@cdk8s/awscdk-resolver 0.0.638 → 0.0.639

package/.jsii

@@ -7,7 +7,7 @@
     "url": "https://aws.amazon.com"
   },
   "bundled": {
-    "@aws-sdk/client-cloudformation": "^3.1094.0"
+    "@aws-sdk/client-cloudformation": "^3.1095.0"
   },
   "dependencies": {
     "aws-cdk-lib": "^2.195.0",
@@ -4082,6 +4082,6 @@
       "symbolId": "src/resolve:AwsCdkResolver"
     }
   },
-  "version": "0.0.638",
-  "fingerprint": "GCTa4K5dxr2iWrAz2LlBR/JUz4NkSvt5ZCmKNB0pbfw="
+  "version": "0.0.639",
+  "fingerprint": "2hrT7ZA4E9XPrmFCj2J8xj7k4p0pmhrTQILOu9RbfZI="
 }

package/lib/resolve.js

@@ -39,7 +39,7 @@ const child_process_1 = require("child_process");
 const path = __importStar(require("path"));
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 class AwsCdkResolver {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@cdk8s/awscdk-resolver.AwsCdkResolver", version: "0.0.638" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@cdk8s/awscdk-resolver.AwsCdkResolver", version: "0.0.639" };
     resolve(context) {
         if (!aws_cdk_lib_1.Token.isUnresolved(context.value)) {
             return;

package/node_modules/@aws-sdk/client-cloudformation/dist-cjs/index.js

@@ -69,7 +69,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.1093.0";
+var version = "3.1094.0";
 var packageInfo = {
 	version: version};
 

package/node_modules/@aws-sdk/client-cloudformation/dist-types/runtimeConfig.browser.d.ts

@@ -42,6 +42,7 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
         logger?: import("@smithy/types").Logger;
     }) => import("@smithy/types").EndpointV2;
     tls?: boolean;
+    ignoreConfiguredEndpointUrls?: boolean;
     serviceConfiguredEndpoint?: never;
     authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
     httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -52,4 +53,5 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
     systemClockOffset?: number;
     signingRegion?: string;
     signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
+    disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-cloudformation/dist-types/runtimeConfig.d.ts

@@ -43,6 +43,7 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
         logger?: import("@smithy/types").Logger;
     }) => import("@smithy/types").EndpointV2;
     tls?: boolean;
+    ignoreConfiguredEndpointUrls?: boolean;
     serviceConfiguredEndpoint?: never;
     httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
     httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").CloudFormationHttpAuthSchemeProvider;
@@ -52,4 +53,5 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
     systemClockOffset?: number;
     signingRegion?: string;
     signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
+    disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-cloudformation/dist-types/runtimeConfig.native.d.ts

@@ -41,6 +41,7 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
         logger?: import("@smithy/types").Logger;
     }) => import("@smithy/types").EndpointV2;
     tls?: boolean;
+    ignoreConfiguredEndpointUrls?: boolean;
     serviceConfiguredEndpoint?: never;
     authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
     httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -51,4 +52,5 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
     systemClockOffset?: number;
     signingRegion?: string;
     signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
+    disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-cloudformation/dist-types/ts3.4/runtimeConfig.browser.d.ts

@@ -71,6 +71,7 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -90,4 +91,5 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-cloudformation/dist-types/ts3.4/runtimeConfig.d.ts

@@ -72,6 +72,7 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
   httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").CloudFormationHttpAuthSchemeProvider;
@@ -90,4 +91,5 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-cloudformation/dist-types/ts3.4/runtimeConfig.native.d.ts

