@aws-sdk/nested-clients 3.935.0 → 3.939.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (77) hide show
  1. package/dist-cjs/submodules/signin/auth/httpAuthSchemeProvider.js +56 -0
  2. package/dist-cjs/submodules/signin/endpoint/endpointResolver.js +18 -0
  3. package/dist-cjs/submodules/signin/endpoint/ruleset.js +7 -0
  4. package/dist-cjs/submodules/signin/index.js +439 -0
  5. package/dist-cjs/submodules/signin/runtimeConfig.browser.js +39 -0
  6. package/dist-cjs/submodules/signin/runtimeConfig.js +54 -0
  7. package/dist-cjs/submodules/signin/runtimeConfig.native.js +15 -0
  8. package/dist-cjs/submodules/signin/runtimeConfig.shared.js +42 -0
  9. package/dist-es/submodules/signin/Signin.js +9 -0
  10. package/dist-es/submodules/signin/SigninClient.js +50 -0
  11. package/dist-es/submodules/signin/auth/httpAuthExtensionConfiguration.js +38 -0
  12. package/dist-es/submodules/signin/auth/httpAuthSchemeProvider.js +50 -0
  13. package/dist-es/submodules/signin/commands/CreateOAuth2TokenCommand.js +16 -0
  14. package/dist-es/submodules/signin/commands/index.js +1 -0
  15. package/dist-es/submodules/signin/endpoint/EndpointParameters.js +13 -0
  16. package/dist-es/submodules/signin/endpoint/endpointResolver.js +14 -0
  17. package/dist-es/submodules/signin/endpoint/ruleset.js +4 -0
  18. package/dist-es/submodules/signin/extensionConfiguration.js +1 -0
  19. package/dist-es/submodules/signin/index.js +6 -0
  20. package/dist-es/submodules/signin/models/SigninServiceException.js +8 -0
  21. package/dist-es/submodules/signin/models/enums.js +8 -0
  22. package/dist-es/submodules/signin/models/errors.js +57 -0
  23. package/dist-es/submodules/signin/models/models_0.js +1 -0
  24. package/dist-es/submodules/signin/runtimeConfig.browser.js +34 -0
  25. package/dist-es/submodules/signin/runtimeConfig.js +49 -0
  26. package/dist-es/submodules/signin/runtimeConfig.native.js +11 -0
  27. package/dist-es/submodules/signin/runtimeConfig.shared.js +38 -0
  28. package/dist-es/submodules/signin/runtimeExtensions.js +9 -0
  29. package/dist-es/submodules/signin/schemas/schemas_0.js +221 -0
  30. package/dist-types/submodules/signin/Signin.d.ts +18 -0
  31. package/dist-types/submodules/signin/SigninClient.d.ts +198 -0
  32. package/dist-types/submodules/signin/auth/httpAuthExtensionConfiguration.d.ts +29 -0
  33. package/dist-types/submodules/signin/auth/httpAuthSchemeProvider.d.ts +75 -0
  34. package/dist-types/submodules/signin/commands/CreateOAuth2TokenCommand.d.ts +157 -0
  35. package/dist-types/submodules/signin/commands/index.d.ts +1 -0
  36. package/dist-types/submodules/signin/endpoint/EndpointParameters.d.ts +38 -0
  37. package/dist-types/submodules/signin/endpoint/endpointResolver.d.ts +5 -0
  38. package/dist-types/submodules/signin/endpoint/ruleset.d.ts +2 -0
  39. package/dist-types/submodules/signin/extensionConfiguration.d.ts +9 -0
  40. package/dist-types/submodules/signin/index.d.ts +16 -0
  41. package/dist-types/submodules/signin/models/SigninServiceException.d.ts +14 -0
  42. package/dist-types/submodules/signin/models/enums.d.ts +34 -0
  43. package/dist-types/submodules/signin/models/errors.d.ts +102 -0
  44. package/dist-types/submodules/signin/models/models_0.d.ts +142 -0
  45. package/dist-types/submodules/signin/runtimeConfig.browser.d.ts +59 -0
  46. package/dist-types/submodules/signin/runtimeConfig.d.ts +59 -0
  47. package/dist-types/submodules/signin/runtimeConfig.native.d.ts +58 -0
  48. package/dist-types/submodules/signin/runtimeConfig.shared.d.ts +33 -0
  49. package/dist-types/submodules/signin/runtimeExtensions.d.ts +17 -0
  50. package/dist-types/submodules/signin/schemas/schemas_0.d.ts +14 -0
  51. package/dist-types/submodules/sts/commands/AssumeRoleCommand.d.ts +2 -3
  52. package/dist-types/submodules/sts/commands/AssumeRoleWithWebIdentityCommand.d.ts +2 -3
  53. package/dist-types/submodules/sts/models/errors.d.ts +2 -3
  54. package/dist-types/ts3.4/submodules/signin/Signin.d.ts +22 -0
  55. package/dist-types/ts3.4/submodules/signin/SigninClient.d.ts +127 -0
  56. package/dist-types/ts3.4/submodules/signin/auth/httpAuthExtensionConfiguration.d.ts +32 -0
  57. package/dist-types/ts3.4/submodules/signin/auth/httpAuthSchemeProvider.d.ts +47 -0
  58. package/dist-types/ts3.4/submodules/signin/commands/CreateOAuth2TokenCommand.d.ts +47 -0
  59. package/dist-types/ts3.4/submodules/signin/commands/index.d.ts +1 -0
