@cdklabs/cdk-ecs-codedeploy 0.0.420 → 0.0.422

package/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js

@@ -4,11 +4,13 @@ export const isWebIdentityProfile = (arg) => Boolean(arg) &&
     typeof arg.web_identity_token_file === "string" &&
     typeof arg.role_arn === "string" &&
     ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1;
-export const resolveWebIdentityCredentials = async (profile, options) => import("@aws-sdk/credential-provider-web-identity").then(({ fromTokenFile }) => fromTokenFile({
+export const resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => import("@aws-sdk/credential-provider-web-identity").then(({ fromTokenFile }) => fromTokenFile({
     webIdentityTokenFile: profile.web_identity_token_file,
     roleArn: profile.role_arn,
     roleSessionName: profile.role_session_name,
     roleAssumerWithWebIdentity: options.roleAssumerWithWebIdentity,
     logger: options.logger,
     parentClientConfig: options.parentClientConfig,
-})().then((creds) => setCredentialFeature(creds, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q")));
+})({
+    callerClientConfig,
+}).then((creds) => setCredentialFeature(creds, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q")));

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/fromIni.d.ts

@@ -1,13 +1,13 @@
+import type { FromLoginCredentialsInit } from "@aws-sdk/credential-provider-login";
 import type { AssumeRoleWithWebIdentityParams } from "@aws-sdk/credential-provider-web-identity";
-import type { CredentialProviderOptions } from "@aws-sdk/types";
-import type { RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
+import type { CredentialProviderOptions, RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
 import { SourceProfileInit } from "@smithy/shared-ini-file-loader";
 import type { AwsCredentialIdentity, Pluggable } from "@smithy/types";
 import { AssumeRoleParams } from "./resolveAssumeRoleCredentials";
 /**
  * @public
  */
-export interface FromIniInit extends SourceProfileInit, CredentialProviderOptions {
+export interface FromIniInit extends SourceProfileInit, CredentialProviderOptions, FromLoginCredentialsInit {
     /**
      * A function that returns a promise fulfilled with an MFA token code for
      * the provided MFA Serial code. If a profile requires an MFA code and
@@ -34,8 +34,8 @@ export interface FromIniInit extends SourceProfileInit, CredentialProviderOption
      */
     roleAssumerWithWebIdentity?: (params: AssumeRoleWithWebIdentityParams) => Promise<AwsCredentialIdentity>;
     /**
-     * STSClientConfig or SSOClientConfig to be used for creating inner client
-     * for auth operations.
+     * AWS SDK Client configuration to be used for creating inner client
+     * for auth operations. Inner clients include STS, SSO, and Signin clients.
      * @internal
      */
     clientConfig?: any;
@@ -52,4 +52,4 @@ export interface FromIniInit extends SourceProfileInit, CredentialProviderOption
  * Creates a credential provider that will read from ini files and supports
  * role assumption and multi-factor authentication.
  */
-export declare const fromIni: (_init?: FromIniInit) => RuntimeConfigAwsCredentialIdentityProvider;
+export declare const fromIni: (init?: FromIniInit) => RuntimeConfigAwsCredentialIdentityProvider;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveAssumeRoleCredentials.d.ts

@@ -1,10 +1,11 @@
+import type { AwsIdentityProperties } from "@aws-sdk/types";
 import { Logger, ParsedIniData } from "@smithy/types";
 import { FromIniInit } from "./fromIni";
+import type { ResolveProfileData } from "./resolveProfileData";
 /**
  * @internal
  *
- * @see http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
- * TODO update the above to link to V3 docs
+ * @see https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sts/command/AssumeRoleCommand/
  */
 export interface AssumeRoleParams {
     /**
@@ -44,4 +45,4 @@ export declare const isAssumeRoleProfile: (arg: any, { profile, logger }?: {
 /**
  * @internal
  */
-export declare const resolveAssumeRoleCredentials: (profileName: string, profiles: ParsedIniData, options: FromIniInit, visitedProfiles?: Record<string, true>) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;
+export declare const resolveAssumeRoleCredentials: (profileName: string, profiles: ParsedIniData, options: FromIniInit, callerClientConfig: AwsIdentityProperties["callerClientConfig"] | undefined, visitedProfiles: Record<string, true> | undefined, resolveProfileData: ResolveProfileData) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveLoginCredentials.d.ts