@@ -75,6 +75,7 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
     },
   ) => import("@smithy/types").EndpointV2;
   tls?: boolean;
+  ignoreConfiguredEndpointUrls?: boolean;
   serviceConfiguredEndpoint?: never;
   authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
   httpAuthSchemes: import("@smithy/types").HttpAuthScheme[];
@@ -94,4 +95,5 @@ export declare const getRuntimeConfig: (config: CloudFormationClientConfig) => {
     options: import("@smithy/signature-v4").SignatureV4Init &
       import("@smithy/signature-v4").SignatureV4CryptoInit,
   ) => import("@smithy/types").RequestSigner;
+  disableClockSkewCorrection?: boolean | import("@smithy/types").Provider<boolean>;
 };

package/node_modules/@aws-sdk/client-cloudformation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/client-cloudformation",
-  "version": "3.1094.0",
+  "version": "3.1095.0",
   "description": "AWS SDK for JavaScript Cloudformation Client for Node.js, Browser and React Native",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-cloudformation",
   "license": "Apache-2.0",
@@ -48,12 +48,12 @@
     "test:index": "tsc --noEmit ./test/index-types.ts && node ./test/index-objects.spec.mjs"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.976.0",
-    "@aws-sdk/credential-provider-node": "^3.972.71",
+    "@aws-sdk/core": "^3.977.0",
+    "@aws-sdk/credential-provider-node": "^3.972.72",
     "@aws-sdk/types": "^3.974.2",
-    "@smithy/core": "^3.29.4",
-    "@smithy/fetch-http-handler": "^5.6.6",
-    "@smithy/node-http-handler": "^4.9.6",
+    "@smithy/core": "^3.29.8",
+    "@smithy/fetch-http-handler": "^5.6.10",
+    "@smithy/node-http-handler": "^4.9.10",
     "@smithy/types": "^4.16.1",
     "tslib": "^2.6.2"
   },

package/node_modules/@aws-sdk/core/dist-cjs/submodules/httpAuthSchemes/index.js

@@ -1,21 +1,27 @@
-const { HttpResponse, HttpRequest } = require("@smithy/core/protocols");
-const { normalizeProvider, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require("@smithy/core");
-const { ProviderError } = require("@smithy/core/config");
+const { ProviderError, booleanSelector, SelectorType, loadConfig } = require("@smithy/core/config");
 const { setCredentialFeature } = require("@aws-sdk/core/client");
+const { normalizeProvider, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require("@smithy/core");
 const { SignatureV4 } = require("@smithy/signature-v4");
+const { HttpResponse, HttpRequest } = require("@smithy/core/protocols");
 
 const getDateHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.date ?? response.headers?.Date) : undefined;
+const getAgeHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.age ?? response.headers?.Age) : undefined;
 
 const getSkewCorrectedDate = (systemClockOffset) => new Date(Date.now() + systemClockOffset);
 
-const isClockSkewed = (clockTime, systemClockOffset) => Math.abs(getSkewCorrectedDate(systemClockOffset).getTime() - clockTime) >= 300000;
-
-const getUpdatedSystemClockOffset = (clockTime, currentSystemClockOffset) => {
-    const clockTimeInMs = Date.parse(clockTime);
-    if (isClockSkewed(clockTimeInMs, currentSystemClockOffset)) {
-        return clockTimeInMs - Date.now();
+const getUpdatedSystemClockOffset = (clockTime, currentSystemClockOffset, timeRequestSent, ageHeader) => {
+    if (ageHeader !== undefined) {
+        return currentSystemClockOffset;
+    }
+    const serverTime = Date.parse(clockTime);
+    const timeResponseReceived = Date.now();
+    if (timeRequestSent !== undefined && timeResponseReceived - timeRequestSent > 900_000) {
+        return currentSystemClockOffset;
     }
-    return currentSystemClockOffset;
+    const candidateSkew = timeRequestSent !== undefined
+        ? serverTime - (timeRequestSent + timeResponseReceived) / 2
+        : serverTime - timeResponseReceived;
+    return candidateSkew;
 };
 