  60. package/dist-types/ts3.4/submodules/signin/endpoint/EndpointParameters.d.ts +51 -0
  61. package/dist-types/ts3.4/submodules/signin/endpoint/endpointResolver.d.ts +8 -0
  62. package/dist-types/ts3.4/submodules/signin/endpoint/ruleset.d.ts +2 -0
  63. package/dist-types/ts3.4/submodules/signin/extensionConfiguration.d.ts +9 -0
  64. package/dist-types/ts3.4/submodules/signin/index.d.ts +10 -0
  65. package/dist-types/ts3.4/submodules/signin/models/SigninServiceException.d.ts +9 -0
  66. package/dist-types/ts3.4/submodules/signin/models/enums.d.ts +10 -0
  67. package/dist-types/ts3.4/submodules/signin/models/errors.d.ts +35 -0
  68. package/dist-types/ts3.4/submodules/signin/models/models_0.d.ts +26 -0
  69. package/dist-types/ts3.4/submodules/signin/runtimeConfig.browser.d.ts +121 -0
  70. package/dist-types/ts3.4/submodules/signin/runtimeConfig.d.ts +114 -0
  71. package/dist-types/ts3.4/submodules/signin/runtimeConfig.native.d.ts +125 -0
  72. package/dist-types/ts3.4/submodules/signin/runtimeConfig.shared.d.ts +53 -0
  73. package/dist-types/ts3.4/submodules/signin/runtimeExtensions.d.ts +11 -0
  74. package/dist-types/ts3.4/submodules/signin/schemas/schemas_0.d.ts +19 -0
  75. package/package.json +22 -11
  76. package/signin.d.ts +7 -0
  77. package/signin.js +5 -0
@@ -0,0 +1,157 @@
1
+ import { Command as $Command } from "@smithy/smithy-client";
2
+ import { MetadataBearer as __MetadataBearer } from "@smithy/types";
3
+ import { CreateOAuth2TokenRequest, CreateOAuth2TokenResponse } from "../models/models_0";
4
+ import { SigninClientResolvedConfig } from "../SigninClient";
5
+ /**
6
+ * @public
7
+ */
8
+ export type { __MetadataBearer };
9
+ export { $Command };
10
+ /**
11
+ * @public
12
+ *
13
+ * The input for {@link CreateOAuth2TokenCommand}.
14
+ */
15
+ export interface CreateOAuth2TokenCommandInput extends CreateOAuth2TokenRequest {
16
+ }
17
+ /**
18
+ * @public
19
+ *
20
+ * The output of {@link CreateOAuth2TokenCommand}.
21
+ */
22
+ export interface CreateOAuth2TokenCommandOutput extends CreateOAuth2TokenResponse, __MetadataBearer {
23
+ }
24
+ declare const CreateOAuth2TokenCommand_base: {
25
+ new (input: CreateOAuth2TokenCommandInput): import("@smithy/smithy-client").CommandImpl<CreateOAuth2TokenCommandInput, CreateOAuth2TokenCommandOutput, SigninClientResolvedConfig, CreateOAuth2TokenCommandInput, CreateOAuth2TokenCommandOutput>;
26
+ new (input: CreateOAuth2TokenCommandInput): import("@smithy/smithy-client").CommandImpl<CreateOAuth2TokenCommandInput, CreateOAuth2TokenCommandOutput, SigninClientResolvedConfig, CreateOAuth2TokenCommandInput, CreateOAuth2TokenCommandOutput>;
27
+ getEndpointParameterInstructions(): import("@smithy/middleware-endpoint").EndpointParameterInstructions;
28
+ };
29
+ /**
30
+ * CreateOAuth2Token API
31
+ *
32
+ * Path: /v1/token
33
+ * Request Method: POST
34
+ * Content-Type: application/json or application/x-www-form-urlencoded
35
+ *
36
+ * This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both:
37
+ * 1. Authorization code redemption (grant_type=authorization_code) - NOT idempotent
38
+ * 2. Token refresh (grant_type=refresh_token) - Idempotent within token validity window
39
+ *
40
+ * The operation behavior is determined by the grant_type parameter in the request body:
41
+ *
42
+ * **Authorization Code Flow (NOT Idempotent):**
43
+ * - JSON or form-encoded body with client_id, grant_type=authorization_code, code, redirect_uri, code_verifier
44
+ * - Returns access_token, token_type, expires_in, refresh_token, and id_token
45
+ * - Each authorization code can only be used ONCE for security (prevents replay attacks)
46
+ *
47
+ * **Token Refresh Flow (Idempotent):**
48
+ * - JSON or form-encoded body with client_id, grant_type=refresh_token, refresh_token
49
+ * - Returns access_token, token_type, expires_in, and refresh_token (no id_token)
50
+ * - Multiple calls with same refresh_token return consistent results within validity window
51
+ *
52
+ * Authentication and authorization:
53
+ * - Confidential clients: sigv4 signing required with signin:ExchangeToken permissions
54
+ * - CLI clients (public): authn/authz skipped based on client_id & grant_type
55
+ *
56
+ * Note: This operation cannot be marked as @idempotent because it handles both idempotent
57
+ * (token refresh) and non-idempotent (auth code redemption) flows in a single endpoint.
