@alienplatform/sdk 1.10.7 → 1.11.1

package/dist/dist-cjs4.js

@@ -0,0 +1,171 @@
+import { a as __toCommonJS, i as __require, t as __commonJSMin } from "./rolldown-runtime.js";
+import { n as init_client, t as client_exports } from "./client.js";
+import { A as config_exports, i as serde_exports, j as init_config, r as init_serde } from "./serde.js";
+import { n as protocols_exports, t as init_protocols } from "./protocols.js";
+import { o as init_tslib_es6, s as tslib_es6_exports } from "./tslib.es6.js";
+import { t as require_dist_cjs$1 } from "./dist-cjs2.js";
+//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.48/node_modules/@aws-sdk/credential-provider-http/dist-cjs/fromHttp/checkUrl.js
+var require_checkUrl = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.checkUrl = void 0;
+	const config_1 = (init_config(), __toCommonJS(config_exports));
+	const ECS_CONTAINER_HOST = "169.254.170.2";
+	const EKS_CONTAINER_HOST_IPv4 = "169.254.170.23";
+	const EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]";
+	const checkUrl = (url, logger) => {
+		if (url.protocol === "https:") return;
+		if (url.hostname === ECS_CONTAINER_HOST || url.hostname === EKS_CONTAINER_HOST_IPv4 || url.hostname === EKS_CONTAINER_HOST_IPv6) return;
+		if (url.hostname.includes("[")) {
+			if (url.hostname === "[::1]" || url.hostname === "[0000:0000:0000:0000:0000:0000:0000:0001]") return;
+		} else {
+			if (url.hostname === "localhost") return;
+			const ipComponents = url.hostname.split(".");
+			const inRange = (component) => {
+				const num = parseInt(component, 10);
+				return 0 <= num && num <= 255;
+			};
+			if (ipComponents[0] === "127" && inRange(ipComponents[1]) && inRange(ipComponents[2]) && inRange(ipComponents[3]) && ipComponents.length === 4) return;
+		}
+		throw new config_1.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
+  - loopback CIDR 127.0.0.0/8 or [::1/128]
+  - ECS container host 169.254.170.2
+  - EKS container host 169.254.170.23 or [fd00:ec2::23]`, { logger });
+	};
+	exports.checkUrl = checkUrl;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.48/node_modules/@aws-sdk/credential-provider-http/dist-cjs/fromHttp/requestHelpers.js
+var require_requestHelpers = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.createGetRequest = createGetRequest;
+	exports.getCredentials = getCredentials;
+	const config_1 = (init_config(), __toCommonJS(config_exports));
+	const protocols_1 = (init_protocols(), __toCommonJS(protocols_exports));
+	const serde_1 = (init_serde(), __toCommonJS(serde_exports));
+	const serde_2 = (init_serde(), __toCommonJS(serde_exports));
+	function createGetRequest(url) {
+		return new protocols_1.HttpRequest({
+			protocol: url.protocol,
+			hostname: url.hostname,
+			port: Number(url.port),
+			path: url.pathname,
+			query: Array.from(url.searchParams.entries()).reduce((acc, [k, v]) => {
+				acc[k] = v;
+				return acc;
+			}, {}),
+			fragment: url.hash
+		});
+	}
+	async function getCredentials(response, logger) {
+		const str = await (0, serde_2.sdkStreamMixin)(response.body).transformToString();
+		if (response.statusCode === 200) {
+			const parsed = JSON.parse(str);
+			if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") throw new config_1.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: { AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
+			return {
+				accessKeyId: parsed.AccessKeyId,
+				secretAccessKey: parsed.SecretAccessKey,
+				sessionToken: parsed.Token,
+				expiration: (0, serde_1.parseRfc3339DateTime)(parsed.Expiration)
+			};
+		}
+		if (response.statusCode >= 400 && response.statusCode < 500) {
+			let parsedBody = {};
+			try {
+				parsedBody = JSON.parse(str);
+			} catch (e) {}
+			throw Object.assign(new config_1.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
+				Code: parsedBody.Code,
+				Message: parsedBody.Message
+			});
+		}
+		throw new config_1.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
+	}
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.48/node_modules/@aws-sdk/credential-provider-http/dist-cjs/fromHttp/retry-wrapper.js
+var require_retry_wrapper = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.retryWrapper = void 0;
+	const retryWrapper = (toRetry, maxRetries, delayMs) => {
+		return async () => {
+			for (let i = 0; i < maxRetries; ++i) try {
+				return await toRetry();
+			} catch (e) {
+				await new Promise((resolve) => setTimeout(resolve, delayMs));
+			}
+			return await toRetry();
+		};
+	};
