@8ms/helpers 3.0.15 → 3.0.16

package/.yarnrc.yml

@@ -1 +1,8 @@
+approvedGitRepositories:
+  - "**"
+
+enableScripts: true
+
 nodeLinker: node-modules
+
+npmMinimalAgeGate: 0

package/dist/_virtual/_rolldown/runtime.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
 //#region \0rolldown/runtime.js
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
 export { __require };

package/dist/aws/server/getAwsConfig.cjs

@@ -1,15 +1,36 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_environment_environment = require("../../environment/environment.cjs");
 //#region src/aws/server/getAwsConfig.ts
+const getGcpOidcToken = async () => {
+	const response = await fetch("http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=sts.amazonaws.com&format=full", { headers: { "Metadata-Flavor": "Google" } });
+	if (!response.ok) throw new Error(`Failed to fetch GCP OIDC token: ${response.status} ${response.statusText}`);
+	return response.text();
+};
+const assumeAwsRoleWithGcpToken = async (token, props) => {
+	const { STSClient, AssumeRoleWithWebIdentityCommand } = await import("@aws-sdk/client-sts");
+	const { Credentials } = await new STSClient({ region: props?.awsRegion || "eu-west-2" }).send(new AssumeRoleWithWebIdentityCommand({
+		RoleArn: props.oidcRoleArn,
+		RoleSessionName: props.gcpSessionName ?? "gcp-aws-session",
+		WebIdentityToken: token
+	}));
+	if (!Credentials?.AccessKeyId || !Credentials?.SecretAccessKey) throw new Error("STS did not return valid credentials");
+	return {
+		accessKeyId: Credentials.AccessKeyId,
+		secretAccessKey: Credentials.SecretAccessKey,
+		sessionToken: Credentials.SessionToken
+	};
+};
 const getAwsConfig = async (props) => {
-	if (props.isOidc && require_environment_environment.isVercel()) {
-		const { awsCredentialsProvider } = await import("@vercel/oidc-aws-credentials-provider");
-		return { credentials: awsCredentialsProvider({ roleArn: props?.oidcRoleArn ?? "" }) };
-	}
-	return { credentials: {
+	let credentials = {
 		accessKeyId: props?.accessKeyId ?? "",
 		secretAccessKey: props?.secretAccessKey ?? ""
-	} };
+	};
+	if (props.oidcRoleArn && require_environment_environment.isVercel()) {
+		const { awsCredentialsProvider } = await import("@vercel/oidc-aws-credentials-provider");
+		credentials = await awsCredentialsProvider({ roleArn: props.oidcRoleArn })();
+	}
+	if (props.oidcRoleArn && require_environment_environment.isGoogleCloud()) credentials = await assumeAwsRoleWithGcpToken(await getGcpOidcToken(), props);
+	return { credentials };
 };
 //#endregion
 exports.getAwsConfig = getAwsConfig;

package/dist/aws/server/getAwsConfig.d.cts

@@ -1,18 +1,18 @@
-import { AwsCredentialIdentityProvider } from "../../node_modules/@smithy/types/dist-types/identity/awsCredentialIdentity.cjs";
 //#region src/aws/server/getAwsConfig.d.ts
 type GetAwsConfigProps = {
-  isOidc: boolean;
   oidcRoleArn?: string;
+  gcpSessionName?: string;
+  awsRegion?: string;
   accessKeyId?: string;
   secretAccessKey?: string;
 };
-declare const getAwsConfig: (props: GetAwsConfigProps) => Promise<{
-  credentials: AwsCredentialIdentityProvider;
-} | {
+type AwsConfig = {
   credentials: {
     accessKeyId: string;
     secretAccessKey: string;
+    sessionToken?: string;
   };
-}>;
+};
+declare const getAwsConfig: (props: GetAwsConfigProps) => Promise<AwsConfig>;
 //#endregion
 export { getAwsConfig };