@@ -0,0 +1,11 @@
+import type { AwsIdentityProperties } from "@aws-sdk/types";
+import type { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
+import type { FromIniInit } from "./fromIni";
+/**
+ * @internal
+ */
+export declare const isLoginProfile: (data: ParsedIniData[string]) => boolean;
+/**
+ * @internal
+ */
+export declare const resolveLoginCredentials: (profileName: string, options: FromIniInit, callerClientConfig?: AwsIdentityProperties["callerClientConfig"]) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveProfileData.d.ts

@@ -1,9 +1,14 @@
+import type { AwsIdentityProperties } from "@aws-sdk/types";
 import type { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
 import { FromIniInit } from "./fromIni";
 /**
  * @internal
  */
-export declare const resolveProfileData: (profileName: string, profiles: ParsedIniData, options: FromIniInit, visitedProfiles?: Record<string, true>, 
+export type ResolveProfileData = typeof resolveProfileData;
+/**
+ * @internal
+ */
+export declare const resolveProfileData: (profileName: string, profiles: ParsedIniData, options: FromIniInit, callerClientConfig?: AwsIdentityProperties["callerClientConfig"], visitedProfiles?: Record<string, true>, 
 /**
  * This override comes from recursive calls only.
  * It is used to flag a recursive profile section

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveSsoCredentials.d.ts

@@ -1,10 +1,11 @@
 import type { SsoProfile } from "@aws-sdk/credential-provider-sso";
+import type { AwsIdentityProperties } from "@aws-sdk/types";
 import type { IniSection, Profile } from "@smithy/types";
 import type { FromIniInit } from "./fromIni";
 /**
  * @internal
  */
-export declare const resolveSsoCredentials: (profile: string, profileData: IniSection, options?: FromIniInit) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;
+export declare const resolveSsoCredentials: (profile: string, profileData: IniSection, options?: FromIniInit, callerClientConfig?: AwsIdentityProperties["callerClientConfig"]) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;
 /**
  * @internal
  * duplicated from \@aws-sdk/credential-provider-sso to defer import.

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/resolveWebIdentityCredentials.d.ts

@@ -1,3 +1,4 @@
+import type { AwsIdentityProperties } from "@aws-sdk/types";
 import { AwsCredentialIdentity, Profile } from "@smithy/types";
 import { FromIniInit } from "./fromIni";
 /**
@@ -15,4 +16,4 @@ export declare const isWebIdentityProfile: (arg: any) => arg is WebIdentityProfi
 /**
  * @internal
  */
-export declare const resolveWebIdentityCredentials: (profile: WebIdentityProfile, options: FromIniInit) => Promise<AwsCredentialIdentity>;
+export declare const resolveWebIdentityCredentials: (profile: WebIdentityProfile, options: FromIniInit, callerClientConfig?: AwsIdentityProperties["callerClientConfig"]) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/fromIni.d.ts

@@ -1,12 +1,16 @@
+import { FromLoginCredentialsInit } from "@aws-sdk/credential-provider-login";
 import { AssumeRoleWithWebIdentityParams } from "@aws-sdk/credential-provider-web-identity";
-import { CredentialProviderOptions } from "@aws-sdk/types";
-import { RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
+import {
+  CredentialProviderOptions,
+  RuntimeConfigAwsCredentialIdentityProvider,
+} from "@aws-sdk/types";
 import { SourceProfileInit } from "@smithy/shared-ini-file-loader";
 import { AwsCredentialIdentity, Pluggable } from "@smithy/types";
 import { AssumeRoleParams } from "./resolveAssumeRoleCredentials";
 export interface FromIniInit
   extends SourceProfileInit,
-    CredentialProviderOptions {
+    CredentialProviderOptions,
+    FromLoginCredentialsInit {
   mfaCodeProvider?: (mfaSerial: string) => Promise<string>;
   roleAssumer?: (
     sourceCreds: AwsCredentialIdentity,
@@ -20,5 +24,5 @@ export interface FromIniInit
   ignoreCache?: boolean;
 }
 export declare const fromIni: (
-  _init?: FromIniInit
+  init?: FromIniInit
 ) => RuntimeConfigAwsCredentialIdentityProvider;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveAssumeRoleCredentials.d.ts