+	exports.retryWrapper = retryWrapper;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.48/node_modules/@aws-sdk/credential-provider-http/dist-cjs/fromHttp/fromHttp.js
+var require_fromHttp = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.fromHttp = void 0;
+	const tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
+	const client_1 = (init_client(), __toCommonJS(client_exports));
+	const config_1 = (init_config(), __toCommonJS(config_exports));
+	const node_http_handler_1 = require_dist_cjs$1();
+	const promises_1 = tslib_1.__importDefault(__require("node:fs/promises"));
+	const checkUrl_1 = require_checkUrl();
+	const requestHelpers_1 = require_requestHelpers();
+	const retry_wrapper_1 = require_retry_wrapper();
+	const AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
+	const DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2";
+	const AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
+	const AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE";
+	const AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN";
+	const fromHttp = (options = {}) => {
+		options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
+		let host;
+		const relative = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
+		const full = options.awsContainerCredentialsFullUri ?? process.env[AWS_CONTAINER_CREDENTIALS_FULL_URI];
+		const token = options.awsContainerAuthorizationToken ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN];
+		const tokenFile = options.awsContainerAuthorizationTokenFile ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE];
+		const warn = options.logger?.constructor?.name === "NoOpLogger" || !options.logger?.warn ? console.warn : options.logger.warn.bind(options.logger);
+		if (relative && full) {
+			warn("@aws-sdk/credential-provider-http: you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri.");
+			warn("awsContainerCredentialsFullUri will take precedence.");
+		}
+		if (token && tokenFile) {
+			warn("@aws-sdk/credential-provider-http: you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile.");
+			warn("awsContainerAuthorizationToken will take precedence.");
+		}
+		if (full) host = full;
+		else if (relative) host = `${DEFAULT_LINK_LOCAL_HOST}${relative}`;
+		else throw new config_1.CredentialsProviderError(`No HTTP credential provider host provided.
+Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`, { logger: options.logger });
+		const url = new URL(host);
+		(0, checkUrl_1.checkUrl)(url, options.logger);
+		const requestHandler = node_http_handler_1.NodeHttpHandler.create({ connectionTimeout: options.timeout ?? 1e3 });
+		const requestTimeout = options.timeout ?? 1e3;
+		const provider = (0, retry_wrapper_1.retryWrapper)(async () => {
+			const request = (0, requestHelpers_1.createGetRequest)(url);
+			if (token) request.headers.Authorization = token;
+			else if (tokenFile) request.headers.Authorization = (await promises_1.default.readFile(tokenFile)).toString();
+			try {
+				const result = await requestHandler.handle(request, { requestTimeout });
+				return (0, requestHelpers_1.getCredentials)(result.response).then((creds) => (0, client_1.setCredentialFeature)(creds, "CREDENTIALS_HTTP", "z"));
+			} catch (e) {
+				throw new config_1.CredentialsProviderError(String(e), { logger: options.logger });
+			}
+		}, options.maxRetries ?? 3, options.timeout ?? 1e3);
+		return async () => {
+			try {
+				return await provider();
+			} finally {
+				requestHandler.destroy?.();
+			}
+		};
+	};
+	exports.fromHttp = fromHttp;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.48/node_modules/@aws-sdk/credential-provider-http/dist-cjs/index.js
+var require_dist_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
+	exports.fromHttp = require_fromHttp().fromHttp;
+}));
+//#endregion
+export default require_dist_cjs();
+export {};

package/dist/dist-cjs5.js

@@ -0,0 +1,429 @@
+import { a as __toCommonJS, i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime.js";
+import { n as init_client, t as client_exports } from "./client.js";
+import { A as config_exports, j as init_config } from "./serde.js";
+import { n as protocols_exports, t as init_protocols } from "./protocols.js";
+//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-login@3.972.52/node_modules/@aws-sdk/credential-provider-login/dist-cjs/index.js
+var require_dist_cjs$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
+	var client = (init_client(), __toCommonJS(client_exports));
+	var config = (init_config(), __toCommonJS(config_exports));