58
+ * @example
59
+ * Use a bare-bones client and the command you need to make an API call.
60
+ * ```javascript
61
+ * import { SigninClient, CreateOAuth2TokenCommand } from "@aws-sdk/client-signin"; // ES Modules import
62
+ * // const { SigninClient, CreateOAuth2TokenCommand } = require("@aws-sdk/client-signin"); // CommonJS import
63
+ * // import type { SigninClientConfig } from "@aws-sdk/client-signin";
64
+ * const config = {}; // type is SigninClientConfig
65
+ * const client = new SigninClient(config);
66
+ * const input = { // CreateOAuth2TokenRequest
67
+ * tokenInput: { // CreateOAuth2TokenRequestBody
68
+ * clientId: "STRING_VALUE", // required
69
+ * grantType: "STRING_VALUE", // required
70
+ * code: "STRING_VALUE",
71
+ * redirectUri: "STRING_VALUE",
72
+ * codeVerifier: "STRING_VALUE",
73
+ * refreshToken: "STRING_VALUE",
74
+ * },
75
+ * };
76
+ * const command = new CreateOAuth2TokenCommand(input);
77
+ * const response = await client.send(command);
78
+ * // { // CreateOAuth2TokenResponse
79
+ * // tokenOutput: { // CreateOAuth2TokenResponseBody
80
+ * // accessToken: { // AccessToken
81
+ * // accessKeyId: "STRING_VALUE", // required
82
+ * // secretAccessKey: "STRING_VALUE", // required
83
+ * // sessionToken: "STRING_VALUE", // required
84
+ * // },
85
+ * // tokenType: "STRING_VALUE", // required
86
+ * // expiresIn: Number("int"), // required
87
+ * // refreshToken: "STRING_VALUE", // required
88
+ * // idToken: "STRING_VALUE",
89
+ * // },
90
+ * // };
91
+ *
92
+ * ```
93
+ *
94
+ * @param CreateOAuth2TokenCommandInput - {@link CreateOAuth2TokenCommandInput}
95
+ * @returns {@link CreateOAuth2TokenCommandOutput}
96
+ * @see {@link CreateOAuth2TokenCommandInput} for command's `input` shape.
97
+ * @see {@link CreateOAuth2TokenCommandOutput} for command's `response` shape.
98
+ * @see {@link SigninClientResolvedConfig | config} for SigninClient's `config` shape.
99
+ *
100
+ * @throws {@link AccessDeniedException} (client fault)
101
+ * Error thrown for access denied scenarios with flexible HTTP status mapping
102
+ *
103
+ * Runtime HTTP Status Code Mapping:
104
+ * - HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
105
+ * - HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS
106
+ *
107
+ * The specific HTTP status code is determined at runtime based on the error enum value.
108
+ * Consumers should use the error field to determine the specific access denial reason.
109
+ *
110
+ * @throws {@link InternalServerException} (server fault)
111
+ * Error thrown when an internal server error occurs
112
+ *
113
+ * HTTP Status Code: 500 Internal Server Error
114
+ *
115
+ * Used for unexpected server-side errors that prevent request processing.
116
+ *
117
+ * @throws {@link TooManyRequestsError} (client fault)
118
+ * Error thrown when rate limit is exceeded
119
+ *
120
+ * HTTP Status Code: 429 Too Many Requests
121
+ *
122
+ * Possible OAuth2ErrorCode values:
123
+ * - INVALID_REQUEST: Rate limiting, too many requests, abuse prevention
124
+ *
125
+ * Possible causes:
126
+ * - Too many token requests from the same client
127
+ * - Rate limiting based on client_id or IP address
128
+ * - Abuse prevention mechanisms triggered
129
+ * - Service protection against excessive token generation
130
+ *
131
+ * @throws {@link ValidationException} (client fault)
132
+ * Error thrown when request validation fails
133
+ *
134
+ * HTTP Status Code: 400 Bad Request
135
+ *
136
+ * Used for request validation errors such as malformed parameters,
137
+ * missing required fields, or invalid parameter values.