@@ -1,5 +1,7 @@
+import { AwsIdentityProperties } from "@aws-sdk/types";
 import { Logger, ParsedIniData } from "@smithy/types";
 import { FromIniInit } from "./fromIni";
+import { ResolveProfileData } from "./resolveProfileData";
 export interface AssumeRoleParams {
   RoleArn: string;
   RoleSessionName: string;
@@ -22,5 +24,7 @@ export declare const resolveAssumeRoleCredentials: (
   profileName: string,
   profiles: ParsedIniData,
   options: FromIniInit,
-  visitedProfiles?: Record<string, true>
+  callerClientConfig: AwsIdentityProperties["callerClientConfig"] | undefined,
+  visitedProfiles: Record<string, true> | undefined,
+  resolveProfileData: ResolveProfileData
 ) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveLoginCredentials.d.ts

@@ -0,0 +1,9 @@
+import { AwsIdentityProperties } from "@aws-sdk/types";
+import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
+import { FromIniInit } from "./fromIni";
+export declare const isLoginProfile: (data: ParsedIniData[string]) => boolean;
+export declare const resolveLoginCredentials: (
+  profileName: string,
+  options: FromIniInit,
+  callerClientConfig?: AwsIdentityProperties["callerClientConfig"]
+) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveProfileData.d.ts

@@ -1,9 +1,12 @@
+import { AwsIdentityProperties } from "@aws-sdk/types";
 import { AwsCredentialIdentity, ParsedIniData } from "@smithy/types";
 import { FromIniInit } from "./fromIni";
+export type ResolveProfileData = typeof resolveProfileData;
 export declare const resolveProfileData: (
   profileName: string,
   profiles: ParsedIniData,
   options: FromIniInit,
+  callerClientConfig?: AwsIdentityProperties["callerClientConfig"],
   visitedProfiles?: Record<string, true>,
   isAssumeRoleRecursiveCall?: boolean
 ) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveSsoCredentials.d.ts

@@ -1,9 +1,11 @@
 import { SsoProfile } from "@aws-sdk/credential-provider-sso";
+import { AwsIdentityProperties } from "@aws-sdk/types";
 import { IniSection, Profile } from "@smithy/types";
 import { FromIniInit } from "./fromIni";
 export declare const resolveSsoCredentials: (
   profile: string,
   profileData: IniSection,
-  options?: FromIniInit
+  options?: FromIniInit,
+  callerClientConfig?: AwsIdentityProperties["callerClientConfig"]
 ) => Promise<import("@aws-sdk/types").AttributedAwsCredentialIdentity>;
 export declare const isSsoProfile: (arg: Profile) => arg is Partial<SsoProfile>;

package/node_modules/@aws-sdk/credential-provider-ini/dist-types/ts3.4/resolveWebIdentityCredentials.d.ts

@@ -1,3 +1,4 @@
+import { AwsIdentityProperties } from "@aws-sdk/types";
 import { AwsCredentialIdentity, Profile } from "@smithy/types";
 import { FromIniInit } from "./fromIni";
 export interface WebIdentityProfile extends Profile {
@@ -10,5 +11,6 @@ export declare const isWebIdentityProfile: (
 ) => arg is WebIdentityProfile;
 export declare const resolveWebIdentityCredentials: (
   profile: WebIdentityProfile,
-  options: FromIniInit
+  options: FromIniInit,
+  callerClientConfig?: AwsIdentityProperties["callerClientConfig"]
 ) => Promise<AwsCredentialIdentity>;