+	var protocols = (init_protocols(), __toCommonJS(protocols_exports));
+	var node_crypto = __require("node:crypto");
+	var node_fs = __require("node:fs");
+	var node_os = __require("node:os");
+	var node_path = __require("node:path");
+	var LoginCredentialsFetcher = class LoginCredentialsFetcher {
+		profileData;
+		init;
+		callerClientConfig;
+		static REFRESH_THRESHOLD = 300 * 1e3;
+		constructor(profileData, init, callerClientConfig) {
+			this.profileData = profileData;
+			this.init = init;
+			this.callerClientConfig = callerClientConfig;
+		}
+		async loadCredentials() {
+			const token = await this.loadToken();
+			if (!token) throw new config.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, {
+				tryNextLink: false,
+				logger: this.logger
+			});
+			const accessToken = token.accessToken;
+			const now = Date.now();
+			if (new Date(accessToken.expiresAt).getTime() - now <= LoginCredentialsFetcher.REFRESH_THRESHOLD) return this.refresh(token);
+			return {
+				accessKeyId: accessToken.accessKeyId,
+				secretAccessKey: accessToken.secretAccessKey,
+				sessionToken: accessToken.sessionToken,
+				accountId: accessToken.accountId,
+				expiration: new Date(accessToken.expiresAt)
+			};
+		}
+		get logger() {
+			return this.init?.logger;
+		}
+		get loginSession() {
+			return this.profileData.login_session;
+		}
+		async refresh(token) {
+			const { SigninClient, CreateOAuth2TokenCommand } = await import("./signin.js");
+			const { logger, userAgentAppId } = this.callerClientConfig ?? {};
+			const isH2 = (requestHandler) => {
+				return requestHandler?.metadata?.handlerProtocol === "h2";
+			};
+			const requestHandler = isH2(this.callerClientConfig?.requestHandler) ? void 0 : this.callerClientConfig?.requestHandler;
+			const client = new SigninClient({
+				credentials: {
+					accessKeyId: "",
+					secretAccessKey: ""
+				},
+				region: this.profileData.region ?? await this.callerClientConfig?.region?.() ?? process.env.AWS_REGION,
+				requestHandler,
+				logger,
+				userAgentAppId,
+				...this.init?.clientConfig
+			});
+			this.createDPoPInterceptor(client.middlewareStack);
+			const commandInput = { tokenInput: {
+				clientId: token.clientId,
+				refreshToken: token.refreshToken,
+				grantType: "refresh_token"
+			} };
+			try {
+				const response = await client.send(new CreateOAuth2TokenCommand(commandInput));
+				const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};
+				const { refreshToken, expiresIn } = response.tokenOutput ?? {};
+				if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) throw new config.CredentialsProviderError("Token refresh response missing required fields", {
+					logger: this.logger,
+					tryNextLink: false
+				});
+				const expiresInMs = (expiresIn ?? 900) * 1e3;
+				const expiration = new Date(Date.now() + expiresInMs);
+				const updatedToken = {
+					...token,
+					accessToken: {
+						...token.accessToken,
+						accessKeyId,
+						secretAccessKey,
+						sessionToken,
+						expiresAt: expiration.toISOString()
+					},
+					refreshToken
+				};
+				await this.saveToken(updatedToken);
+				const newAccessToken = updatedToken.accessToken;
+				return {
+					accessKeyId: newAccessToken.accessKeyId,
+					secretAccessKey: newAccessToken.secretAccessKey,
+					sessionToken: newAccessToken.sessionToken,
+					accountId: newAccessToken.accountId,
+					expiration
+				};
+			} catch (error) {
+				if (error.name === "AccessDeniedException") {
+					const errorType = error.error;
+					let message;
+					switch (errorType) {
+						case "TOKEN_EXPIRED":
+							message = "Your session has expired. Please reauthenticate.";
+							break;
+						case "USER_CREDENTIALS_CHANGED":
+							message = "Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";
+							break;
+						case "INSUFFICIENT_PERMISSIONS":
+							message = "Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";
+							break;
+						default: message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
+					}
+					throw new config.CredentialsProviderError(message, {
+						logger: this.logger,
+						tryNextLink: false
+					});
+				}
+				throw new config.CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
+			}
+		}
+		async loadToken() {
+			const tokenFilePath = this.getTokenFilePath();
+			try {
+				let tokenData;
+				try {
+					tokenData = await config.readFile(tokenFilePath, { ignoreCache: this.init?.ignoreCache });
+				} catch {
