-      var isPlural = msAbs >= n * 1.5;
-      return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
-    }
-  }
-});
-
 // node_modules/http-proxy-agent/node_modules/debug/src/common.js
 var require_common3 = __commonJS({
   "node_modules/http-proxy-agent/node_modules/debug/src/common.js"(exports2, module2) {
@@ -27164,7 +26983,7 @@ var require_common3 = __commonJS({
       createDebug.disable = disable;
       createDebug.enable = enable;
       createDebug.enabled = enabled;
-      createDebug.humanize = require_ms4();
+      createDebug.humanize = require_ms();
       createDebug.destroy = destroy;
       Object.keys(env).forEach((key) => {
         createDebug[key] = env[key];
@@ -29504,8 +29323,8 @@ var require_getClient = __commonJS({
       const noDefaultAcceptHeader = clientOptions.internal?.noDefaultAcceptHeader ?? false;
       const { allowInsecureConnection, httpClient } = clientOptions;
       const endpointUrl = clientOptions.endpoint ?? endpoint;
-      const client = (path2, ...args) => {
-        const getUrl = (requestOptions) => (0, import_urlHelpers.buildRequestUrl)(endpointUrl, path2, args, { allowInsecureConnection, ...requestOptions });
+      const client = (path3, ...args) => {
+        const getUrl = (requestOptions) => (0, import_urlHelpers.buildRequestUrl)(endpointUrl, path3, args, { allowInsecureConnection, ...requestOptions });
         return {
           get: (requestOptions = {}) => {
             return buildOperation(
@@ -30173,19 +29992,19 @@ var require_userAgentPlatform2 = __commonJS({
     });
     module2.exports = __toCommonJS2(userAgentPlatform_exports);
     var import_node_os2 = __toESM2(require("node:os"));
-    var import_node_process8 = __toESM2(require("node:process"));
+    var import_node_process9 = __toESM2(require("node:process"));
     function getHeaderName() {
       return "User-Agent";
     }
     async function setPlatformSpecificData2(map) {
-      if (import_node_process8.default && import_node_process8.default.versions) {
+      if (import_node_process9.default && import_node_process9.default.versions) {
         const osInfo = `${import_node_os2.default.type()} ${import_node_os2.default.release()}; ${import_node_os2.default.arch()}`;
-        if (import_node_process8.default.versions.bun) {
-          map.set("Bun", `${import_node_process8.default.versions.bun} (${osInfo})`);
-        } else if (import_node_process8.default.versions.deno) {
-          map.set("Deno", `${import_node_process8.default.versions.deno} (${osInfo})`);
-        } else if (import_node_process8.default.versions.node) {
-          map.set("Node", `${import_node_process8.default.versions.node} (${osInfo})`);
+        if (import_node_process9.default.versions.bun) {
+          map.set("Bun", `${import_node_process9.default.versions.bun} (${osInfo})`);
+        } else if (import_node_process9.default.versions.deno) {
+          map.set("Deno", `${import_node_process9.default.versions.deno} (${osInfo})`);
+        } else if (import_node_process9.default.versions.node) {
+          map.set("Node", `${import_node_process9.default.versions.node} (${osInfo})`);
         }
       }
     }
@@ -32461,15 +32280,15 @@ var require_urlHelpers2 = __commonJS({
       let isAbsolutePath = false;
       let requestUrl = replaceAll(baseUri, urlReplacements);
       if (operationSpec.path) {
-        let path2 = replaceAll(operationSpec.path, urlReplacements);
-        if (operationSpec.path === "/{nextLink}" && path2.startsWith("/")) {
-          path2 = path2.substring(1);
+        let path3 = replaceAll(operationSpec.path, urlReplacements);
+        if (operationSpec.path === "/{nextLink}" && path3.startsWith("/")) {
+          path3 = path3.substring(1);
         }
-        if (isAbsoluteUrl(path2)) {
-          requestUrl = path2;
+        if (isAbsoluteUrl(path3)) {
+          requestUrl = path3;
           isAbsolutePath = true;
         } else {
-          requestUrl = appendPath(requestUrl, path2);
+          requestUrl = appendPath(requestUrl, path3);
         }
       }
       const { queryParams, sequenceParams } = calculateQueryParameters(operationSpec, operationArguments, fallbackObject);
@@ -32515,9 +32334,9 @@ var require_urlHelpers2 = __commonJS({
       }
       const searchStart = pathToAppend.indexOf("?");
       if (searchStart !== -1) {
-        const path2 = pathToAppend.substring(0, searchStart);
+        const path3 = pathToAppend.substring(0, searchStart);
         const search = pathToAppend.substring(searchStart + 1);
-        newPath = newPath + path2;
+        newPath = newPath + path3;
         if (search) {
           parsedUrl.search = parsedUrl.search ? `${parsedUrl.search}&${search}` : search;
         }
@@ -33130,6 +32949,43 @@ var require_utils5 = __commonJS({
   }
 });
 
+// node_modules/@azure/identity/dist/commonjs/util/authorityHost.js
+var require_authorityHost = __commonJS({
+  "node_modules/@azure/identity/dist/commonjs/util/authorityHost.js"(exports2, module2) {
+    var __defProp2 = Object.defineProperty;
+    var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
+    var __getOwnPropNames2 = Object.getOwnPropertyNames;
+    var __hasOwnProp2 = Object.prototype.hasOwnProperty;
+    var __export2 = (target, all) => {
+      for (var name in all)
+        __defProp2(target, name, { get: all[name], enumerable: true });
+    };
+    var __copyProps2 = (to, from, except, desc) => {
+      if (from && typeof from === "object" || typeof from === "function") {
+        for (let key of __getOwnPropNames2(from))
+          if (!__hasOwnProp2.call(to, key) && key !== except)
+            __defProp2(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc2(from, key)) || desc.enumerable });
+      }
+      return to;
+    };
+    var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
+    var authorityHost_exports = {};
+    __export2(authorityHost_exports, {
+      getAuthorityHost: () => getAuthorityHost
+    });
+    module2.exports = __toCommonJS2(authorityHost_exports);
+    var import_core_util = require_commonjs4();
+    var import_constants = require_constants();
+    function getAuthorityHost(options) {
+      let authorityHost = options?.authorityHost;
+      if (!authorityHost && import_core_util.isNodeLike) {
+        authorityHost = process.env.AZURE_AUTHORITY_HOST;
+      }
+      return authorityHost ?? import_constants.DefaultAuthorityHost;
+    }
+  }
+});
+
 // node_modules/@azure/identity/dist/commonjs/client/identityClient.js
 var require_identityClient = __commonJS({
   "node_modules/@azure/identity/dist/commonjs/client/identityClient.js"(exports2, module2) {
@@ -33152,27 +33008,26 @@ var require_identityClient = __commonJS({
     var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
     var identityClient_exports = {};
     __export2(identityClient_exports, {
-      IdentityClient: () => IdentityClient,
-      getIdentityClientAuthorityHost: () => getIdentityClientAuthorityHost
+      IdentityClient: () => IdentityClient
     });
     module2.exports = __toCommonJS2(identityClient_exports);
     var import_core_client = require_commonjs7();
-    var import_core_util = require_commonjs4();
     var import_core_rest_pipeline = require_commonjs6();
+    var import_core_util = require_commonjs4();
     var import_errors = require_errors2();
     var import_identityTokenEndpoint = require_identityTokenEndpoint();
     var import_constants = require_constants();
     var import_tracing = require_tracing();
     var import_logging = require_logging();
     var import_utils = require_utils5();
+    var import_authorityHost = require_authorityHost();
     var noCorrelationId = "noCorrelationId";
-    function getIdentityClientAuthorityHost(options) {
-      let authorityHost = options?.authorityHost;
-      if (import_core_util.isNode) {
-        authorityHost = authorityHost ?? process.env.AZURE_AUTHORITY_HOST;
-      }
-      return authorityHost ?? import_constants.DefaultAuthorityHost;
-    }
+    var HttpStatus = {
+      CLIENT_ERROR_RANGE_START: 400,
+      CLIENT_ERROR_RANGE_END: 499,
+      SERVER_ERROR_RANGE_START: 500,
+      SERVER_ERROR_RANGE_END: 599
+    };
     var IdentityClient = class extends import_core_client.ServiceClient {
       authorityHost;
       allowLoggingAccountIdentifiers;
@@ -33183,7 +33038,7 @@ var require_identityClient = __commonJS({
       constructor(options) {
         const packageDetails = `azsdk-js-identity/${import_constants.SDK_VERSION}`;
         const userAgentPrefix = options?.userAgentOptions?.userAgentPrefix ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}` : `${packageDetails}`;
-        const baseUri = getIdentityClientAuthorityHost(options);
+        const baseUri = (0, import_authorityHost.getAuthorityHost)(options);
         if (!baseUri.startsWith("https:")) {
           throw new Error("The authorityHost address must use the 'https' protocol.");
         }
@@ -33335,7 +33190,7 @@ var require_identityClient = __commonJS({
         const response = await this.sendRequest(request);
         this.logIdentifiers(response);
         return {
-          body: response.bodyAsText ? JSON.parse(response.bodyAsText) : void 0,
+          body: this.parseResponseBody(response),
           headers: response.headers.toJSON(),
           status: response.status
         };
@@ -33353,7 +33208,7 @@ var require_identityClient = __commonJS({
         const response = await this.sendRequest(request);
         this.logIdentifiers(response);
         return {
-          body: response.bodyAsText ? JSON.parse(response.bodyAsText) : void 0,
+          body: this.parseResponseBody(response),
           headers: response.headers.toJSON(),
           status: response.status
         };
@@ -33390,7 +33245,7 @@ var require_identityClient = __commonJS({
           }
           const base64Metadata = accessToken.split(".")[1];
           const { appid, upn, tid, oid } = JSON.parse(
-            Buffer.from(base64Metadata, "base64").toString("utf8")
+            (0, import_core_util.uint8ArrayToString)((0, import_core_util.stringToUint8Array)(base64Metadata, "base64url"), "utf-8")
           );
           import_logging.logger.info(
             `[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`
@@ -33402,6 +33257,41 @@ var require_identityClient = __commonJS({
           );
         }
       }
+      /**
+       * Parses the response body if possible. Add error properties if parsing fails.
+       * This follows MSAL INetworkModule behavior so the response is in expected format.
+       */
+      parseResponseBody(response) {
+        let parsedBody;
+        try {
+          parsedBody = JSON.parse(response.bodyAsText || "");
+        } catch (error) {
+          import_logging.logger.info(`IdentityClient: Could not parse response body: ${error}`);
+          let errorType;
+          let errorDescriptionHelper;
+          if (response.status >= HttpStatus.CLIENT_ERROR_RANGE_START && response.status <= HttpStatus.CLIENT_ERROR_RANGE_END) {
+            errorType = "client_error";
+            errorDescriptionHelper = "A client";
+          } else if (response.status >= HttpStatus.SERVER_ERROR_RANGE_START && response.status <= HttpStatus.SERVER_ERROR_RANGE_END) {
+            errorType = "server_error";
+            errorDescriptionHelper = "A server";
+          } else {
+            errorType = "unknown_error";
+            errorDescriptionHelper = "An unknown";
+          }
+          const errorDescriptionLines = [
+            `${errorDescriptionHelper} error occured.`,
+            `Http status code: ${response.status}`,
+            `Http status message: ${response.bodyAsText || "Unknown"}`,
+            `Headers: ${JSON.stringify(response.headers)}`
+          ];
+          parsedBody = {
+            error: errorType,
+            error_description: errorDescriptionLines.join("\n")
+          };
+        }
+        return parsedBody;
+      }
     };
   }
 });
@@ -33699,14 +33589,80 @@ var init_is_wsl = __esm({
   }
 });
 
+// node_modules/powershell-utils/index.js
+var import_node_process2, import_node_buffer, import_node_util, import_node_child_process, execFile2, powerShellPath, argumentsPrefix, encodeCommand, escapeArgument, createArguments, createExecFileOptions, executePowerShell;
+var init_powershell_utils = __esm({
+  "node_modules/powershell-utils/index.js"() {
+    import_node_process2 = __toESM(require("node:process"), 1);
+    import_node_buffer = require("node:buffer");
+    import_node_util = require("node:util");
+    import_node_child_process = __toESM(require("node:child_process"), 1);
+    execFile2 = (0, import_node_util.promisify)(import_node_child_process.default.execFile);
+    powerShellPath = () => `${import_node_process2.default.env.SYSTEMROOT || import_node_process2.default.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+    argumentsPrefix = [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand"
+    ];
+    encodeCommand = (command) => import_node_buffer.Buffer.from(command, "utf16le").toString("base64");
+    escapeArgument = (value) => `'${String(value).replaceAll(/['‘’‚‛]/g, (match) => match + match)}'`;
+    createArguments = (command) => [...argumentsPrefix, encodeCommand(command)];
+    createExecFileOptions = (options) => ({
+      encoding: "utf8",
+      ...options,
+      shell: false
+    });
+    executePowerShell = async (command, options = {}) => {
+      const {
+        powerShellPath: psPath,
+        ...execFileOptions
+      } = options;
+      return execFile2(
+        psPath ?? powerShellPath(),
+        createArguments(command),
+        createExecFileOptions(execFileOptions)
+      );
+    };
+    executePowerShell.argumentsPrefix = argumentsPrefix;
+    executePowerShell.encodeCommand = encodeCommand;
+    executePowerShell.escapeArgument = escapeArgument;
+    executePowerShell.createArguments = createArguments;
+  }
+});
+
+// node_modules/wsl-utils/utilities.js
+function parseMountPointFromConfig(content) {
+  for (const line of content.split("\n")) {
+    if (/^\s*#/.test(line)) {
+      continue;
+    }
+    const match = /^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(line);
+    if (!match) {
+      continue;
+    }
+    return match.groups.mountPoint.trim().replaceAll(/^["']|["']$/g, "");
+  }
+}
+var init_utilities = __esm({
+  "node_modules/wsl-utils/utilities.js"() {
+  }
+});
+
 // node_modules/wsl-utils/index.js
-var import_node_process2, import_promises, wslDrivesMountPoint, powerShellPathFromWsl, powerShellPath;
+var import_node_path, import_node_util2, import_node_child_process2, import_promises, execFile3, wslDrivesMountPoint, powerShellPathFromWsl, powerShellPath2, canAccessPowerShellPromise, canAccessPowerShell, wslDefaultBrowser, isUrl, convertPath, convertWslPathToWindows;
 var init_wsl_utils = __esm({
   "node_modules/wsl-utils/index.js"() {
-    import_node_process2 = __toESM(require("node:process"), 1);
+    import_node_path = __toESM(require("node:path"), 1);
+    import_node_util2 = require("node:util");
+    import_node_child_process2 = __toESM(require("node:child_process"), 1);
     import_promises = __toESM(require("node:fs/promises"), 1);
     init_is_wsl();
+    init_powershell_utils();
+    init_utilities();
     init_is_wsl();
+    execFile3 = (0, import_node_util2.promisify)(import_node_child_process2.default.execFile);
     wslDrivesMountPoint = /* @__PURE__ */ (() => {
       const defaultMountPoint = "/mnt/";
       let mountPoint;
@@ -33725,11 +33681,11 @@ var init_wsl_utils = __esm({
           return defaultMountPoint;
         }
         const configContent = await import_promises.default.readFile(configFilePath, { encoding: "utf8" });
-        const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);
-        if (!configMountPoint) {
+        const parsedMountPoint = parseMountPointFromConfig(configContent);
+        if (parsedMountPoint === void 0) {
           return defaultMountPoint;
         }
-        mountPoint = configMountPoint.groups.mountPoint.trim();
+        mountPoint = parsedMountPoint;
         mountPoint = mountPoint.endsWith("/") ? mountPoint : `${mountPoint}/`;
         return mountPoint;
       };
@@ -33738,11 +33694,43 @@ var init_wsl_utils = __esm({
       const mountPoint = await wslDrivesMountPoint();
       return `${mountPoint}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`;
     };
-    powerShellPath = async () => {
-      if (is_wsl_default) {
-        return powerShellPathFromWsl();
+    powerShellPath2 = is_wsl_default ? powerShellPathFromWsl : powerShellPath;
+    canAccessPowerShell = async () => {
+      canAccessPowerShellPromise ??= (async () => {
+        try {
+          const psPath = await powerShellPath2();
+          await import_promises.default.access(psPath, import_promises.constants.X_OK);
+          return true;
+        } catch {
+          return false;
+        }
+      })();
+      return canAccessPowerShellPromise;
+    };
+    wslDefaultBrowser = async () => {
+      const psPath = await powerShellPath2();
+      const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
+      const { stdout } = await executePowerShell(command, {
+        powerShellPath: psPath,
+        cwd: import_node_path.default.dirname(psPath)
+      });
+      return stdout.trim();
+    };
+    isUrl = (path3) => /^[a-z]+:\/\//i.test(path3);
+    convertPath = async (flag, path3) => {
+      const wslpathArguments = path3.startsWith("-") ? [flag, "--", path3] : [flag, path3];
+      try {
+        const { stdout } = await execFile3("wslpath", wslpathArguments, { encoding: "utf8" });
+        return stdout.replace(/\r?\n$/, "") || path3;
