@claudiolabs/claudio 0.1.11 → 0.1.13

package/dist/chunks/index-0.1.13-4cjfx282.mjs

@@ -0,0 +1 @@
+import{r6 as G}from"./cli-0.1.13-b24n1wvw.mjs";import{Jna as _,Kna as U}from"./cli-0.1.13-0hyneh5t.mjs";import{Sna as X}from"./cli-0.1.13-tknwgkgp.mjs";import{Tna as K,Vna as B,Xna as l,Yna as E}from"./cli-0.1.13-bj67mp7n.mjs";var v=B((k)=>{Object.defineProperty(k,"__esModule",{value:!0});k.resolveHttpHandlerRuntimeConfig=k.getHttpHandlerExtensionConfiguration=k.isValidHostname=k.HttpResponse=k.HttpRequest=k.Fields=k.Field=void 0;var H=X();Object.defineProperty(k,"Field",{enumerable:!0,get:function(){return H.Field}});Object.defineProperty(k,"Fields",{enumerable:!0,get:function(){return H.Fields}});Object.defineProperty(k,"HttpRequest",{enumerable:!0,get:function(){return H.HttpRequest}});Object.defineProperty(k,"HttpResponse",{enumerable:!0,get:function(){return H.HttpResponse}});Object.defineProperty(k,"isValidHostname",{enumerable:!0,get:function(){return H.isValidHostname}});Object.defineProperty(k,"getHttpHandlerExtensionConfiguration",{enumerable:!0,get:function(){return H.getHttpHandlerExtensionConfiguration}});Object.defineProperty(k,"resolveHttpHandlerRuntimeConfig",{enumerable:!0,get:function(){return H.resolveHttpHandlerRuntimeConfig}})});var J=B((C)=>{var Q=_(),T=U(),P=G(),W=v(),F=E("node:crypto"),q=E("node:fs"),Z=E("node:os"),A=E("node:path");class ${profileData;init;callerClientConfig;static REFRESH_THRESHOLD=300000;constructor(e,n,t){this.profileData=e,this.init=n,this.callerClientConfig=t}async loadCredentials(){let e=await this.loadToken();if(!e)throw new T.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});let n=e.accessToken,t=Date.now();if(new Date(n.expiresAt).getTime()-t<=$.REFRESH_THRESHOLD)return this.refresh(e);return{accessKeyId:n.accessKeyId,secretAccessKey:n.secretAccessKey,sessionToken:n.sessionToken,accountId:n.accountId,expiration:new Date(n.expiresAt)}}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}async refresh(e){let{SigninClient:n,CreateOAuth2TokenCommand:t}=await import("./index-0.1.13-tvt8fxrq.mjs").then((m)=>K(m.default)),{logger:s,userAgentAppId:c}=this.callerClientConfig??{},r=((h)=>{return h?.metadata?.handlerProtocol==="h2"})(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,a=this.profileData.region??await this.callerClientConfig?.region?.()??process.env.AWS_REGION,i=new n({credentials:{accessKeyId:"",secretAccessKey:""},region:a,requestHandler:r,logger:s,userAgentAppId:c,...this.init?.clientConfig});this.createDPoPInterceptor(i.middlewareStack);let x={tokenInput:{clientId:e.clientId,refreshToken:e.refreshToken,grantType:"refresh_token"}};try{let h=await i.send(new t(x)),{accessKeyId:y,secretAccessKey:d,sessionToken:I}=h.tokenOutput?.accessToken??{},{refreshToken:S,expiresIn:m}=h.tokenOutput??{};if(!y||!d||!I||!S)throw new T.CredentialsProviderError("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});let R=(m??900)*1000,b=new Date(Date.now()+R),j={...e,accessToken:{...e.accessToken,accessKeyId:y,secretAccessKey:d,sessionToken:I,expiresAt:b.toISOString()},refreshToken:S};await this.saveToken(j);let o=j.accessToken;return{accessKeyId:o.accessKeyId,secretAccessKey:o.secretAccessKey,sessionToken:o.sessionToken,accountId:o.accountId,expiration:b}}catch(h){if(h.name==="AccessDeniedException"){let y=h.error,d;switch(y){case"TOKEN_EXPIRED":d="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":d="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":d="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:d=`Failed to refresh token: ${String(h)}. Please re-authenticate using \`aws login\``}throw new T.CredentialsProviderError(d,{logger:this.logger,tryNextLink:!1})}throw new T.CredentialsProviderError(`Failed to refresh token: ${String(h)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){let e=this.getTokenFilePath();try{let n;try{n=await P.readFile(e,{ignoreCache:this.init?.ignoreCache})}catch{n=await q.promises.readFile(e,"utf8")}let t=JSON.parse(n),s=["accessToken","clientId","refreshToken","dpopKey"].filter((c)=>!t[c]);if(!t.accessToken?.accountId)s.push("accountId");if(s.length>0)throw new T.CredentialsProviderError(`Token validation failed, missing fields: ${s.join(", ")}`,{logger:this.logger,tryNextLink:!1});return t}catch(n){throw new T.CredentialsProviderError(`Failed to load token from ${e}: ${String(n)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(e){let n=this.getTokenFilePath(),t=A.dirname(n);try{await q.promises.mkdir(t,{recursive:!0})}catch(s){}await q.promises.writeFile(n,JSON.stringify(e,null,2),"utf8")}getTokenFilePath(){let e=process.env.AWS_LOGIN_CACHE_DIRECTORY??A.join(Z.homedir(),".aws","login","cache"),n=Buffer.from(this.loginSession,"utf8"),t=F.createHash("sha256").update(n).digest("hex");return A.join(e,`${t}.json`)}derToRawSignature(e){let n=2;if(e[n]!