package/dist/aws/server/getAwsConfig.d.mts

@@ -1,18 +1,18 @@
-import { AwsCredentialIdentityProvider } from "../../node_modules/@smithy/types/dist-types/identity/awsCredentialIdentity.mjs";
 //#region src/aws/server/getAwsConfig.d.ts
 type GetAwsConfigProps = {
-  isOidc: boolean;
   oidcRoleArn?: string;
+  gcpSessionName?: string;
+  awsRegion?: string;
   accessKeyId?: string;
   secretAccessKey?: string;
 };
-declare const getAwsConfig: (props: GetAwsConfigProps) => Promise<{
-  credentials: AwsCredentialIdentityProvider;
-} | {
+type AwsConfig = {
   credentials: {
     accessKeyId: string;
     secretAccessKey: string;
+    sessionToken?: string;
   };
-}>;
+};
+declare const getAwsConfig: (props: GetAwsConfigProps) => Promise<AwsConfig>;
 //#endregion
 export { getAwsConfig };

package/dist/aws/server/getAwsConfig.mjs

@@ -1,14 +1,35 @@
-import { isVercel } from "../../environment/environment.mjs";
+import { isGoogleCloud, isVercel } from "../../environment/environment.mjs";
 //#region src/aws/server/getAwsConfig.ts
+const getGcpOidcToken = async () => {
+	const response = await fetch("http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=sts.amazonaws.com&format=full", { headers: { "Metadata-Flavor": "Google" } });
+	if (!response.ok) throw new Error(`Failed to fetch GCP OIDC token: ${response.status} ${response.statusText}`);
+	return response.text();
+};
+const assumeAwsRoleWithGcpToken = async (token, props) => {
+	const { STSClient, AssumeRoleWithWebIdentityCommand } = await import("@aws-sdk/client-sts");
+	const { Credentials } = await new STSClient({ region: props?.awsRegion || "eu-west-2" }).send(new AssumeRoleWithWebIdentityCommand({
+		RoleArn: props.oidcRoleArn,
+		RoleSessionName: props.gcpSessionName ?? "gcp-aws-session",
+		WebIdentityToken: token
+	}));
+	if (!Credentials?.AccessKeyId || !Credentials?.SecretAccessKey) throw new Error("STS did not return valid credentials");
+	return {
+		accessKeyId: Credentials.AccessKeyId,
+		secretAccessKey: Credentials.SecretAccessKey,
+		sessionToken: Credentials.SessionToken
+	};
+};
 const getAwsConfig = async (props) => {
-	if (props.isOidc && isVercel()) {
-		const { awsCredentialsProvider } = await import("@vercel/oidc-aws-credentials-provider");
-		return { credentials: awsCredentialsProvider({ roleArn: props?.oidcRoleArn ?? "" }) };
-	}
-	return { credentials: {
+	let credentials = {
 		accessKeyId: props?.accessKeyId ?? "",
 		secretAccessKey: props?.secretAccessKey ?? ""
-	} };
+	};
+	if (props.oidcRoleArn && isVercel()) {
+		const { awsCredentialsProvider } = await import("@vercel/oidc-aws-credentials-provider");
+		credentials = await awsCredentialsProvider({ roleArn: props.oidcRoleArn })();
+	}
+	if (props.oidcRoleArn && isGoogleCloud()) credentials = await assumeAwsRoleWithGcpToken(await getGcpOidcToken(), props);
+	return { credentials };
 };
 //#endregion
 export { getAwsConfig };