+      } catch {
+        return path3;
       }
-      return `${import_node_process2.default.env.SYSTEMROOT || import_node_process2.default.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+    };
+    convertWslPathToWindows = async (paths) => {
+      const isBatch = Array.isArray(paths);
+      const pathArray = isBatch ? paths : [paths];
+      const results = await Promise.all(pathArray.map((path3) => isUrl(path3) ? path3 : convertPath("-aw", path3)));
+      return isBatch ? results : results[0];
     };
   }
 });
@@ -33782,13 +33770,13 @@ async function defaultBrowserId() {
   }
   return browserId;
 }
-var import_node_util, import_node_process3, import_node_child_process, execFileAsync;
+var import_node_util3, import_node_process3, import_node_child_process3, execFileAsync;
 var init_default_browser_id = __esm({
   "node_modules/default-browser-id/index.js"() {
-    import_node_util = require("node:util");
+    import_node_util3 = require("node:util");
     import_node_process3 = __toESM(require("node:process"), 1);
-    import_node_child_process = require("node:child_process");
-    execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+    import_node_child_process3 = require("node:child_process");
+    execFileAsync = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
   }
 });
 
@@ -33805,13 +33793,13 @@ async function runAppleScript(script, { humanReadableOutput = true, signal } = {
   const { stdout } = await execFileAsync2("osascript", ["-e", script, outputArguments], execOptions);
   return stdout.trim();
 }
-var import_node_process4, import_node_util2, import_node_child_process2, execFileAsync2;
+var import_node_process4, import_node_util4, import_node_child_process4, execFileAsync2;
 var init_run_applescript = __esm({
   "node_modules/run-applescript/index.js"() {
     import_node_process4 = __toESM(require("node:process"), 1);
-    import_node_util2 = require("node:util");
-    import_node_child_process2 = require("node:child_process");
-    execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process2.execFile);
+    import_node_util4 = require("node:util");
+    import_node_child_process4 = require("node:child_process");
+    execFileAsync2 = (0, import_node_util4.promisify)(import_node_child_process4.execFile);
   }
 });
 
@@ -33854,13 +33842,13 @@ async function defaultBrowser(_execFileAsync = execFileAsync3) {
   const baseIdByHyphen = hyphenIndex === -1 ? void 0 : id.slice(0, hyphenIndex);
   return windowsBrowserProgIds[id] ?? windowsBrowserProgIds[baseIdByDot] ?? windowsBrowserProgIds[baseIdByHyphen] ?? { name: id, id };
 }
-var import_node_process5, import_node_util3, import_node_child_process3, execFileAsync3, windowsBrowserProgIds, _windowsBrowserProgIdMap, UnknownBrowserError;
+var import_node_process5, import_node_util5, import_node_child_process5, execFileAsync3, windowsBrowserProgIds, _windowsBrowserProgIdMap, UnknownBrowserError;
 var init_windows = __esm({
   "node_modules/default-browser/windows.js"() {
     import_node_process5 = __toESM(require("node:process"), 1);
-    import_node_util3 = require("node:util");
-    import_node_child_process3 = require("node:child_process");
-    execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
+    import_node_util5 = require("node:util");
+    import_node_child_process5 = require("node:child_process");
+    execFileAsync3 = (0, import_node_util5.promisify)(import_node_child_process5.execFile);
     windowsBrowserProgIds = {
       MSEdgeHTM: { name: "Edge", id: "com.microsoft.edge" },
       // The missing `L` is correct.
@@ -33904,20 +33892,31 @@ async function defaultBrowser2() {
   }
   throw new Error("Only macOS, Linux, and Windows are supported");
 }
-var import_node_util4, import_node_process6, import_node_child_process4, execFileAsync4, titleize;
+var import_node_util6, import_node_process6, import_node_child_process6, execFileAsync4, titleize;
 var init_default_browser = __esm({
   "node_modules/default-browser/index.js"() {
-    import_node_util4 = require("node:util");
+    import_node_util6 = require("node:util");
     import_node_process6 = __toESM(require("node:process"), 1);
-    import_node_child_process4 = require("node:child_process");
+    import_node_child_process6 = require("node:child_process");
     init_default_browser_id();
     init_bundle_name();
     init_windows();
-    execFileAsync4 = (0, import_node_util4.promisify)(import_node_child_process4.execFile);
+    init_windows();
+    execFileAsync4 = (0, import_node_util6.promisify)(import_node_child_process6.execFile);
     titleize = (string) => string.toLowerCase().replaceAll(/(?:^|\s|-)\S/g, (x) => x.toUpperCase());
   }
 });
 
+// node_modules/is-in-ssh/index.js
+var import_node_process7, isInSsh, is_in_ssh_default;
+var init_is_in_ssh = __esm({
+  "node_modules/is-in-ssh/index.js"() {
+    import_node_process7 = __toESM(require("node:process"), 1);
+    isInSsh = Boolean(import_node_process7.default.env.SSH_CONNECTION || import_node_process7.default.env.SSH_CLIENT || import_node_process7.default.env.SSH_TTY);
+    is_in_ssh_default = isInSsh;
+  }
+});
+
 // node_modules/open/index.js
 var open_exports = {};
 __export(open_exports, {
@@ -33925,31 +33924,6 @@ __export(open_exports, {
   default: () => open_default,
   openApp: () => openApp
 });
-async function getWindowsDefaultBrowserFromWsl() {
-  const powershellPath = await powerShellPath();
-  const rawCommand = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
-  const encodedCommand = import_node_buffer.Buffer.from(rawCommand, "utf16le").toString("base64");
-  const { stdout } = await execFile6(
-    powershellPath,
-    [
-      "-NoProfile",
-      "-NonInteractive",
-      "-ExecutionPolicy",
-      "Bypass",
-      "-EncodedCommand",
-      encodedCommand
-    ],
-    { encoding: "utf8" }
-  );
-  const progId = stdout.trim();
-  const browserMap = {
-    ChromeHTML: "com.google.chrome",
-    BraveHTML: "com.brave.Browser",
-    MSEdgeHTM: "com.microsoft.edge",
-    FirefoxURL: "org.mozilla.firefox"
-  };
-  return browserMap[progId] ? { id: browserMap[progId] } : {};
-}
 function detectArchBinary(binary) {
   if (typeof binary === "string" || Array.isArray(binary)) {
     return binary;
@@ -33960,7 +33934,7 @@ function detectArchBinary(binary) {
   }
   return archBinary;
 }
-function detectPlatformBinary({ [platform]: platformBinary }, { wsl }) {
+function detectPlatformBinary({ [platform]: platformBinary }, { wsl } = {}) {
   if (wsl && is_wsl_default) {
     return detectArchBinary(wsl);
   }
@@ -33969,35 +33943,38 @@ function detectPlatformBinary({ [platform]: platformBinary }, { wsl }) {
   }
   return detectArchBinary(platformBinary);
 }
-var import_node_process7, import_node_buffer, import_node_path, import_node_url, import_node_util5, import_node_child_process5, import_promises2, import_meta, execFile6, __dirname, localXdgOpenPath, platform, arch, pTryEach, baseOpen, open, openApp, apps, open_default;
+var import_node_process8, import_node_path2, import_node_url, import_node_child_process7, import_promises2, import_meta, fallbackAttemptSymbol, __dirname, localXdgOpenPath, platform, arch, tryEachApp, baseOpen, open, openApp, apps, open_default;
 var init_open = __esm({
   "node_modules/open/index.js"() {
-    import_node_process7 = __toESM(require("node:process"), 1);
-    import_node_buffer = require("node:buffer");
-    import_node_path = __toESM(require("node:path"), 1);
+    import_node_process8 = __toESM(require("node:process"), 1);
+    import_node_path2 = __toESM(require("node:path"), 1);
     import_node_url = require("node:url");
-    import_node_util5 = require("node:util");
-    import_node_child_process5 = __toESM(require("node:child_process"), 1);
+    import_node_child_process7 = __toESM(require("node:child_process"), 1);
     import_promises2 = __toESM(require("node:fs/promises"), 1);
     init_wsl_utils();
+    init_powershell_utils();
     init_define_lazy_prop();
     init_default_browser();
     init_is_inside_container();
+    init_is_in_ssh();
     import_meta = {};
-    execFile6 = (0, import_node_util5.promisify)(import_node_child_process5.default.execFile);
-    __dirname = import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
-    localXdgOpenPath = import_node_path.default.join(__dirname, "xdg-open");
-    ({ platform, arch } = import_node_process7.default);
-    pTryEach = async (array, mapper) => {
-      let latestError;
-      for (const item of array) {
+    fallbackAttemptSymbol = /* @__PURE__ */ Symbol("fallbackAttempt");
+    __dirname = import_meta.url ? import_node_path2.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url)) : "";
+    localXdgOpenPath = import_node_path2.default.join(__dirname, "xdg-open");
+    ({ platform, arch } = import_node_process8.default);
+    tryEachApp = async (apps2, opener) => {
+      if (apps2.length === 0) {
+        return;
+      }
+      const errors = [];
+      for (const app of apps2) {
         try {
-          return await mapper(item);
+          return await opener(app);
         } catch (error) {
-          latestError = error;
+          errors.push(error);
         }
       }
-      throw latestError;
+      throw new AggregateError(errors, "Failed to open in all supported apps");
     };
     baseOpen = async (options) => {
       options = {
@@ -34007,45 +33984,62 @@ var init_open = __esm({
         allowNonzeroExitCode: false,
         ...options
       };
+      const isFallbackAttempt = options[fallbackAttemptSymbol] === true;
+      delete options[fallbackAttemptSymbol];
       if (Array.isArray(options.app)) {
-        return pTryEach(options.app, (singleApp) => baseOpen({
+        return tryEachApp(options.app, (singleApp) => baseOpen({
           ...options,
-          app: singleApp
+          app: singleApp,
+          [fallbackAttemptSymbol]: true
         }));
       }
       let { name: app, arguments: appArguments = [] } = options.app ?? {};
       appArguments = [...appArguments];
       if (Array.isArray(app)) {
-        return pTryEach(app, (appName) => baseOpen({
+        return tryEachApp(app, (appName) => baseOpen({
           ...options,
           app: {
             name: appName,
             arguments: appArguments
-          }
+          },
+          [fallbackAttemptSymbol]: true
         }));
       }
       if (app === "browser" || app === "browserPrivate") {
         const ids = {
           "com.google.chrome": "chrome",
           "google-chrome.desktop": "chrome",
-          "com.brave.Browser": "brave",
+          "com.brave.browser": "brave",
           "org.mozilla.firefox": "firefox",
           "firefox.desktop": "firefox",
           "com.microsoft.msedge": "edge",
           "com.microsoft.edge": "edge",
           "com.microsoft.edgemac": "edge",
-          "microsoft-edge.desktop": "edge"
+          "microsoft-edge.desktop": "edge",
+          "com.apple.safari": "safari"
         };
         const flags = {
           chrome: "--incognito",
           brave: "--incognito",
           firefox: "--private-window",
           edge: "--inPrivate"
+          // Safari doesn't support private mode via command line
         };
-        const browser = is_wsl_default ? await getWindowsDefaultBrowserFromWsl() : await defaultBrowser2();
-        if (browser.id in ids) {
-          const browserName = ids[browser.id];
+        let browser;
+        if (is_wsl_default) {
+          const progId = await wslDefaultBrowser();
+          const browserInfo = _windowsBrowserProgIdMap.get(progId);
+          browser = browserInfo ?? {};
+        } else {
+          browser = await defaultBrowser2();
+        }
+        const browserId = browser.id?.toLowerCase();
+        if (Object.hasOwn(ids, browserId)) {
+          const browserName = ids[browserId];
           if (app === "browserPrivate") {
+            if (browserName === "safari") {
+              throw new Error("Safari doesn't support opening in private mode via command line");
+            }
             appArguments.push(flags[browserName]);
           }
           return baseOpen({
@@ -34061,6 +34055,10 @@ var init_open = __esm({
       let command;
       const cliArguments = [];
       const childProcessOptions = {};
+      let shouldUseWindowsInWsl = false;
+      if (is_wsl_default && !isInsideContainer() && !is_in_ssh_default && !app) {
+        shouldUseWindowsInWsl = await canAccessPowerShell();
+      }
       if (platform === "darwin") {
         command = "open";
         if (options.wait) {
@@ -34075,35 +34073,38 @@ var init_open = __esm({
         if (app) {
           cliArguments.push("-a", app);
         }
-      } else if (platform === "win32" || is_wsl_default && !isInsideContainer() && !app) {
-        command = await powerShellPath();
-        cliArguments.push(
-          "-NoProfile",
-          "-NonInteractive",
-          "-ExecutionPolicy",
-          "Bypass",
-          "-EncodedCommand"
-        );
+      } else if (platform === "win32" || shouldUseWindowsInWsl) {
+        command = await powerShellPath2();
+        cliArguments.push(...executePowerShell.argumentsPrefix);
         if (!is_wsl_default) {
           childProcessOptions.windowsVerbatimArguments = true;
         }
-        const encodedArguments = ["Start"];
+        if (is_wsl_default && options.target) {
+          options.target = await convertWslPathToWindows(options.target);
+        }
+        const encodedArguments = ["$ProgressPreference = 'SilentlyContinue';", "Start"];
         if (options.wait) {
           encodedArguments.push("-Wait");
         }
         if (app) {
-          encodedArguments.push(`"\`"${app}\`""`);
+          encodedArguments.push(executePowerShell.escapeArgument(app));
           if (options.target) {
             appArguments.push(options.target);
           }
         } else if (options.target) {
-          encodedArguments.push(`"${options.target}"`);
+          encodedArguments.push(executePowerShell.escapeArgument(options.target));
         }
         if (appArguments.length > 0) {
-          appArguments = appArguments.map((argument) => `"\`"${argument}\`""`);
+          appArguments = appArguments.map((argument) => executePowerShell.escapeArgument(argument));
           encodedArguments.push("-ArgumentList", appArguments.join(","));
         }
-        options.target = import_node_buffer.Buffer.from(encodedArguments.join(" "), "utf16le").toString("base64");
+        options.target = executePowerShell.encodeCommand(encodedArguments.join(" "));
+        if (!options.wait) {
+          childProcessOptions.stdio = "ignore";
+        }
+        if (is_wsl_default) {
+          childProcessOptions.cwd = import_node_path2.default.dirname(command);
+        }
       } else {
         if (app) {
           command = app;
@@ -34115,7 +34116,7 @@ var init_open = __esm({
             exeLocalXdgOpen = true;
           } catch {
           }
-          const useSystemXdgOpen = import_node_process7.default.versions.electron ?? (platform === "android" || isBundled || !exeLocalXdgOpen);
+          const useSystemXdgOpen = import_node_process8.default.versions.electron ?? (platform === "android" || isBundled || !exeLocalXdgOpen);
           command = useSystemXdgOpen ? "xdg-open" : localXdgOpenPath;
         }
         if (appArguments.length > 0) {
@@ -34132,12 +34133,12 @@ var init_open = __esm({
       if (options.target) {
         cliArguments.push(options.target);
       }
-      const subprocess = import_node_child_process5.default.spawn(command, cliArguments, childProcessOptions);
+      const subprocess = import_node_child_process7.default.spawn(command, cliArguments, childProcessOptions);
       if (options.wait) {
         return new Promise((resolve, reject) => {
           subprocess.once("error", reject);
           subprocess.once("close", (exitCode) => {
-            if (!options.allowNonzeroExitCode && exitCode > 0) {
+            if (!options.allowNonzeroExitCode && exitCode !== 0) {
               reject(new Error(`Exited with code ${exitCode}`));
               return;
             }
@@ -34145,8 +34146,30 @@ var init_open = __esm({
           });
         });
       }
+      if (isFallbackAttempt || platform === "win32" || shouldUseWindowsInWsl) {
+        return new Promise((resolve, reject) => {
+          subprocess.once("error", reject);
+          subprocess.once("spawn", () => {
+            subprocess.once("close", (exitCode) => {
+              subprocess.off("error", reject);
+              if (isFallbackAttempt && exitCode !== 0) {
+                reject(new Error(`Exited with code ${exitCode}`));
+                return;
+              }
+              subprocess.unref();
+              resolve(subprocess);
+            });
+          });
+        });
+      }
       subprocess.unref();
-      return subprocess;
+      return new Promise((resolve, reject) => {
+        subprocess.once("error", reject);
+        subprocess.once("spawn", () => {
+          subprocess.off("error", reject);
+          resolve(subprocess);
+        });
+      });
     };
     open = (target, options) => {
       if (typeof target !== "string") {
@@ -34173,11 +34196,15 @@ var init_open = __esm({
         }
       });
     };
-    apps = {};
+    apps = {
+      browser: "browser",
+      browserPrivate: "browserPrivate"
+    };
     defineLazyProperty(apps, "chrome", () => detectPlatformBinary({
       darwin: "google chrome",
       win32: "chrome",
-      linux: ["google-chrome", "google-chrome-stable", "chromium"]
+      // `chromium-browser` is the older deb package name used by Ubuntu/Debian before snap.