 const throwSigningPropertyError = (name, property) => {
@@ -57,9 +63,14 @@ class AwsSdkSigV4Signer {
                 signingName = second?.signingName ?? signingName;
             }
         }
-        signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;
+        signingProperties._disableClockSkewCorrection = noSkewCorrection;
+        if (!noSkewCorrection) {
+            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+            signingProperties._requestSentAt = Date.now();
+        }
         const signedRequest = await signer.sign(httpRequest, {
-            signingDate: getSkewCorrectedDate(config.systemClockOffset),
+            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),
             signingRegion: signingRegion,
             signingService: signingName,
         });
@@ -68,27 +79,36 @@ class AwsSdkSigV4Signer {
     errorHandler(signingProperties) {
         return (error) => {
             const errorException = error;
-            const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
-            if (serverTime) {
-                const config = throwSigningPropertyError("config", signingProperties.config);
-                const preRequestOffset = signingProperties._preRequestSystemClockOffset;
-                const newOffset = getUpdatedSystemClockOffset(serverTime, config.systemClockOffset);
-                const isLocalCorrection = newOffset !== config.systemClockOffset;
-                const isConcurrentCorrection = preRequestOffset !== undefined && preRequestOffset !== newOffset;
-                const clockSkewCorrected = isLocalCorrection || isConcurrentCorrection;
-                if (clockSkewCorrected && errorException.$metadata) {
+            if (!signingProperties._disableClockSkewCorrection) {
+                const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
+                if (serverTime) {
+                    const config = throwSigningPropertyError("config", signingProperties.config);
+                    const preRequestOffset = signingProperties._preRequestSystemClockOffset;
+                    const timeRequestSent = signingProperties._requestSentAt;
+                    const ageHeader = getAgeHeader(errorException.$response);
+                    const newOffset = getUpdatedSystemClockOffset(serverTime, config.systemClockOffset, timeRequestSent, ageHeader);
                     config.systemClockOffset = newOffset;
-                    errorException.$metadata.clockSkewCorrected = true;
+                    const skewExceedsThreshold = Math.abs(newOffset) >= 240_000;
+                    const isLocalCorrection = newOffset !== preRequestOffset;
+                    const isConcurrentCorrection = preRequestOffset !== undefined && preRequestOffset !== newOffset;
+                    if (skewExceedsThreshold && (isLocalCorrection || isConcurrentCorrection) && errorException.$metadata) {
+                        errorException.$metadata.clockSkewCorrected = true;
+                    }
                 }
             }
             throw error;
         };
     }
     successHandler(httpResponse, signingProperties) {
+        if (signingProperties._disableClockSkewCorrection) {
+            return;
+        }
         const dateHeader = getDateHeader(httpResponse);
         if (dateHeader) {
             const config = throwSigningPropertyError("config", signingProperties.config);
-            config.systemClockOffset = getUpdatedSystemClockOffset(dateHeader, config.systemClockOffset);
+            const timeRequestSent = signingProperties._requestSentAt;
+            const ageHeader = getAgeHeader(httpResponse);
+            config.systemClockOffset = getUpdatedSystemClockOffset(dateHeader, config.systemClockOffset, timeRequestSent, ageHeader);
         }
     }
 }
@@ -103,9 +123,14 @@ class AwsSdkSigV4ASigner extends AwsSdkSigV4Signer {
         const configResolvedSigningRegionSet = await config.sigv4aSigningRegionSet?.();
         const multiRegionOverride = (configResolvedSigningRegionSet ??
             signingRegionSet ?? [signingRegion]).join(",");
-        signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;
+        signingProperties._disableClockSkewCorrection = noSkewCorrection;
+        if (!noSkewCorrection) {
+            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+            signingProperties._requestSentAt = Date.now();
+        }
         const signedRequest = await signer.sign(httpRequest, {
-            signingDate: getSkewCorrectedDate(config.systemClockOffset),
+            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),
             signingRegion: multiRegionOverride,
             signingService: signingName,
         });
@@ -162,7 +187,7 @@ const NODE_SIGV4A_CONFIG_OPTIONS = {
     default: undefined,
 };
 