138
+ *
139
+ * @throws {@link SigninServiceException}
140
+ * <p>Base exception class for all service exceptions from Signin service.</p>
141
+ *
142
+ *
143
+ * @public
144
+ */
145
+ export declare class CreateOAuth2TokenCommand extends CreateOAuth2TokenCommand_base {
146
+ /** @internal type navigation helper, not in runtime. */
147
+ protected static __types: {
148
+ api: {
149
+ input: CreateOAuth2TokenRequest;
150
+ output: CreateOAuth2TokenResponse;
151
+ };
152
+ sdk: {
153
+ input: CreateOAuth2TokenCommandInput;
154
+ output: CreateOAuth2TokenCommandOutput;
155
+ };
156
+ };
157
+ }
@@ -0,0 +1 @@
1
+ export * from "./CreateOAuth2TokenCommand";
@@ -0,0 +1,38 @@
1
+ import { Endpoint, EndpointParameters as __EndpointParameters, EndpointV2, Provider } from "@smithy/types";
2
+ /**
3
+ * @public
4
+ */
5
+ export interface ClientInputEndpointParameters {
6
+ useDualstackEndpoint?: boolean | undefined | Provider<boolean | undefined>;
7
+ useFipsEndpoint?: boolean | undefined | Provider<boolean | undefined>;
8
+ endpoint?: string | Provider<string> | Endpoint | Provider<Endpoint> | EndpointV2 | Provider<EndpointV2>;
9
+ region?: string | undefined | Provider<string | undefined>;
10
+ }
11
+ export type ClientResolvedEndpointParameters = Omit<ClientInputEndpointParameters, "endpoint"> & {
12
+ defaultSigningName: string;
13
+ };
14
+ export declare const resolveClientEndpointParameters: <T>(options: T & ClientInputEndpointParameters) => T & ClientResolvedEndpointParameters;
15
+ export declare const commonParams: {
16
+ readonly UseFIPS: {
17
+ readonly type: "builtInParams";
18
+ readonly name: "useFipsEndpoint";
19
+ };
20
+ readonly Endpoint: {
21
+ readonly type: "builtInParams";
22
+ readonly name: "endpoint";
23
+ };
24
+ readonly Region: {
25
+ readonly type: "builtInParams";
26
+ readonly name: "region";
27
+ };
28
+ readonly UseDualStack: {
29
+ readonly type: "builtInParams";
30
+ readonly name: "useDualstackEndpoint";
31
+ };
32
+ };
33
+ export interface EndpointParameters extends __EndpointParameters {
34
+ UseDualStack?: boolean | undefined;
35
+ UseFIPS?: boolean | undefined;
36
+ Endpoint?: string | undefined;
37
+ Region?: string | undefined;
38
+ }
@@ -0,0 +1,5 @@
1
+ import { EndpointV2, Logger } from "@smithy/types";
2
+ import { EndpointParameters } from "./EndpointParameters";
3
+ export declare const defaultEndpointResolver: (endpointParams: EndpointParameters, context?: {
4
+ logger?: Logger;
5
+ }) => EndpointV2;
@@ -0,0 +1,2 @@
1
+ import { RuleSetObject } from "@smithy/types";
2
+ export declare const ruleSet: RuleSetObject;
@@ -0,0 +1,9 @@
1
+ import { AwsRegionExtensionConfiguration } from "@aws-sdk/types";
2
+ import { HttpHandlerExtensionConfiguration } from "@smithy/protocol-http";
3
+ import { DefaultExtensionConfiguration } from "@smithy/types";
4
+ import { HttpAuthExtensionConfiguration } from "./auth/httpAuthExtensionConfiguration";
5
+ /**
6
+ * @internal
7
+ */
8
+ export interface SigninExtensionConfiguration extends HttpHandlerExtensionConfiguration, DefaultExtensionConfiguration, AwsRegionExtensionConfiguration, HttpAuthExtensionConfiguration {
9
+ }
@@ -0,0 +1,16 @@
1
+ /**
2
+ * AWS Sign-In manages authentication for AWS services. This service provides
3
+ * secure authentication flows for accessing AWS resources from the console and developer tools.
4
+ *
5
+ * @packageDocumentation
6
+ */
7
+ export * from "./SigninClient";
8
+ export * from "./Signin";
9
+ export { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
10
+ export type { RuntimeExtension } from "./runtimeExtensions";
11
+ export type { SigninExtensionConfiguration } from "./extensionConfiguration";
12
+ export * from "./commands";
13
+ export * from "./models/enums";
14
+ export * from "./models/errors";
15
+ export type * from "./models/models_0";
16
+ export { SigninServiceException } from "./models/SigninServiceException";
@@ -0,0 +1,14 @@
1
+ import { ServiceException as __ServiceException, ServiceExceptionOptions as __ServiceExceptionOptions } from "@smithy/smithy-client";
2
+ export type { __ServiceExceptionOptions };
3
+ export { __ServiceException };
4
+ /**
5
+ * @public
6
+ *
7
+ * Base exception class for all service exceptions from Signin service.