+      linux: ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser"]
     }, {
       wsl: {
         ia32: "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",
@@ -34208,8 +34235,9 @@ var init_open = __esm({
     }, {
       wsl: "/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"
     }));
-    defineLazyProperty(apps, "browser", () => "browser");
-    defineLazyProperty(apps, "browserPrivate", () => "browserPrivate");
+    defineLazyProperty(apps, "safari", () => detectPlatformBinary({
+      darwin: "Safari"
+    }));
     open_default = open;
   }
 });
@@ -34259,6 +34287,7 @@ var require_msalClient = __commonJS({
     var import_regionalAuthority = require_regionalAuthority();
     var import_logger = require_commonjs();
     var import_tenantIdUtils = require_tenantIdUtils();
+    var import_authorityHost = require_authorityHost();
     var msalLogger = (0, import_logging.credentialLogger)("MsalClient");
     function generateMsalConfiguration(clientId, tenantId, msalClientOptions = {}) {
       const resolvedTenant = (0, import_tenantIdUtils.resolveTenantId)(
@@ -34266,9 +34295,9 @@ var require_msalClient = __commonJS({
         tenantId,
         clientId
       );
-      const authority = (0, import_utils.getAuthority)(resolvedTenant, (0, import_utils.getAuthorityHost)(msalClientOptions));
+      const authority = (0, import_utils.getAuthority)(resolvedTenant, (0, import_authorityHost.getAuthorityHost)(msalClientOptions));
       const httpClient = new import_identityClient.IdentityClient({
-        ...msalClientOptions.tokenCredentialOptions,
+        ...msalClientOptions,
         authorityHost: authority,
         loggingOptions: msalClientOptions.loggingOptions
       });
@@ -34378,7 +34407,7 @@ var require_msalClient = __commonJS({
       }
       function calculateRequestAuthority(options) {
         if (options?.tenantId) {
-          return (0, import_utils.getAuthority)(options.tenantId, (0, import_utils.getAuthorityHost)(createMsalClientOptions));
+          return (0, import_utils.getAuthority)(options.tenantId, (0, import_authorityHost.getAuthorityHost)(createMsalClientOptions));
         }
         return state.msalConfig.auth.authority;
       }
@@ -34689,6 +34718,66 @@ var require_msalClient = __commonJS({
   }
 });
 
+// node_modules/@azure/identity/dist/commonjs/util/certificatesUtils.js
+var require_certificatesUtils = __commonJS({
+  "node_modules/@azure/identity/dist/commonjs/util/certificatesUtils.js"(exports2, module2) {
+    var __defProp2 = Object.defineProperty;
+    var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
+    var __getOwnPropNames2 = Object.getOwnPropertyNames;
+    var __hasOwnProp2 = Object.prototype.hasOwnProperty;
+    var __export2 = (target, all) => {
+      for (var name in all)
+        __defProp2(target, name, { get: all[name], enumerable: true });
+    };
+    var __copyProps2 = (to, from, except, desc) => {
+      if (from && typeof from === "object" || typeof from === "function") {
+        for (let key of __getOwnPropNames2(from))
+          if (!__hasOwnProp2.call(to, key) && key !== except)
+            __defProp2(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc2(from, key)) || desc.enumerable });
+      }
+      return to;
+    };
+    var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
+    var certificatesUtils_exports = {};
+    __export2(certificatesUtils_exports, {
+      canParseAsX509Certificate: () => canParseAsX509Certificate,
+      extractPemCertificateKeys: () => extractPemCertificateKeys
+    });
+    module2.exports = __toCommonJS2(certificatesUtils_exports);
+    var import_crypto = require("crypto");
+    function extractPemCertificateKeys(pemContent) {
+      const certificatePattern = /(-+BEGIN CERTIFICATE-+)(\n\r?|\r\n?)([A-Za-z0-9+/\n\r]+=*)(\n\r?|\r\n?)(-+END CERTIFICATE-+)/g;
+      const publicKeys = [];
+      let match;
+      do {
+        match = certificatePattern.exec(pemContent);
+        if (match) {
+          publicKeys.push(match[3]);
+        }
+      } while (match);
+      if (publicKeys.length === 0) {
+        throw new Error("The file at the specified path does not contain a PEM-encoded certificate.");
+      }
+      return publicKeys;
+    }
+    function canParseAsX509Certificate(pemCert) {
+      try {
+        const pemContents = extractPemCertificateKeys(pemCert);
+        for (let i = 0; i < pemContents.length; i++) {
+          const pemContent = pemContents[i];
+          const fullPemCertificate = `-----BEGIN CERTIFICATE-----
+${pemContent}
+-----END CERTIFICATE-----`;
+          new import_crypto.X509Certificate(fullPemCertificate);
+        }
+        return true;
+      } catch (extractError) {
+        return false;
+      }
+    }
+  }
+});
+
 // node_modules/@azure/identity/dist/commonjs/credentials/clientCertificateCredential.js
 var require_clientCertificateCredential = __commonJS({
   "node_modules/@azure/identity/dist/commonjs/credentials/clientCertificateCredential.js"(exports2, module2) {
@@ -34721,6 +34810,7 @@ var require_clientCertificateCredential = __commonJS({
     var import_logging = require_logging();
     var import_promises3 = require("node:fs/promises");
     var import_tracing = require_tracing();
+    var import_certificatesUtils = require_certificatesUtils();
     var credentialName = "ClientCertificateCredential";
     var logger2 = (0, import_logging.credentialLogger)(credentialName);
     var ClientCertificateCredential2 = class {
@@ -34757,8 +34847,7 @@ var require_clientCertificateCredential = __commonJS({
         }
         this.msalClient = (0, import_msalClient.createMsalClient)(clientId, tenantId, {
           ...options,
-          logger: logger2,
-          tokenCredentialOptions: options
+          logger: logger2
         });
       }
       /**
@@ -34813,18 +34902,7 @@ var require_clientCertificateCredential = __commonJS({
       const certificatePath = certificateConfiguration.certificatePath;
       const certificateContents = certificate || await (0, import_promises3.readFile)(certificatePath, "utf8");
       const x5c = sendCertificateChain ? certificateContents : void 0;
-      const certificatePattern = /(-+BEGIN CERTIFICATE-+)(\n\r?|\r\n?)([A-Za-z0-9+/\n\r]+=*)(\n\r?|\r\n?)(-+END CERTIFICATE-+)/g;
-      const publicKeys = [];
-      let match;
-      do {
-        match = certificatePattern.exec(certificateContents);
-        if (match) {
-          publicKeys.push(match[3]);
-        }
-      } while (match);
-      if (publicKeys.length === 0) {
-        throw new Error("The file at the specified path does not contain a PEM-encoded certificate.");
-      }
+      const publicKeys = (0, import_certificatesUtils.extractPemCertificateKeys)(certificateContents);
       const thumbprint = (0, import_node_crypto.createHash)("sha1").update(Buffer.from(publicKeys[0], "base64")).digest("hex").toUpperCase();
       const thumbprintSha256 = (0, import_node_crypto.createHash)("sha256").update(Buffer.from(publicKeys[0], "base64")).digest("hex").toUpperCase();
       return {
@@ -34951,8 +35029,7 @@ var require_clientSecretCredential = __commonJS({
         );
         this.msalClient = (0, import_msalClient.createMsalClient)(clientId, tenantId, {
           ...options,
-          logger: logger2,
-          tokenCredentialOptions: options
+          logger: logger2
         });
       }
       /**
@@ -35060,8 +35137,7 @@ var require_usernamePasswordCredential = __commonJS({
         this.username = username;
         this.password = password;
         this.msalClient = (0, import_msalClient.createMsalClient)(clientId, this.tenantId, {
-          ...options,
-          tokenCredentialOptions: options ?? {}
+          ...options
         });
       }
       /**
@@ -35147,8 +35223,8 @@ var require_environmentCredential = __commonJS({
       "AZURE_CLIENT_SEND_CERTIFICATE_CHAIN"
     ];
     function getAdditionallyAllowedTenants() {
-      const additionallyAllowedValues = process.env.AZURE_ADDITIONALLY_ALLOWED_TENANTS ?? "";
-      return additionallyAllowedValues.split(";");
+      const additionallyAllowedValues = process.env.AZURE_ADDITIONALLY_ALLOWED_TENANTS;
+      return additionallyAllowedValues ? additionallyAllowedValues.split(";") : void 0;
     }
     var credentialName = "EnvironmentCredential";
     var logger2 = (0, import_logging.credentialLogger)(credentialName);
@@ -35191,9 +35267,13 @@ var require_environmentCredential = __commonJS({
         const assigned = (0, import_logging.processEnvVars)(AllSupportedEnvironmentVariables).assigned.join(", ");
         logger2.info(`Found the following environment variables: ${assigned}`);
         const tenantId = process.env.AZURE_TENANT_ID, clientId = process.env.AZURE_CLIENT_ID, clientSecret = process.env.AZURE_CLIENT_SECRET;
-        const additionallyAllowedTenantIds = getAdditionallyAllowedTenants();
+        const additionallyAllowedTenants = options?.additionallyAllowedTenants ?? getAdditionallyAllowedTenants();
         const sendCertificateChain = getSendCertificateChain();
-        const newOptions = { ...options, additionallyAllowedTenantIds, sendCertificateChain };
+        const newOptions = {
+          ...options,
+          additionallyAllowedTenants,
+          sendCertificateChain
+        };
         if (tenantId) {
           (0, import_tenantIdUtils.checkTenantId)(logger2, tenantId);
         }
@@ -35493,9 +35573,8 @@ var require_clientAssertionCredential = __commonJS({
         this.options = options;
         this.getAssertion = getAssertion;
         this.msalClient = (0, import_msalClient.createMsalClient)(clientId, tenantId, {
-          ...options,
-          logger: logger2,
-          tokenCredentialOptions: this.options
+          ...this.options,
+          logger: logger2
         });
       }
       /**
@@ -35553,7 +35632,8 @@ var require_workloadIdentityCredential = __commonJS({
     var workloadIdentityCredential_exports = {};
     __export2(workloadIdentityCredential_exports, {
       SupportedWorkloadEnvironmentVariables: () => SupportedWorkloadEnvironmentVariables,
-      WorkloadIdentityCredential: () => WorkloadIdentityCredential2
+      WorkloadIdentityCredential: () => WorkloadIdentityCredential2,
+      parseAndValidateCustomTokenProxy: () => parseAndValidateCustomTokenProxy
     });
     module2.exports = __toCommonJS2(workloadIdentityCredential_exports);
     var import_logging = require_logging();
@@ -35561,6 +35641,9 @@ var require_workloadIdentityCredential = __commonJS({
     var import_errors = require_errors2();
     var import_tenantIdUtils = require_tenantIdUtils();
     var import_promises3 = require("node:fs/promises");
+    var import_core_rest_pipeline = require_commonjs6();
+    var import_certificatesUtils = require_certificatesUtils();
+    var import_node_fs4 = require("node:fs");
     var credentialName = "WorkloadIdentityCredential";
     var SupportedWorkloadEnvironmentVariables = [
       "AZURE_TENANT_ID",
@@ -35568,11 +35651,77 @@ var require_workloadIdentityCredential = __commonJS({
       "AZURE_FEDERATED_TOKEN_FILE"
     ];
     var logger2 = (0, import_logging.credentialLogger)(credentialName);
+    var ErrorMessages = {
+      FAILED_TO_PARSE_TOKEN_PROXY: (endpoint, error) => `Failed to parse custom token proxy URL "${endpoint}": ${error}`,
+      INVALID_HTTPS_SCHEME: (protocol) => `Custom token endpoint must use https scheme, got "${protocol}"`,
+      TOKEN_ENDPOINT_NO_USER_INFO: (url) => `Custom token endpoint URL "${url}" must not contain user info`,
+      TOKEN_ENDPOINT_NO_QUERY: (url) => `Custom token endpoint URL "${url}" must not contain a query`,
+      TOKEN_ENDPOINT_NO_FRAGMENT: (url) => `Custom token endpoint URL "${url}" must not contain a fragment`,
+      CA_FILE_EMPTY: (file) => `CA certificate file is empty: ${file}`,
+      FAILED_TO_READ_CA_FILE: (file, error) => `Failed to read CA certificate file: ${file}. ${error}`,
+      INVALID_CA_CERTIFICATES: `Invalid CA certificate data: no valid PEM certificates found`,
+      INVALID_FILE_PATH: (path3) => `Invalid file path provided ${path3}.`,
+      NO_FILE_CONTENT: (path3) => `No content on the file ${path3}.`,
+      NO_CA_SOURCE: `No CA certificate source specified.`,
+      CLIENT_ID_REQUIRED: `clientId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_CLIENT_ID".