-const resolveAwsSdkSigV4Config = (config) => {
+const bindResolveAwsSdkSigV4Config = (defaultDisableClockSkewCorrection) => (config) => {
     let inputCredentials = config.credentials;
     let isUserSupplied = !!config.credentials;
     let resolvedCredentials = undefined;
@@ -260,11 +285,11 @@ const resolveAwsSdkSigV4Config = (config) => {
         systemClockOffset,
         signingEscapePath,
         signer,
+        disableClockSkewCorrection: normalizeProvider(config.disableClockSkewCorrection ?? defaultDisableClockSkewCorrection),
     });
     return resolvedConfig;
 };
-const resolveAWSSDKSigV4Config = resolveAwsSdkSigV4Config;
-function normalizeCredentialProvider(config, { credentials, credentialDefaultProvider, }) {
+function normalizeCredentialProvider(config, { credentials, credentialDefaultProvider }) {
     let credentialsProvider;
     if (credentials) {
         if (!credentials?.memoized) {
@@ -299,6 +324,19 @@ function bindCallerConfig(config, credentialsProvider) {
     return fn;
 }
 
+const ENV_DISABLE_CLOCK_SKEW_CORRECTION = "AWS_DISABLE_CLOCK_SKEW_CORRECTION";
+const CONFIG_DISABLE_CLOCK_SKEW_CORRECTION = "disable_clock_skew_correction";
+const NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS = {
+    environmentVariableSelector: (env) => booleanSelector(env, ENV_DISABLE_CLOCK_SKEW_CORRECTION, SelectorType.ENV),
+    configFileSelector: (profile) => booleanSelector(profile, CONFIG_DISABLE_CLOCK_SKEW_CORRECTION, SelectorType.CONFIG),
+    default: false,
+};
+
+const DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION = loadConfig(NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS);
+
+const resolveAwsSdkSigV4Config = bindResolveAwsSdkSigV4Config(DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION);
+const resolveAWSSDKSigV4Config = resolveAwsSdkSigV4Config;
+
 exports.AWSSDKSigV4Signer = AWSSDKSigV4Signer;
 exports.AwsSdkSigV4ASigner = AwsSdkSigV4ASigner;
 exports.AwsSdkSigV4Signer = AwsSdkSigV4Signer;

package/node_modules/@aws-sdk/core/dist-cjs/submodules/protocols/index.js

@@ -281,12 +281,18 @@ function jsonReviver(key, value, context) {
     if (context?.source) {
         const numericString = context.source;
         if (typeof value === "number") {
-            if (value > Number.MAX_SAFE_INTEGER || value < Number.MIN_SAFE_INTEGER || numericString !== String(value)) {
-                const isFractional = numericString.includes(".");
-                if (isFractional) {
+            const inSafeRange = value <= Number.MAX_SAFE_INTEGER && value >= Number.MIN_SAFE_INTEGER;
+            if (!inSafeRange || numericString !== String(value)) {
+                if (inSafeRange && /[eE]/.test(numericString) && String(Number(numericString)) === String(value)) {
+                    return value;
+                }
+                if (isFractionalNumeric(numericString)) {
                     return new NumericValue(numericString, "bigDecimal");
                 }
                 else {
+                    if (/[eE]/.test(numericString)) {
+                        return BigInt(Number(numericString));
+                    }
                     return BigInt(numericString);
                 }
             }
@@ -294,25 +300,114 @@ function jsonReviver(key, value, context) {
     }
     return value;
 }
+function isFractionalNumeric(s) {
+    const dotIndex = s.indexOf(".");
+    if (dotIndex === -1) {
+        return false;
+    }
+    const eIndex = s.search(/[eE]/);
+    if (eIndex === -1) {
+        return true;
+    }
+    const fracDigits = eIndex - dotIndex - 1;
+    const exp = parseInt(s.slice(eIndex + 1), 10);
+    return exp < fracDigits;
+}
+
+const REVIVER_SYMBOL = Symbol.for("@aws-sdk/reviver");
+function needsReviver(schema) {
+    const ns = NormalizedSchema.of(schema);
+    const raw = ns.getSchema();
+    if (Array.isArray(raw) && ns.isStructSchema()) {
+        if (REVIVER_SYMBOL in raw) {
+            return raw[REVIVER_SYMBOL];
+        }
+        const result = _check(ns, new Set());
+        raw[REVIVER_SYMBOL] = result;
+        return result;
+    }
+    return _check(ns, new Set());
+}
+function _check(ns, seen) {
+    const raw = ns.getSchema();
+    if (seen.has(raw)) {
+        return false;
+    }
+    seen.add(raw);
+    if (ns.isBigIntegerSchema() || ns.isBigDecimalSchema()) {
+        return true;
+    }
+    if (ns.isStructSchema()) {
+        for (const [, memberSchema] of ns.structIterator()) {
+            if (_check(memberSchema, seen)) {
+                return true;
+            }
+        }
+    }
+    else if (ns.isListSchema() || ns.isMapSchema()) {
+        if (_check(ns.getValueSchema(), seen)) {
+            return true;
+        }
+    }
+    else if (ns.isDocumentSchema()) {
+        return true;
+    }
+    return false;
+}
 