package/node_modules/@aws-sdk/credential-provider-ini/package.json

@@ -1,44 +1,46 @@
 {
   "name": "@aws-sdk/credential-provider-ini",
-  "version": "3.848.0",
+  "version": "3.962.0",
   "description": "AWS credential provider that sources credentials from ~/.aws/credentials and ~/.aws/config",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
   "scripts": {
-    "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
+    "build": "concurrently 'yarn:build:types' 'yarn:build:es' && yarn build:cjs",
     "build:cjs": "node ../../scripts/compilation/inline credential-provider-ini",
     "build:es": "tsc -p tsconfig.es.json",
-    "build:include:deps": "lerna run --scope $npm_package_name --include-dependencies build",
+    "build:include:deps": "yarn g:turbo run build -F=\"$npm_package_name\"",
     "build:types": "tsc -p tsconfig.types.json",
     "build:types:downlevel": "downlevel-dts dist-types dist-types/ts3.4",
     "clean": "rimraf ./dist-* && rimraf *.tsbuildinfo",
     "test": "yarn g:vitest run",
     "test:watch": "yarn g:vitest watch",
-    "test:integration": "yarn g:vitest run -c vitest.config.integ.ts",
-    "test:integration:watch": "yarn g:vitest watch -c vitest.config.integ.ts"
+    "test:integration": "yarn g:vitest run -c vitest.config.integ.mts",
+    "test:integration:watch": "yarn g:vitest watch -c vitest.config.integ.mts"
   },
   "keywords": [
     "aws",
     "credentials"
   ],
+  "sideEffects": false,
   "author": {
     "name": "AWS SDK for JavaScript Team",
     "url": "https://aws.amazon.com/javascript/"
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/core": "3.846.0",
-    "@aws-sdk/credential-provider-env": "3.846.0",
-    "@aws-sdk/credential-provider-http": "3.846.0",
-    "@aws-sdk/credential-provider-process": "3.846.0",
-    "@aws-sdk/credential-provider-sso": "3.848.0",
-    "@aws-sdk/credential-provider-web-identity": "3.848.0",
-    "@aws-sdk/nested-clients": "3.848.0",
-    "@aws-sdk/types": "3.840.0",
-    "@smithy/credential-provider-imds": "^4.0.6",
-    "@smithy/property-provider": "^4.0.4",
-    "@smithy/shared-ini-file-loader": "^4.0.4",
-    "@smithy/types": "^4.3.1",
+    "@aws-sdk/core": "3.957.0",
+    "@aws-sdk/credential-provider-env": "3.957.0",
+    "@aws-sdk/credential-provider-http": "3.957.0",
+    "@aws-sdk/credential-provider-login": "3.962.0",
+    "@aws-sdk/credential-provider-process": "3.957.0",
+    "@aws-sdk/credential-provider-sso": "3.958.0",
+    "@aws-sdk/credential-provider-web-identity": "3.958.0",
+    "@aws-sdk/nested-clients": "3.958.0",
+    "@aws-sdk/types": "3.957.0",
+    "@smithy/credential-provider-imds": "^4.2.7",
+    "@smithy/property-provider": "^4.2.7",
+    "@smithy/shared-ini-file-loader": "^4.4.2",
+    "@smithy/types": "^4.11.0",
     "tslib": "^2.6.2"
   },
   "devDependencies": {

package/node_modules/@aws-sdk/credential-provider-login/README.md

@@ -0,0 +1,7 @@
+# @aws-sdk/credential-provider-login
+
+> An internal package
+
+## Usage
+
+You probably shouldn't, at least directly. Please use [@aws-sdk/credential-providers](https://www.npmjs.com/package/@aws-sdk/credential-providers) instead.