package/dist/environment/environment.cjs

@@ -7,7 +7,8 @@ const environment = {
 };
 const platform = {
 	AWS: "AWS",
-	VERCEL: "VERCEL"
+	VERCEL: "VERCEL",
+	GCP: "GCP"
 };
 /**
 * Determine the environment we're using.
@@ -37,6 +38,7 @@ const getEnvironment = () => {
 */
 const isAws = () => platform.AWS === process.env["EMS_PLATFORM"];
 const isVercel = () => "undefined" !== typeof process.env.NEXT_PUBLIC_VERCEL_GIT_COMMIT_REF;
+const isGoogleCloud = () => platform.GCP === process.env["EMS_PLATFORM"];
 /**
 * Some code should only run on the server side to protect the data.
 */
@@ -61,6 +63,7 @@ exports.environment = environment;
 exports.getEnvironment = getEnvironment;
 exports.isAws = isAws;
 exports.isDevelopment = isDevelopment;
+exports.isGoogleCloud = isGoogleCloud;
 exports.isLocalhost = isLocalhost;
 exports.isProduction = isProduction;
 exports.isServer = isServer;

package/dist/environment/environment.d.cts

@@ -8,6 +8,7 @@ type Environment = typeof environment[keyof typeof environment];
 declare const platform: {
   readonly AWS: "AWS";
   readonly VERCEL: "VERCEL";
+  readonly GCP: "GCP";
 };
 type Platform = typeof platform[keyof typeof platform];
 /**
@@ -19,6 +20,7 @@ declare const getEnvironment: () => Environment;
  */
 declare const isAws: () => boolean;
 declare const isVercel: () => boolean;
+declare const isGoogleCloud: () => boolean;
 /**
  * Some code should only run on the server side to protect the data.
  */
@@ -34,4 +36,4 @@ declare const isProduction: () => boolean;
  */
 declare const isLocalhost: () => boolean;
 //#endregion
-export { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };
+export { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isGoogleCloud, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };

package/dist/environment/environment.d.mts

@@ -8,6 +8,7 @@ type Environment = typeof environment[keyof typeof environment];
 declare const platform: {
   readonly AWS: "AWS";
   readonly VERCEL: "VERCEL";
+  readonly GCP: "GCP";
 };
 type Platform = typeof platform[keyof typeof platform];
 /**
@@ -19,6 +20,7 @@ declare const getEnvironment: () => Environment;
  */
 declare const isAws: () => boolean;
 declare const isVercel: () => boolean;
+declare const isGoogleCloud: () => boolean;
 /**
  * Some code should only run on the server side to protect the data.
  */
@@ -34,4 +36,4 @@ declare const isProduction: () => boolean;
  */
 declare const isLocalhost: () => boolean;
 //#endregion
-export { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };
+export { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isGoogleCloud, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };

package/dist/environment/environment.mjs

@@ -6,7 +6,8 @@ const environment = {
 };
 const platform = {
 	AWS: "AWS",
-	VERCEL: "VERCEL"
+	VERCEL: "VERCEL",
+	GCP: "GCP"
 };
 /**
 * Determine the environment we're using.
@@ -36,6 +37,7 @@ const getEnvironment = () => {
 */
 const isAws = () => platform.AWS === process.env["EMS_PLATFORM"];
 const isVercel = () => "undefined" !== typeof process.env.NEXT_PUBLIC_VERCEL_GIT_COMMIT_REF;
+const isGoogleCloud = () => platform.GCP === process.env["EMS_PLATFORM"];
 /**
 * Some code should only run on the server side to protect the data.
 */
@@ -56,4 +58,4 @@ const isLocalhost = () => {
 	return false;
 };
 //#endregion
-export { environment, getEnvironment, isAws, isDevelopment, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };
+export { environment, getEnvironment, isAws, isDevelopment, isGoogleCloud, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };

package/dist/environment/index.cjs

@@ -4,6 +4,7 @@ exports.environment = require_environment_environment.environment;
 exports.getEnvironment = require_environment_environment.getEnvironment;
 exports.isAws = require_environment_environment.isAws;
 exports.isDevelopment = require_environment_environment.isDevelopment;
+exports.isGoogleCloud = require_environment_environment.isGoogleCloud;
 exports.isLocalhost = require_environment_environment.isLocalhost;
 exports.isProduction = require_environment_environment.isProduction;
 exports.isServer = require_environment_environment.isServer;