 const collectBodyString = (streamBody, context) => collectBody(streamBody, context).then((body) => (context?.utf8Encoder ?? toUtf8)(body));
 
-const parseJsonBody = (streamBody, context) => collectBodyString(streamBody, context).then((encoded) => {
-    if (encoded.length) {
+let canParseBuffer;
+function detectBufferParsing() {
+    if (canParseBuffer === undefined) {
         try {
-            return JSON.parse(encoded);
+            if (typeof Buffer !== "function") {
+                canParseBuffer = false;
+            }
+            else {
+                const result = JSON.parse(Buffer.from([0x7b, 0x7d]));
+                canParseBuffer = result !== null && typeof result === "object";
+            }
         }
-        catch (e) {
-            if (e?.name === "SyntaxError") {
-                Object.defineProperty(e, "$responseBodyText", {
-                    value: encoded,
-                });
+        catch {
+            canParseBuffer = false;
+        }
+    }
+    return canParseBuffer;
+}
+
+async function parseJsonBody(streamBody, context, schema) {
+    let parsingInput;
+    if (detectBufferParsing() && typeof streamBody?.[Symbol.asyncIterator] === "function") {
+        const buffer = await collectBody(streamBody, context);
+        if (typeof Buffer === "function") {
+            if (Buffer.isBuffer(buffer)) {
+                parsingInput = buffer;
+            }
+            else {
+                parsingInput = Buffer.from(buffer.buffer, buffer.byteOffset, buffer.byteLength);
             }
-            throw e;
         }
     }
-    return {};
-});
+    if (!parsingInput) {
+        parsingInput = await collectBodyString(streamBody, context);
+    }
+    if (parsingInput.length === 0) {
+        return {};
+    }
+    const reviver = schema && needsReviver(schema) ? jsonReviver : undefined;
+    try {
+        return JSON.parse(parsingInput, reviver);
+    }
+    catch (e) {
+        if (e?.name === "SyntaxError") {
+            Object.defineProperty(e, "$responseBodyText", {
+                value: typeof parsingInput === "string" ? parsingInput : parsingInput.toString("utf8"),
+            });
+        }
+        throw e;
+    }
+}
 const parseJsonErrorBody = async (errorBody, context) => {
     const value = await parseJsonBody(errorBody, context);
     value.message = value.message ?? value.Message;
@@ -366,6 +461,10 @@ const loadErrorCode = ({ headers }, data, order) => {
     }
 };
 