+					tokenData = await node_fs.promises.readFile(tokenFilePath, "utf8");
+				}
+				const token = JSON.parse(tokenData);
+				const missingFields = [
+					"accessToken",
+					"clientId",
+					"refreshToken",
+					"dpopKey"
+				].filter((k) => !token[k]);
+				if (!token.accessToken?.accountId) missingFields.push("accountId");
+				if (missingFields.length > 0) throw new config.CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
+					logger: this.logger,
+					tryNextLink: false
+				});
+				return token;
+			} catch (error) {
+				throw new config.CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
+					logger: this.logger,
+					tryNextLink: false
+				});
+			}
+		}
+		async saveToken(token) {
+			const tokenFilePath = this.getTokenFilePath();
+			const directory = node_path.dirname(tokenFilePath);
+			try {
+				await node_fs.promises.mkdir(directory, { recursive: true });
+			} catch (error) {}
+			await node_fs.promises.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
+		}
+		getTokenFilePath() {
+			const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? node_path.join(node_os.homedir(), ".aws", "login", "cache");
+			const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
+			const loginSessionSha256 = node_crypto.createHash("sha256").update(loginSessionBytes).digest("hex");
+			return node_path.join(directory, `${loginSessionSha256}.json`);
+		}
+		derToRawSignature(derSignature) {
+			let offset = 2;
+			if (derSignature[offset] !== 2) throw new Error("Invalid DER signature");
+			offset++;
+			const rLength = derSignature[offset++];
+			let r = derSignature.subarray(offset, offset + rLength);
+			offset += rLength;
+			if (derSignature[offset] !== 2) throw new Error("Invalid DER signature");
+			offset++;
+			const sLength = derSignature[offset++];
+			let s = derSignature.subarray(offset, offset + sLength);
+			r = r[0] === 0 ? r.subarray(1) : r;
+			s = s[0] === 0 ? s.subarray(1) : s;
+			const rPadded = Buffer.concat([Buffer.alloc(32 - r.length), r]);
+			const sPadded = Buffer.concat([Buffer.alloc(32 - s.length), s]);
+			return Buffer.concat([rPadded, sPadded]);
+		}
+		createDPoPInterceptor(middlewareStack) {
+			middlewareStack.add((next) => async (args) => {
+				if (protocols.HttpRequest.isInstance(args.request)) {
+					const request = args.request;
+					const actualEndpoint = `${request.protocol}//${request.hostname}${request.port ? `:${request.port}` : ""}${request.path}`;
+					const dpop = await this.generateDpop(request.method, actualEndpoint);
+					request.headers = {
+						...request.headers,
+						DPoP: dpop
+					};
+				}
+				return next(args);
+			}, {
+				step: "finalizeRequest",
+				name: "dpopInterceptor",
+				override: true
+			});
+		}
+		async generateDpop(method = "POST", endpoint) {
+			const token = await this.loadToken();
+			try {
+				const privateKey = node_crypto.createPrivateKey({
+					key: token.dpopKey,
+					format: "pem",
+					type: "sec1"
+				});
+				const publicDer = node_crypto.createPublicKey(privateKey).export({
+					format: "der",
+					type: "spki"
+				});
+				let pointStart = -1;
+				for (let i = 0; i < publicDer.length; i++) if (publicDer[i] === 4) {
+					pointStart = i;
+					break;
+				}
+				const x = publicDer.slice(pointStart + 1, pointStart + 33);
+				const y = publicDer.slice(pointStart + 33, pointStart + 65);
+				const header = {
+					alg: "ES256",
+					typ: "dpop+jwt",
+					jwk: {
+						kty: "EC",
+						crv: "P-256",
+						x: x.toString("base64url"),
+						y: y.toString("base64url")
+					}
+				};
+				const payload = {
+					jti: crypto.randomUUID(),
+					htm: method,
+					htu: endpoint,
+					iat: Math.floor(Date.now() / 1e3)
+				};
+				const message = `${Buffer.from(JSON.stringify(header)).toString("base64url")}.${Buffer.from(JSON.stringify(payload)).toString("base64url")}`;
+				const asn1Signature = node_crypto.sign("sha256", Buffer.from(message), privateKey);
+				return `${message}.${this.derToRawSignature(asn1Signature).toString("base64url")}`;
+			} catch (error) {
+				throw new config.CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, {
+					logger: this.logger,
+					tryNextLink: false
+				});
+			}
+		}
+	};
+	const fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+		init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
+		const profiles = await config.parseKnownFiles(init || {});
+		const profileName = config.getProfileName({ profile: init?.profile ?? callerClientConfig?.profile });