package/dist/environment/index.d.cts

@@ -1,2 +1,2 @@
-import { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isLocalhost, isProduction, isServer, isStaging, isVercel, platform } from "./environment.cjs";
-export { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };
+import { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isGoogleCloud, isLocalhost, isProduction, isServer, isStaging, isVercel, platform } from "./environment.cjs";
+export { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isGoogleCloud, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };

package/dist/environment/index.d.mts

@@ -1,2 +1,2 @@
-import { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isLocalhost, isProduction, isServer, isStaging, isVercel, platform } from "./environment.mjs";
-export { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };
+import { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isGoogleCloud, isLocalhost, isProduction, isServer, isStaging, isVercel, platform } from "./environment.mjs";
+export { Environment, Platform, environment, getEnvironment, isAws, isDevelopment, isGoogleCloud, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };

package/dist/environment/index.mjs

@@ -1,2 +1,2 @@
-import { environment, getEnvironment, isAws, isDevelopment, isLocalhost, isProduction, isServer, isStaging, isVercel, platform } from "./environment.mjs";
-export { environment, getEnvironment, isAws, isDevelopment, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };
+import { environment, getEnvironment, isAws, isDevelopment, isGoogleCloud, isLocalhost, isProduction, isServer, isStaging, isVercel, platform } from "./environment.mjs";
+export { environment, getEnvironment, isAws, isDevelopment, isGoogleCloud, isLocalhost, isProduction, isServer, isStaging, isVercel, platform };