package/node_modules/@aws-sdk/credential-provider-login/dist-cjs/index.js

@@ -0,0 +1,286 @@
+'use strict';
+
+var client = require('@aws-sdk/core/client');
+var propertyProvider = require('@smithy/property-provider');
+var sharedIniFileLoader = require('@smithy/shared-ini-file-loader');
+var protocolHttp = require('@smithy/protocol-http');
+var node_crypto = require('node:crypto');
+var node_fs = require('node:fs');
+var node_os = require('node:os');
+var node_path = require('node:path');
+
+class LoginCredentialsFetcher {
+    profileData;
+    init;
+    callerClientConfig;
+    static REFRESH_THRESHOLD = 5 * 60 * 1000;
+    constructor(profileData, init, callerClientConfig) {
+        this.profileData = profileData;
+        this.init = init;
+        this.callerClientConfig = callerClientConfig;
+    }
+    async loadCredentials() {
+        const token = await this.loadToken();
+        if (!token) {
+            throw new propertyProvider.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
+        }
+        const accessToken = token.accessToken;
+        const now = Date.now();
+        const expiryTime = new Date(accessToken.expiresAt).getTime();
+        const timeUntilExpiry = expiryTime - now;
+        if (timeUntilExpiry <= LoginCredentialsFetcher.REFRESH_THRESHOLD) {
+            return this.refresh(token);
+        }
+        return {
+            accessKeyId: accessToken.accessKeyId,
+            secretAccessKey: accessToken.secretAccessKey,
+            sessionToken: accessToken.sessionToken,
+            accountId: accessToken.accountId,
+            expiration: new Date(accessToken.expiresAt),
+        };
+    }
+    get logger() {
+        return this.init?.logger;
+    }
+    get loginSession() {
+        return this.profileData.login_session;
+    }
+    async refresh(token) {
+        const { SigninClient, CreateOAuth2TokenCommand } = await import('@aws-sdk/nested-clients/signin');
+        const { logger, userAgentAppId } = this.callerClientConfig ?? {};
+        const isH2 = (requestHandler) => {
+            return requestHandler?.metadata?.handlerProtocol === "h2";
+        };
+        const requestHandler = isH2(this.callerClientConfig?.requestHandler)
+            ? undefined
+            : this.callerClientConfig?.requestHandler;
+        const region = this.profileData.region ?? (await this.callerClientConfig?.region?.()) ?? process.env.AWS_REGION;
+        const client = new SigninClient({
+            credentials: {
+                accessKeyId: "",
+                secretAccessKey: "",
+            },
+            region,
+            requestHandler,
+            logger,
+            userAgentAppId,
+            ...this.init?.clientConfig,
+        });
+        this.createDPoPInterceptor(client.middlewareStack);
+        const commandInput = {
+            tokenInput: {
+                clientId: token.clientId,
+                refreshToken: token.refreshToken,
+                grantType: "refresh_token",
+            },
+        };
+        try {
+            const response = await client.send(new CreateOAuth2TokenCommand(commandInput));
+            const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};
+            const { refreshToken, expiresIn } = response.tokenOutput ?? {};
+            if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {
+                throw new propertyProvider.CredentialsProviderError("Token refresh response missing required fields", {
+                    logger: this.logger,
+                    tryNextLink: false,
+                });
+            }
+            const expiresInMs = (expiresIn ?? 900) * 1000;
+            const expiration = new Date(Date.now() + expiresInMs);
+            const updatedToken = {
+                ...token,
+                accessToken: {
+                    ...token.accessToken,
+                    accessKeyId: accessKeyId,
+                    secretAccessKey: secretAccessKey,
+                    sessionToken: sessionToken,
+                    expiresAt: expiration.toISOString(),
+                },
+                refreshToken: refreshToken,
+            };
+            await this.saveToken(updatedToken);
+            const newAccessToken = updatedToken.accessToken;
+            return {
+                accessKeyId: newAccessToken.accessKeyId,
+                secretAccessKey: newAccessToken.secretAccessKey,
+                sessionToken: newAccessToken.sessionToken,
+                accountId: newAccessToken.accountId,
+                expiration,
+            };
+        }
+        catch (error) {
+            if (error.name === "AccessDeniedException") {
+                const errorType = error.error;
+                let message;
+                switch (errorType) {
+                    case "TOKEN_EXPIRED":
+                        message = "Your session has expired. Please reauthenticate.";
+                        break;
+                    case "USER_CREDENTIALS_CHANGED":
+                        message =
+                            "Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";
+                        break;
+                    case "INSUFFICIENT_PERMISSIONS":
+                        message =
+                            "Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";
+                        break;
+                    default:
+                        message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
+                }
+                throw new propertyProvider.CredentialsProviderError(message, { logger: this.logger, tryNextLink: false });
+            }
+            throw new propertyProvider.CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
+        }
+    }
+    async loadToken() {
+        const tokenFilePath = this.getTokenFilePath();
+        try {
+            let tokenData;
+            try {
+                tokenData = await sharedIniFileLoader.readFile(tokenFilePath, { ignoreCache: this.init?.ignoreCache });
+            }
+            catch {
+                tokenData = await node_fs.promises.readFile(tokenFilePath, "utf8");