8
+ */
9
+ export declare class SigninServiceException extends __ServiceException {
10
+ /**
11
+ * @internal
12
+ */
13
+ constructor(options: __ServiceExceptionOptions);
14
+ }
@@ -0,0 +1,34 @@
1
+ /**
2
+ * @public
3
+ * @enum
4
+ */
5
+ export declare const OAuth2ErrorCode: {
6
+ /**
7
+ * Authorization code has expired
8
+ */
9
+ readonly AUTHCODE_EXPIRED: "AUTHCODE_EXPIRED";
10
+ /**
11
+ * Insufficient permissions to perform this operation
12
+ */
13
+ readonly INSUFFICIENT_PERMISSIONS: "INSUFFICIENT_PERMISSIONS";
14
+ /**
15
+ * The request is missing a required parameter, includes an invalid parameter value, or is otherwise malformed
16
+ */
17
+ readonly INVALID_REQUEST: "INVALID_REQUEST";
18
+ /**
19
+ * Internal server error occurred
20
+ */
21
+ readonly SERVER_ERROR: "server_error";
22
+ /**
23
+ * Token has expired and needs to be refreshed
24
+ */
25
+ readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
26
+ /**
27
+ * User credentials have been changed
28
+ */
29
+ readonly USER_CREDENTIALS_CHANGED: "USER_CREDENTIALS_CHANGED";
30
+ };
31
+ /**
32
+ * @public
33
+ */
34
+ export type OAuth2ErrorCode = (typeof OAuth2ErrorCode)[keyof typeof OAuth2ErrorCode];
@@ -0,0 +1,102 @@
1
+ import { ExceptionOptionType as __ExceptionOptionType } from "@smithy/smithy-client";
2
+ import { OAuth2ErrorCode } from "./enums";
3
+ import { SigninServiceException as __BaseException } from "./SigninServiceException";
4
+ /**
5
+ * Error thrown for access denied scenarios with flexible HTTP status mapping
6
+ *
7
+ * Runtime HTTP Status Code Mapping:
8
+ * - HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
9
+ * - HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS
10
+ *
11
+ * The specific HTTP status code is determined at runtime based on the error enum value.
12
+ * Consumers should use the error field to determine the specific access denial reason.
13
+ * @public
14
+ */
15
+ export declare class AccessDeniedException extends __BaseException {
16
+ readonly name: "AccessDeniedException";
17
+ readonly $fault: "client";
18
+ /**
19
+ * OAuth 2.0 error code indicating the specific type of access denial
20
+ * Can be TOKEN_EXPIRED, AUTHCODE_EXPIRED, USER_CREDENTIALS_CHANGED, or INSUFFICIENT_PERMISSIONS
21
+ * @public
22
+ */
23
+ error: OAuth2ErrorCode | undefined;
24
+ /**
25
+ * @internal
26
+ */
27
+ constructor(opts: __ExceptionOptionType<AccessDeniedException, __BaseException>);
28
+ }
29
+ /**
30
+ * Error thrown when an internal server error occurs
31
+ *
32
+ * HTTP Status Code: 500 Internal Server Error
33
+ *
34
+ * Used for unexpected server-side errors that prevent request processing.
35
+ * @public
36
+ */
37
+ export declare class InternalServerException extends __BaseException {
38
+ readonly name: "InternalServerException";
39
+ readonly $fault: "server";
40
+ /**
41
+ * OAuth 2.0 error code indicating server error
42
+ * Will be SERVER_ERROR for internal server errors
43
+ * @public
44
+ */
45
+ error: OAuth2ErrorCode | undefined;
46
+ /**
47
+ * @internal
48
+ */
49
+ constructor(opts: __ExceptionOptionType<InternalServerException, __BaseException>);
50
+ }
51
+ /**
52
+ * Error thrown when rate limit is exceeded
53
+ *
54
+ * HTTP Status Code: 429 Too Many Requests
55
+ *
56
+ * Possible OAuth2ErrorCode values:
57
+ * - INVALID_REQUEST: Rate limiting, too many requests, abuse prevention
58
+ *
59
+ * Possible causes:
60
+ * - Too many token requests from the same client
61
+ * - Rate limiting based on client_id or IP address
62
+ * - Abuse prevention mechanisms triggered
63
+ * - Service protection against excessive token generation
64
+ * @public
65
+ */
66
+ export declare class TooManyRequestsError extends __BaseException {
67
+ readonly name: "TooManyRequestsError";
68
+ readonly $fault: "client";
69
+ /**
70
+ * OAuth 2.0 error code indicating the specific type of error
71
+ * Will be INVALID_REQUEST for rate limiting scenarios
72
+ * @public
73
+ */
74
+ error: OAuth2ErrorCode | undefined;
75
+ /**
76
+ * @internal
77
+ */
78
+ constructor(opts: __ExceptionOptionType<TooManyRequestsError, __BaseException>);
79
+ }
80
+ /**
81
+ * Error thrown when request validation fails
82
+ *
83
+ * HTTP Status Code: 400 Bad Request
84
+ *
85
+ * Used for request validation errors such as malformed parameters,
86
+ * missing required fields, or invalid parameter values.