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@8ms/helpers",
 	"license": "UNLICENSED",
-	"version": "3.0.15",
+	"version": "3.0.16",
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/8millionstories-organisation/8ms-helpers-ts.git"
@@ -29,6 +29,7 @@
 		"@aws-sdk/client-ses": "^3.0.0",
 		"@aws-sdk/client-sqs": "^3.0.0",
 		"@aws-sdk/client-ssm": "^3.0.0",
+		"@aws-sdk/client-sts": "^3.0.0",
 		"@aws-sdk/lib-storage": "^3.0.0",
 		"@aws-sdk/s3-request-presigner": "^3.0.0",
 		"@google-cloud/bigquery": "^8.0.0",
@@ -87,6 +88,9 @@
 		"@aws-sdk/client-ssm": {
 			"optional": true
 		},
+		"@aws-sdk/client-sts": {
+			"optional": true
+		},
 		"@aws-sdk/lib-storage": {
 			"optional": true
 		},
@@ -159,23 +163,23 @@
 	},
 	"devDependencies": {
 		"@1password/sdk": "^0.4.0",
-		"@aws-sdk/client-cloudwatch": "^3.1068.0",
-		"@aws-sdk/client-cloudwatch-logs": "^3.1068.0",
-		"@aws-sdk/client-ec2": "^3.1068.0",
-		"@aws-sdk/client-ecs": "^3.1068.0",
-		"@aws-sdk/client-glue": "^3.1068.0",
-		"@aws-sdk/client-lambda": "^3.1068.0",
-		"@aws-sdk/client-s3": "^3.1068.0",
-		"@aws-sdk/client-ses": "^3.1068.0",
-		"@aws-sdk/client-sqs": "^3.1068.0",
-		"@aws-sdk/client-ssm": "^3.1068.0",
-		"@aws-sdk/lib-storage": "^3.1068.0",
-		"@aws-sdk/s3-request-presigner": "^3.1068.0",
-		"@aws-sdk/types": "^3.973.12",
-		"@babel/core": "7.29.7",
-		"@babel/preset-env": "7.29.7",
-		"@babel/preset-flow": "7.29.7",
-		"@babel/preset-typescript": "7.29.7",
+		"@aws-sdk/client-cloudwatch": "^3.1075.0",
+		"@aws-sdk/client-cloudwatch-logs": "^3.1075.0",
+		"@aws-sdk/client-ec2": "^3.1075.0",
+		"@aws-sdk/client-ecs": "^3.1075.0",
+		"@aws-sdk/client-glue": "^3.1075.0",
+		"@aws-sdk/client-lambda": "^3.1075.0",
+		"@aws-sdk/client-s3": "^3.1075.0",
+		"@aws-sdk/client-ses": "^3.1075.0",
+		"@aws-sdk/client-sqs": "^3.1075.0",
+		"@aws-sdk/client-ssm": "^3.1075.0",
+		"@aws-sdk/client-sts": "^3.1075.0",
+		"@aws-sdk/lib-storage": "^3.1075.0",
+		"@aws-sdk/s3-request-presigner": "^3.1075.0",
+		"@aws-sdk/types": "^3.973.13",
+		"@babel/core": "^8.0.1",
+		"@babel/preset-env": "^8.0.2",
+		"@babel/preset-typescript": "^8.0.1",
 		"@google-cloud/bigquery": "^8.3.1",
 		"@google-cloud/common": "^6.0.1",
 		"@google-cloud/storage": "^7.21.0",
@@ -185,14 +189,13 @@
 		"@prisma/adapter-pg": "^7.8.0",
 		"@prisma/adapter-planetscale": "^7.8.0",
 		"@prisma/client": "^7.8.0",
-		"@types/babel__core": "^7.20.5",
 		"@types/fs-extra": "^11.0.4",
 		"@types/jest": "30.0.0",
-		"@types/luxon": "3.7.1",
+		"@types/luxon": "3.7.2",
 		"@types/node": "^24.13.2",
 		"@types/react": "^19.2.17",
-		"@vercel/oidc": "^3.6.1",
-		"@vercel/oidc-aws-credentials-provider": "^3.1.4",
+		"@vercel/oidc": "^3.6.2",
+		"@vercel/oidc-aws-credentials-provider": "^3.1.5",
 		"babel-jest": "30.4.1",
 		"dotenv": "^17.4.2",
 		"drizzle-orm": "beta",
@@ -203,12 +206,12 @@
 		"jest": "^30.4.2",
 		"mysql2": "^3.22.5",
 		"next": "^16.2.9",
-		"pg": "^8.21.0",
+		"pg": "^8.22.0",
 		"react": "^19.2.7",
 		"react-intersection-observer": "^10.0.3",
-		"swr": "^2.4.1",
+		"swr": "^2.4.2",
 		"ts-node": "^10.9.2",
-		"tsdown": "^0.22.2",
+		"tsdown": "^0.22.3",
 		"tslib": "^2.8.1",
 		"typescript": "^6.0.3"
 	},
@@ -1206,8 +1209,5 @@
 			"require": "./dist/xml/server/getXml.cjs"
 		},
 		"./package.json": "./package.json"
-	},
-	"inlinedDependencies": {
-		"@smithy/types": "4.15.0"
 	}
 }

package/dist/node_modules/@smithy/types/dist-types/http/httpHandlerInitialization.d.cts

@@ -1,7 +0,0 @@
-//#region node_modules/@smithy/types/dist-types/http/httpHandlerInitialization.d.ts
-declare global {
-  /**
-   * interface merging stub.
-   */
-  interface RequestInit {}
-}

package/dist/node_modules/@smithy/types/dist-types/http/httpHandlerInitialization.d.mts

@@ -1,7 +0,0 @@
-//#region node_modules/@smithy/types/dist-types/http/httpHandlerInitialization.d.ts
-declare global {
-  /**
-   * interface merging stub.
-   */
-  interface RequestInit {}
-}

package/dist/node_modules/@smithy/types/dist-types/identity/awsCredentialIdentity.d.cts