+            }
+            const token = JSON.parse(tokenData);
+            const missingFields = ["accessToken", "clientId", "refreshToken", "dpopKey"].filter((k) => !token[k]);
+            if (!token.accessToken?.accountId) {
+                missingFields.push("accountId");
+            }
+            if (missingFields.length > 0) {
+                throw new propertyProvider.CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
+                    logger: this.logger,
+                    tryNextLink: false,
+                });
+            }
+            return token;
+        }
+        catch (error) {
+            throw new propertyProvider.CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
+                logger: this.logger,
+                tryNextLink: false,
+            });
+        }
+    }
+    async saveToken(token) {
+        const tokenFilePath = this.getTokenFilePath();
+        const directory = node_path.dirname(tokenFilePath);
+        try {
+            await node_fs.promises.mkdir(directory, { recursive: true });
+        }
+        catch (error) {
+        }
+        await node_fs.promises.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
+    }
+    getTokenFilePath() {
+        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? node_path.join(node_os.homedir(), ".aws", "login", "cache");
+        const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
+        const loginSessionSha256 = node_crypto.createHash("sha256").update(loginSessionBytes).digest("hex");
+        return node_path.join(directory, `${loginSessionSha256}.json`);
+    }
+    derToRawSignature(derSignature) {
+        let offset = 2;
+        if (derSignature[offset] !== 0x02) {
+            throw new Error("Invalid DER signature");
+        }
+        offset++;
+        const rLength = derSignature[offset++];
+        let r = derSignature.subarray(offset, offset + rLength);
+        offset += rLength;
+        if (derSignature[offset] !== 0x02) {
+            throw new Error("Invalid DER signature");
+        }
+        offset++;
+        const sLength = derSignature[offset++];
+        let s = derSignature.subarray(offset, offset + sLength);
+        r = r[0] === 0x00 ? r.subarray(1) : r;
+        s = s[0] === 0x00 ? s.subarray(1) : s;
+        const rPadded = Buffer.concat([Buffer.alloc(32 - r.length), r]);
+        const sPadded = Buffer.concat([Buffer.alloc(32 - s.length), s]);
+        return Buffer.concat([rPadded, sPadded]);
+    }
+    createDPoPInterceptor(middlewareStack) {
+        middlewareStack.add((next) => async (args) => {
+            if (protocolHttp.HttpRequest.isInstance(args.request)) {
+                const request = args.request;
+                const actualEndpoint = `${request.protocol}//${request.hostname}${request.port ? `:${request.port}` : ""}${request.path}`;
+                const dpop = await this.generateDpop(request.method, actualEndpoint);
+                request.headers = {
+                    ...request.headers,
+                    DPoP: dpop,
+                };
+            }
+            return next(args);
+        }, {
+            step: "finalizeRequest",
+            name: "dpopInterceptor",
+            override: true,
+        });
+    }
+    async generateDpop(method = "POST", endpoint) {
+        const token = await this.loadToken();
+        try {
+            const privateKey = node_crypto.createPrivateKey({
+                key: token.dpopKey,
+                format: "pem",
+                type: "sec1",
+            });
+            const publicKey = node_crypto.createPublicKey(privateKey);
+            const publicDer = publicKey.export({ format: "der", type: "spki" });
+            let pointStart = -1;
+            for (let i = 0; i < publicDer.length; i++) {
+                if (publicDer[i] === 0x04) {
+                    pointStart = i;
+                    break;
+                }
+            }
+            const x = publicDer.slice(pointStart + 1, pointStart + 33);
+            const y = publicDer.slice(pointStart + 33, pointStart + 65);
+            const header = {
+                alg: "ES256",
+                typ: "dpop+jwt",
+                jwk: {
+                    kty: "EC",
+                    crv: "P-256",
+                    x: x.toString("base64url"),
+                    y: y.toString("base64url"),
+                },
+            };
+            const payload = {
+                jti: crypto.randomUUID(),
+                htm: method,
+                htu: endpoint,
+                iat: Math.floor(Date.now() / 1000),
+            };
+            const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
+            const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
+            const message = `${headerB64}.${payloadB64}`;
+            const asn1Signature = node_crypto.sign("sha256", Buffer.from(message), privateKey);
+            const rawSignature = this.derToRawSignature(asn1Signature);
+            const signatureB64 = rawSignature.toString("base64url");
+            return `${message}.${signatureB64}`;
+        }
+        catch (error) {
+            throw new propertyProvider.CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
+        }
+    }
+}
+
+const fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+    init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
+    const profiles = await sharedIniFileLoader.parseKnownFiles(init || {});
+    const profileName = sharedIniFileLoader.getProfileName({
+        profile: init?.profile ?? callerClientConfig?.profile,
+    });
+    const profile = profiles[profileName];
+    if (!profile?.login_session) {
+        throw new propertyProvider.CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
+            tryNextLink: true,
+            logger: init?.logger,
+        });
+    }
+    const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);
+    const credentials = await fetcher.loadCredentials();
+    return client.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
+};
+
+exports.fromLoginCredentials = fromLoginCredentials;