87
+ * @public
88
+ */
89
+ export declare class ValidationException extends __BaseException {
90
+ readonly name: "ValidationException";
91
+ readonly $fault: "client";
92
+ /**
93
+ * OAuth 2.0 error code indicating validation failure
94
+ * Will be INVALID_REQUEST for validation errors
95
+ * @public
96
+ */
97
+ error: OAuth2ErrorCode | undefined;
98
+ /**
99
+ * @internal
100
+ */
101
+ constructor(opts: __ExceptionOptionType<ValidationException, __BaseException>);
102
+ }
@@ -0,0 +1,142 @@
1
+ /**
2
+ * AWS credentials structure containing temporary access credentials
3
+ *
4
+ * The scoped-down, 15 minute duration AWS credentials.
5
+ * Scoping down will be based on CLI policy (CLI team needs to create it).
6
+ * Similar to cloud shell implementation.
7
+ * @public
8
+ */
9
+ export interface AccessToken {
10
+ /**
11
+ * AWS access key ID for temporary credentials
12
+ * @public
13
+ */
14
+ accessKeyId: string | undefined;
15
+ /**
16
+ * AWS secret access key for temporary credentials
17
+ * @public
18
+ */
19
+ secretAccessKey: string | undefined;
20
+ /**
21
+ * AWS session token for temporary credentials
22
+ * @public
23
+ */
24
+ sessionToken: string | undefined;
25
+ }
26
+ /**
27
+ * Request body payload for CreateOAuth2Token operation
28
+ *
29
+ * The operation type is determined by the grant_type parameter:
30
+ * - grant_type=authorization_code: Requires code, redirect_uri, code_verifier
31
+ * - grant_type=refresh_token: Requires refresh_token
32
+ * @public
33
+ */
34
+ export interface CreateOAuth2TokenRequestBody {
35
+ /**
36
+ * The client identifier (ARN) used during Sign-In onboarding
37
+ * Required for both authorization code and refresh token flows
38
+ * @public
39
+ */
40
+ clientId: string | undefined;
41
+ /**
42
+ * OAuth 2.0 grant type - determines which flow is used
43
+ * Must be "authorization_code" or "refresh_token"
44
+ * @public
45
+ */
46
+ grantType: string | undefined;
47
+ /**
48
+ * The authorization code received from /v1/authorize
49
+ * Required only when grant_type=authorization_code
50
+ * @public
51
+ */
52
+ code?: string | undefined;
53
+ /**
54
+ * The redirect URI that must match the original authorization request
55
+ * Required only when grant_type=authorization_code
56
+ * @public
57
+ */
58
+ redirectUri?: string | undefined;
59
+ /**
60
+ * PKCE code verifier to prove possession of the original code challenge
61
+ * Required only when grant_type=authorization_code
62
+ * @public
63
+ */
64
+ codeVerifier?: string | undefined;
65
+ /**
66
+ * The refresh token returned from auth_code redemption
67
+ * Required only when grant_type=refresh_token
68
+ * @public
69
+ */
70
+ refreshToken?: string | undefined;
71
+ }
72
+ /**
73
+ * Input structure for CreateOAuth2Token operation
74
+ *
75
+ * Contains flattened token operation inputs for both authorization code and refresh token flows.
76
+ * The operation type is determined by the grant_type parameter in the request body.
77
+ * @public
78
+ */
79
+ export interface CreateOAuth2TokenRequest {
80
+ /**
81
+ * Flattened token operation inputs
82
+ * The specific operation is determined by grant_type in the request body
83
+ * @public
84
+ */
85
+ tokenInput: CreateOAuth2TokenRequestBody | undefined;
86
+ }
87
+ /**
88
+ * Response body payload for CreateOAuth2Token operation
89
+ *
90
+ * The response content depends on the grant_type from the request:
91
+ * - grant_type=authorization_code: Returns all fields including refresh_token and id_token
92
+ * - grant_type=refresh_token: Returns access_token, token_type, expires_in, refresh_token (no id_token)
93
+ * @public
94
+ */
95
+ export interface CreateOAuth2TokenResponseBody {
96
+ /**
97
+ * Scoped-down AWS credentials (15 minute duration)
98
+ * Present for both authorization code redemption and token refresh
99
+ * @public
100
+ */
101
+ accessToken: AccessToken | undefined;
102
+ /**
103
+ * Token type indicating this is AWS SigV4 credentials
104
+ * Value is "aws_sigv4" for both flows
105
+ * @public
106
+ */
107
+ tokenType: string | undefined;
108
+ /**
109
+ * Time to expiry in seconds (maximum 900)
110
+ * Present for both authorization code redemption and token refresh
111
+ * @public
112
+ */
113
+ expiresIn: number | undefined;
114
+ /**
115
+ * Encrypted refresh token with cnf.jkt (SHA-256 thumbprint of presented jwk)
116
+ * Always present in responses (required for both flows)
117
+ * @public
118
+ */
119
+ refreshToken: string | undefined;
120
+ /**
121
+ * ID token containing user identity information
122
+ * Present only in authorization code redemption response (grant_type=authorization_code)
123
+ * Not included in token refresh responses
124
+ * @public
125
+ */
126
+ idToken?: string | undefined;
127
+ }
128
+ /**
129
+ * Output structure for CreateOAuth2Token operation
130
+ *
131
+ * Contains flattened token operation outputs for both authorization code and refresh token flows.