+function writeKey(obj) {
+    Object.defineProperty(obj, "__proto__", { value: undefined, writable: true, enumerable: true, configurable: true });
+}
+
 class JsonShapeDeserializer extends SerdeContextConfig {
     settings;
     constructor(settings) {
@@ -373,7 +472,8 @@ class JsonShapeDeserializer extends SerdeContextConfig {
         this.settings = settings;
     }
     async read(schema, data) {
-        return this._read(schema, typeof data === "string" ? JSON.parse(data, jsonReviver) : await parseJsonBody(data, this.serdeContext));
+        const reviver = needsReviver(schema) ? jsonReviver : undefined;
+        return this._read(schema, typeof data === "string" ? JSON.parse(data, reviver) : await parseJsonBody(data, this.serdeContext, schema));
     }
     readObject(schema, data) {
         return this._read(schema, data);
@@ -434,6 +534,9 @@ class JsonShapeDeserializer extends SerdeContextConfig {
                 const mapMember = ns.getValueSchema();
                 const out = {};
                 for (const _k in value) {
+                    if (_k === "__proto__") {
+                        writeKey(out);
+                    }
                     out[_k] = this._read(mapMember, value[_k]);
                 }
                 return out;
@@ -492,6 +595,9 @@ class JsonShapeDeserializer extends SerdeContextConfig {
             if (isObject) {
                 const out = Array.isArray(value) ? [] : {};
                 for (const k in value) {
+                    if (k === "__proto__") {
+                        writeKey(out);
+                    }
                     const v = value[k];
                     if (v instanceof NumericValue) {
                         out[k] = v;
@@ -617,6 +723,9 @@ class JsonShapeSerializer extends SerdeContextConfig {
                     const { $unknown } = record;
                     if (Array.isArray($unknown)) {
                         const [k, v] = $unknown;
+                        if (k === "__proto__") {
+                            writeKey(out);
+                        }
                         out[k] = this._write(15, v);
                     }
                 }
@@ -649,6 +758,9 @@ class JsonShapeSerializer extends SerdeContextConfig {
                 for (const _k in value) {
                     const _v = value[_k];
                     if (sparse || _v != null) {
+                        if (_k === "__proto__") {
+                            writeKey(out);
+                        }
                         out[_k] = this._write(mapMember, _v);
                     }
                 }
@@ -714,6 +826,9 @@ class JsonShapeSerializer extends SerdeContextConfig {
                 const out = Array.isArray(value) ? [] : {};
                 for (const k in value) {
                     const v = value[k];
+                    if (k === "__proto__") {
+                        writeKey(out);
+                    }
                     if (v instanceof NumericValue) {
                         this.useReplacer = true;
                         out[k] = v;
@@ -1037,6 +1152,9 @@ class XmlShapeDeserializer extends SerdeContextConfig {
                 for (const entry of entries) {
                     const key = entry[keyProperty];
                     const value = entry[valueProperty];
+                    if (key === "__proto__") {
+                        writeKey(buffer);
+                    }
                     buffer[key] = this.readSchema(memberNs, value);
                 }
                 return buffer;

package/node_modules/@aws-sdk/core/dist-es/submodules/httpAuthSchemes/aws_sdk/AwsSdkSigV4ASigner.js

@@ -10,9 +10,14 @@ export class AwsSdkSigV4ASigner extends AwsSdkSigV4Signer {
         const configResolvedSigningRegionSet = await config.sigv4aSigningRegionSet?.();
         const multiRegionOverride = (configResolvedSigningRegionSet ??
             signingRegionSet ?? [signingRegion]).join(",");
-        signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;
+        signingProperties._disableClockSkewCorrection = noSkewCorrection;
+        if (!noSkewCorrection) {
+            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+            signingProperties._requestSentAt = Date.now();
+        }
         const signedRequest = await signer.sign(httpRequest, {
-            signingDate: getSkewCorrectedDate(config.systemClockOffset),
+            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),
             signingRegion: multiRegionOverride,
             signingService: signingName,
         });

package/node_modules/@aws-sdk/core/dist-es/submodules/httpAuthSchemes/aws_sdk/AwsSdkSigV4Signer.js