==2)throw Error("Invalid DER signature");n++;let t=e[n++],s=e.subarray(n,n+t);if(n+=t,e[n]!==2)throw Error("Invalid DER signature");n++;let c=e[n++],u=e.subarray(n,n+c);s=s[0]===0?s.subarray(1):s,u=u[0]===0?u.subarray(1):u;let r=Buffer.concat([Buffer.alloc(32-s.length),s]),a=Buffer.concat([Buffer.alloc(32-u.length),u]);return Buffer.concat([r,a])}createDPoPInterceptor(e){e.add((n)=>async(t)=>{if(W.HttpRequest.isInstance(t.request)){let s=t.request,c=`${s.protocol}//${s.hostname}${s.port?`:${s.port}`:""}${s.path}`,u=await this.generateDpop(s.method,c);s.headers={...s.headers,DPoP:u}}return n(t)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(e="POST",n){let t=await this.loadToken();try{let s=F.createPrivateKey({key:t.dpopKey,format:"pem",type:"sec1"}),u=F.createPublicKey(s).export({format:"der",type:"spki"}),r=-1;for(let b=0;b<u.length;b++)if(u[b]===4){r=b;break}let a=u.slice(r+1,r+33),i=u.slice(r+33,r+65),x={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:a.toString("base64url"),y:i.toString("base64url")}},h={jti:crypto.randomUUID(),htm:e,htu:n,iat:Math.floor(Date.now()/1000)},y=Buffer.from(JSON.stringify(x)).toString("base64url"),d=Buffer.from(JSON.stringify(h)).toString("base64url"),I=`${y}.${d}`,S=F.sign("sha256",Buffer.from(I),s),R=this.derToRawSignature(S).toString("base64url");return`${I}.${R}`}catch(s){throw new T.CredentialsProviderError(`Failed to generate Dpop proof: ${s instanceof Error?s.message:String(s)}`,{logger:this.logger,tryNextLink:!1})}}}var N=(e)=>async({callerClientConfig:n}={})=>{e?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");let t=await P.parseKnownFiles(e||{}),s=P.getProfileName({profile:e?.profile??n?.profile}),c=t[s];if(!c?.login_session)throw new T.CredentialsProviderError(`Profile ${s} does not contain login_session.`,{tryNextLink:!0,logger:e?.logger});let r=await new $(c,e,n).loadCredentials();return Q.setCredentialFeature(r,"CREDENTIALS_LOGIN","AD")};C.fromLoginCredentials=N});var L,O,w,p,ee=(e,n,t)=>{let s={EcsContainer:async(c)=>{let{fromHttp:u}=await import("./index-0.1.13-c29wq5dx.mjs").then((m)=>K(m.default,1)),{fromContainerMetadata:r}=await import("./index-0.1.13-7c5y7cbf.mjs");return t?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer"),async()=>O.chain(u(c??{}),r(c))().then(D)},Ec2InstanceMetadata:async(c)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");let{fromInstanceMetadata:u}=await import("./index-0.1.13-7c5y7cbf.mjs");return async()=>u(c)().then(D)},Environment:async(c)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");let{fromEnv:u}=await import("./index-0.1.13-qjt3h799.mjs");return async()=>u(c)().then(D)}};if(e in s)return s[e];else throw new O.CredentialsProviderError(`Unsupported credential source in profile ${n}. Got ${e}, expected EcsContainer or Ec2InstanceMetadata or Environment.`,{logger:t})},D=(e)=>w.setCredentialFeature(e,"CREDENTIALS_PROFILE_NAMED_PROVIDER","p"),te=(e,{profile:n="default",logger:t}={})=>{return Boolean(e)&&typeof e==="object"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1&&["undefined","string"].indexOf(typeof e.external_id)>-1&&["undefined","string"].indexOf(typeof e.mfa_serial)>-1&&(ne(e,{profile:n,logger:t})||se(e,{profile:n,logger:t}))},ne=(e,{profile:n,logger:t})=>{let s=typeof e.source_profile==="string"&&typeof e.credential_source>"u";if(s)t?.debug?.(`    ${n} isAssumeRoleWithSourceProfile source_profile=${e.source_profile}`);return s},se=(e,{profile:n,logger:t})=>{let s=typeof e.credential_source==="string"&&typeof e.source_profile>"u";if(s)t?.debug?.(`    ${n} isCredentialSourceProfile credential_source=${e.credential_source}`);return s},re=async(e,n,t,s,c={},u)=>{t.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");let r=n[e],{source_profile:a,region:i}=r;if(!t.roleAssumer){let{getDefaultRoleAssumer:h}=await import("./index-0.1.13-m9m61529.mjs").then((m)=>K(m.default,1));t.roleAssumer=h({...t.clientConfig,credentialProviderLogger:t.logger,parentClientConfig:{...s,...t?.parentClientConfig,region:i??t?.parentClientConfig?.region??s?.region}},t.clientPlugins)}if(a&&a in c)throw new O.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${L.getProfileName(t)}. Profiles visited: `+Object.keys(c).join(", "),{logger:t.logger});t.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${a?`source_profile=[${a}]`:`profile=[${e}]`}`);let x=a?u(a,n,t,s,{...c,[a]:!0},V(n[a]??{})):(await ee(r.credential_source,e,t.logger)(t))();if(V(r))return x.then((h)=>w.setCredentialFeature(h,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"));else{let h={RoleArn:r.role_arn,RoleSessionName:r.role_session_name||`aws-sdk-js-${Date.now()}`,ExternalId:r.external_id,DurationSeconds:parseInt(r.duration_seconds||"3600",10)},{mfa_serial:y}=r;if(y){if(!t.mfaCodeProvider)throw new O.CredentialsProviderError(`Profile ${e} requires multi-factor authentication, but no MFA code callback was provided.`,{logger:t.logger,tryNextLink:!1});h.SerialNumber=y,h.TokenCode=await t.mfaCodeProvider(y)}let d=await x;return t.roleAssumer(d,h).then((I)=>w.setCredentialFeature(I,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"))}},V=(e)=>{return!e.role_arn&&!!e.credential_source},ce=(e)=>{return Boolean(e&&e.login_session)},ue=async(e,n,t)=>{let s=await p.fromLoginCredentials({...n,profile:e})({callerClientConfig:t});return w.setCredentialFeature(s,"CREDENTIALS_PROFILE_LOGIN","AC")},he=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.credential_process==="string",ae=async(e,n)=>import("./index-0.1.13-bc4sh2m1.mjs").then(({fromProcess:t})=>t({...e,profile:n})().then((s)=>w.setCredentialFeature(s,"CREDENTIALS_PROFILE_PROCESS","v"))),de=async(e,n,t={},s)=>{let{fromSSO:c}=await import("./index-0.1.13-a06q9ad9.mjs");return c({profile:e,logger:t.logger,parentClientConfig:t.parentClientConfig,clientConfig:t.clientConfig})({callerClientConfig:s}).then((u)=>{if(n.sso_session)return w.setCredentialFeature(u,"CREDENTIALS_PROFILE_SSO","r");else return w.setCredentialFeature(u,"CREDENTIALS_PROFILE_SSO_LEGACY","t")})},ye=(e)=>e&&(typeof e.sso_start_url==="string"||typeof e.sso_account_id==="string"||typeof e.sso_session==="string"||typeof e.sso_region==="string"||typeof e.sso_role_name==="string"),Y=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.aws_access_key_id==="string"&&typeof e.aws_secret_access_key==="string"&&["undefined","string"].indexOf(typeof e.aws_session_token)>-1&&["undefined","string"].indexOf(typeof e.aws_account_id)>-1,g=async(e,n)=>{n?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");let t={accessKeyId:e.aws_access_key_id,secretAccessKey:e.aws_secret_access_key,sessionToken:e.aws_session_token,...e.aws_credential_scope&&{credentialScope:e.aws_credential_scope},...e.aws_account_id&&{accountId:e.aws_account_id}};return w.setCredentialFeature(t,"CREDENTIALS_PROFILE","n")},ke=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.web_identity_token_file==="string"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1,we=async(e,n,t)=>import("./index-0.1.13-j9c4bjzh.mjs").then((m)=>K(m.default,1)).then(({fromTokenFile:s})=>s({webIdentityTokenFile:e.web_identity_token_file,roleArn:e.role_arn,roleSessionName:e.role_session_name,roleAssumerWithWebIdentity:n.roleAssumerWithWebIdentity,logger:n.logger,parentClientConfig:n.parentClientConfig})({callerClientConfig:t}).then((c)=>w.setCredentialFeature(c,"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN","q"))),z=async(e,n,t,s,c={},u=!1)=>{let r=n[e];if(Object.keys(c).length>0&&Y(r))return g(r,t);if(u||te(r,{profile:e,logger:t.logger}))return re(e,n,t,s,c,z);if(Y(r))return g(r,t);if(ke(r))return we(r,t,s);if(he(r))return ae(t,e);if(ye(r))return await de(e,r,t,s);if(ce(r))return ue(e,t,s);throw new O.CredentialsProviderError(`Could not resolve credentials using profile: [${e}] in configuration/credentials file(s).`,{logger:t.logger})},Te=(e={})=>async({callerClientConfig:n}={})=>{e.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");let t=await L.parseKnownFiles(e);return z(L.getProfileName({profile:e.profile??n?.profile}),t,e,n)},Ee;var Ie=l(()=>{L=G(),O=U(),w=_(),p=J();Ee=Te});Ie();export{Ee as fromIni};export default {get fromIni(){return Ee}};