132
+ * The response content depends on the grant_type from the original request.
133
+ * @public
134
+ */
135
+ export interface CreateOAuth2TokenResponse {
136
+ /**
137
+ * Flattened token operation outputs
138
+ * The specific response fields depend on the grant_type used in the request
139
+ * @public
140
+ */
141
+ tokenOutput: CreateOAuth2TokenResponseBody | undefined;
142
+ }
@@ -0,0 +1,59 @@
1
+ import { FetchHttpHandler as RequestHandler } from "@smithy/fetch-http-handler";
2
+ import { SigninClientConfig } from "./SigninClient";
3
+ /**
4
+ * @internal
5
+ */
6
+ export declare const getRuntimeConfig: (config: SigninClientConfig) => {
7
+ runtime: string;
8
+ defaultsMode: import("@smithy/types").Provider<import("@smithy/smithy-client").ResolvedDefaultsMode>;
9
+ bodyLengthChecker: import("@smithy/types").BodyLengthCalculator;
10
+ credentialDefaultProvider: ((input: any) => import("@smithy/types").AwsCredentialIdentityProvider) | ((_: unknown) => () => Promise<import("@smithy/types").AwsCredentialIdentity>);
11
+ defaultUserAgentProvider: (config?: import("@aws-sdk/util-user-agent-browser").PreviouslyResolved) => Promise<import("@smithy/types").UserAgent>;
12
+ maxAttempts: number | import("@smithy/types").Provider<number>;
13
+ region: string | import("@smithy/types").Provider<any>;
14
+ requestHandler: import("@smithy/protocol-http").HttpHandler<any> | RequestHandler;
15
+ retryMode: string | import("@smithy/types").Provider<string>;
16
+ sha256: import("@smithy/types").HashConstructor;
17
+ streamCollector: import("@smithy/types").StreamCollector;
18
+ useDualstackEndpoint: (boolean | import("@smithy/types").Provider<boolean>) & (boolean | import("@smithy/types").Provider<boolean | undefined>);
19
+ useFipsEndpoint: (boolean | import("@smithy/types").Provider<boolean>) & (boolean | import("@smithy/types").Provider<boolean | undefined>);
20
+ apiVersion: string;
21
+ cacheMiddleware?: boolean | undefined;
22
+ urlParser: import("@smithy/types").UrlParser;
23
+ base64Decoder: import("@smithy/types").Decoder;
24
+ base64Encoder: (_input: Uint8Array | string) => string;
25
+ utf8Decoder: import("@smithy/types").Decoder;
26
+ utf8Encoder: (input: Uint8Array | string) => string;
27
+ disableHostPrefix: boolean;
28
+ serviceId: string;
29
+ profile?: string;
30
+ logger: import("@smithy/types").Logger;
31
+ extensions: import("./runtimeExtensions").RuntimeExtension[];
32
+ protocol: import("@smithy/types").ClientProtocol<import("@smithy/types").HttpRequest, import("@smithy/types").HttpResponse>;
33
+ customUserAgent?: string | import("@smithy/types").UserAgent;
34
+ userAgentAppId?: string | undefined | import("@smithy/types").Provider<string | undefined>;
35
+ retryStrategy?: import("@smithy/types").RetryStrategy | import("@smithy/types").RetryStrategyV2;
36
+ endpoint?: ((string | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>) & (string | import("@smithy/types").Provider<string> | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>)) | undefined;
37
+ endpointProvider: (endpointParams: import("./endpoint/EndpointParameters").EndpointParameters, context?: {
38
+ logger?: import("@smithy/types").Logger;
39
+ }) => import("@smithy/types").EndpointV2;
40
+ tls?: boolean;
41
+ serviceConfiguredEndpoint?: never;
42
+ authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
43
+ httpAuthSchemes: import("@smithy/types").HttpAuthScheme[] | ({
44
+ schemeId: string;
45
+ identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | undefined;
46
+ signer: import("@aws-sdk/core").AwsSdkSigV4Signer;
47
+ } | {
48
+ schemeId: string;
49
+ identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | (() => Promise<{}>);
50
+ signer: import("@smithy/core").NoAuthSigner;
51
+ })[];
52
+ httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").SigninHttpAuthSchemeProvider;
53
+ credentials?: import("@smithy/types").AwsCredentialIdentity | import("@smithy/types").AwsCredentialIdentityProvider;
54