+		const profile = profiles[profileName];
+		if (!profile?.login_session) throw new config.CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
+			tryNextLink: true,
+			logger: init?.logger
+		});
+		const credentials = await new LoginCredentialsFetcher(profile, init, callerClientConfig).loadCredentials();
+		return client.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
+	};
+	exports.fromLoginCredentials = fromLoginCredentials;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-ini@3.972.53/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/index.js
+var require_dist_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
+	var config = (init_config(), __toCommonJS(config_exports));
+	var client = (init_client(), __toCommonJS(client_exports));
+	var credentialProviderLogin = require_dist_cjs$1();
+	const resolveCredentialSource = (credentialSource, profileName, logger) => {
+		const sourceProvidersMap = {
+			EcsContainer: async (options) => {
+				const { fromHttp } = await import("./dist-cjs4.js").then((m) => /* @__PURE__ */ __toESM(m.default));
+				const { fromContainerMetadata } = await import("./dist-cjs9.js").then((m) => /* @__PURE__ */ __toESM(m.default));
+				logger?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer");
+				return async () => config.chain(fromHttp(options ?? {}), fromContainerMetadata(options))().then(setNamedProvider);
+			},
+			Ec2InstanceMetadata: async (options) => {
+				logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");
+				const { fromInstanceMetadata } = await import("./dist-cjs9.js").then((m) => /* @__PURE__ */ __toESM(m.default));
+				return async () => fromInstanceMetadata(options)().then(setNamedProvider);
+			},
+			Environment: async (options) => {
+				logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");
+				const { fromEnv } = await import("./dist-cjs.js").then((m) => /* @__PURE__ */ __toESM(m.default));
+				return async () => fromEnv(options)().then(setNamedProvider);
+			}
+		};
+		if (credentialSource in sourceProvidersMap) return sourceProvidersMap[credentialSource];
+		else throw new config.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
+	};
+	const setNamedProvider = (creds) => client.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
+	const isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
+		return Boolean(arg) && typeof arg === "object" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1 && ["undefined", "string"].indexOf(typeof arg.external_id) > -1 && ["undefined", "string"].indexOf(typeof arg.mfa_serial) > -1 && (isAssumeRoleWithSourceProfile(arg, {
+			profile,
+			logger
+		}) || isCredentialSourceProfile(arg, {
+			profile,
+			logger
+		}));
+	};
+	const isAssumeRoleWithSourceProfile = (arg, { profile, logger }) => {
+		const withSourceProfile = typeof arg.source_profile === "string" && typeof arg.credential_source === "undefined";
+		if (withSourceProfile) logger?.debug?.(`    ${profile} isAssumeRoleWithSourceProfile source_profile=${arg.source_profile}`);
+		return withSourceProfile;
+	};
+	const isCredentialSourceProfile = (arg, { profile, logger }) => {
+		const withProviderProfile = typeof arg.credential_source === "string" && typeof arg.source_profile === "undefined";
+		if (withProviderProfile) logger?.debug?.(`    ${profile} isCredentialSourceProfile credential_source=${arg.credential_source}`);
+		return withProviderProfile;
+	};
+	const resolveAssumeRoleCredentials = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, resolveProfileData) => {
+		options.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");
+		const profileData = profiles[profileName];
+		const { source_profile, region } = profileData;
+		if (!options.roleAssumer) {
+			const { getDefaultRoleAssumer } = await import("./sts.js");
+			options.roleAssumer = getDefaultRoleAssumer({
+				...options.clientConfig,
+				credentialProviderLogger: options.logger,
+				parentClientConfig: {
+					...callerClientConfig,
+					...options?.parentClientConfig,
+					region: region ?? options?.parentClientConfig?.region ?? callerClientConfig?.region
+				}
+			}, options.clientPlugins);
+		}
+		if (source_profile && source_profile in visitedProfiles) throw new config.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${config.getProfileName(options)}. Profiles visited: ` + Object.keys(visitedProfiles).join(", "), { logger: options.logger });
+		options.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${source_profile ? `source_profile=[${source_profile}]` : `profile=[${profileName}]`}`);