+        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,
+      TENANT_ID_REQUIRED: `tenantId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_TENANT_ID".
+        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,
+      TOKEN_FILE_PATH_REQUIRED: `federatedTokenFilePath is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_FEDERATED_TOKEN_FILE".
+        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`,
+      TOKEN_PROXY_NOT_SET: `AZURE_KUBERNETES_TOKEN_PROXY is not set but other custom endpoint-related environment variables are present`,
+      CA_FILE_AND_DATA_EXCLUSIVE: `AZURE_KUBERNETES_CA_FILE and AZURE_KUBERNETES_CA_DATA are mutually exclusive. Specify only one.`,
+      MISSING_ENV_VARS: `tenantId, clientId, and federatedTokenFilePath are required parameters. 
+      In DefaultAzureCredential and ManagedIdentityCredential, these can be provided as environment variables - 
+      "AZURE_TENANT_ID",
+      "AZURE_CLIENT_ID",
+      "AZURE_FEDERATED_TOKEN_FILE". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
+    };
+    function parseAndValidateCustomTokenProxy(endpoint) {
+      let tokenProxy;
+      try {
+        tokenProxy = new URL(endpoint);
+      } catch (error) {
+        throw new import_errors.CredentialUnavailableError(
+          `${credentialName}: is unavailable. ${ErrorMessages.FAILED_TO_PARSE_TOKEN_PROXY(endpoint, error)}`
+        );
+      }
+      if (tokenProxy.protocol !== "https:") {
+        throw new import_errors.CredentialUnavailableError(
+          `${credentialName}: is unavailable. ${ErrorMessages.INVALID_HTTPS_SCHEME(tokenProxy.protocol)}`
+        );
+      }
+      if (tokenProxy.username || tokenProxy.password) {
+        throw new import_errors.CredentialUnavailableError(
+          `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_ENDPOINT_NO_USER_INFO(tokenProxy.toString())}`
+        );
+      }
+      if (tokenProxy.search) {
+        throw new import_errors.CredentialUnavailableError(
+          `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_ENDPOINT_NO_QUERY(tokenProxy.toString())}`
+        );
+      }
+      if (tokenProxy.hash) {
+        throw new import_errors.CredentialUnavailableError(
+          `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_ENDPOINT_NO_FRAGMENT(tokenProxy.toString())}`
+        );
+      }
+      if (!tokenProxy.pathname || tokenProxy.pathname === "") {
+        tokenProxy.pathname = "/";
+      }
+      return tokenProxy.toString();
+    }
     var WorkloadIdentityCredential2 = class {
       client;
       azureFederatedTokenFileContent = void 0;
       cacheDate = void 0;
       federatedTokenFilePath;
+      // AKS proxy CA caching - persists across token requests
+      cachedTlsSettings;
+      cachedCaData;
+      caData;
+      caFile;
+      sniName;
       /**
        * WorkloadIdentityCredential supports Microsoft Entra Workload ID on Kubernetes.
        *
@@ -35590,22 +35739,48 @@ var require_workloadIdentityCredential = __commonJS({
         }
         if (!clientId) {
           throw new import_errors.CredentialUnavailableError(
-            `${credentialName}: is unavailable. clientId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_CLIENT_ID".
-        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
+            `${credentialName}: is unavailable. ${ErrorMessages.CLIENT_ID_REQUIRED}`
           );
         }
         if (!tenantId) {
           throw new import_errors.CredentialUnavailableError(
-            `${credentialName}: is unavailable. tenantId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_TENANT_ID".
-        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
+            `${credentialName}: is unavailable. ${ErrorMessages.TENANT_ID_REQUIRED}`
           );
         }
         if (!this.federatedTokenFilePath) {
           throw new import_errors.CredentialUnavailableError(
-            `${credentialName}: is unavailable. federatedTokenFilePath is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_FEDERATED_TOKEN_FILE".
-        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
+            `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_FILE_PATH_REQUIRED}`
           );
         }
+        if (workloadIdentityCredentialOptions.enableAzureProxy) {
+          const kubernetesTokenProxy = process.env.AZURE_KUBERNETES_TOKEN_PROXY;
+          const kubernetesSNIName = process.env.AZURE_KUBERNETES_SNI_NAME;
+          const kubernetesCAFile = process.env.AZURE_KUBERNETES_CA_FILE;
+          const kubernetesCAData = process.env.AZURE_KUBERNETES_CA_DATA;
+          if (!kubernetesTokenProxy) {
+            if (kubernetesSNIName || kubernetesCAFile || kubernetesCAData) {
+              throw new import_errors.CredentialUnavailableError(
+                `${credentialName}: is unavailable. ${ErrorMessages.TOKEN_PROXY_NOT_SET}`
+              );
+            }
+            logger2.info(
+              `enableAzureProxy is true but AZURE_KUBERNETES_TOKEN_PROXY is not set, using normal authentication flow`
+            );
+          } else {
+            const tokenProxy = parseAndValidateCustomTokenProxy(kubernetesTokenProxy);
+            if (kubernetesCAFile && kubernetesCAData) {
+              throw new import_errors.CredentialUnavailableError(
+                `${credentialName}: is unavailable. ${ErrorMessages.CA_FILE_AND_DATA_EXCLUSIVE}`
+              );
+            }
+            this.caData = kubernetesCAData;
+            this.caFile = kubernetesCAFile;
+            this.sniName = kubernetesSNIName;
+            const proxyClient = this.createAksProxyClient(tokenProxy);
+            workloadIdentityCredentialOptions.httpClient = proxyClient;
+            logger2.info(`${credentialName}: Using proxy client for token requests`);
+          }
+        }
         logger2.info(
           `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`
         );
@@ -35613,9 +35788,90 @@ var require_workloadIdentityCredential = __commonJS({
           tenantId,
           clientId,
           this.readFileContents.bind(this),
-          options
+          workloadIdentityCredentialOptions
         );
       }
+      /**
+       * Creates a proxy HttpClient that intercepts token requests and redirects them to the Kubernetes endpoint
+       * Caching is handled at the credential level to persist across token requests
+       */
+      createAksProxyClient(tokenEndpoint) {
+        const defaultClient = (0, import_core_rest_pipeline.createDefaultHttpClient)();
+        this.cachedTlsSettings = this.getTlsSettings();
+        return {
+          sendRequest: async (request) => {
+            const requestUrl = new URL(request.url);
+            logger2.info(
+              `${credentialName}: Redirecting request to Kubernetes endpoint: ${tokenEndpoint}`
+            );
+            const proxyUrl = new URL(tokenEndpoint);
+            const requestPath = requestUrl.pathname.replace(/^\//, "");
+            const combinedPath = proxyUrl.pathname.endsWith("/") ? proxyUrl.pathname + requestPath : proxyUrl.pathname + "/" + requestPath;
+            const newUrl = new URL(proxyUrl.origin);
+            newUrl.pathname = combinedPath;
+            newUrl.search = requestUrl.search;
+            newUrl.hash = requestUrl.hash;
+            request.url = newUrl.toString();
+            request.tlsSettings = this.getTlsSettings();
+            logger2.info(`${credentialName}: Sending request to ${request.url}`);
+            return defaultClient.sendRequest(request);
+          }
+        };
+      }
+      /**
+       * Gets TLS settings for the request.
+       * Handles a few scenarios with CA data or CA file provided.
+       */
+      getTlsSettings() {
+        if (!this.caData && !this.caFile) {
+          if (!this.cachedTlsSettings) {
+            this.cachedTlsSettings = this.sniName ? { servername: this.sniName } : {};
+          }
+          return this.cachedTlsSettings;
+        }
+        if (!this.caFile) {
+          if (!this.cachedTlsSettings) {
+            if (!(0, import_certificatesUtils.canParseAsX509Certificate)(this.caData)) {
+              throw new import_errors.CredentialUnavailableError(
+                `${credentialName}: is unavailable. ${ErrorMessages.INVALID_CA_CERTIFICATES}`
+              );
+            }
+            this.cachedTlsSettings = this.sniName ? { servername: this.sniName } : {};
+            this.cachedTlsSettings.ca = this.caData;
+          }
+          return this.cachedTlsSettings;
+        }
+        let fileContent;
+        try {
+          fileContent = (0, import_node_fs4.readFileSync)(this.caFile);
+        } catch (error) {
+          throw new import_errors.CredentialUnavailableError(
+            `${credentialName}: is unavailable. ${ErrorMessages.FAILED_TO_READ_CA_FILE(this.caFile, error)}`
+          );
+        }
+        if (fileContent.length === 0) {
+          if (!this.cachedTlsSettings) {
+            throw new import_errors.CredentialUnavailableError(
+              `${credentialName}: is unavailable. ${ErrorMessages.CA_FILE_EMPTY(this.caFile)}`
+            );
+          }
+          return this.cachedTlsSettings;
+        }
+        if (!this.cachedCaData || !fileContent.equals(this.cachedCaData)) {
+          const caDataString = fileContent.toString("utf8");
+          if (!(0, import_certificatesUtils.canParseAsX509Certificate)(caDataString)) {
+            throw new import_errors.CredentialUnavailableError(
+              `${credentialName}: is unavailable. ${ErrorMessages.INVALID_CA_CERTIFICATES}`
+            );
+          }
+          this.cachedTlsSettings = {
+            ca: caDataString,
+            ...this.sniName && { servername: this.sniName }
+          };
+          this.cachedCaData = fileContent;
+        }
+        return this.cachedTlsSettings;
+      }
       /**
        * Authenticates with Microsoft Entra ID and returns an access token if successful.
        * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
@@ -35626,11 +35882,7 @@ var require_workloadIdentityCredential = __commonJS({
        */
       async getToken(scopes, options) {
         if (!this.client) {
-          const errorMessage = `${credentialName}: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters. 