+ signer?: import("@smithy/types").RequestSigner | ((authScheme?: import("@smithy/types").AuthScheme) => Promise<import("@smithy/types").RequestSigner>);
55
+ signingEscapePath?: boolean;
56
+ systemClockOffset?: number;
57
+ signingRegion?: string;
58
+ signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
59
+ };
@@ -0,0 +1,59 @@
1
+ import { NodeHttpHandler as RequestHandler } from "@smithy/node-http-handler";
2
+ import { SigninClientConfig } from "./SigninClient";
3
+ /**
4
+ * @internal
5
+ */
6
+ export declare const getRuntimeConfig: (config: SigninClientConfig) => {
7
+ runtime: string;
8
+ defaultsMode: import("@smithy/types").Provider<import("@smithy/smithy-client").ResolvedDefaultsMode>;
9
+ authSchemePreference: string[] | import("@smithy/types").Provider<string[]>;
10
+ bodyLengthChecker: import("@smithy/types").BodyLengthCalculator;
11
+ defaultUserAgentProvider: (config?: import("@aws-sdk/util-user-agent-node").PreviouslyResolved) => Promise<import("@smithy/types").UserAgent>;
12
+ maxAttempts: number | import("@smithy/types").Provider<number>;
13
+ region: string | import("@smithy/types").Provider<string>;
14
+ requestHandler: RequestHandler | import("@smithy/protocol-http").HttpHandler<any>;
15
+ retryMode: string | import("@smithy/types").Provider<string>;
16
+ sha256: import("@smithy/types").HashConstructor;
17
+ streamCollector: import("@smithy/types").StreamCollector;
18
+ useDualstackEndpoint: boolean | import("@smithy/types").Provider<boolean>;
19
+ useFipsEndpoint: boolean | import("@smithy/types").Provider<boolean>;
20
+ userAgentAppId: string | import("@smithy/types").Provider<string | undefined>;
21
+ apiVersion: string;
22
+ cacheMiddleware?: boolean | undefined;
23
+ urlParser: import("@smithy/types").UrlParser;
24
+ base64Decoder: import("@smithy/types").Decoder;
25
+ base64Encoder: (_input: Uint8Array | string) => string;
26
+ utf8Decoder: import("@smithy/types").Decoder;
27
+ utf8Encoder: (input: Uint8Array | string) => string;
28
+ disableHostPrefix: boolean;
29
+ serviceId: string;
30
+ profile?: string;
31
+ credentialDefaultProvider?: (input: any) => import("@smithy/types").AwsCredentialIdentityProvider;
32
+ logger: import("@smithy/types").Logger;
33
+ extensions: import("./runtimeExtensions").RuntimeExtension[];
34
+ protocol: import("@smithy/types").ClientProtocol<import("@smithy/types").HttpRequest, import("@smithy/types").HttpResponse>;
35
+ customUserAgent?: string | import("@smithy/types").UserAgent;
36
+ retryStrategy?: import("@smithy/types").RetryStrategy | import("@smithy/types").RetryStrategyV2;
37
+ endpoint?: ((string | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>) & (string | import("@smithy/types").Provider<string> | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>)) | undefined;
38
+ endpointProvider: (endpointParams: import("./endpoint/EndpointParameters").EndpointParameters, context?: {
39
+ logger?: import("@smithy/types").Logger;
40
+ }) => import("@smithy/types").EndpointV2;
41
+ tls?: boolean;
42
+ serviceConfiguredEndpoint?: never;
43
+ httpAuthSchemes: import("@smithy/types").HttpAuthScheme[] | ({
44
+ schemeId: string;
45
+ identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | undefined;
46
+ signer: import("@aws-sdk/core").AwsSdkSigV4Signer;
47
+ } | {
48
+ schemeId: string;
49
+ identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | (() => Promise<{}>);
50
+ signer: import("@smithy/core").NoAuthSigner;
51
+ })[];
52
+ httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").SigninHttpAuthSchemeProvider;
53
+ credentials?: import("@smithy/types").AwsCredentialIdentity | import("@smithy/types").AwsCredentialIdentityProvider;
54
+ signer?: import("@smithy/types").RequestSigner | ((authScheme?: import("@smithy/types").AuthScheme) => Promise<import("@smithy/types").RequestSigner>);
55
+ signingEscapePath?: boolean;
56
+ systemClockOffset?: number;
57
+ signingRegion?: string;
58
+ signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
59
+ };