+		const sourceCredsProvider = source_profile ? resolveProfileData(source_profile, profiles, options, callerClientConfig, {
+			...visitedProfiles,
+			[source_profile]: true
+		}, isCredentialSourceWithoutRoleArn(profiles[source_profile] ?? {})) : (await resolveCredentialSource(profileData.credential_source, profileName, options.logger)(options))();
+		if (isCredentialSourceWithoutRoleArn(profileData)) return sourceCredsProvider.then((creds) => client.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+		else {
+			const params = {
+				RoleArn: profileData.role_arn,
+				RoleSessionName: profileData.role_session_name || `aws-sdk-js-${Date.now()}`,
+				ExternalId: profileData.external_id,
+				DurationSeconds: parseInt(profileData.duration_seconds || "3600", 10)
+			};
+			const { mfa_serial } = profileData;
+			if (mfa_serial) {
+				if (!options.mfaCodeProvider) throw new config.CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, {
+					logger: options.logger,
+					tryNextLink: false
+				});
+				params.SerialNumber = mfa_serial;
+				params.TokenCode = await options.mfaCodeProvider(mfa_serial);
+			}
+			const sourceCreds = await sourceCredsProvider;
+			return options.roleAssumer(sourceCreds, params).then((creds) => client.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+		}
+	};
+	const isCredentialSourceWithoutRoleArn = (section) => {
+		return !section.role_arn && !!section.credential_source;
+	};
+	const isLoginProfile = (data) => {
+		return Boolean(data && data.login_session);
+	};
+	const resolveLoginCredentials = async (profileName, options, callerClientConfig) => {
+		const credentials = await credentialProviderLogin.fromLoginCredentials({
+			...options,
+			profile: profileName
+		})({ callerClientConfig });
+		return client.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
+	};
+	const isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string";
+	const resolveProcessCredentials = async (options, profile) => import("./dist-cjs6.js").then((m) => /* @__PURE__ */ __toESM(m.default)).then(({ fromProcess }) => fromProcess({
+		...options,
+		profile
+	})().then((creds) => client.setCredentialFeature(creds, "CREDENTIALS_PROFILE_PROCESS", "v")));
+	const resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
+		const { fromSSO } = await import("./dist-cjs7.js").then((m) => /* @__PURE__ */ __toESM(m.default));
+		return fromSSO({
+			profile,
+			logger: options.logger,
+			parentClientConfig: options.parentClientConfig,
+			clientConfig: options.clientConfig
+		})({ callerClientConfig }).then((creds) => {
+			if (profileData.sso_session) return client.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
+			else return client.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
+		});
+	};
+	const isSsoProfile = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
+	const isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1;
+	const resolveStaticCredentials = async (profile, options) => {
+		options?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");
+		const credentials = {
+			accessKeyId: profile.aws_access_key_id,
+			secretAccessKey: profile.aws_secret_access_key,
+			sessionToken: profile.aws_session_token,
+			...profile.aws_credential_scope && { credentialScope: profile.aws_credential_scope },
+			...profile.aws_account_id && { accountId: profile.aws_account_id }
+		};
+		return client.setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
+	};
+	const isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1;
+	const resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => import("./dist-cjs8.js").then((m) => /* @__PURE__ */ __toESM(m.default)).then(({ fromTokenFile }) => fromTokenFile({
+		webIdentityTokenFile: profile.web_identity_token_file,
+		roleArn: profile.role_arn,
+		roleSessionName: profile.role_session_name,
+		roleAssumerWithWebIdentity: options.roleAssumerWithWebIdentity,
+		logger: options.logger,
+		parentClientConfig: options.parentClientConfig
+	})({ callerClientConfig }).then((creds) => client.setCredentialFeature(creds, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q")));
+	const resolveProfileData = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
+		const data = profiles[profileName];
+		if (Object.keys(visitedProfiles).length > 0 && isStaticCredsProfile(data)) return resolveStaticCredentials(data, options);
+		if (isAssumeRoleRecursiveCall || isAssumeRoleProfile(data, {
+			profile: profileName,
+			logger: options.logger