-      In DefaultAzureCredential and ManagedIdentityCredential, these can be provided as environment variables - 
-      "AZURE_TENANT_ID",
-      "AZURE_CLIENT_ID",
-      "AZURE_FEDERATED_TOKEN_FILE". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`;
+          const errorMessage = `${credentialName}: is unavailable. ${ErrorMessages.MISSING_ENV_VARS}`;
           logger2.info(errorMessage);
           throw new import_errors.CredentialUnavailableError(errorMessage);
         }
@@ -35643,7 +35895,7 @@ var require_workloadIdentityCredential = __commonJS({
         }
         if (!this.federatedTokenFilePath) {
           throw new import_errors.CredentialUnavailableError(
-            `${credentialName}: is unavailable. Invalid file path provided ${this.federatedTokenFilePath}.`
+            `${credentialName}: is unavailable. ${ErrorMessages.INVALID_FILE_PATH(this.federatedTokenFilePath)}`
           );
         }
         if (!this.azureFederatedTokenFileContent) {
@@ -35651,7 +35903,7 @@ var require_workloadIdentityCredential = __commonJS({
           const value = file.trim();
           if (!value) {
             throw new import_errors.CredentialUnavailableError(
-              `${credentialName}: is unavailable. No content on the file ${this.federatedTokenFilePath}.`
+              `${credentialName}: is unavailable. ${ErrorMessages.NO_FILE_CONTENT(this.federatedTokenFilePath)}`
             );
           } else {
             this.azureFederatedTokenFileContent = value;
@@ -36141,7 +36393,7 @@ var require_resolveExecutable = __commonJS({
     });
     module2.exports = __toCommonJS2(resolveExecutable_exports);
     var import_node_fs4 = require("node:fs");
-    var import_node_path2 = __toESM2(require("node:path"));
+    var import_node_path3 = __toESM2(require("node:path"));
     var import_node_url2 = require("node:url");
     var import_errors = require_errors3();
     var WINDOWS_NATIVE_EXTENSIONS = [".exe", ".com"];
@@ -36189,7 +36441,7 @@ var require_resolveExecutable = __commonJS({
     }
     function normalizeCwd(cwd) {
       const cwdPath = cwd instanceof URL ? (0, import_node_url2.fileURLToPath)(cwd) : cwd;
-      return import_node_path2.default.resolve(cwdPath ?? process.cwd());
+      return import_node_path3.default.resolve(cwdPath ?? process.cwd());
     }
     function createProcessContext(options = {}) {
       if (options.allowWindowsBatchFiles !== void 0 && typeof options.allowWindowsBatchFiles !== "boolean") {
@@ -36223,7 +36475,7 @@ var require_resolveExecutable = __commonJS({
       return WINDOWS_BATCH_EXTENSIONS.some((candidate) => candidate === extension);
     }
     function resolveWindowsCandidate(candidate, allowWindowsBatchFiles) {
-      const extension = import_node_path2.default.extname(candidate).toLowerCase();
+      const extension = import_node_path3.default.extname(candidate).toLowerCase();
       if (extension) {
         if (!isNativeExtension(extension) && !(allowWindowsBatchFiles && isBatchExtension(extension))) {
           return void 0;
@@ -36250,7 +36502,7 @@ var require_resolveExecutable = __commonJS({
       const pathValue = getEnvironmentValue(context.env, "PATH") ?? "";
       const paths = [];
       const seen = /* @__PURE__ */ new Set();
-      for (const entry of pathValue.split(import_node_path2.default.delimiter)) {
+      for (const entry of pathValue.split(import_node_path3.default.delimiter)) {
         let candidate = entry;
         if (process.platform === "win32") {
           candidate = candidate.trim();
@@ -36258,10 +36510,10 @@ var require_resolveExecutable = __commonJS({
             candidate = candidate.slice(1, -1);
           }
         }
-        if (!candidate || !import_node_path2.default.isAbsolute(candidate)) {
+        if (!candidate || !import_node_path3.default.isAbsolute(candidate)) {
           continue;
         }
-        const normalized = import_node_path2.default.resolve(candidate);
+        const normalized = import_node_path3.default.resolve(candidate);
         const key = process.platform === "win32" ? normalized.toLowerCase() : normalized;
         if (!seen.has(key)) {
           seen.add(key);
@@ -36287,8 +36539,8 @@ var require_resolveExecutable = __commonJS({
     }
     function resolveExecutableWithContext(command, context) {
       validateCommand(command);
-      if (hasPathSeparator(command) || import_node_path2.default.isAbsolute(command)) {
-        const candidate = import_node_path2.default.resolve(context.cwd, command);
+      if (hasPathSeparator(command) || import_node_path3.default.isAbsolute(command)) {
+        const candidate = import_node_path3.default.resolve(context.cwd, command);
         if (process.platform === "win32") {
           return resolveWindowsCandidate(candidate, context.allowWindowsBatchFiles);
         }
@@ -36297,20 +36549,20 @@ var require_resolveExecutable = __commonJS({
       const searchPaths = getSearchPaths(context);
       if (process.platform !== "win32") {
         for (const searchPath of searchPaths) {
-          const candidate = import_node_path2.default.join(searchPath, command);
+          const candidate = import_node_path3.default.join(searchPath, command);
           if (isExecutableFile(candidate)) {
             return candidate;
           }
         }
         return void 0;
       }
-      const extension = import_node_path2.default.extname(command).toLowerCase();
+      const extension = import_node_path3.default.extname(command).toLowerCase();
       if (extension) {
         if (!isNativeExtension(extension) && !(context.allowWindowsBatchFiles && isBatchExtension(extension))) {
           return void 0;
         }
         for (const searchPath of searchPaths) {
-          const candidate = import_node_path2.default.join(searchPath, command);
+          const candidate = import_node_path3.default.join(searchPath, command);
           if (isExecutableFile(candidate)) {
             return candidate;
           }
@@ -36319,7 +36571,7 @@ var require_resolveExecutable = __commonJS({
       }
       for (const searchPath of searchPaths) {
         for (const nativeExtension of WINDOWS_NATIVE_EXTENSIONS) {
-          const candidate = import_node_path2.default.join(searchPath, command + nativeExtension);
+          const candidate = import_node_path3.default.join(searchPath, command + nativeExtension);
           if (isExecutableFile(candidate)) {
             return candidate;
           }
@@ -36328,7 +36580,7 @@ var require_resolveExecutable = __commonJS({
       if (context.allowWindowsBatchFiles) {
         for (const searchPath of searchPaths) {
           for (const batchExtension of WINDOWS_BATCH_EXTENSIONS) {
-            const candidate = import_node_path2.default.join(searchPath, command + batchExtension);
+            const candidate = import_node_path3.default.join(searchPath, command + batchExtension);
             if (isExecutableFile(candidate)) {
               return candidate;
             }
@@ -36344,7 +36596,7 @@ var require_resolveExecutable = __commonJS({
       try {
         return import_node_fs4.realpathSync.native(filePath).toLowerCase();
       } catch {
-        return import_node_path2.default.resolve(filePath).toLowerCase();
+        return import_node_path3.default.resolve(filePath).toLowerCase();
       }
     }
     function isWindowsDriveAbsolutePath(filePath) {
@@ -36358,7 +36610,7 @@ var require_resolveExecutable = __commonJS({
           code: "ERR_UNTRUSTED_COMMAND_INTERPRETER"
         });
       }
-      const executablePath = import_node_path2.default.join(systemRoot, "System32", "cmd.exe");
+      const executablePath = import_node_path3.default.join(systemRoot, "System32", "cmd.exe");
       if (!isExecutableFile(executablePath)) {
         throw new import_errors.ProcessError("The Windows command interpreter could not be found.", {
           code: "ERR_UNTRUSTED_COMMAND_INTERPRETER"
@@ -36424,7 +36676,7 @@ var require_normalizeCommand = __commonJS({
       normalizeCommand: () => normalizeCommand
     });
     module2.exports = __toCommonJS2(normalizeCommand_exports);
-    var import_node_path2 = __toESM2(require("node:path"));
+    var import_node_path3 = __toESM2(require("node:path"));
     var import_errors = require_errors3();
     var import_resolveExecutable = require_resolveExecutable();
     var UNSAFE_BATCH_ARGUMENT = /[%!^&|<>()]/;
@@ -36488,7 +36740,7 @@ var require_normalizeCommand = __commonJS({
           windowsVerbatimArguments: false
         };
       }
-      const extension = import_node_path2.default.extname(resolvedPath).toLowerCase();
+      const extension = import_node_path3.default.extname(resolvedPath).toLowerCase();
       if (extension === ".exe" || extension === ".com") {
         return {
           executable: resolvedPath,
@@ -36562,12 +36814,12 @@ var require_process = __commonJS({
     var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
     var process_exports = {};
     __export2(process_exports, {
-      execFile: () => execFile7,
+      execFile: () => execFile8,
       spawn: () => spawn2,
       spawnSync: () => spawnSync2
     });
     module2.exports = __toCommonJS2(process_exports);
-    var childProcess2 = __toESM2(require("node:child_process"));
+    var childProcess4 = __toESM2(require("node:child_process"));
     var import_errors = require_errors3();
     var import_normalizeCommand = require_normalizeCommand();
     var import_resolveExecutable = require_resolveExecutable();
@@ -36650,7 +36902,7 @@ var require_process = __commonJS({
     function spawn2(command, args = [], options = {}) {
       const prepared = prepareProcess(command, args, options, spawnOptionNames);
       const child = callWithSanitizedChildProcessErrors(
-        () => childProcess2.spawn(prepared.command.executable, prepared.command.args, {
+        () => childProcess4.spawn(prepared.command.executable, prepared.command.args, {
           ...prepared.nodeOptions,
           cwd: prepared.command.cwd,
           env: prepared.command.env,
@@ -36663,7 +36915,7 @@ var require_process = __commonJS({
     function spawnSync2(command, args = [], options = {}) {
       const prepared = prepareProcess(command, args, options, spawnSyncOptionNames);
       const result = callWithSanitizedChildProcessErrors(
-        () => childProcess2.spawnSync(prepared.command.executable, prepared.command.args, {
+        () => childProcess4.spawnSync(prepared.command.executable, prepared.command.args, {
           ...prepared.nodeOptions,
           cwd: prepared.command.cwd,
           env: prepared.command.env,
@@ -36679,11 +36931,11 @@ var require_process = __commonJS({
       }
       return result;
     }
-    async function execFile7(command, args = [], options = {}) {
+    async function execFile8(command, args = [], options = {}) {
       const prepared = prepareProcess(command, args, options, execFileOptionNames);
       return new Promise((resolve, reject) => {
         callWithSanitizedChildProcessErrors(
-          () => childProcess2.execFile(
+          () => childProcess4.execFile(
             prepared.command.executable,
             prepared.command.args,
             {
@@ -36845,6 +37097,7 @@ var require_azureDeveloperCliCredential = __commonJS({
     var import_tenantIdUtils = require_tenantIdUtils();
     var import_tracing = require_tracing();
     var import_scopeUtils = require_scopeUtils();
+    var import_core_util = require_commonjs4();
     var import_processUtils = require_processUtils();
     var logger2 = (0, import_logging.credentialLogger)("AzureDeveloperCliCredential");
     var azureDeveloperCliPublicErrorMessages = {
@@ -36854,6 +37107,51 @@ var require_azureDeveloperCliCredential = __commonJS({
       claim: "This credential doesn't support claims challenges. To authenticate with the required claims, please run the following command:"
     };
     var developerCliCredentialInternals = {
+      /**
+       * Parses azd stderr JSON output to extract a human-readable error message.
+       *
+       * Three formats are supported across azd versions:
+       * - pre-v1.23.7: `{"type":"consoleMessage","data":{"message":"..."}}`
+       * - v1.23.7 - v1.23.15: an empty `consoleMessage` line followed by `{"error":"...","message":"...","suggestion":"..."}`
+       * - v1.24.0+: `{"error":"...","message":"...","suggestion":"..."}`
+       *
+       * The structured `error` field is preferred. If absent, falls back to the
+       * first non-empty `data.message` from a legacy `consoleMessage` line. If
+       * neither is found, the raw stderr is returned unchanged so plain-text and
+       * malformed output continue to surface to callers.
+       *
+       * @param stderr - The stderr output from azd command
+       * @returns The parsed error message or raw stderr
+       * @internal
+       */
+      parseAzdStderr(stderr) {
+        if (!stderr?.trim()) {
+          return stderr;
+        }
+        let fallback;
+        for (const rawLine of stderr.split("\n")) {
+          const line = rawLine.trim();
+          if (!line.startsWith("{")) {
+            continue;
+          }
+          let parsed;
+          try {
+            parsed = JSON.parse(line);
+          } catch {
+            continue;
+          }
+          if (typeof parsed?.error === "string" && parsed.error.trim()) {
+            return parsed.error.trim();
+          }
+          if (fallback === void 0) {
+            const message = parsed?.data?.message;
+            if (typeof message === "string" && message.trim()) {
+              fallback = message.trim();
+            }
+          }
+        }
+        return fallback ?? stderr;
+      },
       /**
        * @internal
        */
@@ -36883,7 +37181,7 @@ var require_azureDeveloperCliCredential = __commonJS({
         }
         let claimsSections = [];
         if (claims) {
-          const encodedClaims = btoa(claims);
+          const encodedClaims = (0, import_core_util.uint8ArrayToString)((0, import_core_util.stringToUint8Array)(claims, "utf-8"), "base64");
           claimsSections = ["--claims", encodedClaims];
         }
         const args = [
@@ -36995,7 +37293,8 @@ var require_azureDeveloperCliCredential = __commonJS({
               };
             } catch (e) {
               if (obj.stderr) {
-                throw new import_errors.CredentialUnavailableError(obj.stderr);
+                const errorMessage = developerCliCredentialInternals.parseAzdStderr(obj.stderr);
+                throw new import_errors.CredentialUnavailableError(errorMessage);
               }
               throw e;
             }
@@ -37081,6 +37380,7 @@ var require_azureCliCredential = __commonJS({
     var import_logging = require_logging();
     var import_scopeUtils = require_scopeUtils();
     var import_errors = require_errors2();
+    var import_core_util = require_commonjs4();
     var import_tracing = require_tracing();
     var import_subscriptionUtils = require_subscriptionUtils();
     var import_processUtils = require_processUtils();
@@ -37182,7 +37482,7 @@ var require_azureCliCredential = __commonJS({
         const scope = typeof scopes === "string" ? scopes : scopes[0];
         const claimsValue = options.claims;
         if (claimsValue && claimsValue.trim()) {
-          const encodedClaims = btoa(claimsValue);
+          const encodedClaims = (0, import_core_util.uint8ArrayToString)((0, import_core_util.stringToUint8Array)(claimsValue, "utf-8"), "base64");
           let loginCmd = `az login --claims-challenge ${encodedClaims} --scope ${scope}`;
           const tenantIdFromOptions = options.tenantId;