@@ -1,35 +0,0 @@
-import { Identity, IdentityProvider } from "./identity.cjs";
-
-//#region node_modules/@smithy/types/dist-types/identity/awsCredentialIdentity.d.ts
-/**
- * @public
- */
-interface AwsCredentialIdentity extends Identity {
-  /**
-   * AWS access key ID
-   */
-  readonly accessKeyId: string;
-  /**
-   * AWS secret access key
-   */
-  readonly secretAccessKey: string;
-  /**
-   * A security or session token to use with these credentials. Usually
-   * present for temporary credentials.
-   */
-  readonly sessionToken?: string;
-  /**
-   * AWS credential scope for this set of credentials.
-   */
-  readonly credentialScope?: string;
-  /**
-   * AWS accountId.
-   */
-  readonly accountId?: string;
-}
-/**
- * @public
- */
-type AwsCredentialIdentityProvider = IdentityProvider<AwsCredentialIdentity>;
-//#endregion
-export { AwsCredentialIdentity, AwsCredentialIdentityProvider };

package/dist/node_modules/@smithy/types/dist-types/identity/awsCredentialIdentity.d.mts

@@ -1,35 +0,0 @@
-import { Identity, IdentityProvider } from "./identity.mjs";
-
-//#region node_modules/@smithy/types/dist-types/identity/awsCredentialIdentity.d.ts
-/**
- * @public
- */
-interface AwsCredentialIdentity extends Identity {
-  /**
-   * AWS access key ID
-   */
-  readonly accessKeyId: string;
-  /**
-   * AWS secret access key
-   */
-  readonly secretAccessKey: string;
-  /**
-   * A security or session token to use with these credentials. Usually
-   * present for temporary credentials.
-   */
-  readonly sessionToken?: string;
-  /**
-   * AWS credential scope for this set of credentials.
-   */
-  readonly credentialScope?: string;
-  /**
-   * AWS accountId.
-   */
-  readonly accountId?: string;
-}
-/**
- * @public
- */
-type AwsCredentialIdentityProvider = IdentityProvider<AwsCredentialIdentity>;
-//#endregion
-export { AwsCredentialIdentity, AwsCredentialIdentityProvider };

package/dist/node_modules/@smithy/types/dist-types/identity/identity.d.cts

@@ -1,18 +0,0 @@
-//#region node_modules/@smithy/types/dist-types/identity/identity.d.ts
-/**
- * @public
- */
-interface Identity {
-  /**
-   * A `Date` when the identity or credential will no longer be accepted.
-   */
-  readonly expiration?: Date;
-}
-/**
- * @public
- */
-interface IdentityProvider<IdentityT extends Identity> {
-  (identityProperties?: Record<string, any>): Promise<IdentityT>;
-}
-//#endregion
-export { Identity, IdentityProvider };

package/dist/node_modules/@smithy/types/dist-types/identity/identity.d.mts

@@ -1,18 +0,0 @@
-//#region node_modules/@smithy/types/dist-types/identity/identity.d.ts
-/**
- * @public
- */
-interface Identity {
-  /**
-   * A `Date` when the identity or credential will no longer be accepted.
-   */
-  readonly expiration?: Date;
-}
-/**
- * @public
- */
-interface IdentityProvider<IdentityT extends Identity> {
-  (identityProperties?: Record<string, any>): Promise<IdentityT>;
-}
-//#endregion
-export { Identity, IdentityProvider };

package/dist/node_modules/@smithy/types/dist-types/index.d.cts

@@ -1,2 +0,0 @@
-import { Identity, IdentityProvider } from "./identity/identity.cjs";
-import { AwsCredentialIdentity, AwsCredentialIdentityProvider } from "./identity/awsCredentialIdentity.cjs";

package/dist/node_modules/@smithy/types/dist-types/index.d.mts

@@ -1,2 +0,0 @@
-import { Identity, IdentityProvider } from "./identity/identity.mjs";
-import { AwsCredentialIdentity, AwsCredentialIdentityProvider } from "./identity/awsCredentialIdentity.mjs";