+		})) return resolveAssumeRoleCredentials(profileName, profiles, options, callerClientConfig, visitedProfiles, resolveProfileData);
+		if (isStaticCredsProfile(data)) return resolveStaticCredentials(data, options);
+		if (isWebIdentityProfile(data)) return resolveWebIdentityCredentials(data, options, callerClientConfig);
+		if (isProcessProfile(data)) return resolveProcessCredentials(options, profileName);
+		if (isSsoProfile(data)) return await resolveSsoCredentials(profileName, data, options, callerClientConfig);
+		if (isLoginProfile(data)) return resolveLoginCredentials(profileName, options, callerClientConfig);
+		throw new config.CredentialsProviderError(`Could not resolve credentials using profile: [${profileName}] in configuration/credentials file(s).`, { logger: options.logger });
+	};
+	const fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
+		init.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");
+		const profiles = await config.parseKnownFiles(init);
+		return resolveProfileData(config.getProfileName({ profile: init.profile ?? callerClientConfig?.profile }), profiles, init, callerClientConfig);
+	};
+	exports.fromIni = fromIni;
+}));
+//#endregion
+export default require_dist_cjs();
+export {};

package/dist/dist-cjs6.js

@@ -0,0 +1,60 @@
+import { a as __toCommonJS, i as __require, t as __commonJSMin } from "./rolldown-runtime.js";
+import { n as init_client, t as client_exports } from "./client.js";
+import { A as config_exports, j as init_config } from "./serde.js";
+//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-process@3.972.46/node_modules/@aws-sdk/credential-provider-process/dist-cjs/index.js
+var require_dist_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
+	var config = (init_config(), __toCommonJS(config_exports));
+	var node_child_process = __require("node:child_process");
+	var node_util = __require("node:util");
+	var client = (init_client(), __toCommonJS(client_exports));
+	const getValidatedProcessCredentials = (profileName, data, profiles) => {
+		if (data.Version !== 1) throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
+		if (data.AccessKeyId === void 0 || data.SecretAccessKey === void 0) throw Error(`Profile ${profileName} credential_process returned invalid credentials.`);
+		if (data.Expiration) {
+			const currentTime = /* @__PURE__ */ new Date();
+			if (new Date(data.Expiration) < currentTime) throw Error(`Profile ${profileName} credential_process returned expired credentials.`);
+		}
+		let accountId = data.AccountId;
+		if (!accountId && profiles?.[profileName]?.aws_account_id) accountId = profiles[profileName].aws_account_id;
+		const credentials = {
+			accessKeyId: data.AccessKeyId,
+			secretAccessKey: data.SecretAccessKey,
+			...data.SessionToken && { sessionToken: data.SessionToken },
+			...data.Expiration && { expiration: new Date(data.Expiration) },
+			...data.CredentialScope && { credentialScope: data.CredentialScope },
+			...accountId && { accountId }
+		};
+		client.setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
+		return credentials;
+	};
+	const resolveProcessCredentials = async (profileName, profiles, logger) => {
+		const profile = profiles[profileName];
+		if (profiles[profileName]) {
+			const credentialProcess = profile["credential_process"];
+			if (credentialProcess !== void 0) {
+				const execPromise = node_util.promisify(config.externalDataInterceptor?.getTokenRecord?.().exec ?? node_child_process.exec);
+				try {
+					const { stdout } = await execPromise(credentialProcess);
+					let data;
+					try {
+						data = JSON.parse(stdout.trim());
+					} catch {
+						throw Error(`Profile ${profileName} credential_process returned invalid JSON.`);
+					}
+					return getValidatedProcessCredentials(profileName, data, profiles);
+				} catch (error) {
+					throw new config.CredentialsProviderError(error.message, { logger });
+				}
+			} else throw new config.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
+		} else throw new config.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, { logger });
+	};
+	const fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
+		init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
+		const profiles = await config.parseKnownFiles(init);
+		return resolveProcessCredentials(config.getProfileName({ profile: init.profile ?? callerClientConfig?.profile }), profiles, init.logger);
+	};
+	exports.fromProcess = fromProcess;
+}));
+//#endregion
+export default require_dist_cjs();
+export {};