@@ -1,5 +1,5 @@
 import { HttpRequest } from "@smithy/core/protocols";
-import { getDateHeader, getSkewCorrectedDate, getUpdatedSystemClockOffset } from "../utils";
+import { getAgeHeader, getDateHeader, getSkewCorrectedDate, getUpdatedSystemClockOffset } from "../utils";
 const throwSigningPropertyError = (name, property) => {
     if (!property) {
         throw new Error(`Property \`${name}\` is not resolved for AWS SDK SigV4Auth`);
@@ -39,9 +39,14 @@ export class AwsSdkSigV4Signer {
                 signingName = second?.signingName ?? signingName;
             }
         }
-        signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;
+        signingProperties._disableClockSkewCorrection = noSkewCorrection;
+        if (!noSkewCorrection) {
+            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
+            signingProperties._requestSentAt = Date.now();
+        }
         const signedRequest = await signer.sign(httpRequest, {
-            signingDate: getSkewCorrectedDate(config.systemClockOffset),
+            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),
             signingRegion: signingRegion,
             signingService: signingName,
         });
@@ -50,27 +55,36 @@ export class AwsSdkSigV4Signer {
     errorHandler(signingProperties) {
         return (error) => {
             const errorException = error;
-            const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
-            if (serverTime) {
-                const config = throwSigningPropertyError("config", signingProperties.config);
-                const preRequestOffset = signingProperties._preRequestSystemClockOffset;
-                const newOffset = getUpdatedSystemClockOffset(serverTime, config.systemClockOffset);
-                const isLocalCorrection = newOffset !== config.systemClockOffset;
-                const isConcurrentCorrection = preRequestOffset !== undefined && preRequestOffset !== newOffset;
-                const clockSkewCorrected = isLocalCorrection || isConcurrentCorrection;
-                if (clockSkewCorrected && errorException.$metadata) {
+            if (!signingProperties._disableClockSkewCorrection) {
+                const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
+                if (serverTime) {
+                    const config = throwSigningPropertyError("config", signingProperties.config);
+                    const preRequestOffset = signingProperties._preRequestSystemClockOffset;
+                    const timeRequestSent = signingProperties._requestSentAt;
+                    const ageHeader = getAgeHeader(errorException.$response);
+                    const newOffset = getUpdatedSystemClockOffset(serverTime, config.systemClockOffset, timeRequestSent, ageHeader);
                     config.systemClockOffset = newOffset;
-                    errorException.$metadata.clockSkewCorrected = true;
+                    const skewExceedsThreshold = Math.abs(newOffset) >= 240_000;
+                    const isLocalCorrection = newOffset !== preRequestOffset;
+                    const isConcurrentCorrection = preRequestOffset !== undefined && preRequestOffset !== newOffset;
+                    if (skewExceedsThreshold && (isLocalCorrection || isConcurrentCorrection) && errorException.$metadata) {
+                        errorException.$metadata.clockSkewCorrected = true;
+                    }
                 }
             }
             throw error;
         };
     }
     successHandler(httpResponse, signingProperties) {
+        if (signingProperties._disableClockSkewCorrection) {
+            return;
+        }
         const dateHeader = getDateHeader(httpResponse);
         if (dateHeader) {
             const config = throwSigningPropertyError("config", signingProperties.config);
-            config.systemClockOffset = getUpdatedSystemClockOffset(dateHeader, config.systemClockOffset);
+            const timeRequestSent = signingProperties._requestSentAt;
+            const ageHeader = getAgeHeader(httpResponse);
+            config.systemClockOffset = getUpdatedSystemClockOffset(dateHeader, config.systemClockOffset, timeRequestSent, ageHeader);
         }
     }
 }

package/node_modules/@aws-sdk/core/dist-es/submodules/httpAuthSchemes/aws_sdk/clock-skew-defaults.browser.js

@@ -0,0 +1 @@
+export const DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION = false;

package/node_modules/@aws-sdk/core/dist-es/submodules/httpAuthSchemes/aws_sdk/clock-skew-defaults.js

@@ -0,0 +1,3 @@
+import { loadConfig } from "@smithy/core/config";
+import { NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS } from "./clock-skew-node-config";
+export const DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION = loadConfig(NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS);