@claudiolabs/claudio 0.1.10 → 0.1.11

package/dist/chunks/index-0.1.11-ajdpkanw.mjs

@@ -0,0 +1 @@
+import{vna as N}from"./cli-0.1.11-0qwee9gy.mjs";import{Hna as C}from"./cli-0.1.11-10nmrfsz.mjs";import{Lna as g}from"./cli-0.1.11-n23d2wej.mjs";import{Nna as b,Pna as Y,Rna as Fe,Sna as w}from"./cli-0.1.11-yrfxpjhr.mjs";var V=Y((he)=>{he.HttpAuthLocation=void 0;(function(e){e.HEADER="header",e.QUERY="query"})(he.HttpAuthLocation||(he.HttpAuthLocation={}));he.HttpApiKeyAuthLocation=void 0;(function(e){e.HEADER="header",e.QUERY="query"})(he.HttpApiKeyAuthLocation||(he.HttpApiKeyAuthLocation={}));he.EndpointURLScheme=void 0;(function(e){e.HTTP="http",e.HTTPS="https"})(he.EndpointURLScheme||(he.EndpointURLScheme={}));he.AlgorithmId=void 0;(function(e){e.MD5="md5",e.CRC32="crc32",e.CRC32C="crc32c",e.SHA1="sha1",e.SHA256="sha256"})(he.AlgorithmId||(he.AlgorithmId={}));var ee=(e)=>{let t=[];if(e.sha256!==void 0)t.push({algorithmId:()=>he.AlgorithmId.SHA256,checksumConstructor:()=>e.sha256});if(e.md5!=null)t.push({algorithmId:()=>he.AlgorithmId.MD5,checksumConstructor:()=>e.md5});return{addChecksumAlgorithm(s){t.push(s)},checksumAlgorithms(){return t}}},te=(e)=>{let t={};return e.checksumAlgorithms().forEach((s)=>{t[s.algorithmId()]=s.checksumConstructor()}),t},se=(e)=>{return ee(e)},ce=(e)=>{return te(e)};he.FieldPosition=void 0;(function(e){e[e.HEADER=0]="HEADER",e[e.TRAILER=1]="TRAILER"})(he.FieldPosition||(he.FieldPosition={}));var ne="__smithy_context";he.IniSectionType=void 0;(function(e){e.PROFILE="profile",e.SSO_SESSION="sso-session",e.SERVICES="services"})(he.IniSectionType||(he.IniSectionType={}));he.RequestHandlerProtocol=void 0;(function(e){e.HTTP_0_9="http/0.9",e.HTTP_1_0="http/1.0",e.TDS_8_0="tds/8.0"})(he.RequestHandlerProtocol||(he.RequestHandlerProtocol={}));he.SMITHY_CONTEXT_KEY=ne;he.getDefaultClientConfiguration=se;he.resolveDefaultRuntimeConfig=ce});var v=Y((xe)=>{var de=V(),ke=(e)=>{return{setHttpHandler(t){e.httpHandler=t},httpHandler(){return e.httpHandler},updateHttpClientConfig(t,s){e.httpHandler?.updateHttpClientConfig(t,s)},httpHandlerConfigs(){return e.httpHandler.httpHandlerConfigs()}}},Te=(e)=>{return{httpHandler:e.httpHandler()}};class W{name;kind;values;constructor({name:e,kind:t=de.FieldPosition.HEADER,values:s=[]}){this.name=e,this.kind=t,this.values=s}add(e){this.values.push(e)}set(e){this.values=e}remove(e){this.values=this.values.filter((t)=>t!==e)}toString(){return this.values.map((e)=>e.includes(",")||e.includes(" ")?`"${e}"`:e).join(", ")}get(){return this.values}}class Z{entries={};encoding;constructor({fields:e=[],encoding:t="utf-8"}){e.forEach(this.setField.bind(this)),this.encoding=t}setField(e){this.entries[e.name.toLowerCase()]=e}getField(e){return this.entries[e.toLowerCase()]}removeField(e){delete this.entries[e.toLowerCase()]}getByType(e){return Object.values(this.entries).filter((t)=>t.kind===e)}}class K{method;protocol;hostname;port;path;query;headers;username;password;fragment;body;constructor(e){this.method=e.method||"GET",this.hostname=e.hostname||"localhost",this.port=e.port,this.query=e.query||{},this.headers=e.headers||{},this.body=e.body,this.protocol=e.protocol?e.protocol.slice(-1)!==":"?`${e.protocol}:`:e.protocol:"https:",this.path=e.path?e.path.charAt(0)!=="/"?`/${e.path}`:e.path:"/",this.username=e.username,this.password=e.password,this.fragment=e.fragment}static clone(e){let t=new K({...e,headers:{...e.headers}});if(t.query)t.query=Ee(t.query);return t}static isInstance(e){if(!e)return!1;let t=e;return"method"in t&&"protocol"in t&&"hostname"in t&&"path"in t&&typeof t.query==="object"&&typeof t.headers==="object"}clone(){return K.clone(this)}}function Ee(e){return Object.keys(e).reduce((t,s)=>{let c=e[s];return{...t,[s]:Array.isArray(c)?[...c]:c}},{})}class q{statusCode;reason;headers;body;constructor(e){this.statusCode=e.statusCode,this.reason=e.reason,this.headers=e.headers||{},this.body=e.body}static isInstance(e){if(!e)return!1;let t=e;return typeof t.statusCode==="number"&&typeof t.headers==="object"}}function we(e){return/^[a-z0-9][a-z0-9\.\-]*[a-z0-9]$/.test(e)}xe.Field=W;xe.Fields=Z;xe.HttpRequest=K;xe.HttpResponse=q;xe.getHttpHandlerExtensionConfiguration=ke;xe.isValidHostname=we;xe.resolveHttpHandlerRuntimeConfig=Te});var i=Y((_e)=>{var Ke=C(),E=g(),G=N(),Le=v(),L=w("node:crypto"),j=w("node:fs"),be=w("node:os"),m=w("node:path");class J{profileData;init;callerClientConfig;static REFRESH_THRESHOLD=300000;constructor(e,t,s){this.profileData=e,this.init=t,this.callerClientConfig=s}async loadCredentials(){let e=await this.loadToken();if(!e)throw new E.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});let t=e.accessToken,s=Date.now();if(new Date(t.expiresAt).getTime()-s<=J.REFRESH_THRESHOLD)return this.refresh(e);return{accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,accountId:t.accountId,expiration:new Date(t.expiresAt)}}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}async refresh(e){let{SigninClient:t,CreateOAuth2TokenCommand:s}=await import("./index-0.1.11-xs4mng75.mjs").then((m)=>b(m.default)),{logger:c,userAgentAppId:h}=this.callerClientConfig??{},n=((u)=>{return u?.metadata?.handlerProtocol==="h2"})(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,y=this.profileData.region??await this.callerClientConfig?.region?.()??process.env.AWS_REGION,a=new t({credentials:{accessKeyId:"",secretAccessKey:""},region:y,requestHandler:n,logger:c,userAgentAppId:h,...this.init?.clientConfig});this.createDPoPInterceptor(a.middlewareStack);let S={tokenInput:{clientId:e.clientId,refreshToken:e.refreshToken,grantType:"refresh_token"}};try{let u=await a.send(new s(S)),{accessKeyId:k,secretAccessKey:d,sessionToken:x}=u.tokenOutput?.accessToken??{},{refreshToken:D,expiresIn:Q}=u.tokenOutput??{};if(!k||!d||!x||!D)throw new E.CredentialsProviderError("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});let O=(Q??900)*1000,I=new Date(Date.now()+O),z={...e,accessToken:{...e.accessToken,accessKeyId:k,secretAccessKey:d,sessionToken:x,expiresAt:I.toISOString()},refreshToken:D};await this.saveToken(z);let H=z.accessToken;return{accessKeyId:H.accessKeyId,secretAccessKey:H.secretAccessKey,sessionToken:H.sessionToken,accountId:H.accountId,expiration:I}}catch(u){if(u.name==="AccessDeniedException"){let k=u.error,d;switch(k){case"TOKEN_EXPIRED":d="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":d="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":d="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:d=`Failed to refresh token: ${String(u)}. Please re-authenticate using \`aws login\``}throw new E.CredentialsProviderError(d,{logger:this.logger,tryNextLink:!1})}throw new E.CredentialsProviderError(`Failed to refresh token: ${String(u)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){let e=this.getTokenFilePath();try{let t;try{t=await G.readFile(e,{ignoreCache:this.init?.ignoreCache})}catch{t=await j.promises.readFile(e,"utf8")}let s=JSON.parse(t),c=["accessToken","clientId","refreshToken","dpopKey"].filter((h)=>!s[h]);if(!s.accessToken?.accountId)c.push("accountId");if(c.length>0)throw new E.CredentialsProviderError(`Token validation failed, missing fields: ${c.join(", ")}`,{logger:this.logger,tryNextLink:!1});return s}catch(t){throw new E.CredentialsProviderError(`Failed to load token from ${e}: ${String(t)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(e){let t=this.getTokenFilePath(),s=m.dirname(t);try{await j.promises.mkdir(s,{recursive:!0})}catch(c){}await j.promises.writeFile(t,JSON.stringify(e,null,2),"utf8")}getTokenFilePath(){let e=process.env.AWS_LOGIN_CACHE_DIRECTORY??m.join(be.homedir(),".aws","login","cache"),t=Buffer.from(this.loginSession,"utf8"),s=L.createHash("sha256").update(t).digest("hex");return m.join(e,`${s}.json`)}derToRawSignature(e){let t=2;if(e[t]!==2)throw Error("Invalid DER signature");t++;let s=e[t++],c=e.subarray(t,t+s);if(t+=s,e[t]!==2)throw Error("Invalid DER signature");t++;let h=e[t++],r=e.subarray(t,t+h);c=c[0]===0?c.subarray(1):c,r=r[0]===0?r.subarray(1):r;let n=Buffer.concat([Buffer.alloc(32-c.length),c]),y=Buffer.concat([Buffer.alloc(32-r.length),r]);return Buffer.concat([n,y])}createDPoPInterceptor(e){e.add((t)=>async(s)=>{if(Le.HttpRequest.isInstance(s.request)){let c=s.request,h=`${c.protocol}//${c.hostname}${c.port?`:${c.port}`:""}${c.path}`,r=await this.generateDpop(c.method,h);c.headers={...c.headers,DPoP:r}}return t(s)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(e="POST",t){let s=await this.loadToken();try{let c=L.createPrivateKey({key:s.dpopKey,format:"pem",type:"sec1"}),r=L.createPublicKey(c).export({format:"der",type:"spki"}),n=-1;for(let I=0;I<r.length;I++)if(r[I]===4){n=I;break}let y=r.slice(n+1,n+33),a=r.slice(n+33,n+65),S={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:y.toString("base64url"),y:a.toString("base64url")}},u={jti:crypto.randomUUID(),htm:e,htu:t,iat:Math.floor(Date.now()/1000)},k=Buffer.from(JSON.stringify(S)).toString("base64url"),d=Buffer.from(JSON.stringify(u)).toString("base64url"),x=`${k}.${d}`,D=L.sign("sha256",Buffer.from(x),c),O=this.derToRawSignature(D).toString("base64url");return`${x}.${O}`}catch(c){throw new E.CredentialsProviderError(`Failed to generate Dpop proof: ${c instanceof Error?c.message:String(c)}`,{logger:this.logger,tryNextLink:!1})}}}var Oe=(e)=>async({callerClientConfig:t}={})=>{e?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");let s=await G.parseKnownFiles(e||{}),c=G.getProfileName({profile:e?.profile??t?.profile}),h=s[c];if(!h?.login_session)throw new E.CredentialsProviderError(`Profile ${c} does not contain login_session.`,{tryNextLink:!0,logger:e?.logger});let n=await new J(h,e,t).loadCredentials();return Ke.setCredentialFeature(n,"CREDENTIALS_LOGIN","AD")};_e.fromLoginCredentials=Oe});var X,R,T,Pe,Be=(e,t,s)=>{let c={EcsContainer:async(h)=>{let{fromHttp:r}=await import("./index-0.1.11-e52dzxjz.mjs").then((m)=>b(m.default,1)),{fromContainerMetadata:n}=await import("./index-0.1.11-yej3awws.mjs");return s?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer"),async()=>R.chain(r(h??{}),n(h))().then(M)},Ec2InstanceMetadata:async(h)=>{s?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");let{fromInstanceMetadata:r}=await import("./index-0.1.11-yej3awws.mjs");return async()=>r(h)().then(M)},Environment:async(h)=>{s?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");let{fromEnv:r}=await import("./index-0.1.11-kksxmkwe.mjs");return async()=>r(h)().then(M)}};if(e in c)return c[e];else throw new R.CredentialsProviderError(`Unsupported credential source in profile ${t}. Got ${e}, expected EcsContainer or Ec2InstanceMetadata or Environment.`,{logger:s})},M=(e)=>T.setCredentialFeature(e,"CREDENTIALS_PROFILE_NAMED_PROVIDER","p"),Ue=(e,{profile:t="default",logger:s}={})=>{return Boolean(e)&&typeof e==="object"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1&&["undefined","string"].indexOf(typeof e.external_id)>-1&&["undefined","string"].indexOf(typeof e.mfa_serial)>-1&&(Ye(e,{profile:t,logger:s})||je(e,{profile:t,logger:s}))},Ye=(e,{profile:t,logger:s})=>{let c=typeof e.source_profile==="string"&&typeof e.credential_source>"u";if(c)s?.debug?.(`    ${t} isAssumeRoleWithSourceProfile source_profile=${e.source_profile}`);return c},je=(e,{profile:t,logger:s})=>{let c=typeof e.credential_source==="string"&&typeof e.source_profile>"u";if(c)s?.debug?.(`    ${t} isCredentialSourceProfile credential_source=${e.credential_source}`);return c},me=async(e,t,s,c,h={},r)=>{s.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");let n=t[e],{source_profile:y,region:a}=n;if(!s.roleAssumer){let{getDefaultRoleAssumer:u}=await import("./index-0.1.11-qspcw49p.mjs").then((m)=>b(m.default,1));s.roleAssumer=u({...s.clientConfig,credentialProviderLogger:s.logger,parentClientConfig:{...c,...s?.parentClientConfig,region:a??s?.parentClientConfig?.region??c?.region}},s.clientPlugins)}if(y&&y in h)throw new R.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${X.getProfileName(s)}. Profiles visited: `+Object.keys(h).join(", "),{logger:s.logger});s.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${y?`source_profile=[${y}]`:`profile=[${e}]`}`);let S=y?r(y,t,s,c,{...h,[y]:!0},f(t[y]??{})):(await Be(n.credential_source,e,s.logger)(s))();if(f(n))return S.then((u)=>T.setCredentialFeature(u,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"));else{let u={RoleArn:n.role_arn,RoleSessionName:n.role_session_name||`aws-sdk-js-${Date.now()}`,ExternalId:n.external_id,DurationSeconds:parseInt(n.duration_seconds||"3600",10)},{mfa_serial:k}=n;if(k){if(!s.mfaCodeProvider)throw new R.CredentialsProviderError(`Profile ${e} requires multi-factor authentication, but no MFA code callback was provided.`,{logger:s.logger,tryNextLink:!1});u.SerialNumber=k,u.TokenCode=await s.mfaCodeProvider(k)}let d=await S;return s.roleAssumer(d,u).then((x)=>T.setCredentialFeature(x,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"))}},f=(e)=>{return!e.role_arn&&!!e.credential_source},Ge=(e)=>{return Boolean(e&&e.login_session)},Je=async(e,t,s)=>{let c=await Pe.fromLoginCredentials({...t,profile:e})({callerClientConfig:s});return T.setCredentialFeature(c,"CREDENTIALS_PROFILE_LOGIN","AC")},Me=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.credential_process==="string",Xe=async(e,t)=>import("./index-0.1.11-bhrstsgc.mjs").then(({fromProcess:s})=>s({...e,profile:t})().then((c)=>T.setCredentialFeature(c,"CREDENTIALS_PROFILE_PROCESS","v"))),Qe=async(e,t,s={},c)=>{let{fromSSO:h}=await import("./index-0.1.11-gb3saayk.mjs");return h({profile:e,logger:s.logger,parentClientConfig:s.parentClientConfig,clientConfig:s.clientConfig})({callerClientConfig:c}).then((r)=>{if(t.sso_session)return T.setCredentialFeature(r,"CREDENTIALS_PROFILE_SSO","r");else return T.setCredentialFeature(r,"CREDENTIALS_PROFILE_SSO_LEGACY","t")})},ze=(e)=>e&&(typeof e.sso_start_url==="string"||typeof e.sso_account_id==="string"||typeof e.sso_session==="string"||typeof e.sso_region==="string"||typeof e.sso_role_name==="string"),o=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.aws_access_key_id==="string"&&typeof e.aws_secret_access_key==="string"&&["undefined","string"].indexOf(typeof e.aws_session_token)>-1&&["undefined","string"].indexOf(typeof e.aws_account_id)>-1,l=async(e,t)=>{t?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");let s={accessKeyId:e.aws_access_key_id,secretAccessKey:e.aws_secret_access_key,sessionToken:e.aws_session_token,...e.aws_credential_scope&&{credentialScope:e.aws_credential_scope},...e.aws_account_id&&{accountId:e.aws_account_id}};return T.setCredentialFeature(s,"CREDENTIALS_PROFILE","n")},Ve=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.web_identity_token_file==="string"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1,We=async(e,t,s)=>import("./index-0.1.11-wze82293.mjs").then((m)=>b(m.default,1)).then(({fromTokenFile:c})=>c({webIdentityTokenFile:e.web_identity_token_file,roleArn:e.role_arn,roleSessionName:e.role_session_name,roleAssumerWithWebIdentity:t.roleAssumerWithWebIdentity,logger:t.logger,parentClientConfig:t.parentClientConfig})({callerClientConfig:s}).then((h)=>T.setCredentialFeature(h,"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN","q"))),p=async(e,t,s,c,h={},r=!1)=>{let n=t[e];if(Object.keys(h).length>0&&o(n))return l(n,s);if(r||Ue(n,{profile:e,logger:s.logger}))return me(e,t,s,c,h,p);if(o(n))return l(n,s);if(Ve(n))return We(n,s,c);if(Me(n))return Xe(s,e);if(ze(n))return await Qe(e,n,s,c);if(Ge(n))return Je(e,s,c);throw new R.CredentialsProviderError(`Could not resolve credentials using profile: [${e}] in configuration/credentials file(s).`,{logger:s.logger})},Ze=(e={})=>async({callerClientConfig:t}={})=>{e.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");let s=await X.parseKnownFiles(e);return p(X.getProfileName({profile:e.profile??t?.profile}),s,e,t)},qe;var ve=Fe(()=>{X=N(),R=g(),T=C(),Pe=i();qe=Ze});ve();export{qe as fromIni};export default {get fromIni(){return qe}};