           if (tenantIdFromOptions) {
@@ -37324,6 +37624,7 @@ var require_azurePowerShellCredential = __commonJS({
     var import_errors = require_errors2();
     var import_processUtils = require_processUtils();
     var import_tracing = require_tracing();
+    var import_core_util = require_commonjs4();
     var logger2 = (0, import_logging.credentialLogger)("AzurePowerShellCredential");
     var isWindows = process.platform === "win32";
     var powerShellResourceEnvironmentVariable = "AZURE_IDENTITY_POWERSHELL_RESOURCE";
@@ -37488,7 +37789,10 @@ var require_azurePowerShellCredential = __commonJS({
           const scope = typeof scopes === "string" ? scopes : scopes[0];
           const claimsValue = options.claims;
           if (claimsValue && claimsValue.trim()) {
-            const encodedClaims = btoa(claimsValue);
+            const encodedClaims = (0, import_core_util.uint8ArrayToString)(
+              (0, import_core_util.stringToUint8Array)(claimsValue, "utf-8"),
+              "base64"
+            );
             let loginCmd = `Connect-AzAccount -ClaimsChallenge ${encodedClaims}`;
             const tenantIdFromOptions = options.tenantId;
             if (tenantIdFromOptions) {
@@ -37779,7 +38083,6 @@ var require_brokerCredential = __commonJS({
         );
         const msalClientOptions = {
           ...options,
-          tokenCredentialOptions: options,
           logger: logger2,
           brokerOptions: {
             enabled: true,
@@ -38145,7 +38448,6 @@ var require_interactiveBrowserCredential = __commonJS({
         );
         const msalClientOptions = {
           ...options,
-          tokenCredentialOptions: options,
           logger: logger2
         };
         const ibcNodeOptions = options;
@@ -38313,8 +38615,7 @@ var require_deviceCodeCredential = __commonJS({
         this.userPromptCallback = options?.userPromptCallback ?? defaultDeviceCodePromptCallback;
         this.msalClient = (0, import_msalClient.createMsalClient)(clientId, tenantId, {
           ...options,
-          logger: logger2,
-          tokenCredentialOptions: options || {}
+          logger: logger2
         });
         this.disableAutomaticAuthentication = options?.disableAutomaticAuthentication;
       }
@@ -38634,8 +38935,7 @@ var require_authorizationCodeCredential = __commonJS({
         );
         this.msalClient = (0, import_msalClient.createMsalClient)(clientId, tenantId, {
           ...options,
-          logger: logger2,
-          tokenCredentialOptions: options ?? {}
+          logger: logger2
         });
       }
       /**
@@ -38760,8 +39060,7 @@ var require_onBehalfOfCredential = __commonJS({
         );
         this.msalClient = (0, import_msalClient.createMsalClient)(clientId, this.tenantId, {
           ...options,
-          logger: logger2,
-          tokenCredentialOptions: options
+          logger: logger2
         });
       }
       /**
@@ -39584,206 +39883,17 @@ var require_transient_error_lookup = __commonJS({
   }
 });
 
-// node_modules/sprintf-js/src/sprintf.js
-var require_sprintf = __commonJS({
-  "node_modules/sprintf-js/src/sprintf.js"(exports2) {
-    !(function() {
-      "use strict";
-      var re = {
-        not_string: /[^s]/,
-        not_bool: /[^t]/,
-        not_type: /[^T]/,
-        not_primitive: /[^v]/,
-        number: /[diefg]/,
-        numeric_arg: /[bcdiefguxX]/,
-        json: /[j]/,
-        not_json: /[^j]/,
-        text: /^[^\x25]+/,
-        modulo: /^\x25{2}/,
-        placeholder: /^\x25(?:([1-9]\d*)\$|\(([^)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,
-        key: /^([a-z_][a-z_\d]*)/i,
-        key_access: /^\.([a-z_][a-z_\d]*)/i,
-        index_access: /^\[(\d+)\]/,
-        sign: /^[+-]/
-      };
-      function sprintf(key) {
-        return sprintf_format(sprintf_parse(key), arguments);
-      }
-      function vsprintf(fmt, argv) {
-        return sprintf.apply(null, [fmt].concat(argv || []));
-      }
-      function sprintf_format(parse_tree, argv) {
-        var cursor = 1, tree_length = parse_tree.length, arg, output = "", i, k, ph, pad, pad_character, pad_length, is_positive, sign;
-        for (i = 0; i < tree_length; i++) {
-          if (typeof parse_tree[i] === "string") {
-            output += parse_tree[i];
-          } else if (typeof parse_tree[i] === "object") {
-            ph = parse_tree[i];
-            if (ph.keys) {
-              arg = argv[cursor];
-              for (k = 0; k < ph.keys.length; k++) {
-                if (arg == void 0) {
-                  throw new Error(sprintf('[sprintf] Cannot access property "%s" of undefined value "%s"', ph.keys[k], ph.keys[k - 1]));
-                }
-                arg = arg[ph.keys[k]];
-              }
-            } else if (ph.param_no) {
-              arg = argv[ph.param_no];
-            } else {
-              arg = argv[cursor++];
-            }
-            if (re.not_type.test(ph.type) && re.not_primitive.test(ph.type) && arg instanceof Function) {
-              arg = arg();
-            }
-            if (re.numeric_arg.test(ph.type) && (typeof arg !== "number" && isNaN(arg))) {
-              throw new TypeError(sprintf("[sprintf] expecting number but found %T", arg));
-            }
-            if (re.number.test(ph.type)) {
-              is_positive = arg >= 0;
-            }
-            switch (ph.type) {
-              case "b":
-                arg = parseInt(arg, 10).toString(2);
-                break;
-              case "c":
-                arg = String.fromCharCode(parseInt(arg, 10));
-                break;
-              case "d":
-              case "i":
-                arg = parseInt(arg, 10);
-                break;
-              case "j":
-                arg = JSON.stringify(arg, null, ph.width ? parseInt(ph.width) : 0);
-                break;
-              case "e":
-                arg = ph.precision ? parseFloat(arg).toExponential(ph.precision) : parseFloat(arg).toExponential();
-                break;
-              case "f":
-                arg = ph.precision ? parseFloat(arg).toFixed(ph.precision) : parseFloat(arg);
-                break;
-              case "g":
-                arg = ph.precision ? String(Number(arg.toPrecision(ph.precision))) : parseFloat(arg);
-                break;
-              case "o":
-                arg = (parseInt(arg, 10) >>> 0).toString(8);
-                break;
-              case "s":
-                arg = String(arg);
-                arg = ph.precision ? arg.substring(0, ph.precision) : arg;
-                break;
-              case "t":
-                arg = String(!!arg);
-                arg = ph.precision ? arg.substring(0, ph.precision) : arg;
-                break;
-              case "T":
-                arg = Object.prototype.toString.call(arg).slice(8, -1).toLowerCase();
-                arg = ph.precision ? arg.substring(0, ph.precision) : arg;
-                break;
-              case "u":
-                arg = parseInt(arg, 10) >>> 0;
-                break;
-              case "v":
-                arg = arg.valueOf();
-                arg = ph.precision ? arg.substring(0, ph.precision) : arg;
-                break;
-              case "x":
-                arg = (parseInt(arg, 10) >>> 0).toString(16);
-                break;
-              case "X":
-                arg = (parseInt(arg, 10) >>> 0).toString(16).toUpperCase();
-                break;
-            }
-            if (re.json.test(ph.type)) {
-              output += arg;
-            } else {
-              if (re.number.test(ph.type) && (!is_positive || ph.sign)) {
-                sign = is_positive ? "+" : "-";
-                arg = arg.toString().replace(re.sign, "");
-              } else {
-                sign = "";
-              }
-              pad_character = ph.pad_char ? ph.pad_char === "0" ? "0" : ph.pad_char.charAt(1) : " ";
-              pad_length = ph.width - (sign + arg).length;
-              pad = ph.width ? pad_length > 0 ? pad_character.repeat(pad_length) : "" : "";
-              output += ph.align ? sign + arg + pad : pad_character === "0" ? sign + pad + arg : pad + sign + arg;
-            }
-          }
-        }
-        return output;
-      }
-      var sprintf_cache = /* @__PURE__ */ Object.create(null);
-      function sprintf_parse(fmt) {
-        if (sprintf_cache[fmt]) {
-          return sprintf_cache[fmt];
-        }
-        var _fmt = fmt, match, parse_tree = [], arg_names = 0;
-        while (_fmt) {
-          if ((match = re.text.exec(_fmt)) !== null) {
-            parse_tree.push(match[0]);
-          } else if ((match = re.modulo.exec(_fmt)) !== null) {
-            parse_tree.push("%");
-          } else if ((match = re.placeholder.exec(_fmt)) !== null) {
-            if (match[2]) {
-              arg_names |= 1;
-              var field_list = [], replacement_field = match[2], field_match = [];
-              if ((field_match = re.key.exec(replacement_field)) !== null) {
-                field_list.push(field_match[1]);
-                while ((replacement_field = replacement_field.substring(field_match[0].length)) !== "") {
-                  if ((field_match = re.key_access.exec(replacement_field)) !== null) {
-                    field_list.push(field_match[1]);
-                  } else if ((field_match = re.index_access.exec(replacement_field)) !== null) {
-                    field_list.push(field_match[1]);
-                  } else {
-                    throw new SyntaxError("[sprintf] failed to parse named argument key");
-                  }
-                }
-              } else {
-                throw new SyntaxError("[sprintf] failed to parse named argument key");
-              }
-              match[2] = field_list;
-            } else {
-              arg_names |= 2;
-            }
-            if (arg_names === 3) {
-              throw new Error("[sprintf] mixing positional and named placeholders is not (yet) supported");
-            }
-            parse_tree.push(
-              {
-                placeholder: match[0],
-                param_no: match[1],
-                keys: match[2],
-                sign: match[3],
-                pad_char: match[4],
-                align: match[5],
-                width: match[6],
-                precision: match[7],
-                type: match[8]
-              }
-            );
-          } else {
-            throw new SyntaxError("[sprintf] unexpected placeholder");
-          }
-          _fmt = _fmt.substring(match[0].length);
-        }
-        return sprintf_cache[fmt] = parse_tree;
-      }
-      if (typeof exports2 !== "undefined") {
-        exports2["sprintf"] = sprintf;
-        exports2["vsprintf"] = vsprintf;
-      }
-      if (typeof window !== "undefined") {
-        window["sprintf"] = sprintf;
-        window["vsprintf"] = vsprintf;
-        if (typeof define === "function" && define["amd"]) {
-          define(function() {
-            return {
-              "sprintf": sprintf,
-              "vsprintf": vsprintf
-            };
-          });
-        }
-      }
-    })();
+// node_modules/tedious/lib/format-hex.js
+var require_format_hex = __commonJS({
+  "node_modules/tedious/lib/format-hex.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
+    exports2.formatHex = formatHex;
+    function formatHex(value, width) {
+      return (value >>> 0).toString(16).toUpperCase().padStart(width, "0");
+    }
   }
 });
 
@@ -39797,7 +39907,7 @@ var require_packet = __commonJS({
     exports2.TYPE = exports2.Packet = exports2.OFFSET = exports2.HEADER_LENGTH = void 0;
     exports2.isPacketComplete = isPacketComplete;
     exports2.packetLength = packetLength;
-    var _sprintfJs = require_sprintf();
+    var _formatHex = require_format_hex();
     var HEADER_LENGTH = exports2.HEADER_LENGTH = 8;
     var TYPE = exports2.TYPE = {
       SQL_BATCH: 1,
@@ -39919,7 +40029,8 @@ var require_packet = __commonJS({
         return statuses.join(" ").trim();
       }
       headerToString(indent = "") {
-        const text = (0, _sprintfJs.sprintf)("type:0x%02X(%s), status:0x%02X(%s), length:0x%04X, spid:0x%04X, packetId:0x%02X, window:0x%02X", this.buffer.readUInt8(OFFSET.Type), typeByValue[this.buffer.readUInt8(OFFSET.Type)], this.buffer.readUInt8(OFFSET.Status), this.statusAsString(), this.buffer.readUInt16BE(OFFSET.Length), this.buffer.readUInt16BE(OFFSET.SPID), this.buffer.readUInt8(OFFSET.PacketID), this.buffer.readUInt8(OFFSET.Window));
+        const type = this.buffer.readUInt8(OFFSET.Type);
+        const text = `type:0x${(0, _formatHex.formatHex)(type, 2)}(${typeByValue[type]}), status:0x${(0, _formatHex.formatHex)(this.buffer.readUInt8(OFFSET.Status), 2)}(${this.statusAsString()}), length:0x${(0, _formatHex.formatHex)(this.buffer.readUInt16BE(OFFSET.Length), 4)}, spid:0x${(0, _formatHex.formatHex)(this.buffer.readUInt16BE(OFFSET.SPID), 4)}, packetId:0x${(0, _formatHex.formatHex)(this.buffer.readUInt8(OFFSET.PacketID), 2)}, window:0x${(0, _formatHex.formatHex)(this.buffer.readUInt8(OFFSET.Window), 2)}`;
         return indent + text;
       }
       dataToString(indent = "") {
@@ -39932,7 +40043,7 @@ var require_packet = __commonJS({
         for (let offset = 0; offset < data.length; offset++) {
           if (offset % BYTES_PER_LINE === 0) {
             dataDump += indent;
-            dataDump += (0, _sprintfJs.sprintf)("%04X  ", offset);
+            dataDump += (0, _formatHex.formatHex)(offset, 4) + "  ";
           }
           if (data[offset] < 32 || data[offset] > 126) {
             chars += ".";
@@ -39943,7 +40054,7 @@ var require_packet = __commonJS({
             chars += String.fromCharCode(data[offset]);
           }
           if (data[offset] != null) {
-            dataDump += (0, _sprintfJs.sprintf)("%02X", data[offset]);
+            dataDump += (0, _formatHex.formatHex)(data[offset], 2);
           }
           if ((offset + 1) % BYTES_PER_GROUP === 0 && !((offset + 1) % BYTES_PER_LINE === 0)) {
             dataDump += " ";
@@ -39990,7 +40101,8 @@ var require_prelogin_payload = __commonJS({
       value: true
     });
     exports2.default = void 0;
-    var _sprintfJs = require_sprintf();
+    var _errors = require_errors();
+    var _formatHex = require_format_hex();
     var _writableTrackingBuffer = _interopRequireDefault(require_writable_tracking_buffer());
     var _crypto = require("crypto");
     function _interopRequireDefault(e) {
@@ -40141,6 +40253,7 @@ var require_prelogin_payload = __commonJS({
       }
       extractOptions() {
         let offset = 0;
+        let encryptionOffset;
         while (this.data[offset] !== TOKEN.TERMINATOR) {
           let dataOffset = this.data.readUInt16BE(offset + 1);
           const dataLength = this.data.readUInt16BE(offset + 3);
@@ -40149,6 +40262,13 @@ var require_prelogin_payload = __commonJS({
               this.extractVersion(dataOffset);
               break;
             case TOKEN.ENCRYPTION:
+              if (encryptionOffset !== void 0) {
+                throw new _errors.ConnectionError("Duplicate ENCRYPTION option in PRELOGIN response", "EENCRYPT");
+              }
+              if (dataLength !== 1 || dataOffset >= this.data.length) {
+                throw new _errors.ConnectionError("Malformed ENCRYPTION option in PRELOGIN response", "EENCRYPT");
+              }
+              encryptionOffset = dataOffset;
               this.extractEncryption(dataOffset);
               break;
             case TOKEN.INSTOPT:
@@ -40172,6 +40292,9 @@ var require_prelogin_payload = __commonJS({
           offset += 5;
           dataOffset += dataLength;
         }
+        if (encryptionOffset !== void 0 && encryptionOffset <= offset) {
+          throw new _errors.ConnectionError("Malformed ENCRYPTION option in PRELOGIN response", "EENCRYPT");
+        }
       }
       extractVersion(offset) {
         this.version = {
@@ -40202,7 +40325,13 @@ var require_prelogin_payload = __commonJS({
         this.fedAuthRequired = this.data.readUInt8(offset);
       }
       toString(indent = "") {
-        return indent + "PreLogin - " + (0, _sprintfJs.sprintf)("version:%d.%d.%d.%d, encryption:0x%02X(%s), instopt:0x%02X, threadId:0x%08X, mars:0x%02X(%s), traceId:%s", this.version.major, this.version.minor, this.version.build, this.version.subbuild, this.encryption ? this.encryption : 0, this.encryptionString ? this.encryptionString : "", this.instance ? this.instance : 0, this.threadId ? this.threadId : 0, this.mars ? this.mars : 0, this.marsString ? this.marsString : "", this.traceId ? this.traceId.toString("hex") : "");
+        const {
+          major,
+          minor,
+          build,
+          subbuild
+        } = this.version;
+        return indent + `PreLogin - version:${major}.${minor}.${build}.${subbuild}, encryption:0x${(0, _formatHex.formatHex)(this.encryption ? this.encryption : 0, 2)}(${this.encryptionString ? this.encryptionString : ""}), instopt:0x${(0, _formatHex.formatHex)(this.instance ? this.instance : 0, 2)}, threadId:0x${(0, _formatHex.formatHex)(this.threadId ? this.threadId : 0, 8)}, mars:0x${(0, _formatHex.formatHex)(this.mars ? this.mars : 0, 2)}(${this.marsString ? this.marsString : ""}), traceId:${this.traceId ? this.traceId.toString("hex") : ""}`;
       }
     };
     var _default = exports2.default = PreloginPayload;
@@ -40241,7 +40370,7 @@ var require_login7_payload = __commonJS({
       value: true
     });
     exports2.default = void 0;
-    var _sprintfJs = require_sprintf();
+    var _formatHex = require_format_hex();
     var _tdsVersions = require_tds_versions();
     var FLAGS_1 = {
       ENDIAN_LITTLE: 0,
@@ -40559,9 +40688,15 @@ var require_login7_payload = __commonJS({
         return password;
       }
       toString(indent = "") {
-        return indent + "Login7 - " + (0, _sprintfJs.sprintf)("TDS:0x%08X, PacketSize:0x%08X, ClientProgVer:0x%08X, ClientPID:0x%08X, ConnectionID:0x%08X", this.tdsVersion, this.packetSize, this.clientProgVer, this.clientPid, this.connectionId) + "\n" + indent + "         " + (0, _sprintfJs.sprintf)("Flags1:0x%02X, Flags2:0x%02X, TypeFlags:0x%02X, Flags3:0x%02X, ClientTimezone:%d, ClientLCID:0x%08X", this.buildOptionFlags1(), this.buildOptionFlags2(), this.buildTypeFlags(), this.buildOptionFlags3(), this.clientTimeZone, this.clientLcid) + "\n" + indent + "         " + (0, _sprintfJs.sprintf)("Hostname:'%s', Username:'%s', Password:'%s', AppName:'%s', ServerName:'%s', LibraryName:'%s'", this.hostname, this.userName, this.password, this.appName, this.serverName, this.libraryName) + "\n" + indent + "         " + (0, _sprintfJs.sprintf)("Language:'%s', Database:'%s', SSPI:'%s', AttachDbFile:'%s', ChangePassword:'%s'", this.language, this.database, this.sspi, this.attachDbFile, this.changePassword);
+        return indent + `Login7 - TDS:0x${(0, _formatHex.formatHex)(this.tdsVersion, 8)}, PacketSize:0x${(0, _formatHex.formatHex)(this.packetSize, 8)}, ClientProgVer:0x${(0, _formatHex.formatHex)(this.clientProgVer, 8)}, ClientPID:0x${(0, _formatHex.formatHex)(this.clientPid, 8)}, ConnectionID:0x${(0, _formatHex.formatHex)(this.connectionId, 8)}
+` + indent + `         Flags1:0x${(0, _formatHex.formatHex)(this.buildOptionFlags1(), 2)}, Flags2:0x${(0, _formatHex.formatHex)(this.buildOptionFlags2(), 2)}, TypeFlags:0x${(0, _formatHex.formatHex)(this.buildTypeFlags(), 2)}, Flags3:0x${(0, _formatHex.formatHex)(this.buildOptionFlags3(), 2)}, ClientTimezone:${this.clientTimeZone}, ClientLCID:0x${(0, _formatHex.formatHex)(this.clientLcid, 8)}
+` + indent + `         Hostname:'${this.hostname}', Username:'${this.userName}', Password:'${redact(this.password)}', AppName:'${this.appName}', ServerName:'${this.serverName}', LibraryName:'${this.libraryName}'
+` + indent + `         Language:'${this.language}', Database:'${this.database}', SSPI:'${this.sspi}', AttachDbFile:'${this.attachDbFile}', ChangePassword:'${redact(this.changePassword)}'`;
       }
     };
+    function redact(value) {
+      return value === void 0 ? "undefined" : "********";
+    }
     var _default = exports2.default = Login7Payload;
     module2.exports = Login7Payload;
   }
@@ -56650,19 +56785,24 @@ var require_plp_stream = __commonJS({
       }
       buffer.writeBuffer(PLP_TERMINATOR);
     }
-    async function* writePlpStream(buffer, source, encode) {
+    async function* writePlpStream(buffer, source, encode, flush) {
       buffer.writeBuffer(UNKNOWN_PLP_LEN);
-      for await (const chunk of source) {
-        const bytes = encode(chunk);
-        if (bytes.length === 0) {
-          continue;
+      const writeChunk = (bytes) => {
+        if (!bytes || bytes.length === 0) {
+          return false;
         }
         buffer.writeUInt32LE(bytes.length);
         buffer.writeBuffer(bytes);
-        if (buffer.length >= _writableTrackingBuffer.default.CHUNK_SIZE) {
+        return buffer.length >= _writableTrackingBuffer.default.CHUNK_SIZE;
+      };
+      for await (const chunk of source) {
+        if (writeChunk(encode(chunk))) {
           yield;
         }
       }
+      if (writeChunk(flush?.())) {
+        yield;
+      }
       buffer.writeBuffer(PLP_TERMINATOR);
     }
   }
@@ -56742,7 +56882,8 @@ var require_varbinary = __commonJS({
         }
         const value = Buffer.isBuffer(parameter.value) ? parameter.value : parameter.value.toString();
         const length = typeof value === "string" ? value.length * 2 : value.length;
-        if (parameter.length <= this.maximumLength) {
+        const isPlp = !(parameter.length <= this.maximumLength);
+        if (!isPlp) {
           buffer.writeUInt16LE(length);
         } else {
           buffer.writeBuffer(UNKNOWN_PLP_LEN);
@@ -56757,7 +56898,7 @@ var require_varbinary = __commonJS({
         } else {
           buffer.writeBuffer(value);
         }
-        if (parameter.length > this.maximumLength) {
+        if (isPlp) {
           buffer.writeBuffer(PLP_TERMINATOR);
         }
       },
@@ -56810,14 +56951,6 @@ var require_varchar = __commonJS({
     var NULL_LENGTH = Buffer.from([255, 255]);
     var MAX_NULL_LENGTH = Buffer.from([255, 255, 255, 255, 255, 255, 255, 255]);
     var NO_COLLATION = Buffer.from([0, 0, 0, 0, 0]);
-    function encoderFor(codepage) {
-      return (chunk) => {
-        if (typeof chunk !== "string") {
-          throw new TypeError("Invalid string.");
-        }
-        return _iconvLite.default.encode(chunk, codepage);
-      };
-    }
     var VarChar = {
       id: 167,
       type: "BIGVARCHR",
@@ -56915,7 +57048,14 @@ var require_varchar = __commonJS({
           return;
         }
         if ((0, _plpStream.isAsyncIterable)(parameter.value)) {
-          return (0, _plpStream.writePlpStream)(buffer, parameter.value, encoderFor(parameter.collation.codepage));
+          const codepage = parameter.collation.codepage;
+          const encoder = _iconvLite.default.getEncoder(codepage);
+          return (0, _plpStream.writePlpStream)(buffer, parameter.value, (chunk) => {
+            if (typeof chunk !== "string") {
+              throw new TypeError("Invalid string.");
+            }
+            return encoder.write(chunk);
+          }, () => encoder.end());
         }
         const value = parameter.value;
         if (parameter.length <= this.maximumLength) {
@@ -57166,7 +57306,8 @@ var require_nvarchar = __commonJS({
         }
         const value = parameter.value instanceof Buffer ? parameter.value : parameter.value.toString();
         const length = typeof value === "string" ? value.length * 2 : value.length;
-        if (parameter.length <= this.maximumLength) {
+        const isPlp = !(parameter.length <= this.maximumLength);
+        if (!isPlp) {
           buffer.writeUInt16LE(length);
         } else {
           buffer.writeBuffer(UNKNOWN_PLP_LEN);
@@ -57181,7 +57322,7 @@ var require_nvarchar = __commonJS({
         } else {
           buffer.writeBuffer(value);
         }
-        if (parameter.length > this.maximumLength) {
+        if (isPlp) {
           buffer.writeBuffer(PLP_TERMINATOR);
         }
       },
@@ -58337,11 +58478,10 @@ var require_request2 = __commonJS({
        *   request is being sent, so it does not have to fit in memory, and a
        *   request that carries one can be executed only once.
        *
-       *   Each chunk of a string source is encoded on its own, as `Writable.write`
-       *   would encode it, so a chunk must not end halfway through a UTF-16
-       *   surrogate pair. Text that Node.js decoded from UTF-8 (a `Readable` with
-       *   `encoding: 'utf8'`, `readline`, `TextDecoder`) never does; a string
-       *   sliced by index can. A `Buffer` chunk of 8 KB or more is sent by
+       *   String chunks may split UTF-16 surrogate pairs; the pairs are preserved
+       *   across chunk boundaries, including empty chunks. An unpaired surrogate
+       *   is handled by the type's encoding as it is for an in-memory value.
+       *   A `Buffer` chunk of 8 KB or more is sent by
        *   reference, as `socket.write` would send it, so a source must not reuse
        *   or modify a buffer it has yielded until the request has completed.
        *
@@ -60289,7 +60429,7 @@ var require_process2 = __commonJS({
 var require_process3 = __commonJS({
   "node_modules/readable-stream/lib/internal/shims/process.js"(exports2, module2) {
     "use strict";
-    var process9 = ((base, esmKey, keys, isValid) => {
+    var process10 = ((base, esmKey, keys, isValid) => {
       if (esmKey in base && base[esmKey] === true) {
         let candidate;
         for (const key of keys) {
@@ -60304,7 +60444,7 @@ var require_process3 = __commonJS({
       }
       return base;
     })(require_process2(), "__esModule", ["default", "process"], (candidate) => "nextTick" in candidate);
-    module2.exports = process9;
+    module2.exports = process10;
   }
 });
 
@@ -60521,7 +60661,7 @@ var require_utils6 = __commonJS({
 var require_end_of_stream = __commonJS({
   "node_modules/readable-stream/lib/internal/streams/end-of-stream.js"(exports2, module2) {
     "use strict";
-    var process9 = require_process3();
+    var process10 = require_process3();
     var { AbortError: AbortError2, codes } = require_errors4();
     var { ERR_INVALID_ARG_TYPE, ERR_STREAM_PREMATURE_CLOSE } = codes;
     var { kEmptyObject, once } = require_util();
@@ -60657,17 +60797,17 @@ var require_end_of_stream = __commonJS({
       }
       stream.on("close", onclose);
       if (closed) {
-        process9.nextTick(onclose);
+        process10.nextTick(onclose);
       } else if (wState !== null && wState !== void 0 && wState.errorEmitted || rState !== null && rState !== void 0 && rState.errorEmitted) {
         if (!willEmitClose) {
-          process9.nextTick(onclosed);
+          process10.nextTick(onclosed);
         }
       } else if (!readable && (!willEmitClose || isReadable(stream)) && (writableFinished || isWritable(stream) === false)) {
-        process9.nextTick(onclosed);
+        process10.nextTick(onclosed);
       } else if (!writable && (!willEmitClose || isWritable(stream)) && (readableFinished || isReadable(stream) === false)) {
-        process9.nextTick(onclosed);
+        process10.nextTick(onclosed);
       } else if (rState && stream.req && stream.aborted) {
-        process9.nextTick(onclosed);
+        process10.nextTick(onclosed);
       }
       const cleanup = () => {
         callback = nop;
@@ -60695,7 +60835,7 @@ var require_end_of_stream = __commonJS({
           );
         };
         if (options.signal.aborted) {
-          process9.nextTick(abort);
+          process10.nextTick(abort);
         } else {
           addAbortListener = addAbortListener || require_util().addAbortListener;
           const disposable = addAbortListener(options.signal, abort);
@@ -60722,7 +60862,7 @@ var require_end_of_stream = __commonJS({
           );
         };
         if (options.signal.aborted) {
-          process9.nextTick(abort);
+          process10.nextTick(abort);
         } else {
           addAbortListener = addAbortListener || require_util().addAbortListener;
           const disposable = addAbortListener(options.signal, abort);
@@ -60735,7 +60875,7 @@ var require_end_of_stream = __commonJS({
       }
       const resolverFn = (...args) => {
         if (!isAborted) {
-          process9.nextTick(() => callback.apply(stream, args));
+          process10.nextTick(() => callback.apply(stream, args));
         }
       };
       PromisePrototypeThen(stream[kIsClosedPromise].promise, resolverFn, resolverFn);
@@ -60773,7 +60913,7 @@ var require_end_of_stream = __commonJS({
 var require_destroy = __commonJS({
   "node_modules/readable-stream/lib/internal/streams/destroy.js"(exports2, module2) {
     "use strict";
-    var process9 = require_process3();
+    var process10 = require_process3();
     var {
       aggregateTwoErrors,
       codes: { ERR_MULTIPLE_CALLBACK },
@@ -60840,9 +60980,9 @@ var require_destroy = __commonJS({
           cb(err2);
         }
         if (err2) {
-          process9.nextTick(emitErrorCloseNT, self2, err2);
+          process10.nextTick(emitErrorCloseNT, self2, err2);
         } else {
-          process9.nextTick(emitCloseNT, self2);
+          process10.nextTick(emitCloseNT, self2);
         }
       }
       try {
@@ -60927,7 +61067,7 @@ var require_destroy = __commonJS({
           r.errored = err;
         }
         if (sync) {
-          process9.nextTick(emitErrorNT, stream, err);
+          process10.nextTick(emitErrorNT, stream, err);
         } else {
           emitErrorNT(stream, err);
         }
@@ -60949,7 +61089,7 @@ var require_destroy = __commonJS({
       if (stream.listenerCount(kConstruct) > 1) {
         return;
       }
-      process9.nextTick(constructNT, stream);
+      process10.nextTick(constructNT, stream);
     }
     function constructNT(stream) {
       let called = false;
@@ -60973,15 +61113,15 @@ var require_destroy = __commonJS({
         } else if (err) {
           errorOrDestroy(stream, err, true);
         } else {
-          process9.nextTick(emitConstructNT, stream);
+          process10.nextTick(emitConstructNT, stream);
         }
       }
       try {
         stream._construct((err) => {
-          process9.nextTick(onConstruct, err);
+          process10.nextTick(onConstruct, err);
         });
       } catch (err) {
-        process9.nextTick(onConstruct, err);
+        process10.nextTick(onConstruct, err);
       }
     }
     function emitConstructNT(stream) {
@@ -60995,7 +61135,7 @@ var require_destroy = __commonJS({
     }
     function emitErrorCloseLegacy(stream, err) {
       stream.emit("error", err);
-      process9.nextTick(emitCloseLegacy, stream);
+      process10.nextTick(emitCloseLegacy, stream);
     }
     function destroyer(stream, err) {
       if (!stream || isDestroyed(stream)) {
@@ -61016,9 +61156,9 @@ var require_destroy = __commonJS({
       } else if (typeof stream.close === "function") {
         stream.close();
       } else if (err) {
-        process9.nextTick(emitErrorCloseLegacy, stream, err);
+        process10.nextTick(emitErrorCloseLegacy, stream, err);
       } else {
-        process9.nextTick(emitCloseLegacy, stream);
+        process10.nextTick(emitCloseLegacy, stream);
       }
       if (!stream.destroyed) {
         stream[kIsDestroyed] = true;
@@ -61603,7 +61743,7 @@ var require_string_decoder = __commonJS({
 var require_from = __commonJS({
   "node_modules/readable-stream/lib/internal/streams/from.js"(exports2, module2) {
     "use strict";
-    var process9 = require_process3();
+    var process10 = require_process3();
     var { PromisePrototypeThen, SymbolAsyncIterator, SymbolIterator } = require_primordials();
     var { Buffer: Buffer3 } = require("buffer");
     var { ERR_INVALID_ARG_TYPE, ERR_STREAM_NULL_VALUES } = require_errors4().codes;
@@ -61645,9 +61785,9 @@ var require_from = __commonJS({
       readable._destroy = function(error, cb) {
         PromisePrototypeThen(
           close(error),
-          () => process9.nextTick(cb, error),
+          () => process10.nextTick(cb, error),
           // nextTick is here in case cb throws
-          (e) => process9.nextTick(cb, e || error)
+          (e) => process10.nextTick(cb, e || error)
         );
       };
       async function close(error) {
@@ -61698,7 +61838,7 @@ var require_from = __commonJS({
 var require_readable = __commonJS({
   "node_modules/readable-stream/lib/internal/streams/readable.js"(exports2, module2) {
     "use strict";
-    var process9 = require_process3();
+    var process10 = require_process3();
     var {
       ArrayPrototypeIndexOf,
       NumberIsInteger,
@@ -62083,7 +62223,7 @@ var require_readable = __commonJS({
       if (!state.emittedReadable) {
         debug("emitReadable", state.flowing);
         state.emittedReadable = true;
-        process9.nextTick(emitReadable_, stream);
+        process10.nextTick(emitReadable_, stream);
       }
     }
     function emitReadable_(stream) {
@@ -62099,7 +62239,7 @@ var require_readable = __commonJS({
     function maybeReadMore(stream, state) {
       if (!state.readingMore && state.constructed) {
         state.readingMore = true;
-        process9.nextTick(maybeReadMore_, stream, state);
+        process10.nextTick(maybeReadMore_, stream, state);
       }
     }
     function maybeReadMore_(stream, state) {
@@ -62126,9 +62266,9 @@ var require_readable = __commonJS({
       }
       state.pipes.push(dest);
       debug("pipe count=%d opts=%j", state.pipes.length, pipeOpts);
-      const doEnd = (!pipeOpts || pipeOpts.end !== false) && dest !== process9.stdout && dest !== process9.stderr;
+      const doEnd = (!pipeOpts || pipeOpts.end !== false) && dest !== process10.stdout && dest !== process10.stderr;
       const endFn = doEnd ? onend : unpipe;
-      if (state.endEmitted) process9.nextTick(endFn);
+      if (state.endEmitted) process10.nextTick(endFn);
       else src.once("end", endFn);
       dest.on("unpipe", onunpipe);
       function onunpipe(readable, unpipeInfo) {
@@ -62278,7 +62418,7 @@ var require_readable = __commonJS({
           if (state.length) {
             emitReadable(this);
           } else if (!state.reading) {
-            process9.nextTick(nReadingNextTick, this);
+            process10.nextTick(nReadingNextTick, this);
           }
         }
       }
@@ -62288,7 +62428,7 @@ var require_readable = __commonJS({
     Readable.prototype.removeListener = function(ev, fn) {
       const res = Stream.prototype.removeListener.call(this, ev, fn);
       if (ev === "readable") {
-        process9.nextTick(updateReadableListening, this);
+        process10.nextTick(updateReadableListening, this);
       }
       return res;
     };
@@ -62296,7 +62436,7 @@ var require_readable = __commonJS({
     Readable.prototype.removeAllListeners = function(ev) {
       const res = Stream.prototype.removeAllListeners.apply(this, arguments);
       if (ev === "readable" || ev === void 0) {
-        process9.nextTick(updateReadableListening, this);
+        process10.nextTick(updateReadableListening, this);
       }
       return res;
     };
@@ -62328,7 +62468,7 @@ var require_readable = __commonJS({
     function resume(stream, state) {
       if (!state.resumeScheduled) {
         state.resumeScheduled = true;
-        process9.nextTick(resume_, stream, state);
+        process10.nextTick(resume_, stream, state);
       }
     }
     function resume_(stream, state) {
@@ -62605,7 +62745,7 @@ var require_readable = __commonJS({
       debug("endReadable", state.endEmitted);
       if (!state.endEmitted) {
         state.ended = true;
-        process9.nextTick(endReadableNT, state, stream);
+        process10.nextTick(endReadableNT, state, stream);
       }
     }
     function endReadableNT(state, stream) {
@@ -62614,7 +62754,7 @@ var require_readable = __commonJS({
         state.endEmitted = true;
         stream.emit("end");
         if (stream.writable && stream.allowHalfOpen === false) {
-          process9.nextTick(endWritableNT, stream);
+          process10.nextTick(endWritableNT, stream);
         } else if (state.autoDestroy) {
           const wState = stream._writableState;
           const autoDestroy = !wState || wState.autoDestroy && // We don't expect the writable to ever 'finish'
@@ -62664,7 +62804,7 @@ var require_readable = __commonJS({
 var require_writable = __commonJS({
   "node_modules/readable-stream/lib/internal/streams/writable.js"(exports2, module2) {
     "use strict";
-    var process9 = require_process3();
+    var process10 = require_process3();
     var {
       ArrayPrototypeSlice,
       Error: Error2,
@@ -62817,7 +62957,7 @@ var require_writable = __commonJS({
         err = new ERR_STREAM_DESTROYED("write");
       }
       if (err) {
-        process9.nextTick(cb, err);
+        process10.nextTick(cb, err);
         errorOrDestroy(stream, err, true);
         return err;
       }
@@ -62907,7 +63047,7 @@ var require_writable = __commonJS({
           stream._readableState.errored = er;
         }
         if (sync) {
-          process9.nextTick(onwriteError, stream, state, er, cb);
+          process10.nextTick(onwriteError, stream, state, er, cb);
         } else {
           onwriteError(stream, state, er, cb);
         }
@@ -62925,7 +63065,7 @@ var require_writable = __commonJS({
               stream,
               state
             };
-            process9.nextTick(afterWriteTick, state.afterWriteTickInfo);
+            process10.nextTick(afterWriteTick, state.afterWriteTickInfo);
           }
         } else {
           afterWrite(stream, state, 1, cb);
@@ -63062,7 +63202,7 @@ var require_writable = __commonJS({
       }
       if (typeof cb === "function") {
         if (err || state.finished) {
-          process9.nextTick(cb, err);
+          process10.nextTick(cb, err);
         } else {
           state[kOnFinished].push(cb);
         }
@@ -63091,7 +63231,7 @@ var require_writable = __commonJS({
           state.prefinished = true;
           stream.emit("prefinish");
           state.pendingcb++;
-          process9.nextTick(finish, stream, state);
+          process10.nextTick(finish, stream, state);
         }
       }
       state.sync = true;
@@ -63120,7 +63260,7 @@ var require_writable = __commonJS({
         if (state.pendingcb === 0) {
           if (sync) {
             state.pendingcb++;
-            process9.nextTick(
+            process10.nextTick(
               (stream2, state2) => {
                 if (needFinish(state2)) {
                   finish(stream2, state2);
@@ -63255,7 +63395,7 @@ var require_writable = __commonJS({
     Writable.prototype.destroy = function(err, cb) {
       const state = this._writableState;
       if (!state.destroyed && (state.bufferedIndex < state.buffered.length || state[kOnFinished].length)) {
-        process9.nextTick(errorBuffer, state);
+        process10.nextTick(errorBuffer, state);
       }
       destroy.call(this, err, cb);
       return this;
@@ -63284,7 +63424,7 @@ var require_writable = __commonJS({
 // node_modules/readable-stream/lib/internal/streams/duplexify.js
 var require_duplexify = __commonJS({
   "node_modules/readable-stream/lib/internal/streams/duplexify.js"(exports2, module2) {
-    var process9 = require_process3();
+    var process10 = require_process3();
     var bufferModule = require("buffer");
     var {
       isReadable,
@@ -63397,9 +63537,9 @@ var require_duplexify = __commonJS({
               final(async () => {
                 try {
                   await promise;
-                  process9.nextTick(cb, null);
+                  process10.nextTick(cb, null);
                 } catch (err) {
-                  process9.nextTick(cb, err);
+                  process10.nextTick(cb, err);
                 }
               });
             },
@@ -63478,7 +63618,7 @@ var require_duplexify = __commonJS({
             const _promise = promise;
             promise = null;
             const { chunk, done, cb } = await _promise;
-            process9.nextTick(cb);
+            process10.nextTick(cb);
             if (done) return;
             if (signal.aborted)
               throw new AbortError2(void 0, {
@@ -63869,7 +64009,7 @@ var require_passthrough = __commonJS({
 // node_modules/readable-stream/lib/internal/streams/pipeline.js
 var require_pipeline4 = __commonJS({
   "node_modules/readable-stream/lib/internal/streams/pipeline.js"(exports2, module2) {
-    var process9 = require_process3();
+    var process10 = require_process3();
     var { ArrayIsArray, Promise: Promise2, SymbolAsyncIterator, SymbolDispose } = require_primordials();
     var eos = require_end_of_stream();
     var { once } = require_util();
@@ -64071,7 +64211,7 @@ var require_pipeline4 = __commonJS({
           if (!error) {
             lastStreamCleanup.forEach((fn) => fn());
           }
-          process9.nextTick(callback, error, value);
+          process10.nextTick(callback, error, value);
         }
       }
       let ret;
@@ -64150,11 +64290,11 @@ var require_pipeline4 = __commonJS({
                   if (end) {
                     pt.end();
                   }
-                  process9.nextTick(finish);
+                  process10.nextTick(finish);
                 },
                 (err) => {
                   pt.destroy(err);
-                  process9.nextTick(finish, err);
+                  process10.nextTick(finish, err);
                 }
               );
             } else if (isIterable(ret, true)) {
@@ -64235,7 +64375,7 @@ var require_pipeline4 = __commonJS({
         }
       }
       if (signal !== null && signal !== void 0 && signal.aborted || outerSignal !== null && outerSignal !== void 0 && outerSignal.aborted) {
-        process9.nextTick(abort);
+        process10.nextTick(abort);
       }
       return ret;
     }
@@ -64256,7 +64396,7 @@ var require_pipeline4 = __commonJS({
         };
         var endFn = endFn2;
         if (isReadableFinished(src)) {
-          process9.nextTick(endFn2);
+          process10.nextTick(endFn2);
         } else {
           src.once("end", endFn2);
         }
@@ -66526,7 +66666,7 @@ var require_metadata_parser = __commonJS({
     exports2.readMetadata = readMetadata;
     var _collation = require_collation();
     var _dataType = require_data_type();
-    var _sprintfJs = require_sprintf();
+    var _formatHex = require_format_hex();
     var _helpers = require_helpers3();
     function readCollation(buf, offset) {
       offset = +offset;
@@ -66619,7 +66759,7 @@ var require_metadata_parser = __commonJS({
       } = (0, _helpers.readUInt8)(buf, offset));
       const type = _dataType.TYPE[typeNumber];
       if (!type) {
-        throw new Error((0, _sprintfJs.sprintf)("Unrecognised data type 0x%02X", typeNumber));
+        throw new Error(`Unrecognised data type 0x${(0, _formatHex.formatHex)(typeNumber, 2)}`);
       }
       switch (type.name) {
         case "Null":
@@ -66860,7 +67000,7 @@ var require_metadata_parser = __commonJS({
           }, offset);
         }
         default:
-          throw new Error((0, _sprintfJs.sprintf)("Unrecognised type %s", type.name));
+          throw new Error(`Unrecognised type ${type.name}`);
       }
     }
     module2.exports.readCollation = readCollation;
@@ -67590,7 +67730,6 @@ var require_value_parser = __commonJS({
     var _metadataParser = require_metadata_parser();
     var _dataType = require_data_type();
     var _iconvLite = _interopRequireDefault(require_lib2());
-    var _sprintfJs = require_sprintf();
     var _guidParser = require_guid_parser();
     var _helpers = require_helpers3();
     function _interopRequireDefault(e) {
@@ -67950,7 +68089,7 @@ var require_value_parser = __commonJS({
             case 16:
               return readUniqueIdentifier(buf, offset, options);
             default:
-              throw new Error((0, _sprintfJs.sprintf)("Unsupported guid size %d", dataLength - 1));
+              throw new Error(`Unsupported guid size ${dataLength - 1}`);
           }
         }
         case "Variant": {
@@ -68021,7 +68160,7 @@ var require_value_parser = __commonJS({
           value
         } = (0, _helpers.readUNumeric128LE)(buf, offset));
       } else {
-        throw new Error((0, _sprintfJs.sprintf)("Unsupported numeric dataLength %d", dataLength));
+        throw new Error(`Unsupported numeric dataLength ${dataLength}`);
       }
       return new _helpers.Result(value * sign / Math.pow(10, scale), offset);
     }
@@ -69499,7 +69638,7 @@ var require_package = __commonJS({
       homepage: "https://github.com/tediousjs/tedious",
       bugs: "https://github.com/tediousjs/tedious/issues",
       license: "MIT",
-      version: "20.3.3",
+      version: "20.3.8",
       main: "./lib/tedious.js",
       types: "./lib/tedious.d.ts",
       repository: {
@@ -69539,8 +69678,7 @@ var require_package = __commonJS({
         bl: "^6.1.4",
         "iconv-lite": "^0.7.0",
         "js-md4": "^0.3.2",
-        "native-duplexpair": "^1.0.0",
-        "sprintf-js": "^1.1.3"
+        "native-duplexpair": "^1.0.0"
       },
       devDependencies: {
         "@babel/cli": "^7.28.3",
@@ -69557,7 +69695,6 @@ var require_package = __commonJS({
         "@types/mitm": "^1.3.8",
         "@types/mocha": "^10.0.10",
         "@types/sinon": "^21.0.0",
-        "@types/sprintf-js": "^1.1.4",
         "@typescript-eslint/eslint-plugin": "^8.46.3",
         "@typescript-eslint/parser": "^8.46.3",
         async: "^3.2.6",
@@ -72162,9 +72299,12 @@ var require_connection = __commonJS({
           if (preloginPayload.fedAuthRequired === 1) {
             this.fedAuthRequired = true;
           }
+          if (this.config.options.encrypt === true && preloginPayload.encryptionString !== "ON" && preloginPayload.encryptionString !== "REQ") {
+            throw new _errors.ConnectionError("Server did not negotiate encryption, but the 'encrypt' config option is set to `true`. Set 'encrypt' to `false` to allow unencrypted connections.", "EENCRYPT");
+          }
           if ("strict" !== this.config.options.encrypt && (preloginPayload.encryptionString === "ON" || preloginPayload.encryptionString === "REQ")) {
             if (!this.config.options.encrypt) {
-              throw new _errors.ConnectionError("Server requires encryption, set 'encrypt' config option to true.", "EENCRYPT");
+              throw new _errors.ConnectionError("Server requires encryption, set 'encrypt' config option to `true`.", "EENCRYPT");
             }
             this.transitionTo(this.STATE.SENT_TLSSSLNEGOTIATION);
             await Promise.race([this.messageIo.startTls(this.secureContextOptions, this.config.options.serverName ? this.config.options.serverName : this.routingData?.server ?? this.config.server, this.config.options.trustServerCertificate).catch((err) => {